GlobalConfig.net» SNPA http://globalconfig.net Studying for Network Certifications Sat, 24 Dec 2011 02:07:50 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Studying for Network Certifications GlobalConfig.net no Studying for Network Certifications GlobalConfig.net» SNPA http://globalconfig.net/wp-content/plugins/powerpress/rss_default.jpg http://globalconfig.net/category/snpa/ Take IPhone Screenshots http://globalconfig.net/ccie-security/take-iphone-screenshots/ http://globalconfig.net/ccie-security/take-iphone-screenshots/#comments Sat, 10 Jan 2009 17:17:07 +0000 Brandon Carroll, CCIE #23837 http://www.globalconfig.net/?p=653 You probably know this already but believe it or not…my wife showed me this morning how to take screen shots with the iphone.  Siimple press the home and power button at the same time.  The screen will flash and you are good to go…

img_0003

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccie-security/take-iphone-screenshots/feed/ 1 Per-Flow Policing on ASA VPN http://globalconfig.net/ccie-security/per-flow-policing-on-asa-vpn/ http://globalconfig.net/ccie-security/per-flow-policing-on-asa-vpn/#comments Tue, 16 Dec 2008 08:11:07 +0000 Brandon Carroll, CCIE #23837 http://www.globalconfig.net/?p=591 Tonight I worked on the ASA Per-flow policing.  The configuration is fairly straight forward.  After ensuring that the VPN works create a class-map to match the tunnel-group and the destination-address like so: 
class-map vpn_data
match flow ip destination-address
match tunnel-group ezvpn
Next create the policy map to police based on the class we just created: 
policy-map outside
class vpn_voice
priority
class vpn_data
police output 256000
class class-default
police output 2000000
Finally activate it on the interface: 
service-policy outside interface outside
So while that is pretty simple I did come across a gotcha.  In the IE lab workbook volume 1 it has you create a class-map for vpn_voice, match dscp=ef and the same tunnel-group.  It then wants to apply priority queueing to it.  Here is where it could cause some issues.  When you apply the policy-map to the interface with the priority command configured for a class it give you a really nice error: 
asa1(config-pmap-c)# service-policy outside int outside
ERROR: Class vpn_voice has 'priority' set
without 'priority-queue' in any interface
A quick show service-policy indicates that it was not actually enabled: 
asa1(config)# sh service-policy



Global policy:
Service-policy: global_policy
Class-map: inspection_default
Inspect: dns preset_dns_map, packet 0, drop 0, reset-drop 0
Inspect: ftp, packet 0, drop 0, reset-drop 0
Inspect: h323 h225 _default_h323_map, packet 0, drop 0, reset-drop 0
Inspect: h323 ras _default_h323_map, packet 0, drop 0, reset-drop 0
Inspect: netbios, packet 0, drop 0, reset-drop 0
Inspect: rsh, packet 0, drop 0, reset-drop 0
Inspect: rtsp, packet 0, drop 0, reset-drop 0
Inspect: skinny, packet 0, drop 0, reset-drop 0
Inspect: esmtp _default_esmtp_map, packet 0, drop 0, reset-drop 0
Inspect: sqlnet, packet 0, drop 0, reset-drop 0
Inspect: sunrpc, packet 0, drop 0, reset-drop 0
Inspect: tftp, packet 0, drop 0, reset-drop 0
Inspect: sip, packet 0, drop 0, reset-drop 0
Inspect: xdmcp, packet 0, drop 0, reset-drop 0
So watch out!

TIP: 

if you are telling a class that it should priority queue packets
 you need to enable the priority queue on that interface:



asa1(config-if)# priority-queue outside
asa1(config-priority-queue)#

Related Posts:

]]> http://globalconfig.net/ccie-security/per-flow-policing-on-asa-vpn/feed/ 0 Static Route Tracking with ASA 8.x http://globalconfig.net/ccie-security/static-route-tracking/ http://globalconfig.net/ccie-security/static-route-tracking/#comments Fri, 24 Oct 2008 03:44:05 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=458 For a few days now I have been playing with static route tracking in my SNAF class.  The class is running ASA 8.0 (2).  After reading every document I can find and testing in my lab I have concluded that version 8.0 (2) does not work.  Now I can’t find a bug report on it, but i tested it over and over again.

Finally I decided to upgrade to code 8.0 (3).  Success!  Below is what I did to test and the results:

To begin, here is the topology:

static route tracking
Uploaded with plasq‘s Skitch!

First I set up the interfaces:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 192.168.6.2 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 10.0.6.1 255.255.255.0
!
interface GigabitEthernet0/2
nameif backup
security-level 0
ip address 192.168.5.25 255.255.255.0
!

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccie-security/static-route-tracking/feed/ 4 Changes to this Blog… http://globalconfig.net/security/ips/changes-to-this-blog/ http://globalconfig.net/security/ips/changes-to-this-blog/#comments Sat, 19 Jul 2008 05:32:48 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/07/18/changes-to-this-blog/ First off I want to thank all of you that follow this blog, either by being subscribed via email, subscribed via RSS, or just as regular vistors to www.globalconfig.net.  In the few months that I have been running this site I have seen it go from 0 to nearly 100 subscribers and about 2,000 views a week.  I wanted to take a few minutes to share some information with you about the changed I plan on making to this blog, as well as the addition of my personal blog found at http://cciestudy.brandonjcarroll.com. 

When i first started this blog I was really planning on using it just for the conveyance of information to my students, seeing as I am a Cisco Certified Instructor.  I eventually started writing about my studies in pursuit of the CCIE Security.  In an effort to add a little differentiation I have decided to move my personal CCIE study blogging to http://cciestudy.brandonjcarroll.com and keep this site for tips, tutorials, and more for the benefit of my students. 

Once I have passed the CCIE Security I will begin posting tips on this blog for those that are studying for the CCIE Security.  For now I will dedicate this blog to my students benefit and mostly write about the CCNA, CCNP, CCSP, and CCNA Specializations, all certifications that I hold, have held, or am considered “Certified” in. 

As I get better at video tutorials I plan on perhaps including them on a more regular basis.  For now, I will post a CCNA tip each week, and will discuss the other certifications as they come up either in my classes or as you, the readers, post comments and ask questions.

If you are following me for my CCIE studies or for anything related to the CCIE please visit my site at http://cciestudy.brandonjcarroll.com and subscribe to my feed there.  Continue to follow this site as well as It will also contain valuable information for your studies. 

Your comments are always welcome and I look forward to hearing from you.

Brandon Carroll

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/security/ips/changes-to-this-blog/feed/ 0 Video: Accessing ASDM 6.x http://globalconfig.net/ccsp-study/video-accessing-asdm-6x/ http://globalconfig.net/ccsp-study/video-accessing-asdm-6x/#comments Tue, 03 Jun 2008 16:24:00 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/06/03/video-accessing-asdm-6x/ Here is a quick video on how to access ASDM 6.x.  Please leave a comment to let me know what you think or even to submit requests.  Thanks and Enjoy!

Download accessing_asdm_version_6.x (H264).mov


Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccsp-study/video-accessing-asdm-6x/feed/ 0 Video: Installing ASDM 6.x http://globalconfig.net/ccsp-study/video-installing-asdm-6x/ http://globalconfig.net/ccsp-study/video-installing-asdm-6x/#comments Tue, 03 Jun 2008 06:23:32 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/06/02/video-installing-asdm-6x/ Here is a quick video of how to upgrade to ASDM 6.x on an ASA.  Please leave a comment with any suggestions or just to let me know what you think.  Thanks and Enjoy.

Download upgrading_to_asdm_6.x (H264).mov




Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccsp-study/video-installing-asdm-6x/feed/ 0 Quick Video on How to upgrade to ASA 8.x from 7.2 http://globalconfig.net/ccsp-study/quick-video-on-how-to-upgrade-to-asa-8x-from-72/ http://globalconfig.net/ccsp-study/quick-video-on-how-to-upgrade-to-asa-8x-from-72/#comments Mon, 02 Jun 2008 16:00:00 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/06/02/quick-video-on-how-to-upgrade-to-asa-8x-from-72/ Here is a quick video of how to upgrade from ASA version 7.2 to version 8.0 (3).  Super Simple and Super easy!  Hope you enjoy.

Download Upgrading.mov

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccsp-study/quick-video-on-how-to-upgrade-to-asa-8x-from-72/feed/ 0 SNPA READING LIST http://globalconfig.net/ccsp-study/snpa-reading-list/ http://globalconfig.net/ccsp-study/snpa-reading-list/#comments Thu, 15 May 2008 17:56:24 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/05/15/snpa-reading-list/ Here is my recommendations for the CCSP SNPA prep.

I know the quick reference sheet is really good! The ECG is a big help if you want something that explains it in detail.

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccsp-study/snpa-reading-list/feed/ 0 Recommended Reading: IPSEC http://globalconfig.net/ccie-security/recommended-reading-ipsec/ http://globalconfig.net/ccie-security/recommended-reading-ipsec/#comments Thu, 15 May 2008 17:47:15 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/05/15/recommended-reading-ipsec/ For years I have recommended this IPSec book. I read it in one sitting on a flight from LAX to Orlando. Its well written and I really enjoyed it. I’m sure you will as well. As an added bonus, If you purchase from the link on this page I’ll get a few cents for all my hard work recommending it to you and you will get a warm fuzzy feeling inside.

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccie-security/recommended-reading-ipsec/feed/ 0 This Weeks Outlook http://globalconfig.net/ccie-security/this-weeks-outlook/ http://globalconfig.net/ccie-security/this-weeks-outlook/#comments Mon, 05 May 2008 15:11:19 +0000 Brandon Carroll, CCIE #23837 http://ccieprep.me/2008/05/05/this-weeks-outlook/ Well here it is May 5th. It happens to be my 3 year wedding anniversary. It also happens to be the start of a 2 day “online” MARS training class. After that I think I’ll have some time to get some writing done as well as some busy work for Ascolta.

I am running an SNPA class in Bellevue, Wa next week so if you are interested call Ascolta (949-477-2000) and they can let you know the cost of the class.

You may have seen my daily recaps posted on the board here. My plan is to add some additional videos soon.

Anyhow, until then….

Related Posts:

  • No Related Posts
]]> http://globalconfig.net/ccie-security/this-weeks-outlook/feed/ 0