Cisco IOS hints and tricks

Borderless Networks, Take Two

2010-03-19T07:00:00.002+01:00

Another cloudy product launch happened on Wednesday: the next step in the Borderless Networks saga with the tagline Innovation is Everywhere (what a revelation; we were not aware of that before the event).

Must read: why is cloud computing a bad metaphor

I wanted to entertain you with some juicy opinions about the webcast, but that will have to wait; I’m going rock climbing in a few minutes. In the meantime, you can satisfy your inner Dilbert with a comprehensive technical (what a relief!) summary of the products and technologies launched on Wednesday published by Jennifer McAdams in the Cisco’s Innovation blog. Thank you, Jennifer! Great job; exactly what the engineers need.

CLNS and CLNP

2010-03-18T07:29:00.002+01:00

Yap Chin has been looking at the OSI protocol stack I’ve published in the CT3 wiki and asked an interesting question: “where is CLNS in that protocol stack?”

The OSI protocol stack has a major advantage over the TCP/IP stack: it defines both the protocols and the APIs between the layers. CLNS (Connection-less network Service) is the API (the function calls that allow transport layers to exchange datagrams across the network) while CLNP (Connection-less network Protocol) is the layer-3 protocol that implements CLNS. In my diagram, CLNS would be a thin line above CLNP between L3 and L4 boxes.

Do you use MPLS to transport Internet traffic?

2010-03-17T12:07:00.000+01:00

One of the interesting questions I’ve got after announcing the Building IPv6 Service Provider core webinar was “Why would you push IPv6 into the core?”

Obviously there are two mechanisms to transport Internet traffic across your (next-generation ;) Service Provider core network: forward it natively or transport it between BGP next-hops across MPLS LSP. It would be really interesting to know how many people use one or the other mechanism, so if you’re working in a Service Provider environment, please respond to the poll (use this link if you’ve disabled JavaScript).

More details: Seven IPv6 myths

2010-03-16T06:54:00.001+01:00

Two weeks ago I listed six IPv6 myths, asking you to add your own favorites. Obviously the MythBusters are not reading my blog and everyone else decided to focus on a single provocative sentence (got you!) and expressed strong feelings about NAT being (or not being) a security feature.

I've described the myths (including the mobility myth to get their number up to the nearest magic number) in more details in the Seven IPv6 networking myths that don't match reality article published by SearchTelecom.

If you’re working in the Service Provider environment and plan to roll out IPv6 services, don’t forget to register to my Building IPv6 Service Provider core webinar.

SNMP over XML over HTTP?

2010-03-16T06:52:00.001+01:00

The snmp-server host command in Cisco IOS has an interesting option: you can specify an URL as the destination host, for example: snmp-server host http://1.2.3.4/xxx traps snmpv2c public. However, I was not able to make it work; the router would accept the configuration command, but the outbound HTTP session never starts. Has anyone managed to get this to work? Any ideas what else is required?

Building IPv6 Service Provider Core: Follow-up questions

2010-03-15T06:41:00.000+01:00

I’ve received several follow-up questions after announcing the Building IPv6 Service Provider core webinar. Two were extremely easy:

Q: Can I register after April 5th?
A: Yes, you can. The registration deadline for all my webinars is 1 day before the event.
Q: Is this a Webex event (not a presentation on a location)?
A: Yes, a webinar is a web-delivered event (and I’m in fact using Webex). You can be anywhere in the world, as long as you have a decent Internet connection (we’re using VoIP).

The third one was a bit trickier:

Q: We are looking at moving to IPv6 within our Enterprise. Would this training give us clearer insight into that?
A: This webinar assumes you already know the IPv6 basics (addressing, routing). If your network is big enough that you use BGP or MPLS internally, you'd definitely benefit from this training, but it covers primarily the backbone part and a few select access issues. If your network is smaller (so you don’t use BGP internally) or you don’t know enough about IPv6, I would recommend standard Cisco’s IPv6 training courses.

And don’t forget: the webinar is less than a month away. Register now.

The cult of busy

2010-03-14T20:11:00.000+01:00

I love reading Scott Berkun’s blog. For years I’ve been doing (and preaching) most of the things he writes about, but sometimes he manages to describe them so eloquently that the reading of familiar thoughts becomes pure pleasure. You simply must read the Cult of Busy post; I’ve seen too many people working 12+ hours a day and achieving nothing or pointy-haired bosses who judged the productivity of their team solely by the time they left the office (and consequently managed to end with a heap of useless individuals).

Secure BGP

2010-03-12T10:48:00.000+01:00

One of the decades-long grudges most people have with BGP is that it’s so easy to insert bogus routing information into the Internet if your upstream ISP happens to be a careless idiot (as Google discovered when Pakistan decided to use blackhole routing for Youtube and leaked the routes). There are two potential solutions that use X.509 certificates to authenticate BGP information: Secure BGP (which uses optional transitive attributes) authenticates the originator as well as the whole AS-path (using AS-by-AS certificates), while the significantly simpler Secure Origin BGP (which uses new BGP messages) authenticates only the originator of the routing information.

New webinar: Building IPv6 Service Provider Core

2010-03-11T18:44:00.000+01:00

When building an IPv6-enabled Service Provider (or large enterprise) core, you have three design options: dual-stack deployment, running IPv6 over MPLS (6PE) or running IPv6 inside a VPN (6VPE). My new webinar, Building IPv6 Service Provider core, describes the principles of all three design options and their comparative benefits and drawbacks. It’s targeted at CCNP/CCIE-level engineers with basic IPv6 knowledge and includes detailed configuration examples and router printouts. After attending the webinar, you’ll get complete router configurations which you can use in your own lab to test the scenarios discussed in the webinar.

CRS-3: The marketing flop of the year

2010-03-10T10:03:00.001+01:00

When I received the first invitations to Cisco’s product announcement that will “forever change the Internet”, I knew it would be another case of overpromising and underdelivering. But even being prepared for the let down, I was totally disappointed when the “magic” product was another high-end router. No doubt it’s an important product, no doubt it will give the Tier-1 service providers a tenfold improvement of the total network throughput, no doubt it’s a wonderful piece of engineering (quoting the Cisco’s press release: it unifies the combined power of six chips to work as one ... you see how banal and degrading the engineering efforts look when described by marketing?), but it will “forever change the Internet” in the same way that AGS+, Cisco 7000, Cisco 7500, Cisco 12000 and CRS-1 did ... by providing ever-higher core network throughput.

New webinar pricing

2010-03-09T11:29:00.000+01:00

The responses to the “Can you help me fix the webinar marketing?” question were quite explicit: it’s too expensive for most people. Several readers indicated that they feel the optimal price would be around $50 (and some off-line respondents told me the original $90 price tag was too hard to expense). As Julian pointed out, “the market is always right”, so I’ve decided to reduce the price for the next webinars to $49.99, including the “Choose the optimal VPN service” on May 11^th and the “Market trends in Service Provider networks” on June 2^nd.

Off-topic: The survey bias

2010-03-08T07:08:00.001+01:00

Bad designer, one of my favorite devil’s advocates asked an interesting question about post-course survey results:

Once in a course or similar and you get to know someone it becomes v difficult to give bad results, in particular, if it is life effecting in some way such as bonuses or future work etc. In fact one can argue that you should get high results just for high effort with integrity.

The bias toward higher scores is definitely present and is in fact so strong that 4.0 usually represents a barely acceptable result; sometimes the minimum acceptable average score for an instructor is set to 4.3 – 4.5. It’s also very important to understand how the questions are phrased and what the results actually mean.

Anyone attending Cisco Expo 2010 in Slovenia?

2010-03-06T07:52:00.000+01:00

The local Cisco office sent me such a nice invitation to the Cisco Expo Slovenia event that I simply had to register. So, if you’ll be in Portorož during the event and would like to join me for a cup of coffee or a beer (hopefully on a terrace overlooking the sea), get in touch ... or look for the guy asking nasty questions from the back row ;)

This is how you design a useful protocol

2010-03-05T07:20:00.001+01:00

A post in the My CCIE Training Guide pointed me to the GoogleTechTalk given by Yakov Rekhter (one of the fathers of BGP) in 2007. You should watch the whole video (it helps you understand numerous BGP implementation choices), but its most important message is undoubtedly the Design by Pragmatism approach:

They had a simple, manageable problem (get from a spanning-tree Internet topology to a mesh topology).
They did not want to solve all potential future problems; they left that marvelous task to IDRP (which still got nowhere the last time I've looked).
They started with simple specifications (three napkins), had two interoperable implementations in a few months, and wrote the RFC after BGP was already in production use.
They rolled it out, learnt from its shortcomings and fixed it.
They gradually made it easily extensible: TLV encoding, optional attributes, capabilities negotiations. This approach made it possible to carry additional address families in BGP and use it for applications like MPLS VPN and VPLS.

Can you help me fix the webinar marketing?

2010-03-04T06:52:00.003+01:00

The Market trends in Service Provider networks webinar was obviously well received by the attendees ... the “only” problem was that there were so few of them. The conversion ratios were murderous:

From over a hundred thousand visitors who have seen the webinar announcement, approximately 1% clicked on the registration link. This is normal and expected; most people are banner-blind and many visitors are not interested in the particular topic or don’t want to attend a webinar.
Over a thousand visitors decided that the registration page is worth looking at, but only around 1% actually registered for the webinar. This ratio needs some serious fixing; increasing it by a few percentage points would make the whole idea viable.

Lies, damned lies and independent competitive test reports

2010-03-03T07:06:00.001+01:00

When the friendly sales guy from your favorite vendor honors you with an “independent test lab” report on the newest wonderful gadget he’s trying to sell you, there’s one thing you can be sure of: the box behaves as described in the report. The “independent” labs are earning too much money verifying the test results to participate in outright lies. Whether the results correlate with your needs is a different story, but we’ll skip this discussion.

Market trends in SP networks: the survey results

2010-03-02T06:53:00.001+01:00

The Market trends in Service Provider networks webinar happened just a few days before my winter vacations, so it took me a while to process the post-session survey results (actually, my paperwork day pushed me to do it). Here are the results:

Overall, I was satisfied with this web session	4,8
This session was a worthwhile investment	4,8
Based on this experience, I would recommend this session to others	Yes (100%)
Based on this experience, I would you attend another similar session	Yes (100%)
Considering other educational experiences, I would rate this session	4,4
Instructor score (3 questions)	4,93
Course materials (5 questions)	4,76

Beta version of Cisco VPN client for Windows 7

2010-03-01T09:10:00.002+01:00

Regardless of the supposed focus of my blog, its most popular post still remains the Cisco VPN client in 64-bit Windows 7. This requirement is obviously so common that Cisco decided to implement the 64-bit client natively; it’s currently in beta testing. Philip Remaker left the following comment at my original post:

QPPB in MPLS VPN

2010-03-01T06:34:00.002+01:00

Quick link for the attention-challenged: QPPB works in MPLS VPNs (with a few limitations).

And now for the long story: A while ago I’ve noticed that my LinkedIn friend Joe Cozzupoli changed his status to something like “trying to get QPPB to work in MPLS VPN environment”. I immediately got in touch with him and he was kind enough to send me working configurations; not just for the basic setup, but also for Inter-AS Option A, B and C labs.

Electronic books: real-life data

2010-02-28T18:15:00.003+01:00

I had my yearly “paperwork day” today. As part of that ordeal I was sorting the Cisco Press book sales reports and stumbled across e-book data for my MPLS VPN books. I can’t tell you how well the Safari access is doing (electronic subscriptions are bundled with numerous totally unrelated items into the “Others” category), but the reports have separate line items for PDF and Mobile (I assume that’s Kindle) edition. The sales of these editions are negligible compared to the “regular” sales.

IPv6 myths

2010-02-26T09:06:00.000+01:00

Once you’ve spent a few hours trying to understand the implications of IPv6, you quickly realize that the only significant change is the increase in the address length. All the other goals that some people had been talking about were either forgotten or failed due to huge mismatch between idealistic view of the Internet IPv6 developers had 15 years ago and today’s reality. However, you still find mythical properties of IPv6 propagated across the Internet. Here are a few I’ve found; add your favorites in the comments.

Numerous IPv6 topics are covered in my Enterprise IPv6 Deployment workshop. You can attend an online version of the workshop or we can organize a dedicated event for your team.

IPv6 provides service/location separation. Total nonsense. The only mechanism used to find services is still DNS and it’s still used from the wrong position in the protocol stack.

Highly recommended: Confessions of a Public Speaker

2010-02-25T07:11:00.002+01:00

If you ever have to stand up and speak in front of an audience, the Confessions of a Public Speaker is a must-read. I've read the book a few weeks ago (and found it a fantastic resource), but never got time to write a review. Now I don't have to … Liz Danzico from A List Apart did a wonderful job.

Traffic management in Service Provider networks

2010-02-24T07:02:00.001+01:00

I while ago I wrote two articles for SearchTelecom that deal with traffic management in Service Provider networks and Deep Packet Inspection (DPI). The first article analyses whether you need dedicated boxes doing the traffic management in your network; the second one whether you really need DPI to manage the traffic.

Traffic management and DPI are just two of the many topics covered in my Market trends in Service Provider networks workshop. Follow this link to register for the online event.

Understanding MSTP

2010-02-23T10:34:00.000+01:00

Just in case you haven't noticed it yet: Petr Lapukhov wrote a great (and very long) article describing MSTP. It covers everything, from the basics to multi-region design and interoperability issues. Highly recommended reading.

Unnumbered Ethernet VLAN interfaces

2010-02-22T06:55:00.001+01:00

If you’re upgrading your Service Provider network from ATM- or SDH-based core to Carrier Ethernet core, you could be tempted to keep the unnumbered point-to-point links. The practice of using unnumbered P2P links is debatable, but if you want to, you can configure them on VLAN interfaces in recent IOS releases.

You’ll find more details (and caveats) in the Unnumbered Ethernet VLAN interfaces article in the CT3 wiki.