Study Topics

• Configuring NAT

Notes

• Nat-control - any traffic attempting to pass through the device must have a translation rule
• Static NAT – in this example of INSIDE NAT a static entry is begin created to translate an inside host at 192.168.10.10. This inside address will be translated to 209.165.200.226; the maximum TCP and UDP simultaneous connection limits are set to 1000, and the embryonic connections are restricted to 100 before the security appliance initiates the TCP intercept mode

INSIDE NAT
static (inside,outside) 209.165.200.226 192.168.10.10 netmask 255.255.255.255 tcp 1000 100 udp 1000

NETWORK-BASED INSIDE STATIC NAT and OUTSIDE STATIC NAT

static(inside,outside) 209.165.200.232 192.168.10.0 netmask 255.255.255.248

static(outside,inside) 192.168.10.100 209.165.201.1 netmask 255.255.255.255

• Dynamic NAT – here is how simple it is to create a global NAT pool

global (outside) 1 209.165.200.230-209.165.200.237 netmask 255.255.255.0
nat (inside) 1 192.168.10.0 255.255.255.0

• Configuration of Static PAT

static (inside,outside) tcp 209.165.200.229 80 192.168.10.10 80 netmask 255.255.255.255

• Configuration of Dynamic PAT

nat (inside) 1 192.168.10.0 255.255.255.0

global (outside) 1 209.165.200.230-209.165.20.237 netmask 255.255.255.0
global (outside) 1 interface

• Static Policy NAT

access-list inside_nat_static_1 permit ip host 192.168.10.10 host 209.165.201.1

access-list inside_nat_static_2 permit ip host 192.168.10.10 host 209.165.201.2

static (inside,outside) 209.165.200.226 access-list inside_nat_static_1

static (inside,outside) 209.165.200.227 access-list inside_nat_static_2

• NAT Bypass Using Identity NAT

nat (inside) 0 192.168.20.0 255.255.255.0

• NAT Bypass Using NAT Exemptions

access-list EmailServer extended permit ip host 192.168.10.20 host 192.168.20.20

nat (inside) 0 access-list EmailServers
nat (inside)  1 192.168.10.0 255.255.255.0
global (outside) 1 interface

• NAT order of operations

1. NAT Exemptions
2. Static NAT
3. Static PAT
4. Policy NAT/PAT
5. Identity NAT
6. Dynamic NAT
7. Dynamic PAT

Documentation Path

cisco.com – Support – All Products – Products – Security – Firewalls – Firewall Appliances – ASA 5500 – Configuration Guides – 8.2 – Configuring NAT

Sources

Cisco ASA All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance

Comments

NAT coming up tomorrow. “old rules” of NAT on the ASA.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

• Endpoint registration
• Cisco Unified Communications Manager (CUCM) availability
• Database replication
• Call setup with gatekeepers
• Call setup with a Cisco Unified Border Element (CUBE)
• One-way audio
• Cisco Unity Connection (CUC) integration
• Cisco Unified Contact Center Express (UCCX) integration
• Cisco Unified Presence Server (CUPS) integration

WARNING! This troubleshooting video, which is packed full of demos and content, is over an hour long. So, get comfortable!

Oh, one other warning… My youngest daughter HATES the shirt I wore in this video and says it makes me look like an old man. So, my apologies in advance for that.

All set? OK, here’s the link: http://youtu.be/j3H4wvsFlNo

In my first video, I shared with you my 12-Step CCIE Voice Alchemy strategy. If you missed it, you can check it out here: http://youtu.be/qjFghq4wO-0

My previous video offered a proctor’s answers to several CCIE Voice Lab questions that I had, and hopefully it answered some of your questions too. If you missed it, here’s a link: http://youtu.be/ay2kXsHgirw

I hope these videos are not only giving you some great CCIE Voice Lab content, but they’re also helping you to get to know me and my teaching style.

If what I’ve been saying has resonated with you, please consider joining me for eight live and on-line sessions, beginning June 7^th.  Here are the details:

http://www.ipexpert.com/Cisco/CCIE/Voice/Online-Bootcamp

Enjoy your studies!

Kevin Wallace, CCIEx2 (Voice and R/S) #7945

Print Friendly

1. Instructors

IPexpert takes great pride in hiring an employing world-class Instructors. Without a doubt, you’ve heard about Vik, Marko, Piort, Rahim and Anthony. These guys are extremely knowledgeable, they’re subject matter experts. They know their stuff and have a professional way of explaining complex technologies in a way where you’re sure to catch on and really understand it. They stay after hours (after class) to help students and spend countless hours throughout the class in a 1-on-1 sitting to ensure that every student leaves satisfied. I’ve even been told, and have received many, many “thank you messages” from students because my Instructors actually give out their personal email addresses, and in several instances – their cell phone numbers. They’re dedicated to serving you, the student.

2. Hardware / Interface

The Proctor Labs’ hardware and interface (which will be re-launching – with a complete overhaul – in the very near future!) was designed several years ago keeping “simplicity” in mind. We want our students to have a “real lab experience” (using real hardware), but we also want the connectivity and remote controls to be efficient and effective - and we’ve accomplished that!

3. Course Delivery / Style

Some vendors will try to convince you that you should spend up to 2 weeks watching them stand in front of a class configuring stuff….well, we won’t even attempt to tell you that’s the right strategy, because it’s not. It doesn’t take a genius to understand that students don’t want that – and they won’t accept that teaching style. Our CCIE R&S and Voice Instructors use a combination of white boarding, displaying diagrams (very few PowerPoint slides) and showing various items being configured – throughout their instruction or delivery. They will teach or deliver lectures for several hours, then let you – through hands-on configuration – work through the same thing they just explained, ensuring that you understand and know how to configure, troubleshoot and verify what the instructor just taught you. Asking a student to sit in a class for 2 weeks listening to lectures isn’t an effective way to teach, as our success stories and testimonials speak volumes.

4. Location

Our classes are primarily held in San Jose, near the CCIE Lab testing center, and near hotels and the airport. On occasion we also teach in RTP (We will soon be opening up an East Coast RTP location) - near the CCIE Lab testing center. It’s a bright, sunny location that students don’t mind traveling to. They’re also able to drive by the actual testing center and see the location and map the route prior to their lab date. As far as international locations – Brussels and Bangalore are our primary European and Asian locations, but on occasion we will teach in another city as requested.

5. Dates

IPexpert delivers more CCIE Lab Boot Camps than any other company in the world. Whether it’s online training, or live – CCIE R&S, Voice or Security – we typically teach well over 70 classes per year. Although our classes are typicall full (nearly all of them), we have a very robust schedule for you to choose from, and can usually accommodate your needs.

6. Post-Class Support

Whether it’s support delivered online or directly from our instructors, our post-class support is second-to-none. Other vendors want you to believe that they’ll be there for you, but after they take your dollars and rush you through a painful class – they ignore retake requests and post-class support request. As the leader in CCIE Lab training, our goal is to assist you throughout your entire journey – UNTIL YOU PASS – our Training Advisors, Support Engineers and Instructors are with you, by your side, until you earn your number!

7. Guarantee

IPexpert’s guarantee is simple. If you take our class and don’t feel that you’ve learned enough - come back and retake it – FREE OF CHARGE! Our goal is for us to earn your respect, earn a referral and to see your name on our “Wall of Fame”.

8. Price

Our class pricing is the most competitive in the industry. For $1,999 (sometimes $1,499), students receive a solid week of the most complex training. 10-day pricing can be requested, and is often discounted based on additional self-study purchases. Although we’re the best, we price competitively, because we make up for it in volume – with full, yet manageable, classes.

What Our Students Actually Say:

Marc Abel CCIE #35470 – “I had about 6 months to go before my written was to expire so I decided I would hit it hard and make an attempt before that date. 3 weeks before my lab I took advantage of IPX’s generous retake policy and sat both the R+S and OWLE experience. Going in I was beginning to feel confident, but a couple weeks with Marko let me know that I still had big gaps. Marko is an awesome instructor. I highly recommend anyone take a course with him if you can. You won’t get a slide show, you will get good explanations reinforced with the proof from the command line. I passed my lab in RTP on May 18th. Thank you to everyone that supported me along the way, and I hope I don’t forget anyone but a heartfelt thank you to: God, my wife, Jay McMickle, Steve Di Bias, Chris Moore, Marko Millojovec, Joe Astorino, Thomas Raabo, Christophe Lemaire, IPexpert and my employer.

Keith Baldwin CCIE #35439 – “Well I have finally passed my CCIE R&S. I have been on the road towards certification for many years, and at times lost my way due to work and family commitments. What I have come to realize is that persistence pays off in the end. I first began my study at Cisco as an ASE. I was studying for my Voice certification at the time, and while not becoming successful there, decided to study for the Routing and Switching, to solidify my base knowledge in networking.

After a significant breather, last year in May I left my current employer to pursue the daunting task of finishing what I had started. The studying was relentless, and after about 3 months visited Marko at San Jose for the first sitting of the CCIE boot camp for Routing and Switching. Marko is a very professional instructor who does not use PowerPoint, and talks about key concepts in an easy to understand way so as to hammer the point through. He provided me with the final tools which allowed me to become successful. After a few more months of review, I went back prior to what was become many attempts at sitting the Lab. I went through the one week lab experience again, and after that sat my first attempt.

I would like to say that the road becomes easier there, but it does not, hard work, dedication and courage with a more than liberal does of humility are what will get you to the end result. Ladies and gentlemen, the only way you will fail is if you don’t try, if you are afraid of failure, and won’t try because of that you have failed already. If you try and yes you will feel like Don Quixote beating your head against a windmill, you will succeed.

Thank you to IPexpert, Vik and Marko, without whom this would not have been possible.”

For more information about IPexpert’s world-leading CCIE courses, please contact a CCIE-focused Training Advisor at +1.810.326.1444, sales@ipexpert.com or via chat – or review the links below.

Print Friendly

Study Topics

• Configuring subinterfaces

Notes

• Subinterfaces are tagged with a VLAN ID – IEEE 802.1Q used; max number varies by platform; 5510 Base is 50

configure terminal
interface e0/0.100
vlan 100
no shutdown
nameif DMZ1
security-level 75
ip address 192.168.1.1 255.255.255.0

Documentation Path

cisco.com – Support – All Products – Products – Security – Firewalls – Firewall Appliances – ASA 5500 – Configuration Guides – 8.2 – Getting Started and General Information – Configuring Interfaces

Sources

Cisco ASA All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance

Comments

NAT coming up tomorrow. “old rules” of NAT on the ASA.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

Study Topics

• Configuring a Management Interface
• DHCP Services
• IP Version 6
• Setting Up the System Clock
• Configuration Management
• Remote System Management
• System Maintenance
• System Monitoring

Notes

• Dedicated management interfaces on the device only permit traffic destined for the ASA by default; you can take another interface and convert to this configuration using the management-only interface configuration command; negate this command under a management interface in order for it to behave normally
• Example DHCP configuration for the inside interface

configure terminal
dhcpd address 192.168.10.100-192.168.10.200 inside
dhcpd enable inside
dhcpd dns 192.168.10.10 interface inside
dhcpd lease 86400 interface inside
dhcpd option 66 ip 192.168.10.10
dhcpd domain anthony.com interface inside

• Example IPV6 configuration:

interface fa0/0
ipv6 enable
ipv6 address 2001:11:11::/48 eui-64
ipv6 address fe80:1::11::11::1 link-local
ipv6 enforce-eui64 outside
ipv6 nd ns-interval 2000
ipv6 nd reachable-time 10
ipv6 nd ra-interval msec 10000
ipv6 nd suppress-ra

• Setting the time manually

clock timezone CST -6 0
clock summer-time CDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00 60
clock set 11:36:45 Oct 22 2012

• Setting the time with NTP – do not forget verification with show ntp status

http://blog.ipexpert.com/2012/02/23/ntp-on-the-cisco-asa/

• Removing all portions of a configuration are possible on the ASA with the clear command; for example, clear configure isakmp removes all the isakmp commands from the running configuration; clear configure all can replace the need for a reboot to restore factory default for example
• write erase in order to remove the startup-config from NVRAM
• ASA does not allow Telnet on outside interface unless it is in IPSec tunnel

configure terminal
telnet 172.16.2.0 255.255.255.0 mgmt
telnet timeout 5

• SSH

crypto key generate rya
ssh 172.18.82.0 255.255.255.0 mgmt

• Disable the password recovery process with no service password-recovery
• Logging – here we enable it and cause debug and trace messages to be included – we also use the Cisco EMBLEM format

configure terminal
logging enable
logging debug-trace
logging emblem
logging timestamp

• You can create logging lists that can be used to specify certain behaviors for those groups of messages

configure terminal
logging list IPSECCRITICAL level critical class vpn

• Setting destinations

logging monitor IPSECCRITICAL
logging buffered debugging
logging host mgmt 172.18.82.100 format emblem
logging trap debugging
logging list EMAIL message 101002
logging mail EMAIL
logging from-address anthony@me.com
logging recipient-address admin@anthony.com level errors
smtp-server 192.168.1.101

• You can also set flash and FTP destinations

Documentation Path

cisco.com – Support – All Products – Products – Security – Firewalls – Firewall Appliances – ASA 5500 – Configuration Guides – 8.2 – Getting Started and General Information – Configuring Basic Settings; Configuring DHCP

Sources

Cisco ASA All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance

Comments

Once again, had touched on all of this before so no reason to lab it. Was very much fun to review it all, however. Labbing is going to get cranked up real soon and I cannot wait. Will be a nice chance to review these first couple of days as well.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

In this posting, I want to give you answers to some common CCIE Voice lab questions. Have you ever asked any of the following:

• Do proctors access your equipment and introduce troubleshooting issues DURING your lab?
• What is the pass rate of the CCIE Voice Lab?
• How do you ask an effective question to a proctor?
• Is the lab you get random or hand-picked?
• How is your lab graded?
• When should you expect to get your lab results?
• What terminal emulator is used in the lab?

Answers to these questions were given to me by a Cisco CCIE Lab Proctor. They asked that I not identify them, and I certainly want to respect that. After all, the answers they provided are their opinion, and they are not officially speaking for Cisco. However, the information they provide is packed full of valuable nuggets.

Here’s the video where I share the proctor’s responses to these questions:

I hope you find this information valuable. Also, be on the lookout for my next blog posting, where I’ll show you (in a one hour video!) troubleshooting tips for a wide variety of CCIE Voice Lab topics.

By the way, remember IPexpert’s CCIE Voice Alchemy – LIVE class coming up next month. In this live on-line event, we meet on Thursday evenings for two and a half hours. During that time, we go through a brand new mock lab I’ve written, by following the twelve CCIE Voice Alchemy strategies. We’ll also encounter (and overcome) multiple troubleshooting issues along the way.

For specific information about class dates and all of the bonuses you receive, check out the following link: http://www.ipexpert.com/Cisco/CCIE/Voice/Online-Bootcamp

Enjoy your studies!

Kevin Wallace, CCIEx2 (Voice and R/S) #7945

Print Friendly

Study Topics

Setting Up Device Name and Passwords
Configuring an Interface

Commands Covered
hostname MYASA
domain-name anthony.com
passwd MYSECRET – telnet password
enable password MYSUPERSECRET
same-security-traffic permit inter-interface
nameif DMZCOOL
ip address 10.10.10.1 255.255.255.0
security-level 50
speed 1000
duplex full

Documentation Path

cisco.com – Support – All Products – Products – Security – Firewalls – Firewall Appliances – ASA 5500 – Configuration Guides – 8.2 – Getting Started and General Information – Configuring Basic Settings; Configuring Interfaces

Sources

Cisco ASA All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance

Comments

This track is easy! Not sure what all the fuss is about!!!! OK, OK, just kidding. Nothing new here of course. I did not bother to lab anything at this point since I have done it all a million times. Have an awesome day! Cannot wait for the days ahead to dig deeper on these awesome devices.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

Here is what some students had to say about the recent run of classes:

“Anthony – just wanted to advise you I passed my written with a score of 937. The foundation was excellent in your training sessions. I’m looking forward to the troubleshooting.”
M. Tran

“I paid for this class via my own funds, highly effective and a great value.  Saves time and focused approach.”
Rick H.

“The CCIE written prep bootcamp was excellent.  If you are serious about learning and not memorizing material for this exam, this course is highly recommended!”
TJ Houske, Principle Consultant, Strategic Networkx, LLC

Print Friendly

I am going on a 120 day quest for this highly valued certification and I will detail my journey here at blog.ipexpert.com. I am armed with the following resources:

• The IPexpert Blended Learning Solution
• Safari Books Online
• The Official Cisco CCNP Security Curriculum
• ProctorLabs.com Rack Rental Vouchers

Here is the immediate upcoming schedule of “events” that will deal with the Cisco ASA. Notice I took some liberties with the official Cisco blueprint by organizing, combining, and ordering a little better:

• Day 1 – Basic ASA Initialization
• Day 2 – VLANs
• Day 3 – Device Management
• Day 4 – Address Translation
• Day 5 – ACLs and Object Groups
• Day 6 – IP Routing
• Day 7 – Filtering
• Day 8 – Security Contexts
• Day 9 – Failover
• Day 10 – Transparent Firewall
• Day 11 – MPF
• Day 12 – AIC
• Day 13 – High Availability
• Day 14 – QoS

I hope you will enjoy my posts as I accomplish this challenge. I also look forward to comments and interaction here at the blog.

Anthony Sequeira CCIE, CCSI
Twitter: @compsolv
Facebook: http://www.facebook.com/compsolv

Print Friendly

Join us in congratulating the following CCIEs on their great achievement;

• Marc Abel CCIE #35470 (R&S)

Marc Abel CCIE #35470

I had about 6 months to go before my written was to expire so I decided I would hit it hard and make an attempt before that date. 3 weeks before my lab I took advantage of IPX’s generous retake policy and sat both the R+S and OWLE experience. Going in I was beginning to feel confident, but a couple weeks with Marko let me know that I still had big gaps. Marko is an awesome instructor. I highly recommend anyone take a course with him if you can. You won’t get a slide show, you will get good explanations reinforced with the proof from the command line. I passed my lab in RTP on May 18th. Thank you to everyone that supported me along the way, and I hope I don’t forget anyone but a heartfelt thank you to: God, my wife, Jay McMickle, Steve Di Bias, Chris Moore, Marko Millojovec, Joe Astorino, Thomas Raabo, Christophe Lemaire, IPexpert and my employer.

Keith Baldwin CCIE #35439 (From last weeks CCIE success story list)

Well I have finally passed my CCIE R&S. I have been on the road towards certification for many years, and at times lost my way due to work and family commitments. What I have come to realize is that persistence pays off in the end. I first began my study at Cisco as an ASE. I was studying for my Voice certification at the time, and while not becoming successful there, decided to study for the Routing and Switching, to solidify my base knowledge in networking.

After a significant breather, last year in May I left my current employer to pursue the daunting task of finishing what I had started. The studying was relentless, and after about 3 months visited Marko at San Jose for the first sitting of the CCIE boot camp for Routing and Switching. Marko is a very professional instructor who does not use PowerPoint, and talks about key concepts in an easy to understand way so as to hammer the point through. He provided me with the final tools which allowed me to become successful. After a few more months of review, I went back prior to what was become many attempts at sitting the Lab. I went through the one week lab experience again, and after that sat my first attempt.

I would like to say that the road becomes easier there, but it does not, hard work, dedication and courage with a more than liberal does of humility are what will get you to the end result. Ladies and gentlemen, the only way you will fail is if you don’t try, if you are afraid of failure, and won’t try because of that you have failed already. If you try and yes you will feel like Don Quixote beating your head against a windmill, you will succeed.

Thank you to IPexpert, Vik and Marko, without whom this would not have been possible.

IPexpert is proud to boast the industry’s most complete and updated self-study portfolio for the CCIE Routing & Switching, CCIE Voice, CCIE Security, and CCIE Wireless Lab exams. Have you also used IPexpert or Proctor Labs to help you pass the CCIE lab exam? If so, we want to hear your story! Please email us at success@ipexpert.com.

Print Friendly