Lot's o' goodies. CCNA security, voice, and wireless racks coming soon...

Picked up all of this from one lot for an insane price... (plus a 2970, 3 2950g's, and a couple Cisco business class routers and switches.)

And yes, that is a 3560 POE switch.

I am only missing a p/s for the ASA. If it doesn't work when the P/S get's here I'll probably cry a bit.

CCNA Voice lab beginning

To facilitate a few other possible projects in the future, I'm beginning the build of a CCNA Voice lab.

I'll be looking for a few more phones, and and modules, and will eventually set up a SIP based phone service here, possibly, just to say that I did it, maybe more, we'll see.

Ohh, and the T3600 is up and running, if a bit hampered by some Raid controller card issues on a single 64gb SSD for now.

These are the same workstations we use at work, but believe it or not, at 8gb of system ram in my home system, I have twice as much as my workstation at work. 

Our video cards, at work, on the other hand, are no slouches. We have two W7000, 4GB cards in each station. If you're asking why $1300 worth of Video cards, and only 4gb of system ram in a workstation that does no CAD/CAM, but runs 4-5 Java-heavy Element Management systems, you'd be asking the same question I do every day. I think I've finally goaded them into getting us 8-12gb loaded soon. 

Such is the life of being a technical employee under decidedly, non-technical managers. I had my shot to become one of them, but chose to stay on the Engineering track. I'll revisit management again someday, but I've still got a ton of training and study to do before I'd feel qualified to manage another engineer.

CCP aka Cisco Configuration Professional

I've had a real dearth of posts lately, due to both inherent craziness at work, and a couple other projects that I'm working on.

The HomeLab business was dry for a few months, then picked up with a vengeance right at Christmas. I sold 7 configured Labs over a two week period, ending the very last day of the year. Now that everything is shipped, I can get back to the projects I've been working on.

One of the projects will be... sometimes I forget the title of the Blog, "CCNP or Bust". It probably seems to the outsider, that it's more Bust than CCNP, but because of the limited use of Cisco gear at my day/night job, having the CCNP is less of a driving force. Becoming a well rounded network engineer, is more of a concern with the MEF-CECP a much more desired certification where I work.

That said, I'll be back focusing on the CCNP between February and the end of March, with a desired completion date of March 27th. There is a good reason for this, so the posts will probably be coming in a flurry between the beginning of February and that date.

I likely will be trying to take Switch around the end of Feb. So as the kids say... "It's on like Donkey Kong"

I have a few toys coming as well. I have a Dell Precision workstation, a T3600, identical to the workstations we have at work arriving today. Only thing it's missing are the dual W7000 Video cards that they (for whatever reason) Spec'ed our systems with. It's a bit of an example of what it's like to work at a company in which most of the people, apparently, even our IT department, don't really have a good grasp on what we do. $1300 for dual 4GB video cards, but only 4Gb of system ram. One can only chuckle. I picked up the entire workstation, with 8GB of system ram, for likely, less than my company paid for ONE of the video cards in my workstation at work. I estimate we probably overspent around $30,000 on our workstations.
I picked this up to run ESXi vm's for various reasons, including the evaluation version of Cisco Unified Connection manager, eventually.

I also have two more Juniper SRX210's on the way to facilitate a focus on the JNCIA-ENT after the CCNP is finished. At some point, I'd like to get out of NOC work, and into a 9-5, Monday through Friday position. I don't mind dealing with the occasional emergency network situation, but after nearly 8 years of constant Fiber cut/Network outage management, it's beginning to wear on me.


That all said I do have a subject here, and it aligns with one of my other projects, to be named later...

Cisco Configuration Pro. Something one will have to have some experience with for some of the new CCNA tests, and likely the CCNP when a likely revamp of those come.

I've set it up seriously for the first time. I have an 1841 discovered and now a 3560.

There are a few simple configurations you will need to get a node discovered.

• interface configured on the network you have your PC running CCP on.
• username, privilege, and secret password for the device.
• VTY configured with priviledge, local login, and transport inputs set

and that's pretty much it

MPLS VPN OSPF BGP configuration practice

With my work being mostly based in MPLS, but from a mainly GUI use standpoint, I'm trying to gain a better overall understanding of MPLS configuration.

I don't have the Alcatel Gear to play with here, nor CLI config rights yet at work, so I'm working with the next best thing, practicing on what I do have, Cisco Gear.

I'm using Levent Okvur's walkthrough on YouTube:

So here is the simple MPLS setup I'm using:

Three 1841's, one as Provider Core, and two as Provider edge devices.
Four 1720's as the CE devices.

Config on one of the PE routers:

Added more Racks for Sale on EBAY.

Need to generate some income to pick up another SRX and probably another EX2200.

From Cheapo 1720/2950 racks for just over $100 to a Rack mounted, 5 device setup with a Custom menu Access server for $599.00.

Check out the racks and Buy...Buy...Buy !!!

http://www.ebay.com/itm/251362609974?ssPageName=STRK:MESELX:IT&_trksid=p3984.m1555.l2649

Carrier Ethernet topology a bit more set

Gotta luv local liquidation companies...

The Haul yesterday:

2651xm
2621
2950g EI
Dell powerconnect 3024 (new in box)
Cyberpower 1350 AVR UPS

All for cheap...

With the Cyberpower setup protecting my Main PC(Core i5 680, Nvidia GTX560Ti), the Network rack PC(Core2Duo 2.4ghz, Nvidia 7950Gt), and three 23" monitors, and a few peripherals, it's running 235watts. or 29% of the Cyberpower's capacity.

I have always wanted one with the LCD diplaying output. Not bad for $21.00. I think they run $150.00 new. We'll see how long the batteries last. The are charging to 80% and are showing at 235watt output to have 12 minutes of up time.

Even if it dies, Used UPS are almost always a good deal, as you can run down to a battery store and pick up new replacements for around $40.00, or even cheaper online. For $60.00, I could essentially have a new $150.00 UPS.

SFP interchangeability

Well, the ADVA 850mm SFP's that apparently weren't compatible with the Cisco 3560,

DO WORK in a Juniper EX2200. This is a HUGE savings, as I picked up 6 ADVA SFP's for $35.00, and the cheapest Juniper compatible SFP's I could find were $45.00 a piece.

root@Juniper# run show chassis pic pic-slot 1 fpc-slot 0
FPC slot 0, PIC slot 1 information:
  Type                             4x GE SFP
  State                            Online
  Uptime                         44 minutes, 19 seconds
PIC port information:
                          Fiber                    Xcvr vendor
  Port  Cable type        type  Xcvr vendor        part number       Wavelength
  3     GIGE 1000SX       MM    FINISAR CORP.      FTLF8519P2BNL-AD  850 nm

Obviously, ADVA branded, but actually, a Finisar product...

root@Juniper# run show interfaces diagnostics optics ge-0/1/3
Physical interface: ge-0/1/3
    Laser bias current                        :  6.844 mA
    Laser output power                        :  0.3450 mW / -4.62 dBm
    Module temperature                        :  35 degrees C / 95 degrees F
    Module voltage                            :  3.2430 V
    Receiver signal average optical power     :  0.3637 mW / -4.39 dBm

EX2200 in the rack...

came last night, but had to get caught up in my Python class. Still need to password restore it.


Pics or it didn't happen...

Juniper EX2200 on the way

Barring any of the occasional EBay/Paypal issues, I should have an EX2200 added to the Carrier Ethernet rack within the week possibly. Surely by next week.

I have the devices partially set up now, and am working on an E-line configuration through the SRX210 from the ADVA 825.

Once the EX2200 comes in it will be run (Rack Server)HOST A -(1gig copper)- ADVA825 -(1gig copper)- SRX210 (1gig copper)- EX2200 -(1 gig MM fiber)- ADVA 206v -(1gig fiber)- HOST B(Cisco 3560)

Juniper SRX210 configuration for JNCIA-SP study

Since, out of the box, the SRX210 is for all intents and purposes, a firewall, some adjustments have to be made to make it work for Service provider study. Bear with me, I'm in a bit over my head still and clawing my way out.

This came from Jeremy Merideth's blog, which it doesn't appear that he is currently maintaining, but great info in here and a thanks to him. How to get an SRX out of default Juniper config:

http://runningsecure.blogspot.com/2011/06/screenos-background.html

SRX Default Config

For the purpose of this blog I will be configuring an SRX100.
When either taking an SRX out of the box or entering the following commands, you will get the Juniper default configuration.

root@host# load factory-default
root@host# set system root-authentication plain-text-password
root@host# commit and-quit
root@host> request system reboot

Personally I prefer to work from a blank canvas, so the following commands removes all Juniper applied config, adds a few tweaks and gives us a starting point to build up our configurations.

Remove the interface Ethernet Switching
root@host# delete interfaces fe-0/0/1 unit 0 family ethernet-switching
"Repeat for interfaces range 1-7"
root@host# delete interfaces vlan unit 0 family inet address 192.168.1.1/24
root@host# delete interfaces vlan unit 0 family inet

Remove the fe0/0/0.0 interface from Security Zone
root@host# delete security zones security-zone untrust interfaces fe-0/0/0.0

Remove the Zone Interfaces and Policies
root@host# delete security zones security-zone trust host-inbound-traffic
root@host# delete security zones security-zone trust interfaces vlan.0

Remove Default Policies
root@host# delete security policies from-zone trust to-zone untrust

Remove Default Web Management
root@host# delete system services web-management http interface vlan.0
root@host# delete system services web-management https interface vlan.0

Remove NAT rule
root@host# delete security nat source rule-set trust-to-untrust

Remove Screening on Untrust Zone
root@host# delete security zones security-zone untrust screen

Remove Existing Name Servers and add Google ones
root@host# delete system name-server 208.67.222.222
root@host# delete system name-server 208.67.220.220
root@host# set system name-server 8.8.8.8
root@host# set system name-server 8.8.4.4
root@host# delete system services dhcp

Remove Default Security Zones
root@host# delete security zones security-zone untrust
root@host# delete security zones security-zone trust

root# run show configuration | display set
set version 11.1R2.3
set system root-authentication encrypted-password "$1$sF9Tjm/m$zu6xvdjAUIqeeHSP69Vfm0"
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system services ssh
set system services telnet
set system services xnm-clear-text
set system services web-management http
set system services web-management https system-generated-certificate
set system syslog archive size 100k
set system syslog archive files 3
set system syslog user * any emergency
set system syslog file messages any critical
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands error
set system max-configurations-on-flash 5
set system max-configuration-rollbacks 5
set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
set interfaces fe-0/0/0 unit 0
set interfaces fe-0/0/1 unit 0
set interfaces fe-0/0/2 unit 0
set interfaces fe-0/0/3 unit 0
set interfaces fe-0/0/4 unit 0
set interfaces fe-0/0/5 unit 0
set interfaces fe-0/0/6 unit 0
set interfaces fe-0/0/7 unit 0
set interfaces vlan unit 0
set protocols stp
set security screen ids-option untrust-screen icmp ping-death
set security screen ids-option untrust-screen ip source-route-option
set security screen ids-option untrust-screen ip tear-drop
set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200
set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048
set security screen ids-option untrust-screen tcp syn-flood timeout 20
set security screen ids-option untrust-screen tcp land
set security policies
set vlans vlan-trust vlan-id 3

set vlans vlan-trust l3-interface vlan.0

And then how to set it up to more closely emulate an MX series SP switch from the Juniper Forums:

Cleaned up the rack some, and added some cable management. The second ADVA (GE206V) is just waiting for some MM fiber jumpers to arrive. (quite literally, possibly, on a slow boat from china)

Need to sell a couple more racks and I'll have enough to pull the trigger on a Juniper EX2200 to more fully simulate the types of circuits we'll be performing break/fix on.

Home Network Baller Status ?

Is home network "Baller" status achieved when your home router becomes a Juniper SRX210 ?
Sold the ADSL PIM out of it for $100, making it a net $285.00 purchase, which is a pretty good deal for one of the SRX210high memory versions.

Racks in, Racks out. I was getting a bit worried, but it appears that the U.S. must have a large percentage of people on the same payday weeks. About exactly 2 weeks from the last time I cleaned out my stocks, I'm almost cleaned out again.

Sold 5 systems over the last few days. Configuring what I have left to be a pretty nice rack for the Labkeeper.net/Packetlife.net Beta.

Upgraded a few of the XM routers I have left to have the ability to run 12.4T and IPV6 and advanced security features like Zone Based Firewalls. 192/48 is required.

A Few 2651xm Routers old Boot Roms

Now with upgraded Boot Rom allowing 256 mb of NVRAM

Carrier Ethernet rack coming along... Working on Radius Authentication to become a part of Packetlife.net's LabKeeper.net beta testing.

Picked up my second ADVA to almost complete my Carrier Ethernet NID acquisitions. I'll probably try to pick up a Cisco ME3400 as well, but those end up costing nearly as much as the Junipers do.

I should be able to do some simulations and practice what we preach at work soon.

The one on top is an FSPCCf-825 with 4 x 10/100 copper access ports, 1 x gig copper access port, 1 x gig fiber access port, and two copper and two fiber network ports.

The one on the bottom is an FSP 150CC ge-206 and is all fiber with six access and two network ports.

ADVA's are made in Germany, and the quality shows.

Working hard on CCNP switch study to hopefully test for SWITCH by the end of the month.

I'm working on getting at least one lab live on the labkeeper.net system that Packetlife.net Author, Jeremy Stretch has put together. It's an amazing bit of work he's done, and should allow us to get racks out to people to use much easier. Might kill my business, but I was never really in this to make a killing, just help pay for my own racks. Hopefully, soon, I'll be a busy network engineer and have no time for the business anyway.

CCNA rack try-b4-u-buy are back available... Donations would be wonderfulness !!!

As it says, the rack in the previous post is available to schedule for Try-b4-u-Buy.

See the Rack schedule page, or the CCNA topology page for scheduling button. It's blocked out until mid-day tomorrow as I have to make changes to the topology to fit the new rack config.

I'm probably going to limit this to one scheduling per day and see how it goes. If it get's out of hand, and it appears that someone is attempting to re-sell time, I'll discontinue it, and/or only give access to people through E-bay contact.

Cable building day... and New racks for sale

I tend to dread these days.

I don't know if it's flashbacks to my BICSI commercial cabling days, or if I'm just lazy, but I hate building cables.

With the selling of my semi-custom CCNA and CCNP racks, I have to build quite a few of them, especially when I use 2509/11 RJ access servers.

These ones do end up pretty aesthetically pleasing though. I don't think anyone is selling racks this complete on Ebay.

Putty Manager+Avocent Access server = Heaven in studying...

Don't forget to configure keepalives or you'll lose your sessions everytime the window times out. I'm trying every 15 seconds, and see if there is any kind of issue.

Cable pinout for Terminal Servers, NM modules, etc.

I've been meaning to make this post for a while, and as I'm building roll-over cables for the Avocent TS-3000, I thought it would be a good time to get most of the cable pinouts for custom cables all into one place for myself and others.

If you are using other types of modules in CCNP and up, It's my estimation that you are probably spending too much $$$. I've been getting 56k modules nearly free, and WIC-T1's for as low as $3.50 a piece. In comparison, it's difficult to get a WIC-1T for less than $10.00 and then you have to spend another $10.00 for one cable. I can build much more easily managed cabling for T-1 modules for around $.25 per cable.



Here is Cisco's PDF:

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v7.10/installation/guide/Pinouts.pdf

My nothing fancy guide

Terminal server roll-over cable:

signal     pin     signal
RTS    1 - 8    RTS
DTR    2 - 7    DTR
TXD    3 - 6    TXD
GND   4 - 5   GND
GND   5 - 4   GND
RXD   6 - 3    RXD
DSR    7 - 3    DCD
CTS    8 - 1    CTS

T-1 cross-over cable for back to back connection:

Typical T1 configuration:

ip address 10.1.12.2 255.255.255.0
no fair-queue
no dce-terminal-timing-enable
service-module t1 clock source internal
service-module t1 timeslots 1-24

other side the same except:

diff IP, of course, and:

service-module t1 clock source line

56k 4 wire cross-over for back to back connection:

56k 4 wire back-to-back typical config:

special considerations:

• You cannot use a clock rate of auto on either side of the back-to-back setup
• You cannot use a clock rate of 64 .
• You cannot use switched-56 operation .

ip address 192.168.1.1 255.255.255.0
service-module 56k clock source internal
service-module 56k network-type dds

otherside:


ip address 192.168.1.2 255.255.255.0
service-module 56k clock source line
service-module 56k network-type dds

Avocent Cyclades to ADVA rj45-rj45

This one took me longer to wrap my head around while learning more about Digital signalling.

I had these to work with:

Cyclades RJ45 to DCE DB-25 pinouts

And the ADVA documentation for the RJ45 to DB-9 pinout.

Once I figured out that the cyclades to DCE was more or less straight through, it made sense.

This resulted in my T568B end on the cyclades to the ADVA end:

1 wht/org - pin 8 (RTS - RTS)

2 org        - pin 3 (DTR - DTR)

3 wht/grn - pin 6 (Txd - Txd)

4 blu        - pin 4 (GND - GND)

5 wht/blu  - pin 7 (CTS - CTS)

6 grn         - pin 5 (Rxd - Rxd)

7 wht/brn - pin 1 (not used DCD - DCD)

8 brn        - pin 2 DSR - DSR

I'll add more as I use them.

Avocent Cyclades for Terminal, access servers

After going through the surprisingly easy initial configuration of the Avocent Cyclades TS-3000 Terminal server, I have to say, if you are still using a Cisco 2509 or 2511 for accessing your devices, you, one, overpaid for you access server, likely, and two, you are missing out on an insane amount of features, you could have. Add to that, the fact that it's a 48 port device, and the value is through the roof.

I picked two scratch and dent TS-3000's on Ebay for around $40 a piece, roughly 1/2 to 1/3 what a Cisco 2509 generally goes for. The CLI based initial config wizard to put it on my LAN was simple and took all of 5 minutes.

Because you use a serial rollover cable to connect to equipment, I can build my own custom cables, for around $0.25 a piece.

The web-based config options are extensive, as are the the security options.

All in all, a great device. There are a few people selling literally hundreds of them on Ebay right now. I may pick up 5-10 for the racks I sell.

And with the TS-3000, I can go back to running Putty Manager. I was missing my tabs...(I think I'll likely be ponying up for a Secure CRT license, though.

http://www.vandyke.com/

Junipers Router JWEB

Since I posted the Cisco GUI for the 3560, I thought, since the J2300 came in today, that I'd post a pic of the Jweb interface page on the juniper. This is old as the hills, as this thing came with Junos 7.3, circa 2004.

It's pretty similar. One wonders why we don't use these more.

The rack is definitely looking more interesting, if not more useful.

The Cyclades Term server and the Adva Carrier ethernet switch came in today as well. I haven't begun to sort out the Cyclades yet, which is linux based, and the Adva came with a DC power supply, so I'll have to wait for the AC P/S I ordered today to come, assuming it was the right one. There's not a lot of info on the ADVA site, and my login credentials to the Adva customer portal is at work.

I can already tell that the Adva SFP's are not going to be the killer, but it's going to be the Juniper SFP's on whatever EX switch I end up getting that is going to break the bank.

I'll say one thing, physically, everything about a Juniper or an Adva device appears to be of higher quality than on any Cisco device I've had. The Adva, made in Germany, is on a much higher plane of quality than the other two. Probably comparing apples and oranges, but just an observation. I've now worked with Cisco, Juniper, Alcatel, Marconi, Nortel, and Adva routing and switching gear, and the Adva stuff seems to be more like Nortel used to be, if anything, over-engineered.

The rack with it's new additions.

I spent about an hour configuring the wrong T1 interface in the Juniper, thinking I had missed some crucial option in the T1-options, not realizing that T1-0/0/0 is actually T1-0/0/2, after the FE0/0/0, and FE0/0/1. anyway, I'm pinging J2300 to 1841 on T1 interfaces for the first time.

To contrast the config differences:

J2300

   t1-0/0/2 {

        mtu 1504;

        clocking internal;

        encapsulation ppp;

        t1-options {

            timeslots 1-24;

            buildout 0-132;

            line-encoding b8zs;

            framing esf;

        }

        unit 0 {

            family inet {

                address 10.0.0.3/24;

1841

interface Serial0/0/0

 ip address 10.0.0.1 255.255.255.0

 encapsulation ppp

 no fair-queue

 service-module t1 cablelength short 110ft

 service-module t1 timeslots 1-24

New equipment trickling in... and another Juniper acquisition

After selling 5 systems over about a week and a half, my entire CCNA rack was bare, and ALL of my access servers went to good Cisco studying homes, I had to reload.

So I now have here, or on the way:

Cisco:

10 x 2960-TTL
2 x 2610xm 128/32
3 x 2611xm
3 x 2610 64/32
1 x 2620
1 x 2509rj access server

Term Servers:

2 x Avocent Cyclades TS-3000

Juniper:

J2300 Router

SRX 210b Service Access switch (a 3:30am ebay auction win for $200 !)

ADVA:

FSP-150CC - GE206V Carrier Ethernet Access switch

So my own study rack will be getting much more interesting and fiber based, in line with some coming changes at work in which my job will becoming much more Juniper (and Cisco) based again soon.

I'm replacing the rental racks access servers with the Avocent Cyclades TS-3000

These support SSH, GUI based management, and by-port authentication, which will result in a more seamless studying experience, allowing use of more effective tabbed terminal emulation which the menu-based setup I had didn't really accomplish well. The fact that I picked up two of them for half the price of a single cisco 2511 didn't hurt either. Hopefully they will work.

The start of the Juniper lab is exciting as well. I'll have to integrate it into the CCNP lab for now, with another SRX 210, and a couple EX2200 or 3200's still needed to build the stand-alone lab.