Cisco Blog

Navigating Cisco.com Documentation

2010-03-10T00:21:25Z

Just came across this link: Navigating Cisco.com Documentation. What a fantastic walk-through!

ASA/PIX Order of Operations

2010-03-04T23:45:15Z

Much thanks to Joshua Walton for forwarding this info over to me - handy reference:

====================
Packet Flow Sequence
====================
PIX/ASA - Inside (Higher Sec_Lev) to Outside (Lower SEC_Level)
---------------------------------------------------------------
Eg. Type - [Sub-Type] - Description
1. FLOW-LOOKUP - [] - Check for existing connections, if none found create a new connection.
2. ROUTE-LOOKUP - [input] - Initial Checking (Reverse Path Check, etc.)
3. ACCESS-LIST - [log] - ACL Lookup
4. CONN-SETTINGS - [] - class-map, policy-map, service-policy
5. IP-OPTIONS - [] -
6. NAT - [] - xlate
7. NAT - [host-limits] -
8. IP-OPTIONS - [] -
9. FLOW-CREATION - [] - If everything passes up until this point a connection is created.
10. ROUTE-LOOKUP - [output and adjacency] -

]]> Much thanks to Joshua Walton for forwarding this info over to me - handy reference:

====================
Packet Flow Sequence
====================

PIX/ASA - Inside (Higher Sec_Lev) to Outside (Lower SEC_Level)
---------------------------------------------------------------
Eg. Type - [Sub-Type] - Description
1. FLOW-LOOKUP - [] - Check for existing connections, if none found create a new connection.
2. ROUTE-LOOKUP - [input] - Initial Checking (Reverse Path Check, etc.)
3. ACCESS-LIST - [log] - ACL Lookup
4. CONN-SETTINGS - [] - class-map, policy-map, service-policy
5. IP-OPTIONS - [] -
6. NAT - [] - xlate
7. NAT - [host-limits] -
8. IP-OPTIONS - [] -
9. FLOW-CREATION - [] - If everything passes up until this point a connection is created.
10. ROUTE-LOOKUP - [output and adjacency] -

PIX/ASA - VPN - Inside (Higher Sec_Lev) to Outside (Lower SEC_Level)
---------------------------------------------------------------
Eg. Type - [Sub-Type] - Description
1. FLOW-LOOKUP - [] - Check for existing connections, if none found create a new connection.
2. ROUTE-LOOKUP - [input] - Initial Checking (Reverse Path Check, etc.)
3. ACCESS-LIST - [log] - ACL Lookup
4. CONN-SETTINGS - [] - class-map, policy-map, service-policy
5. IP-OPTIONS - [] -
6. NAT - [] - xlate
7. NAT - [host-limits] -
8. VPN - [encrypt] -
9. VPN - [ipsec-tunnel-flow] -
10. IP-OPTIONS - [] -
11. FLOW-CREATION - [] - If everything passes up until this point a connection is created.
12. FLOW-LOOKUP - [] - On the new header
13. ACCESS-LIST - [] - On the new header
14. FLOW-CREATION - [] -
15. ROUTE-LOOKUP - [output and adjacency]

ASA/PIX - Outside (Lower SEC_Level) to Inside (Higher Sec_Lev)
-----------------------------------------------------------
1. FLOW-LOOKUP - [] - Check for existing connections, if none found create a new connection.
2. UN-NAT - [static] -
2. ROUTE-LOOKUP - [input] - Initial Checking (Reverse Path Check, etc.)
3. ACCESS-LIST - [log] - ACL Lookup
4. CONN-SETTINGS - [] - class-map, policy-map, service-policy
5. IP-OPTIONS - [] -
6. NAT - [rpf-check] -
7. NAT - [host-limits] -
8. IP-OPTIONS - [] -
9. FLOW-CREATION - [] - If everything passes up until this point a connection is created.
10. ROUTE-LOOKUP - [output and adjacency] -

More CCNP Update Resources

2010-03-02T16:06:48Z

Some handy links I just discovered on Cisco's website for the new CCNP:

CCNP Cert Combination Tool: Figures out what CCNP exams to take based on what you have

ESIM Tutorial: A walk-through on how to work with the new CCNP question types

TSHOOT Demo Simulation: Give you an idea of the question types on the new TSHOOT exam (wow - this looks intense!)

Testing AAA on ASA/PIX

2010-02-20T00:29:04Z

Stole this one from the Cisco Reader Tip - very handy! Allows you to test AAA user authentication from the ASA command-line:

ASA# test aaa-server [authentication|authorization] [host |] username password

For example:

ASA# test aaa-server authentication TACGroup username johndoe password cisco123

if authentication is successful - INFO: Authentication Successful
if authentication fails - ERROR: Authentication Rejected: Unspecified

Recover ASA Software from ROMMON

2010-02-17T21:23:38Z

Just putting these commands in a handy place since this seems to happen more often than I thought...

rommon #1> ADDRESS=192.168.1.10
rommon #2> SERVER=192.168.1.1
rommon #3> GATEWAY=192.168.1.1
rommon #4> IMAGE=asa800-232-k8.bin
rommon #5> PORT=Ethernet0/0
rommon #6> tftp

ISO to USB Stick

2010-02-12T22:33:53Z

Image via Wikipedia

I recently was attempting to install CUCM 7 on an older MCS-7825 server...unfortunately, the server is old enough that it only had a CD-Rom drive (and CUCM 7 is on DVDs)...Stumbled onto this utility:

http://sourceforge.net/projects/unetbootin/

Allows you to "burn" an ISO image onto a USB stick (and make a bootable USB drive in the process). Nice! Worked well for my CUCM install, but has a million other uses too.

ASA SSL Clientless VPN Plugins

2010-02-03T15:43:09Z

Image via Wikipedia

These plug-ins are buried so deep in the Cisco site, it took me a good hour to track them down. These allow you to add functionality to the clientless SSLVPN on an ASA through Java. These ROCK for setting up remote administration (without a full VPN) for a network.
SSH Plugin
RDP2 Plugin (supports Win2008/W7)
VNC Plugin
*Note - for the RDP2 plugin, the ASA does not have a built-in plugin type for it. You must manually type "RDP2" as the plugin type when uploading it to the ASA* - click thumbnail below for screencap.

CCNP Update: Changes in a Nutshell

2010-01-25T15:07:56Z

Image via Wikipedia

Okay, here's the scoop:

CCNP will now be three exams, ROUTE, SWITCH, and TSHOOT
Exam price will increase from $150.00 to $200.00 per exam
ROUTE and TSHOOT courses (typically 1 week Cisco official courses) are now supplemented with e-learning material (nearly 8 hours for ROUTE and 9 hours for TSHOOT) which is exam material
Classes / Exams are becoming even MORE real-world (TSHOOT class is 92% hands-on)
New ROUTE and SWITCH exam is available in March, TSHOOT is available in April.
BSCI exam can substitute for ROUTE or vice versa
BCMSN exam can substitute for SWITCH or vice versa
ONT and ISCW exams can substitute for TSHOOT until end of July (ONT/ICSW exams expire then...BSCI and BCMSN are no longer offered after July 31, however can substitute for ROUTE / SWITCH for their entire 3 year expiration period).
New CCNP exams now prepare you more for the CCIE R&S

I think this update is awesome...anything that maps to a more real-world environment is great! Less exams are also a good thing. Cisco has removed much of the CCNP overlap with CCVP (QoS is virtually gone, which is all the ONT exam really was in the first place).

Gives a Whole New Meaning to CatOS!

2010-01-20T23:49:17Z

One of my CBTNuggets students forwarded this over to me. Freakin' amazing use of a Cisco 1900 series switch. Wish I could do something like this for my fish tank!

http://www.newtonnet.co.uk/catfeeder/

The CBTNuggets iPhone App Rules...

2010-01-04T20:19:28Z

Image via Wikipedia

Okay, I've got more useless iPhone apps than I care to admit...but CBTNuggets just released their iPhone app and it's awesome. I was learning how to configure MS Exchange 2007 Storage Groups on the way to Pizza Hut last night. Nice!

...watching the demos does create quite the driving adventure though...

Oodles of Free Cisco Tools

2009-12-30T16:30:29Z

While randomly searching for a Cisco DSP Calculator, I came across this link with a plethora of free Cisco tools - go Brad Reese! (a fellow I commonly see in Network World magazine).

GNS3 Now Supports JunOS!

2009-12-05T00:02:54Z

Wow - this will save me some cash when I decide to finally learn the "dark side of the force".

GNS3 0.7RC1 Supports JunOS

Random Shortcut: Copy R S

2009-12-04T23:42:55Z

I recently stumbled on this...If you try to shortcut copy running-config startup-config with anything shorter than copy run start you'll get an ambiguous command error (ex: copy ru st). However, the Cisco IOS does allow you to type copy r s as a shortcut. Who knew?

...Yes...I still like wr better too.

I Believe This is the Best Error Message I've Ever Seen

2009-11-18T18:28:51Z

Bigger, Better, Faster: The ISR G2

2009-11-17T19:18:06Z

I was on a call with someone today who said they just ordered an ISR G2 from Cisco. Huh? (That'd be my response). Wow - just looked into this; welcome to the "next level" of ISR routers:

Comparing the ISR to the ISR G2

I'm just excited about the "one IOS image" finally coming to consumer-level routers!