QoS classification/marking using PBR

Most of you already know the 2 usual methods of doing QoS classification and marking:

Use MQC:

class-map match-all HOST-CLASS
 match access-group name HOST-ACL
!
class-map match-any P2P-CLASS
 match protocol fasttrack
!
policy-map TEST-POLICY
 class HOST-CLASS
  set ip precedence 3
 class P2P-CLASS
  police 64000 conform-action set-prec-transmit 0 exceed-action drop 
!
ip access-list extended HOST-ACL
 permit tcp host 10.0.0.1 any eq telnet
!
interface serial 2/1
 service-policy input TEST-POLICY

Use legacy QoS, aka CAR:

interface serial 2/1
 rate-limit input access-group 100 64000 8000 8000 conform-action set-prec-transmit 3 exceed-action set-prec-transmit 0
!
access-list 100 permit tcp host 10.0.0.1 any eq telnet

If you have already used QoS policy propagation via BGP (QPPB) you might get the idea more easily about the next method :

Use PBR:

route-map QOS-MAP permit 10
 match ip address HOST-ACL
 set ip precedence 3
!
route-map QOS-MAP permit 20
 match ip next-hop 99
 set ip precedence 0
!
interface serial 2/1
 ip policy route-map QOS-MAP
!
access-list 99 permit 192.168.0.1
ip access-list extended HOST-ACL
 permit tcp host 10.0.0.1 any eq telnet

No sign of MQC, no sign of CAR, just simple PBR. So now you know what you can do, if you're told to configure QoS classification/marking without using neither MQC nor CAR. Just keep in mind that PBR happens only in the ingress direction.

CCIE R&S Lab info by Maurilio Gorito - Mar-Apr 2008

After the October 2007 update from Maurilio Gorito (content manager for the CCIE R&S) which helped me a lot, here is a newer one (Mar 21, 2008) based on what happened on the recent "ASK THE EXPERT - PREPARING FOR CCIE IN ROUTING & SWITCHING" Q&A session, that might help you this time.


you can visit the lab testing facility. If you want to anticipate that you are going to visit the lab facility you can contact our support team at www.cisco.com/go/certsupport to have this arranged. Or, upon your arrival, one or two days before the exam, you can go to the reception of the lab location and ask the receptionist to contact the lab Proctor.

Some times the Proctor may not be available at the time you arrived but he or she can work with you to find a good time to give you a tour.
...

The approach our CCIE Lab operations is taken is to redirect the queries that are no longer available at www.cisco.com/univercd to the current and valid web page.

Every time a page is moved our lab team creates an entry allowing the new path, so all needed documentation will be available for candidates.
...

The decision of changing or replacing the 'univercd' documents is a Cisco corporate decision and they are working on it for some time now, but now we are getting to the point this is moving faster now.

This is a big transition for all of us, and at the CCIE program we are watching this transition really closely to make sure candidates you have access to all needed documentation during the exam.
...

Candidates will have available online access to all needed documentation needed for the exam. During the transition of the old Doc CD we are allowing access to the Cisco websites that contain the documentation that was moved.
...

The DocCD or online documentation is the reference for you to study as we base our exams on it. You don't need necessarily to master everything but be familiar walk through the documentation.
...

Acrobat Reader is to be available to candidates on their desktop during the exam. If a candidate experiment difficult with that he or she must report it to the Proctor. It might be cases where the desktop went to a repair and it is not working properly. Ultimately again, it must be reported to the proctor during the exam.
...

No changes on the blueprint are planned for the next 3 months. This are only rumors.

As you mentioned, any changes to the exam blueprint is announced at our website with at least 6 months in advance. If there is no announcement there, no changes planned.
...

The exam is a set of questions with some requirements you will need to fulfill. When it comes to IGPs you will find scenarios involving RIP, EIGRP and OSPF and in some situations you will have border routers running more the one routing protocol.

One key point of the exam is that you need to keep in mind, at the end of the exam, is to make sure you have full connectivity through your network.

If no specific requirement or restriction is stated in the question you are free to take the approach you fell more comfortable to achieve the results.

You will not be marked down if you do not configure something that is not explicitly stated.
...

The idea is to emphasize MQC, however you might see some legacy QoS as it still being used in the field.
...

At the current lab environment we do not explore much on DVRMP and studying for the exam focus on basic scope as you mentioned, such as basic configuration and basic DVRMP tunnel mode.
...

No, we don't cover IPv6 BGP in our exams yet. You are correct to assume that if a topic or content is not listed on the blueprint it is not tested in the exam. If we will start covering we will add it to the blueprint.
...

While you have extra documentation in our online resources you will find in the written and lab exams only what you have listed on the blueprint.

So, you can assume that only topics listed on the blueprint will be in the written exam.
...

Yes, it is far to say that as the CCIE R&S has as its foundation the core of the network emphasizing Switching and Routing. Anything else is built upon that.

Even though having the CCIE R&S will give you an excellent foundation towards the CCIE SP you can go straight to the CCIE SP.

The main difference between the two tracks in terms of content or topics will be: MPLS, VPN, IS-IS. These topics are not currently test on CCIE R&S lab exam. MPLS only is covered on the CCIE R&S written exam.
...

Currently we have in Asia as a full time CCIE labs Beijing and Tokyo.

We are planning to start beginning in April to offer seats as full time basis are Hong Kong, Dubai and Bangalore.
...

However, we have hired a full time proctor for Dubai and we expect he will be ready to be in charge of the lab still in April, if not in May.

We do really expect this situation for Dubai to be changed soon.
...

At the moment we are not planning to open CCIE Lab location in Africa. However, we are studying ways to reach those locations that we do not have a physical lab, per example to have a mobile lab that we can do it. We are piloting this idea now and we are expecting to roll out it at some time yet in 2008.
...

The Bangalore lab was closed because we didn't have a dedicated full time proctor to cover the lab. Now we have and starting in April we will be opening Bangalore in a regular basis. You may not seem availability for December yet as usually we open it up between 6 to 8 months in advance.
...

At the moment we don't have plans to open another lab in Europe besides Brussels. We are studying ways to expand our offering for CCIE lab exams in 2008. Keep tuned at our website for news on it.
...

Proctors do not touch any of the candidate’s devices during the exam. The only exception will be if a candidate thinks that something is not working because a possible failure on your rack the Proctor will very it, but the candidate will be aware of it. Proctors do not touch or play with candidate’s configuration during or after the exam.

When you start the exam your routers and switches will have an initial configuration such IP addresses, hostnames, passwords. Depending of the exam you may have more pre-configuration. The 'General Guidelines' of the exam will state what you can change and what not can be changed.

We do have a process to development each question of the exam and it is based on results. By the end of the exam Proctors use an automatic tool to save the candidate's configuration into our database and to verify some questions and do some connectivity tests like pings, verify routing tables, and so on. Then Proctors will manually verify the results and all remaining questions to come up with the final score.
...

We have different exam versions and then the initial or pre-configuration will very. You don't need to very your exam initial exam when you start as it will be ready.

Managing the time during the exam is crucial. My suggestion is that you at the beginning of the exam to read the entire exam so you will know what you will have through the exam. Then a good strategy is to start working on the questions you see as easy and not to waste much time on a question. If you are having difficult skip it and come back later. Also, once you worked on a question verify if your network still working, in another word, make sure that after you have configured something new you have no broken anything else.
...

Yes, it will vary from person to person, the time you have until your lab exam, how many hours you can allocate daily just to study and your level of hands-on experience.

Considering the above factors I would say after you have passed the CCIE R&S written exam and dedicating 20 to 24 hours per week having hands-on practice applying what you have learned and your experience, I believe you will be well prepared to take the lab exam in 6 months.
...

I hope you have found some useful info in there ;)

Books for MPLS

I have just started my preparation for the MPLS exam (last one of CCIP) and i'm looking for some relevant books to buy.

I need a book that covers the basics and another one (or two) for the advanced stuff plus design principles/architectures. Preferably a book from the 2nd category should help me in the CCIE SP track too.

During the last week i've been doing an online research and after reading many customer reviews, i think there is something missing from the world of MPLS books. There is no such book as a MPLS bible (although Ivan's 1st -quite old- book has received many good reviews). Do you also wonder why there isn't any recent book about MPLS that covers "everything"? I hope Jeff Doyle will decide to write one...

So, these are the ones i have come up until now:

Basic MPLS
MPLS Fundamentals (2006)
MPLS: Implementing the Technology (2001)
MPLS: Technology and Applications (2000)
Rick Gallaher's MPLS Training Guide: Building Multi Protocol Label Switching Networks (2003)
MPLS Configuration on Cisco IOS Software (2005)
MPLS and VPN Architectures (2000)
MPLS and VPN Architectures, CCIP Edition (2002) (anyone know the difference between this and the above one? is it more recent?) - check "Update 11 May 2008" below for details

Advanced MPLS & MPLS Design
MPLS and VPN Architectures, Volume II (2003)
Traffic Engineering with MPLS (2002)
Advanced MPLS Design and Implementation (2001)
Definitive MPLS Network Designs (2005)
Layer 2 VPN Architectures (2005)
MPLS-Enabled Applications: Emerging Developments and New Technologies (2005)


Do you have any (other) recommendations?


PS: Has anyone living in Europe ordered a book from Cisco Press? Any problems? I have earned a coupon code for 35% but i'm afraid i'll pay that in taxes when entering my country. I wonder, why isn't there a Cisco Press online bookstore in Europe, like amazon.co.uk?
Keep in mind that buying from a local (greek) bookstore is not an option for me, because i'll pay double the price (i learned my lesson from the CCIE books).


Update 11 May 2008...
I got an answer from Ivan Pepelnjak regarding his books, which clarifies many things:

Here is the full story: MPLS and VPN Architectures Volume I and II are completely separate books with only slight overlap. Volume I was written when MPLS and MPLS VPNs were an emerging technology, thus the coverage of some solutions (like Carrier's Carrier architecture) was scarce (as they were mostly on the drawing board at that time). We've later released CCIP edition of Volume I, which includes a few bug fixes and two chapters on troubleshooting to match the requirements of the early version of Cisco's MPLS course.

The Volume II covers advanced MPLS topics, including remote access, inter-AS MPLS VPN, Carrier's carrier architecture, IP Multicast in MPLS VPN etc. Reading Volume II without having sound foundations from Volume I does not make sense.

Update 15 May 2008...
Added the "MPLS-Enabled Applications: Emerging Developments and New Technologies" book.

How to use extended-range vlans in the NM-16ESW

In case that you don't already know, in the latest IOS (> 12.4(15)T) you can use extended-range vlans (1006-4094) in your dynamips router/switch (using the NM-16ESW module). Also the vlan database mode is not recommended anymore and you can use the latest config-vlan submode. That way you can replicate more closely the various vendor labs.

I'm using a 3725 as switch, so this is its config in the net file:

 [[3725]]
  image = /usr/share/cisco-ios/c3725-adventerprisek9-mz.124-15.T5.extracted.bin
  ram = 148
  disk0 = 8
  disk1 = 0
  # The idlepc value hasn't been tested extensively, so it might not work in your case.
  idlepc = 0x6148b594

The tricky part is that you don't get any indication of this capability; it's like a hidden command. But if you try to configure it, it'll be accepted and it'll work fine.

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#vlan ?
  accounting  VLAN accounting configuration
  ifdescr     VLAN subinterface ifDescr

SW1(config)#vlan 2567
SW1(config-vlan)#name VLAN-2567
SW1(config-vlan)#^Z
SW1#

Configure this vlan under an interface:

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f1/1
SW1(config-if)#switchport access vlan ?
  <1-4094>  VLAN ID of the VLAN when this port is in access mode

SW1(config-if)#switchport access vlan 2567
SW1(config-if)#^Z
SW1

Verify the vlan:

SW1#sh vlan-sw br

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa1/0, Fa1/4, Fa1/5, Fa1/6
                                                Fa1/7, Fa1/8, Fa1/9, Fa1/10
                                                Fa1/11, Fa1/12, Fa1/13, Fa1/14
                                                Fa1/15
13   VLAN0013                         active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
2567 VLAN-2567                        active    Fa1/1

Verify the spanning-tree:

SW1#sh spanning-tree vlan 2567

 VLAN2567 is executing the ieee compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, address c200.04f8.0001
  Configured hello time 2, max age 20, forward delay 15
  We are the root of the spanning tree
  Topology change flag set, detected flag set
  Number of topology changes 2 last change occurred 00:00:19 ago
          from FastEthernet1/2
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 1, topology change 16, notification 0, aging 300

 Port 42 (FastEthernet1/1) of VLAN2567 is forwarding
   Port path cost 19, Port priority 128, Port Identifier 128.42.
   Designated root has priority 32768, address c200.04f8.0001
   Designated bridge has priority 32768, address c200.04f8.0001
   Designated port id is 128.42, designated path cost 0
   Timers: message age 0, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   BPDU: sent 193, received 0

Extended-range VLANs are not saved in the VLAN database; they are saved in the switch that runs the configuration file.

SW1#sh run | b vtp
vtp mode transparent
!
vlan 2567
 name VLAN-2567
!

If you get the following message while trying to configure the vlan under an interface, try to shut the interface, reenter the vlan and then unshut the interface:

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f1/1
SW1(config-if)#switchport access vlan 2567
% Warning: port will be inactive in non-ethernet VLAN
SW1(config-if)#^Z

SW1#sh int f1/1 switchport
Name: Fa1/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 2567 ((Inactive))
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 2567
Protected: false
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none


SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f1/1
SW1(config-if)#shut
SW1(config-if)#no switchport access vlan 2567
SW1(config-if)#switchport access vlan 2567
SW1(config-if)#no shut
SW1(config-if)#^Z

SW1#sh int f1/1 switchport
Name: Fa1/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 2567 (VLAN-2567)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 2567
Protected: false
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none

Also, as you may already know, vtp must be in transparent mode if you want to configure extended-range vlans:

SW1#sh vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 36
Number of existing VLANs        : 6
VTP Operating Mode              : Server
VTP Domain Name                 :
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xF5 0xBA 0x45 0x80 0xA7 0x6B 0x76 0x88
Configuration last modified by 0.0.0.0 at 3-1-02 00:07:07
Local updater ID is 0.0.0.0 (no valid interface found)

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#vlan 2567
SW1(config-vlan)#name VLAN-2567
SW1(config-vlan)#exit
% Failed to create VLANs 2567
Extended VLAN(s) not allowed in current VTP mode.
%Failed to commit extended VLAN(s) changes.
SW1(config)#
*Mar  1 00:02:23.247: %SW_VLAN-4-VLAN_CREATE_FAIL: Failed to create VLANs 2567: extended VLAN(s) not allowed in current VTP mode

If you get the following error while trying to change vtp mode, you can erase and then squeeze the flash in order to fix it:

SW1#conf t
SW1(config)#vtp mode server
Setting device to VTP SERVER mode
% not enough space on flash to store vlan database. trying squeeze...
squeeze in progress...
% error squeezing flash - (Unknown error 0)

SW1#squeeze flash:
Squeeze operation may take a while. Continue? [confirm]
squeeze in progress...
%Error squeezing flash (Unknown error 0)


SW1#erase flash:
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device...  ...NOT erased
Erase of flash: complete

SW1#squeeze flash:
Squeeze operation may take a while. Continue? [confirm]
Squeeze of flash complete

At the end, reload this switch from inside dynagen and everything should be fine.

4 more blogging CCIEs

Ethan Banks passed the CCIE R&S lab and is now CCIE #20655.

Victor Cappuccio passed the CCIE R&S lab and is now CCIE #20657.

Joe Harris, CCIE #6200, passed the CCIE SP lab and got his triple CCIE!!!

Congratulations to all of you guys!!! To the rest of you, just keep the numbers running...

Update 7-May-2008...

Arden Packeer passed the CCIE R&S lab and is now CCIE #20716.