@Craig-Walsh,

Right on! remember take the time to work it out logically on paper. Work your ACE (Access Control Entries) from the most specific to the most general (top to bottom in order).

@Arctic said in CCNP: OSPF Area Types Part 1&2 - show notes:

Hello,

Could you please double check the area type comparison table in the show notes?

I think it is supposed to be more like this:

~~~~ Type O O-IA O-E1 O-E2 ASBR Standard Yes Yes Yes Yes Yes Stub Yes Yes No No No Totally Stubby Yes No No No No NSSA Yes Yes No No Yes Totally Stubby NSSA Yes No No No Yes ~~~~

Thanks for pointing this out. We switched the NSSA and Totally Stubby in our table. I'll try and get this changed!

update: I've submitted the change and it should be reflected in our notes!

@scott-maser said in DHCP Snooping Rate:

I was watching your Layer 2 attack mitigation session and you discussed setting a DHCP snooping rate to 10. You said after 10 tries, there are no more DHCP message allowed. When you ran the Show DHCP Snooping command, the rate of 10 was for Packets per Second (PPS). Does the limit of 10 reset every second? I would think you could still starve a DHCP with 600 requests in a minute. If the requests really stop at 10 for good, how d you reset the port?

Great question!
The key here is understanding what does it mean by "pps." I'm inferring from your question that you're thinking the entire DORA = a packet.

But change that thought for a moment. The DORA process is actually 4 separate packets. So that per second, the max addresses you will end up up consuming per second is about 2 if you set it to 10pps.

Hope this helps!

@Acky,

Each Transcender practice exam is created for the exam it's designed to help you pass.

There will be some overlap on the exams therefore the practice exam will include questions that you might find on both exams and even questions you may find in the comprehensive CCNAX exam. I cannot really say how much overlap but fundamentals are fundamentals and will be included on every Cisco exam.

@Arrey-Ashu127,

The 100-105 exam objectives are newly released. We will have labs available for them when the lab provider makes them available. At this point, we do not have a schedule on the release date of labs for the newer objectives.

@Eduard-Luca,

If the Layer 2 switch has the DHCP feature in, I believe they all do but I'm not 100% sure that it is in every every layer 2 switch!

@Acky said in CCNA Lab ICND1 Troubleshooting InterVLAN routing:

Love the labs. I do have a couple questions on this specific lab (ICND1 Troubleshooting InterVLAN routing). When it comes to learning something new, I like to first figure out a step by step method on discovering and figuring out issues, rather than just going on instinct on what I think the problem is. (I might do that in the field after experience and knowing the system) In the labs is pretty much pointed to where the problem is, so it's not difficult to find the problem. I want to try and find ways and methods of seeing the issues through show commands, stats, tools, to locate the problem.
One of the first steps in this Lab was pinging from a router to a switch in the same routing area and then seeing the route the packets were following. Questions

When you're pinging from a router where are you pinging from? (Interface, IP address ?) I was trying to figure out how the packet would be routed through this network. I know instinctively, that traffic, in this case, should not be traveling out the 172.14.0.0 network, but I would be able to explain- why not? I am missing something.
I do see where in showing IP routes that the network route for 192.168.4 is different than the interface on the same network. That was a big clue. Anyway, I have other questions, but I'll start with this one. I want to be able to follow where the packets should be routed without doing any trace routes, is that unrealistic? Thanks

When using the router to ping, the source IP address, by default, is the IP address of the exiting interface of the ping. The routing table should help you to find destination network and the interface that the ping will exit. You can change this by using advanced PING and changing the source IP. You change it to any IP address on any interface on the router.

@Brian-Phillips77,

For the switches, the cisco press books have pointed out the 2960 for layer 2 switches running the latest version of the Cisco IOS. When it comes down to it, though the switch that you can run the latest Cisco IOS for that model is the key. They don't specifically call out a layer 3 switch model but they do emphasize the need to be familiar with them for inter-vlan routing configurations...so again if you can any layer 3 switch will do. You'll need to understand for example the different between the DTP dynamic desirable and dynamic auto defaults ( 3550 by default, ports are set to desirable and 3560 by default, ports are set to auto)

For the Routers, the 2800series and 2900series is normally what you'll see there but the key again is make sure that they can run IOS 15.x.

Essentially, what cannot run the latest IOS on the routers, you shouldn't do it, according to cisco. Having said that, version 15 is not a new and improved version over the 12.x IOS as much as it's a licensing model upgrade.

@Brett-Ferrell On a side note, in studying for my CCNP my reading indicates that doing L3 at the core is really the old way of doing things now, Because L3 switches are practically as much money as L2 these days it's not so uncommon to extend L3 even to the access layer.

From the CCNP FLG
"deploying a Layer 2 switching design in the access layer may result in suboptimal usage of links between the access and distribution layer. In addition, this method does not scale as well in very large numbers because of the size of the Layer 2 domain. Using a design that leverages Layer 3 switching to the access layer VLANs scales better than Layer 2 switching designs because VLANs get terminated on the access layer devices. Specifically, the links between the distribution and access layer switches are routed links; all access and distribution devices would participate in the routing scheme. The Layer 2-only access design is a traditional, slightly cheaper solution, but it suffers from optimal use of links between access and distribution due to spanning tree. "

@Acky,

Thanks for the feedback. I'll let the team know. Also, if you need help with subnetting. You can always post questions here in the forums too. Not only is our team pretty good but also our members are pretty good too! So please feel free to ask questions!

Also take a look at our CompTIA Network+ shows on IP addressing and subnetting. This is where we break it down for the beginner and the multiple ways you'll see subnetting questions for certification exams.

Like riding a bike. You never truly forget.

I'm in the same boat. I got my CCNA in 2010 and i've kept it active but I am in desktop support so very little of my training is actually used. So I've forgotten a lot of stuff. That is why I lurk in these forums and the cisco forums so I can keep up to date on stuff.

Anyway, really glad we could help!

@Dale-Ackerman said in CCENT Troubleshooting Encapsulation Mismatch:

On the CCENT, Troubleshooting episode at the 44:51 time frame, you discuss encapsulation mismatch on a trunk and the fact that you need to "stare and compare" the port configurations on both ends.
In troubleshooting this issue, what would the initial complaint be? Someone can't reach someone else- even on the same VLAN (if seperated by the router) or nobody is getting past the router (ie internet)?

Ok. So in your situation both would probably happen. The trunk will not work and therefore the traffic in the same vlan on both switches will not be connected. Depending on where the router is connected, it could cause this as well.

Would an interface status of either port show anything with the packets?

no, it will just fail to send traffic across the trunk if it's mismatched. if you run a show int trunk and your switch doesn't appear to have one and it should that would be indicative of the trunk being down.

@elasticskywalker,

We are in the works of with our provider about the 210-260 labs but they are not ready yet. We're going to say soon but we don't have anything official as a time line.

The older labs will help to get you access to just about all the equipment you'll see possibly on the exam though. Remember the key here is work through the GUI but to also the CLI. The bridging document for the 210-260 emphasizes the CLI in configuration.

@Daniel-Espinal said in CCNA - Troubleshooting: Trunking & Etherchanneling:

going through setting it up I see all the reasons why it wouldn't work.

Great learning experience. You mentioned a tunnel. I have yet to try a GRE set up. I have no clue how I'd go about doing it across 2 paths but learning is half the fun.

This is where you would setup some layer 2 tunneling that would be complicated but in your diagram that would have tunnel exiting traffic leaving SW1 to be tunneled through SW3 to exit out to a connection between SW3 and SW2. Then you would have to do the same for each switch and each direction. This is complicated in the extreme and thereby rarely done because you're essential creating a band-aid so that you can implement EtherChannel when the other two options that Don mentioned would actually be preferable.

@elasticskywalker Thanks for pointing this out! We have now added the link to the course page.

@James-Schickley,

Wendell Odom's book is top notch and comprehensive; Cool thing is that you're able to practice the configs through our premium labs on real equipment. Remember "Speed and Accuracy" is the key. One or the other will not do for your CCENT and CCNA studies.

@Daniel-Espinal said in CCENT - Troubleshooting - IP Interface Question:

@Ronnie-Wong said in CCENT - Troubleshooting - IP Interface Question:

if you convert that 255.255.255.255 to Hex you're sending to FFFF.FFFF.FFFF, this is the Layer 2 broadcast address. So it's not limited to the Layer 3 subnet.

not to be a jerk but 255.255.255.255 is a 32 bit number while FFFF:FFFF:FFFF is a 48 bit number. You can't really convert between them because of the structure of the two addresses anyway. IP addresses have 4 sets of 8 bit numbers while MACs have 3 sets of 16 bit numbers. 255.255.255.255 actually translates into FF-FF-FF-FF.

No doubt, as usual my poor attempt at relaying a concept failed. I just meant to say they're equivalent. the 32 bit subnet mask translates into the layer 2 broadcast of ALL bits.

This is a great question, I never realized there are different types of broadcasts. Learn something new everyday.

This is why the depth of networking protocols are defined in the RFCs. We normally don't need to go this far in depth in practical networking skills but it's nice to know that there is a final authority and a finite and clearly defined limits to networking.

Furthermore the reason why it's better to use the IP of 255.255.255.255 is that it's limited to the LAN as Ronnie pointed out. By default directed Broadcast are disabled because if not then anyone not on your LAN can send a broadcast to your local LAN. This is very dangerous.

lol, np.
Thanks

@Dale-Ackerman said in CCENT Basic router configuration:

On basic switch and router configuration, I have a few questions:

Is it necessary or is there a good reason to use the "enable password" command as opposed to "enable secret" command"?

There is no real good reason to just use enable password unless you need the password to be read in the startup-config. You may just so that you can lookup up the password from a backup of the config.

Are you just showing it as a command to know, but not necessarily use?

Yes, just showing the password command. it's part of understanding the options that are available. Remember you can still encrypt the enable password but only with a level 7 encryption and that's not much encryption if you used service password-encryption

Is the SSH version 2 command necessary after generation of the key? I thought the SSH ver that is reflected in logs would be good enough?

Yes or No, to the first question. Respectively, if you want to ensure that SSHv2 is only used, then the ip ssh version2 is necessary; if you allow both SSHv1 and SSHv2 to be used, then it's not.

The CCENT lab has us setting up the SSH connection so that it immediately enters into Privileged mode. What if I want the SSH connection to enter into User mode and require them to enter the enable password if they need to gain further access?

Usually, when you setup username Ronnie password cisco123, this gives you the ability to use basic local username/password database. Then when you use enable secret cisco123 and go to your line con 0 or line vty 0 15 and used local login command, you can then exit all the way out or drop the console connection and connect back. That should give you the ability to do what you want.

Thanks

Ronnie,

Cisco made the change to open distribution of Packet-Tracer and announced it with the CCNA exam updates. I saw it on one of the Cisco webinars discussing the changes to the CCNA exams.
This is very handy and a neat toy to play with too.

William