Do you wanna learn more about CISCO Security history? The background knowledge on the evolution of CCIE Security is both interesting and important for Network Engineers. Learn more by reading this post!

<h2>I have been teaching the CCIE Security track since it started and have taught all the versions including the current one, version 6, which I continue to teach.</h2>

<p>Today, I am going to share some of my experiences and insights regarding the evolution of CCIE Security. I believe it will be interesting for Network Engineers to have this background knowledge.</p>

<h3>My Journey with CCIE</h3>

<p>I have been privileged (i.e., am old enough now ;-) ) to have worked and taught in the IT field since the early 1990s. I have seen networks & network security evolve from being a luxury item into a necessity.</p>

<p>In 2003, I passed my CCIE Security exam, which was version 1 at the time. It was predominantly a Routing & Switching exam with a bit of Security added on top. I also passed my CCIE Routing & Switching exam around the same time.</p>

<h4>CCIE Security v1: The Beginning</h4>

<p>At the time of CCIE Security v1, 65% of the 2 exams were almost identical. L2 technologies made up 30% of the exam, which included Ethernet Switches, Frame relay and ATM Switches. IGPs made up another 30%. Believe it or not, 15% of the CCIE Security v1 exam was BGP. Only the last 35% of the exam was the Security part!</p>

<p>The Security portion included basic IPSec/GRE VPNs, PIX Firewall (Basic Initialization), and a section on the Router-based IDS (IOS-IDS).</p>

<p>Right from the start, CISCO made a decision to take an evolutionary path rather than a revolutionary one. This eased engineers into the new field of Network Security rather than forcing the change on them overnight. When I reflect back on it, I think this was a really smart business decision on CISCO's part.</p>

<h4>CCIE Security v2: The Next Phase</h4>

<p>The next phase came with the introduction of additional security devices to the topology. CCIE Security v2 included the Cisco IDS & VPN Concentrator devices. VPN Concentrator was the first device from Cisco that had the Web VPN capability. With this version, you could start to see the shift from Routing & Switching to Security as a standalone stream.</p>

<h4>CCIE Security v3: Introduction of the ASA Firewall</h4>

<p>The next major security device introduced to the CCIE Security exam was the ASA Firewall. This was done in CCIE Security version 3. The ASA has been an integral part of the CCIE Security exam since then.</p>

<h4>CCIE Security v4: Towards a Full-Blown Security Exam</h4>

<p>Version 4, released in 2012, saw the introduction of the ISE, WLC & WSA devices to the exam. CCIE Security v4 was when the exam started to feel like a full-blown Security exam with little or no direct correlation with Routing / Switching. Over the course of 4 evolutions, CISCO had fully established Security as a standalone CCIE track with little overlap with Routing and Switching.</p>

<h4>CCIE Version 5: The Introduction of Firepower Devices</h4>

<p>CCIE Version 5 saw the introduction of the Firepower devices (FTD & NG-IPS). It also saw the inclusion of the ESA device. Although these devices were introduced, the coverage was light. The main firewall being used was still the ASA.</p# I have to use the code tool to format it correctly.
# Continuing from the previous message.
'''
<h4>CCIE Version 6: The Current Version</h4>

<p>CCIE Version 6, the current version which was released in 2020, is similar to version 5 in terms of the devices being tested. ASA was the main firewall in CCIE Security v5. The focus of this exam will be on the FTD as the firewall. The ESA should also see a bigger coverage in this exam. But the main difference, in my opinion, is the introduction of the Design element to the exam. They want you to understand the technologies beyond just configuring the devices. For example, given a customer requirement, you should be able to pick the appropriate technology to fulfill the requirement.</p>

<h3>Understanding Network Security</h3>

<p>In my opinion, network security is not implemented by using one magic device. It is a layered approach to securing your network at different levels for different threats. You need to be able to have perimeter protection using Firewalls (FTD, ASA), you need IPS devices to analyze incoming packets against a database of known network attacks (FTD, NG-IPS), you need to ensure e-mails coming into your network are clean (ESA), you need to verify that the devices that are logging into to internal networks are authorized (ISE), you need to ensure that your internal users are visiting sites that follow the corporate policy (WSA) and that your external communication is protected (VPNs). I personally like and agree with CISCO's decision to focus on Design as it makes learning required to pass the exams more relevant to real-world implementations. After all these certifications are meant to train engineers for everyday problems that they face in their work environments.</p>

<h3>The Current CCIE Security</h3>

<p>The current CCIE Security has been designed to enhance your knowledge on all fronts. It exposes you to various devices and technologies.</p>

<h3>The Benefits of Embarking on the CCIE Security Journey</h3>

<p>Based on my personal experience as well as the combined experience of thousands of students that I have taught, I can assure you that embarking on the CCIE Security journey will make you a better security engineer.</p>

<h3>Got Questions?</h3>

<p>Please feel free to ask any follow-up questions that you may have, I will try to answer them to the best of my knowledge.</p>

<p><strong>Cheers,</strong><br>
Khawar</p>


Evolution of CCIE Security

The paradigm of networking is shifting quickly and definitely towards Software Defined Networking (SDN). How does SDN differ from legacy networking implementations? Read this post to find out!

<h1 id="software-defined-networking-a-paradigm-shift">Software Defined Networking: A Paradigm Shift</h1>
<p>The way we have known networking is currently going through a drastic change. The paradigm is shifting quickly and definitely towards Software Defined Networking (SDN). In this post, I am going to share some of my thoughts on SDN and how it differs from legacy networking implementations.</p>
<p>The current networking model, which I will refer to as Legacy Networking is implemented by connecting to individual devices and configuring them. In any corporation with a sizable amount of devices, this requires a lot of resources and time. Which is neither scalable nor cost-effective.</p>
<p>SDN, which entered mainstream networking post 2015, works on the premise of Controller-based Networking where a Central device is responsible for the configuration of the complete network. This key property of SDN makes it more efficient and scalable than a Legacy Network. In the corporation mentioned above, it might have taken a company 15 network engineers to provision, manage and maintain a 100-120 device network, with SDN the same task can be carried out by 5 engineers in a much more efficient and timely manner.</p>
<p>In a SDN network, the Administrator registers the network devices on the controller. This process could be a manual process or automated. Once the device is registered, the configuration and monitoring of the device is done centrally from the controller. Configurations that are common among the network devices could be pushed together with the help of Configuration templates. Changing policies or protocols within the network also become easier and a lot more scalable as you control the changes from the centralized controller. It also helps in provisioning new devices on the network. If a new device comes up in the network, it can easily be provisioned and configured by using the templates.</p>
<p>As the network devices are already registered in the controller, the monitoring and troubleshooting of these devices is also done from a central console. The controller becomes a single pane of management for the entire network.</p>
<p>SDN is implemented using different technologies for different parts of the network. A typical network has three main aspects, the Campus Network, the Wide Area Network (WAN), and the Data Center.</p>
<h2 id="campus-network">Campus Network</h2>
<p>Cisco has a technology implementation that allows you to apply SDN technology to the Campus Network. The technology is called Software Defined Access (SDA). SDA is a technology that uses 3 components to implement SDN for a Campus Network. These components are the Controller called the Digital Network Architecture Center (DNAC). It is an appliance that is responsible for controlling the Campus Network. The second SDA component is the Campus switch. The Campus switches have to be SDA-Aware. There is a range of Catalyst switches that give you that capability. The third SDA component is the authentication server (RADIUS), preferred to be Cisco ISE. The authentication server provides the DNAC the ability to implement Intent-based networking by providing access based on the user/device that is connecting to the network. Imagine a campus with hundreds of switches that need to be provisioned or a policy or configuration change needs to be made to the entire campus network. You can implement such a change by configuring it from the DNAC rather than logging into each Network device and configuring it. SDA also provides the ability to connect to existing Non-SDA networks using L2 Handoff and L3 Handoff capabilities.</p>
<h2 id="wide-area-network">Wide-Area Network</h2>
<p>Cisco has a technology implementation that allows you to apply SDN technology to the Wide-Area Network. The technology is called Software Defined Wide Area Network (SD-WAN). Cisco’s SD-WAN technology was acquired from Viptela, an industry leader at the time, which CISCO bought in 2017. SD-WAN is a technology that uses 2 components to implement SDN for a WAN. These components are the Controllers and the WAN Edges.</p>
<p>Unlike SDA, SD-WAN has 3 controllers. The first controller called the vManage is used for all the configurations. The second controller called the vSmart is responsible for the Control Plane (Routing). The third controller (vBond) is used for authenticating the devices as they connect to the SD-WAN Network. The Network devices connect to the vBond first. Once they are authenticated, it directs them towards the vManage for Management and vSmart for Control Plane. The controllers are Virtual Machines (VMs) and can easily be implemented in the Cloud (AWS, Azure, etc). You could manage your entire WAN by logging into these controllers.</p>
<p>The second SD-WAN component is the WAN Edge. This is the routing device that sits at the edge of each network. WAN Edge is responsible for the Data Plane. All user traffic is transmitted between sites using the WAN Edge. WAN Edges are transport-independent in terms of connecting to each other. They can connect to other WAN Edges or Controllers using a MPLS Connection, Leased-lines, Broadband Connections, or the Cellular network.</p>
<p>Just like SDA, SD-WAN can also implement policy changes throughout the WAN from a central device, the vManage. This provides extreme scalability to the Network Administrator to implement new networks or make changes to existing devices.</p>
<h2 id="data-center">Data Center</h2>
<p>Cisco has a technology implementation that allows you to apply SDN technology to the Data Center as well. The technology is called Application Centric Infrastructure (ACI). ACI is a technology that uses 2 components to implement SDN for a Data Center. These components are the Controllers and the Data Center Switches.</p>
<p>The Controller is called the Application Policy Infrastructure Controller (APIC). It is an appliance that is responsible for controlling the Data Center Network. The second ACI component is the Data Center switch. The Data Center switches have to be ACI-Aware. There is a range of Nexus switches that give you that capability. As was the case with the Campus network, Data Center Network could have a large number of switches. If a new switch needs to be added or a change needs to be provisioned, the APIC allows you to configure it scalably and centrally. ACI also provides the ability to connect to existing Non-ACI networks using L2-OUT and L3-OUT capabilities.</p>
<p>In conclusion, as SDN provides a centralized controller-based management mechanism, it makes your network much more efficient, scalable and nimble versus a Legacy Network.</p>
<p>As an engineer, this would be the right time to get acquainted and start developing expertise in these technologies. Given the cost versus benefit analysis of implementing SDN technologies that I have observed, it is my opinion that over the next few years corporations will largely adopt this approach.</p>
<p>Cheers,
Khawar</p>


Software Defined Networking - The Future of Networking

Are you considering the Cisco Certified Internetwork Expert (CCIE) certification to boost your career? Great news – the CCIE certification is evolving to remain valuable and relevant in the ever-changing networking landscape! 
Here's a sneak peek into the future of #CCIE certification and how it's adapting to meet the demands of tomorrow's networking professionals:

<h1 id="introduction">Introduction</h1>
<p>In today’s competitive job market, earning a certification that validates your skills and expertise can be a game-changer. Among the numerous networking certifications available, the Cisco Certified Internetwork Expert (CCIE) stands out as one of the most respected and sought-after credentials in the IT industry. In this blog, we will delve into the importance of the CCIE certification and how it can enhance your career prospects.</p>
<p>The CCIE is a prestigious certification offered by Cisco Systems, a leading technology company known for its networking &amp; security solutions. The CCIE is aimed at professionals with significant experience in network engineering, design, and troubleshooting. It validates a candidate’s ability to plan, operate, and troubleshoot complex, converged network infrastructures.</p>
<h2 id="ccie-certification-tracks">CCIE Certification Tracks</h2>
<p>The CCIE certification is available in different tracks, allowing professionals to specialize in a particular domain:</p>
<ul>
<li><strong>CCIE Enterprise Infrastructure</strong></li>
<li><strong>CCIE Enterprise Wireless</strong></li>
<li><strong>CCIE Data Center</strong></li>
<li><strong>CCIE Security</strong></li>
<li><strong>CCIE Service Provider</strong></li>
<li><strong>CCIE Collaboration</strong></li>
</ul>
<p>Each track has its own set of exams, including a written exam and a rigorous, hands-on lab exam to assess the candidate’s practical skills.</p>
<h2 id="importance-of-the-ccie-certification">Importance of the CCIE Certification</h2>
<h3 id="1-recognition-and-credibility">1. Recognition and Credibility</h3>
<p>The CCIE certification is often considered the “Ph.D. of networking” due to its rigorous requirements and comprehensive assessment. As a result, CCIE-certified professionals are highly respected and sought-after in the IT industry. This certification not only validates your skills and knowledge but also serves as a testament to your dedication and commitment to the field.</p>
<h3 id="2-higher-salary-prospects">2. Higher Salary Prospects</h3>
<p>Earning a CCIE certification can significantly impact your earning potential. According to various salary surveys, CCIE-certified professionals often command higher salaries compared to their non-certified peers. This is primarily due to the expertise and skills that come with the certification, which are highly valued by employers.</p>
<h3 id="4-career-advancement">4. Career Advancement</h3>
<p>A CCIE certification can open doors to more challenging and rewarding roles within the IT industry. Employers often prefer to hire or promote individuals with this certification due to the value and credibility it brings. As a CCIE-certified professional, you may have opportunities to work as a network architect, senior network engineer, or even a consultant, depending on your area of specialization.</p>
<h3 id="6-access-to-a-global-network-of-professionals">6. Access to a Global Network of Professionals</h3>
<p>Being a CCIE-certified professional connects you with a global community of like-minded individuals who share the same passion for networking. This network offers the opportunity to learn from the experiences of others, exchange ideas, and stay up-to-date on the latest industry trends.</p>
<h1 id="the-future-of-ccie-certifications-evolving-with-the-networking-landscape">The Future of CCIE Certifications: Evolving with the Networking Landscape</h1>
<p>The Cisco Certified Internetwork Expert (CCIE) certification has long been considered the pinnacle of achievement in the networking industry. As technology evolves and the networking landscape transforms, the CCIE certification must also adapt to remain relevant and valuable. In this blog, we will explore the future of CCIE certifications and how they are evolving to meet the demands of tomorrow’s networking professionals.</p>
<h2 id="the-rise-of-automation-and-programmability">The Rise of Automation and Programmability</h2>
<p>Automation and programmability have become increasingly important in today’s networking world. As a result, the CCIE certification program has started incorporating these concepts into its curriculum. The updated CCIE exam blueprints emphasize the need for professionals to understand and work with network automation tools, APIs, and programmable infrastructure. This shift ensures that CCIE-certified professionals possess the skills necessary to manage and optimize modern, automated networks.</p>
<h2 id="emphasis-on-security">Emphasis on Security</h2>
<p>The increasing prevalence of cyber threats and the growing importance of security have made it essential for networking professionals to be well-versed in security```
best practices. Cisco has acknowledged this by incorporating security topics across all CCIE tracks. Future CCIE certifications will likely continue to emphasize security, ensuring that certified professionals are equipped to design, implement, and manage secure network infrastructures.</p>
<h2 id="integration-of-cloud-technologies">Integration of Cloud Technologies</h2>
<p>As more organizations adopt cloud-based infrastructure and services, networking professionals must be proficient in managing and optimizing these environments. The CCIE certification program has already started integrating cloud technologies into its various tracks, and this trend is expected to continue. Future CCIE certifications will likely cover a broader range of cloud-related topics, such as multi-cloud networking, cloud-native applications, and cloud security.</p>
<h2 id="focus-on-emerging-technologies">Focus on Emerging Technologies</h2>
<p>Emerging technologies, such as the Internet of Things (IoT), artificial intelligence (AI), and machine learning (ML), have the potential to reshape the networking industry. To stay ahead of the curve, the CCIE certification program will need to adapt its curriculum to cover these emerging technologies. As these technologies become more prevalent, future CCIE certifications may introduce specialized tracks or additional modules focused on these areas.</p>
<h2 id="continued-emphasis-on-practical-skills">Continued Emphasis on Practical Skills</h2>
<p>One of the hallmarks of the CCIE certification is its focus on practical, hands-on skills. As networking environments become more complex, the need for professionals with strong problem-solving and troubleshooting abilities will only increase. Future CCIE certifications will likely continue to emphasize practical skills, with lab exams that assess candidates’ abilities to design, implement, and troubleshoot real-world network scenarios.</p>
<h1 id="conclusion">Conclusion</h1>
<p>In a constantly evolving IT landscape, the Cisco CCIE certification remains a valuable credential that distinguishes you as a networking expert. By investing time and effort into earning this prestigious certification, you’ll unlock a world of opportunities and pave the way for a successful career in the networking industry.</p>
<p>The future of CCIE certifications is bright, as they continue to evolve and adapt to the changing networking landscape. By incorporating new technologies, emphasizing security, and maintaining a focus on practical skills, the CCIE certification program ensures that it remains a valuable and relevant credential for networking professionals. As the industry continues to transform, those who hold CCIE certifications will be well-positioned to thrive in the dynamic world of networking.</p>


Importance & Future of the CCIE Certification

 Recently, an update was made to the CCIE Enterprise Infrastructure blueprint.
Considering the significance and difficulty of the CCIE EI exam, I have taken the time to analyze the changes in version 1.1 of the Blueprint and unpack them for the KBITS.LIVE community.


<html>
<head>
    <meta charset="UTF-8">
    <title>Blueprint Differences: CCIE EI v1 & v1.1</title>
    <style>
        body {
            font-family: Arial, sans-serif;
        }
        h1 {
            color: black;
        }
        h2, h3 {
            color: black;
        }
    </style>
</head>
<body>
    <h1>Overview</h1>
    <p>The world of network engineering is in constant motion, continuously evolving and adapting to meet the modern requirements of the industry. Cisco Systems, as the industry leader and standard setter, is consistently evolving its approach related to CCIE education. Recently, an update was made to the Cisco Certified Internetwork Expert (CCIE) Enterprise Infrastructure (EI) blueprint.</p>

    <p>Considering the significance and difficulty of the CCIE EI exam, I have taken the time to analyze the changes in version 1.1 of the Blueprint and unpack them for the KBITS.LIVE community.</p>

    <p>At a higher level, the Blueprint changes reflect Cisco's ongoing focus on enhancing the prominence of Software Defined Networking (SDN) technologies, specifically SD Access and SD-WAN. As I have previously mentioned, Cisco has recognized SDN as a pivotal technology and I anticipate their emphasis on it will only grow in the next 3-5 years. For students who have been preparing for the CCIE EI exam based on the v1.0 Blueprint, I suggest deepening their understanding of SDN technologies.</p>

    <p>Now, let's delve into the changes section by section compared to the previous Blueprint.</p>

    <h2>Section 1: Routing and Switching</h2>
    <p>The new addition of Multi-chassis Ethernet use-case scenarios implies a more advanced understanding of Ethernet deployment in complex, distributed network environments. This showcases the growing importance of scalability and reliability in modern enterprise networks, which are often characterized by their vastness and multi-location features.</p>

    <p>Route leaking between VRFs is another inclusion that signifies the need for greater interoperability and communication within large-scale networks. Route leaking is a powerful tool that enables communication between different VRFs, providing enhanced flexibility and connectivity in managing separate routing instances.</p>

    <p>The increased focus on OSPFv3 Address Family configuration highlights the significance of IPv6 in contemporary networking. OSPFv3 is crucial for routing IPv6 prefixes and this skill will undeniably become even more valuable as the transition from IPv4 to IPv6 continues to gain momentum globally.</p>

    <p>As for the removal of topics such as VTP, EIGRP Load Balancing, and LFA, these changes suggest a shift in focus towards newer and more relevant technologies and practices in the field of routing and switching.</p>

    <h2>Section 2: SDN Technologies</h2>
    <p>The emphasis on SDN Technologies has been amplified in the CCIE EI v1.1 Blueprint. This is in line with the industry's transition towards a more software-defined, programmable network infrastructure.</p>

    <p>In the SDA (Software-Defined Access) section, students need to understand and implement SDA Transit, L2 Handoff, and Fabric-In-A-Box applications. SDA Transit represents the next-level requirement of integrating SDA with traditional routed networks. L2 Handoff and Fabric-In-A-Box applications are unique, scalable solutions that ensure more efficient network deployments.</p>

    <p>The SD-W

AN subsection would require more focus on Centralized Policies with App Aware Routing and Traffic Engineering. This highlights the importance of creating a more manageable, efficient, and intelligent network traffic flow in a WAN environment. The inclusion of these topics underlines the need for network engineers to understand and manipulate the behaviour of network traffic using advanced SD-WAN capabilities, crucial for modern enterprise networks.</p>

    <h2>Section 3: Security</h2>
    <p>In this section, no additional topics have been introduced. However, it is worth noting that Flex VPN has been removed from the syllabus</p>

    <h2>Sections 4 & 5: Automation and Programmability & Network Architecture</h2>
    <p>These parts have stayed pretty consistent, with no major alterations to their content.</p>

    <h2>Conclusion</h2>
    <p>Cisco's emphasis on SDN technologies in the CCIE EI v1.1 blueprint continues to grow. This highlights the increasing importance of Software Defined Networking (SDN) architectures in the field of network engineering. These skills have become crucial for professionals in the industry today and are expected to remain vital over the next 3-5 years and beyond.</p>

    <p>Now, what does this mean for individuals who have been preparing for the CCIE EI exam based on the v1.0 Blueprint? In my perspective, the change is not significant. It simply requires a deeper understanding of SDA and SD-WAN technologies. It's crucial to remember that the CCIE EI certification represents more than just technical expertise. It signifies a commitment to ongoing learning, adaptability, and a comprehensive understanding of networking at a large scale. Embrace the change, explore these topics further, and let's continue to evolve and learn together.</p>

    <p>Cheers,<br>Khawar</p>
</body>
</html>




Blueprint Differences: CCIE EI v1 & v1.1

Cisco Systems recently announced an update to the CCIE Security Blueprint, specifically to version 6.1. I spent some time during the past week to analyze the changes and share my findings with my community. 

<h1>Overview</h1>

<p>In the dynamic landscape of network engineering, change is the only constant. Cisco made changes to some of the CCIE Blueprints this year. In my previous blog, I had written about the changes made to the CCIE Enterprise Infrastructure Blueprint. In this blog I will be focusing on the CCIE Security Blueprint which was updated from v6.0 to v6.1. This is important for students currently preparing for the CCIE Security Exam as the changes will be implemented in exams starting 20th October, 2023. At a high level, the alterations are mostly minor, reflecting Cisco's ongoing commitment to fine-tuning and polishing its blueprints. The changes do not represent a radical departure from version 6.0; instead, they are subtle refinements to better align with the contemporary needs of the industry.</p>

<h2>Let's dive deeper into the changes themselves on a section by section basis:</h2>

<h3>Section 1: Perimeter Security and Intrusion Prevention</h3>

<p>This section remains largely unchanged. However, one new element has entered the scene: <b>Dynamic Object in FMC</b>. This addition underlines the significance of flexible and adaptable security solutions in our modern, dynamically evolving network environments.</p>

<h3>Section 2: Secure Connectivity and Segmentation</h3>

<p>This section has seen a minor reduction, with the removal of the topic of Uplink and Downlink MACsec (802.1AE). This reflects a shift in focus towards more contemporary and relevant practices in secure connectivity and segmentation.</p>

<h3>Section 3: Infrastructure Security</h3>

<p>There are no changes in this section, highlighting the stability and relevance of the topics in this section.</p>

<h3>Section 4: Identity Management, Information Exchange, and Access Control</h3>

<p>The change in this section highlights the increasing importance of identity and access management in securing today's complex and diverse network environments. A new topic has been added that focuses on <i>IBNS 2.0 for authentication, access control, and user policy enforcement</i>.</p>

<h3>Section 5: Advanced Threat Protection and Content Security</h3>

<p>While new topics haven't made their debut in this section, certain subjects have been given a renewed emphasis. Specifically, Cisco Umbrella product related topics such as DNS Proxy, DNS Security, RBI policies, CASB policies, and DLP policies now command more attention. This shows the growing prominence of advanced threat protection and content security technologies in the industry.</p>

<h2>Conclusion</h2>

<p>The CCIE Security v6.1 blueprint is essentially a refined version of its predecessor. The key updates - namely the inclusion of IBNS 2.0 and a stronger focus on Cisco Umbrella topics - are indicative of the evolving demands in the field of network engineering.</p>

<p>So, what does this mean for those who have been preparing for the CCIE Security exam based on the v6.0 blueprint? In my view, the changes are subtle and simply demand a sharpened focus on the updated topics.</p>

<p>Remember, the CCIE Security certification isn't just a testament to technical expertise; it represents a commitment to lifelong learning, adaptability, and a comprehensive understanding of networking at a large scale.</p>

<p><i>Cheers,</i><br>
<b>Khawar<b></p>


Blueprint Differences: Security v6.0 & v6.1

Discover how integrating various technologies like FMC, ISE, and Active Directory can revolutionize your network security. Learn about the shift towards identity-based access control in this informative blog post, demonstrating real-world examples and potential solutions to common challenges. Stay at the forefront of the ever-evolving IT landscape, enhance user experience, and strengthen your IT infrastructure security.

<html>
<head>
    <title>FMC-ISE-AD Integration</title>
</head>
<body>
    <h1>Introduction</h1>
    <p>In our ever-evolving IT industry, new devices and technologies are constantly introduced to existing networks to ensure their dynamism and adaptability. To achieve this, it is crucial to integrate various technologies and devices in order to maintain network security.</p>

    <p>One significant shift that has taken place in approaching networks is the granting of access to end-users based on their identity rather than the network they are connected from. To enable this capability, interaction between several devices that are working together needs to be analyzed. I am going to go through one such example in this blog to explain how this implementation is achieved.</p>

    <h2>FMC-ISE-AD Integration in real life</h2>
    <p>Let's consider a simple example of providing internet access to an end-user based on their User/Group credentials, rather than configuring traditional IP-based Access Control. In our network, all end-users are located in VLAN 10 (10.1.1.0/24), belonging to different departments in the company. Their access should be determined by their identity when accessing the Outside Network (R2) through the Firepower Threat Defense (FTD) firewall.</p>

<p><img class="block w-auto m-auto" src="https://kbits.live/media/blog/67/0001.png" /></p>

    <p>Let's discuss the challenges and solutions for different aspects of this flow:</p>

    <ul>
        <li>The Firewall Management Center (FMC) needs to know the Users/Group names to create an Access Control Policy based on their identities. This information is available on the Active Directory Server. To accomplish this, we can integrate the FMC with the Active Directory Domain, allowing us to create policies based on the same database used for end-user authentication.</li>
<p></p>
        <li>To grant network access and discover the dynamically assigned IP addresses, we need to authenticate the devices using a network device, the Switch. We will utilize Dot1x authentication to establish a relationship between the Switch and ISE (Identity Services Engine) through the RADIUS protocol. ISE will authenticate the end-users based on the same Username/Group Database used to create the Access Control Policy on the FMC -Active Directory integration. By integrating the Active Directory with ISE, ISE will be able to authenticate the user and determine the IP address assigned to them by the DHCP Server.</li>
<p></p>
        <li>At this point, the user has an assigned IP address and is ready to communicate with the network outside of the FTD Firewall. However, when the end-user sends data traffic towards the Outside network, the packet only contains the source IP address of the device, lacking information about the Active Directory user who logged into the device. FMC requires a mapping between the User/Group and the Dynamic IP assigned to the user. This mapping is available on ISE. To resolve this, we will integrate FMC with ISE using pxGrid, enabling FMC to obtain this information. Consequently, when the packet arrives at the FTD, it can correlate the User/Group name with the corresponding IP address, providing the required access.</li>
    </ul>

    <p>To summarize the process, we will integrate FMC with Active Directory, allowing us to download the User/Group Database onto FMC. The FMC administrator will then create an Access Control Policy based on this information.</p>

    <p>Next, when an end-user connects to the network, the switch will prompt them for a Username/Password. ISE will receive the response from the end-user and forward the authentication request to Active Directory for validation, thanks to the integration between ISE and Active Directory. Active Directory will validate the user, and ISE will inform the switch to grant access to the end-user. The end-user will be connected to the network and receive an IP address from the DHCP Server. The switch will retrieve this information and map the User/Group to the assigned IP. ISE will pass this information to FMC using pxGrid.</p>

    <p>With this integration, FMC now has a mapping between the User/Group and the dynamically assigned IP address. When the end-user sends a packet towards the outside network, FMC will utilize the User/Group mapping and IP address information to enforce the Access Control Policy rules.</p>

<p><img class="block w-auto m-auto" src="https://kbits.live/media/blog/67/0002.png " /></p>

    <h1>Conclusion</h1>
    <p>The transformation towards identity-based network access, rather than conventional IP-based access, presents a dynamic and secure approach to network management. This method enables us to manage network access in a more personalized, secure, and effective manner, reinforcing our IT infrastructure. By integrating FMC with Active Directory and employing ISE for user authentication and IP mapping, we can implement precise Access Control Policy rules, ensuring each user only accesses the network resources they are authorized for. This strategy not only strengthens our network security but also enhances the user experience. It's a fascinating journey of adapting and innovating, which underscores our commitment to staying at the forefront of the ever-evolving IT landscape.</p>
</body>
</html>


FMC-ISE-AD Integration for CCIE Security

Dive into a detailed breakdown of the CCIE Enterprise Infrastructure (EI) v1.1 Blueprint. Covering Network Infrastructure, Software-Defined Technologies, Transport Solutions, Security, and Automation, this guide emphasizes crucial topics, study hours, and practical applications for each section. Perfect for engineers aiming for mastery and exam success.

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8">
    <title>CCIE Enterprise Infrastructure (EI) v1.1 Blueprint: A Comprehensive Guide</title>
  </head>
  <body>
    <header>
      <h1>CCIE Enterprise Infrastructure (EI) v1.1 Blueprint: A Comprehensive Guide</h1>
    </header>
    <main>
      <section id="intro">
        <p>I am often asked by my students to provide a breakdown of the entire CCIE Enterprise Infrastructure (EI) v1.1 Blueprint from my point of view and the importance of various sections and topics contained within. In this blog, I have shared my thoughts on the Blueprint with a focus on highlighting the most important topics as well as the time one should devote to each section.</p>
      </section>
      <section id="section1">
        <h2>Section 1 - Network Infrastructure</h2>
        <p>This section serves as a core foundation for the exam, encompassing traditional Networking Technologies previously covered in the CCIE R/S exam. It establishes the fundamental network structure crucial for the remaining 70% of the test.</p>
        <p>Engineers should devote a minimum of 100 hours to lab work in this section.</p>
        <h3>Key topics that one should pay attention to are:</h3>
        <ul>
          <p><b>Switched Campus</b></p>
          <li>Trunking</li>
          <li>Port-Channels (EtherChannel)</li>
          <li>STP (Rapid-PVST & MST)</li>
          <p><b>Routing Protocols</b></p>
          <li>EIGRP (Classic & Named Mode)</li>
          <li>OSPFv2 (Network / Area Types)</li>
          <li>OSPFv3 (Network / Area Types)</li>
          <li>BGP (iBGP/eBGP, Attributes, Routing Policies)</li>
          <li>Multicast Routing (PIM Sparse Mode)</li>
        </ul>
      </section>
      <section id="section2">
        <h2>Section 2 - Software-Defined Infrastructure</h2>
        <p>This is the most important section of the CCIE EI exam, both from a learning point of view as well as its importance for current and future workplace usage. This section covers contemporary technologies utilized in present-day deployments. With an ever-increasing emphasis on this section, Cisco is clearly signaling that technologies covered in this section will form the base of its near-mid term network architectures. I strongly recommend engineers should make a concentrated effort to thoroughly grasp these technologies as they also enhance your career prospects.</p>
        <p>Allocate a minimum of 120 hours to comprehend the technologies covered in this section including their practical applications.</p>
        <h3>Focus intently on these pivotal topics:</h3>
        <ul>
          <p><b>Cisco Software Defined Access (SDA)</b></p>
          <li>Underlay Configuration (Manual/LAN Automation)</li>
          <li>Fabric Configuration (Standard Campus / Fabric in a Box)</li>
          <li>Fabric Deployment (Host Onboarding/Adding devices to a Fabric)</li>
          <li>Fabric Border Handoff (IP Transits/SDA Transit/L2 Handoff)</li>
          <li>Segmentation (Macro & Micro Segmentation)</li>
          <p><b>Cisco Software Defined WAN (SD-WAN)</b></p>
          <li>Controller Functionality (vManage, vBond, vSmart)</li>
          <li>WAN Edge Deployment</li>
          <li>Transport Configuration (Underlay/Tunnel Interfaces/TLOC Extension)</li>
          <li>OMP (Attributes/Redistribution)</li>
          <li>Configuration Templates (CLI/Feature Templates)</li>
          <li>Centralized Policies (DIA/AAR/Control Policies)</li>
          <li>Localized Policies (Access-Lists/Route Policies)</li>
        </ul>
      </section>
      <section id="section3">
        <h2>Section 3 - Transport Technologies & Solutions</h2>
        <p>This is a relatively straight-forward section encompassing two key technologies: MPLS VPNs & DMVPN. One should concentrate on configuring MPLS VPNs using BGP as the PE-CE routing protocol. For DMVPN, engineers should focus on configuring DMVPN Phase III, while also understanding the distinctions among the three phases.</p>
        <p>40 hours for in-depth understanding and practical exercises should suffice.</p>
        <h3>Essential topics for this section are:</h3>
        <ul>
          <p><b>MPLS</b></p>
          <li>Unicast Routing using LDP</li>
          <li>MP-BGP - VPNv4 / VPNv6 [6PE]</li>
          <li>PE-CE Routing using BGP</li>
          <p><b>DMVPN</b></p>
          <li>Configuring DMVPN [Single Hub/Multi-Hub]</li>
          <li>NHRP Redirection</li>
          <li>Encrypting DMVPN using IPSec using IKEv1 & IKEv2</li>
        </ul>
      </section>
      <section id="section4">
        <h2>Section 4 - Infrastructure Security & Services</h2>
        <p>This section provides coverage of several services applicable to IOS-based Routers. While the topics are numerous and it may come across as being overwhelming at first glance, the coverage and understanding needed to ace this section is not overly extensive.</p>
        <p>Engineers should allocate 80 hours for a comprehensive grasp of the topics and practical exercises in this section.</p>
        <h3>The key topics requiring extra attention are:</h3>
        <ul>
          <p><b>Network Services</b></p>
          <li>DHCP Server on an IOS-Device</li>
          <li>FHRP (HSRP, VRRP)</li>
          <li>NTP</li>
          <li>NAT on an IOS-Device (Dynamic NAT/PAT, Static NAT/PAT, VRF-aware NAT)</li>
          <li>Tracking Objects & IP SLA</li>
          <li>QoS (Bandwidth Reservation, Priority Queuing, Policing, Shaping)</li>
          <li>System Management (Telnet, SSH, SNMP)</li>
          <li>Logging</li>
          <p><b>Network Security - Switches</b></p>
          <li>Storm Control</li>
          <li>DHCP Snooping</li>
          <li>IP Source Guard</li>
          <li>Dynamic ARP Inspection (DAI)</li>
          <li>Port Security</li>
          <p><b>Network Security - Routers</b></p>
          <li>ACLs (IPv4/IPv6)</li>
          <li>uRPF</li>
          <p><b>IPv6 Security Features</b></p>
          <li>RA Guard</li>
          <li>DHCP Guard</li>
          <li>Source Guard</li>
        </ul>
      </section>
      <section id="section5">
        <h2>Section 5 - Infrastructure Automation & Programmability</h2>
        <p>This section delves into Automation & Programmability concepts and configurations. Engineers should familiarize themselves with various Data Encoding Formats and their attributes as well as configuring EEM applets and devices using the Guest Shell. Focusing on Python, the primary scripting language, is key.</p>
        <p>At least 40 hours will be needed to gain a solid grasp of the key concepts and practical experience in this area. </p>
        <h3>Focus on the following topics in this section:</h3>
        <ul>
          <p><b>Data Encoding Methods - Characteristics (JSON, XML, YAML, Jinja)</b></p>
          <p><b>Automation & Scripting - EEM Applets, Guest Shell & Python</b></p>
        </ul>
      </section>
      <section id="conclusion">
        <h2>Conclusion</h2>
        <p>Preparing for the CCIE EI exam is a two-step process:</p>
        <ol>
          <li>Achieving proficiency in individual topics</li>
          <li>Practicing on Full-Scale labs to gain experience and know-how in how to integrate and co-deploy these technologies effectively.</li>
        </ol>
        <p>Taking this two-step approach is going to drastically enhance your chances of passing the CCIE EI exam.</p>
        <p>I would spend around 360 hours on individual technologies & at least 40-60 hours on the Full Scale Labs (what I call Super Labs on my platform).</p>
      </section>
    </main>
    <footer>
      <p>Best of Luck and Happy Learning!</p>
    </footer>
  </body>
</html>

CCIE Enterprise Infrastructure (EI) v1.1: Blueprint Breakdown and Study Plan

Unlock success in the CCIE Lab Exam with expert tips and strategies. Learn how to navigate Design and Configuration Modules, ensure precision, and optimize your exam performance.

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8">
    <title>CCIE Exam Tips and Tricks</title>
  </head>
  <body>
    <header>
      <h1>CCIE Exam Tips and Tricks</h1>
    </header>
    <main>
      <section id="intro">
        <p>The CCIE Lab Exam is undoubtedly a formidable challenge. In this blog, I am excited to share a range of methodologies that proved effective for me in passing the CCIE Lab exams. I do think of myself as a bit of an expert here since I have passed 7 of them ;-).</p>
      </section>
      <section id="Arrival">
        <h2>Arrive Well-Rested and Prepared</h2>
        <p>Facing an 8-hour exam demands sharp focus and mental clarity. To stand your best chance, ensure you're well-rested. If your journey involves travel to the exam center, plan to arrive a couple of days in advance to acclimatize to any time zone shifts. Familiarize yourself with the location beforehand to avoid any last-minute stress on the exam day.</p>
      </section>
      <section id="ExamFormat">
        <h2>The Exam Format</h2>
        <p>The exam is divided into two modules: the Design Module and the Configuration Module. The Design Module spans 3 hours and consists of multiple-choice questions that evaluate your capacity to align technologies with customer requirements. The Configuration Module deals with actual device configurations. You are given 5 hours for the Module. Each section aligns with the CCIE Blueprint, subdivided into tasks.</p>
      </section>
      <section id="DesignModule">
        <h2>Navigating the Design Module</h2>
        <p>In the Design Module, pay meticulous attention to customer requirements presented in varied formats, such as email exchanges. Your task is to propose fitting solutions. Always mirror the exact names of objects or configurations mentioned – discrepancies can prove costly. Even slight deviations might cause you to forfeit points.</p>
      </section>
      <section id="ConfigurationElement">
        <h2>Tackling the Configuration Element</h2>
        <p>In the Configuration Module, adopt a "one task at a time" mindset. Break down the tasks into manageable steps. By methodically focusing on individual tasks, the larger configuration objectives become surmountable.</p>
      </section>
      <section id="PreciseConfiguration">
        <h2>Precise Configuration</h2>
        <p>Precision is paramount, as completing all requirements in a task ensures full points, while even a single omission results in zero points. For example, if they have mentioned the name of the EIGRP process to be “ABC”, you need to make sure that it is “ABC”; “abc” will be incorrect and you will lose all the points for the task. If they have mentioned the Sub-interface ID to be “E 0/0.11” either in the question document or on the Diagram, you need to make sure that the sub-interface ID is “E 0/0.11”.</p>
      </section>
      <section id="NotepadEfficiency">
        <h2>Leverage Notepad for Efficiency</h2>
        <p>For configurations spanning multiple devices, employ the notepad application to draft your configurations. Once finalized, you can paste them onto the devices. This approach saves time and minimizes errors during repetitive configurations. This is especially helpful in VPN, BGP & MPLS configurations.</p>
      </section>
      <section id="CommandAliases">
        <h2>Command Aliases for Swift Execution</h2>
        <p>Boost your efficiency by creating command aliases for commonly used verification commands. Familiarize yourself with these aliases during your preparation to streamline their use during the exam.</p>
        <ul>
          <li>SIR: sh ip route</li>
          <li>SRR: sh run | section router</li>
          <li>SIB: sh ip bgp</li>
          <li>SV4: sh bgp vpnv4 unicast</li>
          <li>SON: sh ip ospf neighbor</li>
          <li>CIB: clear ip bgp * soft</li>
        </ul>
      </section>
      <section id="ConfigurationBackups">
        <h2>Regular Configuration Backups</h2>
        <p>Develop a habit of frequently saving your configurations. A prudent approach is to save after successfully completing and verifying a task. Avoid interrupting your workflow by saving mid-task. Complete the task, ensure its alignment with requirements, and then save your work.</p>
      </section>
      <section id="AchievableChallenge">
        <h2>The Achievable Challenge</h2>
        <p>While the CCIE exam poses its challenges, rest assured it is conquerable. The sense of accomplishment from triumphing over such a rigorous test is immeasurable. This certification can significantly enhance your career prospects. I extend my best wishes for your success on this rewarding journey.</p>
      </section>
      <section id="Conclusion">
        <h2>Conclusion</h2>
        <p>Remember, persistence, preparation, and precision are your allies in the quest for CCIE excellence. Best of luck!</p>
      </section>
    </main>
    <footer>
      <p>Best of luck on your journey to CCIE excellence!</p>
    </footer>
  </body>
</html>

Master the CCIE Lab Exam: Expert Tips & Tricks

Unlock the full potential of your Cisco SD-WAN by learning how to establish controlled inter-VPN communication via route leaking. This comprehensive guide walks you through the necessary configurations for seamless network communication.

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8">
    <title>SD-WAN - Route Leaking between VPNs</title>
    <meta name="SD-WAN - Route Leaking between VPNs" content="Learn how to configure inter-VPN communication in a Cisco SD-WAN environment through route leaking.">
  </head>
  <body>
    <h1>SD-WAN - Route Leaking between VPNs</h1>
    <section>
      <p>In our rapidly evolving IT industry, we consistently introduce novel devices and technologies to our established network, ensuring its ongoing dynamism and adaptability. One notable paradigm shift is the emergence of <strong>Software Defined Networking (SDN)</strong> Technologies in the past 10 years. These SDN technologies promote controller-based configuration to bestow configurational scalability across the enterprise infrastructure. A prime example of this transformative technology is <strong>Software Defined Wide Area Network (SD-WAN)</strong>. </p>
    </section>
    <h2>SD-WAN Architecture</h2>
    <section>
      <p>SD-WAN empowers you to configure, operate, and maintain a private WAN through a centralized suite of controllers. Within Cisco's SD-WAN framework, the underlay traffic and overlay traffic (comprising end-user data traffic) are segregated into distinct Virtual Routing and Forwarding (VRF) instances.</p>
    </section>
    <h2>Understanding VPNs and VRFs in Cisco SD-WAN</h2>
    <section>
      <p>Cisco SD-WAN utilizes the term "VPNs" to denote these VRFs. Should you desire the partitioning of end-user data traffic, the allocation of routes to separate VPNs (VRFs) accomplishes this. The VPNs dedicated to end-user data are referred to as Service VPNs. As a default behavior, traffic remains demarcated among various VPNs.</p>
    </section>
    <h2>Purpose of This Guide</h2>
    <section>
      <p>The purpose of this blog is to delve into the configuration necessary to facilitate controlled inter-VPN (inter-VRF) communication via route leaking. We will achieve this by working through an example.</p>
    </section>
    <h2>Example Topology</h2>
    <section>
      <img class="block w-auto m-auto" src="https://kbits.live/media/blog/70/0001.jpg" alt="Cisco SD-WAN Topology Diagram" />
      <p>In the topology shared below, the present status indicates that both Service VPNs are fully functional and are in communication with each other, yet they remain segregated. The objective at hand is to establish communication between the 172.16.X.0/24 and 10.10.X.0/24 networks.</p>
    </section>
    <h2>Configuration Steps</h2>
    <section>
      <p>We will start the task at hand by thoroughly examining the steps necessary for configuring inter-VPN communications between these two Service VPNs. The realization of inter-VPN communication hinges on the practice of route leaking, whereby routes are shared from one VPN to another. This process is executed by configuring a Topology Policy on the vManage platform and subsequently deploying it to the WAN Edges through vSmart.</p>
    </section>
    <p>We will start the task at hand by thoroughly examining the steps necessary for configuring inter-VPN communications between these two Service VPNs. The realization of inter-VPN communication hinges on the practice of route leaking, whereby routes are shared from one VPN to another. This process is executed by configuring a Topology Policy on the vManage platform and subsequently deploying it to the WAN Edges through vSmart.&nbsp;</p>
    <p>Now, let's delve into an in-depth exploration of the sequential steps essential to achieve this objective:</p>
    <ol>
      <p>1. To enable vSmart management and configuration from vManage, a vSmart Device Template within vManage needs to be set up. The necessary steps to accomplish this are outlined below:</p>
      <ol>
        <li>Execute the &ldquo; <strong>Show Run</strong>&rdquo; command on the vSmart device. </li>
        <li>Highlight and copy the config.</li>
        <li>Create a Device Template for vSmart using a CLI Template</li>
        <li>Paste the copied config.</li>
        <li>Attach the vSmart to this template</li>
      </ol>
    </ol>
    <ol>
      <p>2. Moving forward, the subsequent task involves the creation of classification lists, which will play a pivotal role in our Topology Policy. The necessary lists for our configuration encompass Site IDs for individual sites, Service VPN IDs for each VPN, and a compilation of prefixes earmarked for leakage. The classification lists for our configuration are itemized as follows:</p>
      <ul>
        <li>
          <strong>
            <strong>VPN List:</strong>
          </strong>
        </li>
      </ul>
      <ol>
        <ol>
          <ol>
            <ol>
              <li>Name: VPN-10 - ID: 10</li>
              <li>Name: VPN-20 - ID: 20</li>
            </ol>
          </ol>
        </ol>
      </ol>
      <ul>
        <li>
          <strong>
            <strong>SITE List:</strong>
          </strong>
        </li>
      </ul>
      <ol>
        <ol>
          <ol>
            <ol>
              <li>Name: DUBAI - ID: 1</li>
              <li>Name: London - ID: 2</li>
              <li>Name: LA - ID: 3</li>
            </ol>
          </ol>
        </ol>
      </ol>
      <ul>
        <li>
          <strong>
            <strong>Prefix List:</strong>
          </strong>
        </li>
      </ul>
      <ol>
        <ol>
          <ol>
            <li>Name: PL-VPN-10 Prefix: 172.16.0.0/16 le 32</li>
            <li>Name: PL-VPN-20 Prefix: 10.10.0.0/16 le 32</li>
          </ol>
        </ol>
      </ol>
      <p> 3. Our next undertaking involves the creation of a Topology Policy aimed at executing route leaking, utilizing the lists crafted in the preceding phase. This endeavor will be guided by the following attributes:</p>
      <ol>
        <li>Name: <strong>ROUTE-LEAKING-10-20</strong> Desctiption: ROUTE-LEAKING </li>
        <li>Policy # 1:</li>
        <ol>
          <li>
            <strong>Condition:</strong> VPN-ID = VPN-10 &amp; Prefix=PL-VPN-10
          </li>
          <li>
            <strong>Action:</strong> Export To: VPN-20
          </li>
        </ol>
        <li>Policy # 2:</li>
        <ol>
          <li>
            <strong>Condition:</strong> VPN-ID = VPN-20 &amp; Prefix=PL-VPN-20
          </li>
          <li>
            <strong>Action:</strong> Export To: VPN-10
          </li>
        </ol>
        <li>Default Policy:</li>
        <ol>
          <li>
            <strong>Action:</strong> Accept
          </li>
        </ol>
      </ol>
    </ol>
    <ol>
      <p>4. Upon the successful creation of the Topology Policy, the subsequent step entails establishing a Centralized Policy and integrating the previously crafted Topology Policy. Once the Topology Policy is imported, the subsequent action involves its application on the vSmart device for incoming routes from the three designated sites. The directives listed below outline the procedure for generating the Centralized Policy:</p>
      <ol>
        <li>Name: <strong>CENTRAL-POLICY</strong>
        </li>
        <li>Topology Policy: <strong>ROUTE-LEAKING-10-20 </strong>(Import the Policy) </li>
        <li>Apply the policy to incoming routes from <strong>DUBAI, London &amp; LA</strong>
        </li>
        <li>Activate the policy. By activating the policy, it will apply it on vSmart.</li>
      </ol>
    </ol>
    <h2>Validation and Conclusion</h2>
    <section>
      <p>At this juncture, upon inspecting the routing table on the internal routers stationed at the Dubai, London, and LA sites, you will observe the comprehensive inclusion of routes for both the 172.16.X.0/24 and 10.10.X.0/24 networks. To further validate the connectivity, you can employ Ping or Traceroute commands to ascertain reachability. This configuration denotes the establishment of Inter-VPN communication.</p>
      <p>I hope this gives you a good understanding of the steps involved and the general procedure that one needs to follow in order to establish a controlled inter-VPN (inter-VRF) communication via route leaking.</p>
    </section>
  </body>

SD-WAN - Route Leaking between VPNs

Do you want to learn how to make the final prepartion before CCIE EI Lab Exam? Now you can prove yourself by participating in CCIE EI SuperLab!

<p>
  <strong>CCIE Enterprise Infrastructure &ndash; Super Lab</strong>
</p>
<p>
  <span style="font-weight: 400;">The Super Lab is designed to provide CCIE EI candidates with a comprehensive experience and practice platform for the Full Scale Mock CCIE Lab. This challenging assessment is divided into nine distinct sections, each contributing to a holistic understanding of enterprise infrastructure technologies. In this blog post, we will delve into the specifics of these nine sections.</span>
</p>
<p>
  <strong>Section 1</strong>
  <strong>: Building the Service Provider Network</strong>
</p>
<p>
  <span style="font-weight: 400;">In this section, we focus on constructing the Service Provider Network, which includes three key components. You will be tasked with establishing Interior Gateway Protocols (IGPs) to route Loopback Networks efficiently. Configuring Label Distribution Protocol (LDP) is crucial for enabling labeled reachability between routers. Additionally, you'll configure iBGP within the Service Provider network, implementing Route Reflectors for scalability. The final step involves configuring external BGP (eBGP) relationships between the Service Providers to ensure comprehensive connectivity.</span>
</p>
<p>
  <strong>Section 2</strong>
  <strong>: MPLS VPN Network Setup</strong>
</p>
<p>
  <span style="font-weight: 400;">Section 2 leverages the Service Provider networks established earlier to configure an MPLS VPN network for a customer. Your responsibilities include configuring Multi-Protocol BGP (MP-BGP) relationships between routers, setting up Virtual Routing and Forwarding (VRF) instances for the Customer Network, and ensuring seamless reachability between Customer Sites. This configuration is a vital step in building the MPLS network, which will subsequently be used for setting up an SD-WAN network between the Customer Sites.</span>
</p>
<p>
  <strong>Section 3</strong>
  <strong>: Layer 2 Network Setup</strong>
</p>
<p>
  <span style="font-weight: 400;">This section concentrates on setting up the Layer 2 network within Branch 4. You will configure Port-Channels, VLANs, and trunks to establish the Layer 2 underlay. You will be responsible for mapping the Physical Topology to Layer 3 (Logical Topology). Mapping the Physical Topology to the Layer 3 Logical Topology forms the foundation for all future configurations in Branch 4.</span>
</p>
<p>
  <strong>Section 4</strong>
  <strong>: BGP Configuration</strong>
</p>
<p>
  <span style="font-weight: 400;">Section 4 is dedicated to configuring eBGP connections to link the sites with Internet Service Providers (ISPs). Advanced features such as multi-pathing and advanced Route Reflector capabilities are part of this section. By the end of this phase, the ISPs will be fully prepared to connect all Branches and HQ.</span>
</p>
<p>
  <strong>Section 5</strong>
  <strong>: IGP Configuration &amp; Features</strong>
</p>
<p>
  <span style="font-weight: 400;">In this section, you will focus on configuring Interior Gateway Protocols (IGPs) and enhancing their features. Tasks include configuring both Classic and Named Modes for Enhanced Interior Gateway Routing Protocol (EIGRP), implementing route summarization, and enabling authentication. For Open Shortest Path First (OSPF), you will configure a multi-area setup, configuring Area Types based on specific requirements.</span>
</p>
<p>
  <strong>Section 6</strong>
  <strong>: SD-WAN Implementation and Configuration</strong>
</p>
<p>
  <span style="font-weight: 400;">Section 6 is dedicated to the implementation and configuration of Software-Defined Wide Area Network (SD-WAN). This involves registering WAN Edges with Controllers and creating Templates to complete the SD-WAN setup, utilizing the MPLS and Internet Connections configured in previous sections.</span>
</p>
<p>
  <strong>Section 7</strong>
  <strong>: SDA Implementation and Configuration</strong>
</p>
<p>
  <span style="font-weight: 400;">This section focuses on Software-Defined Access (SD-Access) implementation and configuration. You will configure the Fusion Router and Border Switch, enabling onboarding in the DNA Center (DNAC). Border devices will facilitate LAN Automation for Edge Node discovery and onboarding, provisioning them in the SD-Access Fabric. Configuring L3 Handoff and Device Node specifications in the SDA Fabric is a crucial step. The Fusion router will finalize the L3 Handoff configuration initiated by DNAC on the Border Device, enabling HQ to communicate with SD-WAN branches.</span>
</p>
<p>
  <strong>Section 8</strong>
  <strong>: Automation with Python Scripts</strong>
</p>
<p>
  <span style="font-weight: 400;">In this section, you will create Python scripts to automate network tasks such as router backups, user creation on routers/switches, and interface status monitoring across multiple devices.</span>
</p>
<p>
  <strong>Section 9</strong>
  <strong>: Multicast Routing and QoS Configuration</strong>
</p>
<p>
  <span style="font-weight: 400;">Section 9 delves into advanced technologies, covering Multicast Routing using Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP). Additionally, you will configure Quality of Service (QoS) mechanisms to optimize network utilization, including Policing, Bandwidth Reservation, and Low-Latency Queuing (LLQ).</span>
</p>
<p>
  <span style="font-weight: 400;">
    <br />
  </span>
  <span style="font-weight: 400;">
    <br />
    <br />
  </span>
</p>
<p>&nbsp;</p>
<p>
  <span style="font-weight: 400;">&nbsp;</span>
</p>
<p>
  <strong>Conclusion</strong>
</p>
<p>
  <span style="font-weight: 400;">The Super Lab offers a unique opportunity to integrate and apply diverse technologies, emphasizing the importance of time management during the exam. It also illustrates how dependencies among various technologies can impact different sections of the lab exam.</span>
</p>
<p>&nbsp;</p>

#All Blog Posts