A CCNA Lab for those that need extra practice

I've already had my rant about not knowing CCNA R/S for new engineers or even existing ones. After several weeks of intense study I think I will be ready to go sit the new CCNA R/S exam. Yes I know, some may say it is easy, and I'm sure it is for those that do data all the time but I am a UC guy that is sliding back into the data realm slowly. Bottom line is, I miss data and all the cool routing and wireshark captures to find out problems and ways to fix them. I spent some time today finishing up a lab that I had made from scratch that tests most of the CCNA topics but not all. STP is difficult since you can't replicate the ASICS and I don't have an router IOS with a switch module to at least attempt to get STP up. I also haven't implemented GLBP / HSRP/ VRRP either even though they are fairly straight forward. I probably will add to the diagram but my back is killing me today and I haven't been in the mood to really build anything new aside from what I have already done. The below image is what I challenge you to replicate and get working 100% of the way.



At a minimum, here is what you need to configure:

1. Connect all devices as shown
2. Configure all ports with approrpriate addresses and bring them online
3. Configure ssh access only with a password of cisco
4. Configure a username of cisco and secret of cisco
5. Configure an enable secret of cisco
6. Ensure that the routers will not mistaken letters for DNS names
7. Disable enable timeouts
8. Set hosts with IPs so you can use their names instead of IP addresses
9. Configure EIGRP and advertise networks based on subnet with no automatic summarization, do not configure Canada nor advertise its networks!
10. Exclude the first 10 addresses in all ranges in the private networks for DHCP
11. Configure DHCP for all Offices with a /24 subnet based on the network assigned
12. Assign default routes to point to the local primary gateway of each site (not the office GWs)
13. Ensure all PCs get their DHCP addresses assigned to them and they can ping to their local GW
14. Configure the Frame Relay DLCIs as shown and map them as indicated
15. The FR-Switch should not have any other configuration as it is acting like a cloud
16. Assign static routes to get to Canada based on location (Texas will be a end all be all GW if other primary gateways don't know the correct path
17. Configure NAT for Canada to use the internet IP with PAT
18. Ensure all devices can ping to the private network in Canada
19. Ensure Canada can ping from internal to any CORP based internal IP (i.e. 10.0.3.11, 10.0.0.1)
20. Configure EIGRP md5 authentication for all links
21. Make sure that any loopback interfaces assigned are being seen as their subnet in the routing tables
22. Block all telnet traffic from all locations except Texas
23. Block all SSH traffic on private LANs on all sites except Texas
24. Verify NAT on the Canada GW
25. Enable password encrpytion globally so that any plain text passwords are garbled at minimum security.

If you can do the above without having to look anything up, you are probably good to go or still competent in data. I myself had to look up how to do md5 authentication because it's just not something I do everyday...or at all really. I'm not a network engineer I'm a UC engineer. I challenge you to complete this as fast as you can and report your times with honesty. I will probably wipe this entire topology and start from scratch and do a YouTube recording when I get the chance. I want to see how fast I can go under pressure and what I do and do not forget. Keep in mind I set all DLCI interfaces to a /24, you can modify as you want.

The Importance of CCNA in the UC Realm

I've been on my soapbox before about knowing data if you are going to be a specialty engineer, whether that be UC, wireless, security, data-center, or whatever else. I had some time on my hands so I built out a nice GNS3 lab to test my data skills. Granted I did cheat a bit since I had gone through the new CCNA R/S course on CBT nuggets, but it is still necessary to know the underlying foundation. My biggest gripe right now is that Cisco wiped out the need for a CCNA R/S as a pre-requisite to CCNA Collab and CCNP Collab. With this new road map, new engineers will be coming into the field for UC not knowing the different between router and switch. Ok, maybe that was a bit too much, but still, the problem remains. Ask them to troubleshoot STP or check a VLAN and you are going to get a blank stare. Anyways, below is a GNS3 image of what I built out. It is still a work in progress and I plan on using this to gauge other engineers's capabilities with data.

The above diagram hosts a variety of different situations that need to be configured. All the internal sites are using OSPF and the WAN connections are using EIGRP. Yes, I could have used OSPF or EIGRP across the board but part of knowing CCNA R/S is route redistribution. Thus, I used two protocol for that part. The other part is the connection to the ISP, I have a static route in place but also put in BGP as I plan on expanding that diagram to another company and bridging together from there. While BGP really isn't touched on much in the CCNA world, it is still mentioned since it is heavily used at the provider level. Additionally, different networks for each gateway per floor that go in sequence as well as ACLs to limit ICMP, web access, ssh, and telnet accordingly. Finally, when egressing to the internet, all gateways will NAT to their public IP (once I get the other ISP gateways put in there). I will also probably add some security on the routers for neighbor authentication for the hell of it as well. It's stuff like this that is important, if the ASICs could be emulated I would be running real switches as well. The switch modules available can do the job though if I really wanted to run STP and get a loop free topology while using etherchannel. Just in case anyone is doubting the configuration:

I know this wasn't really voice related and more of a rant, but I haven't run into anything interesting or different on CUCM lately. I'll try to break something on accident and post about it :)

Modifying device line buttons saying "Fixed Feature"

So today I was whipping up a new DID scheme for a user since they have been getting to many calls on their current lines since they were not being masked correctly. Easy enough. I got a new set of DIDs for them in the pool and assigned them appropriately and let the know that their voice mail would be changed since the DIDs were changing and everything is LDAP synced. Yes, technically I could do it the hard way but we don't hand code anything unless necessary for voice mail. I had a few phones that had a message on them when I was modifying the line order saying "Fixed Feature Button". This didn't make much sense to me since nothing on that line is a feature other than the line itself and the other phones didn't have this problem. After investigating a little more I saw people completely deleting that line and to me, that isn't an acceptable solution. I ended up disassociating that line with the phone then adding it back in without redoing everything. Since this happened on three different phones, deleting and re-adding would have taken to much time. Once I disassociated the line on the phones then put the line back on all was good. Not a huge deal, but a I guess this was a bug from 9.X that still hasn't been resolved...

Call Pickup Group "Feature is Unavailable" Message

So today I was presented with a very simple yet difficult problem. A customer had a problem with their call pickup group. Any time they would try to pick up a call after seeing the visual alert it would say "Feature is Unavailable". After doing some research on the problem I came up empty handed with others having this same problem. I made a few test calls and GCallPickup and then dialing the ringing number worked yet CallPickup didn't. Perplexed, I had the customer go try another set of phones in another pickup group and everything worked as it should. Absolutely nothing was different between the two configurations other than a the pickup group number (obviously...). So after an hour or so of wasted time troubleshooting and checking everything I created an entirely new pickup group and assigned the phones to it and voila, everything worked. I then deleted the old pickup group and changed the new one back to the old one's name as well as it's number and guess what, everything worked. My only assumption as to why this randomly started to fail all of a sudden is a database issue and removing it while creating a new one was the only solution. No other settings like extension mobility were in play and certainly all of the settings were correct such as the CSS and partitions. Weird...but at least it is fixed. I highly doubt TAC would have an answer other than the solution I ultimately came up with.

The Hunt Pilot Timer

Everyone has those moments where stupidity overrides thought processes. Yesterday I spent about 30 minutes on something that should have taken less than 3. I was providing support for a customer after I migrated their CUCM from a physical box to a virtual host and they wanted to do some additional configuration on their main line calling in. No big deal, slapped a second line group in and added it to the Hunt list and adjusted timers accordingly. After some fine tuning we got the line groups to ring properly but the second line group would always cut off prematurely. After trying to figure out what was going on and checking things I knew were right, it hit me. After you rang out it would hit a voice mailbox which just happened to be read by Cisco's voice and I knew exactly what was happening. The hunt pilot timer was set to 15 seconds and that was seconds more than then the second line group would hit which only allowed a very brief ring on the second group. I adjusted that timer to 30 seconds and bam, everything worked flawlessly. Sometimes you just need a small sample of stupid to realize that everything isn't complicated unless you make it that way. I think part of the reason I was forgetting the Hunt Pilot timer was due to the lack of sleep from the migration on the night prior. Who knows, maybe I'm making excused for a novice mistake?

Unsupported ESXi License that works

Up on the roadmap to be complete today is an MCS to ESXi migration for a clients CUCM. While it isn't a UCS box which makes the entire design not supported, their ESXi is not running a supported version either. They are currently running on 5.5 which, by all intents and purposes, works great. We all know we can load up a ESXi box and load CUCM on it with no issues. Heck, you can load it up on a box with an intel processor then migrate to AMD and it works if you really wanted to but PCD, the migration software that does all the magic in the background specifies certain license sets of ESXi due to certain issues pertaining to access and such. It turns out VMWare Essentials Plus 5.5 works fine despite not being listed in the supported sets of ESXi licensing on Cisco's site. I thought this important as some may need to migrate in the situation that I am in and not know if the ESXi is supported. One sure fire way of finding out is trying to add the ESXi host to the inventory in PCD. It either works or it doesn't. The good thing is, from here on out, I know an extra piece of information that can help out in the future and I wanted to share that with everyone here as well. The other option is to get a key or get a trial license and temporarily apply that to ESXi then bounce back when you are done since PCD is just a temporary situation to begin with.

Unity Connection Greeting Recording

This is a post I have been meaning to put up for a few weeks now. Basically, Cisco refuses to get with the times and use another method to record meetings via the web interface on unity connection. Java is and always will be a big issue with anything Cisco related. When you try to record on your PC you usually get SSL errors and other errors, even with IE. The only way around this is to downgrade your java so far down the ladder, it becomes a security risk. This essentially forces you to stand up a VM or use another box just for recording Unity greetings. You might say just record via phone, which is the best option. For those of you using a VPN connection or have other issues and can't go that route you are stuck with the web interface. You can either create the WAV file by computer recording or upload it from your desktop if you already have the file. When doing this you get the SSL errors I was talking about earlier. The way that I have found to get around the errors is to record via computer but do not save the recording after finishing. Instead, save a copy to your desktop and reload the page. From here, upload the file to the media player again, select the "phone" playback option and have it dial whatever number you want and leave "computer" as the recording option. Open the file up via the web player and hit play with those options set. Answer the phone and hit save while it is playing through your CIPC or phone and you will not get the error. From here, reload the page and hit play to verify it saved and you are done. Now why do we have to go through this for those of us on company laptops that have stringent security requirements and cannot downgrade java?