ShoIProute

Thanks, the only ones I can remember from memory are the ones that I had placed in another post: Check those out. I'll try to remember some of the others and let u all know as they come to my memory.

hey guys, honestly I always thought that int vlan 3999 should have the prefix-suppression disabled, but all the solutions I've seen don't include this for some reason. I haven't had a chance in a long time to do a lab with the vEdge powered on and check to see how this effects reachability, but I think it depends on who becomes the DR for that segment. If the IOS router (sw201 or sw202) has prefix-suppression enabled and becomes the DR, it might cause some problems, since with a broadcast network-type, the DR generates a network LSA for the link and advertises /32 as the subnet mask of the associated subnet in order to hide the transit-only network. I'm not 100% sure if this is what is occurring, but I suspect it might be. I will lab this up soon. Let me know wat u guys think.

Agreed, the lab exams should be more stable and affected less. Awesome!! Ur definitely helping to keep this site alive with ur contributions, so plz keep up posted.! Thanks mate!

anytime!!

They are already managed and synced in the new version of the lab. U should not have to do anything to get the other tasks complete. The re-sync task was in the old version of the lab. I'm not sure if their still giving that anymore.

I think so

Yup! Although I think they also did say in the fine print at the bottom that the Expert level exams (or lab exams) might update a little slower then the CCNA/CCNP tracks. So they might follow a slightly different timeline/schedule Great! Do u know if any of them used any specific vendor solutions to pass? If u have any helpful info. Plz let us know.

I think the DNAC automatically automates that once u configure it as a "Network" AAA Server in "Network Settings". U have to make sure that ISE is configured as a TACACS Server in System Settings > Settings > Authentication and policy servers first tho. And the 'netadmin' username has to be configured in ISE with the shared secret (cisco) and privilege level and all of the AAA backend information in ISE. Then when u go to re-provision the switches in DNAC, it should push out all the necessary AAA configs to them in the global config and VTY lines.

Neither lol haha. Well, I'm using the ones that were posted on this site (I think from the "CCIE EI Real Lab workbook + EVE=UNL (Release 7) ") post as a base and building off of that from my studies and knowledge and what I've tested while labbing. I think I ran across a CLC one that I did feel like it had some solutions wrong or misunderstood, but I've been working to try and correct the wrong answers. I've come to realize at this point that I don't think any vendor has complete solutions really unless someone who passed can prove me wrong. The other thing is that all of the current solutions circling around right now at the moment are from the previous version of the exam. I don't think their giving that one anymore, there was an update back in April/May of last year. I haven't seen anybody post any updated versions (unless someone on here has the updated versions of the lab from CLC or CD and would like to post it 🙂) I would say the old ones have about 80-85% of what's still on the exam today tho. There isn't too much change to the questions and it's a only a few questions changed. I think one of the things that ppl underestimate is the DESIGN module. I've never been able to pass it and they made updates to that too. I've seen CLC and CD have some wrong answers for that module too. I was able to look up some of the answers in cisco documentation. Plus, I haven't seen anybody with the new Design questions either. I remembered some of them, but some I forgot (I've made posts about it.) It's going to be important to focus on passing that module too if u want any shot at passing the exam, because u must get at least the minimum passing score for both modules. If u fail the Design, u fail the entire exam. With that said....I hope we all pass it soon before they change it again!! Haha. From what I seen it looks like they change it up around April/May of each year. At least I think thats what they did last year....

That is correct. Initially, i misunderstood this task and thought there were some AAA configs that needed to be manually configured locally on the switches, but those configs will be pushed out to VTY lines by the DNAC if done properly. And yes, u will still have OOB access to the switches via the console.

Question 1.15 is basically testing your knowledge of a 6VPE deployment, (which is essentially exchanging vpnv6 routes over a v4 MPLS backbone and the PE router uses VRFs facing its CE.) The task is really both IPv4 and IPv6 because u have to form the BGP peering between r3 and r11 using an IPv4 session, but still allow them to exchange IPv6 routes with each other. First thing u need to remember is that u have to enable the IPv6 address-family in the BGP process and then enable IPv6 in the VRF definition, but perhaps the most important thing that u have to remember is when a BGP router is configured to advertise IPv6 routes over an IPv4 session, u need to set the next-hop for the prefixes to the proper IPv6 next-hop address otherwise u will end up with a next-hop that has an IPv4 address appended to it. This is done using a route-map and since the task requires us to set that route-map in the INBOUND direction - "Ensure that all current and future IPv6 prefixes advertised between r11 and r3 will be installed into the RIB of these routers with the next hop address set to the proper global unicast address on their interconnection. Any policy that accomplishes this requirement must be applied in the inbound direction" Then the next-hop for all IPv6 prefixes that are received from ur neighbor must be set to ur neighbor's IPv6 address, so that u use that address as ur next hop for the received IPv6 prefixes. This must be applied using a route-map in the IPv6 address-family config for the neighbor. Also remember that there's some troubleshooting in that task. U have to fix the LSP in the MPLS backbone for Global SP1. r4 is configured with a mis-matched subnet mask for it's Loopback0 (100.255.254.4/31) that doesn't match what is being advertised in the IGP. Because of this, the LSP is broken. It doesn't match r4's Local Binding in LDP for it's Lo0 because by default OSPF will always advertise loopbacks as /32. Therefore, either the subnet mask on r4's loopback must be corrected (changed to /32) or it's ospf network type must be changed to "point-to-point" in order to advertise the correct mask, otherwise r4 will not have a local label binding for 100.255.254.4/32 causing traffic to be dropped.

I think so. I'm hoping that the next attempt will be the one!

I attempted multiple times over the past few months and on each attempt I ran into the r3 as a route-reflector for Section 1.10: Configure r3 as a route-reflector Configure r4, r5 and r6 as clients of the route-reflector On r3 the necessary configuration for this requirement must be accomplished using a peer group named "GlobalSP" I'm not sure if their giving the previous version of the exam anymore. Unless someone has taken it recently and can confirm that their still getting it

it should be. i think its only like 3 points. if u get most of the other tasks correct, u should be able to get enough points to afford skipping that one. remember, the name of the game is not to complete the lab 100%, but to get enough points to pass. i'm not sure how many points that is tho.

From my understanding, with the new 2.1 task (DNAC/ISE AAA TACACS+) that task is independent and no other tasks would depend on that one being completed.

taken the exam recently i was referring to. but i would skip section 2.1 if u can. its very tricky and could potentially lock u out of the devices, so its best to avoid if possible.

i have taken it a couple of times recently and i have not run into the " [Hidden Content] and change newmgmtadd/oldmgmtadd" task on either attempt. Unless they're doing variation i think the one their going with is only the ISE/DNAC TACACS+ AAA for Section 2.1

FABD2 wants to use TACACS+ AAA service for secure communication into the four switches of their SDx infrastructure which are already present in the DNAC inventory: - Use DNAC TACACS+ for Authentication & Authorization through ISE into all 4 switches: sw400, sw501, sw502 and sw510 - TACACS shared secret must be set to cisco - TACACS must only be used on the vty lines - Local authentication must remain as the only method for authenticating management users through the console - The below accounts must be created in ISE for testing purposes: netadmin - will provide full access to all commands This user must be configured in order to use password admin - Note: Do not change/modify aaa authentication login default local. It is already present in all four switches

Thanks Siscco. i finally had a chance to lab this up and u guys are definitely correct about that. Either a VL or rfc5185 (multi-area adjacency in area 0 on the vl2000-2001 interfaces but they have to be changed to point-to-point first) would do the trick. i would probably stay away from tunnelling as much as possible on the exam eventho there was no restriction specifically not to use it. i would just avoid tunneling unless they specifically ask u to.

hey guys, I still havent had a chance to lab this up yet but i'm just thinking for a minute here. did u guys make ur vlan2000 and vlan2001 interfaces passive so that sw101 and sw102 dont form a neighborship with each other between the port-channel? i saw this in some ppls solutions. If u did, im just wondering why? although its best practice in the real world, i don't think it was a requirement on the lab, unless i missed it. What im thinking in theory is that if sw102 receives a better cost route to any DC destination network (in the 10.2.0.0/16 range) from its neighbor, it would prefer that route over its directly connected link with sw202 if another route was available. but if it only had one route to the DC destination subnets, then it will only know how to get there thru it's directly connected link with sw202. but if that link has a higher cost then say, a route advertised by sw101, i'm thinking it would prefer passing thru there then its link with sw202. Also, how high are u increasing the cost on sw102's interface that leads to sw202? Again, i havent had the chance to test this out yet, i'm just walking thru it in my head and thinking in terms of theory. im out of town for a few days but once i get back i will lab it up Let me know if ur allowing sw101 and sw102 to form an ospf adjacency thru their vlan2000 and vl2001 interface Hey jonny18. ur totally spot on. I had to think about that last part that u said once again and remembered that intra-area routes will always be prefferred over inter-area routes. that was a nice "gotcha". What a bummer. i was hoping there would be a more "eloquent" solution other than creating a tunnel or VL because im not sure if thats allowed, but i dont think it goes against any general requirements. i'll be labbing this up once i get back and playing around with it some more to see if theres any alternatives but it doesnt look like it at this point.

i still have yet to traceroute from the HQ side but in theory it should work. with sw102 having a higher cost to all destination networks in DC, all traffic coming from HQ to DC should pass thru sw101 (primary link) i know i've done a trace from DC to HQ and i can confirm that the sw201/sw101 is used as the primary link. even if u trace directly from sw202 in the DC, it will pass thru sw201 to get to HQ destination networks

that's correct. but also recall on the same task that there is a requirement that the primary path for the traffic between HQ and DC must be the link between sw101 and sw201 and the link between sw102 and sw202 must become the primary path if the primary link fails. this can be accomplished by advertising the summary route (10.1.0.0/16) on sw102 with a higher (worst) metric then sw101 forcing traffic from DC to HQ to pass thru the sw101/sw201 link. and then for path symmetry i guess u can increase the cost on the sw102's interface leading to sw202. This way traffic from HQ to DC will prefer to pass thru sw101/sw201 (primary) link from that direction.

thanks. R u planning on sharing ur solutions with this group? would be best if we try and crack it together. i could understand if u dont want to. u paid for it.

same here. anybody have it?

It could be. could be that their giving us a choice because they really are not specific on which area the uplink should be in yeah i agree since sw201/202 are in the DC it would make more sense that they should be in area 0. in the exam the uplinks are actually already in area 0 for both HQ and DC. so that gives you the option of which devices should be the ABRs. U know what i think i answered my own question because it also says in that same task: "all DC OSPF speakers must see 10.1.0.0/16 for any HQ subnets". i think that makes it clear that sw101/102 should be the ABRs and originate a type3 summary route for 10.1.0.0/16 to sw201/202. because if u make sw201/202 the ABRs then they would have the uplinks in area 1 and be able to see all of the specific routes from HQ. at least thats how i'm looking at it for now. What do u guys think?