ShoIProute

any word on the design module? how about the new updates? does anybody have them?

i'd like to join. let me know if this is still active

yeah that sounds about accurate. i agree, u dont need a virtual-link since your not trying to join two backbone areas together and hq (area 1) is directly connected to the backbone (dc - area 0) already. i dont think u need a multi-area adjacency either so it all boils down to whether the links between sw101-sw201 and sw102-sw202 should be in area 1 or area 0. i think the real question is...who/where should the ABRs be? there was a question in the design section where sw101 and sw102 being the ABRs for nssa area 1 (hq) was an option but i dont remember seeing anything about sw201 or sw202 in the dc. that might be a hint that sw101 and sw102 were meant to be ABRs for area 1. This way, those two can send a summary-route for 10.1.0.0/16 (sw102 with a worse metric) to the dc. it just seems kind of funny having sw201 and sw202 as ABRs (links in area0 and area1) in the dc. What do u guys think?

it seems like there are a lot of vendors on here trying to out do each other on tarnishing each others brands and throwing dirt on each others names so that their product seems better. Sales tactics. I thought this was a community where knowledge is shared. i have yet to see somebody who passed come back and share their knowledge. go figure

if this is still active can you please add me?

how do i join? can you add me please?

Their not going to post it bro. i've tried and idk its weird. For some strange reason everybodys being silent on the new lab updates. i cant seem to find them anywhere, but i know they're out there. somebody has them but i cant find them anywhere on this site. hopefully somebody comes along and helps us out

Kat does your guide have the new questions from the design module? does it have the HQ ospf nssa default route injection question? udld vs loopguard? and something about placement importance of RP in DMVPN? For the deploy module does it have the one with HQ in Area 1 and you have to advertise 10.1.0.0/16 to the DC and sw101 as the primary path and sw102 as the backup? And r3 as the route reflector for the MPLS backbone?

I think the expert level lab exams might follow a slightly different schedule though but it seems like the last update came around june/july of this year so that may be accurate. just keep in mind that they also said this on that page: "How does the Cisco Certifications Roadmap affect CCIE lab exams? All Expert-level certifications will align with the associated technology track cycle, but changes to Expert-level certifications might not occur annually due to their complexity and longer time period requirements (such as upgrades for hardware and software)."

Just wanted to revive this thread and see if we can all collaborate to crack the design section. there are new questions out but i wanted to go over some of the original ones that are still there. If anyone passed recently hopefully you can chime in. I went over Jocantaro's solutions (quoted) and picked out the ones that are still relevant but there are still some questions that im not sure about. i'll leave out some of the ones that i agree with and only address the ones that i have a different opinion about: Question 8.3 (two disadvantages of using distribute list to control the routing table contents): - Incorrect deployment of distribute lists may cause permanent routing loops - Administrative overhead will grow since distribute lists must be deployed on all OSPF routers i wouldnt choose "Distribute links in OSPF have no influence on the contents of the CEF FIB on the router" because since distribute lists control which OSPF routes from the LSDB are allowed to be installed in the RIB, which ultimately affects the FIB then that answer can't be correct. Question 9.1 (which switch or switches must perform DHCP Snooping to avoid DHCP-related incidents in the HQ?): here I would choose sw110 only because according to the design "all current and future end hosts on HQ will be connected ONLY TO SW110". The main point of DHCP Snooping is to protect DHCP clients by verifying that messages coming from DHCP servers are coming in through the proper ports. Ports where DHCP clients are plugged into should only send DHCP DISCOVER and REQUEST messages. it probably wouldnt make sense to configure DHCP snooping on the distribution switches that wont have end hosts plugged into them. Typically DHCP OFFERS and ACKs would be coming from that direction, so theres probably less of a need to configure dhcp snooping there because theres no end hosts to protect on those switches. thats just my take on it Question 12 (Drag the QoS configuration action): I would say, R24 -> step #1 - Create child QoS policy Handling traffic, classes, step #2 - Create parent QoS policy with 10Mbps shaper, step #3 Associate the child QoS policy with the parent QoS policy, step #4 Apply the parent QoS policy as an NHRP-mapped policy on the tunnel R70 -> Configure NHRP QoS Group name (agreed with Jocantaro) Question 13 (What change is required to the BGP configuration in the environment of Global SP #1 so that r4 learns about multiple paths to networks at Branch #3?): I think the answer is "On r5 and r6, unique RDs need to be configured". Since according to the design "RD 10000:1 on all PEs", when r3 (the RR) receives that prefix from both r5 and r6 it would place it into its BGP table with the same RD value and would have to select only the prefix with the best path. It will only send the best path to its RR clients (RFC 1966 Section 5: "When a route is received by a RR, it selects the best path based onits path selection rule.") configuring BGP Multipath on r3 would only allow r3 to loadshare traffic destined to that prefix, but wouldnt effect r4. The maximum-paths setting would only dictate how many of the multiple paths are allowed to be selected and installed in the routing table. configuring unique RDs on r5 and r6 would be similar to what the "BGP Add-Path" feature does but instead of the RD it uses a concept called the "Path-ID": "The BGP Additional Paths feature is implemented by adding a path identifier to each path in the NLRI. The path identifier (ID) can be considered as something similar to a route distinguisher (RD) in VPNs, except that a path ID can apply to any address family. Path IDs are unique to a peering session and are generated for each network" Question 17 (What prefixes, along with their label bindings must be advertised by LDP in the MPLS mock lab to enable MPLS L3VPN services?): i agree with Jocantaro on this one because you need the label bindings for the PE and P routers for a complete label switch path. If you dont have labels for the P routers even in this topology you would break the LSP. in OSPF the loopbacks for each PE and P routers will be exchanged and any router with LDP enabled will generate a label for that loopback and they will forward packets to their next hop router based on the remote label binding advertised for that loopback. especially since the MPLS LDP session is established using the Loopback IP of the P and PE routers. all other labels are unnecesary for MPLS L3VPN. Question 18 (What mechanism and type of deployment would be the most appropriate to accomplish the label filtering goals as requested?): here I would say LDP advertisement filter just for the P routers only - (LDP advertisement filter applied to P routers) The requirement is that they dont want to break IP connectivity and they want to allow all labels except the training department's 200 loopbacks. if according to the design only r1 and r2 (the "P" routers) are configured with the loopback interfaces then they would be the only ones that would need an LDP advertisement configured i think. in order to prevent any other routers from receiving the labels for the training department loopbacks. and prefix-suppresion would break IP connectivity to the transit links Question 21 (Given the description of the issue, what are the two reasons for the absence of RAs breaking the IPv6 connectivity?): im still on the fence about this one and not sure. but I think its this: - The end hosts could not locate their default gateway - The end host did not have the necessary information for an autoconfiguration mechanism" Anyone who knows care to chime in? Question 22 (What would be the proper approach to meet the security requirement as stated by Travis?): i think the answer is - Implement IPv6 Secure Neighbor Discovery(SeND) The requirement according to the design is for hosts to continue using DHCPv6 so they would need the global prefix information from the RAs so if the routers stop sending RAs they wont get that critical information. they want to prevent hackers from eavesdropping on the prefix information from the RAs. enabling RA Guard and Suppressing prefix information would prevent the hosts from getting the necessary information for DHCPv6. What they want is to obscure the prefix information in the RAs from anyone who is not authorized to see it and that is what "SeND" would do. SeND encrypts the RA messages using RSA keys or PKI Question 23.2 (Given Travis preference, what would be the first hop redundancy mechanism of choice?): i think its "VRRP only" because one of the requirements is that the solution "does not inundate the end hosts with excess traffic to process, and whole inner workings are simple." The more you tune IPv6 RA message frequency the more messages you will be sending to the end hosts and since they speak IPv6 they will have to process those message and possibly overburden the CPU. since they dont speak VRRP, they would ignore those packets. Also, vrrp counts as an "open" protocol and is able to switch over to another gateway within 1 second - "One thing-I definitely prefer open protocols" "we would like to pick and tune the protocol to allow end hosts to switch over to another gateway within 1 second is most" Question 24 (When building the overall SD-WAN policy to meet the Payment Card Industry requirements for the Point Of Sale(POS) terminals at Branch #1 and Branch #2, what three steps must be accomplished in vManager?): - Create POS VPN AND VPN interface feature templates and apply them to Branch #1 and Branch #2 device templates - Apply the policy outbound to the Site IDs of Branch #1 and Branch #2 - Create a policy to set the TLOCs for Branch #1 and Branch #2 POS OMP routers to the DC TLOC(s) you want to apply the policy outbound to Branch 1 and 2 so that they can receive the TLOCs for each others prefixes pointing to the DC instead of directly to the other Branch in order to fulfill the requirement: "Under no circumstances may POS terminals on Branch #1 communicate directly with POS terminals on Branch #2 and vice versa. Any such communication be instead routed through the data center where we have the necessary firewalls in place" Question 28 (Given the intended scope of SDA fabric deployment on Branch #2, which option represent the smallest applicable IP pool in DNA Center to support LAN Automation on Branch #2): this one gives me a lot of trouble. I have no idea how to answer this question or what documentation backs up the actual answer. Is this just simple basic subnetting/VLSM? im not sure if this is particular to SD-Access or just basic subnetting. Anyone who passed the design section care to chime in? Question 29 (Which option represents the smallest applicable IP pool in DNA Center to support the planned Layer3VN handoffs on Branch#2): I have the same issue with this as Question 28. not sure if its something specific to SD-Access or if its just plain old basic subnetting??? Question 30 (Which two design options are applicable to provide transit between planned SDA fabrics in Branch#1?): This one seems obvious: - Deploy IP Transit between Branch #1 and Branch#2 - Use BGP as a handover protocol between SDA border nodes and SD-WAN vEdge routers but im not sure if its a trick question and im missing something? Question 32 (What are two possible ways of ensuring that authorized local administrators in the Employee VN on Branch #1 or Branch #2 can still access the local SDA border nodes using their loopback addresses through in-band SSH access?: i got: - Utilize an external firewall for controlled inter-VN communication. - Utilize a vEdge router as a fusion router SGACLs would be more relevant for INTRA* VN communication (microsegmentation) Question 33 (Refer to the new resource(s) available. What are the two valid design options for deploying QoS on the SDA branches that will meet FABD2 requirement?): i agree. I got: - Use the DNA Center to define business-irrelevant application sets. - Use the DNA Center application policy to rebuild the QoS policy. They want to be able to mark down business-irrelevant apps and they would like to take the SDA approach. in DNAC you can use the application policy to do this. i dont think its "extending the existing queing model into a new 4/5 class model" since i believe they're pretty much already using that. For questions 34-37 i wasn't sure. not too strong with automation/programmability. Hopefully someone who is can chime in hopefully my inputs helps. i dont know if my answers are correct but together we can crack that design section

Looks like this thread went cold since march. does anybody have the new Design questions? Did anybody pass recently? I see online some people passing but cant seem to find traces of the new design questions anywhere. can anybody with knowledge of this chime in?

there was definitely some new questions. there was a udld vs loopguard question that im seeing show up in some demo dumps online but im not sure if anybody has all of the new questions. can anyone confirm? There's a twist on the PVLAN question, and a couple new ospf questions. one about auto-cost reference-bandwidth and another about controlling a default route within nssa that has DIA. It was something about which routers should be ABR and which router should the default route be originated so that it doesn't effect other areas. i cant remember exactly what the questions wording were but it would be nice to see it again and try to figure it out. There was also some about multicast like OP mentioned and IPv6 and VRRPv3 security. Anybody have the updated questions or have seen them around anywhere? i cant find them anywhere. thanks