70 days to go
Posted by TacAck in CCIE-Security on October 5th, 2010
As the title says, i have 70 more days to go before the 2nd attempt. How am i feeling? To be honest, i’ve no clue! A part of me thinks that i can do it this time, but on the other hand i also worry about my chances of clearing . My main question being, “What am i doing different this time around to help me pass?”. I’ve thought about this for sometime now and here’s a brief overview.
I’m just going to keep up the same study plan that i had followed for my first attempt but i’m going to add a couple of extra features in there which i didn’t do the last time around :
- Go through the solutions. I can’t believe i messed this up the first time around and believe me when i tell you, even if you’ve got the answer, it always pays to look through the solutions
- Participate in forums. If you’ve gone through Kingsley’s interview ( previous blog-post ) , you must have realized how much forums can activate one’s thought process. I find it very helpful and i plan on continuing to participate in OSL and CLND
- Try and watch all the tutorial videos that i can find my hands on
- Finish the online bootcamp that i’ve ordered from INE
- Go through Yusuf’s book prior to the lab. This will prove invaluable in getting the OEQs right ( Atleast that’s my belief
)(and finally!) - Go through all the configuration examples in the doc-cd.
After a 2 week forced break, i’m happy that i’m back to labbing. Although my brain’s kinda rusty at this point, i’m doing my best to keep it greased and running by labbing
. I did the INE IOS-Firewall Vol1 lab yesterday and i’m going to do the IPX vol 2A lab today ( pure evil! ).
Also, i hope you’re all doing well and kicking some serious ccie-sec butt! Do let me know about your study techniques and i’d be glad to put them up here.
Cheers and have a wonderful day!
TacACK
CCIE-sec-candidate interviews : Kingsley Charles
Posted by TacAck in CCIE-sec candidate Interviews on October 1st, 2010
Hello All!
It’s been a while since i posted a CCIE-sec interview. Partly because i’ve been a little busy with all the ccie-study and also because of a hectic work-schedule. So to make up for it, i’ve a totally AWESOME interview lined up for you today. It’s an interview with none other than “Kingsley”.
If you’ve spent any time at all on CLND , OSL , IEOC or SecurityIE , you would have definitely come across Kingsley. He’s one of the most active members on all of these sites and he’s helped innumerable number of people with his answers. I’ve always been amazed with the quality of questions that he asks and also the depth of his knowledge. He’s definitely an inspiration to anyone who’s studying for his/her ccie and it’s an absolute pleasure to get a chance to interview him. So here’s the interview!
TacACK : Hello Kings , how are you doing today!
Never felt better before and today is beautiful.
TacACK: Where are you from?
I am from India
TacACK : When and how did your journey into cisco networks start?
I started my journey of Cisco in 2002 after completing by BE. I did my CCNA and got 1000/1000 which boosted me to get more into Cisco certs. Then I went for CCIE R & S training for 6 months after which I had to discontinue as I joined HCL Cisco (Partner company). I really study hard when it comes to certification. Apart from getting 1000/1000 in CCNA, I again scored 1000/1000 in two other papers. One in CCIP track and other in CCSP. Totally, I got three 1000/1000 i.e., full scores in three of my Cisco certification. When I take a cert, I aim to get full marks. As I aim to get full marks, I study a lot. For nearly 6 years, I have been preparing for my professional certifications. My objective was to get enough knowledge before entering into CCIE.
TacACK : Why did you opt for the security track
For past 7 years, I am working for a Cisco Security product and hence I took the security track.
TacACK : What materials do you currently own?
For CCIE, I am using IPexpert and INE workbooks
TacACK : What is your daily study plan like?
I study whenever, I get time. Till my first attempt, I studied continuously compromising my personal life. But for the 2nd attempt preparation, I have decided to take proper rest, go for movies, spend time with my family and study. By doing this my mind is fresh and I am able to keep up the energy.
TacACK: One thing i really admire in you is your dedication towards serving the ccie-sec community by actively participating in forums like CLND and OSL. Thanks a lot for that. You’ve helped me and lot of other people.How do you find time for it ?:)
Till my first attempt I was part of CLND, OSL and INE community. After my 2nd attempt, I have joined the ccbootcamp community too. As if now, I am part of top four communities – IPE, CLND, INE and ccbootcamp. Following are the reason for me to be active in this group. I need to learn things. Hence I try to reply to all the queries. Even, if I don’t remember and don’t know the answer, I go to Cisco docs, google, read, lab it and then reply. CCIE Security has lot of topics, We prepare in months. You may prepare for feature X in 3rd month and feature y in 6th month. In the 6th month, you would have forgotten topic x. How do we keep ourselves refreshing all topics? On these forums, we get queries from all features/topic. If you keep replying to them, you can keep yourselves updated. It is not possible to be sure that you cover all the topics. Being in forum helps you uncover the topics that you have not touched. When you start learning a lot, then it’s time you contribute to others. Then only you will find yourself balanced. Else you will be dumped with lot of knowledge. Learn and teach others, then you will a satisfacton. If we have learnt something very hard and it’s good you share them with others. It can save their time. Remember, on these forums great people do share their knowlegde, when we post queires hence it is a justice that we help others. Also, you will always understand things in your way. It might be wrong sometimes. When you post on these forums, then you will get corrected. Just imagine, if understand a thing wrongly then after sometime you share your wrong understanding to others and that keeps going.
TacACK : What are your weakpoints in the blueprint and how do you plan on overcoming those?
I try to cover every CLI available of a feature using Cisco’s command reference.
TacACK : Do you have anyone you look upto? Someone you maybe try to emulate? ( Get the dynamips pun here?
)
I believe that everyone is unique and hence I can’t emulate. I am inspired by Tyson who has always helped me. Also I am inspired Keith, he also helped me a lot.Thanks to Brandon, he helps everyone. And offcourse Yusuf, he is great. Still more, many thanks to all of them who has helped me in preparing for my CCI
TacACK : Have you attempted the ccie-security lab before? If yes, what was that experience like?
Yes, I have taken one attempt. It was nice. I felt, I was well prepared but need to improve on my time managemant and cover somemore topics
TacACK : On a scale of 1..10, how close the materials are compared the real lab?
I would tell that they are somewhere around 7 to 9.
TacACK : 5 tips to any ccie-sec candidate?
- Work to your soul and start loving things you learn.
- Keep your mind fresh. Don’t keep studying for 24/7, take a break for a day or two and then study.
- Be part of the forums and be active.
- Share the knowledge that you have learnt.
- Don’t give up. If you have cleared CCIE means you are one among the best in the world.
TacACK : How will you celebrate once you get the ccie digits?
I will be happiest man in the world
![]()
It’s just inspiring to interact with such a motivated and humble person. I’ve definitely learnt a lot from this interview and i hope it’s helped you too!
You can reach Kingsley through CLND, OSL, IEOC and SecurityIE. Just post a question and it’s highly likely that he will answer
Cheers,
TacACK
L2TP over IPSec : Configuration and Theory VoD
Posted by TacAck in CCIE-Security on September 24th, 2010
Hello All,
In an earlier blogpost , i’ve explained the basics of L2TP . In this video, we’re going to be talking about L2TP over IPSec , which is a configuration task in the CCIE-Security Lab blueprint. I thought it would be better if i did a video rather than write about it.
So here it is.
I’d love to hear feedback on how you found the video and what things i could do to improve my technical/presentation skills.
Cheers,
TacACK
Some great videos
Posted by TacAck in CCIE-Security on September 20th, 2010
Hello All!
I’m working on an article ( for a change i’m taking time out to write this
) and i thought i’d share some great videos with you. These videos are not created by me, they are created by Brandon Carroll ( CCIE #23837 (security) ).
As you might already know, Brandon Carroll is an awesome instructor who worked for IPX and is now working for Ascolta Training. He runs a very informative blog and he regularly posts articles there and i find them very helpful.
Yesterday, i came across some videos on his blogsite which were very impressive. He shows us how to configure Anyconnect VPN on the ASA, using the ASDM. If you’re an ASDM fanboy, then this video is a must-watch! Even otherwise, i’d highly recommend watching this because you’re getting free lessons from Brandon who is very well known for his deep technical knowledge and excellent explanation skills. I’ve loved all the IPX videos that Brandon has done and i hope to meet him someday
. So, here are the videos!
PART 1 -> http://globalconfig.net/2010/09/10/configuring-ssl-vpn-with-full-tunnel-access-on-cisco-asa-8-2/
Again, many thanks to Brandon for posting such great material .
Cheers and Happy studying,
TacACK
IOS NAT v/s ASA NAT
Posted by TacAck in CCIE-Security on September 14th, 2010
Hello All,
I have a treat for you today. Well, to be honest , it’s more like a treat for myself , but i thought someone might find it useful too! It’s the NAT IOS order of operation . I’ve tried , tried and tried unsuccessfully to find the exact order of IOS Nat in the Doc-CD. So, this morning, i decided the only way i’m going to find it out is by labbing up a test-scenario where i could manually test out the order of IOS NAT. What better way to learn than by practice right?
Ok, as a foreword, the NAT order of operation on the ASA is fairly easy to find in the Doc-CD and it’s as follows :
- NAT exemption
- Static NAT, Static Policy NAT
- Static PAT , Static Policy PAT
- Policy NAT
- Dynamic NAT
For the IOS , i found that the order is as follows :
- Static NAT
- Static PAT
- Dynamic NAT using Access lists
- Dynamic PAT using Access lists
- Static NAT using Route-maps / Dynamic NAT using Route-maps .
-
- If both Static NAT using route-maps and Dynamic NAT using route-maps is configured, then the precedence works as follows :
- The ROUTE-MAP names are compared lexicographically. The NAT entry with a route-map which has a higher lexicographic value than the other is preferred.
- If the ROUTE-MAPs are identical lexicographically, then Static NAT gets preference over Dynamic NAT
- If both Static NAT using route-maps and Dynamic NAT using route-maps is configured, then the precedence works as follows :
- Static PAT using Route-maps /Dynamic PAT using Route-maps
-
- Same as the previous point.
- Same as the previous point.
Again, if you feel i’ve erred somewhere, please feel free to point out the mistakes either in the comments section or by leaving a small message on the chatbox on the right-hand-bar.
I’m really happy i finally figured this out, because i can now know exactly how the NAT statements are processed in the IOS. Hope you find this helpful too!
Cheers,
TacACK

