The first reason has to do with training customers on the generic model.  That’s the crux of the problem — it is a new syntax that the customer must learn.  Instead, should the vendor choose a device-independent syntax or design around the leading equipment vendor’s syntax?  Both approaches are fraught with problems.

If a new language is used, the customers must be trained on the language, which is a significant burden on the network management vendor as well as the customers.  If a major equipment vendor’s language is used, that creates a burden on the customer to remember which syntax to use for the network management system and on the device itself.   I see a large number of human errors occurring in these scenarios.  There are also enough variations between similar hardware of major vendors that this choice has significant problems.

The second problem is that for a given problem, it is practically impossible to use a generic model to match that of real configurations.  My prime example is QoS configuration where the variation between devices is too great to handle.  The underlying hardware, often the ASICs themselves, drive changes in syntax between devices.  Even Cisco’s attempt at a single command set, the Modular QoS CLI, has many subtle variations.  It gets even more challenging when other vendors are considered.

The only solution I see that is workable is to use the CLI syntax of each device type, just as network engineers have to do in the real world.  They already deal with the variations and understand them.  Why complicate their lives with yet another variation?

-Terry Slattery

So the voice network has its own address space and is separate from the corporate network.  That has made life relatively easy for doing QoS because an ACL can be used to determine which packets are likely to be voice without having to run NBAR (Network Based Application Recognition).  The ACL specifies UDP and that both the source and destination addresses have to be in the VoIP address space.  It’s pretty easy in this case.

But in other networks, some people allocate the VoIP subnets out of various chunks of their network address space.  That makes it exceedingly difficult (well, at least tedious) to provide security betwen the VoIP address space and the corporate address space as well as identifying VoIP data packets.

Using a single chunk of address space for VoIP may not jump out at you initially, until after you’ve deployed it and then decide that it needs to be secure or that you need to add QoS (hmmm, you didn’t do QoS up front… welcome to the club – many people put it off in order to get the phones deployed).  Then you find that the access lists you need are very, very long and difficult to maintain.  But readdressing is also a big pain.

Thinking of it up front during the design phase makes a big, big difference in the amount of work that goes into your deployment and into maintaining the system.  My recommendation: go back and readdress the phones.  Sure, it is a hit in productivity to do it, but you’ll have much fewer security and voice quality problems as a result.  (Imagine convincing a SOX auditor that your 5 page access list is correct.)

Plan, plan, plan.  Then build.

-Terry Slattery

https://cisco.hosted.jivesoftware.com/docs/DOC-3751

The Cisco Learning Network home page is at:

https://cisco.hosted.jivesoftware.com/index.jspa?ciscoHome=true

The slides may not be very readable in the presentation and if that’s important to you, then go to the Netcordia/Resources/Webinars web page to download a PDF of the presentation:

http://www.netcordia.com/elqNow/elqRedir.htm?ref=http://WWW.NETCORDIA.COM/files/voicecon-spring08.pdf

In the presentation I step through a set of common problems with VoIP, from adding a VoIP phone to a network to the causes of poor voice quality. I identify the problems that are typically encountered and how to troubleshooting them. Symptoms, causes, and remediation steps are described. In this presentation, I takes you through:

• The processes of:adding a VoIP phone to a network
• The types of problems that are typically encountered and how to begin troubleshooting them
• Symptoms, causes, and remediation steps for typical VoIP network problems

Because there is more time in the recording studio than I have as a member of a panel at VoiceCon, I was able to expand on some of the trougleshooting topics.  So even if you’ve attended my talk at VoiceCon, you may benefit by watching the Cisco Learning Network video recording.  It is less than 30 minutes in length.

-Terry Slattery

 If you have a customer doing multicast, and they add a 2nd Data Center or DR Site at L2, they’ll probably give the new router/switch the next higher IP on each VLAN. The problem with that is that it shifts the PIM DR from the main campus to the DR Site. It may be somewhat invisible and work, unless they don’t enable IPmc on say the links back to the main campus core from the DR Data Center.

In the case I just ran into, there was a new DR switch with an IP on exactly one VLAN, PIM enabled on the VLAN but no other interfaces. It took a while to figure out why the main campus Data Center server switch wasn’t sending PIM Registers for the one IPmc server on that VLAN. The answer turned out to be, the other one had the higher IP, it was PIM DR, so it was trying to do the Registers but did not have PIM enabled on the links on the dual unicast path to the RP… 

What Pete describes is one of the reasons that I don’t like to do L2 across the WAN.  There are numerous failures that can occur and such failures are often very difficult to troubleshoot, especially with a transparent bridged L2 infrastructure.

  -Terry Slattery

Learn how to manage change and prevent failures at Netcordia.com.

While I was at VoiceCon in San Francisco, CA a few weeks ago, I had the opportunity to stop by Cisco and record two video segments for the Cisco Learning Network.  The first of these videos is now online: What CIOs Should Know About Network Analysis.  I did this presentation a while back for a the Baltimore CIO Forum and the CLN folks thought that it was an ideal topic for their new web site.  What does a CIO message have to do with technical staff?  You generally have to talk to the CIO to get funding for new projects.  Understanding the concerns of the CIO and how they relate to your job can have a big impact on who keeps a job in market down-turns like we’re experiencing now.  The better you understand what a CIO needs, the better you can provide value to your company.

In my recording, I discuss the three major concerns of a CIO: 1) make money – revenue is what drives the company; 2) save money – improving profitability increases company value; and 3) staying out of trouble – regulatory compliance helps the company and its officers avoid various types of trouble with federal and state agencies that oversee companies.  There are a variety of ways that the network staff can help the CIO obtain these objectives and I discuss them in my presentation.  It is 18 minutes long, so it doesn’t take long to see how to support your company.  Good luck with making your network better support your company’s goals!

-Terry Slattery

My prime example for configuration dependency is the set of configurations that may be applied to switch ports.  If a port is used as an access port, it would have one configuration.  If it is a switch-to-switch link, it will have a different configuration.  And if it is a routed interface, it will have yet another configuration.  I’m not aware of tools that can take into account how a port is used and then use that to determine which of several configuration segments to use.

The same mechanism is needed for performing configuration updates.  When you’re trying to install a set of configuration updates to thousands of switch ports on hundreds or thousands of devices, doing manual updates is out of the question (unless you enjoy tracking down a lot of human error induced problems).  In this case, I may be modifying a QoS command across all my access ports.  I don’t want to rely on ports being reserved for specific roles because some switches will have a different number of ports than others.  Aggregation switches may have more down-stream switches than others, potentially altering which ports need to have QoS parameters changed or perhaps changing what commands would be used.

If you’re aware of any tools that can handle configuration checking and updates like those that I describe above, please let me know.

-Terry Slattery

More: Automate network change, manage network configuration, and meet compliance.

Check it out. Calculate your risk by plugging in the numbers and seeing the results:

Risk Calculator

- Yama Habibzai

http://www.google.com/search?q=site%3Acisco.com+unified+communications+port+usage

 There are versions for different versions of Cisco’s products.  Add “+6.0″ or “+7.0″ to specify the version you want.  For versions older than 6, you’ll need to change the search, replacing “communications” with “callmanager”, because the product name changed.  I found that the search string above worked pretty well without designating the version number.  It provided links to a number of different product versions.

Good luck with your ACLs!

  -Terry Slattery

  -Terry Slattery

======

CCSI History and Numbers

Carole Warner Reece

I was part of several folks chatting this week about the Certified Cisco System Instructor (CCSI) certification. This program is older than any of Cisco’s other certification programs, including the CCIE program. It also may have less published history. I pieced together this summary based on recollections from Terry Slattery, Marty Adkins, Pete Welcher, and Gordon Clogston who were involved at the early formation of the Cisco Learning Partner Program.

Early History of Cisco Training
The Cisco Training program was originally headed up by Beau Parnell, who was responsible for all Cisco training outside the US. The program was piloted in Europe, probably in late 1992 or early 1993. The pilot program was targeted on creating authorized instructors who contracted to Cisco. The first 10 or so CCSIs in the pilot program were folks from Europe, and included Eckhart Eichler and Ivan Pepelnjak.

So in early 1993, Cisco authorized training was delivered by contractors under the “Cisco” banner. Cisco then decided to develop training partners to create the delivery environments (facilities, equipment, marketing, sales, etc.). The program was launched in the US and Canada in the fall of 1993 under Gordon. Protocol Interface, PSA Ltd, Chesapeake Computer Consultants, and Ascolta joined as Training Partners in the fall of 1993. Many other organizations including NEC, Information Management Systems, American Research Group, American Research Systems, and US West became partners in 1993 and 1994.

CCSI Certification and the ICP Process
The CCSI component of the training partner program in the US was designed in the fall of 1993 by Gordon, Larry Ahner, Kip Peterson, Karen Fang, and Roger Wood (who at the time were members of the technical training group at Cisco.) In those days, there were only two classes: Router Software Configuration, and Router Hardware Configuration. CCSIs were certified for each class.

The original instructor certification program (ICP) was two weeks in length, and built on the assumption that the participants had already attended the classes as students and could pass a competency test. The first week, the participants sat in either the software or hardware ICP class with lots of discussion around ‘the why’ behind the topics and exercises. The second week the participants had to demonstrate their abilities in two areas: first, they had to create the appropriate lab environment to support the learning objectives. Given the equipment and tools, they had to design and configure a lab environment that the Cisco proctor team evaluated and either approved or not. Second, they were given 30 minutes to prep and teach a module from the course selected by the ICP monitors to the rest of the class and the proctors. If the candidate passed the ICP program, they were awarded a CCSI number.

CCSI Numbering
For several years, the 5 digit CCSI numbers were based on a numbering scheme of YYxxx, with YY being the last two digits of the award year, and xxx being the order the certification was awarded. For example, Terry was CCSI #93020, or the 20th CCSI certified in 1993. Marty was CCSI #93021, or the 21st CCSI certified in 1993. At some time in the late 90s, Cisco dropped this numbering practice, and moved to another numbering. I am not sure what the current numbering scheme is, my CCSI designation of #31564 is from 2007.

Current CCSI Process
Today to become a CCSI, candidates must still participate in the ICP process and ALSO must be sponsored or employed by a Cisco authorized training partner. Candidates need to pass the CCNA exam with an instructor level score, and as well as pass the ICP exam which is administered by a CCSI proctor from a CLSP. Currently there is a two day ICP exam, which is often supported by boot camps led by the CCSI proctor that will later conduct the ICP exam. The first part of the exam focuses on presentation skills based on the ICND course, where candidates choose one module to present, and a proctor chooses another one. The second part of the exam is a day long lab involving configuring the gear used to support ICND labs.

Although a CCIE designation will stay with an individual as they switch jobs, someone who passes the ICP is a CCSI while they are sponsored by a Cisco training partner. (You can get sponsored as a CCSI by another organization without repeating the ICP process.)

CCSI Status
In the early 2000s, there was a fee for learning partners to keep their CCSIs active, and so most CCSIs that were not actively doing training were dropped from the CCSI roles by their sponsoring organization. I don’t believe there is any longer a fee for having CCSIs associated to a training partner, but CCSIs still need to be sponsored. I think today there around 1800 CCSIs are associated with training partners.

(My thanks to Gordon, Terry, Marty, and Pete for their contributions to this blog!)

Learn how you can better manage network change at Netcordia.Com