Posts Tagged ‘cisco’

New CCIE R&S Lab 4.0 Blueprint

Tags: ,

So I’m sitting at the CCIE R/S lab Beta, and beginning the part I was sooooo looking forward to – the new 2-hour troubleshooting section. 2 minutes into that section, I was completely bummed. It seemed too much to even attempt. 40-ish routers and switches… 10-12 trouble tickets… 2 hours… plus a new user interface. But by the end of the process, I had completely reversed my opinion – I thought it was completely reasonable. Today, I’ll describe the process and draw a few conclusions about the t’shooting section.

First, a little context is in order. The day began with a brief talk w/ the proctor, and a look around the parts of the user interface you could see before starting the timer. Then, it was time to start a timer and then answer the open-ended questions. Cisco didn’t require that the Beta candidates pass that part – they wanted the labs, process, interface, etc tested – so then it was time to click start to crank up the t’shooting part of the lab.

(I’m assuming you read my last post, which talks about the GUI; if not, go here.)

There was no physical lab book, but there was a window that you could display that lists the various t’shooting tasks that I would refer to as trouble tickets. Each task or ticket describes a problem, eg, PC1 can’t ping PC2, intervening routers should be set up to do x, y, z, make it work, that kind of thing. I can’t say how many I had, but I did get permission to say 10-12 tickets is typical. Just my opinion, but that number may change over time, particularly as they build more, some of which may take longer or shorter time.

The GUI actually worked pretty well for reading the tickets. The t’shooting tasks could be easily scrolled from the window that displays the tasks. So if I looked at my list, thought about doing numbers 3, 5, or 7 next, it was quick and easy to review each briefly. Because the tickets did not seem to be dependent on each other, it seemed a good strategy to do the easiest for me first, ignore those for which I had no current knowledge of the config, and get the tweeners in between. (Your tickets might be interdependent – they just weren’t in my case.) Regardless, the GUI made it easy to navigate to the trouble ticket I wanted to tackle next.

The shock in the first few minutes was the unveiling of the topology figure. 30-to-40 or so routers/switches interconnected, lots of redundancy. Yikes! On top of that, I came to the lab with the typical strategy for doing the config section, planning to get a good handle on the topology before doing any of the exercises. However, a 4X bigger topology than a typical config topology made that difficult. Plus, the information in the figure was a bit sparser than the typical multiple view figures for the config section. So, going in with my “understand the topology” strategy was not good, particularly in light of the time constraints.

An interesting aside: the config section continues to be performed on real gear, sitting in a rack somewhere else (I think San Jose, not sure, but it wasn’t next to us in Raleigh). But the big t’shooting topology was on a “virtual environment”, to use the approved description. So they don’t have tons of 30-to-40-device pods waiting on you. I don’t know where those instances were hosted, but the response time was better on the t’shooting labs than in the config labs.

The individual tickets were clear and fair. Plus, they were not long – after reading through them all at once, on the 2nd time through, it took maybe 10 seconds to re-read, and it was time to get into the consoles. So, there was only a little time consumed to understand each issue.

For those tickets for which I knew the topic well – those for which the list of likely potential root causes leaped to mind – I took 7-8 minutes from re-reading the ticket to finding/fixing the problem. (Yep, anal retentive Wendell timed them all.) Those for which I knew the topic pretty well, I needed 12-ish minutes on average. I had no clue on 2 of them, but they were well within the scope of the lab blueprint. I think they were all solvable for a prepared candidate, but I thought that maybe… 1 less ticket would have been appropriate, especially with the learning curve on the GUI at that point. But I think if I had mastered all the topics in those tickets, 2 hours was enough to get them done.

The biggest issue with the t’shooting section was how I approached the task. If I took it again, I would not use the usual config section approach of reading everything twice, making diagrams, understanding the topology, and then actually starting to use the CLI. I think I’d use a “read once, and then react” strategy, and be into the CLI for the first ticket within 5 minutes of starting. Think real life, the phone rings, a problem has occurred, you listen for a few minutes, and start logging in. Because most of the tickets let me zero in on 3-5 devices to solve the problem, it was more like a bunch of separate labs with separate topologies, rather than the more comprehensive config section. (I was told the fact that my tickets were focused to a small area of the topology doesn’t mean that all will be, so be warned.) Regardless, if I had to take it again, my strategy would be as follows:

Read all tickets once, enough to find the main topics, and make a checklist in your notes
Pick the easiest, and start picking them off; (Order wasn’t important in what I saw)
For each ticket:
Create a mental checklist of things to check while reading the ticket
No style points: the solution is to change the config, so “show run” is probably needed within the first 3-4 commands
Personal t’shooting style plays a role
I’d make a list of the devices I’m working on for each ticket, in case a later ticket also uses those devices; I could’ve shaved a few minutes by being more aware of where I had been before.
If you plan to spend time later reviewing/confirming, assuming you finish faster than 2 hours, take notes on what you configured on each device, on each ticket

Cisco Ironport

Tags: ,

Great article on the subject

http://www.networkworld.com/community/node/46036?source=NWWNLE_nlt_cisco_2009-10-09

Cisco voice monitoring by solarwinds

Tags: , ,

SolarWinds Tuesday announced an updated product that the company says will enable IT departments to use Cisco IP SLA to better manage WAN connections, router performance statistics and VoIP metrics.

SolarWinds’ Orion IP SLA Manager replaces the vendor’s Orion VoIP Monitor and combines capabilities to track voice metrics such as jitter, latency and packet loss with visibility into Cisco’s IOS IP SLA. According to Cisco, IOS IP SLAs “use active monitoring to generate traffic in a continuous, reliable and predictable manner, thus enabling the measurement of network performance and health.”

SolarWinds says it decided to monitor the Cisco technology with a commercial product (the vendor already made a free IP SLA monitoring tool available) because enterprise IT managers are overcoming the traditional barriers to such Cisco tools as IP SLA and NetFlow, for instance.

“Traditionally there were key barriers to the deployment of IP SLA in customer environments. It could potentially have a pretty negative impact,” says Josh Stephens, head geek for SolarWinds. “That has changed a lot over the past few years and now you can configure devices in such a way that IP SLA and NetFlow don’t impact the operation of the device, but still add value when it comes to network performance monitoring.”

The software, targeted at network engineers ideally, can understand from every point on the network how voice applications, for instance, are performing, Stephens says. The product can help network managers get from one tool metrics on how each site is operating from a WAN perspective as well. Because IP SLA is already built into Cisco routers, network managers can quickly generate network and services performance data to identity site-specific or WAN-related performance issues. It tracks edge-to-edge router performance statistics that can be exported into a dashboard for quick reference as well, SolarWinds says.

“Performance can vary greatly across sites,” Stephens explains. “This product helps to make the process of collecting this data simple and helps network engineers better understand the performance of the networks, applications and services.”

Competitive products include CA’s eHealth, which CA obtained via its Concord Communications buy, and tools developed by InfoVista.

SolarWinds Orion IP SLA Manager pricing starts at $1,495, including first year maintenance. Orion IP SLA requires an installation of Orion Network Performance Monitor (NPM). Pricing starts at $2,475 for Orion NPM, including first year maintenance.

Boot sequence for cisco routers

Tags: ,

Booting up the Router

Cisco routers can boot Cisco IOS software from these locations:

 

  1. Flash memory
  2. TFTP server
  3. ROM (not full Cisco IOS)

Multiple source options provide flexibility and fallback alternatives

 

Locating the Cisco IOS Software

Default boot sequence for Cisco IOS software:

 

  1. NVRAM
  2. Flash (sequential)
  3. TFTP server (network boot)
  4. ROM (partial IOS)

Note: boot system commands can be used to specify the primary IOS source and fallback sequences.

 

Booting up the router and locating the Cisco IOS
  1. POST (power on self test)
  2. Bootstrap code executed
  3. Check Configuration Register value (NVRAM) which can be modified using the configregister command0 = ROM Monitor mode
    1 = ROM IOS
    2 – 15 = startup-config in NVRAM
  4. Startup-config file: Check for boot system commands (NVRAM) If boot system commands in startup-configa. Run boot system commands in order they appear in startup-config to locate the IOS
    b. [If boot system commands fail, use default fallback sequence to locate the IOS (Flash, TFTP, ROM)?]

    If no boot system commands in startup-config use the default fallback sequence in locating the IOS:
    a. Flash (sequential)
    b. TFTP server (netboot)
    c. ROM (partial IOS) or keep retrying TFTP depending upon router model

  5. If IOS is loaded, but there is no startup-config file, the router will use the default fallback sequence for locating the IOS and then it will enter setup mode or the setup dialogue.
  6. If no IOS can be loaded, the router will get the partial IOS version from ROM


Default (normal) Boot Sequence

Power on Router – Router does POST – Bootstrap starts IOS load – Check configuration register
to see what mode the router should boot up in (usually 0×102 to 0×10F to look in NVRAM) – check the startup-config file in NVRAM for boot-system commands (normally there aren’t any) – load IOS from Flash.

 

Boot System Commands

Router(config)# boot system flash IOS filename – boot from FLASH memory Router(config)# boot system tftp IOS filename tftp server ip address – boot from a TFTP server
Router(config)# boot system rom – boot from system ROM

 

Configuration Register Command

Router(config)# config-register 0×10x (where that last x is 0-F in hex)

When the last x is:
0 = boot into ROM Monitor mode
1 = boot the ROM IOS
2 – 15 = look in startup config file in NVRAM

I hope you found this article to be of use and it helps you prepare for your Cisco CCNA certification. Achieving your CCNA certification is much more than just memorizing Cisco exam material. It is having the real world knowledge to configure your Cisco equipment and be able to methodically troubleshoot Cisco issues. So I encourage you to continue in your studies for your CCNA exam certification.

Cisco CLI basic configuration

Tags: ,

Hostname Configuration

 

yourname(config)#hostname LinuxDynasty-Cisco_1811

SNMP Configuration (For Access from Network Management Tools)

LinuxDynasty-Cisco_1(config)#snmp-server community linux ro
LinuxDynasty-Cisco_1(config)#snmp-server community dynasty rw
LinuxDynasty-Cisco_1(config)#snmp-server ifindex persist

Service Configuration (To hide the passwords when doing a “show run”, and
setting the log to show timestamps instead of uptime next to entries)

LinuxDynasty-Cisco_1(config)#service password-encryption
LinuxDynasty-Cisco_1(config)#service timestamps debug datetime msec localtime
LinuxDynasty-Cisco_1(config)#service timestamps log datetime msec localtime

Clock Settings (Configuration for Eastern Standard Time, 5 hour offset from GMT)

LinuxDynasty-Cisco_1(config)#clock timezone EST -5
LinuxDynasty-Cisco_1(config)#clock summer-time EDT recurring
*Oct  5 07:55:58.051: %SYS-6-CLOCKUPDATE: System clock has been updated from 12:55:58 UTC Sun Oct 5 2008 to 07:55:58 EST Sun Oct 5 2008, configured from console by Cisco on console.
LinuxDynasty-Cisco_1(config)#
*Oct  5 08:56:04.423: %SYS-6-CLOCKUPDATE: System clock has been updated from 07:56:04 EST Sun Oct 5 2008 to 08:56:04 EDT Sun Oct 5 2008, configured from console by Cisco on console.

                   
AAA Authentication commands

LinuxDynasty-Cisco_1(config)#aaa new-model

LinuxDynasty-Cisco_1(config)#aaa authentication login default local
LinuxDynasty-Cisco_1(config)#aaa authentication enable default enable line
LinuxDynasty-Cisco_1(config)#username linux privilege 15 password dynasty

VTY Line Authentication Commands

LinuxDynasty-Cisco_1(config)#line vty 0 15
LinuxDynasty-Cisco_1(config-line)#login authentication default
LinuxDynasty-Cisco_1(config-line)#password linux
LinuxDynasty-Cisco_1(config)#enable password dynasty
LinuxDynasty-Cisco_1(config)#enable secret dynasty

The enable secret you have chosen is the same as your enable password.
This is not recommended.  Re-enter the enable secret.

LinuxDynasty-Cisco_1(config)#enable secret dyn@sty

Create Loopback (Best interface to use for NMS’s also will use to test AAA configuration)

LinuxDynasty-Cisco_1(config)#interface loopback 0
*Oct  5 09:05:25.067: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to upaddres
LinuxDynasty-Cisco_1(config-if)#ip address 10.10.10.1 255.255.255.255
LinuxDynasty-Cisco_1(config-if)#exit
LinuxDynasty-Cisco_1(config)#exit
LinuxDynasty-Cisco_1811#
*Oct  5 09:05:58.723: %SYS-5-CONFIG_I: Configured from console by Cisco on consoleping 10.10.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

Telneting to check AAA configuration and passwords

LinuxDynasty-Cisco_1811#telnet 10.10.1.1
Trying 10.10.1.1 …
% Connection refused by remote host

Uh-OHHH!!!

LinuxDynasty-Cisco_1811#sho run | begin line vty
line vty 0 4
 access-class 23 in -> AHA! Default configuration has an Access-Class.
 privilege level 15
 password 7 10420017100F
 transport input telnet ssh
line vty 5 15
 access-class 23 in -> Again with the freakin default Access-Class.
 privilege level 15
 password 7 10420017100F
 transport input telnet ssh

Removing Default Access-Class from VTY Lines

LinuxDynasty-Cisco_1811#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
LinuxDynasty-Cisco_1(config)#line vty 0 15
LinuxDynasty-Cisco_1(config-line)#no access-class 23 in
LinuxDynasty-Cisco_1(config-line)#exit
LinuxDynasty-Cisco_1(config)#exit
LinuxDynasty-Cisco_1811#
*Oct  5 09:07:05.695: %SYS-5-CONFIG_I: Configured from console by Cisco on console

Trying Telnet Again – prompt doesn’t show because of the console message directly above. I just kept typing :)
telnet 10.10.1.1
Trying 10.10.1.1 … Open

———————————————————————–
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username “cisco”
with the password “cisco”. The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
———————————————————————–

User Access Verification

Username: linux
Password:

% Password expiration warning.
———————————————————————–
 
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username “cisco” for  one-time use. If you have already
used the username “cisco” to login to the router and your IOS image supports the
“one-time” user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
 
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
 
username <myuser> privilege 15 secret 0 <mypassword>
 
Replace <myuser> and <mypassword> with the username and password you want to
use.
 
———————————————————————--

Success!!!!

LinuxDynasty-Cisco_1811#config t
Enter configuration commands, one per line.  End with CNTL/Z.

Now for a Standard Banner

LinuxDynasty-Cisco_1(config)#banner login *This device is the property of LinuxDynasty Inc.
Enter TEXT message.  End with the character ‘*’.
Unathorized access will be punished to the full extent of the law!*
LinuxDynasty-Cisco_1(config)#^Z
LinuxDynasty-Cisco_1811#
*Oct  5 09:44:18.747: %SYS-5-CONFIG_I: Configured from console by linux on consolexit

LinuxDynasty-Cisco_1811 con0 is now available

Press RETURN to get started.

Session Timeout during a bathroom break. :)

This device is the property of LinuxDynasty Inc.
Unathorized access will be punished to the full extent of the law!

User Access Verification

Username: linux
Password:

LinuxDynasty-Cisco_1811>en
Password:
LinuxDynasty-Cisco_1811#10.10.1.1
Trying 10.10.1.1 … Open
This device is the property of LinuxDynasty Inc.
Unathorized access will be punished to the full extent of the law!

User Access Verification

Username: linux
Password:

LinuxDynasty-Cisco_1811#

Save your configuratiion by executing the “write memory” command. I didn’t because this was a demo. Rebooting without saving will take you back to the factory configuration. Of course, this always happens when you’re satisfied with the configuration, and you’re off the clock in 5 minutes. hehe

Well, looks like we’re good for now. To be continued…….

 

 

 

 

 


Cisco and Warner deal bidges divide.

Tags: ,

Some of the coverage of the Cisco/Warner deal for hosting artist Web sites centers on the tense relations between the recording and technology industries over the past decade. In that time, we’ve seen Napster and other downloading sites that virtually gave music away, rankling entertainment companies casting an accusatory glare to the Valley.

The Cisco/Warner deal may heal relations, reports suggest. Under the arrangement, Cisco will host Warner artist Websites on its Eos entertainment platform — 12 such sites by the end of the year.

Cisco says the Eos platforms, which are designed to be personable and sociable, could help the music industry create new business models and revenue streams. Yes, this is the same company that makes the equipment through which those nefarious downloads pass…

In a TelePresence session with reporters, CEO John Chambers said, according to Reuters:

“We face a transition that is a paradox in many ways. The consumption of music is up almost in double digits in terms of demand and yet the revenue generation is down about the same.”

Eos will help the two industries collaborate to reap acceptable results for both, he said.

It will be an interesting account to watch from a digital media copyright perspective. The music industry is not impressed with Silicon Valley’s progress in this regard, the Reuters report notes

Cisco IPS 7.0 shows effectiveness

Tags: ,

This week, we also have a review of Cisco IPS 7.0. Our reviewers found that the addition of a global threat correlation feature increases the value of the Cisco software — and the appliances it runs on — and is easy to deploy.

Read the review for yourself here.

Cisco also set the bar “pretty high” with IPS 7.0, states reviewer Joel Snyder. Cisco took the SenderBase reputation filtering technology it obtained from its acquisition of IronPort and created Cisco SensorBase, to change the Risk Rating of security events identified by the IPS.

This mean an event linked to a ‘bad’ IP address will result in an even higher Risk Rating, Snyder writes in his review. A Risk Rating also lets users prioritize events and decide what to look at and what to ignore.

Cisco IPS 7.0 gets good reviews

Tags: ,

This week, we also have a review of Cisco IPS 7.0. Our reviewers found that the addition of a global threat correlation feature increases the value of the Cisco software — and the appliances it runs on — and is easy to deploy.

Read the review for yourself here.

Cisco also set the bar “pretty high” with IPS 7.0, states reviewer Joel Snyder. Cisco took the SenderBase reputation filtering technology it obtained from its acquisition of IronPort and created Cisco SensorBase, to change the Risk Rating of security events identified by the IPS.

This mean an event linked to a ‘bad’ IP address will result in an even higher Risk Rating, Snyder writes in his review. A Risk Rating also lets users prioritize events and decide what to look at and what to ignore.

Is the CCIE in the past?

Tags: ,

Once upon a time, if you wanted to work in networking, and you wanted to remain a technologist, and you wanted certs to demonstrate your skills, CCIE was clearly the one end goal of your certification future. Anyone could read the website, ask around, and realize quickly that CCIE was the top Cisco cert, that it was well respected in the cert world, and that anyone with a CCIE cert got some added level of respect (whether deserved or not). But the world keeps changing, so today, I want us to consider whether CCIE is clearly on a downward path.

I’m sure any of us that care about CCIE might have an opinion about what “golden age” and “downward path” might mean for CCIE. Feel free to offer your own opinion on that count. But the theme I’ll continue throughout is this question: Would you recommend CCDE as the first Expert-level Cisco cert for someone to shoot for, or one of the CCIEs? I’d contend that the more the labor market’s answer to this question is “CCDE”, the more evidence that CCIE’s golden age has passed. But that’s not the only factor, of course.

First, consider CCIE itself, ignoring the newer Cisco certs. CCIE has been around over 15 years. Cisco just passed the 20,000th CCIE mark worldwide. Does the sheer volume start to devalue CCIE? I must admit that as a single CCIE (route/switch), when I go to the Networkers conference and bump into more than a few multiple CCIEs, I wonder if the mere single CCIE status no longer holds as much importance, and that the multiple CCIE crew may be where the cachet lies today. Even so, with more than 2000 worldwide multi-CCIEs, the whole scarcity argument may no longer hold even for multi-CCIEs.

(Brad Reese’s blog on 20,000th CCIE; CCIE Worldwide stats.)

Next, consider the Design track for a moment, ignoring the Cisco Certified Architect for now. Before CCDE, the design track – CCDA and CCDP – had a useful place in Cisco certs, but from my vantage point, they receive little visibility. Learning Partners seem to offer the design-unique courses much less than the rest of the CCNA/CCxP course set, publishers offer fewer books, etc. And frankly, the CCDP is mostly overlapped with CCNP anyway, except for one exam, so there’s little differentiation. As certs, they were a little weak in my opinion – but the job function of design was already important.

Next, consider CCDE, and whether it makes sense to go for CCDE before a CCIE. Just looking at it on Cisco’s web site, one might think that the CCDA/CCDP/CCDE track might make more sense than the age old CCNA/CCxP/CCIE track, particularly if you focus on design. However, if you look hard at CCDE, it appears that the best cert to work on before getting a CCDE may well be… CCIE R/S. In fact, CCNP may be a better prep path than CCDP. Take a quick look at the page that lists details of the CCDE practical exam, and you’ll see a fair amount of technology overlap with the CCIE Route/switch. (CCDE of course tests much different skills using those technologies.) So, while CCDE may at first appear to detract from CCIE by creating an alternate path towards “expert” cert, I think that using CCIE R/S in particular as a stepping stone towards CCDE makes sense. On the other hand, using a CCIE cert as a stepping stone – an important one, but a stepping stone none-the-less – might be a sign of CCIE’s waning importance.

(Any of you already made the choice of shooting for CCDE, but going through CCIE R/S first to prepare?)

I do think CCDE has devalued CCIE a little due to the practical matters of CCDE scarcity and the coolness of design. Until CCDE picks up some volume, there will be a lot fewer CCDEs in the world than even the sparsest CCIE specialty, and that has some appeal. Also, design is cool in a large number of industries, whereas the implementation details in CCIE seem to be less snazzy these days.

Next, what effect does Cisco Certified Architect have on CCIE value? (I will again abbreviate as CCA the rest of the post). I won’t re-hash my comments from my last post, or Michael Morris’s (CCDE) post, but focus on the impact on CCIE. First, CCA adoption will be slow. Today, CCA has no direct channel partner incentive. The nature of the exam – $15,000 US per attempt, difficulty, 10 years experience requirement, and the skills required – probably mean a few dozen CCA’s a year once it’s up and running full steam. But CCA does require CCDE as a pre-req, so the possibility exists that people will be motivated to go first for CCDE, then CCA, ignoring CCIE. But in sheer volume, I don’t think that movement will have any noticeable effect for another… 5 years?

Finally, CCIE’s inherent value didn’t suddenly go poof. It’s still a very difficult cert, and it tests skills that still have relevance. But CCIE’s perceived value, particularly in relation to other alternatives, may be waning.

Let me wrap up today’s post by posing a question, and offering a survey. Imagine your best friend just finished his Bachelor’s degree. He is sold on Cisco, Cisco certs, and wants to reach the pinnacle working with Cisco stuff, both as a business person and technologist, so he hopes one day to be a Cisco Certified Architect. You see the long road ahead, but you know your hyper-active needs-little-sleep friend will go after it. You suggest, and he agrees, that mapping out a 3-year action plan is as far into the future as you can reasonably suggest. Which do you recommend?

Being realistic to the new Cisco Cert

Tags:

The Cisco Certified Architect certification may well be the single biggest addition/change to the Cisco certification space since the introduction of CCNA and CCNP in 1998. In the space of two years, Cisco has taken the pinnacle of the Cisco cert space – the CCIE – and added another cert billed as equivalent for Design issues (CCDE), and then made a new pinnacle to the cert pyramid – the new Cisco Certified Architect cert – sitting on top of the CCDE.. Network World bills it as a Ph.D. in Cisco. I’ve been pondering this one in the back of my mind, and want to offer some perspectives, and give us a space to get a discussion started.

First off, “CCA” is already used by Citrix, so right now, Cisco has to spell out “Cisco Certified Architect”. For the purposes of this quite informal blog space, I’m going to stick with the acronym CCA, just for convenience. Personally, I hope (clicking heels 3 times right now) that Cisco will change the name to a usable acronym. Note that CCDA is of course already taken as well, by Cisco. ;-)
The world, she has changed. Once upon a time, IT was a cost center, something you had to have to get the work done. IT was operations, and not part of the overall business model. Over time, IT has developed into a strategic asset for many companies, with entire business models predicated on the role and function of IT. Over that same time, the complexity of IT has kept growing. Combining the fact that IT has not only visibility within corporate management of large companies, but may been seen as a strategic intertwined asset of the company, it’s not a big surprise that Cisco has developed a certification aligned with those job skills.

Next, consider the typical number of job opportunities for CCIE-level network implementers/troubleshooters versus CCDE-level network designers. Certainly, most companies need more implementers than designers. Is the ratio 10:1? 20:1? That’s not rhetorical, I’d really be curious as to what you see out there. Certainly, in many companies, 1 person fills both the role of designer and implementer, but then there might be several other folks who most do network engineering tasks, but fewer design tasks. So while CCA may be the cool new cert (and CCDE to some extent), the number of job roles for those with these design certs may be less than for CCIEs.

While the design-oriented CCDE and CCA and implementation/troubleshooting oriented CCIE are separate certs, the skills are related. The best network engineers have a good understanding of network design, and vice versa. Many people who do the network design were formerly doing network implementation – in fact, that was one motivation for adding CCDE and then CCA. So while the certs are separate, the skills are not completely separate.

The whole pre-req topic made for some interesting discussions out at Networkers last week. The new biggest baddest Cisco cert, and Cisco doesn’t even require a CCIE as a pre-req. While at Networkers last week, I asked some Cisco folks about the whole CCDE and/or CCIE as pre-req for CCA thing, and the response was interesting. Although CCIE is not a pre-req, it’s unlikely you’d pass the Board exam without CCIE level skills. So while technically the pre-req is CCDE, in practice the better candidates may be the CCIE/CCDE.

Practically speaking, making CCIE the only pre-req just didn’t work, even if Cisco wanted to. For perspective:

(Rumor) 7 CCDE’s worldwide today. Number unverified. However, no scaling issues with the testing.
353 people with 3 or more CCIE’s today (link)
Over 2155 multiple CCIE’s
(my math makes it around 1800 dual CCIE’s)
Over 20,000 total CCIEs; been around over 15 years
With these numbers, Cisco just couldn’t have made CCIE the only pre-req for CCA and also required a live, human board review. They would have way too little capacity to handle the board reviews. I personally would have preferred to see both CCDE and CCIE as pre-reqs. I even thought that Cisco should offer two options for pre-reqs – either CCDE or be a triple (or more) CCIE – but that would still leave us with too big a pool of initial candidates (353 today). I have no idea if Cisco discussed this internally, but it just wouldn’t have worked.

Chime in, give your thoughts, and let me know what you think. Next post, I’ll examine how all this matters to the general certification population.