The 10 most useless tips to pass your JNCIE

Recently I’ve had a bunch of people asking me what to do on exam day to pass their JNCIE, from whether they should have coffee in the morning or not to what sort of breakfast they should have. Other questions have included concerns about screen size on the laptops provided. These sorts of things are mentioned on a bunch of websites and study guides. I’m going to address my view on this once and for all in this post…

I had to abandon my holiday yesterday (Easter Friday) and spend it debugging a fault. It was a particularly hard and complex one, which had left others stumped. While I’m not able to go into a lot of detail, I can disclose that to identify the cause of the fault I had to spend 15 minutes or so tcpdumping RSVP messages and examining them to find the issue. From this I was able to deduce that a particular box was doing something that was particularly odd and we were able to proceed with resolving it.

The above paragraph might seem unrelated to the point of the post… but it really isn’t. The issue I debugged yesterday was far harder than the troubleshooting elements of any JNCIE exams I have taken. This isn’t to say that the JNCIE exams aren’t incredibly challenging – they are – and I have great respect for anyone who has done one of these exams – as it displays a significant level of skill.

The point is however that, like many others, I spend most of my days doing a combination of debugging the most ugly of problems you will ever see in a service provider environment and architecting a huge range of solutions comprising technologies from many vendors to deliver to customers. A couple of times a year, people in these positions are going to face a mind-bendingly odd problem which will require significant debugging skill and an intimate understanding of the technologies and protocols involved to resolve.

If you are doing this sort of work regularly, you are not going to struggle to achieve a JNCIE. You are still going to have to do a hell of a lot of reading, labbing and learning. The breadth of topics covered in a JNCIE will stretch most to have to cover many technologies they have never touched to a depth they have not understood anything before. I personally spent a considerable amount of time reading, re-reading, and re-re-re-reading many RFCs, books, and other resources to make sure I had a solid understanding of the standards defining each protocol. Significant time was spent labbing technologies that were new to me (for example – NV-MVPN, draft-rosen, Carrier of Carriers VPN, and Interprovider MPLS VPN options B,C & E).

But what I didn’t have to learn was how this stuff fundamentally works. I get this stuff already, as do most people who successfully attempt this exam. I didn’t have to learn how to troubleshoot to do the JNCIE – I’ve been troubleshooting complex and horrible problems all of my career. Most people sitting these shouldn’t need to learn this.

About 8 weeks ago I was sitting in a hotel room in drinking with a few friends, when someone piped up and had what I considered to be a long and whiney rant where they blamed everyone else for their failures. Essentially this person was saying that the questions were not worded well enough, and this was why he failed his CCIE. I tend to disagree. Both the JNCIE and CCIE exams are extensively alpha & beta tested (I recently sat the beta version of the JNCIE-ENT). During this time much feedback is given around the readability and understandability of the questions. The questions will never be written to tell you what to do – that’s not the point of an expert level exam. But they are written in a way that ensures that if you have the understanding requred you will know what to do. Another person in the room pointed out that they’d lost half the time in the troubleshooting section of the his CCIE because they hadn’t seen that there was a topology diagram, but still passed. Because he understood the content to an expert level, and had a huge amount of experience, he was able to get everything in that section done in the 50% time remaining.

What’s the point of all this? Why is this all relevant? Well it’s actually all pretty relevant – the point is that for any of these IE exams, they are designed so that an expert in the subject areas will pass. If you have an intimate understanding of how multicast works, you aren’t going to struggle to deploy and troubleshoot it.

Many websites and study guides have tips and tricks for these exams. These range from not having too much coffee (duh!) to eating a certain type of bread in the morning. Most of them are utter rubbish. Or more to the point – while they’re going to help you focus during the day, and might even make the difference between having time for that one extra question that gets you over the pass mark and not having time – this isn’t going to pass the exam for you. For the record – both times I’ve done a JNCIE the morning has begun with a massive breakfast from the Juniper cafe that makes me sleepier than normal! And both times I’ve walked out hours before the finish time with everything done.

While I don’t want to throw stones at anyone in this article, I think it’s time for a bit of a reality check for those who think that the type of bread they eat, range of pens in the exam, different colour highlighters, or the size of the laptop screen are going to make any difference at all. The best difference you can make is regular hard work in the many months leading up to the exam, and having great amounts of hands-on experience to boost.

Happy easter everyone!

Two new certifications… and….. aspirations for another JNCIE!

Over the last month or so, I have been quietly working away at a couple more JNCIS certifications – JNCIS-QF (QFabric) and JNCIS-SEC (Security).

For those of you who have not done any Juniper certifications before – a JNCIS is roughly equivalent to a CCNP level certification. I’ve come off the back of fairly intensive study for my JNCIE-ENT, for which I was invited to sit the beta of some new test forms in February – so rather than doing 6+ an hour per night, I slowed this down to an hour or two per week. It’s actually been quite odd re-figuring out what to do with all this “free time” – so doing these certifications was a good thing to do to keep my brain occupied and learning something new!

I’m pleased to say that I passed both, getting my JNCIS-QF on 14 March, and my JNCIS-SEC on 8 April. I thought both did a really good job of establishing that the candidate had a reasonable knowledge of the subject areas covered, and would feel confident setting up either a QFabric system or a Juniper SRX in a live deployment (which I guess is the point, right?).

I’ve also decided that I am in fact going to work towards a third JNCIE – the JNCIE-SEC. In many ways, this is going to be far more interesting than the other two, given the fact that I have far less experience in the area of Network Security than I have in Service Provider or Enterprise (as I have spent most of my career working for large service providers!). I’m really looking forward to learning a bunch of new and different technologies – something which is always very enjoyable!

I do however plan to take this one significantly slower than the other two. Essentially I did all the study for my last two JNCIEs in one year – and while I am glad I did it, as I wanted to prove to myself that I could; I would not do it again as I had no life at all while I was doing it. My plan is to slowly work towards this with the aim of doing the JNCIE-SEC exam sometime in the next year. Over the next couple of months I plan to sit the JNCIP-SEC and the JNCSP-SEC – though I will be doing plenty of labbing for the JNCIE as I study for these two written exams. From there I’ll make a week-by-week study plan of what I want to learn and work out a pace to approach it, and only book the exam when I’m sure that I am entirely ready.

As I do this, I’ll be blogging regularly on some of the new technologies and concepts I will be learning – and would appreciate any feedback/corrections; much of this stuff will be very new and different for me!

I also am hoping to hear back on my JNCIE-ENT result in the next few weeks – and will post this as soon as I get it!


CoS for RE sourced traffic

Many of you will have deployed CoS extensively on your networks. One area of a Junos CoS deployment that I am often asked about by friends is how to manipulate traffic that is sourced from the routing-engine. There are multiple catches and caveats in dealing with this traffic, and different ways to manipulate this.

At a 10,000 foot level, whenever we deploy CoS we generally want to be able to manipulate route-engine sourced traffic such as ISIS, BGP, OSPF, BFD, RSVP, etc to have various different DSCP, EXP, and 802.1p markings. Firstly, we can set a policy as to the marking used for traffic sourced from the route-engine;

set class-of-service host-outbound-traffic dscp-code-point 111000
set class-of-service host-outbound-traffic ieee-802.1 default 111

You can also specify the forwarding-class that is used for processing traffic sourced from the route-engine;

set class-of-service host-outbound-traffic forwarding-class hoffs-odd-class

It’s important to note that your rewrite rules will not take effect with this traffic (by default). Even if you have specified a forwarding-class, the “host-outbound-traffic” markings will be applied outbound for this route-engine sourced traffic.

However as of Junos 12.3, Juniper have implemented a new option for “host-outbound-traffic” on the MX, which causes the router to use the rewrite-rule for each unit to put markings onto traffic from the RE (based on the forwarding-class it is assigned). This is particularly helpful where you might have multiple fibre providers providing access to your customers, each with a different markings scheme that you are required to use. Note that this is only available for the 802.1p markings (not DSCP) This is done as follows;

set class-of-service host-outbound-traffic ieee-802.1 rewrite-rules

Of course a rewrite-rule must be configured on the outbound unit for this to have effect. So if we have a rewrite-rule to map “hoffs-odd-class” traffic to a marking of 010, the traffic will be now marked as 010 on egress.

This of course does not help us for DSCP markings (it only applies to 802.1p markings). Often we will want to manipulate these. Also how would we approach this problem if we were to wanted to assign different forwarding-classes to different types of traffic being sourced from the RE? A great example of this is that while we might want to ensure that BGP is prioritised, we probably don’t need prioritisation of http traffic sourced from the RE!

The solution for this is quite clever. Most of you will know that you can firewall off all traffic to the RE (regardless of the IP it is destined to – even if that IP is on a physical interface) by applying an inbound firewall filter to the loopback. The clever thing is that you can also apply a firewall filter to all traffic leaving the RE by applying an outbound firewall filter to the loopback. If we want to ensure that all http/https traffic is put into the best-effort forwarding-class, we could do the following;

set interfaces lo0 unit 0 family inet filter output RE-QOS
set firewall family inet filter RE-QOS term web from protocol tcp
set firewall family inet filter RE-QOS term web from port http
set firewall family inet filter RE-QOS term web from port https
set firewall family inet filter RE-QOS term web then dscp be
set firewall family inet filter RE-QOS term web then forwarding-class best-effort
set firewall family inet filter RE-QOS term web then accept
set firewall family inet filter RE-QOS term catchall then accept

This is a pretty handy tool and allows us to do a fairly fine-grained manipulation of how each traffic-type being sourced by the RE is treated. Obviously you could customise this in any way to suit your needs. However it’s worth noting that to my understanding you cannot manipulate the 802.1p markings with a firewall filter – hence why the “rewrite-rules” option becomes so important for host-oubound-traffic.

If you thought that this is all there is to marking/classifying traffic sourced from the RE, you would be wrong! On a MX router, the processing of certain control traffic is delegated to the individual line-cards (such as BFD). I have learned the hard way that the markings on this traffic are not modified by any configuration you apply to normal RE-sourced traffic.

The news is not all bad though, as there is an easy workaround for this, and not many protocols are distributed to the line cards. For this traffic, you can apply an outbound firewall filter to the interface you are doing this traffic on. As an example, here is how to ensure that BFD traffic which has been distributed to the line card is placed into the correct forwarding class and marked appropriately;

set interfaces ge-1/2/3 unit 0 family inet filter output cos-bfd-link
set firewall family inet filter cos-bfd-link term 1 from protocol udp
set firewall family inet filter cos-bfd-link term 1 from port 3784
set firewall family inet filter cos-bfd-link term 1 from port 3785
set firewall family inet filter cos-bfd-link term 1 then loss-priority low
set firewall family inet filter cos-bfd-link term 1 then forwarding-class network-control
set firewall family inet filter cos-bfd-link term 1 then dscp 111000
set firewall family inet filter cos-bfd-link term 2 then accept

Hope this helps!

Don’t forget the rest of your loopbacks!

With all that is going on on the internet currently around NTP reflection attacks and the like, it seemed timely to do a post on the logic of how router-protect filters are applied to loopbacks in JUNOS.

For those of you new to using Juniper gear, if you apply a firewall filter inbound on the loopback of a Juniper networks device, this will be applied to all traffic processed by the routing-engine. This includes traffic with a destination address of a physical interface (i.e. not the loopback). This provides a simple and convenient place to deploy firewall filters to protect the routing-engine on the Juniper device.

This generally looks something like this (where re-protect has the rules for what should talk to the RE);

set interfaces lo0 unit 0 family inet filter input re-protect

This includes VRF/Virtual Router interface traffic for VRFs/ Virtual routers that do not have their own loopback interfaces.

The catch that many people I have been helping over the last week have forgotten however, is the fact that this does not apply to traffic in VRFs or virtual-routers that have their own loopback. If the VRF or virtual-router has a loopback interface in it, you must apply the filter to this loopback as well for it to take effect. For example;

set interfaces lo0 unit 504 family inet filter input re-protect

The classic example where you may strike this is that you will generally require loopback interfaces in any VRF in which you wish to land BNG PPPoE subscribers on the MX routers.

However, a better way to implement firewall filtering to protect the routing engine would actually be to implement it in an apply group, in order that all future loopback interfaces are protected without any configuration being required. This could be done like so;

set groups re-protect interfaces lo0 unit <*> family inet filter input re-protect
set apply-groups re-protect

The only catch with deploying it like this is that if you ever do explicitly configure an input filter on a loopback unit directly (i.e. not through the apply-group to all), the group will cease to have any effect on this loopback (as it will see the group as having been overridden with local config).

Hope this all helps!

JNCIE-ENT in review

Over the last 3 months I have done 350 hours of study towards my JNCIE-ENT lab exam. I had the fortune of being selected to participate in the beta version of a new exam version. Again (as I did for the JNCIE-SP – see my article on this here) I travelled over to the SF Bay Area to do this exam, which I took in Sunnyvale on 21st February (yesterday as I write this while waiting for my flight back to NZ at SFO airport).

I decided to take a few days of annual leave (PTO for American folk) and fly in on the Monday (with the exam on the Friday) in order that I could meet with various people in SF who I know online but had not yet met in person. I had an awesome time doing this, and it’s awesome to have put a heap of faces to names of people I have known for quite some time but never met!

As with all expert level exams, no matter how good you are, a significant amount of study is going to be required. You need to combine a wide ranging detailed knowledge of a heap of different protocols with expert level troubleshooting and debugging skills. The exam was 8.5 hours (8 hours normally, plus an extra half hour due to the exam still being in beta), which seems like a long time, but there are a lot of tasks to complete, and tasks often require a fair amount of configuration to complete.

One of the things that is important to note with these exams is that while you are required to achieve the tasks involved, you don’t have to do anything more – so it’s important to remember exactly what the task specifies. You are not trying to make a perfectly built network – you just need to achieve the goals they lay out to pass!

The JNCIE-ENT focuses on Enterprise Routing & Switching (like a CCIE R&S) – and is geared towards a practical (and realistic) enterprise deployment with a bunch of features you are likely to see. Having said this though, I can’t think of any network where you would see all the odd things you were required to do in this exam – but most networks have one or two of the tasks. The full syllabus list can be found here.

I have always been a big believer that the most important thing in preparing for an expert level exam is to use a wide range of resources to prepare – generally each one will have good and bad elements, but together they present a well rounded view of what is required. Additionally – nothing beats practical operational/architectural experience using the technologies in the exam. Knowing how to drive the right show commands / enable the correct traceoptions / do the right tcpdump is really important in this exam.

My reading list was as follows;

  • The InetZero JNCIE-ENT preparation lab book
  • The Proteus JNCIE-ENT workbook
  • Junos Enterprise Switching (O’Reilly)
  • Junos Enterprise Routing 2nd ed (O’Reilly)
  • The Juniper Day One guides
  • Interdomain Multicast Routing (Practical Juniper & Cisco Solutions)
  • Various Juniper courseware;
    • Junos Multicast Routing (JMR)
    • Junos Class of Service (JCOS)
    • Advanced Junos Enterprise Routing (AJER)
    • Advanced Junos Enterprise Switching (AJEX)
    • Advanced Junos Service Provider Routing (AJSPR)

I also rented a bunch of lab time from InetZero, however unfortunately there was only a very limited amount of lab time available to book in the 3 months I was preparing, so I did not manage to use all my vouchers (hint – if you are doing this, be sure to check with them what times they have available before you buy!).

Finally – I had a fairly extensive lab available at work, and used Junosphere quite a bit to lab various routing features. All in all, by the time I took the exam I was feeling as prepared as I could be, and actually ended up deciding to do absolutely no study in the last week I was in SF – as I had done (hopefully) more than enough prior to that.

I cannot say much about the actual lab – only that there were a lot of interesting and unique tasks – and that it was a really enjoyable day of configuring and troubleshooting! I had everything done after about 5 hours, then spent another hour double and triple checking everything. I’m proud to say that I walked out 2.5 hours early after getting to the point where I was sure everything was right (though of course there’s always the chance that I will have to eat my words if I’ve overlooked some major points and I end up failing!).

I felt that the exam was pitched at a fair level, ensuring the participant met the level required, while sticking to scenarios that you might be required to see in real life. Now I have to wait 2 months while all the other participants do the exam before they will mark them all together then figure out what the passing score is going to be (and then if I have made it!). I have always found that waiting for the result of an exam like this is super-painful, so I will be trying to keep busy and not think about it over the next wee while until I get the pass/fail mail!

Thanks to all those who were preparing for the exam or had already done it, particularly my “study buddies” Tyler and Campo, both of whom I would regularly bounce things off (as they would do the same to me). If you are studying for one of these exams I would highly recommend buddying up with a couple of people to do this – sometimes nothing is more helpful than someone else’s perspective on a problem.

Stay tuned for the result as soon as I have it!

A brief break…

As many of you will have already read, my JNCIE-ENT lab exam is scheduled for Friday 21 Feb 2014 – which is getting quite close now! For more info on what this involves, check out my blog post here; JNCIE-ENT beta exam booked.

I’m going to be travelling over to be in the San Francisco Bay Area from Monday 17 Feb – Saturday 22 Feb in order that I can catch up with various people in that time and recover from the jet lag in time for the exam (which is a tiring experience at the best of times).

As much as the JNCIE-ENT lab exam is a massive undertaking, I am feeling as prepared as I could be at this point – I’ve put in 270 hours of study so far, and will be aiming to put in a minimum of 40 hours per week from this point forward.

I’m also looking forward to attending the NZNOG (New Zealand Network Operators Group) conference in a couple of weeks – this is always a great opportunity to catch up with others in the industry and exchange ideas and thoughts.

Over this time, I doubt I will have sufficient time to post many (if any) blog posts (though I may try to fit a couple of new ones in). I will be attempting to rewrite/reword a couple of my earlier posts that I am not yet 100% happy with yet, plus just keeping my head down and focusing on study! Please forgive me for the lack of new content in these coming few weeks!

Thanks to all of those of you who have taken the time to read the various articles I have posted over the short time I have been blogging – particularly those of you who have been kind enough to provide feedback / encouragement / comments relating to these articles and/or my JNCIE-ENT study :).