<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Aaron&#039;s Worthless Words &#187; 642-845</title>
	<atom:link href="http://aconaway.com/tag/642-845/feed/" rel="self" type="application/rss+xml" />
	<link>http://aconaway.com</link>
	<description>Not something you want to hear</description>
	<lastBuildDate>Wed, 08 Sep 2010 14:39:15 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>ONT &#8211; Epic WIN!</title>
		<link>http://aconaway.com/2010/04/08/ont-epic-win/</link>
		<comments>http://aconaway.com/2010/04/08/ont-epic-win/#comments</comments>
		<pubDate>Thu, 08 Apr 2010 17:07:06 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[certification]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=633</guid>
		<description><![CDATA[I finally passed the ONT.  It's about *$@(#ing time.]]></description>
			<content:encoded><![CDATA[<p>Two down, two to go.  After much groaning and moaning, I&#8217;ve finally passed my ONT test.  The path to this point has been full of road blocks and covered in potholes, but I finally managed to power through it.  Thank $deity.</p>
<p>If you remember, I&#8217;ve had quite a time with finding a testing center that&#8217;s convenient (or open for that matter), so I took the test at yet another center to see what they offer.  The facility was great; it was very quiet and clean, and the people were wonderfully friendly, which is a new concept to me.  Usually, the people don&#8217;t care about testers, but, being a center for inmates at state prisons (yes, prisoners), they do nothing but vocational and professional testing there.  That&#8217;s a lot better than the facilities who give their own students priority or who make money on training instead of testing.  The center is just over 2 hours away, but I think this place may be the best so far.  I&#8217;ll have to see what the future holds, though.</p>
<p>The test itself was nothing strange; I only had two or three question I hadn&#8217;t seen, and even those were basic and easy to answer.  Each time I failed this test, I jotted down what I missed and studied up on those topics.  The first time was mainly FRTS.  The second was VOIP.  The brute force method, as mentioned by <a href="http://twitter.com/ciscovoiceguru">@ciscovoiceguru</a> seemed to be the key this time &#8211; eventually, I&#8217;d get a passing score by studying what I didn&#8217;t know the last time. Of the 55 questions, I would guess that 35 of them were on both previous attempts.  Of the remaining 20, about 17 or 18 of them were on either of the previous tests, so it turned out quite well this time.</p>
<p>The materials I first studied were pretty disappointing.  The Cisco Press books didn&#8217;t really help.  The content in them is so outdated that they&#8217;re pretty worthless for getting the details needed for a passing score, but what can one really expect for a test that&#8217;s expiring in a few months.  A few people made suggestions of other resources to study, but I found them to be too expensive for passing a single test.  Some unnamed solutions were $800, which means I could just take the test 5 times for the same cost; instead of paying that much for a $150 test, I decided to use the test itself as a study guide and to use Cisco&#8217;s docs to fill in the details.  This seems to have worked out eventually.</p>
<p>The next step is a switching test of some kind.  I can&#8217;t really decide if I want to do BCMSN or SWITCH.  I&#8217;ve got to look over the material to decide, but, in the meantime, I&#8217;m starting to read through the SWITCH book on Safari.  I hope it&#8217;s not outdated already.  I&#8217;m scheduled to be in the ROUTE class with Global Knowledge mid-May, so I&#8217;d like to finish up the switching test by then.  I think I can do it since this material is a lot more familiar to me than Cisco VOIP and Wireless; neither of which we run at the office. In theory, it&#8217;s going to be filling in the details than building a new skill set as with the ONT.</p>
<p>Thanks to everyone for their support.  At the risk of sounding cheesy, it&#8217;s hard to keep going, and the words of encouragement kept me from getting down on myself.</p>
<p>Any suggestion on which switching test to take would be greatly appreciated.  Has anyone actually taken the SWITCH test yet?</p>
<p>Send any <span style="text-decoration: line-through;">Safari credits</span> questions my way.</p>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/04/08/ont-epic-win/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>ONT &#8211; Epic Fail Part 3</title>
		<link>http://aconaway.com/2010/03/26/ont-epic-fail-part-3/</link>
		<comments>http://aconaway.com/2010/03/26/ont-epic-fail-part-3/#comments</comments>
		<pubDate>Fri, 26 Mar 2010 21:46:18 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[fail]]></category>
		<category><![CDATA[pearson]]></category>
		<category><![CDATA[testing]]></category>
		<category><![CDATA[vue]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=606</guid>
		<description><![CDATA[I didn't fail this time.  Someone else failed.]]></description>
			<content:encoded><![CDATA[<p>It&#8217;s not what you think.</p>
<p>I was talking with a buddy online last night, and he made a good point.  If you keep putting off taking a test, you&#8217;ll never make any progress.  I took that to heart, went online, and scheduled another sitting of ONT for today at 3pm at the closest center.  I took the day off, too, so I could get some tax stuff done and get over to the center and back before dinner.  I got some really good rest last night for sure, too, and had some very productive study time before heading off for my day&#8217;s adventures.</p>
<p>I ran my errands and headed over to Statesboro, GA, for the test.  There&#8217;s a technical college over there that&#8217;s the closest testing center to the house, thought still an hour and a half drive for me.  On the way over there, I was going over 802.11e stuff in my head and generally enjoying the sunny and warm day.  I pulled into the school and noticed that they were repaving the parking lot up front where I usually park.  No biggie.  I pulled around back and noticed there were 5 cars in the whole lot.  Last week when I was there, there were at least 200 people there signing up for classes, but there was no one around today.  I didn&#8217;t think much of it, though; it was late in the afternoon on a Friday, and I figured everyone just bolted for home early.</p>
<p>It&#8217;s an open campus with buildings all around a few courtyards.  I walked around the building in the back (I have no idea what building that was) and walked towards the Assessment Center where the tests are given.  The long drive was taking a toll, so I stopped by the main building to heed nature&#8217;s call.  The door was locked.  So was the door to the next building.  So was the door to the Assessment Center.  It was dark.  Nobody was there.  I finally found a sign that said everyone was on furlough until next Tuesday.  Nice.</p>
<p>I called Pearson and told them the story.  They verified I was in the right place and there at the right time.  They even called the testing center to see if they could find anyone, but, of course, no one answered.  The support person with whom I spoke told me that their team would have to get in touch with the testing center to see what had happened and that they would contact me when it was all straightened out.  They were very apologetic for the mixup and promised to straighten everything out.</p>
<p>I guess we&#8217;ll see what happens on Tuesday.  Of course all of this means another half day off of work and another 150 miles on the car.  Will I ever get to pass this test?</p>
<p>The Director&#8217;s Commentary is here again.  Let me know if you like the audio, or if I should burn my terrible voice with fire.</p>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/03/26/ont-epic-fail-part-3/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
<enclosure url="http://aconaway.com/wp-content/uploads/2010/03/ONT-Epic-Fail-Part-3.mp3" length="2611897" type="audio/mpeg" />
		</item>
		<item>
		<title>ONT &#8211; Epic Fail Part 2</title>
		<link>http://aconaway.com/2010/03/18/ont-epic-fail-part-2/</link>
		<comments>http://aconaway.com/2010/03/18/ont-epic-fail-part-2/#comments</comments>
		<pubDate>Fri, 19 Mar 2010 01:43:32 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[test]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=598</guid>
		<description><![CDATA[Guess what?  I'm stupid and failed the ONT test again.  Time to refocus.]]></description>
			<content:encoded><![CDATA[<p>I took the ONT again today.  The stench of failure is upon me for a second time, and I&#8217;m beginning to think I&#8217;m not the god-like person that everyone thinks I am.  I went into the test very confidently.  I did extra time on my weak points from the last attempt and knew it inside and out.  I put hours and hours of lab time in and got other books and online materials involved.  I was absolutely convinced that I would blow this thing away, but, alas, it was not to be.</p>
<p>If you ignore the wireless questions, the test was pretty fair.  There were questions in the usual poor wording that made you doubt things that you know are absolutely true.  Unlike last time, though, I didn&#8217;t find any questions where I was totally lost.  There were some questions that were very ambiguous, but only one was out of realm of possibility (it actually required a calculator to answer correctly).  All in all, it was a good test sans the wireless stuff.</p>
<p>Ah, the wireless questions.  I complained last time that there was one needlessly-obscure questions about WLC CLI, and that exact question was on the test today.  The additional CLI questions were downright sadistic, though, and the question about how to do initial configuration was really uncalled for.  Oh, I almost forgot about the question asking what model of WLCs support feature <em>X</em>.  Really?  Has there always been a requirement to know the features of each model in a product line?  I think I got two (maybe three) questions about the technologies like WPA and DCF.</p>
<p>Yes, I know it sounds like I&#8217;m making excuses, but I&#8217;m not the kind of person who shifts the blame.  If I&#8217;m the cause of the problem, I&#8217;ll fess up to it.  If I thought I could have done better, I&#8217;ll admit it.  If I chose to ignore a topic and get bitten for it, I&#8217;ll happily say it was my fault.  In this case, I did more than what I thought was appropriate and still failed.</p>
<p>I believe this puts me far enough behind my schedule to have to take another path to CCNP.  My first reaction would be go the ROUTE/SWITCH/TSHOOT path.  Since I&#8217;m already scheduled to take a ROUTE class, it seems the obvious choice.</p>
<p>Hear the Director&#8217;s Commentary on this post:</p>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/03/18/ont-epic-fail-part-2/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
<enclosure url="http://aconaway.com/wp-content/uploads/2010/03/ONT-Epic-Fail-Part-2.mp3" length="6524858" type="audio/mpeg" />
		</item>
		<item>
		<title>ONT &#8211; Epic Fail</title>
		<link>http://aconaway.com/2010/02/16/ont-epic-fail/</link>
		<comments>http://aconaway.com/2010/02/16/ont-epic-fail/#comments</comments>
		<pubDate>Tue, 16 Feb 2010 19:21:47 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[test]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=527</guid>
		<description><![CDATA[I took the ONT test today.  It wasn't a happy ending.]]></description>
			<content:encoded><![CDATA[<p>I failed the ONT test today.  It was an utter lack of subject matter knowledge that did me in from the beginning.  When the first three questions mention things that I&#8217;ve never even heard, it&#8217;s going to be a long test.  I&#8217;ll take blame on it for sure, but the test was a lot darker than I imagined it would be.</p>
<p>I heard from a couple people that the ONT test was the easiest of the 4 CCNP test.  I must say today&#8217;s test was a LOT harder than the ISCW test I took back in December.  Most of the questions were fair, but there were a few that were down-right evil or unanswerable.  Without giving too much away, there were some matching questions that had multiple items with multiple answers, rendering the answer to a guess.  I even ran into a CLI question about the WLC, which surely wasn&#8217;t mentioned anywhere I studied, and I don&#8217;t have a spare sitting around on which to test.  The icing, though, was the number of questions about FRTS; I know I need to understand it, but the magical question dice landed on that topic way too many times in my opinion.</p>
<p>At the heart of it, I think my demise stemmed from using only the Cisco Press book.  I really needed to get a wider exposure to the topics.  Though the CP books might have mentioned some topics that I missed, a lot of it is mentioned in passing but appeared in detail on the test.  I would think getting different training would fix that problem and I&#8217;ll be using some of our CLCs this week to do just that</p>
<p>The facility was great, though.  I was comfortable and couldn&#8217;t hear traffic or the lecture across the hall this time.  At least I know a good place to take tests now.  I hope somebody gets some value from my absolute failure.</p>
<p>Send any <span style="text-decoration: line-through;">test vouchers</span> questions my way.</p>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/16/ont-epic-fail/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; WLAN Management</title>
		<link>http://aconaway.com/2010/02/13/ont-notes-wlan-management/</link>
		<comments>http://aconaway.com/2010/02/13/ont-notes-wlan-management/#comments</comments>
		<pubDate>Sat, 13 Feb 2010 19:22:42 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[802.1x]]></category>
		<category><![CDATA[aes]]></category>
		<category><![CDATA[campus]]></category>
		<category><![CDATA[ccmp]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[eap]]></category>
		<category><![CDATA[eap-fast]]></category>
		<category><![CDATA[eap-tls]]></category>
		<category><![CDATA[leap]]></category>
		<category><![CDATA[lwap]]></category>
		<category><![CDATA[lwapp]]></category>
		<category><![CDATA[mic]]></category>
		<category><![CDATA[peap]]></category>
		<category><![CDATA[peap-gtc]]></category>
		<category><![CDATA[peap-mschapv2]]></category>
		<category><![CDATA[psk]]></category>
		<category><![CDATA[ssid]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[tkip]]></category>
		<category><![CDATA[wifi]]></category>
		<category><![CDATA[Wireless]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=510</guid>
		<description><![CDATA[Finally, the last chapter of the ONT study entries is here.  WLAN management is the subject.]]></description>
			<content:encoded><![CDATA[<p><strong>Elements of Cisco Unified Wireless Network</strong></p>
<ul>
<li>Client devices &#8211; Cisco compatible extensions on WLAN clients</li>
<li>Mobility platform &#8211; allows configuration of LWAPs through WLCs</li>
<li>Network unification &#8211; integration into the rest of the network with WLCs doing RF management, IPS, etc.</li>
<li>World-class network management &#8211; centralized management through WCS</li>
<li>Unified advanced services &#8211; supports advanced technologies and threat detection</li>
</ul>
<p><strong>WLAN Implementation</strong></p>
<p>Autonomous and LWAP</p>
<table>
<tbody>
<tr>
<th>Category</th>
<th>Autonomous</th>
<th>LWAP</th>
</tr>
<tr>
<td>Access Point</td>
<td>Autonomous APs</td>
<td>LWAPs</td>
</tr>
<tr>
<td>Control</td>
<td>Individual configurations</td>
<td>Configuration through WLCs</td>
</tr>
<tr>
<td>Dependency</td>
<td>Independent operations</td>
<td>Dependent on WLC</td>
</tr>
<tr>
<td>Management</td>
<td>CiscoWorks WLSE and WDS</td>
<td>WCS</td>
</tr>
<tr>
<td>Redundancy</td>
<td>Through APs</td>
<td>Through WLCs</td>
</tr>
</tbody>
</table>
<p><strong>Wireless LAN Services Engine (WLSE)</strong></p>
<ul>
<li>Part of CiscoWorks</li>
<li>Manages autonomous APs</li>
<li>Centralized configuration, firmware, and radio management</li>
<li>Autoconfig of new APs</li>
<li>Misconfiguration and rogue AP alerts</li>
<li>Proactive monitoring of APs, bridges, and 802.1x servers</li>
<li>Supports SSH, HTTP, CDP, SNMP for up to 2500 APs</li>
<li>WLSE Express supports 100 devices in either automatic or manual setups</li>
</ul>
<p><strong>Wireless Control System (WCS)</strong></p>
<ul>
<li>Supports 50 WLCs and 1500 APs</li>
<li>Three versions
<ul>
<li>Base &#8211; can determine with which APs a devices in associated</li>
<li>Location &#8211; Base plus RF fingerprinting</li>
<li>Location + 2700 Series Wireless Location Appliance &#8211; Tracks devices in real time and stores historical location data</li>
</ul>
</li>
</ul>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/13/ont-notes-wlan-management/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; 802.1x and Encryption on LWAPs</title>
		<link>http://aconaway.com/2010/02/12/ont-notes-802-1x-and-encryption-on-lwaps/</link>
		<comments>http://aconaway.com/2010/02/12/ont-notes-802-1x-and-encryption-on-lwaps/#comments</comments>
		<pubDate>Fri, 12 Feb 2010 21:33:28 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[802.1p]]></category>
		<category><![CDATA[802.1x]]></category>
		<category><![CDATA[aes]]></category>
		<category><![CDATA[campus]]></category>
		<category><![CDATA[ccmp]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[eap]]></category>
		<category><![CDATA[eap-fast]]></category>
		<category><![CDATA[eap-tls]]></category>
		<category><![CDATA[leap]]></category>
		<category><![CDATA[lwap]]></category>
		<category><![CDATA[lwapp]]></category>
		<category><![CDATA[mic]]></category>
		<category><![CDATA[peap]]></category>
		<category><![CDATA[peap-gtc]]></category>
		<category><![CDATA[peap-mschapv2]]></category>
		<category><![CDATA[psk]]></category>
		<category><![CDATA[ssid]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[tkip]]></category>
		<category><![CDATA[wifi]]></category>
		<category><![CDATA[Wireless]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=497</guid>
		<description><![CDATA[I think we're almost done with the ONT notes, but here's another installment on auth and encryption on LWAPs.]]></description>
			<content:encoded><![CDATA[<ul>
<li>Traditional WLAN weaknesses
<ul>
<li>SSID for security</li>
<li>Vulnerable to rogue APs</li>
<li>MAC filtering for security</li>
<li>WEP</li>
</ul>
</li>
<li>WEP weaknesses
<ul>
<li>Disribution of static keys is not scalable</li>
<li>WEP keys can be cracked easily</li>
<li>Vulnerable to dictionary attacks</li>
<li>No protection against rogue APs</li>
</ul>
</li>
<li>Benefits of 802.1x
<ul>
<li>Centralized authentication through Radius via AAA</li>
<li>Mutual authentication between client and auth server</li>
<li>Can use multiple encryption algorithms (AES, WPA, TKIP, WEP)</li>
<li>Automatic dynamic WEP keys</li>
<li>Roaming</li>
</ul>
</li>
<li>Requirements of 802.1x
<ul>
<li>EAP-capable client (supplicant)</li>
<li>802.1x-capable AP (authenticator)</li>
<li>EAP-capable auth server</li>
</ul>
</li>
</ul>
<table>
<caption>Table 1.  Characteristics of the EAP variants</caption>
<tbody>
<tr>
<th>Feature</th>
<th>Cisco LEAP</th>
<th>EAP-FAST</th>
<th>EAP-TLS</th>
<th>PEAP-GTC</th>
<th>PEAP-MSCHAPv2</th>
</tr>
<tr>
<td>User authentication DB</td>
<td>AD</td>
<td>AD, LDAP</td>
<td>OTP, LDAP, NDS, AD</td>
<td>OTP, LDAP, NDS, AD</td>
<td>AD</td>
</tr>
<tr>
<td>Requires server certs</td>
<td>No</td>
<td>No</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td>Requires client certs</td>
<td>No</td>
<td>No</td>
<td>Yes</td>
<td>No</td>
<td>No</td>
</tr>
<tr>
<td>Single sign-on</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
<td>Yes</td>
</tr>
<tr>
<td>Roaming</td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
<td>No</td>
<td>No</td>
</tr>
<tr>
<td>Works with WPA/WPA2</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
</tr>
</tbody>
</table>
<ul>
<li>WPA
<ul>
<li>Features
<ul>
<li>Authenticated key management &#8211; auths prior to key management</li>
<li>Unicast and broadcast key management &#8211; keys are distributed and stored on the client and the AP</li>
<li>TKIP and MIC
<ul>
<li>Temporal Key Integrity Protocol (TKIP) &#8211; per-packet keying</li>
<li>Message Integrity Checking (MIC) &#8211; integrity checking</li>
</ul>
</li>
<li>Initialization vector (IV) expansion &#8211; from 24 bits to 48 bits</li>
</ul>
</li>
<li>Shortcomings
<ul>
<li>Relies on RC4</li>
<li>Firmware support required in NICs, APs</li>
<li>Susceptible to DoS attacks</li>
<li>Dictionary attacks can discover PSKs</li>
</ul>
</li>
</ul>
</li>
<li>WPA2
<ul>
<li>Features
<ul>
<li>802.1x authentication or PSK</li>
<li>Key distribution and renewal</li>
<li>Proactive Key Caching (PKC) &#8211; allows roaming</li>
<li>IDS for rogue APs and attacks</li>
</ul>
</li>
<li>Shortcomings
<ul>
<li>Supplicant must have WPA2-compliance firmware</li>
<li>AAA server must support EAP</li>
<li>WPA2 uses more CPU, so a hardware upgrade may be required</li>
<li>Older devices may not be upgradeable and must be replaced</li>
</ul>
</li>
</ul>
</li>
</ul>
<table>
<caption>Table 2.  WPA/WPA2 Enterprise and Personal Modes</caption>
<tbody>
<tr>
<th>Mode</th>
<th>WPA</th>
<th>WPA2</th>
</tr>
<tr>
<td>Enterprise</td>
<td>Auth:  802.1x/EAP<br />
Encryption: TKIP/MIC</td>
<td>Auth:  802.1x/EAP<br />
Encryption: AES-CCMP</td>
</tr>
<tr>
<td>Personal</td>
<td>
Auth:  PSK<br />
Encryption: TKIP/MIC
</td>
<td>
Auth:  PSK<br />
Encryption: AES-CCMP
</td>
</tr>
</tbody>
</table>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/12/ont-notes-802-1x-and-encryption-on-lwaps/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; QoS On Wireless Networks</title>
		<link>http://aconaway.com/2010/02/10/ont-notes-qos-on-wireless-networks/</link>
		<comments>http://aconaway.com/2010/02/10/ont-notes-qos-on-wireless-networks/#comments</comments>
		<pubDate>Thu, 11 Feb 2010 03:05:23 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[802.1p]]></category>
		<category><![CDATA[campus]]></category>
		<category><![CDATA[ccnp]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[dscp]]></category>
		<category><![CDATA[headers]]></category>
		<category><![CDATA[lwap]]></category>
		<category><![CDATA[lwapp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[precedence]]></category>
		<category><![CDATA[qos]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[wifi]]></category>
		<category><![CDATA[Wireless]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=490</guid>
		<description><![CDATA[Imagine that...another ONT notes post.  This one is about QoS on wireless networks.]]></description>
			<content:encoded><![CDATA[<ul>
<li>Wireless LANs (WLANs)
<ul>
<li>Extensions to wired LANs</li>
<li>Carrier sense multiple access collision avoidance (CSMA/CA) as media access method</li>
<li>Uses distributed coordinated function (DCF) for collision avoidance</li>
<li>DCF is based on RF carrier sense, inter-frame spacing (IFS), and random wait timers</li>
</ul>
</li>
<li>Wifi QoS standards
<ul>
<li>802.11e
<ul>
<li>IEEE standard</li>
<li>0-7 priority levels</li>
</ul>
</li>
<li>Wifi Multimedia (WMM)
<ul>
<li>Four access categories
<ul>
<li>Platinum (voice) &#8211; 6 or 7 802.11e</li>
<li>Gold (video) &#8211; 4 or 5 802.11e</li>
<li>Silver (BE) &#8211; 0 or 3 802.11e</li>
<li>Bronze (Background) &#8211; 1 or 2 802.11e</li>
</ul>
</li>
</ul>
</li>
<li>WMM and 802.11e replace DCF with EDCF</li>
</ul>
</li>
<li>Cisco Split-MAC
<ul>
<li>Splits functions between Lightweight access points (LWAPs) and WLAN controllers (WLCs)</li>
<li>LWAPs handle real-time functions
<ul>
<li>Beacon generation</li>
<li>Probe transmission and response</li>
<li>Power management</li>
<li>802.11e/WMM scheduling and queuing</li>
<li>Packet buffering</li>
<li>Encryption/decryption</li>
<li>Control frame/message processing</li>
</ul>
</li>
<li>WLCs handle non-real-time functions
<ul>
<li>Association/disassociation/reassociation</li>
<li>802.11e/WMM resource reservation</li>
<li>802.1x EAP</li>
<li>Key management</li>
<li>Authentication</li>
<li>Fragmentation</li>
<li>Ethernet-WLAN bridging</li>
</ul>
</li>
</ul>
</li>
<li>End-to-end QoS
<ul>
<li>Step 1:  WLC copies DSCP from switch to outer DSCP and outer 802.1p and sends to LWAP over LWAPP tunnel</li>
<li>Step 2:  LWAP copies outer DSCP from WLC to 802.11e/WMM field and sent to client</li>
<li>Step 3:  LWAP copies 802.11e/WMM value from the client to outer DSCP and sends it to WLC</li>
<li>Step 4:  WLC copies outer DSCP from WLAP to 802.1p (CoS) fields and sends it to the switch</li>
</ul>
</li>
<li>Web interface (do you even need to know this?)
<ul>
<li>Controller&gt;QoS Profiles
<ul>
<li>Per-User Bandwidth Contracts &#8211; set avg data rate, burst data rate, avg real-time rate, and burst real-time rate</li>
<li>Over the Air QoS
<ul>
<li>Maximum RF usage per AP (%)</li>
<li>Queue Depth &#8211; queue size before dropping packets</li>
<li>Wired QoS Protocol &#8211; 802.1p or None</li>
</ul>
</li>
</ul>
</li>
<li>Controller&gt;WLANs&gt;Edit
<ul>
<li>For each WLAN ID, set the QoS value:  plat, gold, silver, bronze</li>
<li>WMM Policy
<ul>
<li>Disabled &#8211; 802.11e/WMM QoS requests are ignored</li>
<li>Allowed &#8211; 802.11e/WMM QoS requests are sent</li>
<li>Required &#8211; 802.11e/WMM QoS requests are required</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/10/ont-notes-qos-on-wireless-networks/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; AutoQoS</title>
		<link>http://aconaway.com/2010/02/10/ont-notes-autoqos/</link>
		<comments>http://aconaway.com/2010/02/10/ont-notes-autoqos/#comments</comments>
		<pubDate>Wed, 10 Feb 2010 23:02:04 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[auto]]></category>
		<category><![CDATA[autoqos]]></category>
		<category><![CDATA[campus]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[class]]></category>
		<category><![CDATA[headers]]></category>
		<category><![CDATA[interface]]></category>
		<category><![CDATA[policing]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[qos]]></category>
		<category><![CDATA[shaping]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[voice]]></category>
		<category><![CDATA[voip]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=484</guid>
		<description><![CDATA[Here are some more notes from my ONT studies.  AutoQoS seems to be pretty straightforward.]]></description>
			<content:encoded><![CDATA[<ul>
<li>AutoQoS benefits
<ul>
<li>Automates QoS for most deployments</li>
<li>Protects business-critical apps to maximize availability</li>
<li>Simplifies QoS deployments</li>
<li>Reduces configuration errors</li>
<li>Cheaper, faster, and simpler deployments</li>
<li>Follows DiffServ</li>
<li>Allows complete control over QoS configs</li>
<li>Allows modification of auto-generated configs</li>
</ul>
</li>
<li>AutoQoS phases of evolution
<ul>
<li>AutoQoS VOIP &#8211; Early version that configures the basics without discovery</li>
<li>AutoQoS for Enterprise &#8211; Second version that only runs on routers and uses two-step process
<ul>
<li>Autodiscovery using NBAR</li>
<li>Generation of class maps</li>
</ul>
</li>
</ul>
</li>
<li>AutoQoS key elements
<ul>
<li>Application classification</li>
<li>Policy generation</li>
<li>Configuration</li>
<li>Monitoring and reporting</li>
<li>Consistency</li>
</ul>
</li>
<li>Interfaces that you can configure AutoQoS on
<ul>
<li>Serial ifs with PPP and HDLC</li>
<li>FR point-to-point subifs (NOT multipoint)</li>
<li>ATM point-to-point subifs</li>
<li>FR-to-ATM links</li>
</ul>
</li>
<li>Prerequsites
<ul>
<li>No Qos policy already configured on if</li>
<li>CEF enabled on if</li>
<li>Correct bandwidth configured on if</li>
<li>IP address on low-speed if</li>
</ul>
</li>
<li>Configuring AutoQoS Enterprise on a router (NOT a switch)
<ul>
<li><strong>auto qos discovery</strong> &#8211; begins discovery process</li>
<li><strong>auto qos</strong> &#8211; generates and applies MQC-based policies</li>
</ul>
</li>
<li>Configuring AutoQoS VOIP
<ul>
<li><strong>auto qos voip [ trust | cisco-phone ]</strong></li>
</ul>
</li>
<li>Verifying AutoQoS on router
<ul>
<li><strong>show auto discovery qos</strong> &#8211; get autodiscovery results</li>
<li><strong>show auto qos</strong> &#8211; examine configuration generated
<ul>
<li>Number of classes</li>
<li>Classification options</li>
<li>Marking options</li>
<li>Queuing mechanisms</li>
<li>Other QoS mechanisms</li>
<li>If, subif, PVC where policy is applied</li>
</ul>
</li>
<li><strong>show policy-map interface</strong> &#8211; look at if stats</li>
</ul>
</li>
<li>Verify AutoQoS VOIP
<ul>
<li><strong>show auto qos</strong></li>
<li><strong>show policy-map interface</strong></li>
<li><strong>show mls qos maps</strong> &#8211; shows CoS to DSCP mappings</li>
</ul>
</li>
<li>Possible issues with AutoQoS
<ul>
<li>Too many traffic classes &#8211; manually consolidate some</li>
<li>Configuration doesn&#8217;t change &#8211; rerun AutoQoS</li>
<li>Configuration may not fit your situation &#8211; fine-tune it by hand</li>
</ul>
</li>
<li>Fine-tuning AutoQoS
<ul>
<li>Use QPM</li>
<li>CLI</li>
<li>copy policy into editor, change, reapply</li>
</ul>
</li>
<li>AutoQoS can match on characteristics besides ACLs and NBAR
<ul>
<li><strong>match input interface</strong></li>
<li><strong>match cos</strong></li>
<li><strong>match ip precedence</strong></li>
<li><strong>match ip dscp</strong></li>
<li><strong>match ip rtp</strong></li>
</ul>
</li>
</ul>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/10/ont-notes-autoqos/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; Pre-classify and End-to-end QoS</title>
		<link>http://aconaway.com/2010/02/03/ont-notes-pre-classify-and-end-to-end-qos/</link>
		<comments>http://aconaway.com/2010/02/03/ont-notes-pre-classify-and-end-to-end-qos/#comments</comments>
		<pubDate>Thu, 04 Feb 2010 03:13:53 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[campus]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[class]]></category>
		<category><![CDATA[control plane]]></category>
		<category><![CDATA[copp]]></category>
		<category><![CDATA[documentation]]></category>
		<category><![CDATA[headers]]></category>
		<category><![CDATA[interface]]></category>
		<category><![CDATA[physical]]></category>
		<category><![CDATA[policing]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[pre-classify]]></category>
		<category><![CDATA[qos]]></category>
		<category><![CDATA[shaping]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[tunnel]]></category>
		<category><![CDATA[voice]]></category>
		<category><![CDATA[voip]]></category>
		<category><![CDATA[vpn]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=482</guid>
		<description><![CDATA[Here are some more ONT notes.  We study pre-classifying and end-to-end QoS this time.]]></description>
			<content:encoded><![CDATA[<ul>
<li>VPNs (Didn&#8217;t ISCW cover this?)
<ul>
<li>Provide
<ul>
<li>Confidentiality</li>
<li>Integrity</li>
<li>Authentication</li>
</ul>
</li>
<li>Types
<ul>
<li>Remote-access
<ul>
<li>Client-initiated</li>
<li>NAS-initiated</li>
</ul>
</li>
<li>Site-to-site
<ul>
<li>LAN-to-LAN</li>
<li>Extranet</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li>L3 Tunneling protocols
<ul>
<li>GRE</li>
<li>IPSec</li>
</ul>
</li>
<li>Pre-classify allows traffic to be classified before being sent across a tunnel or crypto-ed.
<ul>
<li><em>qos pre-classify</em></li>
<li>Provides a view into the original IP headers</li>
<li>To classify on pre-tunnel header, apply the policy to the tunnel interface WITHOUT pre-classify.</li>
<li>To classify on post-tunnel header, apply the policy to the physical interface WITHOUT pre-classify.</li>
<li>To classify on pre-tunnel header, apply the policy to the physical interface WITH pre-classify.</li>
</ul>
</li>
<li>SLA &#8211; agreement with provider to guarantee QoS mechanisms across their network based on your markings.
<ul>
<li>Assures availability, loss, throughput, delay, and jitter.</li>
</ul>
</li>
<li>End-to-end QoS
<ul>
<li>To be effective, each hop in the path must have QoS configured similarly.</li>
<li>Necessary in three locations
<ul>
<li>Campus &#8211; within the customer network</li>
<li>The edges &#8211; customer facing the provider, provider facing customer</li>
<li>On the provider network</li>
</ul>
</li>
</ul>
</li>
<li>QoS tasks
<ul>
<li>Campus access switches
<ul>
<li>Speed/duplex settings</li>
<li>Classification</li>
<li>Trust</li>
<li>Phone/access switch configs</li>
<li>Multiple queues on switch ports, including priority for VOIP</li>
</ul>
</li>
<li>Campus distribution
<ul>
<li>L3 policing and marking</li>
<li>Multiple queues on switch ports, including priority for VOIP</li>
<li>WRED</li>
</ul>
</li>
<li>WAN edge
<ul>
<li>SLA definitions</li>
<li>LLQ</li>
<li>LFI</li>
<li>WRED</li>
<li>Shaping</li>
</ul>
</li>
<li>Provider cloud
<ul>
<li>Capacity planning</li>
<li>PHB</li>
<li>LLQ</li>
<li>WRED</li>
</ul>
</li>
</ul>
</li>
<li>Enterprise campus QoS implementation
<ul>
<li>Implement multiple queues to avoid congestion</li>
<li>Assign VOIP and video to highest priority queue</li>
<li>Esablish trust boundaries</li>
<li>Use policing to rate-limit excess traffic</li>
<li>Use hardware QoS when possible</li>
</ul>
</li>
<li>Control Plane Policing (CoPP)
<ul>
<li>Applies QoS policy to traffic destined for the router
<ul>
<li>Routing protocols</li>
<li>Management protocols</li>
</ul>
</li>
<li>Can be used to avoid DOS attacks</li>
<li>Applied to <em>control-plane</em> in global config</li>
</ul>
</li>
</ul>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/03/ont-notes-pre-classify-and-end-to-end-qos/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>ONT Notes &#8211; Congestion Avoidance, Policing, Shaping, and Link Efficiency</title>
		<link>http://aconaway.com/2010/02/02/ont-notes-congestion-avoidance-policing-shaping-and-link-efficiency/</link>
		<comments>http://aconaway.com/2010/02/02/ont-notes-congestion-avoidance-policing-shaping-and-link-efficiency/#comments</comments>
		<pubDate>Wed, 03 Feb 2010 03:09:47 +0000</pubDate>
		<dc:creator>Aaron Conaway</dc:creator>
				<category><![CDATA[ccnp]]></category>
		<category><![CDATA[ont]]></category>
		<category><![CDATA[642-845]]></category>
		<category><![CDATA[bucket]]></category>
		<category><![CDATA[cbwfq]]></category>
		<category><![CDATA[cbwred]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[class]]></category>
		<category><![CDATA[compression]]></category>
		<category><![CDATA[fifo]]></category>
		<category><![CDATA[fragmentation]]></category>
		<category><![CDATA[interleaving]]></category>
		<category><![CDATA[policing]]></category>
		<category><![CDATA[policy]]></category>
		<category><![CDATA[qos]]></category>
		<category><![CDATA[queueing]]></category>
		<category><![CDATA[queuing]]></category>
		<category><![CDATA[red]]></category>
		<category><![CDATA[shaping]]></category>
		<category><![CDATA[tail drop]]></category>
		<category><![CDATA[test]]></category>
		<category><![CDATA[token]]></category>
		<category><![CDATA[voice]]></category>
		<category><![CDATA[voip]]></category>
		<category><![CDATA[wfq]]></category>
		<category><![CDATA[wred]]></category>

		<guid isPermaLink="false">http://aconaway.com/?p=477</guid>
		<description><![CDATA[Here's another set of notes from my ONT studies.]]></description>
			<content:encoded><![CDATA[<ul>
<li>Tail drop drawbacks
<ul>
<li>TCP synchronization &#8211; Dropping TCP packets from different flows can cause them all to window down and back up again at the same time in cycles.</li>
<li>TCP starvation &#8211; Non-TCP or aggressive flows can starve everyone else out when TCP throttles back.</li>
<li>No differentiated drop &#8211; Tail drop doesn&#8217;t care who you are, so you get dropped if the queue is full.</li>
</ul>
</li>
<li>RED &#8211; Random Early Detection
<ul>
<li>Avoids tail drop by randomly dropping packets from the queue before it gets full</li>
<li>Only dropped TCP flows slow down instead of everyone who has sent a packet since the queue filled</li>
<li>Queues are smaller.</li>
<li>Link utilization is more efficient</li>
<li>Configured with
<ul>
<li>Minimum threshold &#8211; start dropping when the queue is this size</li>
<li>Maximum threshold &#8211; if the queue is this big, start tail dropping</li>
<li>Mark probability denominator (MPD) &#8211; 1/MPD is the ratio of packets to drop when between the thresholds</li>
</ul>
</li>
</ul>
</li>
<li>WRED &#8211; Weighted RED
<ul>
<li>Based on IP precedence or DSCP values</li>
<li>Less-important packets are dropped more aggressively than important packets</li>
<li>Applied to an interface, VC or a class within a policy map</li>
</ul>
</li>
<li>CBWRED &#8211; Class based WRED
<ul>
<li>Configured with CBWFQ</li>
</ul>
</li>
<li>Policing
<ul>
<li>Limits subrate bandwidth (give you 100kbps on a T1)</li>
<li>Limits traffic of certain applications</li>
<li>Any traffic that exceeds police is dropped or re-classified; it&#8217;s a hard limit</li>
<li>Inbound or outbound</li>
</ul>
</li>
<li>Shaping
<ul>
<li>Sets a limit but buffers any in excess</li>
<li>Requires memory to store the buffer</li>
<li>Buffers = delay and/or jitter</li>
<li>Outbound only</li>
<li>Can respond to network signals like BECNs and FECNs</li>
</ul>
</li>
<li>Token and bucket
<ul>
<li>The queue is a bucket; if a byte of data needs to be sent, it needs a token.</li>
<li>If there are enough tokens, the traffic is considered conforming.</li>
<li>If there aren&#8217;t enough tokens, the traffic is considered exceeding, which triggers the drop (policing), re-classify (policing), or buffer (shaping).</li>
</ul>
</li>
<li>Frame relay traffic shaping (FRTS)
<ul>
<li>Only controls frame relay traffic</li>
<li>Applied on subif or DLCI</li>
<li>Support fragmentation and interleaving</li>
<li>Reacts to FECNs and BECNs</li>
</ul>
</li>
<li>Compression
<ul>
<li>Removed redundancy and patterns in data</li>
<li>Less data = less latency</li>
<li>Hardware compression or hardware-assisted compression does not involve the main CPU</li>
<li>Software compression does</li>
<li>Payload compression</li>
<li>Header compression</li>
</ul>
</li>
<li>Link fragmentation and interleaving
<ul>
<li>Small data might be waiting for larger data pieces to finish sending</li>
<li>Chunks data into smaller fragments so they don&#8217;t have to wait</li>
<li>Interleaving shuffles flows in the Tx queue</li>
</ul>
</li>
</ul>]]></content:encoded>
			<wfw:commentRss>http://aconaway.com/2010/02/02/ont-notes-congestion-avoidance-policing-shaping-and-link-efficiency/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
