Physical, Rent or Virtual? Building a CCNA networking lab.

When studying for any network certification, there are a couple of choices. You can either purchase all the physical equipment, rent some racks, or go virtual.

Is buying, renting or virtualizing the best option for the CCNA?

In this post we will weigh up some of the pros and cons of each approach.

Physical network equipment

Nothing will beat the real thing. It is going to be closer to the actual environment and there will be less issues compared to virtualization. There is also the geek pride associated with having a room chock-full of esoteric blinking lights from a rack full of routers and switches. The initial outlay can run to a few hundred moolah.

This said, this can be a costly method, and the routers and switches can become useless as the exams change, and you can end up with a garage full of 1U paper weights. The bits and bobs you pick up from eBay will probably not be suitable for SmartNet, and therefore you won't be able to update them (legally).

Pros: Less change of errors compared to virtual devices. Realism.
Cons: Cost, limited usability lifetime

Rent a network rack

Renting equipment can be suitable, but you can be bound to pre-designed topologies, so you lose the ability to design your own networks (unlike having your own physical equipment, or a virtual setup). Depending on the vendor, and the number of hours you need to buy (and remember this could be over a number of years), the cost again can run into the hundreds.

Pros: Less initial monetary outlay
Cons: Costs can easily mount up, less options for configuration

Run a virtual network

The last option we are going to discuss is running a virtual network. for this we need a base operating system and/or some virtualization software.

We could run VMWare ESXi server, which is a hypervisor, but this would then require a second machine to manage the virtual machines.

The second option is to run a normal desktop, and then run the virtualization software within it. The options are VMWare Player (free), VMWare Workstation, or VMWare Fusion. The CPU must support virtualization, here Intel is much preferred, especially where UNetLab is concerned (so look for VT-x support). VirtualBox is not a preferred hypervisor as it (currently) lacks nested virtualization support.

We also need a fairly decently specced machine. Ideally we need to give the network VM about 8GB of memory, meaning that the host machine will need about 16GB of memory. A VM with 8GB will allow you to run a fairly decent sized network (between 768Mb to 1024Mb for switches, and 512Mb for routers), so you could run a handful of switches and still have room for a number of routers.

This then allows us to build the networks we need, when we need, and can add images (device images) as and when we can find them, so the equipment does not become outdated (unlike purchasing physical equipment).

The biggest downside to this is the initial cost. Whilst the cost of a PC with 16GB or more can be quite high, once the costs of this are compared to purchasing physical equipment, or renting a rack, the cost is actually quite reasonable, especially when calculated over the lifetime of the study period, or average lifetime of the hardware (three years). This is one of those times when it's better to invest early, so the rewards can be reaped quicker.

Suitable PCs to use as a virtualization platform

As a general rule of thumb, look for an Intel-based processor, one which supports VT-x, this is required for virtualization. The more cores it has, the more you can give to the virtual machine, and the better it will run.

The more memory you can get, the better. 16Gb will allow enough for the host operating system (Windows or Mac OSX), and the virtual machine.

Zoostorm, whilst not the well-known brand, do a good range of affordable PCs, which are pretty decently-specced. Brand names, such as Dell are probably more advisable, but slightly more costly. It is worth shopping around. Whilst eBay is good, second-hand equipment may not last as long as you need it to, but there are some good bargains to be had.

where do a wide range of suitable Linkage.

Virtual networks, for a home lab, are definitely the way forward. It allows much more control and expandability, whilst keeping costs at a sensible level.

Pros: Complete control, can easily add new devices, won't become out-dated
Cons: Initial costs can be high

Essential networking tools: Wireshark

Nothing screams out good network engineer than some proficiency in Wireshark. In this post we will go through what Wireshark is, how it can help you, and some basics.

What is Wireshark?

Wireshark is a packet capture utility available for Windows and Mac OSX (along with ports for Linux). This allows you to capture the network traffic between two devices.

You can download Wireshark from https://www.wireshark.org/.

Getting started with Wireshark

I am using UNetLab here, which offers great Wireshark integration.

Check this link for Wireshark integration on OSX.

We have a simple topology, running RIP, OSPF and EIGRP. We will be capturing the traffic coming in and out of Client:

Wireshark basic lab

With this set up we should see some good traffic!

The configurations are below:
RIP1(config)#int gi 0/0
RIP1(config-if)#ip add 10.10.1.120 255.255.255.0
RIP1(config-if)#int lo0
RIP1(config-if)#ip add 120.120.120.120 255.255.255.255
RIP1(config-if)#
RIP1(config-if)#router rip
RIP1(config-router)#network 10.10.1.0
RIP1(config-router)#network 120.120.120.120 
RIP1(config-router)#

OSPF1(config)#int gi 0/0
OSPF1(config-if)#ip add 10.10.1.88 255.255.255.0
OSPF1(config-if)#no shut
OSPF1(config-if)#int lo0
OSPF1(config-if)#ip add 88.88.88.88 255.255.255.255 
OSPF1(config-if)#ip ospf network point-to-point 
OSPF1(config-if)#       
OSPF1(config-if)#router ospf 1
OSPF1(config-router)#network 10.10.1.88 0.0.0.0 area 0
OSPF1(config-router)#network 10.10.1.88 0.0.0.0 area 0
OSPF1(config-router)#

EIGRP1(config)#int gi 0/0
EIGRP1(config-if)#ip add 10.10.1.89 255.255.255.0
EIGRP1(config-if)#no shut
EIGRP1(config-if)#int lo0
EIGRP1(config-if)#ip add 89.89.89.89 255.255.255.255
EIGRP1(config-if)#
EIGRP1(config-if)#router eigrp 1
EIGRP1(config-router)#network 10.10.1.89 0.0.0.0
EIGRP1(config-router)#network 89.89.89.89 0.0.0.0
EIGRP1(config-router)#

Client(config)#int gi 0/0
Client(config-if)#ip add 10.10.1.10 255.255.255.0
Client(config-if)# 
Client(config-if)#int lo0
Client(config-if)#ip add 10.10.10.10 255.255.255.255
Client(config-if)#ip ospf network point-to-point 
Client(config-if)#
Client(config)#router rip
Client(config-router)#network 10.10.1.0
Client(config-router)#network 10.10.10.0 
Client(config-router)#no auto
Client(config-router)#
Client(config-router)#router ospf 1
Client(config-router)#network 10.10.1.10 0.0.0.0 area 0
Client(config-router)#network 10.10.10.10 0.0.0.0 area 0
Client(config-router)#
Client(config-router)#router eigrp 1
Client(config-router)#network 10.10.1.10 0.0.0.0
Client(config-router)#network 10.10.10.10 0.0.0.0
Client(config-router)#
Client(config-router)#
The interfaces are currently shutdown on RIP1, OSPF1, EIGRP1 and Client. So we will turn on Client's interface first, and can start capturing the data:
Client(config-router)#int gi 0/0 
Client(config-if)#no shut
Client(config-if)#
Once Wireshark starts showing siome packets, we can bring up the other interfaces:
RIP1(config)#int gi 0/0
RIP1(config-if)#no shut

OSPF1(config)#int gi 0/0
OSPF1(config-if)#no shut

EIGRP1(config)#int gi 0/0
EIGRP1(config-if)#no shut
After we have some traffic, we can stop Wireshark by clicking on the red square.
We should see something similar to this:

Wireshark basic lab

You can download this file from:

https://docs.google.com/uc?export=download&id=0BwJlq_qocwWbLS1CdXRiYklRZmc

We can see traffic for EIGRP, OSPF and RIP (amongst other traffic). But like this it is hard to really dig into anything in particular. So, we can filter our traffic.

Filtering in Wireshark

At the top of the Wireshark window is a box that says "Apply a display filter..." If we click in that, we can enter something to filter on.

Click in the box and type in rip. You should see the box go green, along with an option for "ripng". We are just interested in RIP for the moment, so just press return:

Wireshark basic lab

If we wanted to look at just the OSPF traffic, we can change the filter to "ospf":

Wireshark basic lab

Similarly for EIGRP:

Wireshark basic lab

If the box is green, the query is clean (to paraphrase Ghostbusters)!

What is in a packet?

Wireshark can tell us all about the packets that are sent between hosts.

If we select a packet (such as packet 12), we can see the Frame data, and this includes the encapsulated data:

Wireshark basic lab

We then have the Ethernet data - this is our MAC information, telling us the layer-2 destination and source addresses. We can tell that this is a broadcast packet as the address is ff:ff:ff:ff:ff:ff, and the hardware address it originated from (50:00:00:01:00:00). It also tells us that it is an IP packet (0x0800):

Wireshark basic lab

We then have the layer-3 information:

Wireshark basic lab

Here we can see that layer-3 IP addresses. The source is 10.10.1.120 (RIP1) and the destination is the broadcast address 255.255.255.255. We also have Quality of Service data, by way of the Differentiated Services Field data. We then have the underlying protocol used for the traffic, which is UDP.

The UDP data comes next:

Wireshark basic lab

Here we have the source and destination port (520).

Finally, we have the RIP data:

Wireshark basic lab

This is a great way of seeing what the traffic is actually made up of.

More useful Wireshark stuff:

We can limit down the data displayed to a particular host, and this includes the host as both the source and the destination, using a filter of "ip.addr == <ip address>":

Wireshark basic lab

The Internet is a pretty large place, so sometimes IP addresses are not much help to us and we need to use the DNS name instead. We can, Wireshark will do DNS lookups, we just have to enable it:

Wireshark basic lab

We can also track an entire conversation between two hosts, such as an HTTP call.

You can download the Wireshark file here.

In it's raw state, we can have more information than we need:

Wireshark basic lab

We cannot filter on HTTP traffic though, in this instance, but we can filter based on the port number (80). We can used the filter function (by clicking on "Expresson" next to the filter bar) to build our filter, which is useful if we do not know the syntax:

Wireshark basic lab

This has now filtered the RIP traffic out, leaving us with just the traffic on port 80:

Wireshark basic lab

We can use the captured data to rebuild, well, pretty much anything, from pictures to entire web pages. All we need to do is "follow the stream":

Wireshark basic lab

This brings up a new window with the reconstructed data:

Wireshark basic lab

This is exactly what we see from the RIP1 router:
RIP1#telnet 10.10.1.10 80
Trying 10.10.1.10, 80 ... Open
get
HTTP/1.1 400 Bad Request
Date: Thu, 04 Feb 2016 20:55:29 GMT
Server: cisco-IOS
Accept-Ranges: none

400 Bad Request
[Connection to 10.10.1.10 closed by foreign host]
RIP1#
As you can see, Wireshark is a great tool, and it does not take much time to learn the basics.

It is an essential tool in networking.
CCNA and Beyond - Beta testing/reading starts!

CCNA and Beyond - Beta testing/reading starts!

I was so close to pressing the "publish" button, then decided to hold off. I am taking a new(ish) approach to this book, and am making it available to a limited group of people for testing. This is not a request for more people, just an update, and an explanation as to why it won't be published just yet.

I am happy with the book as it stands at the moment, however, it makes sense to have a few people test it out before publication. I spent a long time over the last few days doing the little things to make it as perfect as I can. I have replaced a couple of tables with images (avoiding weird table flow across pages), lines are aligned to the top of the page better (because of an inherent issue with writing in Word, where paragraph breaks can mean that the first line of the next page is not at the top), correcting the flow, trying to make sure that output is not broken where one page ends and another begins), and generally trying to make it as polished as possible.

I am rather proud of it, and felt ready to publish it.

However...

The first three books I wrote (the trilogy of BGP, MPLS and VPNs) was written for me and for a different audience. But this book is different. I am not the primary audience, so fresh eyes are needed.
I posted a Reddit thread asking for volunteers, and had a great response.

So, the proof copies are ordered and on their way to me. These will then be shipped around the country, and these kind people can test the book.

This means though, that the release date will be later than originally intended. It should (hopefully) be released towards the end of February/beginning of March.