Cisco MARS 6.0.6 Now Available

The following changes and enhancements exist in MARS, Release 6.0.6:

•SNMP v. 3.0 Support—Leveraging a secure communication protocol between MARS and Cisco security enforcement devices, customers can be assured that they are securely mitigating attacks and configuring and managing devices. SNMPv3 support enables the following features:

–Per-device SNMPv3 credentials are used for manual discovery and layer 2 mitigation.

–Support for SNMPv3 credentials for an entire network or range of IP addresses. The MARS autodiscovery feature clones the credentials for an autodiscovered device on that network.

–Monitor the health of supported devices via SNMPv3 via the resource utilization charts that you can add to the Summary > My Reports subtab.

See the Release notes for a matrix of SNMP3 support for different Cisco Devices.

Internet Explorer 8 Support—MARS supports Microsoft Internet Explorer 8 without requiring compatibility mode. Due to the nature of security revisions in Internet Explorer, you may find that you must authenticate more frequently to the MARS appliance.

•Improved Device Support—MARS now includes backward compatible support for ASA 8.0.5 and IOS 15.0(1)M. Backward compatible support means that any events that MARS parsed for ASA 8.0.4 or IOS 12.4 (11) T2 have been verified to parse in the corresponding newer release.

There have also been vendor signature updates for some Cisco and some non Cisco devices.

Find the best Cisco router for your needs

For those of us who have been working with Cisco routers for some time, some of the most well-known routers are missing from the current lineup. Cisco discontinued the 2600 and 3600 Series routers some time ago. For the remote branch office and SMB market, these routers were always the workhorse of the Cisco router lineup.

In my opinion, it wasn’t their capabilities that made them obsolete. They could do just about anything that the latest routers could do. For that reason, many shops are still using them.

What made these series of routers depreciate was the limitation of their CPU processing, Flash, and RAM storage. The Cisco IOS grew to be larger than what those routers could handle efficiently with the maximum amount of RAM.

In addition, the packet load of the typical network grew so much that Gig-Ethernet became common on networks. These routers just didn’t have the processing to handle that throughput with the CPU that they had.

Which router do I need?People often ask me which router they should use for a specific situation. To begin, I think Figure A does a decent job of illustrating Cisco’s available routers and the load they can take (as illustrated by the light blue column in the graphic).

Of course, there’s no hard and fast rule telling us which router to use for which situation. However, here are some general guidelines that I suggest using.

Home office or small branch office
Let’s say you have a home office worker who needs more than just a periodic VPN connection. The employee will be working a full 40-hour workweek over a site-to-site VPN, and you want him or her to have the most reliable and best performing connection possible.

Cisco 800 Series routers are ideal in this situation. They’re great performing routers for a single person or even a small office of up to 10 people. They have the full Cisco IOS, including the latest IOS 12.4 including features such as Firewall, IPS, VPN, VLAN, QoS, NAC, and even high availability features. There are different models for different applications, including ISDN, DSL, and routers with integrated wireless.

I use a Cisco 871W router at my house. In addition to it being a great router to connect to the Internet, it’s an excellent router for testing Cisco IOS commands. I also recommend the 800 Series routers to CCNA and CCNP candidates as the best option for studying IOS commands.

Remote office of 25 workers
For remote offices that have 25 or so workers, Cisco 1800 Series routers are an excellent choice. This router is perfect if all you need is a router to connect your office to the Internet, VPN, firewall, and wireless.

Remote office of 50 workers
If you’re looking for the same basic functionality of the 1800 Series but need a lot more performance and expandability, Cisco 2800 Series routers are what you need. With the 2800 series lineup, you can get everything that’s in the 1800 Series plus redundant power supply options, Gig-Ethernet ports, Network Module (NM) expansion slots, VoIP Call Manager Express (CME) with SRST, and much more performance.

Having the NM card slot lets you add things such as a 36-port switch with PoE, a DS3 ATM, a 24-port VoIP module, an intrusion detection module, a network analysis module, or a Cisco Unity Express voice mail module. In my opinion, the Network Module slot on the 2800 Series is where the Cisco router lineup really starts to get exciting.

Remote or HQ office of 100 workers
Cisco 3800 Series routers are similar to the 2800 Series in that there are a lot of HWIC and NM options for them. But what sets them apart from the 2800 Series is the sheer performance of the hardware and the number of HWIC and NM card that you can put into them.

Campus or large HQ office
For very large campus or service providers, the Catalyst 6500 and 7200/7300 Series platforms are for you. Cisco calls these “service aggregation platforms.” These are very high-performance networking platforms with a huge capacity for expansion.

A quick disclaimer: Always read the specifications for the router you’re considering, and consult with your local SE or experienced Cisco reseller to make sure you get the best router for the job.

Cisco 2800 ISR configuration for SIP voice with NAT and Firewall

I had the enjoyable opportunity over the last few weeks to jump in and do a basic Cisco voice install. It was about 110 phones, with the Cisco Unified Communications Manager Business Edition. This is a single box that includes Call Manager 6.1.3, and Unity Connection 2.1. It had to be done fast, and it had to be done right, so I stuck to mostly tried and true configurations.

Since this was a price sensitive design, we used the 2800 router to its maximum potential. The 2800 is an amazingly flexible piece of equipment; it can be configured to do large variety of things. Sometimes known as the Integrated Services Router, or ISR, it can be set up as a router, firewall, VPN, Voice Gateway, SIP session border controller, transoder, conference bridge, and survivable remote gateway, all at the same time, on the same box!

The call manager and unity connection install was straightforward, like punching out license plates. Set up media, device pools, partitions, calling search spaces, translation patterns, gateways, route filters, route patterns, etc. Scan then batch add the phones, set up voicemail and autoattendant call handlers, create expections, deal with the special people, and that’s it. Enough said about that.

The Cisco 2800 Integrated Services Router is used in this example to terminate a Multilink PPP bundle of four Internet T1’s, act as a firewall, provide media services to the Cisco call manager, act as an MGCP controlled analog gateway, and use Cisco Survivable Remote Site Telephony (SRST) to be the backup call processor to the main Cisco Call Manager.

SIP is ok with Network Address Translation as long as the firewall is capable of doing deep packet inspection and NAT’s all references to IP addresses. When I tried to NAT the inside interface of the firewall…it did not work so well. The remote SIP service provider was seeing private IP addresses in the SIP text, which does not make for good two way communications.

The Quality of Service setup on this example is fairly straightforward. Outbound is the standard Cisco MQS low-latency queuing setup, with a priority queue for voice and class based weighted fair queuing for the rest. Even though the service provider has said they prioritize inbound voice, I still set up inbound policing. Non-voice is limited to 4 Mbps, and anything greater than that will be dropped. Voice can use all of the bandwidth, so essentially there is 2 Mbps reserved for inbound voice. This is based on a calculation of 80 kbps for one G.711 call, so 2000 kbps gives us 25 concurrent voice calls, which should be plenty for 110 phones.

Object groups are used, which is new to IOS version 12.4.20T. As a side note, I recommend strongly against using 12.4.22T1 for NAT or SCCP media like MTP’s, since those feature are broken in that version.

version 12.4

no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname PriorityQueueRouter
!
boot-start-marker
warm-reboot
boot-end-marker
!
card type t1 0 0
card type t1 0 1
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 100000 warnings
no logging console
enable secret 5 0000000000000000000
!
aaa new-model
!
aaa authentication login default local
aaa authorization console
aaa authorization exec default local
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
network-clock-participate wic 0
network-clock-participate wic 1
network-clock-select 1 T1 0/0/0
network-clock-select 2 T1 0/0/1
network-clock-select 3 T1 0/1/0
network-clock-select 4 T1 0/1/1
!
dot11 syslog
no ip source-route
!
!
ip cef
!
!
no ip domain lookup
ip domain name MAINSITE.local

ip inspect max-incomplete high 5000
ip inspect max-incomplete low 4500
ip inspect one-minute high 5000
ip inspect one-minute low 4500
ip inspect tcp idle-time 300
ip inspect tcp finwait-time 10
ip inspect tcp max-incomplete host 1000 block-time 0
ip inspect tcp reassembly queue length 1024
ip inspect tcp reassembly timeout 60
ip inspect tcp reassembly memory limit 256000
ip inspect name EXT_FW ssh
ip inspect name EXT_FW https
ip inspect name EXT_FW ntp
ip inspect name EXT_FW tcp
ip inspect name EXT_FW dns
ip inspect name EXT_FW smtp
ip inspect name EXT_FW udp
ip inspect name EXT_FW icmp
ip inspect name EXT_FW ftp timeout 1200
ip inspect name EXT_FW http
ip inspect name EXT_FW sip
ip inspect name EXT_FW appleqtc
ip inspect name EXT_FW l2tp
ip inspect name EXT_FW pptp
no ipv6 cef
!
multilink bundle-name authenticated
!
!
trunk group FXOPORTS
hunt-scheme sequential both up
!
!
voice service voip
address-hiding
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
no supplementary-service sip moved-temporarily
no supplementary-service sip refer
redirect ip2ip
fax protocol pass-through g711ulaw
modem passthrough nse codec g711ulaw
sip
bind control source-interface Loopback0
bind media source-interface Loopback0
header-passing
registrar server expires max 3600 min 3600
no update-callerid
early-offer forced
!
!
voice class media 1
media flow-through
!
!
voice class codec 1
codec preference 1 g711ulaw
codec preference 2 g729r8
!
!
voice translation-rule 1
rule 1 /^\(2…\)/ /770555\1/
!
voice translation-rule 2
rule 1 /^9/ //
!
!
voice translation-profile OUTBOUND
translate calling 1
translate called 2
!
!
voice-card 0
no dspfarm
dsp services dspfarm
!
!
object-group network EXTERNAL_SIP_SERVERS
host 247.10.98.2
!
object-group network INSIDE_NETWORKS
10.108.0.0 255.255.0.0
!
object-group network INTERNAL_SIP_SERVERS
host 251.222.32.206
host 251.222.32.205

object-group network OUTSIDE_INTERFACE
host 250.1.26.7
!
object-group service PING_SERVICE
icmp echo-reply
icmp unreachable
icmp redirect
icmp echo
udp eq ntp
udp eq domain
!
object-group network PRIVATE_NAT_SERVERS
host 10.108.80.5
host 10.108.60.6
host 10.108.60.7
host 10.108.60.10
host 10.108.60.12
!
object-group network PUBLIC_NAT_SERVERS
host 251.222.32.205
host 251.222.32.195
host 251.222.32.197
host 251.222.32.199
host 251.222.32.201
!
object-group network SERVER_NETWORKS
10.108.60.0 255.255.255.0
10.108.80.0 255.255.255.0
!
object-group network SIP_NETWORKS
host 251.222.32.206
host 251.222.32.205
!
object-group service SIP_SERVICE
udp eq 5060
tcp eq 5060
!
!
controller T1 0/0/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
controller T1 0/1/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/1/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
ip tcp synwait-time 60
ip tcp path-mtu-discovery
ip ssh time-out 60
ip ssh version 2
!
class-map match-any VOICE_CLASS
match ip dscp ef
match access-group name VOICEPACKETS_ACL
class-map match-any CALLCONTROL_CLASS
match ip dscp af31
match ip dscp cs3
match ip dscp af21
class-map match-any CONTROL_CLASS
match access-group name NETWORKCONTROL_ACL
match ip dscp af11
class-map match-any FROM_ISP_CLASS
match access-group name FROM_ISP_ACL
!
!
policy-map DROP_NON_VOICE_POLICY
class FROM_ISP_CLASS
police rate 2000000
conform-action set-dscp-transmit ef
exceed-action set-dscp-transmit ef
violate-action set-dscp-transmit ef
class class-default
police rate 4000000
conform-action transmit
exceed-action drop
violate-action drop
policy-map VOICEFIRST_POLICY
class CALLCONTROL_CLASS
bandwidth percent 5
set dscp af21
class CONTROL_CLASS
bandwidth percent 5
set dscp af11
class VOICE_CLASS
priority percent 65 200000
set dscp ef
class class-default
fair-queue
random-detect
!
!
interface Loopback0
ip address 251.222.32.206 255.255.255.255
!
interface Multilink1
ip address 250.1.26.7 255.255.255.252
ip access-group OUTSIDE_IN in
ip verify unicast reverse-path
ip flow ingress
ip nat outside
ip inspect EXT_FW out
ip virtual-reassembly
snmp trap ip verify drop-rate
no cdp enable
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
service-policy input DROP_NON_VOICE_POLICY
service-policy output VOICEFIRST_POLICY

!
interface GigabitEthernet0/0
ip address 10.108.100.254 255.255.255.0
ip flow ingress
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/0/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
ip local pool VPNPOOL 192.168.50.200 192.168.50.250
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Multilink1
ip route 10.108.0.0 255.255.0.0 10.108.100.1
no ip http server
ip http authentication aaa
ip http secure-server
!
!
ip nat inside source route-map DYNAMIC_RMAP interface Multilink1 overload
ip nat inside source static 10.108.60.6 64.206.208.195 route-map STATIC_RMAP
ip nat inside source static 10.108.60.8 64.206.208.197 route-map STATIC_RMAP
ip nat inside source static 10.108.60.10 64.206.208.199 route-map STATIC_RMAP
ip nat inside source static 10.108.60.12 64.206.208.201 route-map STATIC_RMAP
ip nat inside source static 10.108.80.5 64.206.208.205 route-map STATIC_RMAP
!
ip access-list extended DYNAMIC_NAT_ACL
deny ip object-group PRIVATE_NAT_SERVERS any
permit ip 10.108.0.0 0.0.255.255 any
!
ip access-list extended FROM_ISP_ACL
permit ip object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
!
ip access-list extended OUTSIDE_IN
permit object-group PING_SERVICE any object-group OUTSIDE_INTERFACE
permit object-group PING_SERVICE any object-group INTERNAL_SIP_SERVERS
permit object-group PING_SERVICE any object-group PUBLIC_NAT_SERVERS
permit object-group SIP_SERVICE object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
permit object-group MGMT_SERVICE object-group MGMT_NETWORKS object-group OUTSIDE_INTERFACE
!
ip access-list extended STATIC_NAT_ACL
permit ip 10.108.0.0 0.0.255.255 any
!
!
route-map DYNAMIC_RMAP permit 1
match ip address DYNAMIC_NAT_ACL
!
route-map STATIC_RMAP permit 1
match ip address STATIC_NAT_ACL
!

control-plane
!
voice-port 2/0/0
!
voice-port 2/0/1
!
voice-port 2/0/2
!
voice-port 2/0/3
!
voice-port 2/0/4
!
voice-port 2/0/5
!
voice-port 2/0/6
!
voice-port 2/0/7
!
voice-port 2/0/8
trunk-group FXOPORTS 6
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/9
trunk-group FXOPORTS 5
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/10
connection plar 2700
!
voice-port 2/0/11
connection plar 2700
!
voice-port 2/0/12
connection plar 2700
!
voice-port 2/0/13
connection plar 2700
!
ccm-manager fallback-mgcp
ccm-manager mgcp
ccm-manager music-on-hold
ccm-manager config server 10.108.80.5
ccm-manager config
!
mgcp
mgcp call-agent ucserver 2427 service-type mgcp version 0.1
mgcp dtmf-relay voip codec all mode out-of-band
mgcp rtp unreachable timeout 1000 action notify
mgcp modem passthrough voip mode nse
mgcp package-capability rtp-package
mgcp package-capability sst-package
mgcp package-capability pre-package
no mgcp package-capability res-package
no mgcp package-capability fxr-package
no mgcp timer receive-rtcp
mgcp sdp simple
mgcp fax t38 inhibit
mgcp rtp payload-type g726r16 static
mgcp bind control source-interface GigabitEthernet0/0
mgcp bind media source-interface GigabitEthernet0/0
!
mgcp profile default
!
sccp local Loopback0
sccp ccm 10.108.80.5 identifier 1 priority 1 version 6.0
sccp
!
sccp ccm group 1
associate ccm 1 priority 1
associate profile 4 register MTP2851-729
associate profile 3 register MTP2851
associate profile 2 register CFB2851
associate profile 1 register XCD2851
!
dspfarm profile 1 transcode
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 2 conference
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 3 mtp
codec g711ulaw
maximum sessions software 50
associate application SCCP
!
dspfarm profile 4 mtp
codec g729r8
maximum sessions software 50
associate application SCCP
shutdown
!
!
dial-peer voice 999200 pots
service mgcpapp
port 2/0/0
!
dial-peer voice 999208 pots
service mgcpapp
port 2/0/8
!
dial-peer voice 1 pots
description Incoming called numbers from FXO or FXS or ccm
incoming called-number .
direct-inward-dial
!
dial-peer voice 59111 pots
trunkgroup FXOPORTS
description 911 service with a leading 9
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[49]11
!
dial-peer voice 59112 pots
trunkgroup FXOPORTS
description 911 service without a leading 9
preference 5
destination-pattern [49]11
!
dial-peer voice 5202 pots
trunkgroup FXOPORTS
description International calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9011T
!
dial-peer voice 19111 voip
description 911 service with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 6
destination-pattern 9[49]11
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
!
dial-peer voice 1200 voip
description local with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1201 voip
description long distance with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 91[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1202 voip
description international with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9011T
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 999209 pots
service mgcpapp
port 2/0/9
!
dial-peer voice 5200 pots
trunkgroup FXOPORTS
description Local calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[2-9]..[2-9]……
!
dial-peer voice 5201 pots
trunkgroup FXOPORTS
description Long distance calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 91[2-9]..[2-9]……
!
dial-peer voice 1100 voip
description ** Incoming call from SIP trunk **
translation-profile incoming INBOUND
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
session protocol sipv2
session transport udp
incoming called-number 770…….
dtmf-relay rtp-nte
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
!
sip-ua
nat symmetric role active
retry invite 3
retry response 3
retry bye 3
retry cancel 3
retry rel1xx 3
timers connect 100
timers connection aging 30
!
!
!
call-manager-fallback
secondary-dialtone 9
max-conferences 8 gain -6
transfer-system full-consult
limit-dn 7961 6
timeouts interdigit 5
ip source-address 10.108.100.254 port 2000
max-ephones 110
max-dn 200 dual-line
dialplan-pattern 1 770555 extension-length 4
transfer-pattern 9……….
keepalive 10
default-destination 2700
no huntstop
time-zone 13
!
banner login ^CC
*******************************************************************************
Unauthorized access and improper use are prohibited. Any activity on the system
is subject to monitoring by the company at any time. Anyone who uses the system
consents to such monitoring and agrees that the company may use the results of
such monitoring without limitation.
*******************************************************************************
^C
!
line con 0
exec-timeout 60 0
logging synchronous
line aux 0
line vty 0 4
exec-timeout 60 0
logging synchronous
line vty 5 15
exec-timeout 60 0
logging synchronous
!
scheduler allocate 20000 1000
ntp server 131.144.4.9
ntp server 198.72.72.10
end

Why we bought the Cisco 2800 Series

At my company, we still have a lot of Cisco 2600 and 3600 Series routers. While not all my sites needed the power of these routers, we needed to use a network module card, and these router models were the first in the Cisco product line that supported those network modules. Specifically, we use NM-16A & NM-32A asynchronous serial modules to support serial devices at each location. The Cisco 2600 Series routers don’t have the CPU and RAM to support the latest IOS and to handle the current network traffic load. (Note: The last date to receive service and support for a 2600 Series is April 28, 2008.)

In my case, the Cisco router 2800 Series is the ideal replacement for almost all our routers. We have been purchasing 2811 Series routers, installing a HWIC T1 card for MPLS WAN connectivity, and replacing existing routers at remote sites. We added a NM-16A or NM-32A modules to support the needs of our async devices. I have seen cases where putting in a 2800 Series immediately improved the performance for that remote location.

While I might be able to use a smaller router like an 1800, I need the NM slot from the 2800 Series, and I like the flexibility and power that the 2800 Series offers. Like the 2600 and 3600 Series routers, the 2800 Series has been extremely reliable; so far, not one 2800 Series has failed.

A downside to the Cisco 2800 Series is that it is loud. When I turned it on to configure it in my office, I couldn’t hear my coworkers or my phone.

ConclusionIf you are in the market for a new router (perhaps you’re looking to replace your aging 2600 and 3600 Series routers), I recommend taking a look at the Cisco 2800 Series. Based on my personal use, the Cisco 2800 Series is another rock solid router from Cisco that, like the 2600 and 3600 Series, will serve network admins for years to come.

The real case for the Cisco 2800 Series is that it offers a completely improved package: better performance, solid reliability, versatility of use, and a plethora of WAN interfaces and network modules that you can use to expand it. Also, since the 2600 Series will no longer be supported, the time to replace those routers with the 2800 is now.

8 ways to strengthen your Cisco networking skills

In the past couple of weeks, I’ve written a couple of articles about Cisco certification that generated a lot of response from TechRepublic members. The most recent article, “What you need to know about Cisco’s CCNA certification,” garnered a lot of excellent comments, many of which focused on gaining experience.

More than once, the old “chicken or the egg” conundrum came to mind as readers asked, “How do I get a Cisco job with no experience, and how do I get Cisco experience without a job?” TechRepublic member nacht probably said it best:

“What you have here is a chicken and egg problem: You can’t get the experience because you don’t have the certification, but the certification doesn’t help when you don’t have ‘enough’ experience.”

This really highlights the problem that so many aspiring network engineers have when they’re starting out. Member PhilTkgh said not to bother with earning a CCNA unless you have the experience. Member llapi2000 said the key point was finding a way to get experience because employers won’t hire you unless you have it.

So how do you get the Cisco experience you need to get your foot in the door? Here are eight ways you can start strengthening your Cisco experience.

#1: Work for free
Two years ago, a friend of mine had no Cisco networking knowledge; today, he earns a significant salary as a network engineer. What happened? He got his experience by volunteering to work on Cisco equipment for free.

In his case, he volunteered at his church. Someone donated a Cisco VoIP Call Manager and phones, along with a bunch of Cisco switches, to the church. While working at the church in another area, he spent his spare time reading and researching the new Cisco equipment, learned how it worked, hooked it up, and managed to earn his CCNA certification in the process. After a number of months maintaining the system, he found a full-time job as a network engineer.

In other words, one way to get Cisco experience is to offer to help for free. Let’s say you’re a Windows expert. Plenty organizations out there need your help, and many of them also have Cisco equipment. Besides doing good by helping a local organization, you can also gain valuable experience that you can list on your resume and use during a technical interview.

#2: Use simulators or rent a rack
Member Rand777 said that one way to get experience is to rent racks of Cisco equipment online. For more information, read my article on the subject, “Rent Cisco practice racks from online providers.”

A less expensive option is to use a Cisco IOS simulator, which imitates a rack of Cisco routers and switches. Here’s list of eight Cisco IOS simulators.

I’ve heard that the CCNA exam has a number of simulation questions these days, so either of these options is a good idea. However, it’s not enough to just pay the money; you have to push yourself to use the equipment to learn more about Cisco networking.

#3: Buy used routers and build a home lab
Member Bill Pate argued that the best way to get experience was to build a home lab. It doesn’t get much better than having your own rack of routers, which can be surprisingly inexpensive. Member wade.alexandro pointed out that you can often pick up 2500 series routers for about $25 each. Buy: used cisco, or Rental cisco equipment.

#4: Volunteer at work
Member j.s.davis recommended befriending fellow admins at work, and I couldn’t agree more. Perhaps your networking department could use some help shipping routers or taking inventory of hardware. No matter how small the department is, there may be some way you could help and get your foot in the door. An offer of free help can go a long way.

#5: Attend the Cisco Networking Academy
Member c.stockwell recommended attending the Cisco Network Academy. This is an excellent place to start gaining some experience working on real routers and switches. In addition, it’s a great opportunity to network with students, instructors, and potential employers.

#6: Make new friends
Find ways to make friends who use Cisco routers and switches. This is a great way to learn more, gain experience, and maybe find someone who will give you a chance even though you have limited experience. Use social networking on the Web, or join a local Cisco users’ group.

For example, in my area, we have the popular DFW Cisco Users Group. And there are Cisco user groups around the United States and the world.

What if there isn’t a user group in your area? You can start your own group with as few as 10 people and begin receiving benefits from Cisco Press.

#7: Participate in forums
There’s a plethora of Cisco-specific forums on the Internet where you can learn more about Cisco networking. In addition, you can share your knowledge by helping others with Cisco questions. While that doesn’t automatically give you experience, it does get your name out there and help you network with others. Maybe you’ll even meet a future employer by volunteering to help with a networking issue.

Here are some forums I recommend:

TechRepublic Forums
Petri IT Knowledgebase Forums
HappyRouter Forums

#8: Start at the bottom
Member michael.brodock said that one of the best ways to get experience is to start from the bottom. If you really want to break into a new field and get experience, sometimes you’re going to have to suck it up and start from scratch. This often means taking a pay cut and starting over at the bottom of the ladder.

But look on the bright side: The bottom is also where the most openings are, and where you have more opportunity to get into the field.

SummaryTrying to find a Cisco networking position without any experience is very difficult — even if you have a CCNA certification. However, there are many things you can do to network, promote yourself, and gain Cisco networking experience. Don’t get caught in the “chicken or the egg” conundrum.

David Davis has worked in the IT industry for more than 12 years and holds several certifications, including CCIE, MCSE+I, CISSP, CCNA, CCDA, and CCNP. He currently manages a group of systems/network administrators for a privately owned retail company and performs networking/systems consulting on a part-time basis.