Cisco Live Wednesday Lessons Learned

My first session today was BRKARC-3472, NX-OS Routing Architecture and Best Practices presented by Arkady Shapiro, Technical Marketing Engineer (TME) for NX-OS and Nexus 7000. I thought Arkady was very entertaining and engaging as he delved into the depths of L3 on the N7K. Some of my key takeaways (may or may not be important in your line of work):

1. Routes can be leaked between VRFs by enabling "feature pbr" and setting up route-maps with "match ip" statements and linking them with "set vrf" commands. (ref: slide 50)
2. Routes can be leaked with VRF-lite without an MPLS license by redistributing IGP into BGP and using "route-target export" and "route-target import" commands under the BGP routing configuration of each VRF. (ref: slide 52)
3. Auto-cost reference bandwidth by default is 100Mbps in IOS but 40Gbps in NX-OS.
4. BGP best-practice is to use "aggregate-address a.b.0.0/16" under BGP routing configuration. Do NOT use "network a.b.0.0/16" under BGP routing configuration. Do NOT use "ip route a.b.0.0/16 Null0" under VRF. The reason is that if "network" statement matches a static route to null0, MPLS traffic to that route may be dropped. (ref: slide 92)

For lunch I had the opportunity to spend time with some of Solarwinds Head Geeks (@headgeeks) for two lunch-n-learn styled presentations. The first session, called "Don't Forget The Superglue," was introduced by Carlos Carvajal (Market Strategy) and presented mainly by Patrick Hubbard (The Head Geek). The reference to "superglue" alluded to the tools that Solarwinds offers to help in day-to-day running of the network and IT in general. Tools mentioned included:

1. Web Help Desk - automated ticketing, asset management, knowledge base, communication
2. Network Configuration Manager (NCM) - automatic config backup, realtime change alerts, compliance reporting
3. Firewall Security Manager (FSM) - Java-based, runs on workstation, automated security and compliance audits, firewall change impact modeling, rule/object cleanup and optimization, can download configs from firewalls directly or from NCM
4. Network Topology Mapper (NTM) - successor to LanSurveyor - network discovery, mapping, reporting, can export maps to Orion and open them in Orion Atlas

The second session covered some recent updates to Orion Network Performance Monitor (NPM) v10.5. Again introduced by Carlos Carvajal, this was presented by Michal Hrncirik, Product Manager for several of Solarwinds' applications. A couple key items that interested me:

1. Interface discovery can be filtered for import - for instance, you can tell it to only select trunk ports and not access ports on switches, then it will show you a list of all ports and the devices they belong to so you can manually uncheck ones you don't want to import.
2. Route monitoring - NPM will poll routes from the routing table. Although Michal said EIGRP isn't yet supported, I have actually seen EIGRP routes pulled from my IOS and NX-OS routers. The IOS routers showed them labeled as EIGRP (I think) and NX-OS showed them as "Cisco IGRP" in Orion. I'm pretty excited about the possible alerts we can set up with this type of monitoring.

Many thanks to Kellen Christensen (@ChrisTekIT) for taking the time to talk with me about his experience with Palo Alto firewalls.