7/7/2002 --

	Exam Support (640-606) Certification, Vendor CCNP, Cisco Status Live as of June 2002 Reviewer's Rating "Very similar to the previous version of the exam. Compared to Remote Access, it's a walk in the park" Test Information 58 questions (number may vary), need score of 776 on a scale of 300 to 1,000 to pass. Cost: $125 (U.S.) Who Should Take This Exam? Those pursuing Cisco's CCNP certification. (Note: Can be mixed with "506" versions of other CCNP exams to achieve the title. What Classes Prepare You? Cisco Internetwork Troubleshooting Test Objectives Click here

After taking the previous version of the Support exam 640-506 in February 2002, I was prepared for a new experience with the new edition of this exam. However, in the pool of questions I received, I found many at the same level of difficulty or simplicity as the previous Support exam with an equivalent number of one-liners (a couple of fill-in-the-blank) and old-style multiple-choice questions. I received 58 questions. The passing score was 776 and the grading scale was 300 to 1,000 points possible.

Having mastered everything I needed to know for the CCNA, I started my trek to CCNP in late 2001. I finished by early 2002 by passing exams in this order: Routing, Switching, Remote Access and Support. Those who have gone through the process recommend the same order. I can assure that once you have made it past the Remote Access exam, Support is a walk in the park.

The CCNP credential requires knowledge of many networking concepts and specifics as they relate to Cisco products and technologies. The Support exam covers many of these concepts from a troubleshooting perspective. In this article I address the high points of the new Support exam by mapping to the official objectives, which can be found here.

Connectionless Models
We have many techniques and tools available to troubleshoot today's advanced networks. The troubleshooting techniques of network support people -- although varied -- have one common goal: to restore the network to its normal state. Many troubleshooting tools are available within the operating systems of the network devices. IOS, the Internetwork Operating System, found in Cisco's routers and switches, is no exception. You can solve almost every problem you might come across, through the use of tools -- everything from Ping to TraceRoute -- and commands -- from Show to Debug.

For help on gathering diagnostic information when locating the problem of Connectionless protocols such as UDP, IP and CDP, you'll use:

show ip interface
debug UDP traffic

as well as various CDP display commands such as:

show cdp neighbor detail

and the Telnet utility.

For Connection-oriented protocols, TCP, SMTP and FTP, the same tools work in most cases; but you'll also need knowledge of higher-layer protocols and the applications that use them. For instance, File Transfer Protocol uses TCP port 21 for connections by default and includes the get and put commands, which allow the client's application to access files (get) and send (put) files to the FTP site. If you're troubleshooting FTP and can ping the FTP site by name from the client's PC but can't access the FTP site for login, you might suspect a problem with the FTP server. You could attempt to Telnet to port 21 from the router, log in and issue the get command to check for a response. If you're successful, you have now eliminated general problems with the network, such as router, FTP server, or other common physical layer areas. The problem now points to the client's application or the ever-demanding user error.

Troubleshooting
This topic defines 99 percent of the time spent by the network professional in a common network. Objectives for the exam include demonstrating, describing, defining and applying preferred methods, proven techniques, and use of troubleshooting tools in a typical campus network.

You should understand how to read common router output displays that could be present when you use the show ip, ipx or appletalk interface commands. Also know how to spot problems and recognize what's normal -- such as when an interface is up and up or up and down (but not administratively) or when viewing ISDN interface configurations with the up and up (with spoofing). When describing the methods and tools used for network troubleshooting, know when and why you would use ping with extended mode, what the output of the various fields indicates and where the network problem or problems may exist.

Tip: When using ping and the response is UUUUU, this indicates the destination is unreachable. A single dot (.) or multiple dots (.....) usually indicate the host isn't responding or the destination address doesn't exist. The expected output would be !!!!!. This means successful replies have been received.

When the output of the show interface command is up and up, this means the interface is administratively enabled and the physical layer is operating correctly. When the output is up and down, the interface is administratively enabled, but there's possible a physical problem with the interface such as a broken or missing cable. And when displaying the output of an ISDN interface such as:

show interface bri0:1

and the interface is up and up (spoofing), this is a valid output; the interface is functionally ready in most cases and ready for DDR (Dial on Demand Routing).

Cisco Connection Online (CCO) has been recognized as one the best Web sites on the Internet; but it can be difficult to navigate and locate the simplest of answers. Cisco would like you be familiar with CCO and the tools contained therein for network troubleshooting. One of the best places to start is the Cisco Technical Assistance Center site at http://www.Cisco.com/TAC. The Case Open tool allows you to open a case, whether it be for a priority 1, 2, 3 or 4. Levels 1 and 2 are lower priority and could involve questions about products or available upgrades. Levels 3 and 4 can be placed on open cases where configuration assistance is required to attain a functional network or the network is degraded or an outage exists that warrants a level 4, the highest priority.

Be prepared to demonstrate knowledge of common protocol connection sequences, such as the well-known TCP three-way handshake. A TCP source device sends a SYN (Synchronize) segment to a destination and waits for a SYNACK (Synchronize Acknowledge), and then the source sends its own ACK. When troubleshooting TCP, a common command is:

debug ip-tcp

The output displayed will allow you to find potential errors with the three-way handshake and other possible problems.

For Novell IPX, remember that Service Advertising Protocol (SAP) packets need to propagate by routers so that clients on other networks are notified of network servers and services and clients can send GNS (Get Nearest Server) packets to locate services.

Tip: Debug commands should only be used when the network traffic is relatively low or during off hours when network users aren't present.

Cisco recommends network professionals be familiar with the Problem-Solving model, which includes eight steps to troubleshoot a network effectively:

1. Define the problem.
2. Gather the facts.
3. Consider the possibilities.
4. Create an action plan.
5. Implement the action plan.
6. Observe the results.
7. Repeat the process.
8. Resolve the problem.

When using the steps in the model, consider them in order and always document the situation (part of step 8) to help you and others solve the same or similar problems in the future.

Troubleshooting Windows clients and servers requires special skills. For instance, network browsing using the Network Neighborhood icon on the desktop of Windows 95 and NT can produce incomplete results when a client or server configuration error exists. Many Windows clients use the Microsoft browsing service to locate network services; when configurations are correct, each client and server announces its network availability and resource type when starting. Windows clients do this by announcing to a Master Browser, a Windows computer configured on the network to listen and collect announcements. When browsing clients and servers haven't announced their services and there other clients are trying to locate these services, the browsing service is unable to provide complete results. Also, many Windows networks have a Windows Internet Name Service (WINS) server configured to listen for WINS registrations, which include NetBIOS services and IP address mappings. All clients and servers should be configured to register and use the WINS server by configuring their TCP/IP properties with the WINS server address.

The AppleTalk protocol remains strong in some networks, and Cisco requires that you be aware of the troubleshooting techniques and idiosyncrasies involved. AppleTalk is an entire suite of protocols that, among other things, can be used by Macintosh clients to locate services locally or remotely. One of these protocols on the router is the Zone Information Protocol (ZIP), which is used to maintain the network-number-to-zone-name mapping of the AppleTalk internetwork.

show appletalk route network number or interface name

displays the routing table entries on the router for either the specified network or routes configured to use a specific interface.

show apple zone zonename

can be useful when troubleshooting interface and routing errors.

Virtual Local Area Networks (VLANs) can pose interesting problems for a routed network and troubleshooting issues galore for the network professional. From the router the common show and debug commands can be helpful in locating configuration errors or VLAN problems. VLANs are created to isolate broadcast domains; trunking allows multiple VLANs to operate across the same network switch. Normally each port on the switch only belongs to one VLAN, but a trunk port can be configured to send and receive traffic for many VLANs.

Tip: Duplex mismatch and sometimes auto-negotiation can cause many mysterious problems between the client and the switch. Cisco recommends pre-configuring the trunk ports and server ports to a fixed negotiation. The set port speed mod_num/port_num command can be used to disable auto-negotiation.

show port mod_num/port_num

displays the VLAN to which a port belongs and can be used to isolate communication problems. The show VTP domain (Virtual Trunking Protocol) command displays the VTP domain and must match for all member switches; the name is case-sensitive. Many of the same commands and utilities I've already mentioned are also used when troubleshooting VLANs, such as ping, show and debug. For example, verify you can ping the remote switch from the local switch as a first step in troubleshooting. Then use the show commands to find common configuration errors such as show spantree on the Catalyst OS and debug spanning-tree in IOS to find problems related to the Spanning Tree Protocol problems in a switched network.

You must understand foundational things to troubleshoot an ISDN network. Since ISDN is a dial-on-demand technology, it presents many unique challenges. ISDN operates at layers one through three of the OSI reference model. Two of the most common troubleshooting commands are:

debug isdn events

and

debug isdn q931

Deciphering the output of these commands is crucial in dealing with ISDN because it has so many configurable variables. Using:

dialer map protocol next-hop-address [name hostname] [broadcast] [dial-string]

you can correctly configure the DDR requirements and then use:

show running-configuration

to verify. Another typical challenge you run into when troubleshooting ISDN is Point-to-Point (PPP) protocol configuration errors and authentication problems. In this case starting with the command debug ppp negotiation would be a wise choice. For most ppp negotiation problems, reenter the correct information using the username name password password commands.

Finally, there's the Frame-Relay exam objective. There are many frame-relay command options for show and debug -- certainly too many to list within this article. However, let me name some of the more common commands, which make for a good starting point for troubleshooting Cisco frame-relay networks.

The implementation and configuration of frame-relay is covered for the most part in Routing course and study guides. However there are a few things to keep in mind. The Data Link Connection Identifier (DLCI) is configured locally between each router interface and provider's switch. A Cisco 60-pin cable end is required to connect the router or Data Terminal Equipment (DTE) to the CSU/DSU.

show interfaces serial

indicates if the cable is connected correctly and if the interface has been administratively enabled by the up and up condition in the output.

show frame-relay lmi

gives you the configured Local Management Interface (LMI) value. Remember! It must be the same on all points along the network.

Tip: Don't forget about the two different frame-relay encapsulation types. They must match between devices. Also, the IETF form must be used when connecting Cisco routers to non-Cisco routers; but the Cisco encapsulation which is default, can be used between Cisco only devices.

Configuration errors such as assigning a DLCI to an incorrect sub-interface can be identified with:

show frame-relay pvc

and corrected with:

frame-relay map protocol protocol-address dlci [broadcast] [ietf | cisco]

The debug series of commands for frame-relay can be used with the show commands to locate stubborn problems such as:

debug frame-relay lmi

for configuration mismatch; but don't forget about:

show running-configuration

Tip: For this exam you should also be familiar with the CiscoWorks 2000 suite of products, which is a combination of enterprise router and switch management tools. CiscoWorks for Switched Internetworks(CWSI) provides for traffic management, ATM management, VLAN management and device configuration to CiscoWorks 2000.

In coming weeks, I'll be tackling the new Routing, Switching, and Remote Access exams. These are based on the official Cisco exam objectives located at http://www.cisco.com/warp/public/10/wwtraining/certprog/lan/programs/ccnp.html. All have changed to include simulations, much like that of the new CCNA exam, discussed in this review: http://tcpmag.com/column.asp?id=EXAM&cid=152.

Good luck!

Andy Barkl, CCNP, CCDP, CISSP, MCT, MCSE:Security, MCSA:Security, A+, CTT+, i-Net+, Network+, Security+, Server+, CNA, has over 19 years of experience in the IT field. He's the owner of MCT & Associates LLC, a technical training and consulting firm in Phoenix, Arizona. He spends much of his time in the classroom but has also been responsible for many Microsoft Windows 2000, Exchange 2000, and Cisco networking deployments for many clients across Arizona. He's also the online editor for MCPMag.com, TCPMag.com, CertCities.com, and a contributing author and editor for Sybex and Cisco Press. He hosts a multitude of exam preparation chats monthly on MCPmag.com, TCPmag.com and CertCities.com. You can reach him at .