The thing that prompted me to post is that I completed another book and had to add it to the list. I came home from work today and I read this book in one evening. The book is: "Your CCIE Lab Success Strategy - The Non-Technical Guide Book" by Dean Bahizad and Vivek Tiwari. Both are double CCIEs.

I had mixed feelings about the book. I expected a larger book. Perhaps something like the size of an O'Reilly topic was what I had envisioned. But it's more the size of a small guide book - or a Kindle. I opened it up and saw that the entire book was double spaced. Gasp! But as I read through the book, I found it to be a really good read.

There really isn't anything "new" in the book. Just about all the information or hints are things that are covered in the INE videos. There are no shortcuts. You have to be dedicated and persevere. Yadda yadda...yeah, I know. And that's okay. It's always good to hear it - and to hear it again.

The good part of the book is that it is ENCOURAGING. Even though it's stuff you've heard before, read it. As I was reading, I considered passing it on when I finished. At the end of the book, I decided to keep it - until I get my second CCIE. And that's what the real value of the book turned out to be (for me). I am going to read the book again whenever I get discouraged. I'm going to read it when I start getting sluggish. It's a really good pep talk when you need it.

The biggest recommendation in the book is the hardest to implement. It recommends a study partner. Finding the right study partner is really difficult in some locations. And finding a bad study partner is worse. So I'm going to take that recommendation with a grain of salt. I wish I didn't have to skip that part - a study partner would be helpful.

The part that I found encouraging is the undertone that it is -normal- to want, work toward, and attain TWO CCIE certifications. And it was uplifting to hear that the second one is easier than the first. You already have a strong foundation (your first CCIE), you already have a study method, and you have already proven to yourself and others that you have the drive and persistence needed to complete such a daunting task. All that's left is the doing.

I also got another book this week that I'm poking my way through -> Guide to TCP/IP Fourth Edition by Jefferey Carrell, Laura Chappell, Ed Tittel with James Pyles. OMG I am so excited about this one! Jefferey Carrell was the instructor at a Riverbed workshop I recently attended. It was a great workshop on Pilot and Wireshark. This is the TCP/IP book that I have always wanted. It doesn't just go through some dry rehash of protocols. This one is more of a hands-on guidebook - complete with trace files. Yes. This is the book I have always wanted. It goes through the protocol and tells you how it works. Then you download and explore the trace files to SEE how it works (or doesn't). I'm rationalizing my reading of the book in two ways: first, a good book on TCP/IP is recommended reading for the CCIE R/S path; second, it is oh-so-very directly job-related.

However, I do realize after reading the first book, I can't allow myself to be distracted from my CCIE lab studies. So I'm using this book as my "carrot" to encourage me to study. But this is definitely the book (read: reward) that I get to read after I watch my scheduled videos or finish a scheduled lab. Awesome stuff.

The pictures on that post show three full pages of flip chart filled with a list of every task that I'm going through in the Workbook. There are 5 columns of about 30 lines each - for each page. And that is just Workbook I. Then I list all the videos (number and hours to complete) and then the number of configuration and troubleshooting labs that are found in the other three workbooks. It's pretty overwhelming when you look at it all.

This is something that you can't just do "in your spare time" as a hobby. You really have to focus and practice, practice, practice. I found that those pages of flip chart have provided a lot of relief. I can see my progress and it really keeps me going. I'm also using it to plot my rack sessions and make better use of the time. But it still takes a long time to complete it all.

This is a test of stamina as much as a test of skill.

That's what rack time does.

I probably approached it the way most people do - it's expensive and I wanted to save most of it for actually practicing lab scenarios. In some wishful, magical way I would learn enough on my own to just schedule some labs and work through them. After all, I've been in this field for a long time and I do this stuff every day. I understand the material. Well, I tried that and it was a struggle. And in some ways, the rack time that I used was not as efficient as I had hoped. It also lessened my confidence rather than built it.

So I went back to basics. I returned to Workbook I and started from the beginning - to prepare for my 2nd shot at the CCIE R/S lab. At first it seemed silly. I felt like I was giving myself a pity party or being too soft on myself. But in a very short time, I found that not to be true. It was a very good decision.

The first thing that happened is that the first few exercises were easy. It was nice to start off and be able to knock it out of the park. The easy stuff. That part did not build confidence. However, it did get me to appreciate the things I did know inside out. Then I hit a section that I wasn't strong enough on to complete. Ha. It was something that I know about, but don't use in my everyday experience. Wow. Hey, there's a lot of stuff here that you don't use in every workplace every day.

So when I hit that snag, I broke off a piece of it and worked it. I practiced figuring it out and then I blogged about it at my other blog. Having to write about it helped me to iron out the wrinkles in my understanding. I had to understand it enough to clearly speak on the topic. And with this being public, well, you're going to really make sure you're getting it exactly right. Which brought me to the documentation a few times to check my post. I learned enough through this to be sure of what I was posting. Then I went back to the rack and re-worked those sections again. Now I'm more sure of being able to configure it without needing to rely on notes or documentation. I totally understand it now. THAT is what built the confidence.

Granted, I'm not yet scheduling time at RTP for that 2nd shot. But after having that experience (my first attempt), I now know where I need to be to realistically have a chance at passing. And I can see my knowledge, skills and experience build with each rack session. And I have a "method" of study.

One other thing that I found helpful when practicing - don't struggle. If you're working a section and you're feeling like it's a stretch, then drive forward. But if it feels like a struggle, move on to another section. This will help conserve rack tokens. Struggles take lots of time. Learn on non-rack time. Then go back to the rack to practice what you just learned.

For example, the other day I was able to configure the 'basic' parts of RIP. Then some of the more advanced tasks were in the later sections. I started to get frustrated. Frustration is not what you want to practice. So I made a note on the sections that gave me trouble and moved on to EIGRP. I loaded the next config template and in 12 min was back on track. I started to configure again and made much better use of that rack time. After my session was over, THEN I went over the advanced scenarios and reviewed the documentation.

And once I practice it again and blog about it, the other benefit is: I can put that to bed. That's what came out of my first attempt - the ability to know when I know something well enough to move on to the next topic.

Time Management. It's a soft skill - and although it's not explicitly tested on the Lab Exam, it's a part of it. Practice it before the test and it will become a part of you. These are all skills that you need to take with you to the test.

It grabbed me with the first one:

Tip #1: Security must enable business, not prevent it

and then really hooked me with:

Tip #4: Teach the basics again and again
"you can be far more effective just educating personnel about simple secure practices, over and over again"

Tip #11: In a business vs. security battle, business is always right
Which shows a guy holding a chalkboard that says "There is no security risk. It's all business risk."

Good article. The first point - omg, isn't that an old concept? Remember this book? You may not like or agree with Gates, but read this and realize this was first published in 2000. He was telling businesses that you need to leverage your geeks to give yourself the advantage. And he was also telling geeks that they need to provide business value - not just geek giggle. I remember that time in computing. I had gotten my MCSE in 1998 and CCNA in 1999. The 'big thing' was what you could do - not what you should do. Projects were created just to prove you could do something, not because they had any business value. Heck, we'll figure that part out later - let's see if we can make it work first. And then a few years later, the tech bubble burst and everything changed. One of the reasons I went for the CISSP is the focus it has on business rather than pure technology. Granted, I have the technology background - it's not enough (for me). Fellow Geekateers - wake up! The businesses are where the MONEY happens to be... remember? We work FOR the business, they are not the enemy. They are not the people who are making our jobs difficult; we are making their jobs difficult. You have to make the secure way the EASY way of doing things, or else you will get someone somewhere going around the system. Or if you are that immovable block "protecting" the network - yeah, you can be removed. (Psst - the business will see to that.) And in security, all you need is one weak link to break the chain. Just one person (especially an insider) with a reason and perhaps business permission to circumvent the controls and you have just opened the door to someone following behind them.

So now about #4 - that's a favorite of mine too. You have to teach the basics - and not just nag. You have to get out there and talk to people and train them to think securely. You will not be with them all the time. You will not be able to train them on everything. They will not remember everything. So keep it simple and teach the principle of the matter. Teach them - if YOU can access it, then a malicious user can access it - with your credentials. That way people can retain the idea and apply it to new situations - like when you go from one type of credential to another...["well, I know you shouldn't share your password, but I just let him have my ID card for just a few min to go to the bathroom..." ]

And again...#11... that business thing. The guy with the sign is right. It is ALL business risk. From security to maintenance - it's a business decision.

However - the place where I see both security and business falling down is the reluctance to identify data with different levels of business importance. Business doesn't want to pay for security to take the time (or their time) to properly identify business value. And security wants to secure everything. It's a WASTE OF MONEY to lock up a head of lettuce. I've seen time and again (at a number of companies) where they have a blanket level of security over everything. Sometimes it has been so severe, that many people can't properly do their jobs. Or they waste vast amounts of time employing (or going around) the security measures to complete a simple authorized routine task. At the same time, business-sensitive data is treated the same as all the other data on your network (in the belief that it's all locked down). Is it really secure? If everything has the same level of security and you just got around that security to do some routine task... what about the sensitive data?

There's one tip that they left off - or perhaps may be #21:
Bad security is worse than no security.

If you think you're secure and you have bad security, you won't bother to "fix" something you don't see as broken.

First the cert -> it was EASY... for me. The first time I met a CISSP, I asked him how the test was and he said it was easy. I didn't believe him. Now I do - and now I KNOW WHY... What he didn't explain is that by the time you get the experience (5 years in two or more domains), you have been through most of the material in some way, shape or form. Much of what I saw and read was review from many places - ITIL training, DITSCAP training, Security+ study, MCSE:Security study, CCNA Security study, etc ... I've used many of the biometric devices, I've written the Disaster Recovery documents and performed recovery exercises, I've done the vulnerability remediation, and so on...

For the study materials I used for the recent prep:
These two books -

And these two people:

In case you're interested - the entire CISSP Video Course by Shon Harris is on Safari Books Online (Library Subscription). The content was excellent - the delivery, not so much. The videos are chopped up into tiny bites. A bit too tiny to be honest. But a motivated person can make it through and get some good training.

None of these resources alone are adequate for preparation. You must combine multiple resources and build a knowledge base in your head. They say that the CISSP is an inch deep and a mile wide. Not sure if that's accurate, but there is a LARGE amount of material that you need to be very familiar with in order to pass the exam. And you really can't get it all in any one place. The official book - officially awesome. It has a lot more depth than the other resources and is a really good read. For the crypto stuff... I highly recommend Cryptography Decrypted by H. X. Mel and Doris M. Baker.

Secondly, the stats -- yes, they have been updated. I debated continuation of the book list and stats for some time. Now that my focus has been more toward the area of security, I started thinking again along the lines of "why am I putting this info out there" and had considered stopping. However, I later convinced myself that stopping would never really amount to anything more than "security through obscurity" and decided to continue. At this point, I have read over 40,000 pages of textbook material. Of course, I don't have every book on that list memorized, but I have incorporated the basic ideas and various tidbits of information into my memory. I have also started on a number of other books that are not listed because I didn't complete them.

Any would-be adversary would not be able to know or deduce the extent of my abilities (or any knowledge gap) simply from the list. No, it is not like putting your network diagrams on the Internet. And I refuse to let -fear- drive the content of my blog. Anyone who would attack a network that I would be defending (be it current or future) would need to breach the technology - properly implemented, not breach any personal intimate area like some diary by my nightstand. And, as we all know, once you give into fear, you are already defeated.

One of the other reasons I chose to continue the stats is because someone might really need to know this - which is the reason I started keeping track. People need to know that it really takes a lot of work to stay current and be able to fix whatever breaks. Users need to know that if you (as a user) need to learn a little bit to use the new operating system, your IT people have to learn 10X more to provide it to you. And others need to see that to get from here to there is not "luck" or some "trick of the trade" or something you can do overnight. It takes a lot of hard work - maintained over a long period of time. There are no short cuts.

It's probably a given that any bank or credit card would have a crackerjack team of security professionals who would be scanning the network. And they probably hire crackerjack network and server people who are keeping patches up-to-date ... or you would hope this to be true. So wouldn't it be nice if they could get timely information about any anomalies in the system?

This morning I got an "international transaction alert" from one of my cards. The alert was on a recurring transaction that I have been using for years. I click the secure chat button and talk to a agent. He checks and sees that it is a charge in US currency. "Oh, just must be some sort of mistake. Anything else I can help you with?"

He meant well and was good at what he normally does - helping people with their accounts. This was a little outside his realm. He made a note on my account for me. Great - but that doesn't alert the correct people and doesn't mean that this won't happen again. He said he will let his supervisor know. His supervisor probably doesn't know any more about attacks than he does. Really.

Now, at this point, I'm thinking Salami attack. Sure, the "major" portion of the charge - $X.99 - was in US currency and the "minor" part of the charge - perhaps $X.993947203 was in (or converted to) some type of foreign currency. This would trigger an international transaction alert, wouldn't it? Can anyone check that? No.

So after talking to the chat specialist, I am given a number to call. I dial it and it's the "main" number for the card. I listen to the options and press the button for the fraud department. The person I spoke to there _also_ didn't know what I was talking about and had to send me to her supervisor. The supervisor _again_ didn't know what I was talking about. WTF? And this is not some fly-by-night dinky credit card. This is a major player in that space. All the supervisor could tell me is that there is no country of origin on the transaction. Again, this is a transaction that has been charged to my account on a monthly basis for years that never before triggered an international transaction alert. Something is obviously wrong here. What changed?

In the end, my only option to report this correctly was to WRITE with pen and paper to a PO Box. Oh, I had another option to FAX my letter if I wanted, but I opted out of that one. Really? Is this the process that we want to use to get our information? I know they have a Security Operations Center. It's probably staffed 24x7. But they only know their systems are up and running - not what's happening within the running system. And when I write this letter to "the company" how is it ever going to get to the correct department? It won't. They gave me the address for General Correspondence. A receptionist is going to read and route my letter. Save the stamp. She won't know any more about this than the chat specialist.

Isn't this what a salami attack relies upon? Who is going to notice? And out of that small number, how many will report? And out of that smaller number, how many will be able to report it to someone who can understand it or do anything about it? Meanwhile, unknown amounts are siphoned off and the consumer is left to foot the bill as the company folds it into the cost of doing business. Shrinkage.

But I am not done yet. I will pursue this. And who knows where it will lead? I remember a time when I called my ISP to complain about a disjointed news feed. I ended up with a job there - and that was the start of my IT career. Maybe this is the start of something I can't even imagine or understand at this point. Or perhaps it's just another ignored warning from Cassandra.

Over 10 years ago (when I was a military contractor), I stumbled across an old VHS tape in a box of miscellaneous items in the Security Officer's office. The tape happened to be a briefing for DoD (Department of Defense) personnel on Counter Espionage. It looked interesting and I took it home to watch. I was hooked - this guy (Ray Semko) is an AWESOME speaker. The things he pointed out made you think. And the way he presented it made you remember it and revisit those things in your mind over and over.

At the time, it was pertinent - I worked on a military base and OpSec briefings were regular and required. But there was more in that presentation. He really drove home the idea that this was not just tied to the military and classified documents. This related to industry just as well as it did to the military. If we're bankrupt because our companies are spending $$$ on R&D and all that research is being stolen and given to foreign companies... Not really a profit-making scenario, is it? And bankrupt businesses lower our security posture. Can you say financial collapse? Isn't that why we gave bailouts a few years ago - to prevent that?

One of the examples was a short clip of an interview with France's President Mitterrand who explained, "In war, France and the U.S. are allies. However, in business, we are competitors." That stuck with me. So did the idea of all those companies that spend $$$ on research - only to have it stolen and used by competitors. Another memorable idea is when he tells you right out - if someone starts being sweet on you and they're absolutely gorgeous...and you think you've gotten "lucky"...no, you haven't. Because it's NOT YOU that's interesting - it's the information that you know that's so interesting.

So - from time to time - I think about the DICE Briefing that was so memorable. And a few years ago, I looked him up on the Internet. Of course, being a military-oriented topic, you couldn't just click a button and get yourself a DVD of his presentation. Really? If I remember correctly, and it was quite some time ago, you had to order it through your official DoD channels or something like that. Since I was currently employed in the civilian workspace, I was out of luck.

But the ideas he presented stuck with me. And for whatever reason, the other day I looked him up again. His web site has grown! I noticed that he also has a LinkedIn account. So I tried to connect. And, I was honest - I did not know Ray Semko. Hmmm - so I got a page that told me to not bother people I don't know. Okay - why do they bother having that button? Apparently you have to find some connection. And, of course, we belong to a common group - which allowed me to finally send a request to connect. He accepted and now I am connected to him on LinkedIn. OMG. Who woulda thunk?

In addition to that, there are a number of video clips on D*I*C*E TV that are really good. And D*I*C*E now stands for Defensive Information to Counter Everything - because it's really more than just counter espionage, it's counter everything (because everything matters). There are also DICE Radio downloadable podcasts available on his site. The best of all is that there IS an open 2-day course for Security Professionals. I highly recommend it.

Take this scenario: You have quite a few remote offices. You need to implement some security features so that only authorized users using company equipment connect to your network. The users at these offices have phones that connect to the network and a laptop which uses a docking station. Great - you configure port security - 2 mac addresses and 5 min inactivity timeout. This becomes standard throughout your world and all is well. Or is it?

Eventually complaints start to trickle into your ticket queue. And they come in as complaints of lost connectivity. But you can prove that your connections didn't go down. What gives? Then you look at the port security stats and find thousands of violations. Why? Well, to start - what are your assumptions? When this system/solution was devised, there were a number of 'givens' that either weren't true or are no longer true.

1) The user will come to work and dock the laptop.
2) The laptop will always be docked when in use.
3) If the laptop is not immediately available for use upon docking, the user will wait until it is available.
4) The dock will only be used by the person to whom it has been assigned.
5) Ease of administration is more important than security.

Let's look at what exists today:

+ Remote workers are likely to have Internet access at home. Connecting from a remote office (especially a smaller one) can have the look and feel of their residential connection. Why shouldn't it be as fast and responsive? Just put the right plugs in the right ports and you're ready to work. Since users now have their home network as a comparison, they are less likely to be patient while your security and audit software (and network hardware) performs their functions.

+ If something doesn't work right away, either something's down or you don't have it plugged in properly. Try another port or maybe something like what you have at home. It's worth a shot - it's already broken. Usually you do this at home and eventually you get it to work. And if it doesn't - at the end you can call the Help Desk, but most times you can get it to work with a little effort.

+ You NEED your laptop in meetings. It's silly to write things on paper and then type them up when you get back to your desk. You can project your screen on the wall and type up the notes while you meet so you can get consensus and agreement. When you get back to your desk, you'll email it to everyone at the meeting.

Isn't this how you operate? Why wouldn't the remote user operate the same way? So when they come back from their meeting and dock their laptop ... click, click. Oh, crap, it's not working. Since the part that isn't immediately working is associated with networking, they unplug the cable and try the port on the side of the laptop. [Mac address number 3 = port violation.] Well, maybe if I undock it with the side port? No, still not working. Let me try putting it back. Click, click. Still not working. Dammit, I need to print out those notes! And yes, the authorized mac address on the dock might not 'work' immediately. Remember - 'works' from a user perspective is different from 'works' from a device/administrator perspective. And if the user was too impatient for it to 'work' the first time, by the time they try a few other things, they are even less likely to be patient enough to wait for it to operate properly.

So now you're preventing an authorized user from using the network. This is a business user. They are never the issue - we work for them, they don't exist to serve us. And you want your fellow workers to use the beautiful network that you have created for them. You just don't want the "outsider-bogeyman" to use your network. And you don't want everyone's personal device (that has no antivirus or other security and may harbor malware) to connect to this clean and healthy network and destroy all your hard work.

And also look at the flip side - because the inconvenience will all be worthwhile if you keep the network safe. But have you kept the network safe? Are your unused ports disabled? No, someone might want to use them and would have to wait while you configure it for them. Or perhaps you feel comfortable about those ports since there's an air gap between the port in the data closet and the user-accessible area?

So where is the first place someone would go to use your network? Pen testers (and potentially malicious users) head straight for the janitor's closet and connect to any available port. Since you allow 2 mac addresses for every port, they are allowed on the network. Okay - so your company is so smart, they have all the network equipment in their own area which requires badge access. You still have ports connected to that switch in some manner for your authorized users. They go to the unused desk and connect. Again, they are let in. Or they disconnect the docking station and wait 5 minutes - again, they are let in. [Pen testers and malicious users are often more patient than the 'authorized' user.] Oh, and it gets better. Take the same kind of laptop and plop it on the docking station - and you are not only let in, but you are using the authorized mac of the authorized user.

Wow. All the hassle and none of the benefit. Don't get me wrong, I don't advocate removing security. I simply say that if you're going to do something, do it in a way that it produces the effect you intend. The only way to completely fix this kind of problem is to go back to the design stage and make a better mousetrap.

If you really have your heart set on port security, use statics (without docking stations). Granted, this doesn't scale well. But when it gets to the point where you need to hire someone full-time to deal with move-add-change issues, it's likely that you're large enough to use a better solution.

Another way to attack this issue would be to give the users what they expect - a residential-type connection. For very small offices, this might work. The user is probably already familiar with using their own Internet connection and VPN method to connect to the main office. This scales well if you already have this type of solution in place for those working from home. They could even connect wirelessly (just like at home) and email their meeting notes at the end of the meeting. The response time would be similar to their home connectivity - and you have centralized your remote office traffic and terminated it at a security device.

If you have larger remote offices and must use commercial network gear, you can create an "RBO DMZ" and use whatever firewall, IDS and other security measures you would normally use for any other DMZ to secure the traffic and implement security. Make this first assumption : any connection from these locations might be legit or might be malicious and the main focus of your security devices are to determine which connections are the ones you want to access your network.

Of course, we always want to look at defense in depth which is also a part of this scenario. Yeah. That antivirus stuff. Of course we want to have our desktops protected with the latest signatures. Of course we need to manage our remote resources, just like we do at corporate. But we also need to realize the impact of these configuration choices on the end device's network connectivity. If the laptop does more work for the audit team than it does for the user, it's worthless. The user is going to see it as "not working" and will find ways around your security measures (like moving the cable to another port). Or worse. Enough complaints from enough executive users and you will become the problem.

Teams that formerly worked in isolated silos need to collaborate and get feedback on what works so that the user has a better experience. When security is easy to use, people will use it. You want people to use it. You don't want users playing frisbee with their laptops out of frustration. But in order to do that, we sometimes need to challenge our assumptions. And if those original conditions no longer exist, we need to rethink our plans and retool our devices. Remember - there was a time when the Ceasar cipher was effective.

So how do you keep motivated to get to the end? For me, it's like the "defense in depth" concept - I do it in layers. That way when one layer is breached by procrastination, there are several others to take up the slack.

Layer One : General Motivation Videos

This really needs to be something that you come to on your own. It really needs to resonate with your individual personality and fit your lifestyle. The site that I found that gives me general motivation is BraveHeart Women TV. I like this site and many of its videos for a number of reasons. The videos on the site are relatively short (about 10 min each) and cover a wide variety of topics. They are female-oriented, but not exclusively female. And they focus on collaboration rather than competition - which is more my style.

Another site that has motivational videos is Makers - which is a collection of short (sound bite style) videos from numerous women pioneers. This collection was created by PBS and features women in multiple industries who have broken ground in various ways. Some are famous and others you may not have heard about - but all are awesome.

The third place I go for motivational videos is Safari Books. You need to get a Library subscription (versus a bookshelf) in order to access the videos, but I find it worthwhile. Under Personal and Professional Development, you will find a number of videos from The Success Training Network. They are really interesting and varied in their approaches.

Layer Two : Industry Specific Videos

At this point, I only have one place - INE - that I use for videos that are specific to the task at hand. The videos are great and very encouraging. The motivation of the instructors is contagious and you're learning the material at the same time.

Another place that is available, but not so easy to use is the Cisco site. Search on TechWise TV and you will find a number of TechWise TV videos to show you the latest industry concepts in short (around 5 min) videos. Jimmy Ray Purser and Robb Boyd are interesting and cover a wide range of topics. The down side is that Cisco has these videos filed by topic rather than grouped as a topic itself. But they are entertaining and informative.

Layer Three : Audio Immersion

The daily commute is one of the best times to use to program yourself for success. Instead of listening to the "news" - which is really only bad news - spend some time listening to podcasts. I found it easy to download some podcasts to my Kindle Fire and connect it to the Sync in my car. Now my ride to work is filled with Packet Pushers Podcasts instead of listening to the horrors of the world outside geekville.

Layer Four : Other people

Yes, geekateer - you need to touch base with other people. And not just other people, but those who are doing the same thing you are doing - moving forward. They don't necessarily have to be attempting the exact same certification, but they have to be doing something positive to improve their life and bring success and abundance to themselves and their environment. It's contagious. The more you surround yourself with motivated people, the more motivated you become and you will find yourself attracting the people and opportunities that you need to grow.

Those are my four layers of perpetual motivation. YMMV.
Good luck on your path and keep moving forward!

Although I am bound by the NDA about the exam -material- , I can still say quite a bit about the exam itself. And the first thing I can say about it is - it was all worth it. Yes, even though I did not pass, it was still a great experience to sit for the lab for the first time. In many ways, I crossed a barrier when stepping through that threshold. True, it was a mental barrier that I imposed on myself, however it is now gone.

I no longer wonder or worry about the logistics of the experience. I know how to get to RTP, where to stay, where to eat, and how to get to the correct building. On my second attempt, I will not even need to give these things a second thought. Add several hours of sleep to the equation for this accomplishment.

I no longer wonder or worry about the twin evils of understudying and overstudying. I have seen at least one version of the exam. I have a good idea of the type of content I will encounter. I now know what I need to know and how deeply I need to know it and how fast I need to be able to configure it. When I am 'ready' - I will most certainly know it. This will help prevent the type of fear-based procrastination that produces an 11th-hour-do-or-die 2nd attempt right at the end of the eligibility period. My current target for the lab is the end of the summer - which could be extended out to the end of this year. That still gives me another year - just in case I'm wrong about being ready and discover a whole new level of what I need to know.

I have the tools and I know they're good. I really can't say enough about the INE training materials. They are easy to use. The instructors are good and the material covers every topic in the blueprint. In fact, I have seen some of the material that was covered in the videos not only apply to the exam, but also to my day-to-day activities at work. I really like their approach - they don't "teach the test" -- they teach the technology, which will give you the skills to pass the test. But seriously, you can't just buy the stuff and wear it. You have to work through ALL the material. And there's a lot. You can't get through it in a few months unless you have a LOT of spare time. We're talking hundreds of hours of video with an all-access pass (which is what I have now). Add the workbook materials to that and you're talking a large investment of time and energy. I would add "money" to that, but I have to admit that INE has done a great job of keeping the cost reasonable. The monthly subscription might seem steep to some, but I have to admit - I was spending an equivalent amount of money on cigarettes. Now that I'm not smoking, I put that money towards my AAP. And frankly, if you can't afford the materials, how are you going to afford the exam itself?

Ah, speaking of the exam itself... it was great. The first two hours covers the troubleshooting section. It was not that impossible - I was not completely prepared. I actually got some of them - but not enough of them. I saw the types of things they were expecting you to know and troubleshoot. There was one scenario/ticket that I looked at and said to myself - now, you KNEW they were going to have something about that on the test and you knew you wanted to know that very well before you got here. Okay. Next time. I completed as many as I could, starting with the ones I knew dead-on and then going to the ones I thought I could figure out. I got one that surprised me (I didn't realize I knew how to fix that one until I did it) - so there was enough time to look at one or two and really do some deep thinking. Of course, that demands that there be a number of them that appear straightforward to you and you just knock those out as routine. [This is where lots of lab practice comes in handy.]

When the two hours for troubleshooting is up, the tickets will disappear on you and the configuration section is available. At this point, you may already know you did not pass. I knew that I did not correctly solve and verify 80% of the tickets and therefore was not going to pass on that attempt. In some ways, that was okay too. The pressure was off and I could relax a bit. I treated the configuration portion just like it was rack time. I couldn't pass, but I couldn't do any worse, either. So I sat and looked at the config requirements. I really have to admit that it was pretty straightforward. I'm sure there were a few "gotchas" that would have only been apparent if I had completed all the configuration, but it really didn't appear to be all that tricky. I didn't see anything in there that looked like it came from an obscure method, configuration or design. It was not that huge and the configuration tasks were not anywhere near as demanding or time-consuming as you might fear. It can all reasonably be completed by someone in about four hours - which would give you time to check your work. But you could only do that if you knew the material from the blueprint and could do a good 90% of it without looking up anything in the Cisco Documentation. It's not really just that you don't have time. It's also that you might not find it. There was one item in particular that I looked up several times during my studies. I didn't practice it as much as I should have because I knew where to find it in the Docs. Yeah - during the test I couldn't find it. Not sure why, but I really couldn't find it and I knew I had easily found it before (several times) during my studies. Test blindness I guess.

I wasn't as stressed as I thought I might be during the exam. The environment is calm and (for the most part) quiet. The guy next to me kept huffing and puffing as he completed each section as though he was lifting weights. I think he was taking the Voice track, though. But it was very nice to be there. We had chicken pot pie and salad for lunch. We had enough time to choke down some food and then we were back to our stations. The break was long enough to give us rest (and food) but not too long to introduce the jitters.

All in all, I found it to be a positive experience. I learned quite a bit from it and I'm really looking forward to going back again. Granted, it was an expensive experience. The lab itself cost $1500 - not to mention the cost of the transportation and lodging. I stayed at the Indigo Hotel. It was a lovely experience that helped maintain the peace of mind that I needed for the exam. They also give a Cisco discount for the room if you're there for the exam.

And with all that, I joined a group of network engineers who have attempted the exam. It's a step in the right direction.

For an update... I'm building speed. I'm building knowledge. Will I build enough of each to pass? Will I get just the right test at just the right moment that it all gels and ...

Okay. I dunno. I've met a number of CCIEs. They don't know everything about everything off the top of their head. But when they sat for the test, they knew enough about enough to get enough points to pass. Maybe that will happen to me.

The only other alternative is that I would be (gasp) -average-.... That's not the end of the world. In fact, most people are average - by definition. Of course, I would like to pass the first time. Of course, I am putting forth a lot of effort to learn as much as I can and keep it as sharp and at the end of my fingers as possible. But I am also human.

No matter which way the tree falls, I will come back and study. Perhaps not as hard, fast and furious as I have been of late... but I will still be watching the videos and working the labs. If I pass, it will be the Security material. If not, it will be the Routing and Switching material. So it's all the same, just a different flavor.

I have to admit that I have seen quite a bit of improvement as this process is unfolding. And I have to admit - I get a thrill when I fix an issue or configure something and test...and it pings!!!!! No, really, I don't need to back off the espresso. For those that aren't this kind of nerdy...when you ping from a router, you don't get the same feedback as from the command prompt. At the router, when you ping a dot = not and ! is great! So when you ping and it's reachable, you get " !!!!! " Do that a few hundred times and Pavlov says that when you see the ping (!) it's a wonderful thing.

Yeah - today was the first day I woke up with butterflies in my stomach. What's strange is that it wasn't a -dread- type of butterflies, but more of an "excited" type of butterflies. Despite everything - I'm just really looking forward to taking a shot at this lab.

One of the things I'm doing for prep is becoming comfortable with this in every way possible. I'm not only doing labs when I'm at my top form. I'm not only doing labs in any one way. I'm not only connecting to the remote labs in any one way. This way, no matter what, I will only see the material and not the environment/circumstance that may be unfamiliar. I sat at my kitchen table with a laptop. I built a rack and went the console route. I did some labs at my computer desk. I did them in the morning when I was fresh and at night when I wasn't so fresh. I wanted to do some while I was exhausted. And this past weekend, when I came down with a fever, I sat in bed with my laptop and kept going. Was it because I'm SuperWoman or Hercules? HELL NO. I felt like shit and I barely got anything done. But I got _something_ done. And I showed myself that - no matter what - I can configure anywhere and any time. [I can configure in a box. I can configure with a fox. (somebody get Dr Seuss outta my head here)]

So I'm reaching for as many comforts as I can get and take with me to the test. I'll let you know how that all works for me next week...

These words of wisdom apply here. I don't have to get _every_ troubleshooting scenario and _every_ configuration scenario 100% perfect. I need to get the ones on the TEST right. I can make all the typos and misconfigs I need to in order to learn. Now is the time to shake them all out. I get absolutely nothing for getting these workbooks correct. My gain is in the _learning_ and the awareness and the ah-ha moments that I'm seeing in these exercises.

I'm also encouraged by my increase in speed. I'm increasing in some areas...in others, not so much. But it's getting so familiar and _comfortable_ that it's okay to go faster. I'm also looking at ways to combine tasks so I don't have to keep going back and forth. While I'm on SW2 configuring this, I might as well configure that. These are the things that I'm now seeing from the constant practice.

One of the unintended side-effects of this is that I'm getting much faster on the IGP and BGP. Think about it. I bust into the scenario - and I'm going along at a good clip. That's the part that's getting faster and familiar. Much of it seems to be variations on a theme. So then I hit something that slows me. Maybe it's a typo or a misconfig or something that I don't really understand as well as I want to, so I slow down to delve into it. Usually it's at the point where I only have an hour and a half left where I look at the lab and think - oh shit - and bust hump to get as much configured as I can before the terminal disappears. So that's how I'm getting faster at my "opening" and "endgame"... the middle-game....hmmm... needs work (or coffee).

Since I have one lab per day - and I'm coming to the end of the 10 labs in each workbook, I'm looking for things I want to work on or reinforce during rack time. One of my weak areas is IPv6. We don't use it at work, so I don't get daily exposure to it. Or perhaps while I'm going through Vol 2, I might see a scenario or lab that I would like to work on or practice. I'm sure I won't run out of ideas or scenarios. You really get a lot to work with on these workbooks.

So tonight's lab was Workbook 4 Lab 6. It has a strange little mixture of a lot of items. I enjoyed hitting some of the more distant items - core dumps, ntp, ftp... etc. The SWITCH configuration kinda threw me...

It was an Etherchannel Tunnel. I must have been getting used to being spoon-fed since normally you see them mention how things are set up. Now on the later labs you have to look. The "Baseline" for this lab was one paragraph that basically said - the diagram rules. No discussion of how the Layer 2 is set up and the only hint of a switch config was the measley port channel from SW3 to SW4 on the diagram. There wasn't even a heading for layer 2 - the first ticket went right to EIGRP - which really wasn't an EIGRP issue and required the switches to be looked at, digested and fixed. Wow. It was interesting.

So then I moved on and eventually came upon a IPv6 ticket. I went along with the solutions guide and did everything they said to do that should have fixed the problem. Oh yeah...but that would have fixed it if I was on Rack 1. So I went over all the IPv6 addresses and made sure they had the embedded IPv4 address for my rack. It still didn't work. I moved on. Luckily, I finished somewhat early. I could have just gone off and relaxed (and I did consider that option), but that IPv6 thing was nagging at my brain. So I went back to finish that off. I looked at the documentation and probably read more on IPv6 than I intended to this evening. I even pulled out the IPv6 study guide. Then I used my old friend Notepad. I took ALL 4 tunnel configs and pasted them into Notepad. Once they were listed, I noticed that R6 did not have the tunnel source line. Once I put that in...Bust My Buttons...it worked!

Attention to detail. Yes, it's required.

I'm seeing a lot of pink elephants patterns in some of the scenarios. And I'm seeing a lot of parallels with learning chess. I remember when I first started learning chess - going to chess clubs and watching and listening while those with much more experience showed how to tackle this or that problem. It gets really really confusing when they go down one path...then back up to show a variation. It made my head spin. Again, while I was working my way through the first workbook, they did the same thing. Configure this in this manner...okay I followed that. Now, undo this and configure it with this kind of ...wait, [Lou Costello voice] Now you're just tryin' to confuse me. What's the fella's name on first? (No, What is on second, Who's on first.) [/Lou Costello voice] However, now these twists, turns and backtracks are starting to become 'normal' and I'm finding it easier to remember these things as variations on a common theme.

So a lot of things are becoming 'normal' for me and that's a good thing. The "setup" of my console sessions - this is natural now. I look at the 8 key and think SW2 now. Sure, I know some people are going to hear that and tell me how SecureCRT is so much better - and you can do tabs. Yes, I know this. I've been watching hours of those tabs in the INE videos. However... this is what I'm going with. Sessions. They're everywhere. And the options on the exam are pretty much outlined here: Web-based Exam Delivery System. So from what I'm seeing in this video, the two options are: a central access server with console sessions or clicking on the topology map for individual sessions. Practice in the way you will be tested as much as possible. So, again...sessions.

I've gotten through some labs on all 4 workbooks, so now I'm ready for some hard-core repetition to 'drill' the material into my being. This type of learning has to be done in layers. With the intense 11 hour back-to-back sessions this week, I'm seeing myself change and grow in a way that is noticable. And it's interesting that sometimes I'll work on something all day long...go to sleep...and when I wake up I can feel like I know it better. [Yeah, maybe I'm doing practice labs in my dreams?]

One of the things I need to do is speed up my pace. But that will come with time and practice. What I have found is that the first few labs of each workbook, I use to ease into the material. Although the labs are designed to be completed in two hours (or others in 4-6), I pick one and work my way through it no matter how long it takes. I don't expect myself to know everything about everything. But on these, I force myself to do them through what I know and what I look up in the documentation. This is getting me VERY familiar with where things are in that space. Once I get a couple done like that, I have to get used to speed and configuring. So the next few labs of the workbook I use to time myself. If I can't get a trouble ticket right away (within 5-10 min) I look at the solutions and configure it as shown and move on. I want to train myself not to get stuck on something. After a couple of those, I'm ready to go at it myself and I'm doing it somewhat close to the target times. For the config labs, I'm working out a solution and checking it before I confirm it with the solutions guide. [Oh, it so helps to have multiple computers and multiple monitors to use for this.]

Another thing that has been helpful -- access to motivational videos. Sometimes while I'm waiting for the configs to load on the rack (this takes 15 min), I'll pop over to BraveHeart Women TV and watch one of their 10 min videos. Another trick is to put on a video in another room. I use the ones I've already seen (so it doesn't distract) and really liked. I make sure it's at a level where I can barely hear it (so it doesn't distract) and hope the motivational message sinks into my subconscious (like a subliminal). There are plenty of these in the Safari Library (safaribooksonline). My favorites are in the series called "The Next Level" from Dr. Ellie Drake (of BraveHeart Women.com) -- especially the ones about Transitions, Creating New Experiences, and Dynamics of Attracting Effortlessly. If you have a subscription, it's really worth taking a look at those - especially with respect to taking this exam.

Well - now some slots opened up. I jumped on them. I just finished a 12 am (midnight) to 5:30am rack that I scheduled ...just because I could. I took yet another week of vaca to study. And it looks like I'm going to make that week worthwhile. Because, yes, more slots opened up. So now for the rest of the week - Tues, Wed, Thurs and Fri - I have rack time from noon to midnight. Then I take a break on Sat and Sun with only one measly 6 to midnight rack per day.

However, I have to say that it IS worth it to get rack time. I can see the difference already. And I'm building speed, accuracy and confidence. I finally finished up the troubleshooting labs and did a config lab. I've been putting them off - and now I don't see why since I'm rolling through them for the most part.

Well I don't have much time left before my next rack session. I better get some sleep.