My CCSA(156.215.65) Diary

[geetarman]

Mistake in Checkpoint docs
In VPN Admin doc there is one mistake "Support key exchange for subnets"
this option is for earlier products like R55 but for new products like R65 it is under VPN Tunnel Sharing (once agian proved cisco is best)
[/font][/quote]

Not sure how this proves anything really? They do the same thing different ways. IKE is IKE, no?

JM2C...
Speaking as someone who came from a CP background and has tried since to live with ASA's, I like to think I see the short comings of both pretty clearly now. And given the choice, I would take CP's issues in a heartbeat. Cisco's once great support has gotten weak, their 7.x code is buggy as can be and their management tools are just plain sad when compared with either SmartCenter or Juniper's management console. I know it is frustrating to have unfixed bugs out there, but all software sucks. It's written by people after all. Not making excuses here, it should NOT suck. Not at these prices. Everyone has bugs though. ASA, NGX, Netscreen...

I've had unfixed bugs in ASA code for many months now, mof for most of that time no one in support could really tell me what was wrong.. only that my config was fine. (cold comfort..) I've had ACL's not work, had to regularly clear SA's to get tunnels back on their feet, clusters not fail over or just plain crash.. not leaving core files of course... As a bonus, ASDM and the CLI do not work the same way and deleting say a tunnel in ASDM does *not* cleanly remove the config. Show me somewhere in CP where this kind of configuration entropy is an issue?? The GUI is worse than useless if it does not work properly.
Now, try managing a dozen or more of these things with no central console, no change auditing, no rollback, unforgiveably lousy logging (syslog?!) or log management... They are a management nightmare IMHO. Hey, I like the switches and routers ok. I just think the ASA is half baked when you really look at it as a "solution", and I use them every day. I have the scars to prove it. ;)

Not looking to slam anyone, and if I am incorrect here, please correct me. I am just confused when someone posts something vague about how this or that tweak makes them the "best". The best at WHAT in which circumstance is the Q, and in whose opinion.

You are absolutely entitled to yours, and know you know mine. ;)

Good luck with your exam!

ICBW, YMMV and the usual disclaimers apply..

- GM

[amol0009in_7]

I wasn't talking from perfomance point of view, but from studying point of the view.Checkpoint studies aren't structured very well enough as compare to cisco. I could easily understand the cisco docs and book but when i started with checkpoint i was very confused and it took much more time to know what they are telling.The structure and the way the book is made or checkpoint has its exam is somewhat confusing.Also there are many mistakes in the checkpoint book.For instance
Mistake in Checkpoint docs

In VPN Admin doc there is one mistake "Support key exchange for subnets"
this option is for earlier products like R55 but for new products like R65 it is under VPN Tunnel Sharing (once agian proved cisco is best)
[/font]

Search for that option "Support key exchange for subnets" on R65 and you are only gonna scratch your head. The same happened with me.


Well today gonna deal with Smartdefense and revision.

[geetarman]

Thanks for the clarification, I misunderstood it appears.
I agree the CP docs could use some help in spots. I learn more and faster using Google in most cases and reading these boards!
I bet I am not alone... ;)

ps: thanks for posting your experiences on prepping for the exams.

[amol0009in_7]

Finished Smartdefense revision.I am using syngress book for the same instead of checkpoint docs as it has all protections explained.
Now going to revise HA and clustering and also Secureplatform.

12 Days to go...

[amol0009in_7]

Forgot HA & Clustering is not in the CCSA 156.215.65
*Caution: There are many topics like VPN, HA Clustering which aren't on exam.So don't go with Syngress book always take a look at Topic of Contents

[amol0009in_7]

My heart is pumping , 6 days to go

[amol0009in_7]

Encryption supported :
DES
AES-128
AES-256

Data Integrity :
SHA1
MD5


DH group:
Group 1 : 768
Group 2 : 1024
Group 3 : 1536

Some of the important point to remember

[amol0009in_7]

I am planning to give exam on 17 , instead of 18.I am getting bored reading books.Hope i will pass!
48 hours remaining

[amol0009in_7]

I passed with 87%
Books: I have mentioned above
Dumps : Study 156-215.1 and 156-315.1, if u got hand to latest 156-215.65 of pass4sure or testking then ok
Exam: Somewhat tough 70-80 % from dump, Passing mark 70% out of 100
More detail and materials will be uploaded,wait for few days...let me enjoy some days after hard work :D

[rji479]

congrats mate. I plan on taking mine in the new year.... I have to deploy 10 utms for a customer over the next couple of months so that'll be good revision for me.

[kmj1268]

Great Job amol0009in_7!!!!
I just sat for the CCSA-NGX 156-215.1.
I thought about sitting for the R65 exam, but I use the R60 environment. I have one customer that I setup on R65 and did a full upgrade on their SmartCenter Server from R55AI as well as two HA gateways on a Nokia platform. Most of my experience has been on a daily basis with R60, however I have actively worked with the R65 environment, just dont have the courseware on it. I also heard the R65 exam was a good bit different than the standard R60-CCSA-NGX exam.

I think once I get my CCSE on 156.315.1, I'll sit for the R65.
However, I hear there is a new version of Checkpoint coming out very soon for the 7 series.

Congrats again.
Happy New Year.

J. Mark Kellerman, CISSP, CCSA-NGX

[amol0009in_7]

Thanks!!!!!!! :)