Cisco CCIE Security

Central management turns many firewalls into one policy. You build objects, access control policy, prefilter and decryption rules in FMC, deploy to devices, and understand what deployment does underneath.

• Objects, variables and reusable policy
• Access control rules and ordering
• Prefilter and fast-path decisions
• Application, URL and identity conditions
• Deployment and rollback
• Health monitoring and troubleshooting a failed deployment

You build A reusable policy set deployed to two firewalls from the management center.

Intrusion prevention is only useful when tuned. You build NGIPS policy, adjust rules and variables, recognize scans, floods and spoofing in firewall data, and mitigate each with the right feature.

• Intrusion policy and rule states
• Variable sets and network analysis policy
• Recognizing scans and reconnaissance
• Detecting and limiting floods
• Anti-spoofing and protocol anomalies
• Tuning to reduce false positives
• Reading intrusion events

You build A tuned intrusion policy that detects and blocks four attack types in a lab.

A firewall that fails takes the business with it. You configure failover pairs, build clusters, understand state synchronization and traffic flow, and test failure the way production will.

• Active and standby failover
• State synchronization and its limits
• Clustering roles and traffic distribution
• Asymmetric flows in a cluster
• Upgrade order and procedure
• Failure testing and verification

You build A firewall pair and a cluster, with a failure test log for each.

Remote access is the front door for staff. You configure SSL and IKEv2 client VPN, authenticate through external servers, apply group policy, split tunneling and posture, and scale with load balancing.

• SSL, DTLS and IKEv2 client connections
• Connection profiles and group policy
• Authentication and authorization with ISE
• Split tunneling and its security trade-offs
• Posture checks for VPN clients
• Certificates for client and gateway
• Troubleshooting a failed connection

You build A remote access VPN with certificate and identity-based policy, tested from a client.

Sites need encrypted paths that survive failure. You build IPsec tunnels, FlexVPN and DMVPN designs, make them highly available, and diagnose phase and policy mismatches from the logs.

• IKEv1 and IKEv2 negotiation
• IPsec policy and proxy identities
• Static and dynamic VTI designs
• FlexVPN hub-and-spoke and spoke-to-spoke
• DMVPN with IPsec protection
• Redundant hubs and tunnel failover
• Debugging IPsec tunnel failures

You build A redundant VPN between three sites using both FlexVPN and DMVPN.

Segmentation by address does not survive modern networks. You assign security group tags, propagate them across devices that cannot tag, and enforce group-based policy on switches and firewalls.

• Security groups and what they replace
• Classification: dynamic and static
• Inline tagging and SXP propagation
• Group-based policy matrices
• Enforcement on switches and firewalls
• Troubleshooting tag propagation

You build A group-based policy matrix enforced across a switch and a firewall in a lab.

The network itself needs protecting from the inside. You harden devices and their three planes, apply Layer 2 and first-hop protections, secure wireless access, and monitor it all.

• Hardening the management, control and data planes
• Routing protocol and control plane protection
• Port security, DHCP snooping and ARP inspection
• Private VLANs and segmentation at Layer 2
• Wireless security with 802.1X and WPA3
• Logging and monitoring for infrastructure
• IPv6 security features

You build A hardened access layer with Layer 2 and wireless protections and logging in place.

ISE is the engine of identity-based access. You deploy it across multiple nodes, configure 802.1X and MAB on switches and controllers, and write policy sets, profiling and authorization that behave predictably.

• ISE node roles and distributed deployment
• 802.1X on wired and wireless access
• MAB for devices without supplicants
• Policy sets, conditions and authorization results
• Profiling devices
• Dynamic VLANs, ACLs and group tags
• Troubleshooting with live logs

You build A multi-node ISE deployment authenticating employees and non-supplicant devices.

Not every user is an employee and not every device is yours. You build guest portals and sponsored access, onboard personal devices with certificates, and enforce posture checks before devices reach sensitive resources.

• Guest portals and sponsor flows
• Hotspot and self-registration options
• BYOD onboarding and certificate provisioning
• Posture policy and remediation
• Redirect and change-of-authorization flows
• Troubleshooting redirects and portal failures

You build Guest, BYOD and posture flows working together on one wired and wireless lab.

Identity lives in several directories, and administrators need controlled access too. You join ISE to external sources, map attributes into policy, run device administration with TACACS+, and control who administers ISE itself.

• Directory and external identity integration
• Attribute and group mapping into policy
• Certificate-based authentication
• Device administration with TACACS+
• Role-based administration of ISE
• Troubleshooting directory integration

You build ISE integrated with a directory, with TACACS+ command authorization for network devices.

Threats arrive over the web, DNS and email. You deploy advanced malware protection, DNS-layer and cloud security, web and email security, and handle encrypted traffic through decryption policy.

• Advanced malware protection for endpoints and networks
• DNS-layer security with Umbrella
• Web proxy policy and the WSA
• Email security gateway policy
• Decryption: what to decrypt and what not to
• Integrating content security with the firewall

You build A content security layer covering web, DNS, email and malware, with decryption rules.

Evidence and automation close the loop. You capture and analyze traffic to investigate an incident, gather logs and flows, and use Python against security product APIs to read data and make changes.

• Capturing traffic on firewalls and switches
• Analyzing a capture to confirm an attack
• Syslog and flow data for security monitoring
• Python against security product APIs
• Automating a repetitive policy change
• Verifying changes made through an API

You build A Python script that queries a security platform and applies a verified policy change.

Build one network that uses every control. You place firewalls, VPNs and segmentation, run identity across wired, wireless and remote access, add threat protection, and then break and repair it.

• Planning the security architecture
• Building the perimeter, VPN and segmentation
• Deploying identity and access control
• Adding threat and content protection
• Breaking and repairing the design

You build A complete secured lab with identity, perimeter, VPN and threat protection, with a repair log.