Security Tecnologies

All sections open below. Scroll and explore — each topic is a quick chip for fast scanning.

ASA 9.x Firewall VPNs & Tunnels Firepower Threat Defense (FTD) Cisco ISE & 802.1X Device Administration (ISE) Web Security Appliance (WSA) E-Mail Security Appliance (ESA)

Implementing a Cisco ASA 9.x Firewall

From first boot to advanced redundancy and DPI.

Overview & Basic Initialization

ASA Overview & Traffic Flow Basic Initialization

Routing on the ASA

Static Routes RIPv2 EIGRP OSPF BGP

Traffic Flow & Access

Thru-Traffic with ACLs Control Traffic to the Firewall

Remote Management

Management Access Telnet Access SSH Access HTTP/ASDM Access

Network Address Translation (NAT)

NAT & Dynamic NAT Static NAT Destination NAT Dynamic PAT Static PAT Policy NAT

Transparent Layer-2 Firewall

Transparent Mode — Overview & Init Routing Thru Transparent FW Ethertype ACLs

Virtualization & Redundancy

Redundant Interfaces Port-Channels Security Contexts Active/Standby — Stateless Active/Standby — Stateful Active/Active Failover ASA Clustering — Overview Clustering — Spanned Mode

Deep Packet Inspection (DPI)

DPI — Overview ICMP Inspection FTP on Non-Standard Port

Virtual Private Networks (VPNs)

Site-to-Site, DMVPN, GETVPN, IKEv2, FlexVPN and ASA remote access.

Basics

VPN Overview LAN-to-LAN (no NAT-T) LAN-to-LAN (with NAT-T) P2P GRE GRE over IPSec IPSec SVTI (Static VTI)

Advanced VPNs

mGRE DMVPN — Phase I DMVPN — Phase II DMVPN — Phase III DMVPN Phase III — Dual Hub DMVPN with IPSec GETVPN — Small GETVPN with Redundancy VRF-Aware VPN Router as CA Server

VPNs using IKEv2

Site-to-Site — Crypto Maps Site-to-Site — S-VTI

FlexVPN

FlexVPN — Crypto Maps FlexVPN — S-VTI

ASA VPNs & Remote Access

ASA Site-to-Site (no NAT-T) ASA Site-to-Site (with NAT-T) LAN-to-LAN — Router ↔ ASA ASDM for Management WebVPN AnyConnect Remote Access

Firepower Threat Defense (FTD)

From FMC/FTD bring-up to ACP, IPS and redundancy.

Overview & Basic Configuration

FTD Overview (Video) FMC Init — CLI FMC Init — GUI FTD Init — CLI Register FTD to FMC Interface Initialization

Routing on FTD

Static Routing OSPF Redistribute Static → OSPF RIPv2 + Redistribution BGP Verify Routing Allow Traffic via Basic ACP Setup Review & EIGRP Flex Config

NAT on FTD

NAT Overview Dynamic NAT Static NAT Dynamic PAT Static PAT Policy NAT — Manual ACP with L3/L4 Characteristics Verify NAT & ACP

ACP, IPS & Advanced Controls

Geo-Location Blocking URL Filtering ACP Analysis AVC — App Visibility & Control Logging & Alerting IPS — Overview IPS — Default Policies IPS — Custom Policies Network AMP / File Policies Packet Flow through FTD Pre-Filter Creation

Redundancy & Multi-Instance

Redundancy & Multi-Context — Overview Active/Standby Failover Multi-Instance — Overview Verify Failover

Transparent Firewalls

Transparent FW — Overview Transparent FW — CLI Transparent FW — GUI Access Policy for Transparent FW

Cisco ISE & 802.1X

Wired, wireless and AD integration with authorization policies and DACLs.

Overview & Initialization

ISE Overview Wired Base Network for ISE ISE — Common CLI ISE — Initial GUI Config

ISE & Switch — 802.1X

ISE–Switch Trust Groups & Users Authorization Profile (VLAN) Authorization Policy Mapping Switch Dot1x + ISE Validator SVIs & DHCP on SW2 Client Dot1x — Verify VLAN Downloadable ACLs (DACLs)

Wireless with ISE & WLC

Wired Topology + Smart Macro Routing for Wireless Topology DHCP & Relay for AP Registration Register APs to WLC (Manual) WLC Init — CLI Verify AP Registrations Wi-Fi — Central Switched

ISE & WLC Integration

Integrate ISE & WLC (AuthN) Groups & Users Authorization Profile (VLAN) Authorization Policy Mapping WLAN with WPA/WPA2 (802.1X) Recap + DACL

Active Directory Integration

Add AD to ISE AD Groups in Policy Cert-Based AuthN with AD

MAB (MAC Auth Bypass)

MAB for Access Points

Device Administration using ISE

TACACS+ and RADIUS for routers, switches, WLC and ASA.

Overview

Device Admin — Overview NDGs + TACACS+/RADIUS

AAA Fundamentals

Authentication Authorization Accounting

TACACS+ Workflows

Routers — Device / ISE / Verify Switches — Device / ISE / Verify WLC — Device / ISE / Verify ASA — Device / ISE / Verify

RADIUS Workflows

Routers — Device / ISE / Verify Switches — Device / ISE / Verify WLC — Device / ISE / Verify

Web Security Appliance (WSA)

Transparent redirection, identities, policies and custom categories.

Overview & Initialization

WSA Overview Base Network for WSA Initialization — CLI Initialization — GUI

Transparent Redirection (WCCP)

WSA-Side WCCP Router-Side WCCP Verify Redirection

Identities & Access Policies

Configure Identities Access Policies by Identity

Custom Categories

Whitelist — Create & Use Blacklist — Create & Use

E-Mail Security Appliance (ESA)

Bring-up, mail flow and content policies with verification.

Overview

E-Mail Propagation Overview Forwarding without ESA ESA — High-Level Overview

Initialize & Configure

Init — CLI Init — GUI ESA as Relay Host Re-configure DNS Verify Forwarding via ESA

Policies & Filters

Outgoing Content Filters Incoming Content Filters Incoming Mail Policy Outgoing Mail Policy Verify Mail Policy Use