01 Information Security Fundamentals 6 lessons planned
01M1 · Lab 1: Build the Core Lab — Workstations, AD & the AttackerPlanned02Security Fundamentals: Threat, Vulnerability, Risk & the CVE/CVSS EnginePlanned03Vulnerability Prioritization: KEV, EPSS, SSVC & BOD 26-04Planned04Zero Trust Architecture & Defense in Depth (Cisco SAFE)Planned05Security Intelligence: Authoring, Sharing & ConsumptionPlanned06Phishing & Social Engineering: Controls That Protect HumansPlanned
02 Common Threats 5 lessons planned
01Common Threats: On-Premises, Hybrid & Cloud — Malware, DoS/DDoS, Breaches & Credential CompromisePlanned02OWASP Top Ten in Practice: SQL Injection & XSS, Live from ATK-KALI-01Planned03Vulnerability Classes Beyond the Web: Weak/Hardcoded Passwords, Missing Ciphers, Buffer Overflow, Path Traversal & CSRFPlanned04AI/LLM Security: Prompt Injection, System Prompt Leakage, Embedding Weaknesses & AI Supply ChainPlanned05Man-in-the-Middle: ARP Spoofing Packet WalkPlanned
03 Cryptography & PKI 6 lessons planned
01Cryptography Foundations: Hashing, Encryption & PKIPlanned02Stand Up the Enterprise CA on AD-01 & Issue CertificatesPlanned03The SSL/TLS Handshake: Packet WalkPlanned04Post-Quantum Cryptography: NIST Algorithms, Hybrid Key Exchange & MigrationPlanned05QUIC & MASQUE: Where TLS Is GoingPlanned06IPsec: AH, ESP, IKE, PSK vs Certificates & NAT TraversalPlanned
04 ASA Stateful Firewall 16 lessons planned
01M4 · Lab 1: Power On the ASA PerimeterPlanned02Stateful FirewallsPlanned03ASA: Deployment TypesPlanned04ASA: Security ContextsPlanned05ASA: Security Levels⚑Planned06ASA: DMZ Interface & Verification⚑Planned07ASA: Objects & Object Groups⚑Planned08ASA: Service Groups & Access Rules⚑Planned09ASA: NAT Concepts and Rule Evaluation⚑Planned10ASA: NAT — Static NAT and Dynamic PAT⚑Planned11ASA: NAT — Identity Rules, Verification and Troubleshooting⚑Planned12ASA: Interface ACLs⚑Planned13ASA: Global ACLs⚑Planned14ASA: Advanced Access Policies — Modular Policy Framework (MPF)⚑Planned15ASA: High Availability (HA)Planned16M4 · Lab 5: ASA Perimeter Policy⚑Planned
05 Firepower NGFW 16 lessons planned
01M5 · Lab 1: Power On FTD & FMCPlanned02Firepower: DeploymentsPlanned03Management Models: Single vs Multidevice, In-Band vs Out-of-Band, On-Premises vs Cloud (Cisco Security Cloud Control)Planned04Firepower: Packet Processing & PoliciesPlanned05Firepower: ObjectsPlanned06Firepower: Policies — Access Control (ACP)Planned07Firepower: Policies — AVC & Application ControlPlanned08Firepower: Policies — URL FilteringPlanned09FTD: NAT Concepts and Rule EvaluationPlanned10FTD: NAT — Dynamic PAT and Static PublicationPlanned11FTD: NAT — Identity Rules, Verification and TroubleshootingPlanned12Firepower: Policies — PrefilterPlanned13Firepower: Security Intelligence (SI)Planned14Firepower: Policies — Network DiscoveryPlanned15Firepower: Policies — IPSPlanned16Firepower: Policies — Malware & FilePlanned
06 Endpoint Security 7 lessons planned
01M6 · Lab 1: Power On the Secure Endpoint Console & WorkstationsPlanned02EPP vs EDR — and Why Endpoint Security at AllPlanned03Endpoint Protection & Detection: Secure Endpoint, Secure Client & Malware AnalyticsPlanned04Configure Antimalware Protection: Policies, Outbreak Control & QuarantinesPlanned05Triage Secure Endpoint: Interpreting Malware Detection EventsPlanned06Endpoint Hygiene: MDM, Asset Inventory & Posture AssessmentPlanned07Configure Email Security with Cisco Secure Email Threat DefensePlanned
07 Secure Network Access (ISE) 1 live · 12 planned
01M7 · Lab 1: Power On ISE, the Access Layer & WirelessPlanned02Identity Management: Guest, Profiling, Posture & BYODPlanned03Configure & Troubleshoot TACACS+ Device AdministrationPlanned04Configure & Troubleshoot RADIUS Network AccessPlanned05802.1X, EAP & RADIUS Flows: Packet WalkPlanned06Configure 802.1X, MAB & WebAuth with ISEPlanned07Authorization: dACLs & Dynamic VLAN AssignmentPlanned08Change of Authorization (CoA): Triggers, Packet Flow & VerificationPlanned09Configure Profiling, Guest Services & BYODPlanned10Configure Posture Assessment & Device CompliancePlanned11Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access PoliciesPlanned 12Cisco Duo SSO, the Authentication Proxy & Cisco Identity Intelligence 20m 08 Infrastructure Security 6 lessons planned
01Layer 2 Attacks & Defenses: Port Security, DHCP Snooping, DAI & Storm ControlPlanned02Configure Segmentation: VLANs, SGTs & Private VLANsPlanned03Device Hardening with CIS Benchmarks: Cisco Secure Firewall (FTD) & IOS XEPlanned04Secure Management Access: SNMPv3, NetConf, RestConf & APIsPlanned05Secure Log Transport: Syslog HardeningPlanned06Trusted Time: Authenticated NTPPlanned
09 Telemetry & Visibility 6 lessons planned
01M9 · Lab 1: Power On the Telemetry StackPlanned02Security Monitoring & Telemetry Technologies: NetFlow, Logs & BeyondPlanned03Configure Flexible NetFlow Export: Telemetry Hands-OnPlanned04Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDRPlanned05Splunk for Security Operations: SIEM, SOAR, Orchestration & AutomationPlanned06Exfiltration & Its Detection: DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger/IRC, NTP & Cloud StoragePlanned
10 VPNs: Site-to-Site 6 lessons planned
01M10 · Lab 1: Power On the Branch SitePlanned02Site-to-Site VPN Options & Design: sVTI, IPsec, DMVPN, FlexVPN & GETVPNPlanned03IKEv2 Tunnel Establishment: Packet WalkPlanned04Configure IOS Site-to-Site IPsec with sVTIPlanned05Configure Site-to-Site VPN: FTD to Branch RouterPlanned06Troubleshoot VPN Tunnel Establishment on FTD: Debugs That MatterPlanned
11 VPNs: Remote Access 3 lessons planned
01Remote Access VPN & Cisco Secure Client ArchitecturePlanned02Configure Remote Access VPN: FTD & Cisco Secure ClientPlanned03Verify & Troubleshoot RA VPN: TLS/DTLS Session Establishment & DebugsPlanned
12 Secure Service Edge (Cisco Secure Access) 7 lessons planned
01M12 · Lab 1: Secure Access Tenant & Branch Component AvailabilityPlanned02SSE & SASE: From Umbrella to Cisco Secure AccessPlanned03Configure Secure Internet Access: DNS Forwarding, Branch Egress, Web Policies, Destination Lists & ReportingPlanned04Configure Secure Private Access: ZTNA to Internal AppsPlanned05Configure DLP & AI Guardrails for Secure Internet AccessPlanned06Interpret Secure Access Investigate: Scores & IndicatorsPlanned07SDN & SD-WAN: Architecture, North- & South-Bound APIs, Securing the Overlay⚑Planned
13 Cloud Security 7 lessons planned
01M13 · Lab 1: Power On the Cloud Services SimulatorPlanned02Cloud Shared Responsibility ModelsPlanned03Cloud Service & Deployment Models: NIST 800-145, Cloud Types & CASB SelectionPlanned04Selecting Cloud Security Capabilities: Deployment Models, Frameworks & Policy ManagementPlanned05Application & Workload Security: eBPF-Based ProtectionPlanned06Cloud Network, Application & Data Security: Multicloud Defense & Secure WorkloadPlanned07Configure Splunk to Ingest Cloud Logging & Monitoring DataPlanned
14 DevSecOps & Security Programmability 3 lessons planned
01DevSecOps: CI/CD, Containers, IaC Security & Secure Software DevelopmentPlanned02Secure a CI/CD Pipeline: Container & IaC Scanning Hands-OnPlanned03Interpret Python Scripts Against Cisco Security Appliance APIsPlanned
01 Zero Trust & Cloud Security Foundations 8 lessons planned
01M1 · Lab 1: Build the SCAZT Lab - Cloud Accounts, the IdP & the Container NodePlanned02Zero Trust Architecture & Defense in Depth (Cisco SAFE)Planned03Zero Trust Frameworks: NIST SP 800-207 & the CISA Zero Trust Maturity Model v2.0Planned04MITRE ATT&CK for the Cloud: Selecting Mitigations for IdP, SaaS & IaaS TechniquesPlanned05Security Requirements for AWS, Azure & GCP: Identity, Native Controls, Posture & Shared ResponsibilityPlanned06Operational Requirements for Public Cloud: Visibility, Monitoring, Infrastructure & the Consumption ModelPlanned07Private Cloud: VMware Hypervisors & Kubernetes Container OrchestrationPlanned08eBPF Runtime Security: Cilium & Tetragon Observability and Enforcement for ContainersPlanned
02 Identity, Certificates & Multifactor Authentication 1 live · 11 planned
01M2 · Lab 1: Stand Up the Identity Plane - IdP, Duo Tenant & DirectoryPlanned02Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access PoliciesPlanned 03Cisco Duo SSO, the Authentication Proxy & Cisco Identity Intelligence 20m 04Identity Intelligence Across Identity Providers: Signals, Risk Scoring & Blind SpotsPlanned05Implement User & Device Authentication with Identity CertificatesPlanned06Implement Phishing-Resistant Multifactor Authentication with Cisco DuoPlanned07Implement Endpoint Posture Policies for User Access to ResourcesPlanned08Implement Trusted Endpoint Policies for Device Access with Cisco DuoPlanned09Configure User & Device Trust with SAML Authentication for Web and Mobile ApplicationsPlanned10Configure SSO & Automated User Provisioning Over an IdP Connection: SAML + SCIMPlanned11SAML Assertions & SCIM Provisioning Calls: Packet WalkPlanned 03 Security Policy at the Network Security Edge 9 lessons planned
01M3 · Lab 1: The Policy Edge - Secure Firewall, the WAF Node & the Secure Access TenantPlanned02SSE & SASE: From Umbrella to Cisco Secure AccessPlanned03Encrypting Data In Transit and At Rest in the Cloud: TLS, IPsec & Tunnel DesignPlanned04How IPS, DLP & Malware Protection Secure Private AccessPlanned05Cisco AI Defense: Purpose, Characteristics & Where It Sits in the ArchitecturePlanned06AI Access & AI Guardrails in Cisco Secure AccessPlanned07Web Application Firewalls & DDoS: What a WAF Actually AbsorbsPlanned08Design Security Policy for the Security Service Edge: Rule Model, Order & Identity ConditionsPlanned09Enforcing Application Policy on Edge Devices: Cisco Secure Firewall, Meraki & Catalyst SD-WANPlanned
04 Application Enforcement, Microsegmentation & Secure Workload 7 lessons planned
01M4 · Lab 1: The Workload Lab - App Tiers, Enforcement Agents & the ClusterPlanned02Cloud Network, Application & Data Security: Multicloud Defense & Secure WorkloadPlanned03Application Discovery & Dependency Mapping with Cisco Secure WorkloadPlanned04Designing Microsegmentation to Stop Lateral MovementPlanned05Enforce Microsegmentation Hands-On: Host Agents & Kubernetes Network PolicyPlanned06Policy Creation, Validation & Analysis in Cisco Secure WorkloadPlanned07Vulnerability Assessment & Response for WorkloadsPlanned
05 Secure Internet Access: DNS, SWG, DLP & CASB 7 lessons planned
01M5 · Lab 1: Prepare the Secure Access Lab - Tenant, Roaming Client & Branch EgressPlanned02Configure Secure Internet Access: DNS & Web Policies, Destination Lists & ReportingPlanned03Configure DNS Security in Cisco Secure AccessPlanned04Configure the Secure Web Gateway: Web Policy, TLS Decryption & Tenant ControlsPlanned05Configure Data Loss Protection in Cisco Secure AccessPlanned06Configure CASB: App Discovery, Risk Scoring & Tenant RestrictionsPlanned07Troubleshoot Secure Internet Access: Steering, Certificates, Identity & BypassPlanned
06 Secure Private Access for Workloads & Users 8 lessons planned
01M6 · Lab 1: Tenant, Hosts & Branch Devices for Secure Private AccessPlanned02Configure Secure Private Access: ZTNA to Internal AppsPlanned03Configure Secure Private Access for Workloads: Resource Connector vs IPsec BackhaulPlanned04Configure Branch Connectivity to the Secure Access EdgePlanned05Configure VPN as a Service with ISE as the RADIUS ServerPlanned06Configure Zero-Trust Access: Clientless and Client-Based with Cisco Secure ClientPlanned07MASQUE over QUIC: How the Zero-Trust Tunnel Is Actually Built - Packet WalkPlanned08Digital Experience Monitoring with ThousandEyes & Secure AccessPlanned
07 Zero Trust Operations: Telemetry, Dashboards & SOC Integration 6 lessons planned
01M7 · Lab 1: The Operations Stack - Splunk, Telemetry Sources & the XDR TrialPlanned02Selecting the Right Tool: Visibility, Microsegmentation, Traffic Analysis & EnforcementPlanned03Network Visibility & Enforcement: Telemetry, AI/ML Analytics & Cisco XDRPlanned04Interpreting Traffic Flow & Telemetry Reports: Baselines and Compliance BehaviourPlanned05Interpreting Cisco Secure Access Dashboards & ReportsPlanned06Integrating Cisco Secure Access with Cisco XDR & Splunk Enterprise for the SOCPlanned
01 ISE Architecture & Deployment 7 lessons planned
01M1 · Lab 1: Power On the ISE Lab — Three ISE Nodes, Active Directory & the Admin WorkstationPlanned02Identity Management: Guest, Profiling, Posture & BYODPlanned03ISE Personas: PAN, MnT, PSN & pxGrid Controller — What Each Node Actually RunsPlanned04ISE Deployment Models: Standalone, Distributed, Node Groups & Dedicated MnTPlanned05Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated OnboardingPlanned06Build a Distributed Deployment: Register Nodes, Assign Personas, Verify Replication & Promote the SecondaryPlanned07Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence TiersPlanned
02 Identity Stores & the ISE Policy Model 8 lessons planned
01M2 · Lab 1: Add the Identity Sources — Active Directory, LDAP & the Certificate ChainPlanned02Identity Store Options: Internal, Active Directory, LDAP, PKI, ODBC & Multifactor — Choosing the Right OnePlanned03Join ISE to Active Directory: Join Points, Domain Controllers, Groups, Attributes & the Diagnostic ToolPlanned04LDAP, ODBC & Internal Users: Binds, Search Bases, Attribute Retrieval & Identity Source SequencesPlanned05ISE Certificates & PKI: System Certificate Roles, Trusted Store, CSRs/SANs & the ISE Internal CAPlanned06Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access PoliciesPlanned07Policy Sets: Service Types, Conditions, Dictionaries, Authentication Rules & Identity Source SequencesPlanned08Authorization Policy & Profiles: Results, Common Tasks, Advanced Attributes & Rule Evaluation OrderPlanned
03 Network Access: Wired 802.1X, IBNS 2.0, MAB & Wireless 10 lessons planned
01M3 · Lab 1: Bring Up the Access Layer — IOS-XE Switch, Wireless LAN Controller & the Test EndpointsPlanned02802.1X, EAP & RADIUS Flows: Packet WalkPlanned03Change of Authorization: Types, Triggers, Timers & the RFC 5176 Packet WalkPlanned04EAP Methods Compared: PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS, EAP-FAST & TEAP EAP ChainingPlanned05Configure 802.1X, MAB & WebAuth with ISEPlanned06IBNS 2.0: C3PL Identity Control Policies, Service Templates & Converting from Legacy 802.1XPlanned07Monitor Mode, Low-Impact Mode & Closed Mode: Staging 802.1X Without Breaking the CampusPlanned08Host Modes & MAB: Single-Host, Multi-Domain, Multi-Auth, Multi-Host — and Authenticating What Cannot Speak 802.1XPlanned09Authorization: dACLs, Dynamic VLAN Assignment & CoAPlanned10Wireless 802.1X End to End: WLC AAA Server Lists, WPA2/WPA3-Enterprise, AAA Override & Wireless CoAPlanned
04 Cisco TrustSec: SGT Classification, Propagation & Enforcement 6 lessons planned
01M4 · Lab 1: Prepare the TrustSec Domain — SGT-Capable Switch, PAC Provisioning & Environment DataPlanned02Cisco TrustSec: Classification, Propagation & Enforcement — the Three-Phase ModelPlanned03SGT Classification: Dynamic Assignment via Authorization Profile, Static IP/Subnet/VLAN Mappings & the SGT DatabasePlanned04Propagating SGTs: Inline Tagging (CMD) vs SXP — Speaker/Listener Peers, the PAC Exchange & Environment Data DownloadPlanned05Enforcement: SGACLs, the ISE Policy Matrix, Egress Policy Download & SGT-Based Firewall RulesPlanned06pxGrid Context Sharing: Publishing Session and SGT Context to SubscribersPlanned
05 Web Authentication & Guest Services 10 lessons planned
01M5 · Lab 1: Stand Up the Guest Environment — Guest VLAN, DNS, Portal Certificate & the Guest SSIDPlanned02Web Authentication in ISE: Local vs Central Web Auth, the URL-Redirect Mechanic & When to Use EachPlanned03Central Web Auth Packet Walk: MAB, Redirect, Portal Authentication & CoA Re-AuthorizationPlanned04Configure Central Web Auth on Wired: Redirect ACL, MAB Policy Set, Portal Result & the CoAPlanned05Central Web Auth on Wireless: MAC-Filtering SSIDs, AAA Override, RADIUS NAC & the Guest Anchor PatternPlanned06Guest Access Types: Hotspot, Self-Registered & Sponsored — Flows, Guest Types, Identity Groups & Time ProfilesPlanned07Build the Guest Portals: Hotspot & Self-Registered — Pages, AUP, Device Registration & Portal CertificatesPlanned08Sponsor Portal & Sponsor Groups: AD-Backed Sponsors, Account Creation, Approval Workflow & Guest Account LifecyclePlanned09Portal Customization: Themes, Languages, Portal FQDN & Multi-Portal Design for Multiple Guest PopulationsPlanned10Troubleshooting Guest & Web Auth: Redirect Failures, Certificate Warnings, DNS, CoA Drops & Reading Live LogsPlanned
06 Profiler & Endpoint Identity 9 lessons planned
01M6 · Lab 1: Prepare Profiling — DHCP Relay, SPAN, SNMP, NetFlow Sources & the Endpoints to ProfilePlanned02How ISE Profiling Works: Attribute Dictionaries, Profiling Policies, Certainty Factors & the Endpoint DatabasePlanned03Profiling Probes: RADIUS, DHCP & DHCP-SPAN, SNMPQUERY/SNMPTRAP, HTTP, DNS, NMAP, NetFlow and Active DirectoryPlanned04Probe Data on the Wire: DHCP Relay, RADIUS Accounting & SNMP Query Packet WalkPlanned05Authoring Profiling Policies: Conditions, Logical Profiles, Policy Hierarchy & the Profiler Feed ServicePlanned06Configure Profiler CoA & Re-Authorization: Global Settings, Per-Policy CoA & Wired vs Wireless DifferencesPlanned07Endpoint Identity Management: Identity Groups, Static Assignment, Import/Export, Context Visibility & Purge RulesPlanned08Adaptive Network Control & pxGrid Consumption: Endpoint Quarantine, ANC Policies, MDM & Threat-Centric NAC AttributesPlanned09Troubleshooting Profiling: Unknown Endpoints, Wrong Profiles, Missing Probe Data & CoA That Never FiresPlanned
07 BYOD: Onboarding, Certificates & Lifecycle 10 lessons planned
01M7 · Lab 1: Prepare BYOD — Internal CA, SCEP RA to AD CS, the Provisioning SSID & a Personal DevicePlanned02Cisco BYOD: Use Cases, Requirements & Solution ComponentsPlanned03The BYOD Flows: Single-SSID vs Dual-SSID Onboarding, Step by StepPlanned04Certificates for BYOD: ISE Internal CA, SCEP RA to AD CS, Certificate Templates, Key Size & EAP-TLS TrustPlanned05BYOD Portals & Client Provisioning Policy: My Devices, BYOD Portal, Native Supplicant Profiles & the WizardPlanned06Dual-SSID Onboarding on the Wireless LAN Controller: Open Provisioning SSID to EAP-TLS Corporate SSIDPlanned07Wired BYOD: Onboarding Through the Switch with Redirect, IBNS 2.0 Service Templates & EAP-TLSPlanned08BYOD Lifecycle Operations: My Devices Portal, Lost/Stolen, Blocklist, Reinstate, Certificate Revocation & OCSPPlanned09MDM/UEM Integration: Registration and Compliance Attributes in Authorization Policy & Remote Device ActionsPlanned10Troubleshooting BYOD: Wizard Failures, SCEP Errors, Certificate Chain Problems & Onboarding LoopsPlanned
08 Endpoint Compliance & Posture 7 lessons planned
01M8 · Lab 1: Stage Posture — Secure Client Packages, Compliance Module & the Remediation SegmentPlanned02Endpoint Compliance & Posture Services: Agents, the Condition-Requirement-Policy Chain & Client ProvisioningPlanned03The Posture Flow: Discovery, Redirect vs Redirectless Stage-2 Discovery, Probing, Assessment & CoAPlanned04Posture Conditions & Requirements: File, Registry, Application, Anti-Malware, Disk Encryption, Patch & CompoundPlanned05Client Provisioning: Resources, Agent Configuration, Provisioning Policy & the Client Provisioning PortalPlanned06Configure Posture Assessment & Device CompliancePlanned07The Posture Work Center: Posture Policy in One Place, Remediation Actions, Grace Periods & ReportsPlanned
09 Network Access Device Administration (TACACS+) 7 lessons planned
01M9 · Lab 1: Enable the Device Admin Service — Policy Service Node, TACACS+ Licensing & the Managed DevicesPlanned02AAA Protocols Compared: RADIUS vs TACACS+ — Transport, Encryption, Packet Structure & AV PairsPlanned03Configure & Troubleshoot TACACS+ Device AdministrationPlanned04Device Admin Policy Sets: Network Device Groups, Conditions, AD Group Mapping & Rule OrderPlanned05Shell Profiles: Default & Maximum Privilege, Custom Attributes & Per-Platform Behaviour on IOS-XE, WLC & FTDPlanned06Command Authorization: Command Sets, Permit/Deny Ordering, Wildcards & Unmatched-Command BehaviourPlanned07Accounting & Troubleshooting Device Admin: TACACS+ Live Logs, Accounting Reports, Fallback Paths & Lockout RecoveryPlanned
01 Deployment: Firewall & NGIPS Modes 8 lessons planned
01M1 · Lab 1: Stand Up the SNCF Firewall Lab — FTD, FMC and the Traffic GeneratorsPlanned02Secure Firewall Platform Architecture: Threat Defense, FMC and the Snort/LINA SplitPlanned03Onboarding Threat Defense to FMC: Manager Modes, Registration and Initial SetupPlanned04Implementing Routed Mode: Interfaces, Security Zones and Sub-interfacesPlanned05Implementing Transparent Mode: Bridge Groups, BVIs and Layer 2 BehaviourPlanned06NGIPS Passive Deployment: Passive and ERSPAN InterfacesPlanned07NGIPS Inline Deployment: Inline Pairs, Inline Sets and Tap ModePlanned08Virtual Appliances and Cloud-Delivered Management: FTDv, FMCv and cdFMCPlanned
02 Deployment: High Availability and Scaling 7 lessons planned
01M2 · Lab 1: Add the Second Chassis - Failover Links, Port Channels and the Backup UpstreamPlanned02Choosing a Resiliency Model: HA Pair vs Clustering vs ECMP vs Port ChannelPlanned03Port Channels on Threat Defense: EtherChannel, LACP and Load BalancingPlanned04High Availability Pairs: Failover and State Links, Interface Monitoring, Split BrainPlanned05Equal-Cost Multipath: Traffic Zones and Multi-Homed Threat DefensePlanned06Static Route Tracking: SLA Monitors and Automatic Failover to a Backup ISPPlanned07Clustering Threat Defense: Cluster Control Link, Owner/Director/Forwarder RolesPlanned
03 Configuration: FMC System Settings, Objects and Device Management 14 lessons planned
01M3 · Lab 1: A Clean FMC - Domains, Licensing and the Managed DevicePlanned02FMC Administration: Users, Role-Based Access Control and External AuthenticationPlanned03FMC Maintenance: Time Synchronization and Backup and RestorePlanned04FMC Licensing and Software Updates: Smart Licensing, Geolocation, VDB and Rule UpdatesPlanned05Object Management at Scale: Overrides, Dynamic Objects and Bulk OperationsPlanned06Device Management: Platform Settings and Health PoliciesPlanned07Device Management: PKI Objects and Certificate EnrollmentPlanned08Network Settings I: Static and Dynamic Routing (OSPF, BGP)Planned09Network Settings I: Virtual Routing and Forwarding and Policy-Based RoutingPlanned10Network Settings I: QoS Policy - Classification, Policing and PrioritizationPlanned11Network Settings II: NAT on Threat Defense - Auto, Manual and Twice NATPlanned12Secure Access on Threat Defense: Site-to-Site VPN Topologies and Certificate-Based AuthenticationPlanned13Secure Access on Threat Defense: Remote-Access VPN with Cisco Secure ClientPlanned14Secure Access on Threat Defense: Zero Trust Access PolicyPlanned
04 Configuration: Security Policies and the Snort Engine 10 lessons planned
01M4 · Lab 1: Policy Bench - Attacker, Identity Sources and a Policy-Ready FMCPlanned02Firepower: Packet Processing & PoliciesPlanned03Snort 3 Inside Threat Defense: Inspectors, Binders, Rule Syntax and Snort 2 MigrationPlanned04Intrusion Rules as Objects: Writing, Importing and Grouping Custom Snort RulesPlanned05Firepower: Policies - PrefilterPlanned06Access Control Policy in Depth: Hierarchy, Inheritance, Rule Expansion and Logging StrategyPlanned07Security Intelligence and the DNS Policy: Feeds, Sinkholes and Encrypted DNSPlanned08Identity Policy: Realms, Passive Auth via ISE/pxGrid and Active Captive PortalPlanned09Network Analysis Policy: Preprocessors, Inline Normalization and Custom NAP TuningPlanned10Intrusion Policy Tuning: Rule Groups, Recommendations, Thresholds and Variable SetsPlanned
05 Configuration: Discovery, Correlation and Encrypted Visibility 4 lessons planned
01M5 · Lab 1: A Population to Discover - Mixed Hosts, Servers and Real Application TrafficPlanned02Network Discovery and Application Detectors: Building a Host Map You Can TrustPlanned03Correlation Policies: Rules, Compliance Allow Lists, Traffic Profiles and RemediationsPlanned04Encrypted Visibility Engine: Fingerprinting TLS Without Decrypting ItPlanned
06 Management and Troubleshooting: FMC, CLI and the Four Tools 7 lessons planned
01M6 · Lab 1: Break It on Purpose - A Lab Wired for DiagnosisPlanned02The Threat Defense CLI: FTD Shell, LINA and Expert ModePlanned03Troubleshooting from FMC: Deployment Failures, Message Center, Health Monitor and Troubleshoot FilesPlanned04Packet Capture Procedures: LINA Captures, Snort capture-traffic and Exporting to WiresharkPlanned05Packet Tracer: Proving Which Rule, NAT Statement or Route Made the DecisionPlanned06Firewall Engine Debug and System Support Trace: Watching Snort DecidePlanned07A Repeatable Workflow: From "The App Is Broken" to the Offending RulePlanned
07 Management: Events, Reporting and Management Platforms 6 lessons planned
01M7 · Lab 1: Something Worth Reporting On - Seeding Events Across Every PolicyPlanned02Dashboards and Reporting: Widgets, Custom Workflows, Report Templates and SchedulingPlanned03Event Analysis: Connection, Intrusion, Malware, Discovery and the Unified Event ViewerPlanned04Risk Reports, the Network Map and Indications of CompromisePlanned05Choosing a Manager: FMC vs Secure Firewall Device Manager vs Security Cloud ControlPlanned06Cisco Security Cloud Control: Cloud-Delivered Firewall ManagementPlanned
08 Integration: Malware Defense, Endpoint, Threat Intel and the SOC Stack 10 lessons planned
01M8 · Lab 1: Wire the Ecosystem - Endpoints, ISE, Feeds and the Cloud ConsolesPlanned02Malware Defense: File Policies, Dispositions, Dynamic Analysis and RetrospectionPlanned03Integrating Secure Endpoint with FMC: Connection, Event Streaming and Endpoint IoCsPlanned04Security Intelligence: Authoring, Sharing & ConsumptionPlanned05Threat Intelligence Director: STIX/TAXII Feeds, Observables, Incidents and ElementsPlanned06FMC and ISE over pxGrid: Identity Mapping, SGT Exchange and Session AwarenessPlanned07Rapid Threat Containment: Remediation Modules, ANC Policies and Automatic QuarantinePlanned08Cisco XDR Investigations Driven from the FirewallPlanned09Off-Box Logging I: Cisco Security Analytics and Logging (SaaS and On-Prem)Planned10Off-Box Logging II: Splunk Integration and AI-Driven Threat IntelligencePlanned