CCIE Security V6 Lab Exam Review

Configure active standby high availability for the ASA at the internet edge. Set management to .53/.54, non-management to .1/.2, and failover link to .1/.2, ensuring ASA1v remains active.

Learn to configure multi-context Cisco ASA with C1 and C2 contexts, VLAN subinterfaces, failover, NAT, and access policies to expose sales and finance servers via DMZ.

Configure a two-node ASA AnyConnect IPsec VPN with active-standby, using ISE and Active Directory for authentication, dynamic ACLs, and two split-tunnel profiles for sales and finance.

Configure Stealthwatch with NetFlow to monitor ICMP traffic, enforce a 10-point concern threshold, auto-block for five minutes, and forward raw flows from R9 to the NetFlow collector and console.

Configure active standby high availability for the ASA in intranet edge two, establishing management and non-management interfaces with correct octets and setting failover IPs to ensure a synchronized active pair.

Configure a two ASA cluster (ASA3 master, ASA4 slave) with a four-link port channel, inter-area OSPF, and mgmt/inside/dmz/outside subinterfaces, plus NAT and clientless SSL VPN.

Configure SSL clientless VPN using CLI and ASDM, integrating ISE with Active Directory, and define RADIUS authentication, group policies, and web VPN bookmarks for marketing and engineering access.

Configure a site-to-site IPsec VPN between FTDs, using predefined objects, deploy routing, and enforce DNS, engineering, and NTP traffic, then verify end-to-end connectivity and time synchronization.

Configure ngips with 802.1x, amp, and zone-based firewall to allow only https from the Windows host to the engineering server, while monitoring events in FMC.

Configure 802.1x with ISE and Active Directory, push dynamic VLANs, and enforce per-user access to the tag server, DNS, and Cisco AMP cloud.

Configure the syslog server first to collect zone-based firewall logs, fix the incorrect origin tag for CSI_lab_R13, and enable logging with the correct host, console messages, and trap debugging messages.

Configure a zone-based firewall to protect the engineering server from ddos by inspecting https traffic and limiting half-open tcp sessions. Use port 443 in acl.

Explore integrating Cisco AMP with Firepower services and FMC, configure 1x authentication and licensing, and install the AMP connector on a Windows PC to connect with IPS.

MAB authentication and map authentication on switches using ISE, with endpoint profiling for Windows 10, dynamic VLAN assignment to 305, and access control to the intranet server.

Configure a PCP client and WCCP v2 web cache redirect to proxy intranet http traffic, authenticating contractor user one via Active Directory, permitting only show ip http server history page.

Correct the arp access list to permit the proper mac addresses for R5 and R4, resolving dynamic arp inspection issues. Enable ospf neighbor formation and verify reachability by pinging 192.168.125.125.

This lecture demonstrates configuring a flex vpn between two routers to create a layer-2 ipsec tunnel, enabling ibgp neighborship and secure traffic over the 172.16.200.0 network.

Learn to configure SXP peering with ISE for onboarding a QA PC, using Active Directory as the external identity source and security group tags.

Migrate the ice to the DNA center, create security group tags for QA PC and intranet, and implement port-specific policy that logs packets on switch seven and permits TCP traffic.

Troubleshoot clock skew in ISE by aligning Active Directory time, zeroing clock dispersion, and configuring a shared NTP server and time zone to synchronize with Active Directory.