CCNA Security 2019 210-260 Video Boot Camp With Chris Bryant

Explore how mac spoofing masks a device's mac address and how cam table overflows flood switches, forcing hub-like behavior; learn port security to defend dynamic and static entries.

Explore port security fundamentals on Cisco switches, configuring trusted and non-trusted MAC addresses, per-port actions, and the aging, maximum, and violation modes that govern secure access.

Explore port security on layer 2 and layer 3 switches, including the default limit of one secure address per port, dynamically learned addresses, and the role of static addresses.

Explore how port security on a switch dynamically learns Mac addresses with a default of one, then a violation shuts down the port and triggers an error-disabled state.

Configure port security on switches to mix static and dynamic MACs, keep the maximum addresses low (two), and use error disable recovery carefully for violations.

Explore port security aging, comparing dynamic and static MAC entries, and learn aging commands, time units, and aging types (absolute and inactivity) with practical examples.

Refresh your VLAN knowledge by exploring how private VLAN configurations isolate groups, limit broadcast domains, and prevent broadcast storms, while using show vlan and show cdp neighbor for validation.

Explore private VLAN theory by defining promiscuous, community, and isolated ports, and mapping primary and secondary private VLANs with practical lab exercises and exam-ready commands.

Investigate ospf clear-text authentication by enabling interface passwords, adjusting network types to point-to-point, and debugging adjacencies to verify that mismatched keys disrupt and restore adjacencies.

Demonstrate DHCP snooping for a device's first-time IP address acquisition, configuring trusted ports, and verifying assignments with show interface and debug outputs.

Demonstrate IP source guard in action with DHCP snooping, verifying source addresses and diagnosing packet drops when a hardcoded router bypasses DHCP. Discuss port security basics.

Learn to configure ip source guard with static bindings in a dhcp-snooping-free lab, including per-vlan bindings and manual mac-to-ip mappings, then test connectivity.

We continue covering Section 4 of the blueprint while separating the attack content into a privilege level section to keep videos organized and navigable.

Explore privilege levels from user exec to enable in practical labs, and see how commands like show privilege and show run work with username password, enable password, and enable secret.

Explore the three default privilege levels (0, 1, 15), assign users with the username password command, and preview custom privilege levels and the auto command feature for real-world admin control.

Set up autocommand and one-time password options to control access after login, showing the output of commands like show ip route, with privilege level 9 and no password.

Learn to configure views for AAA authentication on Cisco routers, tie the views to the console port, and troubleshoot why a loaded view may not apply during login.

Explore the lawful intercept lifecycle in the CCNA security course: data collection, mediation formatting, and delivery to law enforcement, with warrants, legal obligations, and Cisco’s mediation device landscape.

Learn how Cisco IOS resilient configuration enables quick recovery from startup config loss by archiving the running config and the iOS image locally, with remote enablement.

Restore the resilient config from flash, use configure replace to load it as the running config, then save to startup config.

Learn to manage router flash and secure boot images, including viewing, archiving, and formatting, and to update the running and archived configurations for reliable image recovery.

Discover the control plane's role in path discovery and routing, and learn to configure control plane policing with class maps, policy maps, and MQC to protect the router's control plane.

learn how to implement CoPP with class maps and ACLs to identify and police OSPF traffic, block fragments, and safeguard the control plane.

Learn to implement and verify control plane protection (CoPP) and CPR with a five-step workflow using ACLs, class maps, and policy maps, and verify via show policy map control plane.

Configure a site-to-site vpn by building an isakmp policy, choosing authentication and encryption options (pre-shared keys, des, 3des, aes), and understanding policy priority and lifetime.

Configure the ISAKMP policy for VPN by avoiding MD5, selecting a 2048-bit Diffie-Hellman group (group 14), and setting phase 1 lifetimes and custom policies.

Test and troubleshoot a site-to-site vpn by pinging traffic and analyzing ike phase 1 negotiations. Fix hash mismatches with show crypto commands to restore the tunnel.

Explore vpn crypto maps, debug isakmp and ike flows, recognize udp port 500, phase 1/2, transform sets, and how diffie-hellman groups secure key exchange.

Review IKE phase 1 and phase 2 exchanges and IPsec security associations during a tunnel build, and note UDP ports 500 and 4500 and NAT traversal.

Explore how Diffie-Hellman enables a secure key exchange over a non-secure channel using a color-based illustration with Alice and Bob, and understand the role of HMAC for authentication and integrity.

Demonstrates building a site-to-site vpn with the ASDM launcher, configuring a routed firewall, and using the vpn wizards to set ipsec parameters while addressing java and certificate warnings.

Wrap up the first adsm vpn build by configuring ssl vpn in internet explorer, validating intuitive group names, login trust, and reviewing mobility client settings, ipv4/ipv6 tunneling, and connection flow.

Learn how firewalls stop dangerous traffic while allowing legitimate data, integrate into defense in depth, and require ongoing policy updates, tuning, and awareness of stateful firewalling and other types.

Explore zone based firewall concepts—zones, zone pairs, and the permit versus inspect behavior—covering inside and outside traffic and the DMZ.

Build practical firewall skills by using CCP to run basic and advanced firewall wizards, apply predefined rules, and configure class maps and service policies across inside and outside interfaces.

Learn advanced firewall wizard concepts, including unicast reverse path forwarding, dmz configuration with a loopback, and pki setup with a self-signed certificate, plus practical lab troubleshooting tips.

Conclude the advanced firewall wizard lab by selecting security levels, exploring class maps and policy maps, configuring DNS, and applying and saving the running configuration to startup configuration.

Learn the basics of ASA firewalling, including numeric security levels (0–100) for inside, outside, and DMZ interfaces, and how traffic flows downstream with state table and ACLs.

Open outside interface to reach the dmz host 11.1.1.2 by configuring access rules and network objects, and learn how interface rules precede global rules and implicit rules function.

Explains inline mode traffic controls with six deny or modify actions, versus promiscuous mode, and covers signatures, policies, anomaly detection, and bad reputation for network protection.

Configure ips using the ips wizard, discover the router, set up ips rules, signature definitions, and sdee loading, including sources from flash or url, with built-in signatures as backup.

Edit signatures in the CCP lab by changing severity and actions (alarm, deny inline, drop, reset), managing built-in and backup SDF signatures. Expect a 15–20 second delivery delay.

Learn how to load and update Cisco IPS signatures, compare built-in and backup signature files, monitor threats and IPS status, and review hits, drop counts, and logs to detect anomalies.

Explore hips, nips, and wips—host- and network-wide intrusion prevention—contrast signatures with anomaly detection, and learn how a layered security approach protects desktops and the entire network.

Explore nat and pat basics, including inside local, inside global, outside local, and outside global addresses, private ip ranges, and translation dynamics with static and dynamic nat.

Configure dynamic NAT using an address pool and ACLs, map inside local to pool addresses, verify translations with pings, and manage dynamic entries with clear ip nat translations.

Master pat: translate many inside hosts to one public ip via port numbers. Build the config with acls and ip nat inside/outside, then verify translations with show ip nat translations.

Learn how synchronized time supports accurate logs and secure certificates, and how the network time protocol uses stratum levels and server, client, and peer relationships.

Configure a master and client in an NTP client-server lab, verify reference clocks and stratum levels, and confirm clock synchronization across routers.

Master ntp authentication debugging in Cisco routers by configuring trusted keys, validating key parity, and using show commands to confirm clock synchronization with a time server.

Configure a second time server for redundancy, set master and authentication key, trust the key, and verify how routers select and synchronize with multiple ntp servers.

Troubleshoot NTP time sources and AP time servers using show ap association detail, apply prefer, and verify synchronization with clock detail to prevent single points of failure.

Walk through configuring tacacs and radius servers on a Cisco switch, enabling aaa, setting server addresses and keys, encrypting passwords, and applying authentication to vty lines.

Configure a radius server and encryption keys, enable 802.1x authentication, and explore port security with auto, force authorized, and force unauthorized states on per-interface ports.

Trace the TCAP finite state machine from closed to listening, sin received, established, finish, fin wait, close wait, and time wait states.