CCNA Security 2019 210-260 Video Boot Camp With Chris Bryant

Explore how mac spoofing masks a device's mac address and how cam table overflows flood switches, forcing hub-like behavior; learn port security to defend dynamic and static entries.

Explore port security fundamentals on Cisco switches, configuring trusted and non-trusted MAC addresses, per-port actions, and the aging, maximum, and violation modes that govern secure access.

Explore port security on layer 2 and layer 3 switches, including the default limit of one secure address per port, dynamically learned addresses, and the role of static addresses.

Explore how port security on a switch dynamically learns Mac addresses with a default of one, then a violation shuts down the port and triggers an error-disabled state.

Configure port security on switches to mix static and dynamic MACs, keep the maximum addresses low (two), and use error disable recovery carefully for violations.

Explore port security aging, comparing dynamic and static MAC entries, and learn aging commands, time units, and aging types (absolute and inactivity) with practical examples.

Refresh your VLAN knowledge by exploring how private VLAN configurations isolate groups, limit broadcast domains, and prevent broadcast storms, while using show vlan and show cdp neighbor for validation.

Explore private VLAN theory by defining promiscuous, community, and isolated ports, and mapping primary and secondary private VLANs with practical lab exercises and exam-ready commands.

Investigate ospf clear-text authentication by enabling interface passwords, adjusting network types to point-to-point, and debugging adjacencies to verify that mismatched keys disrupt and restore adjacencies.

Root guard protects the root election in a switch network by discarding superior BPDU on guarded ports and placing the port in route inconsistent state until the issue is resolved.

Explore BPDU guard and loop guard to prevent rogue BPDU, block compromised ports, and maintain loop-free networks; configure globally or per interface, and understand port fast interactions.

the lecture covers vlan acls on a multilayer switch, using a lan access map to drop traffic from hosts 10.1.1.1 to 10.1.1.3 while allowing other 10.1.1.0/24 traffic.

Explore vlan hopping and double tagging, focusing on native vlan and trunking, and implement defenses such as dtp control, nonessential ports closed, and dhcp snooping prep.

Demonstrate DHCP snooping for a device's first-time IP address acquisition, configuring trusted ports, and verifying assignments with show interface and debug outputs.

Explore IP source guard and how it prevents a host from spoofing another IP address, using DHCP snooping and the switch's binding database.

Demonstrate IP source guard in action with DHCP snooping, verifying source addresses and diagnosing packet drops when a hardcoded router bypasses DHCP. Discuss port security basics.

Learn to configure ip source guard with static bindings in a dhcp-snooping-free lab, including per-vlan bindings and manual mac-to-ip mappings, then test connectivity.

We continue covering Section 4 of the blueprint while separating the attack content into a privilege level section to keep videos organized and navigable.

Explore privilege levels from user exec to enable in practical labs, and see how commands like show privilege and show run work with username password, enable password, and enable secret.

Explore the three default privilege levels (0, 1, 15), assign users with the username password command, and preview custom privilege levels and the auto command feature for real-world admin control.

Set up autocommand and one-time password options to control access after login, showing the output of commands like show ip route, with privilege level 9 and no password.

Explore how privilege levels shape show run visibility, showing admin access versus help desk limitations, and how one-time passwords remove user records from the database.

Configure a parser view to let a helpdesk user run all show commands, while restricting other actions; enable interface configuration with ip address and no shutdown, and explore supervisor views.

Learn to configure views for AAA authentication on Cisco routers, tie the views to the console port, and troubleshoot why a loaded view may not apply during login.

Explore the lawful intercept lifecycle in the CCNA security course: data collection, mediation formatting, and delivery to law enforcement, with warrants, legal obligations, and Cisco’s mediation device landscape.

Learn how Cisco IOS resilient configuration enables quick recovery from startup config loss by archiving the running config and the iOS image locally, with remote enablement.

Restore the resilient config from flash, use configure replace to load it as the running config, then save to startup config.

Learn to manage router flash and secure boot images, including viewing, archiving, and formatting, and to update the running and archived configurations for reliable image recovery.

Discover the control plane's role in path discovery and routing, and learn to configure control plane policing with class maps, policy maps, and MQC to protect the router's control plane.

learn how to implement CoPP with class maps and ACLs to identify and police OSPF traffic, block fragments, and safeguard the control plane.

Configure policy maps and class maps for CoPP by creating an OSPF policy, mapping fragments, and applying a service policy to the control plane in both input and output.

Learn to implement and verify control plane protection (CoPP) and CPR with a five-step workflow using ACLs, class maps, and policy maps, and verify via show policy map control plane.

Explore site-to-site vpn theory with ipsec, including ah and esp, ike phases, sa negotiation, and the tradeoffs of tunnel versus transport mode, plus overhead considerations.

Examine site-to-site vpn implementation with IPsec, ISAKMP phases 1 and 2, and IKE policies, contrasting tunnel and transport modes, and outlining the five-step process from interesting traffic to tunnel termination.

Configure a site-to-site vpn by building an isakmp policy, choosing authentication and encryption options (pre-shared keys, des, 3des, aes), and understanding policy priority and lifetime.

Configure the ISAKMP policy for VPN by avoiding MD5, selecting a 2048-bit Diffie-Hellman group (group 14), and setting phase 1 lifetimes and custom policies.

Configure a non-default ISAKMP policy with 256 encryption, sha-256, pre-shared authentication, and a 60000-second lifetime; set dh group to 14 and configure the remote pre-shared key.

Identify and configure crypto acls as interesting traffic for site-to-site vpn, and apply ipsec protection to outbound and inbound traffic using a mirror image extended acl.

Test and troubleshoot a site-to-site vpn by pinging traffic and analyzing ike phase 1 negotiations. Fix hash mismatches with show crypto commands to restore the tunnel.

Explore vpn crypto maps, debug isakmp and ike flows, recognize udp port 500, phase 1/2, transform sets, and how diffie-hellman groups secure key exchange.

Review IKE phase 1 and phase 2 exchanges and IPsec security associations during a tunnel build, and note UDP ports 500 and 4500 and NAT traversal.

Explore how Diffie-Hellman enables a secure key exchange over a non-secure channel using a color-based illustration with Alice and Bob, and understand the role of HMAC for authentication and integrity.

Demonstrates building a site-to-site vpn with the ASDM launcher, configuring a routed firewall, and using the vpn wizards to set ipsec parameters while addressing java and certificate warnings.

Wrap up the first adsm vpn build by configuring ssl vpn in internet explorer, validating intuitive group names, login trust, and reviewing mobility client settings, ipv4/ipv6 tunneling, and connection flow.

Learn how firewalls stop dangerous traffic while allowing legitimate data, integrate into defense in depth, and require ongoing policy updates, tuning, and awareness of stateful firewalling and other types.

Explore personal firewalls, per-user and per-device policies, white-listing and black-listing, prompts for non-approved access, and the importance of pre-installation device scanning.

Explore zone based firewall concepts—zones, zone pairs, and the permit versus inspect behavior—covering inside and outside traffic and the DMZ.

Learn how a DMZ middle zone protects the inside network by hosting public servers in a DMZ, with single or dual firewall setups, and manage traffic and multicast caveats.

Define ip addressing for firewall labs, with inside trusted 10.1.1.1/24 on fastethernet 0/0 and outside untrusted 2.1.1.1/24 on fastethernet 0/1; loopback prepared for advanced wizard.

Build practical firewall skills by using CCP to run basic and advanced firewall wizards, apply predefined rules, and configure class maps and service policies across inside and outside interfaces.

Learn advanced firewall wizard concepts, including unicast reverse path forwarding, dmz configuration with a loopback, and pki setup with a self-signed certificate, plus practical lab troubleshooting tips.

Conclude the advanced firewall wizard lab by selecting security levels, exploring class maps and policy maps, configuring DNS, and applying and saving the running configuration to startup configuration.

Learn the basics of ASA firewalling, including numeric security levels (0–100) for inside, outside, and DMZ interfaces, and how traffic flows downstream with state table and ACLs.

Configure a new Cisco ASA firewall from the command line, learn the default login (press enter), and set up inside, outside, and a DMZ with appropriate security levels.

Configure the outside, inside, and dmz interfaces with IP addresses and security levels. Enable the interfaces, apply the changes, and verify the outside interface status.

Configure the outside, dmz, and inside interfaces in asdm, assign static ips, save and apply changes, and test connectivity with ping while shaping firewall access to the dmz.

Open outside interface to reach the dmz host 11.1.1.2 by configuring access rules and network objects, and learn how interface rules precede global rules and implicit rules function.

Explore how a global any any permit IP any any rule dominates interface rules, and how applying it affects connectivity, hits, and logging on a DMZ ping test.

Compare intrusion prevention systems and intrusion detection systems by their network placement and traffic handling, where IDS uses mirrored out-of-band traffic and raises alarms, and IPS is inline and actionable.

Explains inline mode traffic controls with six deny or modify actions, versus promiscuous mode, and covers signatures, policies, anomaly detection, and bad reputation for network protection.

Configure ips using the ips wizard, discover the router, set up ips rules, signature definitions, and sdee loading, including sources from flash or url, with built-in signatures as backup.

Edit signatures in the CCP lab by changing severity and actions (alarm, deny inline, drop, reset), managing built-in and backup SDF signatures. Expect a 15–20 second delivery delay.

Learn how to load and update Cisco IPS signatures, compare built-in and backup signature files, monitor threats and IPS status, and review hits, drop counts, and logs to detect anomalies.

Explore hips, nips, and wips—host- and network-wide intrusion prevention—contrast signatures with anomaly detection, and learn how a layered security approach protects desktops and the entire network.

Explore nat and pat basics, including inside local, inside global, outside local, and outside global addresses, private ip ranges, and translation dynamics with static and dynamic nat.

Learn how static NAT provides a mapping from inside local to inside global addresses using ACLs to identify hosts, and why dynamic NAT with an address pool suits larger networks.

Configure dynamic NAT using an address pool and ACLs, map inside local to pool addresses, verify translations with pings, and manage dynamic entries with clear ip nat translations.

Master pat: translate many inside hosts to one public ip via port numbers. Build the config with acls and ip nat inside/outside, then verify translations with show ip nat translations.

Learn how synchronized time supports accurate logs and secure certificates, and how the network time protocol uses stratum levels and server, client, and peer relationships.

Configure a master and client in an NTP client-server lab, verify reference clocks and stratum levels, and confirm clock synchronization across routers.

Configure network time protocol peering to synchronize routers over the 172.23.0.0/24 network, verify time with show clock and show ntp associations, and observe stratum levels from reference to peers.

Configure ntp broadcast mode by enabling a master to broadcast time information over a specific interface and have clients listen, ensuring association and clock synchronization.

Master ntp authentication debugging in Cisco routers by configuring trusted keys, validating key parity, and using show commands to confirm clock synchronization with a time server.

Configure a second time server for redundancy, set master and authentication key, trust the key, and verify how routers select and synchronize with multiple ntp servers.

Troubleshoot NTP time sources and AP time servers using show ap association detail, apply prefer, and verify synchronization with clock detail to prevent single points of failure.

Understand triple-a basics—authentication, authorization, and accounting—and compare tech x plus and radius, including self-contained deployments, per-command authorization, and packet encryption differences.

Walk through configuring tacacs and radius servers on a Cisco switch, enabling aaa, setting server addresses and keys, encrypting passwords, and applying authentication to vty lines.

Configure a radius server and encryption keys, enable 802.1x authentication, and explore port security with auto, force authorized, and force unauthorized states on per-interface ports.

Trace the TCAP finite state machine from closed to listening, sin received, established, finish, fin wait, close wait, and time wait states.