CCNP Enterprise: ENARSI 300-410 Training Part-2/2

Explore theory of device security using IOS AAA, explaining authentication, authorization, and accounting, and how RADIUS and TACACS+ protect network access and device administration.

Compare TACACS+ and RADIUS in Cisco ISE for AAA; TACACS+ for device administration with packet encryption and command-level authorization; RADIUS for network access authentication and accounting with password encryption only.

Secure routers through device hardening by using enable secret, MD5/SHA hashing, strong console and virtual terminal line protections, and by enabling ssh with rsa keys and access controls.

Master IPv4 access control lists by applying standard and extended acl on interfaces, using permit or deny, top-to-bottom, inbound or outbound, with time-based and infrastructure acl variants.

Block a single source ip with a standard ipv4 access control list, apply it on the correct interface in or out, and verify with logs and wildcards.

Explore extended IPv4 access control lists that specify source, destination, and protocol, apply near the source, block traffic such as TCP port 80, and manage implicit deny through top-to-bottom ordering.

Explore named IPv4 access control lists, comparing standard and extended ACL, using name-based ACL for easy modification, applying with IP access-group, and logging Telnet and HTTP traffic.

Configure time based access control lists by creating time ranges and applying them to interfaces. Choose absolute or periodic schedules, specify weekdays and 24-hour times, and verify with show access-list.

Explore infrastructure iACL IPv4 ACL list, a technique used by ISPs and enterprises to block private ranges and other disallowed traffic at the edge router, protecting the enterprise.

Learn how unicast reverse path forwarding (uRPF) on Cisco routers protects networks from IP spoofing by verifying destination routing and the source address, with strict and loose modes.

Demonstrates unicast reverse path forwarding (uRPF) lab: configure ip verify unicast on two interfaces, compare strict and loose modes, test spoofed and valid sources, and observe drops.

Secure the control plane using policing and protection to guard device-to-device traffic from UDP and ICMP floods, with policy-map, class-map, and ACL configurations.

Discover device management via console ports and VTY lines for secure, out-of-band access, and compare Telnet and SSH with version 2 and RSA keys.

Configure and verify secure device management by securing the console with password and login local, enabling vty access, and implementing ssh with rsa keys and access-control lists.

Troubleshoot console access by confirming 9600 baud, locating the correct COM port in device manager, and installing USB-to-serial drivers. Check ACLs and firewalls that block telnet or ssh.

Configure and verify http and https on Cisco routers, compare tcp based http and secure https, and access the device graphically with local credentials.

Verify reachability between client and server, enable http and https servers, and use credentials with privilege level 15. Check ACLs, port correctness, and review logs to diagnose access issues.

Enable scp for secure copying of files between Cisco routers, switches, and your system. Copy startup and running configurations or images via port 22 with ssh for device management.

Troubleshoot device management via ssh and scp by verifying ACP configuration, authentication and authorization commands, RSA and crypto keys, and that port 22 is allowed by ACL and firewall.

Explore two file transfer protocols for device management, DFP (UDP-based) and FPP (TCP-based), used for copying, backing up, restoring, and upgrading router, switch, and firewall operating systems.

Explore SNMP, a UDP-based application protocol using a manager, agents, and MIB to retrieve data via get, get next, get bulk, set, and inform messages on ports 161/162.

Configure snmp version 2 on an mp manager by setting the community string, enabling trap messages, and specifying the ip address; then verify with get, get next, and set.

Learn to configure and verify SNMP version 3 in three modes: no authentication and no privacy, authentication with no privacy, and authentication with privacy, using groups, users, and trap logging.

Explore how syslog and device logging work on routers and switches, including local, console, buffer, and remote log servers, with severity levels and practical monitoring.

Configure logging on r1 by setting a logging host to the syslog server, selecting severity levels, enabling console or remote logs, and verifying the log buffer.

Learn to troubleshoot syslog by configuring the syslog server IP and UDP port 514, validating reachability, and enabling terminal monitoring to view logs from the correct interface.

Use debug and conditional debug to reveal real-time device messages for troubleshooting, but limit burden on CPU and RAM by filtering to specific interfaces or protocols.

Discover Cisco NetFlow, a UDP-based protocol that collects IP traffic flow data from routers and switches and exports it to a central server for analysis and monitoring.

Configure NetFlow on a router to export traffic to a NetFlow collector and verify with show ip flow export, enabling top talker analysis and protocol details.

Explore ip sla and service level agreements to monitor network performance and implement automatic failover between isp 1 and isp 2 using icmp echo probes and floating static routes.

Explore the dynamic host configuration protocol and how it assigns IP, subnet, gateway, and DNS. Follow the discovery, offer, request, and acknowledgement flow and DHCP relay with an ATP server.

Configure and verify a DHCP server by creating a pool, excluding addresses, assigning network, gateway, DNS, and domain name, setting lease times, and validating bindings across Windows, Linux, and routers.

Configure and verify dhcp relay across a three-router setup, using an ip helper address to forward broadcast dhcp requests as unicast to the dhcp server.

Discover Cisco DNA Center as a centralized architecture that unifies your network devices, policies, and topology from a single dashboard, enabling design, provisioning, health checks, and automated upgrades.

Cryptography protects data in motion by converting plaintext to ciphertext with a symmetric algorithm and key, enabling decryption by the receiver and guarding against the man in the middle.

explain symmetric and asymmetric encryption, where a single key encrypts and decrypts data in symmetric schemes, while public and private keys govern encryption and decryption in asymmetric systems.

Explore hashing concepts with MD5 and SHA, a one-way function for data integrity in VPN. Learn about hash message authentication code and encryption standards like DES, 3DES, and AES.

Explore how Diffie-Hellman groups enable secure key exchange for VPN encryption, covering group numbers, primes, and generators that shape encryption strength.

Discover IPsec as a basic open standard that provides confidentiality, integrity, and authentication for remote access and site-to-site VPNs, using encryption algorithms, anti-replay, and certificate-based authentication.

Demonstrate the differences between IPsec ESP and AH, emphasizing encryption vs. authentication, integrity, and replay protection, using tunnel and transport modes with real capture analysis.

Learn how virtual private networks create secure tunnels over the public internet to connect branches and remote users, delivering confidentiality, integrity, and authentication via IPsec and SSL VPN.

Learn how Internet key exchange (IKE) negotiates security associations for IPsec, covering phase one and phase two (quick mode), initiator and responder roles, and UDP port 500.

Explore how IKE secures connections through phase one and phase two, using main mode and aggressive mode, with initiator and responder exchanging information on authentication methods and encryption details.

Explore generic routing encapsulation (GRE), a Cisco tunneling protocol that carries layer 3 traffic and supports multicast. It is not encrypted by default and can be secured with IPsec.

Configure a gre tunnel between routers, set tunnel source and destination, assign logical and tunnel ip addresses, and secure multicast traffic with ipsec encryption and a crypto map policy.

Explore DMVPN, a dynamic multipoint VPN that provides zero-configuration hub-and-spoke to full-mesh connectivity, and learn phase one, two, and three deployment models.

Learn to configure DMVPN phase 1 in a hub-and-spoke topology, using multipoint VPN, with static/dynamic registration, panel concepts, and IPsec guidance for encryption.