CCNP Security SVPN (300-730) Training Part-1/2

Download and import the dmvpn labs, workbook, and topology resources for eve-ng, then follow the step-by-step lab workbook to practice main mode and aggressive mode configurations.

Demonstrates site-to-site IPsec using ESP and AH, compares tunnel and transport modes, explains encryption, authentication, and anti-replay, and verifies policies with a hands-on lab topology.

configure a site-to-site ipsec vpn on two Cisco routers using ikev1, pre-shared key, phase one and phase two settings, and an interesting traffic acl.

verify site-to-site ipsec vpn between r1 and r2 using debug crypto isakmp and Wireshark; observe phase one and phase two exchanges, including encryption, hashing, and pre-shared key authentication.

Identify and fix phase one issues in a site-to-site IPsec VPN by testing mismatched encryption, hash algorithm, Diffie-Hellman group, authentication, or pre-shared key, using debug crypto and policy checks.

Troubleshoot phase two ipsec by diagnosing transform set mismatches and acl errors; use debug crypto ipsec and show commands to verify with isakmp, ipsec, and crypto map.

Configure a site-to-site IPsec VPN on Cisco routers with overlapping subnets, using NAT outside/inside and static NAT to map private networks and verify with IPsec SA and translations.

Configure site-to-site ipsec vpn ikev1 with nat between two private subnets (192.168.1.0/24 and 192.168.2.0/24), implement nat exemption, and verify with show commands and pings.

Configure a site-to-site ipsec vpn between Cisco routers when one side has a dynamic ip, using a dynamic crypto map attached to a static map, with dhcp on isp and verify phase one and two.

Configure a site-to-site ipsec vpn between a Cisco router and RSA using ikev1, implementing phase 1 and 2, crypto maps, and testing with PC one and PC two.

Configure site-to-site IPsec vpn between two Cisco RSA firewalls using ECC version 1 and IKEv1, establishing a tunnel for 192.168.1.0/24 to 192.168.2.0/24 traffic with ESP, ACL, and crypto map.

Demonstrates verifying site-to-site ipsec vpn phase one modes—main mode (six packets) and aggressive mode (three packets)—using a three-router topology, with practical testing via show crypto and wireshark.

Configure site-to-multi site ipsec vpn using ikev1 between head office and two branches (R1 to R2 and R1 to R3), with two tunnels and a crypto map applying distinct policies.

Configure a full mesh ipsec vpn using ikev1 with esp between three routers, building two tunnels per device, using public ips 1.1.1.1, 2.2.2.2, 3.3.3.3 and subnets 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24.

Discover how generic routing encapsulation, a Cisco tunneling protocol, creates a layer 3 tunnel to carry multicast traffic, not encrypted by default, with a secure site-to-site VPN added.

Build a GRE over IPsec site-to-site VPN lab between R1 and R2 across an ISP, enabling multicast traffic and securing the tunnel with IPsec (ESP) using OSPF or RIP.

Explore Cisco DMVPN, a dynamic multipoint IPsec solution that uses hub-and-spoke architecture to enable partial or full mesh connectivity with a single hub tunnel and on-demand spoke-to-spoke links.

Explore DMVPN deployment across three methods: phase one hub-to-spoke, and phases two and three with spoke-to-spoke tunnels using Mgr on both sides.

Describe dmvpn terminologies including NBMA addresses, NHS and NHC roles, and tunnel IP addresses used to map private and public addresses.

Dmvpn uses multipoint tunnels and point-to-point tunnels for hub-to-spoke and spoke-to-spoke connectivity. It relies on nhrp to map nbma addresses to logical tunnel addresses via a hub and spokes.

Understand dmvpn network designs across phase one hub-to-spoke, phase two spoke-to-spoke, and phase three with route summarization and direct spoke communication.

Set up dmvpn phase one with hub and spoke tunnels, assign tunnel and logical IPs, enable vpn authentication, ip nhrp mappings, multicast dynamic routing, and explain phase one terminology.

Explore dmvpn phase one essentials: no ip redirect on the hub, multipoint tunnel mode, tunnel source/destination, and static versus dynamic nhrp mappings.

Configure dmvpn phase two to enable multipoint gre tunnels across hub and spoke routers, remove manual destinations, implement ip nhrp mappings, and verify routing with phase-two commands.

Configure dmvpn phase three in a hub-and-spoke lab, adding ntp redirect on the hub and ntp shortcut on the spokes, and implement tunnel, nhrp mapping, and routing configuration.

Discover how IPsec secures DMVPN traffic by configuring phase one, transform sets, and a profile in transport mode, including port considerations and MTU tuning.

secure dmvpn phase 3 with ipsec by configuring crypto map and isakmp, then transform set and ipsec profile. verify encryption with show crypto isakmp and show crypto ipsec sa.

Learn DMVPN troubleshooting starting at the spoke site by verifying http registration and observing NRHP registration messages. Use phase three configuration and commands to verify hub-spoke dynamics and multicast mappings.

Learn to configure site-to-site ipsec vpn using ikev2 between r1 and r2 with isp, using private subnets 192.168.1.0/24 and 192.168.2.0/24, with pre-shared keys, proposals, policies, and acl-based traffic.

Configure a site-to-site IPsec VPN on a Cisco ASA using IKEv2, including policy creation, IPsec proposal, tunnel group, pre-shared keys, crypto map, and verification commands.