CCNA Security online course

CCNA Security Online Course: Securing Cisco Networks

Learn foundational Cisco network security: IOS hardening, AAA, ACLs, Layer 2 protection, firewalls, IPS, cryptography, IPsec VPNs, monitoring, and troubleshooting.

This course teaches the foundational skills used to secure Cisco routers, switches, and the networks connected to them. You will combine networking knowledge with security policy, Cisco IOS configuration, validation, logging, and troubleshooting.

The material is aligned with the type of knowledge covered by the legacy CCNA Security and IINS objectives. Certification names, exam identifiers, and detailed objectives change over time, but the underlying skills—secure administration, access control, segmentation, monitoring, and protected connectivity—remain useful.

Course orientation and security role

Routing decides where Layer 3 traffic travels. Switching forwards frames within local networks and VLANs. Administration provides controlled access to devices, while security ensures that routing, switching, management, and connected services behave according to an approved policy.

A security administrator does not treat security as a separate configuration added after the network is built. Secure design begins with trusted management paths, appropriate segmentation, least privilege, hardened interfaces, protected credentials, reliable logs, and repeatable validation.

Expect a combination of theory and practical work. Labs should follow this cycle:

1. Document the intended policy and permitted traffic.
2. Configure one security control at a time.
3. Validate both permitted and denied behavior.
4. Review counters, logs, and device state.
5. Save a known-good configuration and record the change.

Useful companion material includes basic security terms, the CIA triad, and Cisco Network Foundation Protection.

Prerequisites and networking foundation

Before beginning, be comfortable installing software on Windows, configuring a host IPv4 address, and testing Internet connectivity. You should understand users, passwords, services, updates, files, backups, and basic operating-system administration.

Networking prerequisites include IPv4 addresses and subnet masks, subnetting, default gateways, Ethernet switching, VLANs, basic routing, and connectivity tests such as ping and a route-path test. You should also recognize Cisco IOS command modes:

• User EXEC: limited monitoring access, usually shown by >.
• Privileged EXEC: administrative monitoring and configuration entry, shown by #.
• Global configuration: device-wide settings, entered with configure terminal.
• Subconfiguration modes: settings for interfaces, lines, routing protocols, ACLs, and other features.

Be able to identify a router's interfaces and routes, a switch's VLANs and access or trunk ports, and the relationship between a host, its default gateway, and remote networks. Cisco Configuration Professional (CCP) may appear in legacy learning environments, but the IOS CLI remains essential for understanding and validating configuration.

Foundational security concepts

The confidentiality, integrity, and availability (CIA) triad is a basic model for security objectives. Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized alteration, and availability keeps systems and services usable.

AAA means authentication, authorization, and accounting. Authentication verifies identity. Authorization determines what an authenticated identity may do. Accounting records activity such as login sessions or administrative commands.

A threat is a possible cause of harm. A vulnerability is a weakness. An exploit is a technique or code that takes advantage of a vulnerability. Risk combines the likelihood and impact of an adverse event. A countermeasure reduces likelihood, impact, or both.

Defense in depth uses multiple independent or overlapping controls. For example, endpoint patching, switch port security, VLAN segmentation, router ACLs, a stateful firewall, authentication, and centralized logging provide more resilience than one perimeter rule alone.

A policy states management intent. A standard defines mandatory technical or operational requirements. A procedure gives repeatable steps. An acceptable-use expectation explains permitted use of systems and network resources.

Threats and attack methods

Common threats include malware, phishing, social engineering, password guessing, credential stuffing, reconnaissance, and denial-of-service attacks. Reconnaissance gathers information about hosts, services, addresses, and users before an attack.

Spoofing falsifies an identity or address. A man-in-the-middle attack places an attacker between communicating parties. Traffic interception captures data in transit. Session attacks target tokens or established connections. Network-layer attacks commonly target IP, routing, ARP, or availability; application-layer attacks target services, protocols, and application logic.

Insiders may misuse legitimate access, while weak credentials and unmanaged devices create additional entry points. Indicators may include repeated failed logins, unfamiliar source addresses, unexpected configuration changes, unusual outbound traffic, MAC-address violations, ARP inspection failures, interface errors, or sudden resource exhaustion.

Initial response should preserve evidence, confirm the scope, contain the affected account or device when authorized, notify the responsible security team, and document actions. Do not erase logs or make uncontrolled changes that destroy evidence.

Secure Cisco device management

The management plane handles administrative access and device configuration. The control plane processes protocols that build forwarding knowledge, such as routing and spanning tree. The data plane forwards user traffic. Each plane requires appropriate protection.

Start with a hostname, accurate time, protected credentials, a legal notification banner, and a restricted management path. Prefer SSH over Telnet because SSH encrypts the management session; Telnet sends credentials and commands without equivalent protection.

hostname R1
ip domain-name example.local
username admin privilege 15 secret <secret>
enable secret <enable-secret>
crypto key generate rsa modulus 2048
ip ssh version 2
service timestamps log datetime msec
banner motd ^CAuthorized access only. Activity may be monitored.^C
line console 0
 login local
 exec-timeout 10 0
line vty 0 4
 login local
 transport input ssh
 access-class MGMT-SOURCES in

Protect console, auxiliary, and VTY lines separately. Disable or restrict auxiliary access when it is not needed. Apply password length, complexity, expiration, and lockout controls where supported by the platform and operating policy. Use secret-based credential storage rather than plain-text passwords, and protect exported configuration files because they may contain hashes, keys, or shared secrets.

Management ACLs should permit only approved administration subnets. Login banners provide legal notice; they do not provide technical protection. Enable command logging, timestamps, remote syslog, configuration backups, and change records. Review management-plane protection, control-plane protection, and data-plane protection as related study areas.

AAA implementation

AAA can use the device's local user database or a centralized identity service. A local database is simple and useful for small deployments and emergency fallback. Centralized AAA provides consistent identity policy, role assignment, and accounting across many devices.

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
radius server RADIUS1
 address ipv4 <server-address> auth-port 1812 acct-port 1813
 key <shared-secret>

The method list tries the centralized server first and uses the local database if the server cannot be reached, depending on the result and platform behavior. Test fallback from console access before testing remotely. Apply the intended method list to console and VTY lines, and verify authorization and accounting separately.

See AAA explained and the material on configuring routers for centralized access control.

IPv4 access control lists

An ACL is an ordered list of access control entries (ACEs). A standard ACL normally matches a source IPv4 address. An extended ACL can match protocol, source, destination, and ports. A named ACL is easier to manage and edit than many numbered ACLs.

A wildcard mask uses zero bits to require a match and one bits to ignore a bit. For example, 0.0.0.255 represents one /24-sized range when paired with the appropriate network address.

ACLs are evaluated from top to bottom. The first matching ACE determines the result. If no explicit entry matches, the hidden implicit deny rejects the packet. Inbound ACLs filter before routing; outbound ACLs filter after the routing decision and before transmission. Place standard ACLs near the destination when possible, and extended ACLs near the source to stop unwanted traffic early, while considering the complete policy.

ip access-list extended USER-POLICY
 permit tcp <user-subnet> <wildcard> host <server-address> eq 443
 permit udp <user-subnet> <wildcard> any eq 53
 deny ip <user-subnet> <wildcard> <management-subnet> <wildcard> log
 permit ip any any
interface <interface-id>
 ip access-group USER-POLICY in

Write the policy in plain language first. Account for return traffic, routing, protocol behavior, and the implicit deny. Use counters and temporary logging carefully; excessive logging can overload a device. Verify the ACL on the correct interface and test approved, denied, and boundary cases.

Layer 2 switch security

Layer 2 controls protect local switching, address learning, DHCP, ARP, and spanning tree. Configure user-facing interfaces as fixed access ports, place them in the intended VLAN, and shut down unused ports. Avoid allowing unnecessary negotiation or trunking on end-user ports.

interface <access-port>
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 switchport port-security mac-address sticky
ip dhcp snooping
ip dhcp snooping vlan <vlan-id>
interface <trusted-uplink>
 ip dhcp snooping trust

Port security limits learned MAC addresses. Violation actions commonly include shutdown, restrict, and protect; exact behavior varies by platform. DHCP snooping trusts replies only from authorized interfaces and builds a binding table. Dynamic ARP Inspection uses trusted DHCP bindings or static entries to reject invalid ARP messages. IP Source Guard uses learned bindings to restrict source addresses on access ports.

VLAN hopping can result from a wrongly configured trunk or native VLAN. Use explicit trunk configuration, limit allowed VLANs, choose a controlled native VLAN, and do not place ordinary users in that native VLAN. Spanning Tree protections have distinct purposes: PortFast accelerates edge-port transition, BPDU Guard disables an edge port that receives an unexpected BPDU, Root Guard prevents an interface from becoming a path to an unauthorized root, and loop protection helps detect certain missing-BPDU conditions.

Monitoring, logging, and time

Syslog transports event messages. Severity levels range from emergency conditions to debugging detail; choose a useful remote logging threshold and protect the log collector. NTP synchronizes clocks so authentication, ACL, VPN, and interface events can be correlated accurately.

service timestamps log datetime msec
logging host <syslog-server-address>
logging trap informational
ntp server <ntp-server-address>
show logging
show clock

Prefer secure SNMP versions such as SNMPv3, which supports authentication and privacy, rather than relying on weak community strings. NetFlow or similar traffic-visibility features can establish normal source, destination, protocol, and volume patterns. Compare current behavior with a baseline and investigate unusual logins, ACL denials, VPN changes, interface flaps, route changes, and traffic spikes.

Firewall technologies and traffic inspection

A packet-filtering ACL makes a decision using packet fields and does not inherently understand connection state. A stateful firewall tracks sessions and can allow valid return traffic for an approved connection while blocking unsolicited traffic.

Security zones represent trust boundaries. A zone-based policy firewall commonly uses class maps to identify traffic, policy maps to define inspection or drop actions, and zone pairs to apply a directional policy between zones.

zone security INSIDE
zone security OUTSIDE
class-map type inspect match-any ALLOWED-TRAFFIC
policy-map type inspect INSIDE-TO-OUTSIDE
zone-pair security IN-OUT source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE-TO-OUTSIDE

Define the zones and trust assumptions before writing rules. Permit only required services, inspect appropriate protocols, and validate both policy statistics and logs. A firewall cannot replace secure endpoints, identity controls, patching, careful routing, or monitoring.

Intrusion detection and prevention

An IDS observes traffic and generates alerts. An IPS is placed inline and can block or modify suspicious traffic. Signature-based detection recognizes known patterns. Anomaly-based detection identifies behavior that differs from a baseline. Policy-based detection compares activity with explicitly prohibited or required behavior.

A false positive is a benign event reported as malicious. A false negative is malicious activity that goes undetected. Tune signatures and thresholds using normal traffic, business context, and reliable time synchronization. Treat alerts as leads requiring validation, not as automatic proof of compromise. Cisco IOS IPS concepts fit into a layered design with ACLs, firewalls, endpoint controls, and centralized logging.

Cryptography fundamentals

Encryption transforms readable plaintext into ciphertext using a key; decryption reverses it. Hashing creates a one-way digest used to detect changes. Encoding changes representation for compatibility and is not a security control. A digital signature combines a private key with a digest to provide integrity, origin authentication, and nonrepudiation properties.

Symmetric encryption uses the same shared secret for encryption and decryption and is efficient for bulk data. Asymmetric encryption uses a public/private key pair and helps with authentication and key exchange, but is more computationally expensive. A certificate binds an identity to a public key. A certificate authority (CA) issues and validates certificates within a public key infrastructure (PKI).

Data in transit needs protection while crossing a network; data at rest needs protection on disks, backups, and device files. Use current, supported algorithms and protocols, strong keys, authenticated integrity mechanisms, and managed certificate lifecycles. Avoid weak legacy algorithms, obsolete protocol versions, reused secrets, and unprotected private keys.

Site-to-site IPsec VPNs

A site-to-site VPN securely connects two networks across an untrusted WAN. IPsec establishes security associations that define how selected traffic is authenticated, protected, and processed. ESP provides confidentiality plus integrity and authentication features. AH provides integrity and authentication but not confidentiality and is less commonly used when address translation is involved.

In tunnel mode, the original IP packet is encapsulated inside a new IP packet, which is typical for gateway-to-gateway VPNs. Transport mode protects the payload while retaining the original IP header and is used in more specialized designs.

IKE negotiates peers, authentication, cryptographic parameters, and security associations. Peers may authenticate with pre-shared keys or certificates. A crypto ACL, also called a traffic selector, identifies the protected or interesting traffic. Policy-based Cisco IOS VPNs commonly use a crypto map attached to the WAN interface.

crypto isakmp policy 10
 authentication pre-share
 encryption aes
 hash sha
crypto isakmp key <pre-shared-key> address <peer-address>
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
ip access-list extended VPN-INTERESTING-TRAFFIC
 permit ip <local-subnet> <wildcard> <remote-subnet> <wildcard>
crypto map VPN-MAP 10 ipsec-isakmp
 set peer <peer-address>
 set transform-set VPN-SET
 match address VPN-INTERESTING-TRAFFIC
interface <wan-interface>
 crypto map VPN-MAP
show crypto isakmp sa
show crypto ipsec sa

Both peers must agree on reachability, IKE policy, authentication, transform parameters, traffic selectors, and interface application. Generate matching traffic, inspect security-association state and encrypted/decrypted counters, and check whether NAT or another ACL interferes. Protect pre-shared keys and prefer modern supported cryptographic settings.

Endpoint, wireless, and perimeter awareness

Network controls are incomplete without endpoint security. Harden hosts, apply patches, use antimalware and host firewalls, remove unnecessary services, protect credentials, and train users to recognize phishing and unsafe requests.

BYOD and unmanaged devices may lack patches, endpoint protection, or reliable identity. Wireless security requires strong authentication and modern encryption, with separate guest and internal access where appropriate. Secure remote access should authenticate users strongly, limit reachable resources, and log activity.

A DMZ is a perimeter network for services that must be reachable from less-trusted networks. It should not be treated as equivalent to the internal network. Use VLANs, ACLs, firewall zones, and separate management paths to segment users, servers, guests, and infrastructure.

Security operations and troubleshooting

Use a repeatable method rather than changing multiple controls at once:

1. State the intended traffic and management policy.
2. Confirm physical links, interface status, addresses, VLANs, routes, and default gateways.
3. Check the relevant feature configuration and counters.
4. Test from both an allowed and a denied source.
5. Correlate timestamps, logs, and packet behavior.
6. Roll back an unsafe change using a known-good configuration.
7. Save, back up, and document the validated result.

Common troubleshooting cases

Remote administrators cannot connect: check SSH keys, the domain name, local users, VTY login and transport settings, the management ACL, interface status, routing, and TCP port 22 reachability.

AAA fails when the server is unavailable: confirm a local fallback method, server address, shared secret, routing, RADIUS or TACACS+ filtering, and method-list application. Preserve tested console recovery access before remote testing.

An ACL blocks valid traffic: inspect wildcard masks, protocol and port fields, interface direction, earlier broader entries, counters, and the implicit deny. Test both directions.

A secured switch port loses connectivity: inspect port-security state, MAC limits, VLAN mode, DHCP snooping bindings, ARP inspection results, and error-disabled recovery.

An IPsec VPN does not establish: verify peer reachability, matching IKE and IPsec settings, authentication, selectors, NAT behavior, ACLs, crypto-map attachment, and encrypted packet counters.

Exam-relevant review checklist

• Explain the CIA triad, AAA, risk terms, defense in depth, and least privilege.
• Distinguish management, control, and data planes.
• Secure IOS administration with secrets, SSH, VTY restrictions, banners, timestamps, backups, and logging.
• Compare local AAA, RADIUS, and TACACS+ and explain fallback behavior.
• Calculate wildcard masks and predict ACL first-match and implicit-deny results.
• Explain port security, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, and STP protections.
• Compare ACL filtering, stateful firewalls, IDS, and IPS.
• Explain symmetric and asymmetric cryptography, hashing, signatures, certificates, and PKI.
• Trace IPsec negotiation from peer reachability through IKE, security associations, selectors, and encrypted traffic.
• Use show commands, counters, logs, and controlled tests to distinguish routing, Layer 2, ACL, AAA, firewall, and VPN faults.

Related study areas

Continue with SSH on a Cisco router, IOS password protection, NTP configuration, secure IOS images and files, and risk and countermeasure definitions. For legacy graphical administration, review the Cisco Configuration Professional overview.