itnetworking
Search / GitHub Start with lab 1

Network Security

13 labs in this topic area, in recommended learning order.

  1. PTL-0003

    Securing Switch Management with SSH

    Configure secure administrative access to a Cisco Catalyst switch using SSHv2, RSA key generation, local user authentication, and disabled Telnet transport.

    • Network Security
    • SSH
    • Switch Security
    • Cisco IOS
    Level
    Intermediate
    Time
    30 min
    Simulator
    Tested in Packet Tracer

  2. PTL-0004

    Implementing Switchport Port Security

    Configure Cisco Catalyst switch port security to restrict unauthorized MAC addresses, learn dynamic sticky MAC addresses, and configure violation shutdown and recovery.

    • Port Security
    • Switch Security
    • Sticky MAC
    • Err Disable
    • Cisco IOS
    Level
    Intermediate
    Time
    35 min
    Simulator
    Tested in Packet Tracer

  3. PTL-0018

    Dynamic Trunking Protocol and Native VLAN Security

    Investigate Cisco Dynamic Trunking Protocol (DTP) operational modes, mitigate trunk negotiation risks with switchport nonegotiate, secure untagged traffic with an isolated Native VLAN 999, and prune unauthorized traffic with explicit allowed VLAN lists.

    • DTP
    • Trunking
    • Native VLAN
    • VLAN Hopping
    • Switchport Security
    Level
    Intermediate
    Time
    45 min
    Simulator
    Tested in Packet Tracer

  4. PTL-0007

    Cisco Switch Security Hardening Best Practices

    Implement enterprise switchport hardening: mitigate VLAN hopping by changing the native VLAN, disable DTP negotiation, shut down unused ports in a parking-lot VLAN, and enable STP PortFast and BPDU Guard.

    • Switch Hardening
    • VLAN Hopping
    • BPDU Guard
    • PortFast
    • DTP
    Level
    Intermediate
    Time
    40 min
    Simulator
    Tested in Packet Tracer

  5. PTL-0013

    Configuring Standard and Extended IPv4 Access Control Lists

    Design, configure, and verify numbered standard and named extended IPv4 Access Control Lists (ACLs) to filter traffic based on source, destination, protocol, and port numbers.

    • Network Security
    • ACLs
    • Packet Filtering
    • Traffic Filtering
    • Cisco IOS
    Level
    Intermediate
    Time
    45 min
    Simulator
    Tested in Packet Tracer

  6. PTL-0038

    DHCP Snooping and Rogue DHCP Detection

    Configure and verify Cisco IOS DHCP Snooping on Catalyst switches to mitigate rogue DHCP server attacks, establish trusted and untrusted port boundaries, enforce Option 82 handling policies, apply DHCP rate limiting, and validate dynamic DHCP snooping binding database population.

    • Network Security
    • DHCP Snooping
    • Layer 2 Security
    • Rogue DHCP
    • Option 82
    Level
    Advanced
    Time
    50 min
    Simulator
    Tested in Packet Tracer

  7. PTL-0039

    Dynamic ARP Inspection and Spoofing Defense

    Configure and verify Dynamic ARP Inspection (DAI) on Cisco Catalyst switches, establish trusted and untrusted port boundaries, configure ARP inspection rate limiting, activate multi-attribute validation checks (src-mac, dst-mac, ip), integrate with DHCP snooping bindings, and observe Layer 2 ARP security behavior.

    • Network Security
    • Dynamic ARP Inspection
    • ARP Spoofing
    • Man in the Middle
    • DHCP Snooping
    Level
    Advanced
    Time
    50 min
    Simulator
    Tested in Packet Tracer

  8. PTL-0040

    Port Security Violation Troubleshooting

    Diagnose and resolve Layer 2 switchport port security faults across Cisco Catalyst access switches. Analyze stale sticky MAC address conflicts, recover interfaces latched in err-disabled state without disabling security, and reconfigure violation modes from silent drop (protect) to audit-compliant (restrict/shutdown).

    • Network Security
    • Port Security
    • Switch Security
    • Sticky MAC
    • Err Disable
    Level
    Intermediate
    Time
    45 min
    Simulator
    Tested in Packet Tracer

  9. PTL-0041

    IPv4 ACL Troubleshooting with Traffic Matrix

    Troubleshoot and remediate IPv4 standard and extended Access Control Lists using a structured traffic matrix. Identify and correct common ACL design and implementation faults including shadowed rules, directional misplacement (inbound vs. outbound), and inverted wildcard masks on Cisco IOS routers.

    • Network Security
    • Access Control Lists
    • Extended ACL
    • Standard ACL
    • Wildcard Mask
    Level
    Intermediate
    Time
    60 min
    Simulator
    Tested in Packet Tracer

  10. PTL-0042

    Named Extended IPv4 ACL for Server Access

    Design, implement, and verify named extended IPv4 Access Control Lists to control traffic flow between corporate network zones. Enforce the principle of least privilege by selectively permitting DNS (UDP 53) and web services (TCP 80/443) to public DMZ resources while isolating sensitive internal database servers and departmental subnets.

    • Network Security
    • Access Control Lists
    • Named Extended ACL
    • Packet Filtering
    • Dmz Security
    Level
    Intermediate
    Time
    60 min
    Simulator
    Tested in Packet Tracer

  11. PTL-0050

    Guest Network Segmentation with ACLs

    Implement and troubleshoot enterprise guest network segmentation using named extended IPv4 Access Control Lists on a Cisco edge router. Enforce least privilege access by permitting essential public DNS, HTTP, and HTTPS services to external servers while strictly isolating and dropping untrusted guest traffic destined for sensitive corporate intranet subnets.

    • Network Security
    • Access Control Lists
    • ACLs
    • Extended ACLs
    • Guest Segmentation
    Level
    Intermediate
    Time
    60 min
    Simulator
    Tested in Packet Tracer

  12. PTL-0051

    DMZ Services with Edge ACL Policy

    Architect, deploy, and verify enterprise perimeter security using named extended IPv4 Access Control Lists on a Cisco three-legged edge router. Isolate an untrusted Demilitarized Zone hosting public web services from the private corporate intranet, while permitting controlled database access and public reachability conforming to the principle of least privilege.

    • Network Security
    • Dmz
    • Access Control Lists
    • ACLs
    • Extended ACLs
    Level
    Advanced
    Time
    75 min
    Simulator
    Tested in Packet Tracer

  13. PTL-0053

    Secure Management Network Design

    Design, implement, and verify enterprise management plane security using dedicated management VLAN segmentation, cryptographic SSHv2 access, and VTY access-class filtering on Cisco IOS routers and switches. Isolate infrastructure management interfaces from user data subnets and enforce strict administrative access controls.

    • Network Security
    • Management Plane
    • SSH
    • VTY Hardening
    • Access Control Lists
    Level
    Advanced
    Time
    75 min
    Simulator
    Tested in Packet Tracer

Search

Type at least two letters, for example OSPF, DHCP relay or VLAN.