Network Security and Wireless Fundamentals

Protect a Cisco network from the router to the access port: harden device access, filter traffic with ACLs, stop Layer 2 attacks, and build wireless LANs secured with WPA2 and WPA3.

Intermediate · Networking · about 12 hours · 4 modules · certificate on completion

Taught by Cataliná Ionescù, Lachlaneè Mitchèll, AI Learning Companions.

About this course

This course teaches you to defend a network, layer by layer, on Cisco routers, switches and wireless controllers in Cisco Packet Tracer, following the Security Fundamentals topics of Cisco's CCNA (200-301) exam. You'll start with the language of security, threats, vulnerabilities, exploits and mitigations, and then protect the devices themselves: hashed secrets, local users, SSH, protection against password guessing, and AAA with a TACACS+ server. You'll turn a written policy into standard and extended access control lists, placed where they work best, and prove they do what you meant. At the access layer you'll stop the attacks that start at a wall socket, with port security, DHCP snooping and dynamic ARP inspection. Finally you'll learn how Wi-Fi works, how enterprise wireless is built from access points and controllers, and how WPA2 and WPA3 protect it, and you'll configure a secure WLAN on a wireless LAN controller.

Everything here is defensive: you'll practise on your own simulated networks, and every module ends with a Packet Tracer lab that your instructor reviews. The capstone asks you to secure a whole branch office and write the security assessment an auditor would expect.

What you'll learn

  • Explain threats, vulnerabilities and exploits, and choose mitigations for them
  • Secure access to Cisco devices with strong secrets, SSH and AAA
  • Write, apply and verify standard and extended access control lists
  • Protect access ports with port security, DHCP snooping and dynamic ARP inspection
  • Compare wireless architectures, from autonomous access points to wireless LAN controllers
  • Configure a WLAN secured with WPA2 on a wireless LAN controller, and explain what WPA3 adds

Skills you'll gain

Network security, Access control lists, AAA, SSH, Port security, DHCP snooping, Dynamic ARP inspection, Wireless LANs, WPA2 and WPA3, Cisco IOS

Tools

Cisco Packet Tracer, Cisco IOS

Before you start

Basic Cisco IOS configuration and IPv4 addressing with subnet masks, and an idea of what VLANs and DHCP do. Install Cisco Packet Tracer (free with a Cisco Networking Academy account) on Windows, macOS or Linux.

Aligned with: Cisco CCNA (200-301) exam topics: Security Fundamentals

Modules

  1. Security concepts and secure device access

    The language of security, then the first thing to protect on any network: who can log in to its routers and switches, and how they prove who they are.

    • Threats, vulnerabilities, exploits and mitigations (12 min)
    • Passwords and local device access (12 min)
    • AAA servers, and VPNs (13 min)
    • Hands-on lab: Harden a router's management access

  2. Access control lists

    Filter traffic with standard and extended ACLs: how a router reads them, how to write wildcard masks, where to apply them, and how to prove they do what you meant.

    • How ACLs work: order, wildcard masks and placement (12 min)
    • Standard ACLs, numbered and named (12 min)
    • Extended ACLs: protocols and ports (14 min)
    • Hands-on lab: Filter traffic with standard and extended ACLs

  3. Layer 2 security: port security, DHCP snooping and ARP inspection

    Protect the access layer, where people plug in: limit which devices can use each port, stop rogue DHCP servers, and block ARP spoofing.

    • Port security (12 min)
    • DHCP snooping (12 min)
    • Dynamic ARP inspection (12 min)
    • Hands-on lab: Lock down an access switch

  4. Wireless fundamentals and secure WLANs

    How Wi-Fi shares the airwaves, how enterprise wireless is built from access points and controllers, and how to secure a WLAN with WPA2 and WPA3.

    • Wireless principles: radio, channels and SSIDs (12 min)
    • Wireless architectures: autonomous, cloud and controller-based (12 min)
    • WPA2, WPA3 and configuring a secure WLAN (14 min)
    • Hands-on lab: Build a secure staff WLAN

Project: Secure a branch office network

A branch office has a staff LAN, a guest LAN, a server LAN and a wireless network for staff. Build it in Cisco Packet Tracer, reusing your labs if you like, and secure it as a whole. Harden the router and the switches: secrets and local users, SSH version 2 only and only from the admin PC, protection against password guessing, and logins checked by a TACACS+ server with a local fallback. Filter traffic with ACLs so guests can use only the web server and DNS, staff can reach everything, and management is possible only from the admin PC. Protect the access ports with port security, DHCP snooping and, where your Packet Tracer supports it, dynamic ARP inspection, and shut every unused port. Add a staff WLAN secured with WPA2 and a pre-shared key on a wireless LAN controller. Then test it the way an auditor would, recording what should work and what shouldn't, and write a one-page security assessment of the branch.

Part of

Cisco, CCNA, Cisco IOS and Cisco Packet Tracer are trademarks of Cisco Systems, Inc. This course is independent: Cisco hasn't made or endorsed it, and it doesn't give you a Cisco certification.

Start the course free