CCIE Security study plan - revised

I am hitting a bit of a brick wall with the WSA appliance. So I will need to reach out for help, but bearing in mind that it will be just a 45 day trial (in most likelihood), I should reserve this for nearer the end of the study period. The same may be true for other components, such as the ISE, ACS, vWLC, and IPS.

I know at least I should be able to get an IPS license myself, if I need one.

You would think that Cisco would make it a little easier for people wanting to study! We pay enough money to Cisco, we should at least be able to download the stuff we need to study. Anyway, enough of the ranting. The plan needs a little revision.

So, let's concentrate on the things that I can do. Here's the original list, I'll keep it a little more brief than in the original study plan. The numbers in brackets are the new position in the plan.

1: Set up TestPC-B, Switch 3 and Switch 6. This will give me access to WSA1 (1)
2: WSA (12)
3: Set up Switch 1 & Switch 3, giving access to ISE1 and ISE2 (2)
4: ISE (11)
5: Set up Switch 2 and Switch 4 - giving access to ACS1 and ACS2. (2)
6: ACS (10)
7: Set up ASAs (3)
8: VPNs (4)
9: IPS (9)
10: Hardening and availability (7)
11: Wireless stuff (6)
12: Miscellaneous other stuff (8)
13: IPv4 and IPv6 routing protocol security (5)
14: Do written exam (13)
15: Practice - do INE Security workbooks and full scale labs. (14)
16: Lab - take the lab exam. (15)
17: Profit? Re-take lab exam? Who knows! (16)
Here is the revised version:

1: Set up TestPC-B, Switch 2 and Switch 6. This will give me access to WSA1
2: Set up all the switches
3: Set up ASAs
4: Set up routers for VPNs
5: IPv4 and IPv6 routing protocol security
6: Wireless stuff
7: Hardening and availability
8: Miscellaneous other stuff (threat identification and mitigation)
9: IPS
10: ACS
11: ISE
12: WSA
13: Do written exam
14: Practice (INE labs)
15: Lab exam
16: Drink beer and celebrate

This makes a little more sense. Setting up all the switches will lay the foundation for the network, as well as determining the addressing needed.

From there I can move on to the ASAs, and the VPNs.

Once the VPNs are in place we can do all of the routing protocols (both IPv4 and IPv6), and then move on to the wireless aspects.

One we have the wireless configured we can look at hardening and availability. Then we can finish off the threat stuff.

Then we get to the appliances, the IPS, ACS, ISE and WSA.

After that I should be ready for the written exam.

That's the plan. At the moment.

CCIE Security study plan

It's always a good idea to have a structured study plan. I did this with my Routing and Switching CCIE, managing to stick to it (roughly). So it makes sense to do one for this as well.

My plan in it's most general sense is to:

Build up a fully working lab, bit by bit.
Use the INE videos to build up this knowledge as I go.
Read the books for the various sections.

The lab will be based around UNL, and the topology will be based around the same one used by INE. So that when I come to do their full labs, it will all be set up and all the kinks will be worked out. The topology is in my first post about the CCIE Security, but I will re-post it here to make life easier:

Sounds very broad, doesn't it. So let's break it down to a proper study plan, starting with the things that are new to me. Where I mention ATC, this is the INE Advanced Technology Class (http://streaming.ine.com/c/ccie-security-advanced-technologies-class)

1: Set up TestPC-B, Switch 2 and Switch 6. This will give me access to WSA1
2: WSA :-

• Watch: INE video course http://streaming.ine.com/c/ccie-sc-wsa-primer. Applicable videos from the ATC.
• Read: http://www.cisco.com/c/dam/en/us/td/docs/security/wsa/wsa7-1/user_guide/Cisco_IronPort_AsyncOS_7-1-0_User_Guide_for_Web_Security_Appliances.pdf
• Do: Set up WSA in UNetLab.
• Covering: Section 3: Intrusion Detection and Content Security (second half)

3: Set up Switch 1 & Switch 3, giving access to ISE1 and ISE2 (Not pictured - need to complete topology)
4: ISE :-

• Watch: INE video course http://streaming.ine.com/c/ccie-sc-ise--primer, and videos from ATC.
• Read: Cisco ISE for BYOD and Secure Unified Access: BYOD Network Security with ISE
• Do: Set up ISE(s) in UNetLab/ESXi - I don't think they will run natively in UNL.
• Covering: Section 4: Identity Management

5: Set up Switch 2 and Switch 4 - giving access to ACS1 and ACS2.
6: ACS :-

• Watch: INE ATC videos
• Read: Cisco Access Control Security: AAA Administration Services
• Do: Setup ACS
• Covering: Section 4: Identity Management

7: Set up ASAs - Now the fun really starts! I should be in a good position now to start opening up the network. We are ready to authenticate through ACS/ISE and WSA, and are working from an inside-out fashion, rather than outside-in.

• Watch: INE ATC
• Read: Cisco ASA: All-in-one Next-generation Firewall, IPS, and VPN Services
• Do: Set up ASAs, for VLANs, failover/HA, transparent mode, routed mode and anything else I can think of.
• Covering: Section 5: Perimeter Security and Services 

8: VPNs

• Watch: INE ATC
• Read: VPN books - refer to CCIE security topics and reading list.
• Do: Majority of Section 6.
• Covering: Section 6: Confidentiality and Secure Access

9: IPS

• Watch: INE ATC
• Read: Cisco ASA: All-in-one Next-generation Firewall, IPS, and VPN Services
• Do: Set up IPS
• Covering: Section 3: Intrusion Detection and Content Security (first half)

10: Hardening and availability

• Watch: INE ATC
• Read: Designing Network Security
• Do: Set up hardened services on routers
• Covering: Section 1: System Hardening and Availability

11: Wireless stuff

• Watch: INE ATC
• Read: Cisco Wireless LAN Security
• Do: Set up Wireless components - vWLC, an AP, a wi-fi client
• Covering: Section 6: Confidentiality and Secure Access

12: Miscellaneous other stuff - need to cover section 2: Threat Identification and Mitigation

• Watch: Not sure yet.
• Read: Implementing Cisco IOS Network Security
• Do: General protection
• Covering: Section 2: Threat Identification and Mitigation

13: IPv4 and IPv6 routing protocol security. Although it's not stated, explicitly, section 1.1 does refer to IGP authentication, so with the aid of part 8 (VPNs), we can add on some IGPs and EGPs.

• Do: Implement IGPs and set up authentication.

By this stage I should have gone back and forward, as the network expands, adding and building on to WSA, ISE and ACS knowledge. As I go through the topology I will be changing it, and then when complete, it will be published, definitely here, probably on the UNL site as well. Then we get to the final stages.

14: Do written exam
15: Practice - do INE Security workbooks and full scale labs.
16: Lab - take the lab exam.
17: Profit? Re-take lab exam? Who knows!

I am not attaching any timelines to this at the moment though. I'll start doing that closer to the end.

What do you reckon? A workable plan? Missing anything?

Month two done, ten to go

Just a quick post today.

It's been a bit of a slow month.

I am on chapter 11 of the Odom book, getting into BGP - as you'll see from some of the posts last month, it was fairly BGP intensive. Still got some way to go with it yet, but it does feel as if when something new gets learned something else gets forgotten. I guess that it's just a case of solidifying knowledge through practice, practice, and more practice. The blog posts do help, but I know I need more hands-on time, so it's time to start using my lab hardware.

I have picked up a couple more books through eBay and Amazon, hopefully I will actually get time to read them!

I have taken a bit of a side-step and am listening to CCDA audio in the car, it's only a short series but hopefully will help with the basics on sometings that I am not familiar with, such as MPLS. I have more audio lined up (IPv6, BGP and QoS) after my brief foray into the world of design.

CCIE lab hardware

The lab is now complete, all cables purchased, now I just need to make some space at home and start setting it all up. I will post pictures of it later on.

CCIE and home life

I managed to get a bit of study done when we went away to see my Father-In-Law over in France. He's not completely up to date with all the latest technologies, and back in his day the internet was still evolving from ARPANET. But he does know a lot, in fact he wrote a book on it called The Architecture of Small Computer Systems. he even dedicated to my wife. Despite the long travelling the boys enjoyed their trip away, they got to pick hazelnuts!

It is however hard to do as much study as I know I should, but after staring at a computer all day, coming home to play with the twins before I put them to bed, then eating, its already about 8pm or so and quite frankly I am tired. But there is the rub. When it comes to actually practising the exams I know I will need large blocks of time. I can split the troubleshooting and configurations, but we are still looking at finding a 5 1/2 hour block somewhere during the weekend.

But I can figure that out later. Need to finish the reading first.

CCIE and work life

Hopefully the company will be paying for me to attend the INE bootcamp course next year, can't do it this January unfortunately  but there is another in April, which if my original goal of completing by October 2014 pans out, should be good time-wise. I havn't managed to get as much done at work as I would have liked. 

It's been busy in the office working on a Lync 2013 rollout, it's been a bit painful, we have had a 2010 set up for sometime, but we are aiming to have external (non-vpn) access available - so with the aid of a Microsoft IIS with ARR its working, though every time I got the desktop client working the mobile client would stop connecting and vice versa, until yesterday when everything seemed to fall into place.

Hopefully now things will lighten up so I can continue reading and making notes.

Month one done, eleven to go

So August has come and passed, of my goal of gaining CCIE-dom within twelve months I now have eleven months left.

So where am I? well, I think that my original idea of one chapter a month of the Odom book was a little, well, how can I say, "light" in respects to how far that book alone would get me. It's a great book, don't get me wrong, and it should be the first book that gets read along the journey, but I don't think it will be the only book that gets read. So with that in mind, my study plan has evolved.

CCIE Revised study plan

My new study plan includes the following:

For every chapter I read of the Odom book I will read a chapter on the same topic from another book listed in the CCIE book list.

Example - I have just finished chapter 7 of the Odom book, and am now reading chapter 7 of the Routing TCP/IP volume 1 by Jeff Doyle (both are about EIGRP).

This way I think it will help solidify the knowledge.

As I just mentioned I am now finished chapter 7 in the CCIE exam book, so already am ahead in that respects of the original study plan. If I keep up this rate then I should finish that book within a few months, and can then read other books, or just start with the actual practice.

CCIE lab hardware

My lab equipment purchasing is nearly finished, I only have 17 DB60 cables to get and then its completed. I am still under the budget of £1000, so that's no too bad really, it's all come via eBay and I did get some good bargains! I hope to post some pictures soon... Once I clear some room in the study!

CCIE and home life

It is starting to feel that there is another member of the family. It now feels like it's all about spending "quality time" with my wife, our two boys and my studies. To be honest sometimes the last thing I want to do when I come home is to have my nose in a book, but then I know that if I don't then I won't pass. So sometimes it is a push to get the studying done.

CCIE and work life

I am quite blessed in that the company I work for are behind me in this venture. It is also for their interest (obviously) as having a CCIE within their ranks will a) look good to clients if they ask, and b) potentially reduce the contractors we have bought in to do things. I do get some time to study at work (occasionally), and as the majority of the work I am doing is either CCIE level, or actually something on the CCIE syllabus, so it's a pretty copasetic existence.

Anyway, enough chat, back to the reading!