GlobalConfig.net» CCIE Security http://globalconfig.net Studying for Network Certifications Sat, 24 Dec 2011 02:07:50 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Last Day to Enroll in 6-Week CCIE Security Evening Class. http://globalconfig.net/ccie-security/last-day-to-enroll-in-6-week-ccie-security-evening-class/ http://globalconfig.net/ccie-security/last-day-to-enroll-in-6-week-ccie-security-evening-class/#comments Sun, 17 Jul 2011 05:40:09 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=2338 bullhorn.jpgThis is just a quick heads up for anyone interested in the 6-week evening class for CCIE Security candidates. Today, Sunday, July 17th is the final day to enroll in the 6-Week Evening CCIE Security Class. This is a unique opportunity to mix instructor-led training and the ability to move at your own pace through the material. You can get all the details, including the course schedule, class outline and class topology by visiting http://globalconfig.net/ccie_security.

Related Posts:

]]> http://globalconfig.net/ccie-security/last-day-to-enroll-in-6-week-ccie-security-evening-class/feed/ 0 CCIE Security Bootcamp Topology http://globalconfig.net/ccie-security/ccie-security-bootcamp-topology/ http://globalconfig.net/ccie-security/ccie-security-bootcamp-topology/#comments Fri, 17 Jun 2011 19:03:05 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=2324 I’ve had some requests to post the CCIE Bootcamp topology. Here is a look at the Layer 3 Topology. The price has already gone up a bit, but if you’re still interested in the 1000.00 pricing I can work with you today. Just let me know.

Please visit the course page for more details.

Related Posts:

]]> http://globalconfig.net/ccie-security/ccie-security-bootcamp-topology/feed/ 0 New Video: Comparing Crypto Maps and VTI’s Part 2 http://globalconfig.net/ccie-security/new-video-comparing-crypto-maps-and-vti%e2%80%99s-part-2/ http://globalconfig.net/ccie-security/new-video-comparing-crypto-maps-and-vti%e2%80%99s-part-2/#comments Fri, 15 Apr 2011 20:44:44 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=2013 In this video I show the configuration of a site-to-site IPsec VPN using static VTI interfaces. I really like using this method because its very straight forward in my eyes. You dont have to use ACL’s to define what gets encrypted but you can use them to filter what goes across the tunnel. Find more information on VTI interface at Cisco.com in the 12.4T documentation


Related Posts:

]]> http://globalconfig.net/ccie-security/new-video-comparing-crypto-maps-and-vti%e2%80%99s-part-2/feed/ 0 New Video: Comparing Crypto Maps and VTI’s Part 1 http://globalconfig.net/general/new-video-comparing-crypto-maps-and-vtis-part-1/ http://globalconfig.net/general/new-video-comparing-crypto-maps-and-vtis-part-1/#comments Wed, 06 Apr 2011 19:02:54 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1993 I’m trying something new here.  I seem to do that alot!  Let me explain why.  Basically it takes to long to type up a full post and worry about all the screenshots and command line snippets to be able to get you good content quickly.  And the since the members area of Global Config is video focused I have gotten quite a bit faster at creating videos and editing them.  So, here is the first of what I hope will become a number of video tutorials.

This one covers Crypto Map configurations for a site-to-site VPN between two routers.  In the second video I’ll cover the VTI configuration for comparison.



Useful Links:
Become a Member
How to Configure IPSec VPN’s (Cisco.com)

Related Posts:

]]> http://globalconfig.net/general/new-video-comparing-crypto-maps-and-vtis-part-1/feed/ 0 Today Only! Lifetime Video Membership for $99.99 USD. http://globalconfig.net/ccie-security/today-only-lifetime-video-membership-for-99-99-usd/ http://globalconfig.net/ccie-security/today-only-lifetime-video-membership-for-99-99-usd/#comments Thu, 31 Mar 2011 18:32:06 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1986 *** This Offer Ended on Friday April 1st at 5pm PST. *** Visit http://members.globalconfig.net/sign-up/ for an even better offer!

While the GlobalConfig.net Members area is growing in both members and content I felt like giving people an opportunity to get in on a special deal today. The standard Web Session Membership is $75.00 USD per month and this includes access to the following:

  • Live Webinars (~ once a month)
  • Access to recordings of the live Webinars
  • Access to Video Training specific to CCIE Security that is NOT covered in the Webinars.
  • Technology Specific Lab Exercises (To Be Released Soon)
  • And of course, access to all the free videos.
    • Today we are offering a “Video Only” membership that will give you access to all the existing videos and all upcoming videos. This includes the recordings of live sessions. For today only a lifetime membership will run you $99.99 USD. Follow the “Buy Now” link below to complete your purchase and registration. Upon completion you will gain access to all existing videos, and you will be updated when new videos are added.

    To purchase lifetime access to the “Video Only” members area for just $99.99 UDS click the “Buy Now” button.

    *** This Offer Ended on Friday April 1st at 5pm PST. ***

    Related Posts:

    • No Related Posts
    ]]>     http://globalconfig.net/ccie-security/today-only-lifetime-video-membership-for-99-99-usd/feed/ 2     Configuring Etherchannel on Cisco ASA 8.4 http://globalconfig.net/security/firewalls/configuring-etherchannel-on-cisco-asa-8-4/ http://globalconfig.net/security/firewalls/configuring-etherchannel-on-cisco-asa-8-4/#comments Thu, 17 Feb 2011 20:45:07 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1953 With the recent release of Cisco ASA 8.4 code a new feature has emerged. Yes, Etherchannel. I’ll spare you the gory details of how etherchannel works. Rather lets just get right into how you set it up.

    Lets begin with the switch configuration:

    Rack1SW1# sh run int f0/1
Building configuration...
    


    Current configuration : 109 bytes
!
interface FastEthernet0/1
 switchport access vlan 146
 switchport mode access
 channel-group 1 mode active
 spanning-tree portfast
end
    


    Rack1SW1# sh run int f0/2
Building configuration...

    Related Posts:

    ]]>     http://globalconfig.net/security/firewalls/configuring-etherchannel-on-cisco-asa-8-4/feed/ 1     Bypassing NAT on Cisco ASA 8.2 http://globalconfig.net/security/bypassing-nat-on-cisco-asa-8-2/ http://globalconfig.net/security/bypassing-nat-on-cisco-asa-8-2/#comments Mon, 31 Jan 2011 13:00:18 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1899 There are a number of ways to bypass NAT using a Cisco ASA. I suppose the easiest way would be to leave it alone when you install it and don’t use NAT at all. Why? Because the ASA does not have NAT-Control enabled by default. This means that you can configure you ASA just as you would a router and exchange routes between the inside and outside. Aside from needing an ACL on the outside interface, applied in an inbound direction, you should notice that if functions very similar to what you would expect a router to function like.

    However, for most of us, this is not feasible. Because of the use of RFC 1918 addresses we are required to use NAT or PAT when we make connections to the Internet. Still situations may arise where you have NAT configured but for some reason you need to bypass it. Here are a few examples of how to do this along with the terminology that these methods are referred to in ASA 8.2.

    Identity NAT

    When you use Identity NAT the connections can only be originated by the address that’s covered in the statement. Of course, return traffic will be allowed, but you can’t originate an outside connection into the address in the NAT statement.

    Here is how you configure it:

    ASA1(config)# nat (inside) 0 10.1.1.0 255.255.255.0

    In this code example you can initiate an outbound connection from addresses on the 10.1.1.0/24 subnet and it will not translate the source.

    Static Identity NAT

    A Static Identity NAT Translation is always active. This means that a connection can be initiated into this address, provided there is an ACL inbound on the lower security-level interface that permits the connection. You can also originate connections from the address defined in the statement for outbound connections and the ASA will not Translate the source.

    Related Posts:

    ]]>     http://globalconfig.net/security/bypassing-nat-on-cisco-asa-8-2/feed/ 0     Destination NAT on Cisco ASA 8.2 http://globalconfig.net/security/firewalls/destination-nat-on-cisco-asa-8-2/ http://globalconfig.net/security/firewalls/destination-nat-on-cisco-asa-8-2/#comments Fri, 21 Jan 2011 13:00:01 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1858 This week I had a few students in a neighboring class that are trying to accomplish a destination nat using Cisco ASA 8.x. They were apparently told by Cisco TAC that this was not possible on anything prior to ASA 8.3 code. This isn’t the case. In fact, it’s been possible for some time on the ASA. Now as it sits they have an ASA sitting behind a Juniper Firewall which is currently providing the destination NAT services, but that’s the only reason they have the Juniper there. So, by being able to do the NAT on the ASA the Juniper Firewall can be removed.

    So the scenario goes a little something like this. Originally we had two servers with IP addresses 172.18.0.99 and 172.18.0.100 that are hard coded into a few thousand clients. The servers were consolidated into one server and the IP address is now in a different address space. Rather than changing the static assignment on so many clients, can we just configure the ASA so that when they go to the old hard coded addresses they will be destination NAT’d to the new server IP address? The answer is yes and here is how you do it.

    First, We can take a look at the old Topology. Here we note the addresses that are hard coded to the clients on the left.

    destnat1-2.jpg

    Related Posts:

    ]]>     http://globalconfig.net/security/firewalls/destination-nat-on-cisco-asa-8-2/feed/ 0     Recap of Changes and One Last Deal of the Year!!! http://globalconfig.net/iegeneral/recap-of-changes-and-one-last-deal-of-the-year/ http://globalconfig.net/iegeneral/recap-of-changes-and-one-last-deal-of-the-year/#comments Wed, 29 Dec 2010 17:37:25 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1816 bullhorn.jpgMany of you have noticed that there have been many changes here at GlobalConfig.net. We’ve added a podcast, web sessions and now a members area. Here is the run down.

    The Podcast

    The podcast is a resource to help people understand methods in preparation and with some recent interviews it will provide valuable tips for finding employment and handling interviews.

    The Community Lab

    I announced a community lab, much in the style of Jeremy Stretch at Packetlife.net. This lab should be ready for access sometime on February and will be free of charge. The lab bandwidth and much of the equipment is provided by Ascolta.

    The Members Area

    webinar.jpgWe’ve had great response to the 4-hour CCIE Security ASA Web Session that will be running tomorrow, December 30th, however, you may be wondering what you get with the web session. Basically you get me for four hours teaching everything I can, minus VPN, about the ASA. Will that be enough time to cover everything there is to cover for the ASA? Not likely. That’s where the members area comes in.

    I decided that while I can’t run live web sessions every day I can record shorter sessions and make them available online. These videos will rage from VPN configurations on the ASA to NAT to Failover and more. But they don’t stop there. The videos will also cover other aspects of the CCIE Security Lab Exam blueprint topics such as Zone Based Firewalls, Flexible Packet Matching, IOS CA Servers, AAA, 802.1x, and so on.

    So, the web session itself is priced at 40 bucks. The membership to the site is 75 bucks monthly. What do you get for 75 bucks? You get enrolled in every live session I do beginning with the first session following your registration, plus access to every video I post and all topics of the blueprint.

    The Bootcamps

    Finally, I’ve just launched a Bootcamps section where you can purchase a 12 day bootcamp here in Irvine, Ca, which will run in March of 2011. This bootcamp will be lab focused and designed to prepare you in each aspect of the lab exam blueprint. It will help you identify any weak areas you may have and you’ll get specific attention on those areas. You’ll get a number of labs to work on during the 12 days as well as your own rack of equipment to work on. The 12 day bootcamp is currently priced at 4500.00 but will go up after the 1st of the year. If you get in early you score the lower price.

    The Last Deal of the Year!

    I promised one last deal of the year. Actually I’m going to give you two deals to take advantage of.

    Deal #1: Sign up for the CCIE ASA web session and get a 2 month membership for free

    This Special Has Ended

    If you enroll in the CCIE ASA web session using the “Buy Now” button just above this line, you’ll get a two month membership to all sessions and videos. The cost of the CCIE ASA Web Session is $40.00.

    Deal #2: Sign up for the bootcamp and get a lifetime membership along with it.

    CCIE Security Bootcamp with Free Lifetime Membership Cost: $4500.00

    Enroll in the bootcamp using the button above, before January 1st, 2011, and I’ll throw in a lifetime membership to the web sessions and videos. Of course, if you’d like to use one of the flexible payment options you are welcome to, however this deal applies only to bootcamps paid in full prior to January 1st, 2011.

    So what’s in the Pipeline

    We’re not stopping there. I’m currently writing technology specific labs for CCIE Security candidates and plan to release them early next year. Additionally members will receive an exclusive discount program on Cisco Training in other areas.

    Also, there are more technical blog posts to come as well!

    Related Posts:

    ]]>     http://globalconfig.net/iegeneral/recap-of-changes-and-one-last-deal-of-the-year/feed/ 0     Free CCIE Security Web Sessions! http://globalconfig.net/ccie-security/free-bgp-authentication-thru-asa%e2%80%99s-web-session-december-23%e2%80%b2rd-2010/ http://globalconfig.net/ccie-security/free-bgp-authentication-thru-asa%e2%80%99s-web-session-december-23%e2%80%b2rd-2010/#comments Thu, 23 Dec 2010 07:40:00 +0000 Brandon Carroll, CCIE #23837 http://globalconfig.net/?p=1798 On December 23rd, 2010 at 11PM PDT I offered a free CCIE Security Web Session where i covered how to authenticate BGP Sessions through and ASA. The session was recorded and is being made available through the members only area of globalconfig.net. If you’d like to gain access to this, or any future web sessions, simply follow the link to register on the site. Once registered you will need to “opt-in”. You’ll then get an email with all the access details for the previous recordings and future free sessions.

    Related Posts:

    ]]>     http://globalconfig.net/ccie-security/free-bgp-authentication-thru-asa%e2%80%99s-web-session-december-23%e2%80%b2rd-2010/feed/ 0