I85PREP
⌘ K
CCIE Security study materials
CCIE Security study resources

CCIE Security: Network Security

CCIE Security · Work through your exam, one topic at a time.

All guide sections

Network Security

What this domain tests

Network Security covers protecting the transport itself: IPsec and FlexVPN, DMVPN and GET VPN, zone-based firewall policy, segmentation with Cisco TrustSec, and control-plane hardening. Exam scenarios often present a tunnel that negotiates but passes no traffic, or a segmentation rule enforced at the wrong device.

Core rules

  • IKEv2 uses a keyring, profile, and proposal; both peers must agree on encryption, integrity, PRF, and DH group or IKE_SA_INIT fails.
  • Route-based tunnels (VTI, FlexVPN virtual-template) select traffic by routing; policy-based crypto ACLs must mirror between peers.
  • TrustSec classifies packets into an SGT at ingress, carries it inline (802.1Q or Cisco Meta Data) or via SXP, and enforces SGACLs at egress.
  • Zone-based firewall uses zones and zone pairs; traffic between zones is denied unless a policy permits it, and inspect is stateful.
  • Control-plane protection uses CoPP, strict or loose uRPF, BGP TTL security, and routing-protocol authentication.
  • GET VPN uses group members registered to a key server and preserves the underlying routing topology without per-site tunnels.

Worked example

A spoke with WAN address 203.0.113.10/32 must encrypt traffic to 10.10.0.0/16 behind hub 198.51.100.1/32 while NATing Internet traffic. IKEv2 uses AES-256, SHA-256, and DH group 19.

Reasoning: build the keyring and profile matching the hub address, create a virtual-template, attach an IPsec profile with tunnel protection, and route 10.10.0.0/16 out the tunnel. The NAT ACL must deny 10.10.0.0/16 before permitting ip any any. The route, not a crypto ACL, selects traffic on a VTI. Without the route, packets follow the default route and are translated; without the NAT exemption, translation happens before tunnel encapsulation and the hub sees the wrong source.

Traps that cost marks

  • Mismatched proposals fail early; check PRF and DH, not just encryption.
  • A policy-based tunnel with a one-way ACL drops return traffic.
  • Inline SGT tagging needs hardware support; SXP carries SGTs only in the control plane.
  • Strict uRPF breaks asymmetric routing; loose uRPF checks reachability only.
  • CoPP that omits BGP or OSPF can drop the control plane while data still forwards.

Key points

  • Match IKEv2 proposals end to end before troubleshooting traffic selectors.
  • Route-based tunnels use routing for selection; policy-based tunnels use mirrored ACLs.
  • TrustSec enforces SGACLs at egress, not at classification.
  • Zone pairs default to deny; inspect maintains state.
  • NAT exemption must precede PAT for tunnel-bound traffic.
  • CoPP protects the control plane and must explicitly permit routing protocols.