Network Security
What to master
Cisco Secure Firewall is usually managed through Firepower Management Center (FMC) with Firepower Threat Defense (FTD) devices. Know interface and zone design, access control policies, NAT order, and routing. VPN is heavily tested: IPsec IKEv1 versus IKEv2, phase 1 (IKE/ISAKMP SA) and phase 2 (IPsec SA), crypto maps, tunnel versus transport mode, and remote-access AnyConnect with split tunneling. Site-to-site VPN questions often hinge on mirrored crypto ACLs and NAT exemption. Also understand IPS/IDS modes-inline prevention versus promiscuous detection-and Snort rule actions. Segmentation (VLANs, VRFs, zones) and failover or clustering are fair game.
Traps
- Crypto ACLs must be mirror images on peers; a mismatch often shows phase 2 failure while phase 1 remains up.
- NAT exemption must be evaluated before dynamic NAT, or tunnel traffic gets translated and dropped.
- IKEv2 uses proposals and PSK or PKI; mismatched encryption, hash, or DH fails phase 1.
- Stateful failover preserves sessions; stateless failover does not. Do not confuse interface monitoring with failover health.
- An inline IPS can drop traffic; a promiscuous IDS only alerts.
Worked example
A site-to-site tunnel is down after a change. Verify the IKE SA first, then the IPsec SA. If phase 1 is up and phase 2 shows no encaps/decaps, compare proxy ACLs and NAT exemption. Rule of thumb: phase 1 before phase 2, and interesting traffic before encryption.