Secure Networking
Secure Networking tests where Cisco security controls sit and how they are enforced across branch, campus, data center, and cloud: Cisco Secure Firewall (FTD with FMC), Umbrella DNS-layer security and SIG, Cisco Secure Access for SSE/ZTNA, ISE with TrustSec SGTs, security on Catalyst SD-WAN, and Zero Trust design. Expect scenario items asking you to pick an enforcement point and justify it.
Choosing the enforcement point
- Umbrella DNS resolver: blocks and logs by domain name, no decryption, no visibility into IP-literal traffic or non-web ports.
- SIG tunnel from the SD-WAN router: URL filtering, file inspection, TLS decryption, identity passed via integration (otherwise policy is keyed to the egress IP).
- Secure Access client/ZTNA: per-user, per-application access to private apps without a full tunnel.
- Secure Firewall: north-south segmentation, IPS, and east-west control in the data center.
- Campus segmentation: classify at ingress (VLAN or ISE), carry the SGT in Cisco Meta Data, enforce with SGACL.
Segmentation rules
SGTs ride in CMD on Catalyst, in the SGT field of VXLAN encap in EVPN fabrics, and across SD-WAN when configured; SXP propagates tags to devices that cannot tag natively. SGACLs are stateless, so return traffic needs its own rule or a stateful firewall. Roll out new policy in monitor mode before enforce mode.
Worked example
A 300-user branch needs direct internet access to SaaS, DNS-layer phishing blocking, file inspection on downloads, and guest traffic isolated from corporate. Reasoning: turn on Umbrella DNS on the SD-WAN DIA path - cheapest and lowest-latency block, catches most phishing at resolution. Add an Umbrella SIG IPsec tunnel from the same router for URL filtering and file inspection on that DIA path, and pass user identity from ISE/AD so policy is not keyed only to the branch IP. Put guests in a separate VPN/VRF with no SIG tunnel and local-only policy. Do not backhaul SaaS traffic to the data center - that defeats DIA.
Traps that cost marks
- Expecting DNS-layer security to catch IP-literal callbacks or DoH unless DoH control is enabled.
- Forgetting that TLS inspection requires a trusted internal CA and certificate distribution.
- Placing policy in the wrong firewall zone, or before/after NAT, so it never matches.
- Assuming SGTs survive a non-TrustSec hop without SXP.
- Treating SGACLs as stateful and losing return traffic.