NetSec Professional case studies
NetSec Professional · Put your knowledge to work in context.
NetSec Professional is an independent, vendor-neutral-style study track for network security practitioners who administer policy on a next-generation firewall. It is aimed at the working administrator - someone who already understands TCP/IP, routing, and basic cryptography and now needs to operate a security gateway day to day: assigning interfaces and zones, building the routing table, writing and ordering security policies, translating addresses with NAT, terminating IPsec and SSL tunnels, applying security profiles, and reading logs well enough to prove what happened. The NetSec Professional case studies are 5 cases and about 4,388 words.
1The 4% HTTPS Stall After Enabling ECMP
A stateful firewall at the HQ edge has two internet uplinks: ISP-A fiber at 500/100 Mbps with a 1500-byte MTU, and ISP-B fixed wireless at 200/50 Mbps delivered over PPPoE with a 1492-byte MTU, where the carrier's tunnel further reduces usable MTU to 1400 bytes. Last week you replaced static default routes with ECMP across both uplinks using 5-tuple hashing.
810 words, about 4 min2Intermittent Outages on a Two-Member LACP Bundle
A firewall connects to a pair of core switches through a two-member 10G LACP bundle, one member to each switch in an MLAG pair. VLANs 10 (users), 20 (voice), 30 (storage, jumbo frames), and 99 (management) cross the bundle.
861 words, about 4 min3Overlapping Subnets, Twice-NAT, and an ERP That Redirects
Company A (HQ, 10.10.0.0/16) acquires Company B, which also uses 10.10.0.0/16 internally. An IPsec tunnel already connects HQ edge 203.0.113.10 to B's edge 198.51.100.20.
894 words, about 4 min4Failover Takes 90 Seconds and the Tunnel Comes Back Half-Dead
A hub firewall terminates 40 route-based IPsec tunnels (IKEv2, PSK, /24 selectors) from branch offices and runs BGP with the branches over the tunnels. Branch 7 has a 150/150 Mbps fiber primary and an LTE backup behind carrier-grade NAT; the LTE tunnel is a secondary path with worse BGP local preference.
913 words, about 5 min5Logging That Drops 15% and Fills a 64 GB Partition in 36 Hours
Three perimeter firewalls each send session logs to a single syslog collector at 10.0.99.5 over UDP/514. Combined average volume is 8,000 events/s, peaking at 25,000 events/s during incidents, with an average event size of 300 bytes.
910 words, about 5 min