Infrastructure Security & IP Services
Go deep on the infrastructure security and IP services topics that sit at the core of enterprise networking — device hardening, switch and router security features, IPv6 first-hop security, system management, QoS, FHRP and time synchronization, DHCP, NAT, network optimization, and operational tooling like SPAN and packet capture.
The launch will be soonCourse Highlights
Device & Control Plane Security
Configure CoPP, CPPr, centralized AAA via TACACS+ and RADIUS, administrative command authorization, and line-based authentication on Cisco IOS XE.
Switch & Router Security
Master VACLs, PACLs, Storm Control, DHCP Snooping, IP Source Guard, Dynamic ARP Inspection, uRPF, and advanced IPv4/IPv6 access control lists.
IPv6 First-Hop Security
Deploy IPv6 RA Guard, DHCP Guard, Neighbor Discovery Inspection, device tracking, binding tables, and IPv6 Source Guard to protect access ports.
Quality of Service (QoS)
Build end-to-end MQC policies covering DiffServ classification, NBAR2 deep inspection, DSCP marking, policing, shaping, and congestion management.
Core Network Services
Configure FHRP redundancy (HSRP/VRRP), DHCP roles, stateful/stateless DHCPv6 with prefix delegation, and multi-tenant VRF-Aware NAT/PAT.
Optimization & Operations
Utilize IP SLA, NetFlow, SPAN/RSPAN/ERSPAN, Embedded Packet Capture (EPC), data path trace, and conditional debugging frameworks.
Complete Blueprint Section Coverage
Designed for CCIE Enterprise Infrastructure candidates and working network engineers who need real configuration reps across the entire Section 4 blueprint.
Gain intensive, hands-on practice covering every sub-topic, from robust device hardening and advanced QoS to complex NAT topologies and operational troubleshooting.
- Granular Device Hardening: Protect route processors and management planes using CoPP, CPPr, and robust AAA frameworks.
- End-to-End QoS Execution: Master modular QoS CLI (MQC) structures, traffic conditioning, and hierarchical queuing policies.
- Advanced Operational Tooling: Diagnose complex forwarding anomalies using packet tracing, EPC, and conditional debugging.
Technologies Covered
- ✓ CoPP, CPPr & TACACS+ / RADIUS Device Security
- ✓ VACLs, PACLs, DHCP Snooping & Dynamic ARP Inspection
- ✓ IPv6 First-Hop Security (RA Guard, DHCPv6 Guard & Source Guard)
- ✓ System Management, RESTCONF/NETCONF & Secure Logging
- ✓ Modular QoS CLI (MQC), NBAR2, Policing & Shaping
- ✓ FHRP Redundancy (HSRP/VRRP) & NTP/PTP Synchronization
- ✓ DHCP Server/Relay & Stateful/Stateless DHCPv6
- ✓ IPv4/IPv6 NAT, PAT, Policy-Based & VRF-Aware NAT / VASI
- ✓ IP SLA Probes, Tracking Objects & Flexible NetFlow
- ✓ SPAN, RSPAN & ERSPAN Traffic Capture
- ✓ Embedded Packet Capture (EPC) & Data Path Packet Tracing
- ✓ Conditional Debugging Platforms for Root-Cause Isolation
Modules & Topics
Module numbers below reference the corresponding Cisco CCIE Enterprise Infrastructure (v1.1) blueprint sections.
- Configure Control Plane Policing (CoPP) to rate-limit and protect the route processor from control-plane floods
- Configure Control Plane Protection (CPPr) with host, transit, and CEF-exception sub-interfaces
- Configure local, line-based authentication and privilege levels for console and VTY access
- Configure centralized device-administration AAA using TACACS+
- Configure centralized network-access AAA using RADIUS
- Configure AAA command authorization and accounting for administrative audit logging
- Configure and verify VLAN Access Control Lists (VACL) to filter intra-VLAN traffic
- Configure and verify Port Access Control Lists (PACL) on Layer 2 switchports
- Configure Storm Control to mitigate broadcast, multicast, and unicast storms
- Configure DHCP Snooping and DHCP Option 82 to build a trusted binding database
- Configure IP Source Guard to prevent IP/MAC spoofing using the DHCP snooping binding table
- Configure Dynamic ARP Inspection to prevent ARP spoofing and man-in-the-middle attacks
- Configure Port Security to restrict and sticky-learn MAC addresses per switchport
- Configure IPv6 traffic filters to control IPv6 traffic at Layer 3
- Configure standard, extended, and named IPv4 access control lists
- Configure Unicast Reverse Path Forwarding (uRPF, strict/loose mode) to prevent source-address spoofing
- Configure IPv6 RA Guard to block rogue Router Advertisements
- Configure IPv6 DHCP Guard to block rogue DHCPv6 servers/relays
- Build and verify the IPv6 first-hop security binding table
- Configure IPv6 Device Tracking to monitor host reachability and state
- Configure ND Inspection/Snooping to validate Neighbor Discovery messages
- Configure IPv6 Source Guard to prevent address spoofing on access ports
- Secure console and VTY line access with exec-timeout, access-class, and transport restrictions
- Configure and harden SSH and SCP for secure device access and file transfer
- Enable and verify RESTCONF and NETCONF for programmatic device management
- Configure SNMPv2c and SNMPv3 with authentication and privacy
- Configure local logging, syslog, debugs, and conditional debugging
- Enable configuration change notification and logging
- Configure and verify accurate timestamps on logs and debug output
- Explain and apply the Differentiated Services (DiffServ) architecture
- Configure traffic classification and define trust boundaries
- Configure Network-Based Application Recognition (NBAR/NBAR2) for deep packet classification
- Mark DSCP values in IPv4 and IPv6 headers
- Configure policing and shaping to control traffic rates
- Configure congestion management and avoidance (CBWFQ/LLQ, WRED)
- Configure Hierarchical QoS with parent/child policy structures
- Build end-to-end Layer 3 QoS policies using the Modular QoS CLI (MQC)
- Configure HSRP and VRRP for default-gateway redundancy
- Configure IPv6 gateway redundancy using Router Solicitation/Advertisement
- Configure NTP in client mode for device time synchronization
- Evaluate PTP design considerations for precision time synchronization
- Configure DHCP client, server, and relay roles on Cisco devices
- Configure DHCP options for custom client parameters
- Integrate SLAAC with DHCPv6 for IPv6 address assignment
- Configure Stateful and Stateless DHCPv6
- Configure DHCPv6 Prefix Delegation for downstream routers
- Configure Static NAT and Static PAT for fixed address/port translation
- Configure Dynamic NAT and Dynamic PAT using address pools
- Configure Policy-Based NAT/PAT using route-maps for selective translation
- Configure VRF-Aware NAT/PAT for multi-tenant environments
- Configure VRF-Aware Software Infrastructure (VASI) NAT between VRFs
- Configure IP SLA using ICMP, UDP, and TCP probes
- Configure Tracking Objects and Track Lists tied to IP SLA and interface state
- Configure Flexible NetFlow for traffic visibility and export
- Configure SPAN, RSPAN, and ERSPAN for local and remote traffic capture
- Configure Embedded Packet Capture (EPC) for on-box packet analysis
- Use data path packet trace to troubleshoot forwarding issues
- Use the conditional debug platform framework to isolate per-interface / per-packet issues
Start Your Lab Experience
Lab Hours Booking
Reserve access to a dedicated, pre-wired enterprise security and services lab environment and use your purchased lab hours whenever it suits you.
- Direct access via browser and internet connection
- Dedicated Cisco IOS XE routers and Catalyst switches
- Full control over CoPP, QoS MQC policies, NAT, and telemetry features
- Zero hardware required on your side
- Schedule your lab session for any available date and time