Security / Technical Security

Network Security with Cisco and Palo Alto Networks — Switching, Routing and Next-Generation Firewall

A three-day course that prepares participants to design, configure and secure network infrastructure built on Cisco and Palo Alto Networks equipment, and to monitor network security. The program runs through three thematic days: from designing a secure local network and layer-two protection mechanisms, through securing the routing process, segmenting traffic and hardening the devices themselves, to the architecture of a next-generation firewall and the configuration of its core functions. The configuration exercises, in which participants carry out the tasks discussed themselves, form a separate block of the program.

Two products, three days, one infrastructure

Network security rarely fails in a single place. A well-configured firewall will not help if the local network allows someone to impersonate the default gateway or insert their own DHCP server. The reverse holds too: impeccably hardened switches do not replace traffic control at the edge.

So this course works from the bottom up. Day one covers layer two and the local network, where most of the quiet gaps appear. Day two covers routing, segmentation and hardening the devices themselves — the work that usually gets left “for later” and stays there for years. Day three covers the next-generation firewall: zones, policies, address translation and application objects.

What the program covers, and what it does not

The scope is described narrowly on purpose, because that is the precision with which it is delivered:

It covers network devices — switches, routers and the firewall. It does not cover server operating systems, endpoints or applications.
It covers monitoring and log analysis — Syslog, SNMPv3, NTP and troubleshooting with system tools. It does not cover incident response processes.
The encrypted IPSec tunnel sits in the exercise block, not in a separate theory module. If you need a full course on virtual private networks, say so before the course.
This is not a vendor-authorized course. The course is EITT’s own and does not prepare for a vendor exam. If a specific exam is the goal, the EITT catalog has separate certification courses.

Who it is for

For people who already administer a network and want to close the gap between “the network works” and “the network is secured”. The program assumes that addressing and the basics of working with a device command line are not new to the participant — the weight of the course sits on protection mechanisms, not on how networking works.

How we work

Every mechanism discussed has its counterpart in the exercise block: configuration, verification, and a look at what breaks when the protection is switched off. Troubleshooting is a full part of the material here rather than an add-on — because in practice most of the time goes not into deploying a control, but into working out why something stopped working once it was enabled.

Benefits

Configuring and securing local networks and routing mechanisms
Deploying security policies on network devices and on a next-generation firewall
Managing administrative access and traffic segmentation
Monitoring network traffic and analyzing logs
Diagnosing problems and verifying the effectiveness of the security measures applied

Who is this training for?

Administrators of local and wide area networks

Specialists responsible for the security of network infrastructure

Engineers deploying security policies on edge devices

Professionals maintaining switches and routers in a production environment

Training program

Principles of designing secure network infrastructure
Network segmentation as a security control and defining trust zones
The most common design mistakes
Virtual networks as a traffic isolation mechanism, IEEE 802.1Q trunking
Native VLAN, Private VLAN, Voice VLAN
Managing broadcast traffic
Layer-two protection mechanisms: Port Security, BPDU Guard, Root Guard
Storm Control, DHCP Snooping, Dynamic ARP Inspection
Monitoring and troubleshooting the local network: MAC table analysis, loop detection

Static routing and OSPF dynamic routing
OSPF neighbor authentication and protecting the routing process
Default gateway redundancy
Inter-VLAN routing and traffic filtering
Access control lists as a traffic control mechanism
Restricting access to administrative services, the least privilege principle
Secure configuration of switches and routers, SSH instead of Telnet
Authentication, authorization and accounting, password management
Configuration backups and device software updates
Infrastructure monitoring: Syslog, SNMPv3, NTP, log analysis

Differences between a classic firewall and a next-generation firewall
The architecture of the Palo Alto Networks system and security zones
Layer 3 interfaces and Security Zones
Virtual Router and NAT address translation
Security Policies as the written form of a security policy
Service objects, address objects and application objects

Configuring switches and deploying layer-two protection mechanisms
Configuring static routing and OSPF, implementing access control lists
Securing administrative access to devices
Configuring and managing a next-generation firewall, creating security policies
Configuring NAT address translation
Building an encrypted IPSec tunnel
Log analysis and network traffic troubleshooting
Verifying the effectiveness of the deployed security measures

Delivery Methods

Online

Convenience of participating from anywhere
Interactive live sessions with trainer
Materials available for 30 days
No travel costs

On-site

Direct contact with trainer and group
Intensive hands-on workshops
Networking with other participants
Full focus on learning

Training Topics

Frequently asked questions

How long is the course?

The training lasts 3 days. Each day closes one area: secure switched infrastructure, routing and wide area network security, and finally the next-generation firewall.

Is this a vendor-authorized course?

No. This is an EITT course delivered on Cisco and Palo Alto Networks equipment. It does not end with a vendor exam and does not lead to a vendor certificate.

Which two products does the program cover?

Days one and two cover Cisco switches and routers, day three covers the Palo Alto Networks next-generation firewall. The program covers network devices, not an organization's entire information and communication systems.

Does the course cover incident response?

No. The program covers infrastructure monitoring and log analysis using Syslog, SNMPv3 and NTP. Incident response processes and response team workflows are not discussed.

What form do the exercises take?

The exercises form a separate block of the program and consist of carrying out the configuration tasks discussed in the modules. The scope of the exercise environment is agreed before the course, depending on the delivery variant chosen.