802.1X is the IEEE standard for port-based network access control. A switch port stays closed until the device on the other end authenticates - typically via RADIUS through Cisco ISE or similar. Once authenticated, the port opens with the
AAA - Authentication, Authorization, Accounting - is the framework that lets centralized servers (TACACS+ or RADIUS) handle login validation, command authorization, and command-logging across all your network devices. The local user database becomes a fallback if AAA servers are unreachable. This
SSH (Secure Shell) is the encrypted, authenticated alternative to telnet for remote device management. Telnet sends passwords in plain text - readable by anyone on the wire. SSH encrypts the entire session. This lab configures SSH version 2 on R1, generates
The previous lab (ips-09) classified and marked traffic. This one APPLIES the policy to a WAN-egress interface and uses two queueing mechanisms: LLQ (Low Latency Queue) for voice traffic, CBWFQ (Class-Based Weighted Fair Queueing) for everything else.
Port security limits which MAC addresses can use a switch port. If an unauthorized MAC appears, the switch can drop, restrict, or shut the port. This stops casual "plug-anything-in" attacks at the access layer. This lab
Extended ACLs filter based on source IP, destination IP, protocol, source port, destination port, and various TCP flags. They are the workhorse ACL type in production. Named ACLs (vs numbered) give you a descriptive name and let you insert/remove
The first line of defense on any Cisco device is the password configuration. This lab walks through the modern best practice: scrypt-hashed enable secret, AAA-aware user database, no plain-text passwords anywhere. The shortcuts you may have seen
NTP (Network Time Protocol) synchronizes clocks across network devices so that log timestamps are consistent and meaningful. Without NTP, a single incident's logs spread across 10 routers might look like 10 unrelated events at unrelated times. This lab
QoS - Quality of Service - is how you give priority to traffic that needs it (voice, video) over traffic that does not (bulk file copies, software updates). The first step is CLASSIFICATION (identifying traffic that needs special treatment) and MARKING (tagging
SNMP (Simple Network Management Protocol) is how monitoring systems poll devices for status, counters, and config. SNMPv2c uses community strings (plain text, no encryption). SNMPv3 adds users, authentication (MD5/SHA), and encryption (DES/AES). Modern best practice: use SNMPv3 everywhere;
Syslog is the log-collection protocol every network device speaks. Configure your routers and switches to send their logs to a central syslog server, and you get a single searchable archive of everything that happened across the network. This lab
Static NAT creates a permanent one-to-one mapping between an inside private IP and an outside public IP. Used when an internal server needs to be reachable from the outside on a specific external address (web server, mail server,