What is 802.1X Authentication? End-to-End Flow with Real show Output
How 802.1X authenticates a switch port from link-up to traffic flow. The three roles, EAPoL exchange, IOS XE config, host modes, and real show authentication sessions output.
Jaime
Latest posts — page 32
OSPF vs BGP Redistribution: Which Protocol Wins Which Tie
When OSPF and BGP both know about the same prefix, who wins? A practical walkthrough of mutual redistribution, the admin-distance trap, and why BGP into OSPF needs a filter or it takes down your domain.
paid
Lab sec-10 - Wireless Security WPA2 vs WPA3 (Concept Lab)
Concept lab comparing WPA2 and WPA3 for the CCNA: the five Wi-Fi security generations, why KRACK broke WPA2 and how WPA3 fixed it, PSK vs 802.1X modes, forward secrecy, and OWE for open networks.
paid
Lab sec-09 - IPsec Site-to-Site Overview (Concept Lab)
A concept lab on IPsec site-to-site VPNs: IKE Phase 1 and Phase 2, tunnel vs transport mode, ESP vs AH, and the shape of the configuration on Cisco IOS XE.
paid
Lab sec-05 - DHCP Snooping and Dynamic ARP Inspection
Configure DHCP snooping and Dynamic ARP Inspection on SW1: build the binding table, set trusted ports, and verify with show ip dhcp snooping and show ip arp inspection. Stops rogue DHCP servers, starvation attacks, and ARP poisoning.
paid
Lab sec-08 - 802.1X Port-Based Authentication (Switch Side)
Configure the switch side of 802.1X on SW1: the authenticator role, the dot1x port-control modes, and what the show output tells you. The supplicant and RADIUS server roles are covered conceptually since both sit outside CML Free.
paid
Lab sec-07 - AAA New-Model with Local Fallback
Configure AAA new-model on R1 with the local database as the primary method: named method lists for vty and console, the four AAA methods, and the fallback chain that keeps you logged in when servers are unreachable.
paid
Lab sec-06 - SSH and Disable Telnet
Configure SSH version 2 on a Cisco router: generate RSA keys, set the hostname and domain name, enable ip ssh version 2, and restrict the vty lines to SSH only so telnet's plaintext passwords are gone for good.
paid
Lab ips-10 - QoS LLQ + CBWFQ on WAN Egress
Attach a QoS policy to WAN egress: priority percent builds an LLQ for voice, bandwidth percent builds CBWFQ for the rest, and show policy-map interface proves each class with packet counters. Builds on the ips-09 marking lab.
paid
Lab sec-04 - Port Security and MAC Pinning
Configure port security on SW1: the protect, restrict, and shutdown violation modes, MAC count limits, and sticky MAC learning, verified with show port-security interface. Stops casual plug-anything-in attacks at the access layer.
paid
Lab sec-03 - Extended ACL (Named)
Configure a named extended ACL on IOS XE: matching by protocol and destination port, the established keyword, inserting entries by line number, and why extended ACLs belong close to the source.
paid
Lab sec-01 - Line and Enable Passwords (Modern Best Practice)
Modern Cisco password practice: scrypt-hashed enable secrets, an AAA-aware user database, and no plain-text passwords anywhere. This lab shows why type 9 beats types 0, 5, and 7 in 2026.