The CCIE Security lab is not a written test with a keyboard attached. It is an eight-hour, hands-on practical exam where you plan, deploy, operate, and optimize the end-to-end security of a dual-stack (IPv4 and IPv6) enterprise network, then troubleshoot it when the graders break it under you. You do not get credit for knowing what a crypto map is. You get credit for building one that passes traffic, surviving a failover with zero packet loss, and explaining why the tunnel that should be up is stuck in MM_WAIT_MSG2.
This hub maps every domain of the current CCIE Security v6.1 blueprint to the PingLabz articles that cover it, all grounded in real captures from a Cisco Modeling Labs (CML) rack: cat8000v and IOL-XE routers, asav firewalls, and a real Debian host bridged into the topology. Where a feature genuinely does not exist on virtual hardware, we say so and show the parser rejecting it, because knowing the platform boundary is itself an exam skill. Use this page as your table of contents: work a domain top to bottom, follow the links, and lab everything you read.
The Two Exams: Qualifying, Then the Lab
CCIE Security is a two-stage certification, and the stages test very different muscles.
Stage 1, the qualifying exam (350-701 SCOR). A 120-minute written exam on core security technologies: network security, cloud security, content security, endpoint protection, secure network access, visibility, and enforcement. It is the same exam that anchors CCNP Security, so passing it also moves your professional-level track forward. You must pass SCOR before you are allowed to book the lab. (Cisco is refreshing SCOR from v1.1 to v2.0 in late 2026, so check the current blueprint before you schedule.)
Stage 2, the practical exam (v6.1). Eight hours, hands-on, on real Cisco security gear. Cisco describes it as designing, deploying, operating, and optimizing end-to-end security for a dual-stack enterprise network, and you are expected to program and automate the network inside the exam as well. The lab is weighted across five domains: Perimeter Security and Intrusion Prevention (20%), Secure Connectivity and Segmentation (20%), Security Infrastructure (15%), Identity Management, Information Exchange and Access Control (25%), and Advanced Threat Protection and Content Security (20%).
What the lab actually asks of you is muscle memory under time pressure: bring up a FlexVPN hub with IKEv2 and a AAA authorization policy from a blank config, get OSPF adjacencies through an ASA in transparent mode, tune CoPP so the control plane survives a flood, then find the one NAT rule in the wrong section that is silently black-holing an inbound service. Reading about these does almost nothing. Building them, breaking them, and reading the counters is the whole game. That is why every article below is built on captured output you can reproduce.
Domain 1: Perimeter Security and Intrusion Prevention (20%)
This domain is firewalls: Cisco ASA and Firepower Threat Defense (FTD) deployment modes, NAT, application inspection, high availability, and the IOS/IOS XE Zone-Based Firewall. PingLabz has deep, lab-proven coverage of the ASA and IOS ZBF halves. The FTD and FMC half is on the backlog (see the honest note at the end of this section), so it is listed there rather than linked to pages that do not exist yet.
ASA Deployment Modes, Contexts, and Transparent Firewalling (1.1)
Firewall Features: NAT and Application Inspection (1.2, 1.3)
NAT on the modern ASA is a table with sections and an order of operations, not a pile of commands. Get the order wrong and the right rule never fires. The Modular Policy Framework (MPF) is how the ASA does everything from protocol inspection to TCP normalization, and it is the single most reusable pattern on the box.
High Availability and Clustering (1.8), Routing-Protocol Security (1.10)
This is where a virtual lab teaches you as much by what it refuses as by what it builds. Active/Standby stateful failover works perfectly on asav and is worth building until it is reflex. The hardware-oriented HA features (redundant interfaces, EtherChannel, Active/Active, clustering) are concept-plus-config on virtual gear, so those articles pair the design with the real platform boundary.
Policies, Connectivity, and Management (1.9, 1.11)
Domain 2: Secure Connectivity and Segmentation (20%)
This is the heart of PingLabz's security coverage: IPsec, IKEv2, FlexVPN, GETVPN, DMVPN, the ASA VPN suite, an IOS CA you can actually run, and the segmentation building blocks (VLAN, PVLAN, GRE, VRF-Lite). Start with the IPsec VPN pillar and the DMVPN pillar, then work the clusters below.
IPsec and IKEv2 Site-to-Site (2.3)
FlexVPN and GETVPN (2.3, 2.4)
IOS CA and Certificate Authentication (2.2)
ASA Remote-Access and LAN-to-LAN VPNs (2.1, 2.3)
Segmentation: VLAN, PVLAN, GRE, VRF-Lite, SGT (2.5, 2.6)
Domain 3: Security Infrastructure (15%)
Domain 3 is hardening the network devices themselves: control-plane protection, management- and data-plane defense, Layer 2 security, and the monitoring and automation plumbing. The infrastructure security pillar ties the router-hardening pieces together; the VLANs and Layer 2 switching pillar anchors the switch-side controls.
Control-Plane and Device Hardening (3.1, 3.2)
Data-Plane and Anti-Spoofing (3.3, 3.7)
Layer 2 Security (3.4)
Monitoring, NTP, and Automation (3.6, 3.9)
Wireless security (3.5) and the broader monitoring stack are covered in the Cisco wireless guide and the network automation pillar.
Domain 4: Identity Management, Information Exchange, and Access Control (25%)
This is the single largest domain on the lab at 25 percent, and it is built around Cisco ISE: 802.1X and MAB, guest and BYOD onboarding, posture, profiling, external identity sources, DUO MFA, and IBNS 2.0. PingLabz has the network-access foundation live in the 802.1X pillar, and the ISE control layer is the next cluster on the build list.
The identity control plane itself (ISE personas and scaling, guest lifecycle, BYOD onboarding, posture assessment, endpoint profiling, external identity sources, DUO, and IBNS 2.0 / C3PL) is on the backlog. A dedicated ISE image (ISE 3.5) is now staged on the CML server, so this cluster is next up rather than hypothetical. Until it publishes, this hub will not link ISE articles that do not exist. See the backlog section below.
Domain 5: Advanced Threat Protection and Content Security (20%)
Domain 5 is the Cisco content-security and threat portfolio: AMP (now Secure Endpoint), Umbrella DNS-layer security, WSA and ESA, SMA, Stealthwatch, and packet capture and analysis. The packet-capture skill (5.3) is live today; the appliance-based content-security products are on the backlog.
AMP/Secure Endpoint, Umbrella (DNS, RBI, CASB, DLP), WSA and ESA content security, WCCP redirection, and the SMA/Stealthwatch integration story are not yet covered. They are listed honestly in the backlog rather than linked.
A Recommended Reading Order
If you are working the domains in study order rather than exam-weight order, this sequence builds each layer on the one below it:
- Firewall fundamentals first. ASA security levels, packet flow, and NAT order of operations, then the MPF and inspection engines. You cannot troubleshoot a VPN through a firewall you do not understand.
- Then VPNs, in this order: IPsec IKE phases, crypto maps, SVTI, IKEv2, then FlexVPN, then GETVPN, then DMVPN redundancy. Add the IOS CA and certificate auth once the tunnels work with pre-shared keys.
- Then infrastructure hardening. CoPP/CPPr, anti-spoofing and uRPF, router service hardening, then the full Layer 2 stack (DHCP snooping first, because DAI and IPSG depend on it).
- Then identity. 802.1X and MAB now; ISE, posture, and BYOD when that cluster publishes.
- Automation and capture throughout. On-box Python, telemetry, and packet capture are not a separate study block; fold them into every domain as verification tools.
The Pillar Guides
Each pillar below is a full cluster hub with its own article index. These seven carry the bulk of the CCIE Security-relevant material on PingLabz:
Dual-Stack Is Not Optional: IPv6 Security and Services
The CCIE Security lab is explicitly dual-stack, which means every control you build has an IPv6 counterpart the graders can test. The IPv6 pillar covers the routing and transition mechanisms; the first-hop security articles map directly to blueprint 3.4.f.
What a Home Lab Can and Cannot Prove
A good study lab is honest about its own boundaries, because on the real exam you are expected to know which features live on which platform. Everything below was hit during the build of this material on CML, and each limit is a thing worth being able to reason about out loud.
What the virtual lab proves cleanly
- ASA Active/Standby stateful failover, with real zero packet loss. A 45-packet stream through the firewall survived a forced active-unit failover with 45 of 45 received, 0% loss, and the full Standby-Ready to Active state machine in the failover history. This is the anchor HA demo, and it is completely real on asav.
- The entire IOS/IOS XE VPN suite. Crypto maps, SVTI, IKEv2, FlexVPN hub-and-spoke, GETVPN with COOP key servers, VRF-aware IPsec, and a router-based CA all come up and pass traffic on cat8000v and IOL-XE.
- The control-plane and Layer 2 hardening stack. CoPP/CPPr, DHCP snooping, DAI, IP Source Guard, VACLs, and private VLANs all enforce and can be verified with real counters.
- Good news on licensing: cat8000v 17.18.02 came up at License Level network-advantage straight from the day0 config on first boot, with no reload, so every crypto command was accepted immediately.
Where the virtual platform draws a hard line (and that is the lesson)
- asav supports only Active/Standby. The parser flatly rejects the hardware-oriented HA and scale features:
interface Redundant1,interface Port-channel1/channel-group,mode multiple(multiple-context mode, and therefore Active/Active and resource classes), andcluster interface-mode spannedall return% Invalid input. This matches Cisco's own docs (the ASAv does not support multiple contexts or clustering), so those articles teach the concept, show the hardware config, and show the real refusal. Knowing the boundary is the exam-relevant skill. - Clientless SSL VPN (WebVPN) is removed on ASA 9.17 and later. If your study notes still show a clientless portal, they predate the removal. The modern answer is the AnyConnect / Secure Client model.
- The Zone-Based Firewall needs a licensed cat8000v. ZBF is not available on IOL-XE, so the ZBF articles were built on cat8000v with network-advantage. Picking the right node for the feature is part of building a lab that can actually prove the thing you are studying.
- Virtual IOL does not fully forward every data-plane feature. Some counters that would move on real silicon (uRPF drop counters, NAT64 translation entries) stay flat on the virtual data path. The configuration and control-plane logic are correct and testable; the packet-forwarding proof needs different gear. Recognizing that a clean config with a zero counter can be a platform artifact, not a mistake, is a genuine troubleshooting skill.
- FMCv is a 30-to-45-minute boot, and ftdv takes another 15-to-25 minutes to initialize before registration. That boot budget is exactly why the FTD/FMC cluster is on the backlog rather than rushed, and it is a real planning lesson for anyone building an FTD lab at home: start the appliances first and do other work while they come up.
- Honest VPN edge case: on cat8000v 17.18.02, FlexVPN hub-and-spoke worked fully (both spokes authenticated, routes injected, spoke-to-spoke traffic passed), but the NHRP shortcut never fired, so spoke-to-spoke traffic hairpinned through the hub with every NHRP counter at zero. The article is written as a field report with the real 2-hop traceroute, not a faked 1-hop result, and points to the DMVPN cluster where NHRP shortcut is proven working on IOL-XE. Being able to tell a control-plane bug from a platform behavior is the point.
On the Backlog: What This Hub Does Not Link Yet
Topical authority is built by not faking coverage. The following blueprint areas are genuinely in progress and are listed here rather than linked to pages that do not exist:
Frequently Asked Questions
Is CCIE Security worth it in 2026?
For the right person, yes. The certification signals that you can design and operate end-to-end security on Cisco gear under pressure, and it remains one of the few credentials that is validated by an eight-hour hands-on lab rather than a multiple-choice test. The honest caveats: it is a large time investment (typically a year or more of lab hours), the technology set is broad and shifts with each blueprint (FTD, ISE, and cloud security keep growing), and it is most valuable if your role or target role is genuinely security-focused. If you want the depth but not the exam, the same lab practice makes you materially better at the day job either way.
How do I build a CCIE Security home lab?
Cisco Modeling Labs (CML) is the practical foundation. It runs cat8000v and IOL-XE routers, IOL-L2 switches, and asav firewalls, which covers Domains 2 and 3 and most of Domain 1 outright. Add ftdv and FMCv for the NGFW domain (budget the RAM: FMCv wants 32 GB and a 30-to-45-minute boot), and an ISE VM for Domain 4. Bridge a real Linux host into the topology so you have a genuine client for testing VPNs, captures, and posture. The recurring lesson from building this material: match the node to the feature (ZBF needs a licensed cat8000v, not IOL-XE) and start the heavyweight appliances first so they are ready when you are.
ASA or FTD for the lab?
Both, because the blueprint tests both. The ASA is where you build the muscle memory for NAT order of operations, the Modular Policy Framework, failover, and contexts; it boots fast and is forgiving to lab. FTD (managed by FMC or FDM) is where the NGFW features live: SSL inspection, user identity, geolocation, AVC, and intrusion policy. The practical approach is to master the ASA first because its concepts underpin FTD, then layer FTD on top. Note that on virtual asav the hardware HA and scale features (Active/Active, clustering, contexts) are concept-only, so you will lab those designs on paper and prove Active/Standby stateful failover live.
What is the difference between the CCIE Security written and lab exams?
The written qualifying exam (350-701 SCOR) is a 120-minute test of core security knowledge that you must pass first, and it doubles as the CCNP Security core exam. The practical exam (v6.1) is a separate eight-hour hands-on lab where you design, deploy, operate, optimize, and troubleshoot a real dual-stack network. Passing the written does not get you the CCIE; it gets you the right to book the lab. The two test different things: recall versus execution under time pressure.
Does the CCIE Security lab really test IPv6?
Yes, explicitly. Cisco describes the exam as end-to-end security of a dual-stack (IPv4 and IPv6) enterprise network, so IPv6 is not a separate section you can skip; it runs through every domain. Expect to secure IPv6 routing, apply IPv6 first-hop security (RA Guard, DHCPv6 Guard, ND inspection), and handle transition mechanisms. Treat every control you learn as something you must also be able to do for IPv6.
How much automation is on the CCIE Security lab?
Enough that you cannot ignore it. The blueprint calls out interacting with devices through REST APIs using basic Python, the JSON/XML/YAML encoding formats, and DNAC northbound API use cases. You are not expected to be a software engineer, but you should be able to read and write a basic Python script that hits a REST API, parse the response, and understand the data formats. On-box Python and Jinja2 templating are the most exam-adjacent skills to practice.
Key Takeaways
- CCIE Security is two exams: the 350-701 SCOR qualifying written, then the eight-hour hands-on v6.1 practical lab. Both are required, and the lab is where execution under time pressure is tested.
- The lab is weighted Perimeter Security 20%, Secure Connectivity and Segmentation 20%, Security Infrastructure 15%, Identity Management 25%, and Advanced Threat Protection and Content Security 20%, on a dual-stack network you must also automate.
- PingLabz has lab-proven, capture-backed coverage of the VPN, ASA firewall, IOS ZBF, infrastructure-hardening, Layer 2 security, and IPv6 domains, all cross-linked from the pillar guides above.
- The NGFW/FTD, ISE identity, and content-security domains are on the backlog and are listed honestly rather than linked, so every link on this page points to content that actually exists.
- A study lab is only as good as its honesty about platform limits: know that asav is Active/Standby only, that WebVPN is gone on 9.17+, that ZBF needs a licensed cat8000v, and that a zero counter on virtual IOL can be an artifact rather than a bug.
- Lab everything. Reading about a crypto map or a failover proves nothing; building it, breaking it, and reading the counters is the entire point of the CCIE.