CoPP vs CPPr: Which Control-Plane Defense to Deploy
CoPP is one aggregate policer; CPPr subdivides the control plane and adds port-filtering. A decision guide backed by a real CoPP police capture.
Labs
Hands-on Cisco IOS XE lab walkthroughs. Each lab ships with a real CML topology, configs you can paste, and verified show output. Articles tagged Labs cover the full CCNA 200-301 blueprint across Network Fundamentals, Network Access, IP Connectivity, IP Services, and Security Fundamentals.
Latest
Control Plane Protection (CPPr): Beyond CoPP with Port-Filtering
CPPr subdivides the control plane into host, transit and cef-exception subinterfaces and adds port-filtering, next to real CoPP police captures from CML.
ZBF vs ASA vs FTD: Which Firewall Belongs Where
Cisco sells three different stateful firewalls, and engineers argue about which one is "best" as if there were
Nested Class-Maps in ZBF: Building Layered Policy
Most Zone-Based Firewall policies you will see are flat: a class-map lists a handful of match protocol lines,
ZBF Port-Maps: Inspecting Applications on Non-Standard Ports
You have a Zone-Based Firewall inspecting traffic on your Cisco IOS XE router, you write match protocol http to
Zone-Based Firewall on Cisco IOS XE: Zones, Zone-Pairs, and the Policy Model
The Zone-Based Firewall (ZBF) is the stateful firewall that lives inside Cisco IOS XE. It is not a bolt-
ASA
·
Clientless SSL VPN Is Gone: What Replaced WebVPN on Modern ASA
Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
ASA
·
ASDM Access on the ASA: Setup, TLS, and Whether You Should Use It
Enable ASDM on a Cisco ASA 9.24, hit the image-not-set gotcha, and get the honest 2026 verdict on the Java GUI versus the CLI.
ASA
·
IPsec Through an ASA: NAT-T, ESP Pass-Through, and Why the Tunnel Won't Come Up
Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.
ASA
·
IKEv1 vs IKEv2 on the ASA: Migrating a Site-to-Site Tunnel
Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.
ASA
·
LAN-to-LAN IPsec VPN on the ASA with IKEv2
A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.
ASA
·
Transparent Mode ACLs: EtherType Rules and What Bridges Through
Every ACL you have ever written on a firewall operates on IP: source address, destination address, port, protocol. A routed