FTDv 10 in Containerlab: Bootstrap Local FDM Without FMC
Bootstrap local FDM on FTDv 10 in Containerlab, deploy policy through the REST API, and fix unreachable management while verifying traffic still passes.
Security
Broader security topics that touch the network without belonging to a single platform. Threat models, defensive design, and the trade-offs behind each control.
Latest posts — page 2
ASA tcp-not-syn: Asymmetric Routing and TCP State Bypass
Reproduce ASA tcp-not-syn and syslog 106015 with asymmetric routing, then verify a routing repair and scoped TCP state bypass with the return ACL.
Suricata on a SPAN Port: Why the Wrong Mirror Direction Means No Alerts
Suricata shows no alerts during a port scan? Trace a SPAN direction fault through missing SYNs and EVE logs, then fix the mirror and verify recovery.
Cisco Port Security vs MAC Flooding: Limit Learning, Fix Shutdowns
Test Cisco port security against MAC flooding: 17,991 learned entries, a three-MAC protected table, and a phone-plus-PC shutdown fixed with maximum 2.
Cisco IPsec Phase 1 Up, Phase 2 Down: Five IOL Lab Tests
Phase 1 up, Phase 2 down on Cisco? Diagnose four IOL VPN outages with real debug, NAT and ESP evidence, plus a lifetime mismatch that kept working.
802.1X Dynamic VLAN Assignment Not Working: FreeRADIUS Lab
Trace a FreeRADIUS VLAN typo from Access-Accept to an unauthorized Cisco port. Compare sessions, syslog, pings, and Zeek, then verify the fix.
ASA NAT Troubleshooting: Stale Manual NAT Overrides Static NAT
Fix an ASA static NAT publish hijacked by a stale manual rule. Follow packet-tracer, NAT hits, syslog 106023, and Zeek S0-to-SF recovery in this lab.
MAB with FreeRADIUS on Cisco: MAC Authentication Bypass Without ISE
MAB with no ISE node and no license: FreeRADIUS 3.2.7 against a Catalyst 9000v, with the freeradius -X trail that proves MAB is bare PAP, the MAC format everyone gets wrong, and a real Method: mab / Authc Success on a live switchport.
802.1X with FreeRADIUS on Cisco: The Full Lab, No ISE Required
Every 802.1X guide assumes you have Cisco ISE. You do not need it. Here is the whole chain built on FreeRADIUS and a Catalyst 9000v, with real Access-Accept output, a port flipping to Authorized, and the CML switch image that silently wastes your evening.
Detecting Nmap Scans: The View From the Defender's Side
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.
Scapy vs Cisco Layer 2 Defenses: Crafting and Spoofing Packets
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
dnswalk: Audit a DNS Zone for Consistency
dnswalk transfers a DNS zone and audits it for internal consistency: missing PTR records, mismatched addresses, and bad delegations. Real Kali output shows you how to read what it flags.