Status Update:

So in order to be fully transparent about this whole study thing: This week has been a bust!

There, i said it! now i need to do something about it.

So what happened? - Well, for one thing, i was out of the country from Thursday until Saturday (yesterday) with my great coworkers on our annual kick-off trip (it was a great time), and i didnt do much studying monday to wednesday either.

Status Update:

This is an update on my progress studying for the CCIE Security v6.1 Lab exam. Today is the 17th of January 2026 and im going to do an inventory of where im at and what i will be focusing on for the coming week.

Status Update:

Its weekend, which means its time to do a review on my study progress (along with other life items), but lets focus on the study part.

First off, i have about 12 weeks left before my next attempt. It is scheduled for April 13th.

So i just finished a lab that included integrating the WSA to my Lab Active Directory. One that thats certain is that you must enable NTP for this to work. I tried manually setting the time and even though it was just off by a few seconds, the WSA would not tolerate it and would cancel the integration.

I am currently setting up a home lab for practicing Cisco Web Security Appliance (WSA). I am using EVE-NG with an image for the WSA called: Coeus-10-5-2-072-S100V, which means its version 10.5.

I have it setup in my lab and was able to access it through the GUI after setting up IP + default gateway on it. However, i got an SSL error and was unable to use the GUI.

In my continued journey with Cisco TrustSec, I now have a verified switch configuration with all the components of basic TrustSec with ISE doing the policy and the switch doing the enforcement.

It was important to me to reach this point, as i now have to remember everything until this point in my practice. That and i dont have to fumble around a million different blog posts scattered all over the interwebs, in order to figure out what to do.

So today i spent some time setting up Cisco TrustSec on my ISE installation as well as my Catalyst 3650 switch. I did all the mandatory configuration on the switch, including:

• Setting up ISE / Radius with a pac key.
• Setting up a CTS authorization list that references the ISE / Radius server.
• Setting up device credentials on the Switch.
• Setup ISE to allow TLS 1.0 (this is required in order to get a PAC key assigned from ISE).
• Getting the PAC key on the Switch.

Everything was looking good so far, but for the life of me i could not get the environment data from ISE. This was even though ISE said it was sending it back to the Switch, which i could verify from the Radius Live Logs.

I am currently deep diving into the whole TrustSec architecture. It has quickly become apparent to me, that i need to lab alot of this out in detail. That means upgrading my homelab with a 3650 switch as well as a refurbished laptop for acting as the supplicant for Dot1x operations.

So a couple of days ago I was going through the CCIE Security training videos on Cisco Learning Network and I noticed a golden nugget.

It was mentioned that Cisco was on track, to release some learning labs for practice use for the CCIE Security lab exam!!

Its been almost a year since my last post. Wow, do I feel bad about that! :(

Anyways, ive been studying on and off for the last year and I was scheduled to have my first lab attempt this coming thursday. However, with the rising numbers of Corona, I made the tough decision to postpone it until March 10th 2022.

So I have had some time to put everything together in my small CCIE Security V6 lab.

I want to spend a few moments explaining how everything is put together so others can benefit from it.

At the core of the whole thing is my new server, which is running great! (and importantly, fairly silent :) )

The Concept:

In legacy site to site (S2S) VPN’s we are used to defining crypto maps and applying them to a physical interface. However, since these does not utilize GRE, you have no way of supporting multicast and routing protocols. This leads to having to define “interesting” traffic using ACL’s. Something which is clearly not scalable.