This is definitely one of those 100% for me posts, I dont know who else is going to get value from it.
The topology was derived from old CCNP Security courseware, which is dated 2014. But I definitely remember the SENSS exam, which is where these books start.
Remember these? LOL
So here’s your basic topology that is followed through the 4 books. I might work through some of this old material at some point, because anything beyond ACS and the old 4200 series IDS/IPS sensors is still relevant at some level I imagine.
And here’s what I built out in GNS3. While the real meat of the work will be done in this GNS3 topology and a few supporting VMs living on an ESXi server, I try to keep a few physical devices on hand as well so I can quickly validate if I’ve encountered a GNS3 issue or I actually just don’t have a config correct. So yeah, that rack full of routers ranging from the 90’s 2500 series routers up through x800 series ISRs, IOS and IOS-XE switches, and a few PIX and ASA firewalls, plus a lot of misc gear from other vendors, is still in the basement ready for service should anything be needed. You can pry that 2511 access server from my cold dead fingers.
What are my modifications? Well, right off the bat everything in these guides is an ISR, while I’m using a mix of CSR1000v and L3 IOU routers. Why? Availability and convenience mostly. While Cisco does have a virtual ISR, they have said that the ISRv and CSR1000v are going to maintain feature parity and I’ve had a better experience with the CSRv. Same for the switches, the coursewear is written around a 3560 running IOS 15.0, where I’m running L2 IOU 15.2 images. Strictly convenience based on what has ran better in my experience with doing this stuff in GNS3. Should I need more IOS XE switching, there’s options I can switch out these IOU switches for, and I can start tinkering with my physical 3650s (shoutout to Cisco for having the 3560 and the 3650 so close in time so I have to double and triple check that I’m using the right one). Worst case I eventually have to do a forklift upgrade on all these routers and switches for 8000v and 9000v models.
Next, that single router simulating the Internet for this material was sufficient, but I imagine I’ll be doing more with BGP and all the VPN tunnels so I’m going to break that out into 4 routers. The BB-Shared router is not really needed now that I’ve spread it around some. But in that space on the sheet, I’m dropping a OpenWRT router and simulating a “home user.”
Next, I dropped in another router for “Branch 2” and tied it to the quad Internet routers with a serial link. Nescessary? Maybe, maybe not but its there if I need it. There’s then Branch 3 that’s built out with Juniper gear. When I’m ready for a Juniper cert, it’s all ready to roll with protocols I’ve been working with all along and I really need to just focus on the Juniper syntax. A vSRX, an Olive (remember those? LOL) to see where older syntax differs, some Juniper switches, some Aruba switches. This is both for future cert plans and because Juniper routers/firewalls are what’s being used at work. Also at work there’s a mix of Aruba and Juniper switches while we transition from one to the other so it made sense to drop a couple Arubas here too.
The “inside” network is heavily modified, first with an additional router doing RoaS for the internal subnets, one switch becomes 4 so I can setup etherchannel several times, and then the GNS3 interal switch with the hosts tied to it so I can quickly move them betwen VLANs without messing with the lab switches. The management network just connects to a cloud object that breaks out to the physical managment network and the HQ-ISR has an additional connection out to some other vlans on the physical network just in case I’d rather use an instance of something already there rather than reinventing the wheel here. The first thing that comes to mind is the instance of ISE 2.4 that I put a lot of config into the first time I did the CCNP Security. It’s working TACACS+ and RADIUS immediately. And other things like an FTP server holding configuration backups and the LibreNMS server with can quickly validate an SNMP configuration on a device.
And finally, there are competing tasks happening in the lab concurrently. The big one that comes to mind is learning Python right now. So while time will obviously be spent on that, there will also be ways I try and tie the things together. I’m not going to configure a router manually this time around, I’m planning to write Python scripts and use Ansible to do all my router and switch configuration as much as possible. The same FTP server where I backup all my device configurations will be used for the devices in this topology. The same LibreNMS server will monitor these devices in addition to just validating their SNMP configuration. And these devices will all ship syslog to my Wazuh server so it’s centralized and so I have more logs available as I work out my skills on there. Basically, nothing will be studied in a complete silo this time around.
Happy labbing!