Forum Replies

  1. tkalis says:

    Hi. Although not directly related to this wondering if you could help me out as it relates to NTP and the ASA. Does the ASA only support NTP using authentication?

    Many thanks,

  2. hi rene I’ve almost completed my ccnp route and switch and I hope to be starting the ccnp security track sometime this year but i’d like to build my own home lab but i’m not sure what i’d need to cover all the stuff on the new exam as I’ve heard a lot of people saying that cisco have not even released the training books for the exam yet could you help me with what I would need for a home lab thanks

  3. Hi Shaun. I have a Cisco PIX515E and a 2851. Most of the commands that Rene uses are able to be used on the PIX. These are available on eBay for a fraction of the cost of an ASA. Get one with an unlimited licence and IOS version 8. This allows for a RAM upgrade to 256MB+ and failover if you get adventurous. The RAM & CPU are also easily upgradeable. Cheers, Matt.

  4. Hi Shaun & Matt,

    If your goal is to study for the exams then it’s best to start with the blueprints that have the exam topics. I’ve added them in the attachment.

    Here’s a general overview:

    The SIMOS exam has topics like DMVPN, FlexVPN, IPsec, GETVPN, etc. You can test any of these topics on IOS routers and the ASA. I would make sure that you use IOS 15 and the latest ASA images otherwise you might run into issues with commands that are not supported.

    SENSS is all about security on switches, routers and the ASA.

    In the SITCS exam you have some different topics…there’s WSA (Web Security Appliance) and ESA (Email Security Appliance). These products are available as hardware boxes but also as VMWare images.

    SISAS is about 802.1X and using ISE (Cisco Identity Services Engine)

    Basically, you need this:

    • IOS routers
    • IOS switches
    • ASA Firewalls
    • VMWare workstation or ESXi for the virtual appliances

    If you want real hardware then you could look at some 3560/3750 switches, the 1841 or 28xx series routers, the ASA 5510s and/or the 5506-X (because of the new features).

    Personally, I would build an ESXi server that runs Cisco VIRL. This allows you to run all routers, switches and ASA firewalls that are required. You can use your ESXi server to run all the other requires virtual appliances as well. You’ll be able to practice 99% of all the topics in the CCNP Security exams with a single server.

    Hope this helps :slight_smile:


    300-206_senss.pdf (112.2 KB)

    300-207_sitcs.pdf (116.1 KB)

    300-208_sisas.pdf (120.2 KB)

    300-209_simos.pdf (100.7 KB)

  5. Hi Shaun,

    The “Cisco ASA All-in-One Next Generation Firewall” book is great. It’s up-to-date and covers pretty much everything. The only thing it doesn’t cover I think is Firepower so you might want to look for another resource to learn that.

    “The Complete Cisco VPN Configuration Guide” is quite old so I wouldn’t recommend it, especially if you have the “all-in-one” book. The “Cisco Firewalls (Cisco Press Networking Technology) by Alexandre M.S.P.” gets good reviews and it’s from 2011. It might be nice to read just to review everything again.

    In the ASA platform, version 8.3 (released in ~2010) was a major upgrade. The entire NAT configuration has changed. Another big change was around 2013 when ASA 9.X was released. That’s something to keep in mind when you look at books, they should cover at least ASA 8.3 or later.

    I can also highly recommend the books from Andrea Harris (http://www.networkstraining.com) Those are easy to read and to the point. Great if you want to learn a couple of things fast.


4 more replies! Ask a question or join the discussion by visiting our Community Forum