Cisco
Cisco Implementing Cisco ACI Security (ACISEC)
Secure Cisco ACI data centre fabrics.
4 daysIntermediate8 modules
About this course
Secure Cisco ACI data centre fabrics. You will use ACI's built-in access control, integrate hypervisors securely, insert L4 to L7 services with service graphs, integrate next-generation firewalls and harden the APIC controller.
What you'll learn
- Proficient in managing and implementing a comprehensive Cisco ACI security solution
- Utilize all of the Cisco ACI built in security mechanisms
- Implement L4-L7 solutions into ACI
- Integrate NGFW features into an ACI security solution
Curriculum
8 modules
- Objective: Gain comprehensive knowledge of the Cisco SDN Architecture implementation of hardware and software
- Lesson 1: ACI SDN Network Architecture
- Lesson 2: ACI Zero Trust Model and Security constructs
- Lesson 3: ACI Physical Server Integration
- Lesson 4: ACI Security for Physical or Virtual workloads
- Lesson 5: ACI L3Out external routing
- Objective: Understand the secure integration of leading hypervisors with Cisco Application Centric Infrastructure (ACI)
- Lesson 1: Nutanix AHV (Nutanix Acropolis Hypervisor)
- Lesson 2: VMware ESXi and vCenter
- Lesson 3: Microsoft Hyper-V with System Center Virtual Machine Manager (SCVMM)
- Lesson 4: Red Hat OpenStack
- Lesson 5: Google Kubernetes
- Lesson 6: Kernel-based Virtual Machine (KVM)
- Objective: Explore, configure, and evaluate all the native Cisco ACI access control mechanisms
- Lesson 1: ACI networking constructs of Bridge Domain and VRF.
- Lesson 2: ACI Zero Trust model objects of Tenant, EPG, Application Profile, Contract, Subject and Filters
- Lesson 3: Network Centric vs Application Centric Security Models
- Lesson 4: ACI zones
- Lesson 5: ACI VRF Policy Control Enforcement
- Lesson 6: ACI Preferred Groups
- Lesson 7: Configure ACI vzAny
- Lesson 8: Configure an ACI Allow List Model with Contracts and Filters
- Lesson 9: Stateful vs Stateless Contracts
- Lesson 10: ACI Tenant Span to analyze secure traffic flows
- Lesson 11: ACI EPG Shutdown
- Lesson 12: ACI contract logging
- Lesson 13: Contract Inheritance with EPG Contract Master
- Lesson 14: ACI Micro segmented EPG (uEPG) for Intra-EPG communications
- Lesson 15: ACI Endpoint Security Groups (ESGs)
- Lesson 16: VRF Leaking
- Lesson 17: Designing a secure ACI Data Center
- Objective: Develop skills in L4-L7 service graphs to extend ACI security with external devices
- Lesson 1: ACI L4-L7 Service Graph
- Lesson 2: ACI Service Graph Template
- Lesson 3: Concrete Object
- Lesson 4: Service Chaining with multiple highly available devices
- Lesson 5: Managed vs Unmanaged L4-L7 ACI Integration
- Lesson 6: Integrating Cisco ASAv
- Lesson 7: Transparent vs routed mode security device integration
- Lesson 8: Contracts to insert security services into ACI
- Lesson 9: L3Out routing integration with security devices
- Objective: Develop skills in understanding the value and approach of Cisco ACI and NGFW integration
- Lesson 1: Next Generation Firewall (NGFW) Integrated Security Architecture
- Lesson 2: Cisco Secure Firewall Management Center (FMC)
- Lesson 3: Cisco Secure Firewall Threat Defense Virtual (formerly FTDv/NGFWv) and Cisco Secure Firewall Management Center (FMC) enabling on Nutanix AHV
- Lesson 4: Firepower Management Center Endpoint Update App for the Cisco Application Centric Infrastructure (ACI)
- Lesson 5: NGFW Routed, switch or inline interface mode
- Lesson 6: ACI L4-L7 Policy Based Redirect (PBR) to security service
- Lesson 7: ACI PBR for micro-segmentation
- Lesson 8: Extend PBR security services to ACI Multi-Pod
- Lesson 9: Cisco NGFW zone-based policies in FMC
- Lesson 10: Threat detection with Cisco intrusion detection systems (IDS) to ACI Insertion
- Lesson 11: Threat detection with Cisco intrusion prevention systems (IPS) to ACI Insertion
- Lesson 12: Cisco ACI Integration with SPAN for IDS and IPS
- Lesson 13: Distributed Denial of Service (DDoS) Services Insertion
- Lesson 14: Cisco DC App ACI Endpoint Update to push endpoint information to the ASA or FMC
- Objective: Learn method of adding security to the APIC for all management and programmatic functions
- Lesson 1: APIC Hardening
- Lesson 2: APIC Northbound Protocols
- Lesson 3: APIC Northbound Authentication
- Lesson 4: ACI Role Based Access Control (RBAC) for secure access
- Lesson 5: Audit logs for ACI changes
- Lesson 6: Certificate based authentication
- Lesson 7: Two factor authentication
- Objective: Master administration of ACI Physical Security
- Lesson 1: Remote Leafs
- Lesson 2: MACsec on ACI leafs
- Lesson 3: Enabling 802.1x on ACI leafs
- Lesson 4: NXOS Image signing and verification
- Objective: Develop skills in understanding the value and approach of Cisco ACI and VMware NSX integration
- Lesson 1: Trustsec Policy Domain
- Lesson 2: Cisco Identity Services Engine (ISE) for a cohesive security policy
- Lesson 3: Trustsec Security Group to ACI External EPG security translation
- Lesson 4: Stealthwatch and ACI Integration
- Lesson 5: Cisco ACI and Cisco Secure Workload Integration
- Lesson 6: Cisco ACI and Cisco Secure Workload Rapid Threat Containment
Who it's for
Data centre and security engineers working with Cisco ACI.
Before you start
- Basic knowledge of Cisco ACI infrastructure
- Recommend CCNP Certification or equivalent knowledge
- Understanding of networking and security fundamentals
Related courses
More in Cisco →Intermediate
Administering Cisco Unified Communications Manager (ACUCM)
Cisco
View course →Intermediate
Administering Cisco Webex AI Assistant & Agent (AWXAI)
Cisco
View course →Intermediate
Cisco Administering and Troubleshooting Meraki Full Stack (MX,MS,MR,MV,MI,SM,MT) Technologies (MER-FS-ADMIN)
Cisco
View course →Intermediate
Cisco Administering Cisco Data Center Unified Computing System with Intersight v6.0 (DCUCAI)
Cisco
View course →Intermediate
Cisco Administering Cisco Unified Communications Manager and Unity Connection v15 (ACUCM w/AUC)
Cisco
View course →Intermediate
Cisco Administering Webex Contact Center (AWXCC)
Cisco
View course →Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.