Firewalls & VPN Technologies

Module 1: Firewall Fundamentals

• Firewall types: Packet filter, stateful, application proxy, NGFW
• Firewall placement: Perimeter, internal, host-based
• Security zones: Trust, untrust, DMZ
• Firewall rule design principles
• Firewall high availability and clustering

Module 2: Cisco ASA Firewall

• ASA architecture and interface security levels
• ASA object and object-group configuration
• ACLs on ASA: Permit/deny, logging
• NAT on ASA: Static, dynamic, PAT
• ASA high availability: Active/standby failover

Module 3: Cisco Firepower (FTD)

• FTD architecture: Snort engine, AVC, URL filtering
• FMC (Firepower Management Center) overview
• FTD access control policies
• Intrusion policies and rules
• File and malware policies in FTD

Module 4: Palo Alto NGFW

• PAN-OS architecture: App-ID, User-ID, Content-ID
• Security policy design in Panorama
• NAT policies in PAN-OS
• URL filtering and application control
• Threat prevention profiles

Module 5: Fortinet FortiGate

• FortiGate architecture and FortiOS
• FortiGate firewall policy configuration
• FortiGate NAT and virtual IPs
• FortiGate UTM: IPS, antivirus, web filtering
• FortiGate high availability (active-passive, active-active)

Module 6: IPSec VPN

• IPSec fundamentals: IKEv1 vs. IKEv2
• IKE Phase 1 and Phase 2 negotiation
• Site-to-site VPN: Cisco, Palo Alto, Fortinet configuration
• IPSec troubleshooting: debug crypto commands
• IPSec over NAT (NAT-T)

Module 7: SSL/TLS VPN

• SSL VPN modes: Clientless, thin client, full tunnel
• Cisco AnyConnect: Configuration and deployment
• Palo Alto GlobalProtect: Gateway and portal setup
• Fortinet FortiClient SSL VPN
• SSL VPN security hardening

Module 8: DMVPN (Dynamic Multipoint VPN)

• DMVPN architecture: Hub, spoke, NHRP
• DMVPN Phase 1, 2, and 3
• mGRE and IPSec profile integration
• Dynamic spoke-to-spoke tunnels
• DMVPN with OSPF and EIGRP

Module 9: Zero Trust Network Access (ZTNA)

• ZTNA vs. traditional VPN
• ZTNA architectures: Inline, API-based
• Palo Alto Prisma Access
• Zscaler Private Access (ZPA)
• Cisco Secure Access (formerly CloudSec)

Module 10: Firewall Management and Monitoring

• Centralised firewall management: Palo Alto Panorama, FMC
• Firewall log analysis
• Security policy optimisation and cleanup
• Change management for firewall rules
• Firewall performance monitoring

Module 11: Firewall Auditing and Hardening

• CIS Benchmarks for firewalls
• Firewall rule review methodology
• Unused rule identification and removal
• Firewall penetration testing concepts
• Compliance review: PCI DSS, ISO 27001

Module 12: Capstone Projects

• Design and configure a DMZ with Cisco ASA
• Configure site-to-site IPSec VPN between Cisco and Palo Alto
• Palo Alto NGFW policy configuration lab
• FortiGate UTM and VPN lab
• Certification preparation: Cisco CCNA Security, PCNSA, NSE4

Experience in the Industry Learn from network security engineers with hands-on experience deploying and managing Cisco ASA, Palo Alto NGFW, Fortinet FortiGate, and enterprise VPN solutions.

Backgrounds at the Top Our instructors hold PCNSE, NSE7, and Cisco CCNP Security certifications, with deployment experience at IT security companies, enterprise organisations, and Cisco/Palo Alto partner firms.

Clear & Effective Teaching Firewall policy design, NAT, and VPN configuration are taught with live platform labs on Cisco, Palo Alto, and FortiGate, using realistic enterprise topology scenarios.

Hands-On Learning Focus Students configure firewalls, build IPSec and SSL VPNs from scratch, set up DMVPN, and audit firewall policies in comprehensive lab environments.

Up-to-Date Knowledge Instructors stay current with ZTNA product releases, updated PAN-OS and FortiOS versions, Cisco Firepower updates, and the latest VPN security hardening guidance.