Ahriakin wrote: » GNS 3 can emulate a PIX 525 (run up to 8.04 code), which will get you pretty far. Otherwise an ASA 5505 for hands on is doable these days. As for books the "Cisco ASA,PIX and FWSM Handbook" is my favourite of the bunch, Amazon.com: Cisco ASA, PIX, and FWSM Firewall Handbook (2nd Edition) (9781587054570): David Hucaby: Books . The 2nd ed. is definitely preferable over the first as the Modular Policy framework changed a lot between 7.0x and 7.2x (and up) and the 2nd Ed is the only book I've found that covers this revision (and modular policies in general) well.