CCIE:S written and lab materials thread

Bl8ckr0uter

I guess this is a good place to put this. I decided to go for CCIE:S and I am gathering materials for the CCIE:Security written and lab. I am giving myself quite a bit of time to go through it (I want to get the written done by June, or early July) as I am going through the CCNP:S track as well. I do not plan on purchasing every If anyone has read of any of these books I would love some feedback (particularly someone who is gearing up to CCNP/CCIE level topics):

*= owned

R/S Core:
*Routing TCP/IP Vol I +II
*TCP/IP Guide
*TCP/IP Illustrated
*Switch Guide
*Running IPV6

Security:
Network Security Auditing
Network Security Arch.
*Network Security Bible
Router Security Strategies
IPV6 Security
IPSEC VPN design book
*CCNP:S Library (I need to purchase the IPS and VPN books)
*ASA Handbook

I also will be looking very closely at Ahriakin's thread and gleam anything I can from it.

I have also thought about getting a few firewall and ips theory books and also using the TAO of network security monitoring as well. I haven't decided.


Other:
*Metasploit Handbook
*Wireshark Guide
*Nmap Handbook
Various RFCs

I think I actually might have too much material (at least for the written). I can't seem to find any good practice exams. I did purchase the INE videos and I think with those I should be able to go over the top at least for the written. I'll probably purchase the INE lab manuals when I get closer to the lab. My basic plan is to go through each objective from the top down and hit a section


I am building a lab (currently in the hunt for an ips sensor) with at least two ASAs. I am on a budget so I will practice with the 5520s at work. I already have quite a few routers so I should be ok in that department. Since i've heard IPS 6 and 7 are pretty similar, I hope that I will be able to get buy with the old version (I have heard that IPS 6 is what CCIE:S v3 touches on anyway).

2 ASA 5520s (borrowed from work)
1 IPS 4235
4 2610xm
1 851
2 2950s

I will probably pick up 2 3550s as I get close to a lab date.

So any feed back? I am looking at you Ahriakin

chrisone

Good choice on the security track my friend

As for the lab INE or IP Expert will do great. That is pretty much all I would feel comfortable having for the lab portion. No need to have any other books , just drill and drill those lab books from INE or IP Expert.

Bl8ckr0uter

chrisone wrote: »

Good choice on the security track my friend

As for the lab INE or IP Expert will do great. That is pretty much all I would feel comfortable having for the lab portion. No need to have any other books , just drill and drill those lab books from INE or IP Expert.

My only problem is money. I don't want to spend 10k getting this exam done. Realistically do get CCNP:S and CCIE:S I want to spend less than 3 (no including test cost, and trip cost). That limits things quite a bit. I don't think I can swing to the entire end to end or boot camps from either vendor. I can afford the lab manuals and books. I just don't know how much more material I need. Honestly (I could be totally off base here) but the written doesn't look that bad. I have never worked with Mars or Cisco ACS but I built a few servers for the purposes of running those products so with the DOC cd I should be good as far as that is concerned.

Another thing is that unlike the R/S path, the Sec path still seems a little bit like the wild wild west. The material seems to less refined and plentiful. IDK maybe that has to do with the amount of people taking each path (Sec path is nowhere near as popular as the R/S path).

chrisone

Any CCIE is going to cost a lot of money 5 to 7k minimum with Labs, materials, travel and expenses. One of the reasons you hear me preach around here i have a hard time convincing myself that any CCIE is worth the time and trouble. Anyway, 5-7k should be looked at as an expense over a 2 year span, so its not as bad as you look at it.

As for MARS, there are text books (cisco press) dedicated to MARS. You will also have to get the 2 volumes for the NAC materials. The CCNP:S dont cover those two products. I would also get the FSWM book to cover the FWSM on 6500 series. I am not sure if that is covered in the CCIE:S.

I am comfortable with just obtaining the CCNP:S and covering those other products with specialized certs or by studying white papers.

:insert: there is also CSM (cisco security manager) which could also be covered in CCIE:S

Bl8ckr0uter

chrisone wrote: »

Any CCIE is going to cost a lot of money 5 to 7k minimum with Labs, materials, travel and expenses. One of the reasons you hear me preach around here i have a hard time convincing myself that any CCIE is worth the time and trouble. Anyway, 5-7k should be looked at as an expense over a 2 year span, so its not as bad as you look at it.

It is only a two year span if you spend two years doing it....

5-7k is a lot of money. I simply think I can do it for less. There had to be CCIEs before all of these vendors and boot camps sprung up. So it has to be passable without all of those things.

As far as worth, I still see 100% of the CCIE jobs in my area above 6 figures (I was talking to a recruiter who stated if you had a CCIE right now, I could get you 130k. In Ohio). My goal is to hit 6 figures and to get into consulting and I think a CCIE will help me do both (by building my knowledge and credibility). I don't know if my job will help out with the cost but I don't want to ask (because I don't want to owe anyone anything).

chrisone wrote: »

As for MARS, there are text books (cisco press) dedicated to MARS. You will also have to get the 2 volumes for the NAC materials. The CCNP:S dont cover those two products. I would also get the FSWM book to cover the FWSM on 6500 series. I am not sure if that is covered in the CCIE:S.

I have the old ASA book as well. I thought they run they same code as the ASAs. I have never worked on a 6500 or a nexus so I am hoping that there isn't much coverage of either platform. Mars and NAC are something I hope I can cover via cisco.com


I am confortable with just obtaining the CCNP:S and covering those other products with specialized certs or by studying white papers.

chrisone wrote: »

:insert: there is also CSM (cisco security manager) which could also be covered in CCIE:S

I may be deploying CSM in a few days so I should be good as far as that is concerned.

chrisone

Yeah CSM doesnt seem hard to configure and install. I will be getting it for our enterprise at work, we manage to many ASA firewalls.

For the 6500 or Nexus, you should get the white papers on those as well. I find it hard for any employer to pay a CCIE more than 100k that cannot setup or have any experience with 6500 or nexus devices. So most likely you will be put in a spot or environment where you have to manage that as well.

Bl8ckr0uter

chrisone wrote: »

For the 6500 or Nexus, you should get the white papers on those as well. I find it hard for any employer to pay a CCIE more than 100k that cannot setup or have any experience with 6500 or nexus devices. So most likely you will be put in a spot or environment where you have to manage that as well.

That is a big fear of mine. I don't know how I am going to get nexus or 6500 (or juniper or citrix) experience which seems to be very popular in senior network engineer roles. I actually thought about renting rack time for the nexus but I haven't seen with that available (nor juniper or citrix). Virtualization and storage are other areas that I don't have any professional experience in that I can't figure out how to bust into. I don't want to be a "hollow" CCIE.

chrisone

Yeah i understand where you are coming from, i have been lucky that my past 2 companies we use 6500s so i have very good experience in that. I just havent touched Nexus at all. Renting rack time is probably your best bet, along with reading the NX-OS book which is all about Nexus configurations i believe. After a year of going that route, i would feel confident with the Nexus platform. You just have to cough up the money and invest in yourself. So little time i know I want to study everything i see lol , but with my own business adventure coming along next year (non IT) I find myself less interested in investing my life into studying IT. I think i may call it quits with certs after i get my CCNP:S and dedicate my extra time on my side businesses.

Bl8ckr0uter

I hear that. It should be everyone's goal to create their own wealth and owning a business is an excellent way to do that.

I thought you were going to do CEH and OSCP?

chrisone

Yeah i am going to study the CEH material and some other pen testing material, but not to the point of test taking. I want to know the material but i dont think the cert will benefit me in any way. CEH material will help me understand OSCP when i study that as well. The only reason i want to study CEH and OSCP is to make me a better security engineer. OSCP i could invision myself taking the cert, however i dont think CEH is worth it, i just want the CEH material to help me understand the basics of OSCP.

In all honesty i would rather have the OSCP (pen testing skills) and the CCNP:S, over the CCIE Security. CCIE security is only going to make you a master at designing/maintaining/installing Cisco security products, while obviously the CCNP:S teaches you all that at the professional level (which is good enough for me and my career). I think a good security engineer needs to have good pen testing skills under their belt as well. So OSCP is on my radar.

Bl8ckr0uter

chrisone wrote: »

Yeah i am going to study the CEH material and some other pen testing material, but not to the point of test taking. I want to know the material but i dont think the cert will benefit me in any way. CEH material will help me understand OSCP when i study that as well. The only reason i want to study CEH and OSCP is to make me a better security engineer. OSCP i could invision myself taking the cert, however i dont think CEH is worth it, i just want the CEH material to help me understand the basics of OSCP.

In all honesty i would rather have the OSCP (pen testing skills) and the CCNP:S, over the CCIE Security. CCIE security is only going to make you a master at designing/maintaining/installing Cisco security products, while obviously the CCNP:S teaches you all that at the professional level (which is good enough for me and my career). I think a good security engineer needs to have good pen testing skills under their belt as well. So OSCP is on my radar.

I hear where you are coming from for sure. I would much rather have CCIE:S and OSCP but that's just me

I don't think Cisco has the same market penetration in the security space as it does in other areas (particularly R/S). There are so many firewall platforms (FOSS and vendor) that have features that blow ASAs away. But the corporate world likes the Cisco name. If/when I do get my CCIE:S I am going to make sure to study the standards and learn the concepts so that moving to a new platform is just a synatax/gui issue.

Kelkin

Im excited for ya man.. glad to see another person step up to the IE plate.. I will be watching your blog/thread to see your progress!

Turgon

Bl8ckr0uter wrote: »

It is only a two year span if you spend two years doing it....

5-7k is a lot of money. I simply think I can do it for less. There had to be CCIEs before all of these vendors and boot camps sprung up. So it has to be passable without all of those things.

As far as worth, I still see 100% of the CCIE jobs in my area above 6 figures (I was talking to a recruiter who stated if you had a CCIE right now, I could get you 130k. In Ohio). My goal is to hit 6 figures and to get into consulting and I think a CCIE will help me do both (by building my knowledge and credibility). I don't know if my job will help out with the cost but I don't want to ask (because I don't want to owe anyone anything).

Congratulations. I have been egging you on for a while to do this. First recommendation is a study thread with your written and lab prep hours recorded. Second is to clear the written by the end of Q1 2012 so get cracking with that reading.

As for clearing this CCIE or any CCIE inside 12 months you need to be very, very regular on hands on prep. You should be configuring practically everyday. Look at 2 -3 hours each workday and many more hours than that at weekends. Cancel hobbies, sit down with your wife or girlfriend to explain how you will be spending regular time away from them and they will be sitting on their own regularly for a long time, and forget WoW.

Check out Reaper81's thread, hes' on track to pass in 2012 sometime. You will see the commitment required. As for your expenditure I suggest you bump it up. You will need rack hire time and it adds up.

Good luck!

Bl8ckr0uter

Thanks.

It is going to be tough as I am finishing school (soon to be full time) so it may end up bleeding over to quarter 1 2013. At worse it should be a 14-16 month journey. I know there have been rumors of CCIE:S 4.0 coming out soon but I'll deal with that as the time comes.

nicklauscombs

i'm also glad you decide to jump in. looks like we will be working through the material at roughly the same time frame so let's make sure to bounce ideas and feedback off each other.

Bl8ckr0uter

nicklauscombs wrote: »

i'm also glad you decide to jump in. looks like we will be working through the material at roughly the same time frame so let's make sure to bounce ideas and feedback off each other.

For sure Nick. Hopefully we will have two new CCIE:S soon (of course I want my numbers first but I'm not racing).

Well my job told me that I will be taking a Corero IPS course in a few weeks (Corero) so I need to hurry up and knock Secure down so I can get to the fun stuff (Firewall). My wife thinks I should go from CCNP:S straight to CCIE:S written but I am wondering if a detour to CCNP:R/S would be good. The material would help me in my CCIE:S studies as well as my day to day work. I might even try to sneak the CCNP R/S in during my CCIE Lab studies. That would be bold and probably foolish but I may do it. Anyone have any thoughts on this?

2012:
May- CCNP:S
June/July: CCIE:S Written
December: CCIE:S Lab hopefully

Obviously if I'm not ready I'll push some dates back. I have the elearnsecurity course that I need to wrap up in Q1 of 2012 before it expires. I can probably dedicate 1 hour+ at work and then 1-1/2 to 2 hours during the weekdays at home and probably 6-8 hours (broken into two, 4 hour sessions) during the weekend. It is going to be hard but I think that it will be doable. It is my news year resolution to be a CCIE:S so getting my numbers is top priority, even though I know my boss won't care too much. I don't have as much experience as many other cisco people on this board so I will probably make some stupid mistakes along the way.

Turgon do you think my lab that I mentioned is not enough to clear it? I did just get an IPS module today and with ASAs and a few routers I could emulate the entire INE topology at home. Also how do you differ studying for the written vs studying for the lab?

chrisone

Quick question, you dont have CCNP R/S yet?

If so I would recommend you get that first before venturing off into other technologies. R/S is the foundation for WIFI, Voice, ISP, and especially Security.

You dont have to, but many experienced engineers here will tell you, routing and switching is vital in all technologies. Especially when it comes to a CCIE, I would assume one has CCNP R/S level experience. Anyways, Good luck with any of the various routes you do choose. I know you can accomplish anything if you buckle down and attack it.

Bl8ckr0uter

chrisone wrote: »

Quick question, you dont have CCNP R/S yet?

If so I would recommend you get that first before venturing off into other technologies. R/S is the foundation for WIFI, Voice, ISP, and especially Security.

Nope. No CCNP:R/S for me. That's why I was thinking about sneaking it in once I finish the CCIE Written (during my Lab studies). I know of at least two people who did CCIE:S without CCNP R/S (at least one here and one at my previous job). They both said that it isn't required and I think that it may be a good idea for me to save the 600 dollars for something else. Of course getting CCNP would improve my marketability but having CCNP R/S knowledge and having the cert are different things. We will see. If I can swing it, I might try to knock out CCNP R/S in like 90 days tops but if not, I'll pick it up after I do the CCIE:S lab. I work with over 60 ASAs (soon to be about 100 ASAs) and 25 routers (and a few switches) so my job is more firewall heavy than router/switch heavy. I deal with many CCNP topics (GRE/IPSEC, HRSP, very light bgp soon OSPF/EIGRP, DMVPN) so I am somewhat familiar with the topics. I just don't know if doing the cert is worth 600 additional on the way to the CCIE Lab. Do you think it would be worth it?

http://ieoc.com/forums/p/15820/132701.aspx

chrisone

Hmmm well, to be honest I wouldn't lose focus on the CCIE Lab after completing the written. It would mean you are working backwards after obtaining your CCIE written to obtain a professional level cert. So scratch that concept out of your mind ASAP! just read the Routing TCP/IP volumes and have them as your source for routing topics when you need to brush up on something. Switching is always an easy task. I sold my CCNP library once i was done and bought the CCIE R/S v4 book to keep as my main source for routing and switching topics. I got that book because it covers switching. So its my go to book for any R/S technologies.

nicklauscombs

i'm with chrisone. if you are serious about making it through till the end especially with such an ambitious deadline as the end of the year do not get sidetracked with other certs. use cisco docs and routing tcp/ip when needed to brush up on some of the routing topics and keep focus.

Bl8ckr0uter

chrisone wrote: »

Hmmm well, to be honest I wouldn't lose focus on the CCIE Lab after completing the written. It would mean you are working backwards after obtaining your CCIE written to obtain a professional level cert. So scratch that concept out of your mind ASAP! just read the Routing TCP/IP volumes and have them as your source for routing topics when you need to brush up on something. Switching is always an easy task. I sold my CCNP library once i was done and bought the CCIE R/S v4 book to keep as my main source for routing and switching topics. I got that book because it covers switching. So its my go to book for any R/S technologies.

nicklauscombs wrote: »

i'm with chrisone. if you are serious about making it through till the end especially with such an ambitious deadline as the end of the year do not get sidetracked with other certs. use cisco docs and routing tcp/ip when needed to brush up on some of the routing topics and keep focus.

That makes sense. I am just going to focus on getting the CCIE done then I will think about CCNP:R/S (after a good break lol). Thanks guys. Now onward.

chrisone

I agree, but after having the CCIE:S you dont need the CCNP: R/S. I am sure you will have enough knowledge of R/S throughout your 18 months of studying for CCIE:S. You are bound to cross R/S technologies and do a lot of reviewing for R/S while you work on CCIE Security. If the cert for CCNP:R/S is important then go get it, if not then dont bother. However if you are grinding your teeth for a R/S cert, you might as well just go for the CCIE:R/S after your CCIE:S, you will have a lot of experience in routing and switching come 18 months from now and you will already have loads of experience studying for CCIE exams because of your CCIE:S adventures.

The CCIE:S to CCIE:R/S works out quite well IMO. All depends on how deep and serious you want to go with R/S technologies.

Bl8ckr0uter

That's kind of how I envisioned it: CCNP:S>CCIE:S take a break (OSCP) CCNP>CCIE:R/S. I'd like to grab two CCIEs (but after that no more). I decided a few weeks ago that I don't think I will be getting too many more certifications once I hit expert level. I'd like to get CWNA/CWSP and maybe some Juniper if I get some experience with them. I still want to take a few SANS courses as well but I really want to specialize in networking/network security and have strong linux knowledge. I also need to focus on design because I can see myself going the consultant route in the next few years (and the contractor route sooner than that).

chrisone

That is a pretty heavy load for the next 5 years. How old are you? lol

How long are you thinking it is going to take you to finish CCNP Security? Do you have any of the exams completed? Tackle that on to what is normally projected around here. Not saying you "can't" do it in less time, cause obviously there are a lot of factors to what people around here call the "norm" when it comes to these time frames. That is an impressive journey!

CCNP:S = 4 to 6 months?
CCIE:S = 1.5 years
CCNP: RS = 4 to 5 months minimum?
CCIE:RS = 1.5 years
OSCP = 3 to 5 months min?
CWNA/CWSP = 3 to 6 months min?
Juniper = 2-3 months at least for 1 cert?
LPIC or Linux+ = 3 to 5 months?

$hiet its 2016 already lol

P.S. you still need to factor in 6500/Nexus experience. Add on another year i guess.

lrb

Bl8ckr0uter wrote: »

That's kind of how I envisioned it: CCNP:S>CCIE:S take a break (OSCP) CCNP>CCIE:R/S. I'd like to grab two CCIEs (but after that no more). I decided a few weeks ago that I don't think I will be getting too many more certifications once I hit expert level. I'd like to get CWNA/CWSP and maybe some Juniper if I get some experience with them. I still want to take a few SANS courses as well but I really want to specialize in networking/network security and have strong linux knowledge. I also need to focus on design because I can see myself going the consultant route in the next few years (and the contractor route sooner than that).

Seems like a good plan mate, really looking forward to watching the progress of your IE journey. As much as you seem pretty dedicated to the IE cause, I can say that in AU Juniper deployments (especially the SRX series) are gaining momentum very quickly and the Juniper certs will make you so much more marketable. From what I've seen and what the HR people tell me every month, I would almost say that someone who is a CCNP SEC and a JCNIP-SEC would be favored over someone who is a CCNP SEC and CCIE SEC.

Bl8ckr0uter

chrisone wrote: »

That is a pretty heavy load for the next 5 years. How old are you? lol

24 years young.

chrisone wrote: »

How long are you thinking it is going to take you to finish CCNP Security?
CCNP:S = 4 to 6 months?
CCIE:S = 1.5 years
CCNP: RS = 4 to 5 months minimum?
CCIE:RS = 1.5 years
OSCP = 3 to 5 months min?
CWNA/CWSP = 3 to 6 months min?
Juniper = 2-3 months at least for 1 cert?
LPIC or Linux+ = 3 to 5 months?

I know I can get CCNP:S done by June (while studying for CCIE written). The way I figure, CCNP:S is just CCIE:S written study with mini checkpoints (in the form of exams).

CCIE:S in 1.5 tops (including CCNP:S time )
OSCP I would take the 60 day course. Everything else is speculation at this point since I haven't got through what's on my plate. I decided my next 3 certs are going to be CCNP:S, CCIE:S and OSCP so I need to just focus on those. I just read about a guy who did the CCIE lab like 4 months after the written so I think it is possible to do it. In fact I think if I take longer than 6 or so, I probably will never do it because I'll get bored lol.

lrb wrote: »

Seems like a good plan mate, really looking forward to watching the progress of your IE journey. As much as you seem pretty dedicated to the IE cause, I can say that in AU Juniper deployments (especially the SRX series) are gaining momentum very quickly and the Juniper certs will make you so much more marketable. From what I've seen and what the HR people tell me every month, I would almost say that someone who is a CCNP SEC and a JCNIP-SEC would be favored over someone who is a CCNP SEC and CCIE SEC.

I would love to do some juniper certs if I actually worked with Juniper gear. None of my customers work have juniper gear either. After CCIE I may do Jncia-Junos and see if that helps with my marketability. I don't want to be a cisco network security engineer, I want to be a network security engineer so I am very open to doing vendor certs other than cisco. We will see what happens. At one point we were considering moving to Palo Alto Firewalls so I was going to do their training course and cert.

chrisone

Yeah you should be able to cover most of the CCIE Written with the CCNP Security. Like i said before you need to get the NAC (both volumes I, II), Mars, and FWSM books. You will need a minimum 3 to 4 months on those for the written, so just theory will get you by, but for the lab, i bet they give you a pair of 6500's with dual FWSM's and there is no getting around that. CSM as well, but you got that covered by your job implementing that. I also noticed there is Wireless security, not sure what they mean by that (might be encryption and 802.1x technologies), but that is also not covered in the CCNP:S. Below you can see some of the written topics that are not covered in CCNP:S.

The written might not be a cake walk like you think it might be after the CCNP:S track, however the CCNP:S does cover the majority, just spend more time on the below going over the theories since it is only written not Lab yet.

5.12

Cisco Network Admission Control (NAC) Appliance

5.13

Cisco Security Agent (CSA)

5.14

Cisco Secure ACS for Windows

5.15

Cisco Secure ACS Solution Engine

5.16

Cisco Security Monitoring, Analysis and Response System (MARS)

5.17

Cisco Catalyst 6500 Series Security Services Modules (FWSM, IDSM-2, VPNSPA)

6.03

Cisco Security Manager (CSM)

7.04

Wireless Security

Bl8ckr0uter

I think it is almost unfair for them to cover mars when NO ONE uses it. Cisco doesn't even sell it anymore (AFAIK).

Kelkin

I was just thinking that myself.. perhaps thats why theres rumors of a lab refresh?

chrisone

It is possible they remove it in the new version I guess, but are you guys positive they dont sell MARS anymore? I know it integrates with CSM heavily from what i could tell. It would be nice though if they removed it, we will have to wait and see. Last i seen MARS is a very good tool to monitor anomalies , viruses, intrusions, etc from all your ASA's , IPS/IDS, IOS FWs. I dont see why they would destroy such a tool unless CSM handles all that?

:update: yes it is gone, looks like they are trying to push CSM i guess.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5739/ps6241/end_of_life_notice_c51-470242.html

So maybe the next refresher of the IE its gone. Look for them to add Nexus security technologies now lol

Bl8ckr0uter

EOL/EOS for the Cisco Security Monitoring, Analysis and Response System (MARS) 20R/20/50 Appliances* [Cisco Security Monitoring, Analysis and Response System] - Cisco Systems
End of Life Notice for Cisco CS-MARS Questions Ciscoís Commitment to Security.

Reading this kind of stuff makes me question the time and commitment to a CCIE:S