Cybersecurity and firewall library
The free topics behind our security programs: CCNA Cybersecurity for SOC analysts, and Palo Alto Networks and Fortinet for firewall engineers. Every security job assumes the networking underneath, so these pages start from the CCNA-level concepts and build up.
Each topic page: summary · mental model · topology · commands · verification · common mistakes · lab · cheat strip.
Pick the program that fits the job you want.
SOC analysts watch alerts and investigate. Firewall engineers build and run the firewalls. The topics below serve both.
CCNA Cybersecurity (200-201)
Cisco's SOC analyst certification, with analyst labs in your browser.
SOC analystPalo Alto Networks Cybersecurity Practitioner
Palo Alto's foundational certification (formerly PCCET), taught in live 1:1 classes.
Firewall engineerPalo Alto Networks Network Security Analyst
PAN-OS policy, App-ID, NAT and decryption (formerly PCNSA), with EVE-NG labs.
Firewall engineerFortinet NSE 4: FortiOS Administrator
FortiGate administration (formerly FCP FortiGate), with EVE-NG labs.
Cisco®, CCNA®, Palo Alto Networks® and Fortinet® are trademarks of their owners. PacketMentor is independent and not affiliated with them.
Security concepts
Cybersecurity Threats & Mitigation
Threats every network engineer must recognize (phishing, ransomware, MITM, DDoS, supply-chain attacks, insider threats) and the mitigation controls that work.
Security Program Elements: Awareness, Training, and Physical Access
The non-technical layers of a security program (user awareness, formal training and physical access controls) that network engineers must understand.
Encryption Fundamentals
Cryptography for network engineers: symmetric vs asymmetric, hashing, digital signatures and certificates, and where each is used in IPsec, TLS, SSH and 802.1X.
OWASP Top Threats for Network Engineers
The three OWASP threats called out in CCNAAUTO 200-901 4.10: XSS (code injected into pages), SQLi (code injected into database queries), CSRF (tricking a user's browser into making a request). Plain English with examples.
Application Security: Secrets, Encryption, Data Handling
Three application-security topics the CCNAAUTO 200-901 4.8 exam asks you to describe: protecting secrets (API keys, tokens), encryption at rest and in transit, and data handling practices.
Identity and access control
AAA · RADIUS & TACACS+
AAA (authentication, authorization and accounting) explained: RADIUS vs TACACS+, method lists, and why networks over 5 devices use centralized auth.
802.1X: Port-Based Network Access Control
Lock every switch port until the connected device proves identity. Covers the supplicant / authenticator / auth server roles, EAPOL on the wire, and how 802.1X plugs into RADIUS for enterprise Wi-Fi and wired auth.
Cisco ISE Basics
Cisco ISE (Identity Services Engine): the RADIUS/TACACS+, posture and profiling brain behind enterprise network access, where it sits and how it enables 802.1X.
FortiGate FSSO: Fortinet Single Sign-On
How FSSO gives FortiGate identity-aware policies without prompting users: collector agents on the AD DC, event-log monitoring, transparent login mapping, and RADIUS-SSO variants.
Securing the access layer
Port Security
Lock a switch port to a specific MAC address (or addresses). Covers static, dynamic, and sticky learning, violation modes (protect / restrict / shutdown), and the err-disable recovery dance.
DHCP Snooping
Switch security feature that blocks rogue DHCP servers. Trusts one port (where the real server lives) and drops DHCP server messages from any other port. Foundation for Dynamic ARP Inspection too.
Dynamic ARP Inspection (DAI)
The Layer-2 security feature that kills ARP spoofing. It checks every ARP packet against the DHCP Snooping binding table and drops bogus replies.
IP Source Guard (IPSG)
IP Source Guard, the fourth Layer-2 security feature, checks every packet's source IP against the DHCP Snooping binding table to block IP spoofing.
Storm Control
Stop broadcast, multicast and unicast storms at the switch port. Covers rising and falling thresholds, drop vs shutdown vs trap, recovery and show commands.
IPv6 First-Hop Security: RA Guard, DHCPv6 Guard, ND Inspection
The four Layer-2 security features every enterprise needs when it enables IPv6: RA Guard blocks rogue Router Advertisements, DHCPv6 Guard blocks rogue DHCPv6 servers, ND Inspection validates Neighbor Discovery, IPv6 Source Guard binds addresses to ports.
IPv6 RA Guard
What IPv6 RA Guard does, why it matters, and the one-command Cisco IOS config. Covers CCNA 200-301 v2.0 objective 4.7.d.
Wi-Fi Security: WEP, WPA, WPA2, WPA3
Twenty-five years of wireless security in one page. Why WEP is broken, why WPA is a stop-gap, why WPA2 ruled for two decades, and what WPA3 actually fixes.
Firewalls and NAT
Access Control Lists (ACLs)
CCNA ACL guide: first-match-wins, implicit deny, wildcard masks, standard, extended and named ACLs, in vs out, time-based ACLs, 9 scenarios and debugging.
NAT & PAT
CCNA NAT guide: static NAT, dynamic NAT, PAT/overload, inside/outside terms, port forwarding, CGNAT, hairpin NAT, 8 worked scenarios and NAT debugging.
Cisco Zone-Based Firewall (ZBFW): Zones, Zone-Pairs, Policy-Maps
How Cisco's Zone-Based Firewall models a router as a set of security zones with policy-maps controlling traffic between them. Zone-pairs, class-based policy, the self zone, and typical enterprise deployments.
FortiGate Architecture: FortiOS, VDOMs, and the Session Table
How a FortiGate is built end-to-end: FortiOS on ASIC-accelerated hardware, the packet flow, VDOMs, admin access, factory reset, and the stateful session table NSE 4 asks about.
FortiGate Firewall Policies: Structure, Order, NAT Inline
How firewall policies work on FortiOS: the 6 core fields, top-down first-match evaluation, how NAT lives inside the policy, and the diagnostic that tells you which policy matched.
FortiGate Security Profiles: AV, Web Filter, App Control, IPS
FortiGate security profiles applied inline to traffic: antivirus, web filter, app control, IPS, DNS filter, DLP and SSL/SSH inspection, and how to combine them.
FortiGate HA: FGCP Active-Passive and Active-Active
How FortiGate Clustering Protocol (FGCP) forms a redundant pair or cluster: heartbeat, session sync, election, active-passive vs active-active, override, split-brain avoidance.
VPNs
VPN Basics: IPsec & SSL
How two separated networks (or one user and a network) can talk privately over the public internet. Covers site-to-site IPsec, remote-access SSL/TLS VPNs, IKE phases, and what 'tunnel' actually means.
Cisco AnyConnect / Remote Access VPN
How a remote user's laptop gets put 'on the corporate LAN' over the internet. Covers AnyConnect client, SSL/TLS vs IKEv2, split tunneling, authentication options, and where it fits alongside ZTNA in 2026.
FortiGate IPsec VPN: Site-to-Site and Dial-Up
How IPsec VPNs work on FortiOS: Phase 1 IKE, Phase 2 SA, site-to-site, dial-up, route-based vs policy-based, and the diagnostics that solve 90% of tunnel-down tickets.
FortiGate SSL VPN: Web Mode and Tunnel Mode
How FortiOS SSL VPN works for remote users: web-mode portal, full-tunnel-mode client (FortiClient), authentication with LDAP/RADIUS/SAML, and the split-tunnel decision every design faces.
Security monitoring and analysis
Syslog
Send every device's log messages to a central server. Covers severity levels (0-7), facilities, message format, where to send logs (local buffer / console / monitor / server), and the eternal question of how much logging is too much.
SNMP: Simple Network Management Protocol
How monitoring systems pull metrics and receive alerts from network devices. Covers SNMPv1/v2c/v3, community strings, traps vs informs, MIB / OID navigation, and why SNMPv3 is the only one acceptable in 2026.
NetFlow & Flow-Based Monitoring
How NetFlow, IPFIX and sFlow turn raw traffic into queryable records: flows, exports, collectors, and capacity, security and billing answers SNMP can't give.
SPAN, RSPAN & ERSPAN: Port Mirroring
How to copy traffic from one switch port to another for analysis. Covers local SPAN, RSPAN across switches via VLAN, ERSPAN over GRE for remote sites, and when each one is the right call.
Reading Packet Captures for CCNA
Read Wireshark style capture output like an engineer: where captures come from, what each column means, and the patterns behind ARP, DHCP, TCP and DNS faults.
TCP Connection States
What every TCP socket goes through from CLOSED to ESTABLISHED to TIME_WAIT. Covers each state, why TIME_WAIT exists (and frustrates web servers), and how netstat and ss show you what's really happening.
Common Ports and Protocols: N10-009 Reference Table
Every port and protocol CompTIA Network+ (N10-009) expects you to memorize. Grouped by category with TCP/UDP, the encrypted alternative where one exists, and the one thing most students forget.
Cisco Security Platforms: XDR, Firepower, Secure Connect, Secure Endpoint, ISE, SMA
The six Cisco security platforms on CCNAAUTO 200-901 3.5 (v1.1): Cisco XDR, Firepower (now Secure Firewall), Secure Connect, Secure Endpoint, ISE, Secure Malware Analytics. What each does and how its API is shaped.