it-learn.io | IT, Networking & Cybersecurity Blog

ActiveMQ Code Injection Under Active Attack — CISA KEV Additions and macOS LOTL Techniques

Tue, 21 Apr 2026 00:00:00 +0000

ActiveMQ exploitation confirmed with 6,400 exposed servers. CISA adds 8 flaws to KEV including 3 Cisco SD-WAN bugs. Cisco Talos documents macOS living-off-the-land techniques bypassing enterprise EDR as Mac adoption hits 45%.

Cisco SD-WAN vs Traditional VPN: What to Tell the Customer

Tue, 21 Apr 2026 00:00:00 +0000

The conversation usually starts the same way. A network manager says their MPLS contract is up for renewal, branch users are complaining about application performance, and the CFO wants to cut WAN costs. The question lands on your desk: should we stick with our current VPN setup or move to SD-WAN?

This guide gives you the architectural comparison, performance data, security analysis, cost framework, and customer conversation structure to answer that question with confidence.

Cloud Account Takeover: From Leaked AWS Keys to Crypto Mining in 4 Minutes

Tue, 21 Apr 2026 00:00:00 +0000

AWS publishes a statistic that should terrify every engineering team: when a valid AWS access key is committed to a public GitHub repository, automated scanners detect and attempt to use it in an average of 4 minutes. In documented cases, the first unauthorized API call has occurred within seconds of the git push.

Cloud credential theft is not a sophisticated nation-state technique. It is commodity automation running 24 hours a day against every public code repository, package registry, and CI/CD log endpoint on the internet. Understanding how these attacks work — the exact IAM privilege escalation chains, the specific services attackers abuse, and the detection signals that give you a chance to respond — is essential for anyone operating in AWS.

Cisco ISE vs Aruba ClearPass vs Forescout: SE Comparison Guide

Mon, 20 Apr 2026 00:00:00 +0000

Every NAC evaluation eventually becomes a three-horse race: Cisco ISE, Aruba ClearPass, and Forescout. Each platform approaches network access control from a different angle, and the right recommendation depends on the customer’s existing infrastructure, device landscape, and operational maturity. This guide gives you the feature-by-feature comparison, deployment model differences, and conversation frameworks you need to position confidently in any NAC deal.

Kubernetes RBAC Bypass: When Least Privilege Isn't Actually Configured

Mon, 20 Apr 2026 00:00:00 +0000

Kubernetes RBAC (Role-Based Access Control) is the cluster’s primary authorization system. Properly configured, it enforces least privilege so that a compromised pod, developer account, or CI/CD pipeline cannot escalate to cluster control. In practice, RBAC is frequently misconfigured in ways that create exactly the escalation paths it was designed to prevent.

The misconfigurations are often subtle: a wildcard that looks like a shortcut, a cluster-admin binding on a CI service account for convenience, a default service account left with auto-mounted tokens. This post maps the complete attack surface, demonstrates exploitation techniques, and provides the audit commands and policies to detect and remediate each issue.

Vercel Breached Through Context.AI Supply Chain Compromise — MCP Design Flaw, QEMU Evasion

Mon, 20 Apr 2026 00:00:00 +0000

Vercel confirmed a breach originating from a compromised third-party AI tool. Anthropic’s MCP protocol has a design-level RCE flaw. Ransomware operators are hiding payloads inside QEMU virtual machines to blind EDR. Plus NIST halts CVSS scoring for low-priority CVEs, Microsoft ships emergency OOB patches, and Apple notifications weaponized for phishing.

Container Escape: Breaking Out of Docker Into the Host

Sun, 19 Apr 2026 00:00:00 +0000

Containers are not virtual machines. This is one of the most consequential misunderstandings in modern infrastructure security. Where a virtual machine has a full hypervisor isolation layer separating guest and host kernels, a container shares the host kernel directly. The isolation that makes containers lightweight — Linux namespaces and cgroups — is also what makes them escapable when misconfigured or when vulnerabilities are present.

This post examines how container isolation works at the kernel level, walks through the primary escape vectors with working demonstrations, covers real CVEs that enabled escapes, and provides a concrete detection and hardening framework.

The SE's Guide to Reading a Vulnerability Report (CVE, CVSS, EPSS)

Sun, 19 Apr 2026 00:00:00 +0000

A customer sends you a Slack message at 3 PM: “Hey, have you seen CVE-2025-XXXXX? Our CISO is asking how your product handles this. Can you get back to me by EOD?”

You have two options. Option one: panic, forward it to your product team, and wait hours for a response while the customer’s confidence in you erodes. Option two: open the CVE, read it in 5 minutes, assess the severity, understand the attack vector, and respond with a clear, informed answer within 30 minutes.

How to Run a Technical Discovery Call for Security Deals

Sat, 18 Apr 2026 00:00:00 +0000

The discovery call is where deals are won or lost — and most SEs do not realize it. By the time you get to the demo, the technical evaluation, or the proof of concept, the trajectory of the deal has already been set by the quality of your discovery.

A strong discovery call does three things: it qualifies whether the deal is real, it maps the customer’s environment and pain to your solution, and it establishes you as a trusted technical advisor rather than a vendor. A weak discovery call — one where you ask surface-level questions and jump to solutioning too early — produces proposals that miss the mark, demos that do not resonate, and POCs that go nowhere.

S3 Bucket Breach: One Misconfigured Permission, Millions of Records Leaked

Sat, 18 Apr 2026 00:00:00 +0000

S3 buckets power the internet. They store backups, media assets, application logs, database exports, and millions of records of personal data. They are also among the most commonly misconfigured resources in cloud environments. A single checkbox left unchecked, a single wildcard principal in a bucket policy, or a legacy ACL set to “public-read” has led to some of the largest data breaches in cloud computing history.

This post dissects how S3 bucket exposures happen at a technical level, walks through real-world breaches, demonstrates the CLI commands attackers and defenders both use, and provides a concrete hardening framework you can apply today.

Apache ActiveMQ CVE-2026-34197 Exploited in the Wild — ZionSiphon ICS Malware and Sapphire Sleet macOS Campaign

Fri, 17 Apr 2026 00:00:00 +0000

Apache ActiveMQ RCE flaw dormant for 13 years now exploited in the wild and added to CISA KEV. ZionSiphon malware targets water treatment ICS. North Korean APT Sapphire Sleet pivots to macOS social engineering. AI-powered vishing platform ATHR automates credential theft at scale.

Firmware Rootkit: The Malware That Survives a Full OS Reinstall

Fri, 17 Apr 2026 00:00:00 +0000

Every incident response framework assumes at some point that reimaging a compromised machine returns it to a known-good state. Firmware rootkits invalidate this assumption entirely. When malware lives in the SPI flash on the motherboard — below the operating system, below the bootloader, below any software security control — no OS-level remediation is sufficient. The infection survives a Windows reinstall, a Linux install over Windows, a full drive replacement, and even a BitLocker wipe. The only remediation is reflashing the firmware from a trusted image or replacing the motherboard.

Security Compliance Cheat Sheet: NIST, ISO 27001, SOC 2, PCI DSS

Fri, 17 Apr 2026 00:00:00 +0000

Compliance comes up in nearly every enterprise security deal. The customer mentions SOC 2 during discovery. The RFP has a section on NIST controls. The CISO asks how your product helps with ISO 27001 certification. The IT director needs to know about PCI DSS 4.0 changes.

If you fumble these conversations, you look like a product specialist who does not understand the business context. If you handle them confidently, you position yourself as someone who understands not just the technology but the regulatory landscape that drives purchasing decisions.

SIEM Replacement: How Agentic AI Changes Security Operations

Fri, 17 Apr 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2743984) episode.

 In 2022, attackers took 8 hours to move from initial access to launching a secondary attack. By RSAC 2026, that window had collapsed to just 22 seconds. This jaw-dropping statistic—shared by Mandiant on the main stage in San Francisco—encapsulates everything that matters about cybersecurity in 2026: the speed of modern threats has fundamentally changed how we need to defend ourselves.

What This Episode Covers

Agentic AI as a Security Paradigm Shift — why agents aren’t just smarter chatbots, but autonomous decision-makers that can take action
The Death of Traditional SIEMs — how agentic systems are replacing legacy security information and event management platforms
Non-Human Identity & Agent Runtime Control — managing identities for AI agents and controlling their actions in production
AI-Generated Code Security — new vulnerabilities emerging from AI-assisted development
Post-Quantum Cryptography — the quiet but critical shift to quantum-resistant algorithms
Six Critical Predictions — what security leaders need to track over the next 12 months
The Vendor Landscape — products from Cisco, Microsoft, Palo Alto, Google Cloud, and others positioning themselves in the agentic era

Deep Dive

The 22-Second Problem: Why Speed Changes Everything

The collapse of the attack-to-exploitation window from hours to seconds is more than a scary statistic—it’s a wake-up call about operational feasibility. Traditional SOCs built around human analysts, ticket queues, and escalation chains cannot respond in 22 seconds. This is why the industry is pivoting so aggressively toward autonomous agents: they can detect, triage, and respond at machine speed.

BGP Hijacking: How Attackers Reroute the Internet Itself

Thu, 16 Apr 2026 00:00:00 +0000

The internet’s routing infrastructure — the system that determines how packets travel from one network to another — was not designed with security as a primary consideration. BGP (Border Gateway Protocol), the protocol that glues together the approximately 75,000 Autonomous Systems (ASes) that constitute the global internet, operates fundamentally on trust. When an AS announces that it is the best path to a given IP prefix, neighboring ASes generally believe it. This design decision, reasonable in 1989, enables a class of attacks with global impact.

Cisco ISE and Webex RCE Flaws Patched — CVE-2026-20184, nginx-ui Exploited, SAP CVSS 9.9

Thu, 16 Apr 2026 00:00:00 +0000

Four critical Cisco ISE and Webex vulnerabilities patched, nginx-ui authentication bypass actively exploited, SAP April Patch Tuesday includes a CVSS 9.9 SQL injection, and Cisco Talos exposes the PowMix botnet hiding C2 traffic in Heroku API calls.

How to Whiteboard a Zero Trust Architecture in 10 Minutes

Thu, 16 Apr 2026 00:00:00 +0000

There is a moment in every customer meeting where slides stop working. The CISO has seen a hundred vendor decks. The security architect is checking email during your presentation. The energy in the room is flat.

Then you stand up, walk to the whiteboard, and start drawing.

Everything changes. People put down their phones. They start asking questions. They point at the diagram and say “Wait, where does our VPN fit in that model?” Now you are having a conversation, not delivering a presentation.

Microsoft April 2026 Patch Tuesday: 167 Fixes, Exploited SharePoint Zero-Day CVE-2026-32201, and n8n Phishing Abuse

Wed, 15 Apr 2026 00:00:00 +0000

April 2026’s record Patch Tuesday, Cisco Talos research on n8n workflow abuse for phishing, a fake Ledger Live app that drained $9.5M through Apple’s App Store, and an Android RAT turning 220K devices into proxy nodes.

MITRE ATT&CK Framework Explained for Solutions Engineers

Wed, 15 Apr 2026 00:00:00 +0000

Every Solutions Engineer in cybersecurity will eventually sit across from a customer who says some version of this: “Show me how your product maps to MITRE ATT&CK.” If you stumble through that moment, you lose credibility that is very hard to recover. If you handle it well, you establish yourself as someone who understands threats at a technical level — not just someone who demos software.

MITRE ATT&CK has become the de facto common language between security vendors, SOC teams, threat intelligence analysts, and CISOs. It is referenced in RFPs, used in product evaluations, and increasingly required in compliance frameworks. As an SE, you do not need to be a threat researcher. But you do need to understand the framework well enough to use it naturally in conversation, map it to your product’s capabilities, and leverage it to differentiate your solution.

Pass-the-Hash: Why Stealing the Hash Is Just as Good as the Password

Wed, 15 Apr 2026 00:00:00 +0000

Pass-the-Hash (PtH) is arguably the most impactful lateral movement technique in Windows environments. It transforms credential access into network-wide compromise without requiring password cracking, works across the majority of enterprise network services, and has been a core component of some of the most destructive cyberattacks in history — including NotPetya and numerous ransomware operations. Understanding its mechanics is prerequisite to understanding why so many Active Directory environments remain vulnerable despite years of awareness.

30 Skills Every Cybersecurity Solutions Engineer Needs

Tue, 14 Apr 2026 00:00:00 +0000

The difference between a good Solutions Engineer and a great one is not just technical knowledge — it is knowing how to apply that knowledge in every phase of the sales cycle. From the first discovery call to the final architecture review, the best SEs combine deep technical credibility with the ability to translate complex security concepts into business outcomes.

This series covers 30 essential skills across six categories. Each post is a practical guide you can apply immediately — in your next customer meeting, your next whiteboard session, or your next career move.

Kerberoasting: Stealing Service Tickets to Crack Passwords Offline

Tue, 14 Apr 2026 00:00:00 +0000

Kerberoasting is one of the most reliably effective Active Directory attack techniques: it requires only a valid domain account, leaves minimal traces by default, and yields plaintext service account credentials that often grant significant lateral movement opportunities. Unlike many AD attacks that require elevated access or interaction with specific hosts, Kerberoasting operates entirely through legitimate Kerberos protocol requests — making it difficult to block without fundamentally changing service account management practices.

SAP Critical ABAP Patch, FortiClient EMS CVE-2026-21643, W3LL Phishing Takedown — 2026-04-14

Tue, 14 Apr 2026 00:00:00 +0000

SAP’s April 2026 patch cycle includes a critical ABAP vulnerability affecting 13+ products. CISA adds FortiClient EMS SQL injection CVE-2026-21643 to KEV with confirmed exploitation. FBI and Indonesia dismantle the W3LL phishing kit behind $20M in fraud. wolfSSL ECDSA flaw breaks certificate trust for embedded devices.

Adobe Reader Zero-Day CVE-2026-34621 Exploited for Months — CPUID Supply Chain Compromise and OpenAI Certificate Revocation

Mon, 13 Apr 2026 00:00:00 +0000

Adobe Reader’s CVE-2026-34621 was actively exploited for months before the April 12 patch. CPUID’s site was compromised to serve trojanized CPU-Z and HWMonitor. OpenAI revokes its macOS signing certificate after the Axios supply chain incident cascades. APT37 shifts to Facebook for initial access.

DNS Hijacking: Redirecting Your Traffic Without You Knowing

Mon, 13 Apr 2026 00:00:00 +0000

The Domain Name System is the phone book of the internet. When your browser resolves bank.example.com, it trusts the answer it receives. DNS hijacking exploits that trust — an attacker who controls the DNS resolution path can silently redirect your traffic to infrastructure they control, intercept credentials, and serve malware, all while your browser displays a lock icon and a familiar URL.

This post dissects every major DNS hijacking vector, walks through real APT campaigns that used these techniques at scale, provides detection logic you can deploy today, and covers defenses that meaningfully reduce your attack surface.

Adobe Reader Zero-Day Exploited for Months Before Emergency Patch

Sun, 12 Apr 2026 00:00:00 +0000

An Adobe Reader RCE exploited in the wild for months, a 19-hour supply chain compromise at CPUID, and active exploitation of a Marimo notebook flaw — plus detection guidance for trojanized utility installers.

Watering Hole Attack: They Compromised the Site You Trust

Sun, 12 Apr 2026 00:00:00 +0000

In February 2017, a bank’s security team was reviewing the JavaScript source code of the Polish Financial Supervision Authority (KNF) website — a regulatory portal they were required to visit regularly. They found something unexpected: an obfuscated JavaScript snippet that fingerprinted visitors and selectively redirected specific targets to an exploit kit landing page. The KNF site had been compromised. The attackers had turned the regulator’s own website into a trap for the banks it supervised.

Living Off the Land: How Attackers Use PowerShell, WMI, and Your Own Tools Against You

Sat, 11 Apr 2026 00:00:00 +0000

APT29 did not land on the DNC network in 2016 with custom malware. They used PowerShell Empire — a framework built entirely on Windows’ own scripting infrastructure. The SolarWinds attackers deployed TEARDROP as a memory-only shellcode loader. Carbanak stole over $1 billion from banks using WMI and PowerShell for persistence and lateral movement without dropping traditional malware files.

Living Off the Land (LOTL) attacks are not a niche technique — they are the standard operating procedure for every serious threat actor today. The fundamental insight is elegant: if you use the operating system’s own tools, your activity looks like the operating system’s own activity.

Ransomware Double Extortion: They Encrypt AND Leak Your Data

Fri, 10 Apr 2026 00:00:00 +0000

In 2019, the Maze ransomware group made a strategic decision that fundamentally changed the ransomware threat landscape: they began stealing data before encrypting it. The extortion pressure was no longer just “pay or lose your files” — it became “pay or we publish your files.” When Maze shut down in late 2020, they shared their playbook with other groups. By 2021, double extortion was the industry standard.

This post covers the full technical attack chain — from initial access through exfiltration and encryption — along with the detection logic and defensive controls that create meaningful friction for modern ransomware groups.

Ransomware, Viruses & Malware Types: Detection Guide

Fri, 10 Apr 2026 00:00:00 +0000

🎙️ This post was auto-generated from the Tech Updates podcast episode.

Malware isn’t just “a virus”—it’s a complex ecosystem of weaponized tools designed to damage systems, steal data, and extort organizations. In 2026, the threat landscape is more sophisticated than ever, and understanding the differences between malware types is critical for any IT or security professional. This episode breaks down the major malware categories, how they infiltrate networks, and the multi-layered defense strategies you need to protect your infrastructure.

Zero-Day Exploit: The Patch Doesn't Exist Yet — Now What?

Thu, 09 Apr 2026 00:00:00 +0000

On December 9, 2021, a single GitHub commit changed global cybersecurity operations. The Log4Shell vulnerability — a remote code execution flaw in the ubiquitous Log4j Java logging library — went from privately reported to publicly weaponized in the span of hours. Within three days, over 100 distinct threat actor groups were observed exploiting it. Within a week, it was in ransomware deployment chains.

Zero-days are not theoretical. They are the operational reality that every security team must plan for — not just during disclosure, but long before one is announced. This post covers the full zero-day lifecycle, how brokers and nation-states monetize them, real-world examples with technical depth, and the controls that give you options when the patch does not yet exist.

Supply Chain Attack: How SolarWinds Compromised 18,000 Organizations with One Update

Wed, 08 Apr 2026 00:00:00 +0000

The SolarWinds attack did not begin with a phishing email or a misconfigured firewall. It began inside a build server — the trusted forge where software is assembled, signed, and shipped. By the time 18,000 organizations downloaded the trojaned Orion update in the spring of 2020, the attackers had already achieved something far more dangerous than a network intrusion: they had weaponized trust itself.

This post dissects the technical mechanics of the SUNBURST backdoor, the Orion build pipeline compromise, DGA-based command and control, and the detection and defense strategies that can limit your exposure to this class of attack.

30 Cybersecurity Attacks Every Solutions Engineer Should Know

Tue, 07 Apr 2026 00:00:00 +0000

Every customer conversation about security eventually lands on the same question: “What attacks does your solution actually stop?” If you cannot walk through the kill chain of a ransomware double-extortion campaign, explain how a Golden Ticket forges Kerberos credentials, or describe why BGP hijacking can reroute traffic across continents, you lose credibility fast.

This series covers 30 attacks that matter in 2026. Each post breaks down the attack mechanics, maps techniques to the MITRE ATT&CK framework, provides detection queries you can run in Splunk or Sentinel, and outlines concrete defense strategies. These are the attacks you will hear about in security briefings, encounter in RFP responses, and need to demo against in proof-of-concept engagements.

Splunk + Cisco ISE: Syslog Integration and RADIUS Dashboard

Tue, 07 Apr 2026 00:00:00 +0000

Cisco ISE is generating a continuous stream of authentication, authorization, and posture data — every 802.1X login, every guest registration, every failed auth attempt. Out of the box, that data lives in ISE’s internal MnT database where it’s searchable but limited. Sending it to Splunk unlocks full SIEM capabilities: long-term retention, correlation with other security data, custom dashboards, and automated alerting.

This guide covers the complete integration from ISE syslog configuration through Splunk field extractions, SPL queries, and a live RADIUS operations dashboard.

Cisco ISE Posture Assessment: Complete Configuration Guide

Mon, 06 Apr 2026 00:00:00 +0000

Network access control without posture is trust based on identity alone. Posture adds a second layer: even if you are who you say you are, is your device actually secure? ISE posture assessment answers that question — checking antivirus status, patch levels, disk encryption, and more before granting full access.

This guide covers the complete posture configuration: client provisioning, conditions, requirements, policy, compliance state handling, and remediation.

Cisco ISE Guest Portal Setup: Self-Registration, Sponsored, and Hotspot

Fri, 03 Apr 2026 00:00:00 +0000

ISE’s guest access system is one of its most visible features — visitors, contractors, and BYOD users all need network access, and ISE gives you complete control over how that access is granted, monitored, and expired. But the configuration has a lot of moving pieces: portal types, sponsor workflows, CWA redirects, guest types, and VLAN assignments all need to work together.

This guide walks through the full setup for all three portal types, the CWA flow that ties it to the network, and the sponsor portal configuration for enterprise deployments.

Cisco ISE Active Directory Integration: Complete Configuration Guide

Thu, 02 Apr 2026 00:00:00 +0000

Cisco Identity Services Engine (ISE) is built around the concept of identity-aware policy — but ISE itself doesn’t store your users. It needs to talk to your directory. For most enterprise environments, that directory is Active Directory. Getting the ISE-to-AD integration right is the foundation everything else sits on: 802.1X authentication, authorization policy, guest flows, posture assessment, and profiling all depend on it.

This guide walks through the complete integration from scratch: prerequisites, joining ISE to AD, configuring the identity store, mapping AD groups into policy, and troubleshooting when things don’t work.

CUIC Report Execution Failed: Complete Troubleshooting Guide

Wed, 01 Apr 2026 00:00:00 +0000

If you’ve hit the dreaded “Report Execution Failed. Retry running the report and if the condition persists, contact the administrator” message in Cisco Unified Intelligence Center (CUIC), you’re not alone. It’s one of the most searched CUIC errors — and unfortunately one of the vaguest. The same message can come from a dozen different root causes.

This guide walks through every common cause, how to diagnose which one you’re hitting, and exactly how to fix it.

Introducing the CCIE Security Study Hub — cciesec.it-learn.io

Sat, 28 Mar 2026 00:00:00 +0000

If you’re chasing the CCIE Security, you already know there’s no shortage of documentation — but there’s a real shortage of organized, exam-focused material that covers both the written qualifying exam and the 8-hour lab in one place.

That’s exactly what we built.

Meet cciesec.it-learn.io

cciesec.it-learn.io is a dedicated CCIE Security study hub built and maintained by it-learn.io. It covers two exams end-to-end:

RADIUS Load Balancing for Cisco ISE: The Complete Guide

Wed, 25 Mar 2026 00:00:00 +0000

If you’ve got multiple ISE Policy Service Nodes and you’re trying to distribute RADIUS traffic across them without breaking 802.1X, CoA, or session tracking — this guide is for you.

RADIUS load balancing is one of those topics that looks straightforward on paper but has a handful of sharp edges that bite you in production. We’re going to cover every major concept: PSN architecture, load balancing methods, session persistence, the SNAT trap, health probes, ISE-side config requirements, and what to watch for in cloud environments.

Ransomware-as-a-Service: 2026 Extortion Tactics Explained

Tue, 24 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2658840) episode.

Ransomware has evolved beyond simple encryption into a sophisticated extortion machine—and the tactics are getting darker in 2026. If your organization is still treating ransomware as a purely technical problem, you’re already behind. This episode breaks down how modern threat actors operate, why they’re abandoning encryption, and what actually works to stop them.

CompTIA Network+ (N10-009) Objective 1.3: Cloud Concepts & Connectivity Explained

Mon, 23 Mar 2026 12:00:00 +0000

Cloud computing has fundamentally changed how networks are designed and managed. Objective 1.3 of the CompTIA Network+ N10-009 exam tests your understanding of cloud service models, deployment models, and the connectivity options that tie everything together — VPN, SD-WAN, MPLS, and more.

Whether you’re studying for the exam or looking to understand how modern enterprise networks actually work, this post has you covered.

CompTIA Network+ (N10-009) Objective 1.2: Networking Appliances Explained

Mon, 23 Mar 2026 11:00:00 +0000

If Objective 1.1 gave you the OSI model as a framework, Objective 1.2 fills it with the actual hardware and software that makes networks run. Routers, switches, firewalls, IDS/IPS, load balancers — you need to know what each one does, where it sits in the network, and which OSI layer it operates at.

CCNA 200-301: How to Build a Home Lab and Study Without Buying Cisco Hardware

Sun, 22 Mar 2026 00:00:00 +0000

The Cisco CCNA 200-301 is the gold standard entry-level networking certification. It proves you can configure, troubleshoot, and operate enterprise networks — Cisco’s routers and switches specifically — and it opens doors that no CompTIA cert can match in the Cisco-heavy enterprise world.

The challenge is obvious: Cisco hardware is expensive. A used Cisco 2811 router runs $30–100 on eBay, switches cost more, and you need multiple devices to build anything realistic. That adds up fast.

CompTIA Network+ (N10-009) Objective 1.1: OSI Model All 7 Layers Explained

Sun, 22 Mar 2026 00:00:00 +0000

If you are studying for the CompTIA Network+ (N10-009) exam, Objective 1.1 is where it all begins. The OSI (Open Systems Interconnection) model is the foundation every other networking concept builds on. Nail this and the rest of the exam gets easier.

In the video above I walk through all 7 layers visually. In this post I’m going to go deeper — covering each layer, the encapsulation process, TCP flags, MTU, and the exam tips that actually matter.

How to Integrate Meraki Networks with Cisco ISE

Sun, 22 Mar 2026 00:00:00 +0000

Cisco Identity Services Engine (ISE) is the cornerstone of enterprise network access control. Meraki is the go-to platform for cloud-managed networking in branch offices and mid-market deployments. Getting the two working together gives you centralized authentication, guest management, device posturing, and dynamic policy enforcement — all across your wireless, wired, and VPN infrastructure.

This guide walks you through the full integration end to end: ISE device configuration, Meraki Dashboard setup for both wireless and wired, ISE policy sets, Central Web Authentication, Change of Authorization (CoA), and verification.

CompTIA Network+ N10-009 Complete Study Guide

Fri, 20 Mar 2026 00:00:00 +0000

The CompTIA Network+ (N10-009) is one of the most respected vendor-neutral networking certifications available — and one of the best starting points for a career in IT infrastructure, network engineering, or cybersecurity. This page is your hub for everything on this blog covering the N10-009 exam objectives.

Each objective gets its own dedicated post with a video walkthrough, detailed explanations, and accordion-style practice questions so you can test yourself as you go.

Network+ N10-009: Home Lab Ideas to Study Networking the Right Way

Wed, 18 Mar 2026 00:00:00 +0000

The CompTIA Network+ N10-009 proves you can design, configure, manage, and troubleshoot real networks. It’s one of the most recognized mid-level certifications in IT — and it’s the foundation that everything else (Security+, cloud, DevOps) builds on.

The challenge is that networking is deeply physical by nature. Routers, switches, cables, IP addresses — it’s hard to understand these concepts without actually touching them. That’s exactly where a home lab changes everything.

Phishing in 2026: From Classic Emails to AI-Enhanced Deepfakes – Technical Breakdown & Defenses

Tue, 17 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2636101) episode.

 # Phishing in 2026: From Classic Emails to AI-Enhanced Deepfakes – Technical Breakdown & Defenses

Phishing has evolved far beyond misspelled emails and obvious urgency tactics. In 2026, attackers are weaponizing generative AI, voice cloning, and deepfake video to create hyper-personalized, grammatically perfect campaigns that bypass both human intuition and legacy email filters. This episode breaks down how these attacks work, what the attack chains look like in practice, and the technical defenses that actually stop them.

Security+ SY0-701: Study Ideas and Home Labs You Can Build Today

Tue, 17 Mar 2026 00:00:00 +0000

The CompTIA Security+ SY0-701 is one of the most recognized entry-level cybersecurity certifications in the industry. It’s DoD-approved, vendor-neutral, and validates that you understand the real threats and controls organizations deal with every day.

But here’s the truth: you can’t just read your way to passing Security+. The exam tests scenario-based thinking. You need to understand why a control exists, how an attack works, and what you would do when something goes wrong.

We Built a Free Network+ Study Site — Flashcards, Practice Quizzes & Progress Tracking

Tue, 17 Mar 2026 00:00:00 +0000

If you’re studying for the CompTIA Network+ N10-009 exam, we built something specifically for you — and it’s completely free.

No account required. No paywall. No ads. Just a clean, fast study tool that covers every domain and objective on the current exam.

👉 network.it-learn.io

What Is It?

It’s a static web app organized around the official Network+ N10-009 exam domains:

1.0 Networking Concepts (8 objectives)
2.0 Network Implementation (4 objectives)
3.0 Network Operations (5 objectives)
4.0 Network Security (3 objectives)
5.0 Network Troubleshooting (5 objectives)

Every section is broken down to the objective level so you can study exactly what’s on the exam — nothing more, nothing less.

Urgent Cybersecurity Alerts: Geopolitical Cyber Escalation, VMware Zero-Day Exploitation, and Major Ransomware Breach (March 2026)

Wed, 11 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2607614) episode.

 Geopolitical tensions, zero-day exploits, and healthcare data breaches converge in this week's cybersecurity landscape—a perfect storm of threats that demand immediate attention from security teams everywhere. In a single week spanning late February through early March 2026, organizations faced escalating state-sponsored cyber operations, active VMware vulnerabilities, and the fallout of a massive healthcare data exposure affecting over a million individuals.

What This Episode Covers

Geopolitical Cyber Escalation: Iranian-linked cyber operations intensifying following U.S.-Israel military strikes, including coordinated phishing campaigns targeting critical infrastructure and government entities
VMware Aria Operations Zero-Day (CVE-2026-22719): A command injection vulnerability now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, actively weaponized in the wild
University of Hawaiʻi Cancer Center Ransomware Breach: Disclosure of a 2025 attack impacting up to 1.2 million individuals, exposing sensitive healthcare data and revealing extended dwell times in healthcare environments

Deep Dive

Geopolitical Cyber Escalation: When Kinetic Meets Digital

The escalation of Iranian-linked cyber operations in late February represents a critical shift in the threat landscape. Following U.S.-Israel military strikes, threat actors affiliated with Iranian state interests have ramped up offensive cyber operations—a classic pattern of asymmetric response when conventional military options are constrained.

Welcome to the new it-learn.io

Tue, 10 Mar 2026 00:00:00 +0000

Welcome to the new it-learn.io — now running on Hugo + S3 + CloudFront.

Same content, same topics: IT, networking, security, and the occasional deep dive. Faster, cheaper, and fully automated.

Stay tuned for new posts and podcast episode recaps from Techupdates.

Application-Level Microsegmentation: Granular Zero Trust Enforcement in 2026

Mon, 09 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2607482) episode.

 As breaches become a matter of when, not if, the security industry has shifted focus from prevention to containment—and microsegmentation at the application level is emerging as the critical control that stops attackers dead in their tracks. In this technical deep dive, we explore three enterprise-grade platforms designed to enforce zero trust principles at the workload and process level, stopping lateral movement before it becomes a breach.

What This Episode Covers

Microsegmentation fundamentals — how application and workload-level policies differ from network-level segmentation
Illumio Zero Trust Segmentation — host/agentless visibility, AI-powered policy automation, and breach isolation capabilities
Akamai Guardicore Segmentation — kernel-level process enforcement, automated policy generation, and Osquery threat hunting integration
Cisco Secure Workload — workload dependency mapping, eBPF tracing, and native integration with ACI and Kubernetes
Emerging 2025-2026 trends — agentless enforcement modes, machine learning anomaly detection, and scalability for thousands of workloads
Technical architectures and enforcement mechanisms — understanding how each platform detects, enforces, and responds to policy violations in real time

Deep Dive

Why Microsegmentation Matters in 2026

Traditional network segmentation relies on perimeter controls and network zones—but modern infrastructure has shattered the perimeter. Hybrid environments, multi-cloud deployments, and containerized workloads mean that attackers who breach one system are often just a lateral hop away from critical assets. Microsegmentation flips this model: instead of trusting everything inside a zone, zero trust principles enforce least-privilege policies at the application and workload level, based on actual process identities, behaviors, and dependencies. This granular approach means that even if an attacker compromises a web server, they cannot automatically access a database or authentication service without explicit policy approval.

The Future of Firewalls: Hybrid Mesh Architectures Take Center Stage in 2026

Thu, 05 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2598062) episode.

 Your traditional perimeter firewall is becoming obsolete—and organizations that don't adapt risk leaving critical vulnerabilities in their multi-cloud, hybrid work environments. In this episode, we explore how hybrid mesh architectures are fundamentally reshaping enterprise network security, backed by Gartner's inaugural Magic Quadrant and real-world deployments from industry leaders.

What This Episode Covers

The rise of Hybrid Mesh Firewalls (HMF) — what they are and why Gartner formalized this category in 2025
Multi-deployment firewall strategies — how hardware, virtual, cloud-native, and FWaaS solutions work together under unified management
Vendor landscape — Palo Alto Networks, Fortinet, Cisco, and other leaders pushing unified security approaches
Operational benefits — centralized policy management, consistent threat prevention, and reduced complexity across distributed infrastructure
Future trends — SASE/SSE integration, quantum-readiness, and the shift from east-west to omni-directional threat prevention
Real-world implications — how hybrid mesh addresses multi-cloud, edge computing, and remote work security challenges

Deep Dive

Understanding Hybrid Mesh Firewalls

A Hybrid Mesh Firewall isn’t a single appliance—it’s an architecture. It represents multi-deployment firewalls (hardware, virtual, cloud-native, and Firewall-as-a-Service) managed from a single cloud-based control plane. The key innovation: consistent security policies, threat intelligence, and detection capabilities across your entire infrastructure, whether that’s on-premises data centers, AWS, Azure, GCP, edge locations, or remote user endpoints.

Latest Technical Enhancements in SSE Platforms: Prisma Access, Zscaler, and Cisco Secure Access (2025–2026 Updates)

Mon, 02 Mar 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2594798) episode.

 The Secure Service Edge (SSE) platform landscape is evolving at an unprecedented pace, with major vendors rolling out game-changing features throughout 2025 and into 2026. If you're responsible for securing your organization's network infrastructure, understanding these latest enhancements from Palo Alto Networks, Zscaler, and Cisco isn't just nice to know—it's essential to making informed technology decisions for your enterprise.

What This Episode Covers

Palo Alto Networks Prisma Access — Flow visualization, SD-WAN enhancements, and Strata Cloud Manager improvements
Zscaler Platform Updates — AI Security Suite, advanced DLP capabilities, and Client Connector refinements
Cisco Secure Access Evolution — Universal ZTNA, AI Defense, and AI-Aware SASE architecture
2026 Roadmap Priorities — Enterprise AI security, strict enforcement models, and hybrid deployment strategies
Practical Implementation Considerations — What these updates mean for your infrastructure planning

Deep Dive

Palo Alto Networks: From Infrastructure Visibility to AI-Ready Management

Palo Alto’s Prisma Access is solidifying its position as a comprehensive SSE platform with tangible improvements to operational visibility and management capabilities. The February 2025 Prisma SD-WAN updates introduced flow visualization—a critical feature for network engineers who need real-time insights into traffic patterns across distributed environments. This isn’t just eye candy; it’s the foundation for identifying bottlenecks, troubleshooting performance issues, and validating security policies in practice.

How Exploit Kits Are Automating Attacks Against Recent CVEs

Fri, 27 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2587027) episode.

 The window between a vulnerability disclosure and active exploitation in the wild is shrinking at an alarming rate—and exploit kits are the reason why. What once took weeks or months now happens in hours, thanks to automated attack frameworks that scan the internet continuously and deploy payloads with minimal human intervention. For IT teams and security professionals, understanding how exploit kits operate has moved from "nice to know" to "mission critical."

What This Episode Covers

How exploit kits function as automated attack platforms
The mechanics of vulnerability scanning and payload deployment at scale
Why the exploitation window after CVE disclosure keeps shrinking
The primary targets of exploit kit campaigns (internet-facing infrastructure)
Defensive strategies that move beyond reactive patching
Patch prioritization frameworks and attack surface reduction techniques
Building proactive exposure management into your security posture

Deep Dive

The Evolution of Automated Attacks

Exploit kits represent a fundamental shift in how cyberattacks are executed. Rather than relying on skilled attackers to manually identify vulnerable systems and craft custom exploits, these automated platforms handle the heavy lifting. Think of an exploit kit as a plug-and-play attack infrastructure—once configured, it continuously scans the internet, fingerprints systems, identifies vulnerabilities, and deploys malicious payloads without requiring active attacker intervention.

The perimeter is no longer just a boundary — it’s the battlefield

Wed, 25 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2576762) episode.

 Your firewall isn't just protecting your network anymore—it's become the primary target. In the latest Tech Updates episode, we explore a perfect storm of vulnerabilities hitting critical infrastructure, from CCTV systems to the perimeter devices you rely on most. If you manage internet-facing systems, this is required listening.

What This Episode Covers

CVE-2026-1670: A critical 9.8 severity vulnerability affecting Honeywell CCTV systems
Ransomware campaigns targeting firewalls: Why attackers are shifting focus to perimeter devices
Surge of high-severity CVEs: A wave of infrastructure vulnerabilities published this week
Perimeter security strategy: Understanding why the network edge has become the primary battleground

Deep Dive

The Honeywell CCTV Vulnerability: More Than Just Camera Feeds

The critical vulnerability in Honeywell CCTV systems (CVE-2026-1670) represents a growing problem in IoT security. With a CVSS score of 9.8, this isn’t a minor flaw—it’s a critical security gap that could allow attackers to hijack cameras and compromise password systems.

Trending Cybersecurity News (February 2026)

Sun, 22 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2568894) episode.

 February's cybersecurity landscape is moving at breakneck speed, with major vendors racing to patch critical vulnerabilities while attackers exploit zero-days in the wild. This week's Tech Updates episode cuts through the noise to highlight the stories that demand your immediate attention—and the strategic shifts they signal.

What This Episode Covers

Microsoft Patch Tuesday — 54 vulnerabilities patched, including 6 zero-days requiring immediate action
Apple’s Emergency Update — An actively exploited zero-day affecting iOS and macOS devices
AI and Attack Surface Expansion — New research on how enterprise AI adoption is creating security blind spots
The Strategic Reality — Why speed, visibility, and governance matter more than tool proliferation

Deep Dive

Microsoft’s February Patch Tuesday: 54 Vulnerabilities and 6 Zero-Days

Microsoft’s monthly Patch Tuesday updates are always significant, but February’s release underscores a troubling trend: zero-day vulnerabilities are becoming routine. Six zero-days in a single update means attackers had already discovered and likely weaponized these flaws before Microsoft could develop fixes.

Cisco Live EMEA - 2026 Recap

Thu, 19 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2559558) episode.

 Cisco Live EMEA 2026 delivered a masterclass in how enterprise infrastructure must evolve to meet the demands of AI-scale operations. With over 21,000 attendees gathering in Amsterdam, the conference revealed that networking, security, and operations are undergoing a fundamental transformation—and your infrastructure strategy needs to evolve accordingly.

What This Episode Covers

Silicon One G300 ASIC: Cisco’s new 102.4 Tbps programmable switching chip designed for AI data centers
AI Defense Portfolio Expansion: New security controls for AI supply chains, agent governance, and runtime protection
AgenticOps: Cisco’s autonomous operations framework bringing AI-first intelligence to networking and security
AI-Powered Collaboration: Webex enhancements including real-time translation and AI-ready devices
Strategic Positioning: How Cisco is positioning itself as an AI platform company, not just a networking vendor
Sovereign Infrastructure & Data Fabrics: Emerging trends in integrated, AI-optimized data center design

Deep Dive

The Silicon One G300: Redefining Data Center Performance

The headline announcement was the Silicon One G300, a programmable switching ASIC delivering 102.4 Tbps of throughput. For network engineers, this isn’t just another spec bump—it’s built from the ground up to handle the unique demands of AI workloads.

E4 - Agentic AI & AI Autonomy Edition

Wed, 11 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2542146) episode.

 # Goldman Sachs, Claude Opus 4.6, and the Enterprise Race for Agentic AI

Agentic AI is no longer theoretical—it’s moving into production environments at some of the world’s largest financial institutions. In this episode, we explore how enterprises are operationalizing autonomous AI systems, what the latest Claude model brings to the table, and what observability challenges IT teams need to prepare for right now.

E3 - Zero Trust, what's the latest?

Tue, 03 Feb 2026 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2517328) episode.

 # Zero Trust Adoption is Accelerating: Here's What You Need to Know

The security landscape is shifting beneath our feet, and zero trust is no longer a buzzword—it’s becoming the standard that government agencies and enterprises expect you to implement. With recent NSA guidance, major partnerships forming around critical infrastructure, and security vendors racing to expand their federal presence, the zero trust movement has reached an inflection point that every IT professional needs to understand.

CLUS 25 - AI-Ready Data Centers

Tue, 08 Jul 2025 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2100679) episode.

 # Transforming Your Data Center for the AI Era: Cisco Live 2025 Innovations

AI isn’t coming to your data center—it’s already there. And if your infrastructure isn’t ready for it, you’re about to face some serious challenges. At Cisco Live 2025, one of the strongest focal points was helping organizations transform their data center infrastructure to handle the massive, unprecedented demands of AI workloads. Let’s break down what Cisco announced and why it matters for your organization.

CLUS 25 - Cisco's Technology Vision for the Future

Wed, 02 Jul 2025 00:00:00 +0000

 > 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2098101) episode.

 As artificial intelligence reshapes the technology landscape, Cisco is charting a bold new course for the future of networking and security. During Cisco Live 2025 in San Diego, company executives laid out a strategic vision that places AI agents and autonomous applications at the center of network architecture—forcing organizations to rethink everything they thought they knew about infrastructure.

What This Episode Covers

The emergence of “agentic AI” and what it means for enterprise networks
How autonomous applications and AI bots will fundamentally change network demands
The need for reimagined network architecture to handle unprecedented data scales
Cisco’s unified platform strategy for the AI-driven era
Embedding intelligence across the networking and security portfolio
Building adaptive, secure, and operationally efficient networks for tomorrow

Deep Dive

The Agentic AI Era is Here

We’re not talking about the ChatGPT-style AI that responds to prompts. Agentic AI represents a fundamentally different paradigm—autonomous agents and bots that can perceive their environment, make decisions, and take action with minimal human intervention. These aren’t tools you query; they’re systems that operate independently, managing tasks, making trade-offs, and learning from outcomes.

Secure Client (AnyConnect) + Secure Endpoint - Quick Deployment Guide

Wed, 12 Apr 2023 00:00:00 +0000

Quick post on Implementing Cisco Secure Endpoint leveraging Cisco Secure Client Cloud Deployment - Cool stuff and easy to deploy and implement

First go to SecureX (https://securex.us.security.cisco.com)

Click the Insights Tab

Go to Deployment Management on the Left SideBar

On the right Go to –> + Create New Add a name and Click Save

Under the Cloud Management Section, you will have 2 options – Depending on your needs you can have it to AutoUpdate or NoAutoUpdate. This is a cool feature and will be the best way to keep the Core Modules updated

Cybersecurity Incident Response - Basics and How to get Started

Mon, 27 Feb 2023 00:00:00 +0000

Today I want to start off by sharing a few things that I have been researching for a while. I have had a lot of curiosity about incident response, I want to understand how it works, what is expected from an IR team, and much more.

For the last few days, I have also been asking my new friend ChatGPT about it so that I can get some of the answers and things that go on during an Incident Response engagement.

Cybersecurity Incident Response - Detection and Analysis (Tools and Indications)

Mon, 27 Feb 2023 00:00:00 +0000

I consider it should be a good idea to start with a quick overview or list of Attack Vectors before we dive right into what goes into the Detection and Analysis phase.

Companies should be able to prepare and have plans around common attack vectors, and what to do in those cases, we went over that in our previous post, but this time as a refresher, here is a non-exhaustive list of common attack vectors:

Cybersecurity Incident Response - Preparation

Mon, 27 Feb 2023 00:00:00 +0000

I want to take the opportunity to break down what goes into the preparation for incident response and what things could like from the perspective of an infosec professional.

Going back to NIST, there are a few things that are considered:

Part of a well-defined IR Plan includes things like creating an IR Policy and plan, and what tools will be used for performing incident handling and reporting. A determined team structure, who are the players?, lead Engineers? who is in charge of collecting forensic data? what happens during the eradication and recovery phases, and who is in charge? Should these functions be assigned to a team or an individual? - A well-described line of communication between teams and technical and executive teams (Yeah - Executives need to be involved)

Secure Client (AnyConnect) - How to configure Secure Client 5.x Using SecureX Insights

Tue, 14 Feb 2023 00:00:00 +0000

Last year AnyConnect went through an interesting transformation, its name changed to Secure Client, and looks like Cisco realized that the amount of information that could be collected from it and other services, makes it a good data mine for Security context and information.

But what is the buzz about, what changed?

A few interesting things changed, and one of the most important things that changed was the way to deploy it or roll it out to an environment.

SASE - Configuring Umbrella Security - Basic Setup - DNS Server Forwarding

Mon, 13 Feb 2023 00:00:00 +0000

Today I want to create a quick blog post that goes over setting up Umbrella in a few different ways, you may notice that these will be long posts, so I will have to break this into a few different posts over the coming weeks.

If you are new to Cisco Umbrella, well here is a quick explanation of what it is and how it works:

Cisco Umbrella offers flexible, cloud-delivered security. It combines multiple security functions into one solution, so you can extend data protection to devices, remote users, and distributed locations anywhere. Umbrella is the easiest way to effectively protect your users everywhere in minutes.

SASE - Configuring Umbrella Security - Basic Setup - How to integrate Umbrella with FMC

Mon, 13 Feb 2023 00:00:00 +0000

Hey we are back, this time I want to explore the section of the deployment of Umbrella, where we can configure a device to communicate and forward all traffic to Umbrella

We will concentrate on the section for Network Devices this time:

The main idea of this integration is that the devices will become an Identity, which you can use later to apply policy under any of your settings inside Umbrella

The Basics of Networking | Cables, Interfaces and Fiber

Mon, 16 Jan 2023 00:00:00 +0000

Simple Definition of Ethernet Cables and Speeds

Ethernet is a widely-used local area network (LAN) technology that uses a bus or star topology and supports data transfer rates of 10 Mbps. Fast Ethernet, also known as 100BASE-T, is an extension of Ethernet that supports data transfer rates of 100 Mbps. Gigabit Ethernet, also known as 1000BASE-T, is another extension of Ethernet that supports data transfer rates of 1 Gbps. 10 Gigabit Ethernet, also known as 10GBASE-T, is the latest extension of Ethernet that supports data transfer rates of 10 Gbps.

The Basics of Networking | Network Protocols | DHCP

Mon, 16 Jan 2023 00:00:00 +0000

The Simple Definition

Dynamic Host Configuration Protocol (DHCP) is a network protocol used to automatically assign IP addresses to devices on a network. DHCP is used to simplify the management of IP addresses and reduce the likelihood of IP address conflicts.

When a device, such as a computer or a smartphone, connects to a network, it sends out a broadcast message requesting an IP address. A DHCP server, which is typically located on a router or a dedicated server, receives the request and assigns an available IP address to the device. The DHCP server also assigns other network configuration information, such as the subnet mask, default gateway, and DNS server IP addresses.

The Basics of Networking | Network Topology Architectures | Spine-Leaf

Mon, 16 Jan 2023 00:00:00 +0000

Spine-Leaf Network Architecture

The spine-and-leaf network topology is a variation of the three-tier network topology, where the core layer is split into two parts: a spine and a leaf.

The spine layer is made up of high-speed routers or switches that connect all the leaf devices together. These devices are responsible for providing high-speed connectivity between the different parts of the network and they act as the primary point of interconnection.

The Basics of Networking | Network Topology Architectures | Tier 1 and Tier 2

Mon, 16 Jan 2023 00:00:00 +0000

Tier 2 Network Architecture

A two-tier network topology refers to a network architecture that has two layers, or tiers, of network devices.

Access: The first tier is the access layer, which is the point of entry for end-users into the network. It comprises of network devices such as switches, routers, and wireless access points. This layer is responsible for connecting end-users to the network and providing basic security features such as VLANs and access control lists.

The Basics of Networking | TCP and UDP

Mon, 16 Jan 2023 00:00:00 +0000

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two most commonly used protocols for transmitting data over a network. Both protocols are used for different types of data transmission and have their own unique features and characteristics.

Simple Definition of TCP

TCP is a connection-oriented protocol, which means that a virtual connection is established between the sender and the receiver before any data is transferred. This connection is maintained throughout the duration of the data transfer, and the receiver acknowledges receipt of each packet of data. This ensures that all data is received correctly and in the proper order. Additionally, TCP includes flow control and error-checking mechanisms to ensure that data is transferred efficiently and reliably. Due to these features, TCP is often used for applications that require high reliability, such as web browsing, email, and file transfer.

The Basics of Networking | The most Common Protocols in Networks

Mon, 16 Jan 2023 00:00:00 +0000

There is a very long list of network protocols, but I wanted to include a comprehensive list, with its descriptions. As mentioned this is a short list that is only including the most common and basic protocols

As you progress in your learning you will notice more protocols, based on the things that you are trying to achieve. Mostly it comes down to your infrastructure requirements and environment.

We can think of this list as a quick list to get us started, as these are the most common protocols

Series: The Basics of Networking | Network Elements

Sun, 15 Jan 2023 00:00:00 +0000

I wanted to create a quick series with simple explanations of Network Devices and how they fit in Network environments. I hope this helps anyone that is starting their IT Career Journey.

I think that if you are looking to start a career in IT, Networking, Information Security, Cloud, or any other specialty, this series will help you.

Here is the breakdown of the topics created under the Series:

The Basics of Networking | Network Elements | Routers

The Basics of Networking | Network Elements | Endpoints, Servers and Computers

Sun, 15 Jan 2023 00:00:00 +0000

The simple definition | Endpoints

Endpoints are the devices that connect to the network and access its resources. These can include computers, laptops, smartphones, tablets, and other devices. They are the “ends” of the network, where people interact with the network and its resources.

Think of endpoints as the musicians in an orchestra. They are the ones who play the instruments and create the music, but they need a conductor to lead them and make sure everything is in sync. In the same way, endpoints need the network to access the resources they need to function.

The Basics of Networking | Network Elements | Firewalls and NGFW

Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A firewall is a security tool that is used to protect a computer network from unauthorized access. It acts as a barrier between a protected network and the outside world, controlling the flow of traffic in and out of the network.

Think of a firewall as a virtual security guard for your network. Just like how a security guard controls who can enter a building, a firewall controls what types of traffic can enter your network.

The basics of Networking | Network Elements | Routers

Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A router is a device that connects multiple networks together and directs the flow of data between them. It’s like the traffic cop on the internet, directing the flow of information to ensure it reaches its intended destination.

At its core, a router is a computer with specialized software and hardware that performs the task of routing. It uses routing tables and protocols to determine the most efficient path for data to travel from one network to another. When a packet of data (like an email or a web page) is sent from one device to another, the router examines the destination address and decides which path to send it on.

The Basics of Networking | Network Elements | Switches

Sun, 15 Jan 2023 00:00:00 +0000

The simple definition

A network switch is a networking device that connects devices together on a computer network. It allows multiple devices to communicate with each other by forwarding data packets between them.

When a device, such as a computer or a printer, wants to communicate with another device on the network, it sends a data packet to the switch. The switch then examines the packet and forwards it to the appropriate device.

The Basics of Networking | Network Elements | Wireless Access Points (WAP)

Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

Imagine being able to access the internet from anywhere in your house without the need for cables and wires. That’s exactly what a wireless access point (WAP) allows you to do.

A WAP is a networking device that allows wireless devices such as laptops, smartphones, and tablets to connect to a wired network and access the internet. It works by receiving signals from wireless devices and forwarding them to the wired network, where they can be processed and sent to the internet.

The Basics of Networking | Network Elements | Wireless LAN Controllers (WLC)

Sun, 15 Jan 2023 00:00:00 +0000

The Simple Definition

A WLC is a networking device that acts as a central management system for one or more WAPs. It is responsible for controlling the configuration, security, and performance of the WAPs in the network.

A wireless LAN controller (WLC) is like the conductor of an orchestra for your wireless network. It manages and coordinates the different wireless access points (WAPs) in your network, ensuring that they all work together seamlessly and efficiently.

Configure SMTP with Cisco ISE 3 | Import Microsoft 365 Certificates

Fri, 29 Jul 2022 00:00:00 +0000

If you are configuring the SMTP setting on Cisco ISE, you may have found an interesting error when complete this configuration —> Connection to smtp.domain.com failed. Could not connect to SMTP Server, SSL Error. Please check the trusted certificates.

In this case the issue is that Cisco ISE has to trust the connection with Microsoft 365, since we are doing the connection with MS365 recommended settings as follows:

AWS Certified Advanced Networking - Specialty: Documenting Progress

Wed, 20 Oct 2021 00:00:00 +0000

I’d like to start by saying some wise words I once read somewhere, “Everyone has a plan until they get punched in the mouth” and I believe this one was said by Mike Tyson. I think it holds a lot of true.

I recently attempted the AWS Network Specialty exam, and was humbled immediately after seeing the very first 5 questions. I failed the exam and felt a bit down for a while, but to recover from it I want to make sure I work on my plan extensively, so that I don’t get punched that bad next time.

Adding Google Analytics to a Static Website

Mon, 21 Jun 2021 00:00:00 +0000

A CMS software like WordPress is awesome because it lets you get statistics in real-time, like page visits, link hits, and many more; in my case, I was unsure what I need to do with a static website and add analytics to it. So I decided to look for ideas quickly.

I use Google Analytics in other business websites that I have set up, but those run on Squarespace or WordPress, in this case, my website is hosted in S3, so I was curious

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 1

Wed, 16 Jun 2021 00:00:00 +0000

I have noticed this company called Link Tree, where users log in and create a quick Links page with their picture on it and with all their links in one place. These links take them to multiple places, like their Social Media accounts, resumes. Blogs, products they sell, and so on.

While I was looking at it, I thought, I can create something like that from scratch. My HTML/CSS Skills are very outdated, so I decided to give it a shot.

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 2

Wed, 16 Jun 2021 00:00:00 +0000

As we continue moving forward with our project, we will move to the creation of the certificate using AWS Certificate Manager

Requesting Certificate from AWS Certificate Manager

I created a quick video to illustrate the process, so it’s easy to follow if you are trying something similar

What to look forward to?

The next and final piece of the puzzle is to make sure we enable a Content Distribution using CloudFront

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 3

Wed, 16 Jun 2021 00:00:00 +0000

Finally we made it to the last step of the project, this will be dedicated to the CloudFront piece

Create a Cloud Front Distribution

This quick video will show you how to configure the CDN piece with CloudFront.

What to look forward to?

Perfect, we made it to the end; now we want to make sure our Bucket is only accessible from our CDN, not from the external world. The next post will be the configuration we need to make this happen.

Creating a Links Website - S3, CloudFront & Certificate Manager - Supporting SSL + HTML/CSS - Part 4

Wed, 16 Jun 2021 00:00:00 +0000

Applying security is important, even when I lab stuff I try to make it as secure as possible, my projects may take a bit more time to complete, but this step will allow me to sleep at night.

Applying Security

I wanted to make sure that while my bucket in S3 is configured with Public Access, that now that we have Cloud Front up and running, we lock it so that only Cloud Front can access it. Here is a quick video on how to it

Simple Static Website Using Amazon S3

Tue, 01 Jun 2021 00:00:00 +0000

I’m refreshing a bit on my AWS skills to master most of AWS Services and technologies. I have attempted the AWS SA: Professional a few months back and failed pretty badly.

As a refresher I started using A-Cloud-Guru again and I was very impressed by the Hand on Lab Features, which they did not have last year.

I started playing with the Create a Static Webpage and here are the results. The video is not of great quality, but I wanted to make sure my process is documented and hopefully, I get better at doing these things.

FortiGate - Configuration (Part 4) - Administration and Management setup | Active Directory Setup | Administration with AD Group Membership

Mon, 19 Apr 2021 00:00:00 +0000

Having multiple administrators managing your Security devices is common practice, every user that is supposed to have access to a Firewall should have access to it. This needs to be controlled by an identity server; in this case, we will use Microsoft Active Directory.

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

The Requirement

Ensure the Network Administrators Group and Help Desk Groups have access to Manage the FortiGate - Use AD for Authentication.

FortiGate - Configuration (Part 1) - Interfaces and Getting Started

Sat, 17 Apr 2021 00:00:00 +0000

It has been a long time since my last practical/post, so I wanted to share what I have been working on

For my understanding and anyone reading this, I would like to set a quick standard for this lab; the best way to do it is by creating a quick diagram and a Plan

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

FortiGate - Configuration (Part 2) - Static Routes | Firewall Policies | Port Address Translation for Internet

Sat, 17 Apr 2021 00:00:00 +0000

TO pick up right where we left off, we will configure Static Routes to the providers, Security Policies (Allowing Traffic to the Internet), and NAT

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

The Diagram

Static Routes ISP

This part of the configuration is enjoyable; Fortinet helps you save time. When you configure a static route, it will suggest an interface to be used as the next hop, without you having to do much other than making sure it is the right one. You can also use the advanced options to make sure and set the priority of your interface.

FortiGate - Configuration (Part 3) - Web Filtering | Read-only SSL handshake inspection | Troubleshooting | Adding FortiGate CA Certificate to Windows 10

Sat, 17 Apr 2021 00:00:00 +0000

The Security Profile - Web Filter

FortiOS has a neat section for all the Security Profiles; this GUI is straightforward and intuitive. So let’s see what we have by default.

Looking to catch up up the FortiGate Series? - Make sure you check the Main Page for it –> FortiGate - Configuration Series.

From the screenshot, we can clearly see what these profiles are being used for. This time, I will make sure to copy the Default one instead of creating a new Profile. You can do this by right-clicking on the default profile, then select Clone. This will open a new section to adjust the name or accept the default Fortinet created for you, which reads: “Clone of Default.”

FortiGate - Configuration Series

Sat, 17 Apr 2021 00:00:00 +0000

Hey there, I created a quick series that goes over Fortinet Configuration. Initially, this series goes over simple configuration tasks

Let me know if this is helpful

FortiGate Configuration Series Main Post

On becoming Serverless, and what the heck is the Cloud anyways? - Part 1

Wed, 07 Apr 2021 00:00:00 +0000

For the past year, I have been wrestling with Cloud Technologies, trying to understand and put it in practice, but the right way, and what is the right way? You may ask. Cloud is designed to change the vision of how traditional infrastructures are created. Cloud shares a vision of multi-tenancy, elasticity, and scalability. And why not? Major Cloud providers design these solutions to make technology more streamlined and easy to consume.

New site for all previous posts and new ones! - it-learn.io

Mon, 05 Apr 2021 00:00:00 +0000

Launching it-learn.io

Welcome to the first and official post for it-learn.io - This post is just the vision of this site and what the creators (me) are looking to accomplish.

I’m thrilled you are here; as you may see previous posts you have read before from me(Andres Sarmiento), some posts from 2014 until 2020. After giving it a lot of thought, I decided to consolidate my previous collabengineer.com and cybersecengineer.com sites into one that makes sense and covers pretty much all areas of Technology.

Ready or not, MS Teams' prime-time at Schools (First day of School)

Wed, 19 Aug 2020 00:00:00 +0000

My blogging game has been off for the last few months ((https://cybersecengineer.com)), and that is ok, but as schools start today in my neck of the woods, I just could not resist and write this short post with my opinion.

A story of Broward Public Schools - Microsoft Teams Prime-Time

Today my kids started virtual classes and to my surprise I noticed that they are using MS Teams to get connected, meet and collaborate. I have to be honest, I did not think MS Teams was ready for meetings and collaboration, event tough I have been forced to use it at work, because all my team mates are using it.

Splunk Series III: System Administrator Class (File Structure, Settings and CLI)

Mon, 11 May 2020 00:00:00 +0000

Awesome, I was able to move from those 2 slides that took a lot of content and energy our of my brain! - The slides I’m referring to are the ones you get when you assist Splunk’s class for System Administration, basically the posts are my notes (This blog) which is an extraction of the most important content.

The next post will be about few things that I consider very important, like the settings, the directory structure and so on, so lets get at it

Splunk Series III: System Administrator Class (Installation and Recommendations)

Sun, 10 May 2020 00:00:00 +0000

Splunk can be installed in Windows and Linux for Production environments, there are some tweaks that you can configure to make your environment run better and with no issues, this class makes few recommendations that are very new to me so I will list them here to keep adding to my notes.

Linux Settings Recommendations

Ulimit

The class recommends the use of ulimit -ato view settings, and then increase the parameters on indexers and search heads. This one seems a bit off, but here is a quick informational link about the ulimit command

PANOS - Configuring OSPF and Default Route Advertisement

Fri, 08 May 2020 00:00:00 +0000

I have a very modest lab setup and have been putting the PAN-VM 100 to the test, in this case, I have 2 firewalls setup to handle the internet of the internal VMs in my lab

Here I a quick snapshot of the all the junk I have been running

So I decided that I want to use the PANVM as my primary internet, due to some limitations of speed with the ASA5506X (Only 250Mbps) - I’m running currently a 1Gbps internet for the lab so I wanted to make sure I could use all my bandwidth! (I want my money and I want it now!!)

Splunk Series III: System Administrator Class (Splunk Components, Processes and Installation)

Wed, 06 May 2020 00:00:00 +0000

Getting back from where we left over from yesterday. Here is a quick and interesting view of the components, processes and the Installation planning of the solution. I know, these post maybe repetitive in nature, but its the foundation of a well implemented solution

Core Components and Processes

This section is dedicated to describe all the components and processes and a brief explanation of Splunk

Search Heads

Allow users to submit search request using SPL (Search Processing Language)
Distribute search requests to the indexers
Consolidate results and render visualizations of results
Store search-time knowledge objects (Field extractions, alerts and dashboards)

Indexers

Receive incoming data from forwarders
Index and store data in Splunk indexes
search data in response to requests from Search Heads

Forwarders

Monitor configured inputs and forward data to the indexers (best practice data collection method)
Requires minimal resources and typically installed on the machines that produce the data

Deployment Server

Acts as a centralized configuration manager for any number of deployment clients
Requires running on an enterprise instance

Installation Overview

As with any installation, preparation and planning are key!

Splunk Series III: System Administrator Class (Splunk Deployment)

Wed, 06 May 2020 00:00:00 +0000

As I continue being exposed to Splunk in the wild as well as in class :) - I decided to write a bit on the class that I just took.

The System Administrator Class

This class is one of the many requirements to become a Splunk Certified Architect, which is what I’m going for in the next couple of months. This class along with the Data Administration one are required in order to take the Administration exam.

PANOS - Configuring Snapshots of Configuration

Tue, 05 May 2020 00:00:00 +0000

One thing that I really appreciate from Palo Alto is that their Firewalls have this nice way to save your configuration. As I move with labbing my experience with the Firewalls and products, I really wanted to highlight this.

Configuration Management

This section relates to the ability to different functions you can use to practically save your configurations, this is very handy because you can save a good known configuration, and ue at later time.

Palo Alto Networks - PCNSE Certification Part 6: Basic Configuration (Destination NAT and Security Policy)

Fri, 24 Apr 2020 00:00:00 +0000

The last post was very long and a bit crazy all over the place, but here we are continuing with it. To illustrate how to crate a destination NAT, we will be opening FTP to one of our DMZ server, so lets get started

Create Object

Under Objects -> Services we will create our new FTP Object

Destination NAT Policy

We are pretty much following the same flow we initially followed when we were playing with the Source NAT Policies, with few minor changes that will make sense

Palo Alto Networks - PCNSE Certification Part 3: Basic Configuration (Admin Roles)

Thu, 23 Apr 2020 00:00:00 +0000

So I continue my journey to get this cert, I think I have procrastinated for too long and I need to get back to learning all the ins and outs for the technology. Again this certification is very heavy on configuration, HA concepts and maybe scattered between all their main Objectives. We are going to get working with Initial Configuration

Admin Roles

Like any other appliance out there, you have the ability to create different Admin roles and different permissions based on their job function

Palo Alto Networks - PCNSE Certification Part 4: Basic Configuration (Interfaces)

Thu, 23 Apr 2020 00:00:00 +0000

This quick lab is going to be about creating Zones, assigning them to interfaces, Management Interface configuration

Creating a Zone

We will create the Outside Zone and we are going to add a name + selecting the type, nothing fancy, but later in the lab we will use it and go through configuring more features

Create an Interface Management Profile

We are going to quickly create a Management profile and assign to an interface

Palo Alto Networks - PCNSE Certification Part 5: Basic Configuration (Security Policies, source NAT)

Thu, 23 Apr 2020 00:00:00 +0000

Create Tags

One thing that I really appreciate from PANOS is the introduction of TAGs, they are very handy when you are looking for policies, objects and many different things in your firewall. I know many of you out there appreciate the feature.

Tags are color-coded labels and enable you to group, sort, and filter objects using keywords or phrases. Tags can be applied to Address objects, Address Groups (static and dynamic), services, Service Groups, and policy rules. Tags can be assigned a color that makes the results of a search easier to find in the web interface.

Cybersecurity Tools - VERIS Incident Model

Wed, 22 Apr 2020 00:00:00 +0000

Lack of quality information in Cyber Security and incident response is real, you have too many sources for too many things, and most of the information at reach is not centralized. A couple of years back when I was working on learning more and more ins and outs on the InfoSec community I found VERIS, which I think is a nice initiative.

Here is a quick breakdown of what it is

Splunk Series II: Correlating Events

Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Transactions

A transaction is a group of related events that span time. Events can come from multiple applications or hots. For example, One email message can create multiple events as it travels through various queues, also visiting a single website normally generates multiple HTTP requests

Transaction field-list can be one list field or a list of field names. Events are grouped into transactions based on the values of these fields. If multiple fields are specified and a relationship exists between those fields, events with a related field value are grouped into a single transaction.

Splunk Series II: Filtering/Formatting Data

Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Eval Commands

The eval commands are great to perform calculations, convert values, road values, format values and even use conditional statements. It is recommended to use search and were commands to filter calculated results.

Eval commands allow you to calculate and manipulate field values in your report Supports a variety of functions Results of Eval written to either new or existing fields you specify

If the destination field exists, the values of the field are replaced by the results of eval

Splunk Series II: Fundamentals II

Mon, 20 Apr 2020 00:00:00 +0000

SO we got to this point, looking at the Fundamentals 2 section of my training. This training builds on the Fundamentals 1 course. Which is pretty much all tools you can use for searching and understanding data in Splunk

What is part fo Fundamentals 2:

Transforming commands and Visualizations Filter/Format results of a Search Correlate Events into Transactions Knowledge Objects Extracted Fields, Fields Aliases and Calculated Fields Tags and Event Types Macros and WorkFlow Objects Manage Data Models Splunk Common Information Model

Splunk Series II: Knowledge Objects and Managing Fields

Mon, 20 Apr 2020 00:00:00 +0000

Introduction to Knowledge objects

These are tools you use to discover and analyze various aspects of your data

Data Interpretation - Fields and field extractions
Data Classification - Event types
Data Enrichment - Lookups and Workflow Actions
Normalization - Tasks and Field Aliases
Datasets - Data models

Knowledge objects can be shared between users, they are reusable, are made of persistent objects that can be used by multiple people or apps, such as macros and reports. They are also searchable since the objects are persistent, they can be used in a search

Splunk Series II: Visualizations

Mon, 20 Apr 2020 00:00:00 +0000

Visualizations

When a search returns statistical values, the results can be viewed with different visualization types, some of the Visualization types: Statistical Values Charts: Line, column, pie Single Value Visualizations Maps

Charts - Line Chart (Time Series)

Chart - Bubble

Cluster Map

Choropleth Map

What is next?

Filtering/Formatting Data

About the Author:

Andres Sarmiento, CCIE # 53520 (Collaboration) With more than 15 years of experience, Andres is specialized in Unified Communications and Collaboration technologies. Consulted for several companies in South Florida, also Financial Institutions on behalf of Cisco Systems. Andres has been involved in high-profile implementations including Cisco technologies; such as Data Center, UC & Collaboration, Contact Center Express, Routing & Switching, Security and Hosted IPT Service provider infrastructures.

Splunk Series: Basic Search

Mon, 06 Apr 2020 00:00:00 +0000

Basic search

The search assistant provides a nice way to begin looking up for something in particular. At this stage, you can determine a few different search criteria, such as a term in particular or search directly into a specific Index. The search assistant lets you be flexible and presents you with different options. Before the first pipe 9|), it will look at any matching term.

After the (|) sign you have the ability to start using a list of commands to help you search data, once you hover your mouse over the commands the Assistant will provide you with high-level information on how to use the command.

Splunk Series: Components

Mon, 06 Apr 2020 00:00:00 +0000

Splunk - Indexer

This is the engine that is in charge of processing machine data, stores the results in indexes as events. This is what allows enabling fast searches and analysis

As data is indexed, Splunk creates files organized in sets of directories by age.

Splunk - Search Head

Splunk has its own Search language, which we will be documenting here in the series as it progresses, in this case, the Search head allows users to search the indexed data. Distributes user search requests to the indexers, and helps consolidate the results based on Field Value Pairs. There is a multitude of different commands and functions that can be used to extract data or put it in a format that can be understood easily.

Splunk Series: Feeding Data to Splunk

Mon, 06 Apr 2020 00:00:00 +0000

Splunk Index Time Process

Data ingestion for Splunk is broken down into 3 different phases

Input Phase - Data is handled at the source and is usually done by a forwarder
Parsing Phase - Handled by the indexer or Heavy Forwarders, the data is broken into events
Indexing Phase - The license meter runs as data is been written to disk, this happens before the compression of the data. After this process runs the data cannot be changed

Splunk Series: Field searches

Mon, 06 Apr 2020 00:00:00 +0000

Fields are searchable key/value pairs in your event data Fields can be searched by their name, for example:

area_code=404 action=purchase status=200

When you look for multiple items in the editor an implied AND will be implied unless specified otherwise (AND, OR, NOT) to the search as follows

action=purchase AND status=200

Field Discovery

Splunk automatically discovers many fields based on the sourcetype and key/value pairs in the data

Prior to the search as explained before, some fields are stored with the event in the index

Splunk Series: Overview of Splunk

Mon, 06 Apr 2020 00:00:00 +0000

What is Splunk

Splunk is many things to different groups in an organization, but mostly is an engine that looks you to visualize data in a way that could be understood by the business, what are few of the things that Splunk can help with:

Application Management
Operations Management
Security and Compliance

Splunk allows you to aggregate, analyze and get answers from your machine data

What Data can Splunk work with?

There are multiple sources of data that can be fed into any Splunk installation, few examples are:

Splunk Series: Saving Search Jobs

Mon, 06 Apr 2020 00:00:00 +0000

Every search is also a job, which can be paused, stopped, saved and exported.

Here are some interesting things you need to know about Search jobs:

Jobs are available for 10 Minutes (By Default)

Jobs can have the following permissions as part of the configuration when they are saved

Private - Only the creator can access them
Everyone - All app users can see the report
Lifetime - The default is 10 Minutes - Can be extended to live for 7 days, in order to keep your searches for longer you have to schedule a report

Splunk Series: Search Language Syntax

Mon, 06 Apr 2020 00:00:00 +0000

How is the syntax used in the Search editor

To better explain the syntax of a search is by using the following diagram

The components of the Search

Search Terms –> What you are looking for
Commands –> What do you want to do with the results, chart, statistics, format and so on
Functions –> How do you want to chart, compute or evaluate your result, for example, get a sum, get an average or transform the values, amongs many other functions

Splunk Series: Splunk Deployments

Mon, 06 Apr 2020 00:00:00 +0000

Addition Splunk Components

There are additional components for a Splunk deployment, here is a list

Deployment Server
Cluster Master
License Master

Standalone Deployment

This deployment is only in 1 server, and all functions needed for this deployment reside on the same server

Searching
Indexing
Parsing
Input

It is recommended to have 1 test or dev set up at your site

A basic Splunk deployment

This setup includes the Splunk Server which will be handling the same functions as a Standalone deployment, however, in this case, all the input is ingested from the Forwarders

Palo Alto Networks - PCNSE Certification - Part 2 - Building a Lab (Where to get Started)

Tue, 07 Jan 2020 00:00:00 +0000

As with any certification that I attempt I go into it with a mindset of learning by reading, watching videos and doing… Being doing the strongest one in my list of things to do. I want to make sure all the things that I have seen listed in the PCNSE Study Guide I can do, with the exception of the High Availability piece, which I will have. Bait of a hard time using since I only have access to 1 VM.

Palo Alto Networks - PCNSE Certification - Part 1 - Breaking down the Exam Objectives

Mon, 06 Jan 2020 00:00:00 +0000

As the new year hits, I have new resolutions, and these entail getting my feet wet with Palo Alto Networks, due to my job and many other factors I’m open to learning and get certified on the PCNSE, which stands for Palo Alto Networks Certified Network Security Engineer

The Certification Requirements

This exam contains 75 questions and over 80 minutes - The intended audience are engineers that currently work with Next-generation firewalls and would like to take their knowledge to the next level. They recommend having 3 to 5 years of experience

VIDEO: SD-WAN from Cisco Viptela (SD-WAN Series (Lab 1 - ZTP: P4.3)

Tue, 10 Dec 2019 00:00:00 +0000

So it was not my intention to make this series as long as it is right now, but hey, its so far lots of fun.

This time I created a quick video of me playing around with vManage and using the Zero-Touch Provisioning feature

The Video

https://youtu.be/AohRDD7KUlY

What to look forward to?

We will play with the Policies, testing Multi-Topology and Strict Hub-n-Spoke

About the Author:

Andres Sarmiento, CCIE # 53520 (Collaboration) With more than 13 years of experience, Andres is specialized in the Unified Communications and Collaboration technologies. Consulted for several companies in South Florida, also Financial Institutions on behalf of Cisco Systems. Andres has been involved in high-profile implementations including Cisco technologies; such as Data Center, UC & Collaboration, Contact Center Express, Routing & Switching, Security and Hosted IPT Service provider infrastructures.

SD-WAN from Cisco Viptela (SD- WAN Series (Components and Technical Info: P4.1)

Tue, 03 Dec 2019 00:00:00 +0000

Hey all, as the schedule clears up a bit or at least I get the time to scape the routine, I wanted to get a bit time to continue the SD-WAN Series, I know I still have lots of HW to do on this one but here are “My Findings”

The background story on how Cisco entered the SD-WAN Market

Viptela, now known as Cisco SD-WAN is one of the acquisitions Cisco entered to finally get into the SD-WAN market with a product that finally makes sense, as you remember Cisco introduced a flavor of SD-WAN in the market few moons ago with the introduction of IWAN, which is still in production in lots of customer networks. If you are curious as how some of the pieces in IWAN work and to get the foundation make sure you read –> DMVPN Design

Upgrading ESXI from 6.5 to 6.7

Thu, 21 Nov 2019 00:00:00 +0000

I turned my lab back on!!, and guess what, it was a mess, I lost my vCenter server and well… I’ll stop complaining and jump back into the substance of this post.

Previous steps after losing the Host I had vCenter on

If this has happened to you either in production or in a lab environment, be sure it will not be nice, few of the things I had to deal with:

VMware SD-WAN from VeloCloud (SD- WAN Series: P3)

Wed, 18 Sep 2019 00:00:00 +0000

First of all big thank you to VMware Hands-On Labs resources, they are great and a very cool way to use for demonstrations and Learning

Lets talk about VMWare SD-WAN by VeloCloud, a company that was a acquired by the virtualization giant back in December 12, 2017 - The company was initially founded in 2012 and had a very successful run on their own and now operate as the SD-WAN arm of VMware.

SD-WAN Terminology (SD- WAN Series: P2)

Sat, 14 Sep 2019 00:00:00 +0000

SD-WAN is not a new concept that is becoming trendy right now, but is actually something that has been there for a while! (Remember the iWAN days?) - Also there will not be something new or exciting that you maybe have not seen before.

My idea is to keep analyzing the technology and off course have the ability to use it in a lab environment as well as in a Production environment.

SD-WAN Series - The Components (SD- WAN Series: P1)

Mon, 24 Jun 2019 00:00:00 +0000

Hi there, know it has been a while - to be exact my last post was back in August. A lot has happened since :) - However this post is not about me, but about me and what I have been up to maybe in a different post!

This time I’d like to give the spotlight to the buzz technology that has been out there for a while but with many different names. In my pursuit to understand everything I do and everything I think helps me build on my knowledge, I wanted to dissect few things on SD-WAN - So what better than to come up with a series.

Zero Downtime Upgrades - An upgrade approach to avoid late nights

Fri, 03 Aug 2018 00:00:00 +0000

Let’s see, it has been a while since the last time you heard from me, but this time I will spare you the excuse!

What is a Zero Downtime Upgrade?

This is an upgrade where no matter from which version of VOS (CUCM, UNITY, and UCCX) you are coming from can be done with very little or zero downtime

The Reasoning behind

Look I have always worked with companies that like their stuff done quickly, efficiently and with minimal downtime. I’m also very lazy, or very practical, so if I don’t have to spend all night doing an upgrade, I simply don’t do it. Now, like everything else, there are a lot of exceptions to the scenario I will be going over on this Post, so keep reading!

Consuming the "Cloud" - How are you doing it?

Fri, 30 Mar 2018 00:00:00 +0000

Before leaving my previous company there was an interesting trend in the market and industry I have worked for the past few years, and that is that multiple verticals out there are considering moving their traditional premises workloads to the cloud.

That is a beautiful thing, but from my standpoint as an Engineer/Architect, I’m thinking how I’m going to be able to get involved into it? - Smart conversations need to happen and well, I’m usually part of those conversations, or in the room when smart people talks about cloud :)

Cybersecurity - Want to be a Security Analyst? The List of things you need to understand

Wed, 28 Mar 2018 00:00:00 +0000

To better understand what are the domains that are part of CyberSecurity is better to identify them individually and make sure we all know what to expect to learn more and more about it.

Currently the Cybersecurity tracks, like Cisco’s, make emphasis on you preparing you to be a Security Analyst Level I - Remember that all the Associate certifications are the ones validates that you can be the first knowledgeable level of contact in the enterprise. In this case Cisco Cybersecurity Operations CCNA is not different.

Introduction to CyberSecEngineer Blog

Wed, 28 Mar 2018 00:00:00 +0000

I have recently started a class on CyberSecurity offered by Cisco, and have been hooked into the material and the things that this class offers.

If you know me, you will know that I have always been a hybrid engineer, I have done few things from Network, Security, Data Center and Collaboration. With the last one being what I specialize on and what I’d like to call the profession that pays my bills :)

The Job Description of a Security Analyst

Wed, 28 Mar 2018 00:00:00 +0000

Thinking on few things that can help people out there to begin or advance in a career in IT Security or Cybersecurity. I had to get some information about this from a Job description of what companies are looking for in candidates, just because, yeah Andres had to find out, and help the now growing audience of CyberSecEngineer

Disclaimer

I may not be the right person for specific career advise on Cyber Security, however, I will/should/could be able to provide a high-level overview of how things work from a career point of view, if you are interested in such thing, make sure you ask me using the comments section, and I will do my best to reply ** I hope the comments section work :)

Training on Cybersecurity and what is out there?

Wed, 28 Mar 2018 00:00:00 +0000

I looove free and fun stuff to do when I’m training, and I also like to pay for training when is good. With that in mind, this post will be a collection of the training that I have found or will find in the future, so that it can be listed on this site.

Remember, if you know of any training that you think is sooooo cool that needs to be mentioned or announced, please feel free to reach out in the comments post, I will happily add that information.

The Anatomy of a Call Recording Service - Cisco Unified Communications Manager

Fri, 09 Feb 2018 00:00:00 +0000

Call recording is an interesting topic for me and it’s sometimes hard to understand, but It’s easy when you break it down to get what it is all about.

My experience varies from different vendors and most of it comes to the same place, at least when preparing CUCM for Recording services. This post is just to go over what is involved form CUCM’s preparation and a bit of an explanation when possible :)

Implement NetFlow IOS-XE with NBAR Discovery

Tue, 23 Jan 2018 00:00:00 +0000

I’m pretty sure that there are many examples out there to create NetFlow configuration and very well documented as well, however, I wanted to give my config a crack and also wanted to share. I’m adding one more bit of information as it is very useful to keep your network on-check, and that is the NBAR addition.

Which Direction for NetFlow?

I have read somewhere, and I refuse to look for the document again, thinking it was from Lancope’s website, but I remember reading that NetFlow works better if applied in only one direction. Pretty sure that many people out there will have their opinions and reasons to do it in very different directions on the same interface, but after lots of thinking, it made sense to me.

CCNP Security 300-206 (SENSS) - The After Math of the Exam - Useful Links

Mon, 22 Jan 2018 00:00:00 +0000

I finished last year with an incomplete challenge and lots of things in my to-do list. This exam was one of them, so I ended up moving lots of my objectives to 2018

I presented this exam at the beginning of November-17 and failed with few or a lot of incorrect questions. It really took me by surprise some of the things that I thought I knew needed more re-enforcing on my end. It is also very important to understand that these exams are also created with technology in mind, and many of them get to be un-updated for a while, so I was also tested on things that are End of Life (which I think got the best of me)

Denial of Service Attack Prevention (IOS)

Mon, 22 Jan 2018 00:00:00 +0000

As part of the CCNP Security 300-206 (SENSS) - I have found interesting topics along the ways and this one catches my attention. So here is a quick high-level overview + some configuration examples on IP TCP Intercept

What TCP Intercept is looking to prevent?

This feature looks to prevent Denial of Service Attacks, by limiting incomplete connections to a host, in this case, a Web Server could be a good example.

CUCM - Moving CUCM Publisher - Change IP address

Thu, 28 Dec 2017 00:00:00 +0000

Where do we begin with this one? - Here is your ticket and before you go to the next section of this post, make sure you have a quick answer.

The Ticket/Challenge **Trying not to call it a problem!

Your client needs to move from a Datacenter to a new location. You need to move the CUCM Publisher and be able to do it also by changing the IP address, with minimum service impact as possible

CUCM - Unable to add SFTP Backup Device - Some Linux stuff

Wed, 27 Dec 2017 00:00:00 +0000

Few weeks have gone by and I have not written anything for a while **But I still have lots of Drafts in the works. Job has been a bit busy this time of the year so that’s my excuse and I will stick to it :)

If you are a UC and Collaboration engineer, you may have under your sleeve few cool solutions to backup your Apps. Well, I have a few too, and I used to crash a lot with the FREE SolarWinds app. But for some reason, this app sometimes fails.

MacOS High Sierra Vulnerability - It's true!

Tue, 28 Nov 2017 00:00:00 +0000

A quick and short post just to advice MAC users to change their root Password as soon as possible

The issue

A quick excerpt of the newly discovered vulnerability - Credit KrebsonSecurity - MacOS High Sierra Users: Change Root Password Now

A newly-discovered flaw in macOS High Sierra — Apple’s latest iteration of its operating system — allows anyone with local (and, apparently in some cases, remote) access to the machine to log in as the all-powerful “root” user without supplying a password. Fortunately, there is a simple fix for this until Apple patches this inexplicable bug: Change the root account’s password now

Overview of Cisco Prime Infrastructure 3.1.0

Wed, 15 Nov 2017 00:00:00 +0000

Ok, I’m going to give this one a try, and hope all readers help me keep myself honest on this one. Initially, the title of this Post was based on CCNP Security and Cisco Prime Infrastructure Security Use Cases.

So I have been looking for some Security use cases with Cisco Prime Infrastructure, and I think I found some based on correlation and other important things the tool has to offer.

Bundle T1's for MPLS and Internet Connectivity MFR Interface Configuration Example

Tue, 14 Nov 2017 00:00:00 +0000

Picture this, you have been given a provisional WAN circuit using a T1, or multiple, in this particular use case; The provider is connecting you to its MPLS network, which provides you with an MPLS WAN address, an Internet WAN address.

This is simple for many out there, but it was not for me until not too long ago. I realize that in all of my turn ups I have been given an ethernet Hand off, and from there is just making a “Routing on a Stick” configuration and I will be calling it a day.

VIDEO: CCNP Security 300-206 (SENSS) - Installing Cisco ACS on VMWware

Thu, 09 Nov 2017 00:00:00 +0000

A quick video on how to install Cisco ACS Version 5.8

Here are the VM Requirements:

Minimum Requirements

CPU 2 CPUs (dual CPU, Xeon, Core2 Duo or 2 single CPUs) 2 GHz CPU speed

Memory 4 GB RAM

Hard Disk A minimum of 60 GB is required.

Maximum storage is up to 750 GB. Note: ACS partitions the available disk space automatically during the installation process.

Note: It is recommended that you allocate the hard disk size to be greater than 500 GB for the secondary instance, which acts as a log collector.

VIDEO: CCNP Security 300-206 (SENSS) - Building a quick Virtual Lab

Wed, 08 Nov 2017 00:00:00 +0000

To all visual learners, like me, and to the ones that need to do the stuff in order to learn. Also for the love of virtualization, I thought it will be a good idea to include videos and demonstrations on how things could be done.

The Video

https://youtu.be/XSsrW1gFx3A

The Content

This is just going over the installation of an ASAv and a CSR1000v

What will be next?

There will be some more content on the installation of ACS, hopefully, sooner than later

A quick overview of Cisco Security Manager

Tue, 07 Nov 2017 00:00:00 +0000

Looking at the Objectives and the Exam topics, I found something that I was not entirely familiar and decided to take a look at it. At this point, I’m not sure if Cisco Security Manager is still something that is worth taking a look at or a product that is widely used by Security professionals in the field.

I asked around with a few colleagues and all of them agreed that CSM was already faced out by other tools, like Cisco Firepower Management Console and even other third-party integrations out there.

CCNP Security 300-206 (SENSS) - My Lab Infrastructure

Thu, 02 Nov 2017 00:00:00 +0000

So like anything else, is just very hard for me to begin something without first coming up with a plan, so I decided to treat this as a project, with planning and designing included into it.

The main constraint you may ask if any? Time, so time is valuable and the day of my first exam approaches very quickly, I have been doing lots of studying so far and also labs here and there, also I’m very familiar with the topics on SENSS, so hopefully, I can knock it down with no problems. But this time is different, I want to share all the ride with the people that read this blog.

CCNP Security 300-206 (SENSS) - Introductory Post

Tue, 31 Oct 2017 00:00:00 +0000

If you have read this blog before you will notice that I have lots of stuff going on some good and some meh!, from Collaboration, Security, Enterprise Networks and some other stuff non-related to Cisco, which I recommend you checking out in case you are interested. Initially, I started sharing my Journey to the CCIE Collaboration back in 2014. I completed my adventure last year (2016), and I’m very happy to say that I fully enjoyed the ride. Now I would like to focus most of my posts on Security and on my ride on completing my CCNP Security following it up with the CCIE Security by the beginning of next year (hope it works). UC and Collaboration will still be playing a HUGE roll into my writing as I find it very fun! and I still have LOTS of pending posts and Videos

CUCM Management affected CUCM 11.5(1) - Case Sensitivity

Mon, 30 Oct 2017 00:00:00 +0000

In case you are hit with this bug the solution is very simple, but asks the question, is it really necessary creating the UserID in AD with a combination of UPPER CASE and lower case?

Here is the Scenario

CUCM implementation of 11.5(1) with AD/LDAP authentication, once users are synced with LDAP you proceed to assign Power Users under End User Administration. All is fine but such users have their user ID as follows: AD UserID: WUser

Importing hosts into SecureCRT

Mon, 25 Sep 2017 00:00:00 +0000

I have always tried to use something like this in the past, but with no luck, by digging a bit deeper into it I found how to import hosts into SecureCRT.

This is the Link that goes over the process of importing data and what is relevant for the import:

https://www.vandyke.com/support/tips/importsessions.html

For Python or VBS here are the scripts:

https://forums.vandyke.com/showthread.php?p=37089#post37089

Here a quick sample of the data and how needs to go, I used the Python script, I decided not to use the .csv format, instead, I used .txt to save my data

Documentation - Playing with SecureCRT - Log to File and Simple Automation Python Script

Mon, 24 Jul 2017 00:00:00 +0000

Being clear from the beginning of the post here are some disclaimers I have:

I’m not an expert, I just like messing around with stuff that saves me time
The automation piece is a simple script in Python that is created from SecureCRT automatically

Now, as I document my projects, I have to find a way to provide my clients with meaningful information on what was what I did in their environment. I know engineers out there that hate documentation… me too, but when I do Documentation I just think like my client will think

Cisco Systems - The Security Portfolio

Tue, 11 Jul 2017 00:00:00 +0000

Looking to get a better picture of the Security Portfolio from Cisco I thought it will be a good idea to have a document handy. I know that this list may be obsolete at some point but will help illustrate what I’m trying to achieve today :)

It is a reality that Security is right now the main focus of any company out there, if not and you are asking yourself why? then you should be worried.

CLUS17: Security Monitoring with StealthWatch - A quick Overview and Thoughts

Mon, 10 Jul 2017 00:00:00 +0000

My Cisco live experience was focused on 80% Security and 20% Collaboration. One of the sessions I assisted last week was the one related to StealthWatch and Security Monitoring, an interesting new topic for me and one that opens my brain for more questions.

The Security portfolio from Cisco is still huge for me, but I remember saying that when I was starting on my CCIE Collaboration journey a few years back. Remember the Before During and After Attack continuum from Cisco? - Yes, I remember and made my mission to know how all the pieces fit together.

CLUS17: Cisco Spark all over CLUS - All Breakout Sessions need a Space, so all Sessions had a Space :)

Fri, 07 Jul 2017 00:00:00 +0000

This is going to be my Feedback on the Breakout sessions, as expected Cisco was ready for the challenge and the questions.

I really don’t know if CLUS had the ability for you to join a Spark room simultaneously to the session, at least not in my previous CLUS over in 2014, when I guess it was called Project Squared. My experience was really good with this new feature and helped very much to be engaged in the conversation.

CLUS17: Contact Center Reporting : Cisco Unified Intelligence Center

Thu, 06 Jul 2017 00:00:00 +0000

I’m making contact back from Cisco Live with many interesting things to show and tell, so I decided I would write small pieces of the information I digested from the conference.

I will start it off by mentioning where to locate the presentation that was used for this session, to follow along with all the things that I will be covering. Eventually all videos on the session will be uploaded to the ciscolive.com on Demand Library

DMVPN Design using FrontDoor VRF

Wed, 21 Jun 2017 00:00:00 +0000

This posts looks more to analyze few design questions and good information on how to complete a successful DMVPN implementation, other than a focus on the configuration. And last but not least, to start a conversation and hear more about what would you do in cases like this (There are many ways to skin a cat!!)

A short background on what got me to this:

I have been most of my Professional career focused on UC and Collaboration technologies until not too long ago that I decided that I wanted to get involved with Security and Networks again. At this point my focus is to be able to maintain a good deal of knowledge on the technologies that cover all Cisco Security suite, but UC is still a great part on what I do daily at my current position.

UCCX 11.5 Tomcat and Tomcat-ECDSA certificates for Cisco Finesse CUIC and the Admin Pages

Thu, 20 Apr 2017 00:00:00 +0000

I keep hearing about many engineers out there with issues related to the UCCX certificates and the ECDSA certificate used by few services on UCCX. I wanted to create this quick post to help others and Document the procedure.

The certificates Overview

I will go back a bit to give you a quick overview on the UCCX certificates, but not too far back. UCCX uses Self-Signed certificates out of the box for Secure connectivity using your browser (Nothing new here) - However, since UCCX 11.5 there is a new Tomcat Certificate called Elliptic Curve Digital Signature Algorithm, ECDSA for short. If you want to find out more about these type of certificates feel free to visit (https://www.maximintegrated.com/en/app-notes/index.mvp/id/5767)

UCCX Labs - Compilation of Videos and Posts for getting Familiar with UCCX

Wed, 19 Apr 2017 00:00:00 +0000

As you have been seeing over the last couple of months, I have been actively creating videos and posts about UCCX in General. So I wanted to create a new Post which will mark the first milestone of the series of UCCX Labs.

Video Collection:

The following list compiles all the videos that I have created, using my approach to create a Successful Contact Center deployment.

Integrating CUCM and UCCX

Video - UCCX Labs - Upgrade from 10.6 to 11.5

Tue, 18 Apr 2017 00:00:00 +0000

A quick video on how to upgrade from version 10.6 to 11.5 - also some good information on the process.

The Video

The Content

On this video I go over the Upgrade from UCCX 10.6 to 11.5

What to look Forward to?

I have created these videos to help others on how to get familiar with UCCX. I will continue creating more videos as I’m going, I hope you enjoy them!

Video - UCCX 10.6 Labs - Working with a script, creating the auto attendant and looking at the logic of the script

Wed, 12 Apr 2017 00:00:00 +0000

This video goes over working with the UCCX Script editor and the Steps

The Video

The Content

Looking at the Script Logic, how to use Labels, GoTo’s, Menus and a bit more

What to look Forward to?

Expect more videos coming in the next days

About the Author:

Video - UCCX 10.6 Labs - Looking at Resources, creating the first queuing script, testing basic queuing

Tue, 11 Apr 2017 00:00:00 +0000

This video looks at resources to get more information on how to use UCCX and the Scripts configuration. Also goes over the configuration of a queuing script using the stock ICD script

The Video

The Content

DevNet Resources Script Repository Modifying the ICD Script

What to look forward to?

About the Author:

Video - Setting up a CIsco Collaboration Lab - SIP Trunk from UC520 to CUCM 11.5

Mon, 10 Apr 2017 00:00:00 +0000

Quick video warming up, ready to finish the UCCX series video on 10.6 - so I needed a way to test calling from my home phone to my lab

The Video

The Content

Just basic troubleshooting of a call from UC520 to CUCM using SIP protocol

What to look forward to?

Not much really on this one, just getting ready to additional videos and testing - enjoy!

About the Author:

UCCX 11.5 Hostname must be in lower case and the character limit is 24 characters

Thu, 06 Apr 2017 00:00:00 +0000

Yesterday I got bitten by this one… It really has been my first encounter with this issue. In all honesty I did not know this was a thing until yesterday. So I hope that you can use this to your advantage and on the planning of a successful UCCX Deployment.

The Issue

Replication was not working properly after adding the secondary node. As stated in the Administration Guide “Hostname must be in lower case and the character limit is 24 characters.”

No voice-port when using NIM-1CE1T1-PRI - From Cisco Support community

Wed, 05 Apr 2017 00:00:00 +0000

I love the Cisco Support community, and credit should be given to all the people out there that work very hard on UC and Collaboration.

Last night I was trying to turn up a PRI (Yeah, old technology right?) - So a client is terminating a PRI back to back with their equipment and on my CUBE router (ISR4331) I’m terminating the PRI and sending the calls to IPFLEX, sound like fun!

Fix for the Apache Struts2 Vulnerability on UCCX (CSCvd63322) - Posted to CCO

Tue, 04 Apr 2017 00:00:00 +0000

I rarely post twice in the same day and most if it is scheduled from days before, however, I thought this one was important. Cisco just released the following fix that looks to address/patch this vulnerability.

Here is the CCO Link to download and install the patch on your new and upgraded UCCX 11.5 servers

Here is the link to (http://www.cisco.com/web/software/280840578/134989/ReadMe-UCCX-11.5-struts2-fix.pdf) (Not really much information on what the whole thing, but just the installation instructions)

UCCX - Contact Center Express Implementation and Configuration Flow

Tue, 04 Apr 2017 00:00:00 +0000

As a way to complete my very long post from last week, I decided that I needed a nice and easy way to keep myself in check when configuring and installing UCCX, so I decided to create the flow you see in the picture above. All to help me and others

The Content

The idea of this quick diagram is to guide you/me through a successful installation of a Cisco Contact Center Express.

Planning a successful Contact Center implementation using Cisco UCCX

Fri, 31 Mar 2017 00:00:00 +0000

9-12-2019 Edit –> Added the Excel Spreadsheet on Planning a successful Contact Center implementation using Cisco UCCX.xslx

As you may know, I’m very much into contact center stuff, and I have been creating different videos, but I really got worried because there are so many things to show and do on UCCX, and I did not have a road-map or a document to use to base my configurations on.

I decided that I needed a Design and a Planning session with myself and created this document.

Because not all Contact centers are the same - First look at Amazon Connect and how easy it is to use

Thu, 30 Mar 2017 00:00:00 +0000

Unified Communications and Collaboration is being getting so much speed in the last few months. There are many great and incredible additions from many big vendors out there, such as Cisco, Google, Microsoft and now Amazon is also playing on this space (I think it has been for a while).

Amazon came up with another scary easy to use solution, this time for contact centers. the product is called Amazon Connect - I heard about the product yesterday from a co-worker that was at #EC17 and I heard it was really easy to use, so I could not resist and had to take a look at it.

Cisco Identity Services Engine 2.2 (ISE) New feature-set

Wed, 29 Mar 2017 00:00:00 +0000

There is a constant evolution of security technologies and also Security threats, which makes the need for additional and enhanced visibility of the network. Cisco keeps on improving its Security portfolio, and this time I’m looking more closely at the Cisco Identity Services Engine. At a first glance, to me it looked like just an 802.1x solution with very complicated features.

I decided that I wanted to get more involved, and I have been working with the product for the last month in a more serious note this time, trying to understand the product I decided to make a list with important Features that are packed into the solution

Invalid Server Certificate - activating Spark Phone with Meraki Infrastructure WBX000023772

Tue, 28 Mar 2017 00:00:00 +0000

This will be a quick post, with a quick issue and the solution.

The issue

Some new phones needed to be activated along with a full network infrastructure deployment using Meraki gear. Meraki in my eyes was scary easy to set up, also thankfully it was already set-up for me on the cloud by a co-worker in advance.

When it was time to activate the new Spark phones, I was receiving a weird “Invalid Certificate” message that I’d never seen before. basically when receiving these type of errors, few things could be happening:

Cisco and the Always Evolving Security Portfolio of Solutions - Fire Jumper

Mon, 27 Mar 2017 00:00:00 +0000

Last week I had the pleasure to attend a Fire Jumper Achievement classes, and it was a great eye opener for me. Security products have changed and evolved tremendously over the past few years, this evolution is due to the constant changing Attack vectors users and companies experience out there in the wild.

The Attack Continuum

Cisco has a good strategy to address Security threats into different phases that could be possible in an attack. Understanding that there is not one “Perfect Solution” is part of the play. They do a great job to explain the different aspects of a security attack by breaking it down into 3 phases: Before, During and After. I also think that Cisco understands that there are very advanced and sophisticated attacks, which can bypass IPS systems, Firewall Rules and other security measures you may have at the edge, along with the security that you can deploy at the core of your infrastructure, on services such as DNS, Web and Email traffic among others.

Video - UCCX 10.6 Labs - Understanding the CCX Editor, Validating a Script, Using the Reactive Script for Debugging

Fri, 24 Mar 2017 00:00:00 +0000

The Video

Quick video on few interesting things about UCCX 10.6

https://youtu.be/gYhkNNhVVSI

The Content

This video is about understanding tools available in UCCX

CCX Editor
CCX Editor Functions and Steps
Validating a UCCX Script
Using the Reactive Script for Debugging

What to look forward to?

As we get ready to implement a full solution, there will coming videos to cover the creation of UCCX applications and how they can be integrated into Production

Video - UCCX 10.6 Labs - rmcm user, jtapi user, skills, resource groups, contact service queues, resources, teams

Thu, 23 Mar 2017 00:00:00 +0000

The Video

Continuation video from the UCCX Labs series. Going over some more preparation in CUCM and UCCX

https://youtu.be/204pr0orvyA

The Content

This is a video that shows the building blocks of a typical UCCX Configuration

Using the RMCM User
What is the JTAPI user needed for
Creating Skills
Creating Resource Groups
Creating Contact Service Groups
Creating/Adding Resources from CUCM to UCCX
Creating Teams

What to Look forward to?

After few weeks I continue the videos showing basic things, along with quick tricks that can be applied to any deployment or situation in real world.

Video - UCCX 10.6 SU2 Labs - CUCM Device Preparation - CTI Ports - CTI Route Points - Auto Attendant

Wed, 22 Mar 2017 00:00:00 +0000

A quick video showing considerations and things to do to successfully configure and make UCCX work properly

The Video

https://youtu.be/7hthzA30s5A

The content

The video goes over:

Description of what we are doing
Creating Users
Creating CTI Ports or Port Control Groups
Creating a Trigger or CTI Route Point
Creating a UCCX Application and assigning a Script
Testing the UCCX Auto Attendant

What to look forward to?

I hope you enjoy looking at the videos, in case you have questions or doubts, please feel free to contact me

A Collaboration Cloud Lab vs a Collaboration Home Lab

Tue, 28 Feb 2017 00:00:00 +0000

So, the question is, what is a better choice to get started with a Lab, and begin creating your own configurations? - Here is a list of the benefits from a Cloud Vs Home Lab

The difference between a Cloud lab and a Home lab

Cloud Lab (dCLoud and DevNet)

If you are one of those weird people that don’t want to run CUCM, UNITY Connection, IM & Presence, Jabber and other UC apps in your house, you are in luck. Cisco dCloud + Devnet Sandboxes are what you are in the business for.

CCIE Certifications Changing to Agile and Modular Revision Cycles

Fri, 24 Feb 2017 00:00:00 +0000

A nice email with this information may have gotten to your Mailbox today. The email opens up a new methodology called agile, wich will be used going forward.

What do these changes mean?

For what I read so far and what I have been able to research, means that there will be minor revisions every year, these revisions will bring at least 20% of changes with what you are being asked in the test. Also, there will be major changes to blueprints and actual exams every 3 to 5 years, such changes should reflect between a 50% to an 80%

Video: Setting up a Collaboration Lab - Integrating CUCM and UCCX

Thu, 16 Feb 2017 00:00:00 +0000

Video detailing the basic steps to integrate CUCM and Contact Center Express

The Video

https://www.youtube.com/watch?v=7qtY2g1HZrE

The Content

Get the configuration started
JTAPI/CTI Users
Getting an Admin User

What to look forward to?

I’m having too much fun with these videos and I think I will keep on doing them, of course, as time permits

About the Author:

Video: Setting up a Collaboration Lab - Licensing CUCM and UNITY

Wed, 15 Feb 2017 00:00:00 +0000

Video is about how to License CUCM and UNITY Connection (Using NFR Licenses), same applies for regular licenses

The Video

https://www.youtube.com/watch?v=337Wg1aZMRg

The Content

Go to Cisco Licensing
Generate License from PAK
Add CUCM and UNITY to Prime Licensing Manager
Generate Licensing Request
Install Licensing File
Verify Licensing

What to look forward to

The videos are a cool way for me to keep things interesting and provide help for people that have questions.

Video: Setting up a Collaboration Lab - Installing Trusted Certificates

Tue, 14 Feb 2017 00:00:00 +0000

This is a quick video on how to install Trusted Certificates to any of your UC and Collaboration servers

The Video

https://www.youtube.com/watch?v=6UW1dEltNYw

The Content

Using Windows CA Role to generate Certificates
Generate the CSR
Upload ROOT CA Certificate as “tomcat-trust”
Upload Signed Certificate as “tomcat”

What to look forward to?

As time permits I will keep creating the videos and continue with the labs

About the Author:

Video: Setting up a Cisco Collaboration Lab - Installing CUCM

Wed, 01 Feb 2017 00:00:00 +0000

The continuation from Yesterday is here, not too much. I’m trying to make them shorter so that they can be easily watched.

The Video

The Content

Requirements for CUCM 11.5 (SU2)
Setup DNS Records
Setup NTP Server
Test Connectivity before installation (Connectivity tricks)

What to look forward to?

As time permits I will keep creating the videos and continue with the labs

About the Author:

Video: Setting up a Cisco Collaboration Lab - Preparation

Tue, 31 Jan 2017 00:00:00 +0000

This is going to be the first of few videos that I’m creating on how to set up a Cisco Collaboration Lab.

This is just to get a baseline ready for starting configuring CUCM and other UC applications but today is just CUCM Preparation. I prefer looking at the video in Speed x1.39 - I noticed I’m a slow talker :) hope you enjoy the video.

The Video

The Content

I describe in a very high level how I’m running my lab

Rebuilding CUCM from an Export - Common issues and solutions

Mon, 30 Jan 2017 00:00:00 +0000

Here is something that I should have posted few weeks ago, but I have been very busy lately, a sign that the New year took off very strong.

The Scenario

Sometimes your CUCM server is out of any hope, full of bugs and issues after issues, yes I’m talking about CUCM version 11.0 - .0 versions are really hard on Delivery Engineers, because the solution is not as stable as Cisco says it is.

Adventures with OpenStack - Learning what's inside

Tue, 13 Dec 2016 00:00:00 +0000

When I heard about OpenStack for the first time I was very confused, so I want to share in my own words (Hope I don’t confuse you more), what is the deal with OpenStack.

OpenStack maybe so many things for different people, but I decided to unveil the doubt and take it for a spin in my lab. I’m still learning and as I have said before, is just baby steps, and I still have not seen the tip of the iceberg, there is still too much to learn.

Tropo Series: Creating a Voicemail Application with Tropo - That simple really?

Mon, 21 Nov 2016 00:00:00 +0000

I’m a bit surprised and impressed on the capabilities of Tropo, and this small post will show you why.

Here is a quick and short tutorial on how to create a Voicemail application at the Tropo site

The Code [PYTHON]

Here is the sample code in Python, I believe this one is more readable for me… JavaScript is the next best option

record(“Please leave your message at the beep. Press pound when finished to listen to your recording.”, { “beep”:true, “timeout”:10, “silenceTimeout”:7, “maxTime”:60, “terminator”:"#", “recordURI”:“http://www.example.com/recording.py", “transcriptionOutURI”:“mailto:you@example.com”, “onRecord”: lambda event : say(“You said " + event.recordURI) })

Tropo Series: Good resources to keep around when playing with the Tropo Scripting API

Fri, 18 Nov 2016 00:00:00 +0000

If you are experiencing and learning how to play with Tropo, make sure you check all these tools, it really make sense and are very easy to use.

Speaking Languages

In case you are in need to get a full list of Spoken Languages and different styles, make sure you look the page

Speaking Multiple Languages

** I have to admit, in my native language it sounds very good, I bet that the others is just great

Tropo Series: Ready to get Started with Tropo?

Thu, 17 Nov 2016 00:00:00 +0000

In case you are interested in getting your hands dirty with Tropo, here is some handy information

What is Tropo?

Tropo is a company that Cisco aquired not too long ago, but to be short and sweet, Tropo is a “cloud API platform that simplifies the addition of real-time communications and collaboration capabilities within applications” from Wikipedia

What is possible with Tropo?

I’m a UC and Collaboration guy, and the first time I heard of Tropo so many ideas came to my mind.

Auto Registration CUCM 11.5 (Video)

Wed, 16 Nov 2016 00:00:00 +0000

This is a video I created, showing how auto registration works in CUCM 11.5

Not too much really, but I think I will get better as I start working more in my editing skills and being a bit less nervous

Enjoy

About the Author:

Changing the hostname of Unity Connection - why would you?

Mon, 14 Nov 2016 00:00:00 +0000

In case you were wondering, if there was a way to change the name of a Unity Connection server… of course there is a way… Now, the question is, would you do it?

So in this case I will go with the Cisco Prime Collaboration Deployment to even think about tackling this one. Seems that there is a function that will assist you on doing that. I guess I will definitely take a look at that and share my experience with you in the near future, as I keep advancing on creating more content that is keeping me distracted, but hang in there, cools stuff is coming soon :)

Configuring a Cisco IOS Router to act as a DNS Server

Fri, 04 Nov 2016 00:00:00 +0000

Have you ever had the need to have a quick DNS server at hand? - This is very useful when configuring UCCX 9.x and above in a lab environment with no DNS Server.

At this point I’m not really sure if this DNS configuration will support more advanced configurations, like SRV records or anything of that nature, but I guess is a good start to begin testing it and see if there is more to it.

Creating "Zaps" with Cisco Spark and Zapier

Wed, 26 Oct 2016 00:00:00 +0000

Since we ran out of space in our last post (I think it was too long!), I have created this one, to expand a bit more on the Integrations. There are many ways to integrate Spark into our software and things that we do that I wanted to dedicate this Post to something useful.

In this post we are going to create a Form from Wufoo, and when the form is filled out, you will be invited to join my Collaboration Room in Spark. Lets Give it a try!

Want to know how to start using Spark? it's FREE and useful - lets meet in Spark

Tue, 25 Oct 2016 00:00:00 +0000

Cisco spark is a great and useful cloud collaboration tool that integrates Messaging, Calling and Meeting features very nicely. Shortly in this post I will be sharing interesting features that I think you can begin leveraging at work. I will also show a sneak peak of things that you can start using right of the box.

How do I get started with Cisco Spark?

The first thing you are going to do is register with Cisco Spark, its FREE, follow this link Cisco Spark

Lab for Cisco APIC-EM and my feedback

Mon, 24 Oct 2016 00:00:00 +0000

I’m sure that by now there is lots of people already working and playing on the Cisco APIC-EM. I finally had the opportunity this week to attend to a Cisco APIC-EM hands on lab. Let me begin by telling you that I was very impressed with the quality and the functionality of the software.

The general idea from APIC-EM is to provide provisioning, inventory and networking path tracing among others… I think this description is short and loose from what the application itself can accomplish.

Directory lookup not working - Unified Attendant Console Standard V11.0.2.

Fri, 21 Oct 2016 00:00:00 +0000

In some cases when you complete the installation of the Attendant Console Standard, you may notice that the Directory lookup is not working. You may ask yourself, what could be the issue.

The issue

Plain and simple, the Attendant console is not able to return any information from the Directory

The Solution

At the installation stage you will be asked to provide the IP address of the CUCM server and the User name and password of the Console User:

Fix for Unified Attendant Console Standard V11.0.2.2571 - CSCva24885

Fri, 21 Oct 2016 00:00:00 +0000

As you may know with he release of CUCM 11.5 there were lots of issues with the Attendant Console applications, one of the related to a bug defect CSCva24885. September 16 there was a new update and instructions on how to install the attendant Console with CUCM 11.x

This post looks at 2 different levels of issues, the actual technical issue and discrepancies on Documentation for the solution. Also the post is looking to point out the solutions that are provided, in hopes that you can finally solve the issues you are currently having with your install

Introduction to Projects from Collaboration Engineer

Tue, 18 Oct 2016 00:00:00 +0000

I’m very excited to announce that the Collaboration Engineer site is evolving into a solution repository for Engineers, I started this project as a way for me to document my studies and achieve my CCIE in Collaboration. I completed my task few months ago, along the way I was introduced to exciting technologies and interesting things into the Cisco Collaboration arena, and I now feel that I want to share all things have come across, and introduce it to whomever will make use of the information I will be blogging about.

TED Talk 10-Pack: Security Lectures

Mon, 15 Aug 2016 00:00:00 +0000

Following up on my (http://collabengineer.com/2016/06/15/cisco-puts-10-million-cisco-for-cisco-cyber-security-scholarships/) and my sudden interest into Security I wanted to share the following information in case you did not receive it.

If you signed up for the Scholarship program Cisco started couple of months back you should have received the following link.

TED Talk 10-Pack

Here is a breakdown of the videos:

Andres Sarmiento CCIE # 53520 - 4th Time was the charm - CCIE Collaboration, Passing the Lab and recommendations!

Wed, 20 Jul 2016 00:00:00 +0000

Passing the CCIE Collaboration Lab was really hard and a very nice and entertaining experience, which I feel very happy to say that I completed the challenge!!

I will be very short on this post and will make it technical and a bit emotional for the people out there that may benefit from it at all

How many times is enough?

Well I started this year thinking that it was going to take as many times as it needed to take… Financially this could be brutal and indeed it is. But the reality is that you need to make everything possible to make it happen. Just make sure you will get it, no matter what! and put every effort possible to achieve the goal.

{uccx scripting tips & tricks: generating prompts}

Mon, 11 Jul 2016 00:00:00 +0000

adding this one to my toolbox! - Thank You Sam!

Cisco puts $10 Million Cisco for Cisco Cyber Security Scholarships

Wed, 15 Jun 2016 00:00:00 +0000

I read this one the other day and posted it in my Facebook account. But I really wanted to dig deep into it and learn more about it.

Here are some highlights from Cisco’s latest publication on this one and on their Security program.

New Certification CCNA Cyber Ops

Cisco introduces its new CCNA Cyber Security Ops certification, more information in the following link: http://www.cisco.com/c/en/us/training-events/training-certifications/certifications/associate/ccna-cyber-ops.html

A deeper look into requirements and the blue print of the exam(s) can be found on the Cisco’s training website, but I wanted to save you time and list the exam topics and the % on each one of the topics:

CUCM 11.5 is here and with it, deprecated phones announcement

Wed, 15 Jun 2016 00:00:00 +0000

Looking for more information on this one, is always good idea to look at the field notices on CCO.

In a nutshell here is a list of the phones that will no longer be supported by CUCM on version 11.5

Problem Description

The following phone models are deprecated and are not supported by Cisco Unified Communications Manager Release 11.5(x). If you are using any of these phone models and you upgrade to release 11.5(x), you will be unable to use the phone after the upgrade. After you switch over to the new release, registration on the phone will be blocked.

Combining 2 ISO files into 1 - CUCM pre-8.x Installation

Thu, 05 May 2016 00:00:00 +0000

A quick one and hopefully you don’t get to see this moving forward.

Long time ago Cisco used to provide images on CCO that were divided in 2 parts, for upgrades and patches, I started working with those images since everybody started migrating from older versions to 9.x which is when I officially working as a consultant.

How to join or combine these 2 ISO image?

Windows:

coby /b UCSInstall_UCOS_6.1.3.1000-16.sgn.iso_part1of2+UCSInstall_UCOS_6.1.3.1000-16.sgn.iso_part2of2 UCSInstall_UCOS_6.1.3.1000-16.sgn.iso

How to install vSphere 5.5 client on a domain controller

Wed, 04 May 2016 00:00:00 +0000

Always give credit where credit is due. Looking for a simple solution I found the following article:

(http://www.josephturley.com/install-vsphere-5-5-client-domain-controller/) - Thank You Joseph Turley

But in summary and just in case you are one of the ones that just look for the solution and not the entire blog post, here is how you install the Vsphere client in a Domain Controller:

Make sure you run this command into your Command Prompt or Shell window:

ASA AnyConnect and SSL VPN for IP Phones with CUCM

Fri, 04 Mar 2016 00:00:00 +0000

This one may seem a bit like a very involved configuration but in reality is not. The process is easy, if you know how to set up AnyConnect in an ASA, you will be able to crack it.

I have also included few links that show the process and the important things that you need to consider, as well as licensing requirements

Useful Links: ASA Sample Configuration: (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/8_5_1/secugd/sec-851-cm/secuvpn.html#wp1054676)

Configure AnyConnect VPN IP Phones with Certificate Authentication on an ASA (http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/115785-anyconnect-vpn-00.html)

CUCM upgrade from 9.x to 11.x - Short post

Fri, 04 Mar 2016 00:00:00 +0000

Finishing an upgrade project after being a while since doing one, I wanted to take the time to share the experience and how easy has Cisco made it into upgrading their software.

It may look a bit disorganized, but you will find few things that I used to refresh my memory on the process, but I found that it was a surprisingly less painful than before. Now, one thing I like to mention is the fact that this is still a Refresh Upgrade because of the change on the REHL version of CUCM, but the Refresh Upgrade COP is not needed, note that the previous version is 9.x.

UCCX 10.6 Migration from Cisco Agent Desktop (CAD) to Finesse Desktop

Thu, 03 Mar 2016 00:00:00 +0000

Today I attended to the WebEx training UCCX, so this time I decided I was going to take note of all the things that I considered interesting on the training. This one is an interesting one to note because is a question that we may get asked very often. Also one more thing, CAD and Finesse can work in the same UCCX only if its running version 10.6SU1 this is called mixed mode. This post is also followed by a Q&A that was held by the Cisco team on WebEx and I added the ones I considered more relevant.

Check DNS records for Collab_Edge Expressway

Sun, 28 Feb 2016 00:00:00 +0000

This one is intended to look it up when you need, on the fly, also a quick google search will show you the light:

Check any SRV record:

On your DNS, click Start, and then click Run.
In the Open box, type cmd.
Type nslookup, and then press ENTER.
Type set type=all, and then press ENTER.
Type _ldap._tcp.dc._msdcs.

Check Collab_Edge SRV record:

nslookup -type=SRV _collab-edge._tls.example.com

dig _collab-edge._tls.example.com SRV

Example:

dig _collab-edge._tls.example.com SRV

NANPA and LocalCallingGuide - Best new friends?

Sun, 28 Feb 2016 00:00:00 +0000

Confused about dial plans in the US? - Here is the solution

These 2 sites will help you get the most out of any North America dial-plan based on Areacode

Lets begin with NANPA: https://www.nationalnanpa.com/

Going into Tools and Area Code Search you can get a lot information

Here is an example:

Pay close attention to the Dialing Plan for this NPA section. This will dictate the way you can make calls out locally and nationally. In case you are interested in FPA HNPA, NPA and NXX terms, here is a good link: https://en.wikipedia.org/wiki/North_American_Numbering_Plan

OpenSSL Create and Sign Certificate on MAC [El Capitan]

Sun, 28 Feb 2016 00:00:00 +0000

Since I started in IT and Networking, I have discovered that there are many things that result easier to do on a MAC, than any other OS. However we have to give credit where credit is due, Windows is doing a fantastic job with their new OS, but I still prefer MAC ;).

This post is dedicated to a paged referred from a colleague at my job on Cisco VCS Expressway configuration:

VCS Expressway Licensing - The allocation of the SKUs

Sun, 28 Feb 2016 00:00:00 +0000

In my effort to make sure I post things as do them, I want to make sure I leave this one here for anyone out there that may need a bit of help on understanding the obscure process of Licensing a VCS (Control and Expressway servers)

The good news is that Cisco Licensing is already providing all the Option Keys and Features keys in one message, which makes it easy to get licensing done in just one shot! - This requires you to open a case and most of the times they will do it right, but again we are humans and we make mistakes, that was my venting about my latest call to Cisco Licensing.

2nd Attempt -but not out of the Collaboration woods yet

Sun, 22 Nov 2015 00:00:00 +0000

Hi all,

Here is an update on my second and unsuccessful attempt. Things to think about and others to ignore.

This time the results were less effective and the score one to be ashamed of, however I learned few things of me and some “don’t try this at the lab” things that can be useful for many out there in the same path.

This the lab hit me with different questions and stuff from my previous attempt, which got the best of me and made me loose tremendous amount of time. I will do my best to summarize how everything went, off course without breaking my NDA. I hope you enjoy reading this post

CUBE LTI - Local Transcoding Interface No need for SCCP and/or CME Licenses)

Tue, 17 Nov 2015 00:00:00 +0000

Hi everyone, I think this post will be very useful for everyone, I have tried this on few production environments and requires some tweaking but nothing impossible, just make sure you are aware of how the call flows and how it interacts with other endpoints.

Previously the issues I have had with this configuration have been based on DTMF, oddly enough DTMF on International calls only. Fortunately the case was resolved by our provider in conjunction with few commands that are listed in this document.

QOS Values Calculator or better yet, cheat-sheeet!

Tue, 17 Nov 2015 00:00:00 +0000

I have been using this page for this particular and obscure subject for many out there.

I hope you enjoy it.

You can also find it in this blog:

http://www.netcontractor.pl/blog/?p=1161

Thank you NetContractor for putting this together.

About the Author:

Install CUCM 9.1 Boot error (Make any Cisco UC CD/DVD Bootable)

Sun, 08 Nov 2015 00:00:00 +0000

Because sometimes you just need a refresher - rebuilding my lab servers and was just forgetting the Generate Bootinfotables option. Thank you!

About the Author:

Auto Registration ATA 190 - Dual registration

Fri, 06 Nov 2015 00:00:00 +0000

I don’t mess around too much with ATA devices, and I think never configured one that supports 2 DNs/FXS ports. I was surprised that when configuring Auto-Registration and connecting the ATA 2 devices came up with 2 devices, I was unsure so I looked around to get more information on this one.

I used Auto Registration to save me some time.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cata/190/1_0/english/administration/guide/sip/ATA190/a190_ag2str.html

Here is the text from Cisco’s website on the ATA’s

Document from Cisco on FoIP CUBE Third Party Interoperability

Fri, 06 Nov 2015 00:00:00 +0000

Hi there, Here is the link to the CUBE Third-Party Interoperability Fax Guidelines - http://www.cisco.com/c/en/us/support/docs/voice/t38/116280-configure-cube-00.html I decided to copy the Source code of the page just not mess around with the contents and images which help on understanding the Fax protocols with Cisco CUBE.

Also this makes it a nice link to keep in your toolbox.

Introduction

Prerequisites

Requirements

Components Used

Background Information

CUBE Fax Call Flows

FoIP Transport Methods

Multicasting with GNS3 and Virtualbox

Wed, 26 Aug 2015 00:00:00 +0000

Really nice article… I’m actually working on a lab to do this… Multicast has become viral for all my customers!

About the Author:

CCIE Collaboration Lab Recommendations and Strategy [The aftermath of my first attempt]

Tue, 09 Dec 2014 00:00:00 +0000

While my experience on my first attempt was not the brightest one because I failed, I was able to open my mind and think on endless possibilities and maybe potential recommendations. I hope this helps other with their studies and strategies.

Studying and Muscle Memory: Do you studying… I think many instructors across the globe could not stress this one enough… but its right, going into the Lab with just few practice is not enough, muscle memory plays and interesting role on your experience. The need to know your IOS commands without Context Sensitive help is key (this one got me very bad).

Single Inbox Unity Connection 9.x Exchange 2013

Tue, 09 Dec 2014 00:00:00 +0000

We are UC/Collaboration guys and if you are like me, Exchange 2013 is not your expertise… but if you are handy with Exchange 2013 that is great, and maybe you can use the following post useful too.

Single Inbox Unity Connection 9.x Exchange 2013

Here are some useful links that I have found in order to get Single Inbox configured:

This is the main link:

(http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/9x/design/guide/9xcucdgx/9xcucdg032.html%23pgfId-1141552)

System Requirements:

(http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/9x/requirements/9xcucsysreqs.html)

High level and pretty much what you need to do in order to complete the configuration:

Cisco 9971 Factory Reset Admin Password Removal - [Timing is the answer]

Sat, 15 Nov 2014 00:00:00 +0000

I promise this will be a very short one. This week I purchased 3 9971 with the camera in order to get ready for my rack rentals for CCIE Collaboration, well when I got them I noticed that the phones belonged to someone else(Duhhh!!).

I needed to do a factory reset on those guys, or at least be able to remove the ITL files.

My problem was that I could not do any of these because the Admin Settings was locked by a password. Of course you can remove this password but if only if your phone is able to get the SEP config from your CME (off course if you are using CME) - TCLSH procedure here http://collabengineer.com/2014/11/15/cisco-sip-phones-admin-password-removal-cme-tclsh-operation/

Cisco SIP Phones Admin Password removal CME [TCLSH Operation]

Sat, 15 Nov 2014 00:00:00 +0000

On this one I wanted to share a really nice way to remove the Admin password from Cisco SIP phones.

It really is annoying to type the Admin password every time you need to modify or at least take a look at the configuration on your phone.

As you may know when you configure a SIP phone on CME you need to give it a username and password, also SIP is kind enough to publish the SEPXXXXX.cnf.xml file to Flash

Cisco AutoSecure Feature [Routers – Management Plane]

Thu, 13 Nov 2014 00:00:00 +0000

Let’s break it down, I heard about this feature not too long ago and just wanted to take the time to take a look at it and see what is it all about. In the mean time, I’m rebuilding all my U VMs because I created a new topology (CCIE Collaboration LAB on November 26th), but more on that later. Network needs to be secured, that is what we keep hearing from customers/clients everywhere, and why not make it easier to use and apply.

Shellshock-ed

Wed, 12 Nov 2014 00:00:00 +0000

Thank you Michael for the post. Just re-posting to make my connections aware!

About the Author:

Accesibility Features for Hearing Impaired Users - Cisco 7900 Phones

Tue, 28 Oct 2014 00:00:00 +0000

This post is dedicated to a request that was sent to me, and this is what I did in order to make it more understandable for my customer and Client Manager.

The request was basically that the client needed to support Hearing impaired users and needed to find a way to do it. In all the aspects I found out that Cisco provides a vast majority of features that are very accessible friendly that I did not noticed before.

National Numbering Plans - ITU

Mon, 20 Oct 2014 00:00:00 +0000

Today I have a quick one, I hope you find it useful.

Just in case you are doing an international Dial-Plan configuration, I think this web site will be very helpful:

http://www.itu.int/oth/T0202.aspx?parent=T0202

You can find all the numbering dial plans per country, including the country codes, in the past I used to google to find country codes or what I needed to know, but this will be my official link from now on to look so that I can based my Dial-Plans.

CCNA – LAN Switching Technologies RE: 100-101 ICND [LAB-1]

Sat, 18 Oct 2014 00:00:00 +0000

This one is going to be a series of labs to help friends with their CCNA studies, I have always been asked about something like this and I think now is the time to help and share.

In order to help you pass the ICND 1 there are few things that you need to visualize. I want to start from the one I think its more important:** **

Know the Objectives

IM&P (CUPS) Server, Blank (Admin Page) page after upgrade from 9.x to 10.5

Thu, 02 Oct 2014 00:00:00 +0000

Yes, another upgrade and more with it. This one was very special and I was totally blaming myself after the TAC engineer helped me figure it out.

I was always told, or I remember it was good practice to always get the latest Upgrade file from CCO Downloads page for everything. Well I did that and found myself into an issue.

The scenario:

Customer Upgrading CUCM, CUC and IM&P servers from 9.1.2 to Version 10.5 (No issue here):

Upgrade CUCM 9.1 to 10.5 - Procedure (No Prime Collaboration Deployment)

Sat, 27 Sep 2014 00:00:00 +0000

So with the introduction of Cisco Prime Collaboration Deployment, now upgrade any of your UC applications its easier and quicker than before. One of the big advantages that I see with this new product is that the product can have control of the overall infrastructure, starting from VMware all the way to the UC applications.

For a better understanding of this product you can use the following link: (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/pcdadmin/10_0_1/CUCM_BK_U9C58CB1_00_pcd-administration-guide-1001.html) - The previous is the one for version 10.x – I don’t see too many changes from version to version.

Unity Express AA Transfer no Ring-back - Perception is Key!

Thu, 18 Sep 2014 00:00:00 +0000

This one was a very funny one and I’d like to share with you. After an install of a remote office using the following equipment:

CIsco 2901 with an ISM for CUE and an AutoAttendant that when the office is open sends the call to a Hunt Group in CUCM and when they are close the **AA (**prompts) really kicks in. Nothing too crazy right?

After 1 month of the installation received a call that when someone calls the main number they hear not ring back (only death air) until someone answers the call. After this one I had few things to look at but I knew this was a cosmetic issue.

Debug CCSIP for Lunch

Sat, 13 Sep 2014 00:00:00 +0000

Well written, I was actually having the same issues but it was related to Codec negotiation, so my PSTN site is using a CP-7961 and noticed that my Dial-peer on the PSTN router was using ilbc, and this codec is not supported on these phones, http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7962g_7961g_7961g-ge_7942g_7941g_7941g-ge/8_0/english/administration/guide/62adm80/62614241trb.html

About the Author:

CCIE Collaboration Labs by Technologies

Fri, 12 Sep 2014 00:00:00 +0000

In order to organize myself for my lab preparation I need to work on my speed and accuracy, so I created quick and very general Lab outlines, which will be covering CUCM as of now. I created them so that I can guide myself and know where to begin, where to stop and don’t burn myself (hoping this strategy to work!!)

I know I’m missing lots and lots of information and study domains, such as QoS and yes, QoS… Infrastructure and Multicast… I do feel confident with the Network infrastructure configuration, but need more work on QoS and Multicast, if you know of good QoS labs let me know… enjoy!

How are you preparing for the CCIE Collaboration LAB ?

Sat, 30 Aug 2014 00:00:00 +0000

Just for curiosity, I would like to know how is the people on this group preparing for the CCIE Collaboraiton Lab, right now here is my preparation and roadmap:

I have completed a lab in order to be able to study most of the technologies included in the blueprint, here is what I have:

3 Cisco 2811 64 PVDM2 1 Cisco 2821 128 PVDM2 1 Cisco 3750G 24 Port 1 Poweredge 1950 III 32GB - 2 TB HD - 2 XeonQuadCore E5240 2.4Ghz 5 Cisco 7961 2 Cisco 7965

Upgrading CUCM from 9.1.2 to 10.5 – Issues

Fri, 29 Aug 2014 00:00:00 +0000

Hi there, today I have a customer that wanted to upgrade from CUCM 9.1.2 to 10.5 - which sounds pretty easy… think again, so this is a BE6K deployment where CUCM instance was configured with the recommended OVA from CCO. When starting the upgrade I found that the upgrade didn’t wanted to proceed as expected. and I was getting the following error:

Installation of UCSInstall_UCOS_10.5.1.10000-7.sgn.iso failed

An error has occured but no messages are available. This can happen when another administrator is working on the system at the same time and triggers an error.

CCIE collaboration Lab

Thu, 14 Aug 2014 00:00:00 +0000

Here is my lab

About the Author:

CWMS - Recordings button grayed out - Alerts button not found

Wed, 30 Jul 2014 00:00:00 +0000

So I stumbled across a really basic issue related to adding storage to WebEx, really simple right, just adding an NFS mount to it and done with the issue.

In my particular case my NFS storage was running on 84% of capacity, which is OK, I mean, there is still some space on it, maybe not good practice to have it like that (will be changing it soon though)

So when started I started a meeting to test the recording feature I noticed that my recording button was grayed out, which indicated that there was an issue. After doing some research I found the CWMS troubleshooting guide, which pointed to an issue with the alerts and the threshold of my storage, here is the document that explains it all:

Andres’s toolbox, workflow and more…

Mon, 23 Jun 2014 00:00:00 +0000

Hi people, I wanted to take this opportunity and share my toolbox and workflow with you. In case you don’t know who I am and what I do here is a quick reference note.

What I do and who I am:

I’m a Lead Technical consultant specialized in Cisco Unified Communications and Collaboration (a mouthful, but really cool stuff … that, I can assure you!) – yes I do some other stuff but I could not call myself an expert, such as in routing & switching, Network design and architecture. I’m learning a bit more about security, which I though I knew something but not really!

RADIUS vs TACACS+ - Cool document I found...

Mon, 16 Jun 2014 00:00:00 +0000

Liking the beginning of the document and some how knowing where the conversation will end up being…..

"Cisco seriously evaluated RADIUS as a security protocol before it developed TACACS+. Many features were included in the TACACS+ protocol to meet the needs of the growing security market. The protocol was designed to scale as networks grow, and to adapt to new security technology as the market matures. The underlying architecture of the TACACS+ protocol complements the independent authentication, authorization, and accounting (AAA) architecture."

First contact after I made it back from Cisco Live 2014!!

Wed, 28 May 2014 00:00:00 +0000

Cisco Live 2014 – San Francisco

Just wanted to take this time to talk about my experience at Cisco Live 2014, representing the Modcomp team.

It was a great experience and a nice way to meet with people that is in the same boat you are, Engineers that are seeing the same issues you see and others that have it all figured out (You want to be like them!!).

So just to get you started off the narration of this adventure, I wanted to start by adding few things that I think deserve to be mentioned:

CCIE Collaboration - Campus Design (Migration to Routed Access Layer Design)

Tue, 13 May 2014 00:00:00 +0000

So in the traditional Campus Design it used to be Layer 2 from the Access Layer to the Distribution and to the Endpoints, running Layer 3 on the Distribution and the Core, and in most of the cases, you will have a Core/Distribution approach called Collapsed Distribution Core. as shown in the example:

Now moving from that model to a new and recommended approach you can take a look at the Layer 3 or Route Access layer Design, this one has many benefits as follows:

CCIE Collaboration - Written Exam Reading List

Tue, 13 May 2014 00:00:00 +0000

Just wanted to share some knowledge about the locations on some useful resources:

This document contains the topics that will be covered by the CCIE Collaboration exam, in my case I have been using an structured approach that goes from weakness I have. here are few (Just not to say all of them)

SCCP Call Flows MGCP Call Flows UC on UCS (all fine print and special requirements, many things I didn’t know until now!!!) Answer Files….Who in earth uses them? (I know I would have saved so much time in past deployments by using them…Cool Stuff!).

Cisco Collaboration Edge - Mobile Remote Access (Jabber with no VPN)

Mon, 05 May 2014 00:00:00 +0000

Hi there, I have been looking at the new collaboration edge deployments, in order to support Jabber from remote networks without the need of using a VPN (What a relief!!! - I was actually getting slammed from customers because of the lack of options from Cisco). Doing some research I was able to find the following documents:

Collaboration Edge with Cisco VCS Expressway:

Cisco TelePresence VCS Cluster Creation and Maintenance: www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/config_guide/X8-1/Cisco-VCS-Cluster-Creation-and-Maintenance-Deployment-Guide-X8-1-1.pdf

Configure MoH on CUCME and Transcoding

Fri, 02 May 2014 00:00:00 +0000

So I stumbled into this topic with a customer and was having few issues to understand the mechanics of this simple step, my customer is having issues with quality on the music on hold.

Here is what I did:

Looked up in CUCM Flash and found a media file that I was going to use as MoH.

media/music-on-hold.au

First I started by working on my Transcoder:

voice-card 0 * dsp services dspfarm*

SIP Devices unable to stablish PSTN calls

Thu, 01 May 2014 00:00:00 +0000

I was just reading the following Article and wanted to add few things that helped me solve my issue:

http://uctickets.wordpress.com/2014/03/21/11-sip-9971-phone-unable-to-complete-pstn-calls/

*** bearer-cap speech *** This simple command also fixed an issue I had with Jabber clients calling from Softphone mode to cellphones, and they were getting straight to the voice mail of that particular cellphone.

At first it looks like a simple issue with the phone company, but then you start re-thinking it because it happens with every cellphone you make and with every SIP device you have connected to CUCM.

CCIE Collab - Gateways and Trunks in CUCM

Sat, 26 Apr 2014 00:00:00 +0000

Hi there, so today I wanted to bring up something that was very confusing to me long time ago. The concept of MGCP, H.323 and SIP.

these 3 are very big and there is a lot of information about them, I just want to explain with my own words what every single protocol means for me and the way I had to put it in my head before I was able to understand the technology behind it.

CCIE Collab - Self Training

Fri, 25 Apr 2014 00:00:00 +0000

So today I was able to study for 3 hours, dedicated the first hour to read CIPT2 on Multi-site considerations, read about some QoS recommendations and also something about multi-site dial plans.

I was also able to watch the demonstration videos on Media Termination Points (One of my weakest areas) from INE ATC for CCIE VOICE and I was able to understand more and more about it and saw some multicast and why is there, I remember studying but not paying to much attention to it.

CCIE Collab preparation - Written Booked at Cisco Live!!!

Tue, 22 Apr 2014 00:00:00 +0000

Just wanted to throw it out here, not sure if you have had the same experience but finding Study material for this exam has been very hard for me, currently I’m looking at the INE Voice ATC. they look great but I see a bunch of irrelevant information as of now compared to the new blueprint on the exam.

So far I have studied the following topics:

QoS
Cisco UC on UCS

About it-learn.io

Mon, 01 Jan 0001 00:00:00 +0000

What is it-learn.io?

it-learn.io is a free learning hub for IT professionals, network engineers, and cybersecurity practitioners. We cover what matters in the field — not watered-down theory, but practical content you can apply on the job and in the lab.

The site was built by someone who has been in the trenches of enterprise networking and security, and who got tired of paying for study resources that didn’t align with real-world experience.

Search

Mon, 01 Jan 0001 00:00:00 +0000

You're In — Welcome to the it-learn Brief

Mon, 01 Jan 0001 00:00:00 +0000

You're subscribed.

Your first issue of The it-learn Brief will land in your inbox on the next weekday morning.

Every issue includes breaking CVEs, MITRE ATT&CK-mapped deep dives, copy-paste detection queries, and specific defender action items — the technical depth that keeps you sharp in customer conversations and on the job.

While you wait, check out the latest:

Adobe Reader Zero-Day Exploited for Months Before Emergency Patch — CVE-2026-34621, CPUID supply chain compromise, Marimo RCE
Browse all posts
Listen to the Tech Updates podcast