A complete, practical Cisco course in 27 writeups — from your very first console session to stateful firewalls, redundant edges, fleet automation, and honest buying advice, capped by four full lab scenarios you can build in Packet Tracer. No filler, real commands, and the gotchas that actually bite. Every technical post is cross-mapped to MikroTik, so it works whichever platform you run.
This is the series we wished existed when we were learning: not a certification cram, but the working knowledge to walk up to any Cisco switch or router and make it do what a real site needs — safely. It starts at the console cable and builds, one self-contained post at a time, through VLANs, routing, redundancy, firewalls, VPNs, monitoring, and automation, finishing with the buying decisions nobody writes about honestly.
Read it in order as a course, or jump to the post you need — each one stands alone, opens with prerequisites, and links the others it builds on. And because we run mixed MikroTik and Cisco sites, every technical post ends with a MikroTik ↔ Cisco mapping table: the concepts are universal, only the syntax changes. For the design decisions that sit above the config — topology, segmentation, resilience — see the Network Architecture guides. Planning subnets for the labs? Our subnet & VLAN planner exports ready-to-paste IOS and RouterOS config.
Chapter 1
Get on the box, segment it, protect the config, and put it on the internet.
01First ContactThe CLI from scratch — console, the three modes, safe show commands, passwords, and SSH.18 min→ 02VLANs & TrunkingAccess/trunk ports, 802.1Q, the native VLAN, and inter-VLAN routing two ways.20 min→ 03Backup & RestoreSave, export off-box, the archive feature, one-command rollback, and password recovery.17 min→ 04DHCP & NAT/PATDHCP pools and relay, NAT vocabulary, PAT overload, and static NAT for port forwarding.19 min→Chapter 2
Filter traffic, harden the L2 edge, and teach the router where everything lives.
05Access Control ListsStandard vs extended, wildcard masks, named ACLs with sequence numbers, and VTY lockdown.19 min→ 06Switch SecurityPort security, DHCP snooping, dynamic ARP inspection, and BPDU guard — the defended edge.20 min→ 07Static Routing & OSPFReading the routing table, static and default routes, floating statics, and single-area OSPF.21 min→ 08STP & EtherChannelRoot-bridge election, Rapid PVST+, PortFast, and bundling links with LACP.20 min→Chapter 3
Survive a dead router, a dead ISP, a hostile inbound — and keep voice clear through it all.
09First-Hop Redundancy (HSRP & VRRP)A virtual gateway that fails over between two routers, with interface tracking and load sharing.18 min→ 10Dual-WAN Failover with IP SLAFailover that detects a dead ISP even when the link stays up — probes, tracks, and NAT that follows.19 min→ 11Zone-Based FirewallA real stateful firewall on a router — zones, class/policy-maps, zone-pairs, and the self zone.21 min→ 12QoS for VoIPDSCP marking, the trust boundary, and LLQ priority queuing that keeps calls clear on a full link.19 min→Chapter 4
Link sites, instrument everything, upgrade without fear, and let the box fix itself.
13Site-to-Site IPsec VPNA modern IKEv2 route-based (VTI) tunnel between two offices — and the NAT-exemption trap.22 min→ 14ObservabilityNTP, central syslog, SNMPv3, and NetFlow — you can't troubleshoot what you didn't record.18 min→ 15Upgrading SafelyVerify the hash, set boot variables, IOS-XE install mode, and a rollback plan that works remotely.17 min→ 16EEM AutomationApplets that react to syslog, timers, and track state — auto-recover ports, back up on change.18 min→Chapter 5
Authenticate who plugs in, lock the box itself, watch the wire, and get IPv6 right.
17802.1X Port AuthenticationIdentity at the wall socket with RADIUS — MAB fallback, dynamic VLANs, and a safe monitor-mode rollout.20 min→ 18Management-Plane HardeningSSH, SNMPv3, AAA, VTY access-class, CoPP — the 15-minute audit checklist for any box.19 min→ 19SPAN & RSPANMirror traffic to an analyzer — local, remote, and ERSPAN — with the oversubscription gotcha.15 min→ 20IPv6 FundamentalsAddress types, SLAAC vs DHCPv6, OSPFv3, NDP, and the no-NAT security shift you must plan for.19 min→Chapter 6
Manage a fleet as code, then decide — honestly — what hardware to actually buy.
21Managing a Fleet with AnsibleConfig as code — idempotent ios_config, backups to git, vaulted secrets, and safe check-mode rollout.20 min→ 22Catalyst vs MerakiA vendor-neutral SMB buyer's guide — the licensing trap, when each wins, and the third option.14 min→ 23Buying Used Cisco: Smart or Trap?Counterfeits, licensing dead-ends, EOL patch risk, and a pre-purchase + factory-reset checklist.15 min→Chapter 7
Everything above, assembled into full topologies you can build in Packet Tracer — then broken on purpose.
24Lab: The Collapsed-Core CampusTwo access switches, two L3 cores with HSRP and aligned STP roots, LACP interlink, NAT edge — plus failure drills.24 min→ 25Lab: Multi-Area OSPFFive routers, three areas — ABRs, the LSA types that matter, stub/totally-stubby, and cost-steered failover.23 min→ 26Lab: HQ + Branches — GRE over IPsecA hub-and-spoke WAN through an ISP that won't route your LANs — GRE tunnels, OSPF on top, IPsec around it.24 min→ 27Lab: The Broken CampusEight planted faults, presented as tickets — err-disabled ports, a pruned trunk, split-brain HSRP, a stale NAT ACL.22 min→Beyond the Series
Standalone pieces that go past the fundamentals — the attacker's view of the same gear, cross-vendor work, and a real build from the field.
＋Attacking Cisco Gear — A Pentester's Field GuideThe offensive companion: CDP/SNMP recon, Smart Install config theft, SNMP-RW exfil, password cracking, and DTP/VTP abuse — each with its one-line fix.10 min→ ＋MikroTik ↔ Cisco — One IPsec Tunnel, Two VendorsA cross-vendor IKEv2 site-to-site tunnel between IOS and RouterOS — proposal matching, the policy-vs-route-based trap, and NAT exemption both ends.9 min→ ＋Field Notes: A Cisco Campus for a Cretan HotelAn anonymised collapsed-core build — VLAN segmentation, dual-WAN failover onto Starlink, guest isolation, and the three things that actually broke.9 min→ ＋Cisco ↔ MikroTik: The Translation GuideThe same network on both platforms — a task-by-task command map between IOS and RouterOS, linking every twin post in both series.8 min→Beyond the Series
Past the fundamentals — the edge protocol, policy routing, and driving IOS-XE like an API.
＋BGP & Dual-ISP MultihomingA real multihomed edge — two eBGP upstreams, local-preference and AS-path prepend for path control, mandatory anti-transit filtering, and automatic failover.11 min→ ＋Policy-Based RoutingRoute by who sent the packet, not just where it's going — route-maps that steer a subnet or app out a different next-hop, with IP SLA so a dead path never blackholes.9 min→ ＋Model-Driven Config (NETCONF/RESTCONF)Talk to modern IOS-XE like an API — YANG-modelled data, a curl RESTCONF quick-win, and transactional NETCONF edits that never half-apply.10 min→Beyond the Series
The protocols and tunnels past the fundamentals — an all-Cisco IGP, safe multi-protocol glue, and scaling the WAN.
＋EIGRPCisco's advanced distance-vector protocol — feasible successors for sub-second failover, unequal-cost load balancing, and why it locks you in.5 min→ ＋Route Redistribution & BFDGlue OSPF/BGP/EIGRP/static safely — seed metrics, tag-and-deny loop prevention, admin-distance traps, and millisecond failure detection.5 min→ ＋DMVPNScale a branch WAN without a full mesh — mGRE + NHRP + IPsec, a hub configured once, and Phase-3 direct spoke-to-spoke tunnels.5 min→ ＋Remote-Access VPN (IKEv2)Road-warrior access — IKEv2/FlexVPN with an authorization policy, per-client virtual-template, split tunnelling, and the server-cert trust gotcha.5 min→Beyond the Series
Controller-based Cisco wireless, the way real deployments run it.
＋The Lightweight AP ArchitectureHow a lightweight AP discovers and joins a WLC over CAPWAP, the Catalyst 9800 tag model for the whole fleet, FlexConnect branches, and VLAN-per-SSID.7 min→This whole series is the standard I hold my own paid work to — every switch documented, hardened, and monitored, whether it's Cisco, MikroTik, or both running side by side.
Book a Discovery Call →