Coming soon. This course is planned; lessons and labs are not available yet. No release date has been announced.
Build a private IKEv2 site link, trace negotiated identities and traffic selectors, then verify Linux XFRM policy and real application traffic.
Advanced ยท Protected networking
Routes, forwarding, firewalls and a previous VPN example from Linux networking, or equivalent practice. Certificate chains, trust anchors and peer-identity matching are introduced before certificate authentication.
Connect two owned site prefixes, repair a changed negotiation or packet-path fault, and prove intended traffic works while an excluded prefix remains excluded.
Protect two private site prefixes using policy-based IKEv2/IPsec in isolated Linux guests. Inspect both allowed and excluded traffic. Route-based XFRM and NAT traversal are later extensions; an established IKE association alone is not proof that application traffic is protected.
3 planned chapters and 6 lesson outlines.
Model two site prefixes, peer identity and the initial security associations before changing the packet path.
Planned task: Predict permitted and excluded source/destination pairs, then inspect baseline routes, forwarding and underlay reachability on owned gateways.
Changed case to investigate: A new host appears outside the protected prefix; explain why underlay reachability does not grant tunnel access.
Planned task: Establish a pinned private IKEv2 connection and compare peer-authentication evidence with negotiated CHILD SA selectors.
Changed case to investigate: IKE establishes but a changed selector omits the application subnet; avoid marking the tunnel healthy.
Connect selector and kernel policy to actual forwarding while keeping a negative traffic control.
Planned task: Predict a service packet's route, kernel XFRM policy/state and firewall path, then verify a real private application exchange.
Changed case to investigate: The CHILD SA exists but forwarding is disabled; locate the packet-path break without renegotiating keys.
Planned task: Test an excluded-prefix negative control and a permitted positive control while inspecting policy and packet counters.
Changed case to investigate: The site adds a second subnet; update only the intended selector and preserve exclusion of the original forbidden prefix.
Move from a worked peer configuration to a changed site whose fault must be localized from evidence.
Planned task: Use a worked certificate chain to explain the trust anchor and peer-identity match, then replace lab pre-shared keys with course-owned certificates. Predict acceptance and rejection, and inspect a deliberate trust failure.
Changed case to investigate: A renewed certificate uses the wrong identity; correct the trust/configuration mismatch without disabling verification.
Planned task: Independently diagnose a changed prefix or trust fault, repair it, and verify service traffic, excluded traffic and management reachability.
Changed case to investigate: A peer now traverses a NAT node; identify which prior observations still apply and which additional transport evidence is needed.