A complete, practical Cisco course in 27 writeups — from your very first console session to stateful firewalls, redundant edges, fleet automation, and honest buying advice, capped by four full lab scenarios you can build in Packet Tracer. No filler, real commands, and the gotchas that actually bite. Every technical post is cross-mapped to MikroTik, so it works whichever platform you run.
This is the series we wished existed when we were learning: not a certification cram, but the working knowledge to walk up to any Cisco switch or router and make it do what a real site needs — safely. It starts at the console cable and builds, one self-contained post at a time, through VLANs, routing, redundancy, firewalls, VPNs, monitoring, and automation, finishing with the buying decisions nobody writes about honestly.
Read it in order as a course, or jump to the post you need — each one stands alone, opens with prerequisites, and links the others it builds on. And because we run mixed MikroTik and Cisco sites, every technical post ends with a MikroTik ↔ Cisco mapping table: the concepts are universal, only the syntax changes. Planning subnets for the labs? Our subnet & VLAN planner exports ready-to-paste IOS and RouterOS config.
Chapter 1
Get on the box, segment it, protect the config, and put it on the internet.
01First ContactThe CLI from scratch — console, the three modes, safe show commands, passwords, and SSH.18 min→ 02VLANs & TrunkingAccess/trunk ports, 802.1Q, the native VLAN, and inter-VLAN routing two ways.20 min→ 03Backup & RestoreSave, export off-box, the archive feature, one-command rollback, and password recovery.17 min→ 04DHCP & NAT/PATDHCP pools and relay, NAT vocabulary, PAT overload, and static NAT for port forwarding.19 min→Chapter 2
Filter traffic, harden the L2 edge, and teach the router where everything lives.
05Access Control ListsStandard vs extended, wildcard masks, named ACLs with sequence numbers, and VTY lockdown.19 min→ 06Switch SecurityPort security, DHCP snooping, dynamic ARP inspection, and BPDU guard — the defended edge.20 min→ 07Static Routing & OSPFReading the routing table, static and default routes, floating statics, and single-area OSPF.21 min→ 08STP & EtherChannelRoot-bridge election, Rapid PVST+, PortFast, and bundling links with LACP.20 min→Chapter 3
Survive a dead router, a dead ISP, a hostile inbound — and keep voice clear through it all.
09First-Hop Redundancy (HSRP & VRRP)A virtual gateway that fails over between two routers, with interface tracking and load sharing.18 min→ 10Dual-WAN Failover with IP SLAFailover that detects a dead ISP even when the link stays up — probes, tracks, and NAT that follows.19 min→ 11Zone-Based FirewallA real stateful firewall on a router — zones, class/policy-maps, zone-pairs, and the self zone.21 min→ 12QoS for VoIPDSCP marking, the trust boundary, and LLQ priority queuing that keeps calls clear on a full link.19 min→Chapter 4
Link sites, instrument everything, upgrade without fear, and let the box fix itself.
13Site-to-Site IPsec VPNA modern IKEv2 route-based (VTI) tunnel between two offices — and the NAT-exemption trap.22 min→ 14ObservabilityNTP, central syslog, SNMPv3, and NetFlow — you can't troubleshoot what you didn't record.18 min→ 15Upgrading SafelyVerify the hash, set boot variables, IOS-XE install mode, and a rollback plan that works remotely.17 min→ 16EEM AutomationApplets that react to syslog, timers, and track state — auto-recover ports, back up on change.18 min→Chapter 5
Authenticate who plugs in, lock the box itself, watch the wire, and get IPv6 right.
17802.1X Port AuthenticationIdentity at the wall socket with RADIUS — MAB fallback, dynamic VLANs, and a safe monitor-mode rollout.20 min→ 18Management-Plane HardeningSSH, SNMPv3, AAA, VTY access-class, CoPP — the 15-minute audit checklist for any box.19 min→ 19SPAN & RSPANMirror traffic to an analyzer — local, remote, and ERSPAN — with the oversubscription gotcha.15 min→ 20IPv6 FundamentalsAddress types, SLAAC vs DHCPv6, OSPFv3, NDP, and the no-NAT security shift you must plan for.19 min→Chapter 6
Manage a fleet as code, then decide — honestly — what hardware to actually buy.
21Managing a Fleet with AnsibleConfig as code — idempotent ios_config, backups to git, vaulted secrets, and safe check-mode rollout.20 min→ 22Catalyst vs MerakiA vendor-neutral SMB buyer's guide — the licensing trap, when each wins, and the third option.14 min→ 23Buying Used Cisco: Smart or Trap?Counterfeits, licensing dead-ends, EOL patch risk, and a pre-purchase + factory-reset checklist.15 min→Chapter 7
Everything above, assembled into full topologies you can build in Packet Tracer — then broken on purpose.
24Lab: The Collapsed-Core CampusTwo access switches, two L3 cores with HSRP and aligned STP roots, LACP interlink, NAT edge — plus failure drills.24 min→ 25Lab: Multi-Area OSPFFive routers, three areas — ABRs, the LSA types that matter, stub/totally-stubby, and cost-steered failover.23 min→ 26Lab: HQ + Branches — GRE over IPsecA hub-and-spoke WAN through an ISP that won't route your LANs — GRE tunnels, OSPF on top, IPsec around it.24 min→ 27Lab: The Broken CampusEight planted faults, presented as tickets — err-disabled ports, a pruned trunk, split-brain HSRP, a stale NAT ACL.22 min→NOCTIS designs, secures, and operates Cisco and MikroTik networks for hotels, clinics, and SMBs across Crete — every switch documented, hardened, and monitored. The whole series, applied to your rack.
Book a Discovery Call →