CCIE Security v6.1 Lab Topology: Devices, Versions, Practice

The CCIE Security v6.1 lab is an eight-hour practical exam on a topology that combines physical Cisco ASA firewalls, Catalyst switches and an access point with virtual ISE, Firepower (FMC, FTD and NGIPSv), ASAv, CSR 1000V routers, WSA, ESA, Stealthwatch, FireAMP and DNA Center, plus Cisco Umbrella as a cloud service. Cisco publishes the exact platforms and software versions in its CCIE Security v6.1 Equipment and Software List, and this guide walks through that list, the security zones the exam pivots on, and the realistic ways to build a practice lab that matches it.

If you are preparing for the lab, you already know it is not a knowledge test. You either know what each device is doing and can fix it under time pressure, or you do not pass. The fastest way to get there is a practice topology that matches the exam pod, so the rest of this guide is about building one.

Table of contents

• CCIE Security v6 Lab Topology at a Glance
• What is the CCIE Security v6 lab topology?
• The Full CCIE Security v6.1 Device List and Versions
• Security Zones and Traffic Flows in the v6 Topology
• The CCIE Security v6.1 Blueprint Mapped to the Topology
• How to Practice the CCIE Security Lab: Hardware vs CML vs EVE-NG vs Hosted
• Choosing Your CCIE Security Practice Path

CCIE Security v6 Lab Topology at a Glance

Here is how the four common ways to build a CCIE Security practice lab compare on images, realism and scale.

A full physical rack is the closest match to the real exam, and very few individual candidates can justify one. Self-hosted CML and EVE-NG take you a long way if you have a capable server and licensed images, with EVE-NG covering more of the security appliances as native nodes. A hosted lab removes the server from the equation. With CloudMyLab's hosted EVE-NG and CML, you upload the Cisco images you are licensed to use, with onboarding and image-upload help included, and build the virtual part of the v6.1 topology on infrastructure sized for it. Image licensing stays with you: CloudMyLab does not supply Cisco security images.

What is the CCIE Security v6 lab topology?

The CCIE Security v6 lab topology is the enterprise network used in the CCIE Security v6.1 practical exam. Cisco's equipment list splits it into physical equipment (ASA 5512 and 5516 firewalls, Catalyst 3650 and 3850 switches, an AP1852 access point), virtual machines (ISE, FMC, FTD, NGIPSv, ASAv, CSR 1000V, WSA, ESA, Stealthwatch, FireAMP, WLC, DNA Center and L2IOSv), Cisco Umbrella as a cloud-delivered service, and test clients running Windows 10, Windows Server 2016 for AD and DNS, and Kali Linux. You design, configure and troubleshoot security across all of it in a single eight-hour exam.

Two things make this topology different from the other CCIE tracks. First, it is appliance-heavy. You are not just configuring routing and switching; you are running NGFW, identity, web and email security, threat detection and automation on dedicated platforms that each have their own management plane. Second, integrations matter as much as individual configurations: ISE-to-Firepower identity, AnyConnect posture through ISE, FMC correlation, and Stealthwatch flow ingestion. The lab rewards how cleanly the pieces work together, not just whether each box passes a show command.

The Full CCIE Security v6.1 Device List and Versions

Cisco states that the practical exam tests candidates on solutions that can be configured with the equipment and software versions on its list. Candidates may see more recent software during their attempt, but are tested only on features in the list. Here is that list, with the newer names Cisco gave some of the products.

Virtual machines in the v6.1 lab

Physical hardware in the v6.1 lab

Cisco Umbrella is on the list as a cloud-delivered service. Because SaaS platforms change between updates, Cisco notes that candidates are tested only on blueprint topics for it. The remaining systems are a Windows 10 Enterprise test PC, a Windows Server 2016 AD and DNS server, a Kali Linux host, and Cisco AnyConnect 4.2.

Two practical consequences follow. Most of the topology is virtual, so a hypervisor with enough CPU and memory matters more than a rack. And if your practice setup does not include an AD-joined Windows client, you cannot test the ISE and Active Directory integration on Cisco's list. For what each emulator can host, the EVE-NG vs CML comparison walks through the differences.

Security Zones and Traffic Flows in the v6 Topology

A practical way to organize a CCIE Security practice topology is six logical zones, because the exam keeps returning to the traffic that crosses between them:

• Inside: the trusted corporate network where authenticated users sit.
• Outside: the untrusted Internet. Default-deny inbound, controlled outbound.
• DMZ: public-facing servers, with specific allow rules in both directions.
• Management: the network for device administration, locked down and often on its own VLAN or VRF.
• User segments: VLANs split by role, such as corporate, BYOD, guest and contractor.
• Server segments: internal application and data tiers, segmented from users by a firewall.

The ASA or FTD at the Internet edge handles traffic between Outside, DMZ and Inside. Firepower inspects east-west traffic between user and server zones with identity-aware rules that use ISE context. AnyConnect remote-access VPN places users in an Inside subnet and runs them through posture before granting a higher level of access. Site-to-site IPsec tunnels connect branch topologies to the corporate network, and Stealthwatch ingests flow data for visibility.

VLAN design is its own checkpoint: user VLANs, server VLANs with different security requirements, a locked-down management VLAN, and an isolated guest VLAN that can only reach the Internet. If you are building a practice topology, get the VLAN plan right before you start configuring ISE. Many ISE problems trace back to a sloppy VLAN map.

The CCIE Security v6.1 Blueprint Mapped to the Topology

The lab has two modules: a three-hour design module and a five-hour deploy, operate and optimize module, with automation part of both. Here is how the main technology areas in the blueprint land on the devices in the topology.

Perimeter security and intrusion prevention (NGFW)

This is the ASA, ASAv, FTD, NGIPSv and FMC part of the topology. Expect firewall policy, NAT, IPsec site-to-site VPN with IKEv1 and IKEv2, AnyConnect remote-access VPN, and ASA high availability. On Firepower you work with access control policies, intrusion policies, URL filtering, file and malware policies, and identity-aware rules that use ISE. NAT is an area where shallow practice catches candidates out; see What is NAT and how it works for a refresher on the fundamentals.

Secure connectivity and segmentation (ISE and TrustSec)

ISE drives identity: 802.1X for wired and wireless access, with the Catalyst switches and the WLC as authenticators, RADIUS and TACACS+ for AAA, policy sets for authentication, authorization, profiling and posture, TrustSec with SGTs for role-based enforcement, and Active Directory integration with the Windows Server in the lab. Posture usually appears as a remediation flow: a non-compliant client is quarantined, remediates through AnyConnect, and gains access once it passes.

Threat detection, response and visibility

Stealthwatch ingests NetFlow from the network devices, builds host group baselines and raises alarms on anomalous behavior. Rapid threat containment is the integration showpiece: an alert in Stealthwatch or Firepower triggers an ISE change of authorization that quarantines the offending endpoint. FireAMP covers the endpoint side.

Web and email security

WSA handles outbound web traffic with URL categories, HTTPS decryption, malware scanning and identity-aware policies that use ISE. ESA handles inbound and outbound email with anti-spam, anti-malware, content filters and DLP. Umbrella adds DNS-layer and cloud-delivered web security.

Automation and programmability

The v6.1 blueprint expects basic Python and REST API skills: HTTP methods, response codes, headers and authentication, and JSON, XML and YAML payloads, plus DNA Center northbound APIs. In practice, that means reading a JSON payload, sending a request to an appliance API, and parsing the response under time pressure. Ansible and Terraform are not on the blueprint.

How to Practice the CCIE Security Lab: Hardware vs CML vs EVE-NG vs Hosted

There are four realistic ways to build a CCIE Security practice environment. Each trades cost, fidelity, and the amount of study time you spend building the lab instead of using it.

Physical hardware

A physical rack modeled on Cisco's list is the closest you can get to the exam pod, and the hardest to justify for one candidate. It also does not remove the virtual appliance problem: ISE, FMC, FTD, WSA, ESA, Stealthwatch and DNA Center run as virtual machines either way, so you still need a well-sized hypervisor host next to the rack.

Cisco Modeling Labs (CML)

CML is Cisco's own emulator. It is excellent for the routing and switching side of the topology. Where it gets thinner is the security appliances: ISE, FMC, WSA and ESA are not native CML node types, so a common setup uses CML as the network backbone and runs the security virtual machines alongside it on the same hypervisor. A security-scale topology needs a lot of memory, more than most laptops have.

EVE-NG

EVE-NG, especially with a Pro license, is a popular self-hosted choice for CCIE Security practice because most Cisco security appliances can be imported as custom nodes, from ASAv and FTDv to ISE, WSA and ESA. The catch is the same one CML has: you need images you are licensed to use. For Community vs Pro, see EVE-NG Community vs EVE-NG Professional.

Hosted CCIE Security labs

A hosted lab is EVE-NG, CML or a custom topology running on infrastructure someone else maintains. You reach it through a browser, VPN or jump host, and you spend your time on configuration instead of on the server. With hosted EVE-NG, GNS3 or CML from CloudMyLab, you bring your own licensed images and build the virtual part of the v6.1 topology, with onboarding and image-upload help included and 24/7/365 support. The free 24-hour trial covers hosted EVE-NG Pro and CML.

The honest tradeoff: hardware is closest to the exam and hardest to justify. Self-hosted CML or EVE-NG suits you if you have the server, the licensed images and the patience for setup. A hosted lab suits you if your study hours are the scarcest resource.

Choosing Your CCIE Security Practice Path

The right path depends on whether you have legitimate access to Cisco security images, how much hardware you already own, and how much study time you can spend building the lab.

Whichever path you choose, build against Cisco's list rather than against a generic security topology, and plan for an AD-joined Windows client from day one. If your time matters more than the server, start a free trial of hosted EVE-NG Pro or CML. For the broader landscape of cloud-based training environments, see Cloud-Based Training Labs, and for where CCIE Security sits in the wider Cisco certification path, see the Network Engineer Certifications and Career Paths guide.

Frequently Asked Questions

What is the CCIE Security v6 lab topology?

It is the network you configure in the CCIE Security v6.1 practical exam: physical ASA firewalls, Catalyst switches and an access point, plus virtual ISE, FMC, FTD, NGIPSv, ASAv, CSR 1000V routers, WSA, ESA, Stealthwatch, FireAMP, a WLC and DNA Center, with Windows, Windows Server and Kali Linux clients and Cisco Umbrella as a cloud service.

What devices and software versions are on the CCIE Security v6.1 lab?

Cisco publishes them in its CCIE Security v6.1 Equipment and Software List. Virtual machines include ISE 3.1.0, FMC 7.1 and 6.2, FTD 6.2, NGIPSv 7.0, ASAv 9.4(3), CSR 1000V, WSA 9.2, ESA 11.1, Stealthwatch 6.10, FireAMP Cloud 5.3, WLC 8.3 and DNA Center 2.2.2.4. Physical equipment is ASA 5512 and 5516, Catalyst 3650 and 3850, and an AP1852. Candidates may see newer software, but are tested only on features in the list.

How do I practice for the CCIE Security lab without buying hardware?

Use virtual appliances on EVE-NG or Cisco CML, self-hosted or on a hosted platform, with Cisco security images you are licensed to use. Most of the exam topology already runs as virtual machines; only the ASA appliances, switches and access point on Cisco's list are physical.

How much does the CCIE Security lab exam cost?

Cisco lists the CCIE Security lab exam at 1,600 US dollars per attempt at its testing facilities, or Cisco Learning Credits. The lab is an eight-hour exam, and you also need to pass the 350-701 SCOR core exam.

Are Ansible or Terraform on the CCIE Security v6.1 lab?

No. The v6.1 blueprint covers basic Python, REST APIs, JSON, XML and YAML payloads, and DNA Center northbound APIs, but not Ansible or Terraform.