Before you start
Come from Routing, Switching & VLANs — this assumes you know how traffic moves before covering how it gets blocked.
CLUSTER 0.6
Once traffic can move around a network, the next question is what shouldn't be allowed to. Firewalls, VPNs, and the ability to actually inspect traffic are the baseline of network security.
Drag to rotate · click a node to jump to that topic
Think of it as: a bouncer checking ID against a list before letting traffic through
A firewall inspects traffic against a set of rules and decides what to allow or block — the single most fundamental network security control that exists.
Think of it as: a private tunnel through a public road
A VPN encrypts your traffic and routes it through a private tunnel, so someone working from a coffee shop can securely reach internal company resources as if they were sitting in the office.
Think of it as: a microscope for network traffic
Wireshark captures and displays every individual packet crossing a network, letting you see exactly what's being sent, to where, and whether it looks legitimate — invaluable when something's wrong and you need proof, not guesses.
Think of it as: working outward from "can I reach anything at all?"
Effective troubleshooting moves systematically: local connection, then local network, then internet, then the specific destination — narrowing down exactly where a problem lives instead of guessing randomly.
The default posture in network security is "deny by default, allow by exception" — a firewall should block everything except what's explicitly been approved, not the other way around. This one habit of mind underpins nearly every security decision covered later in the Identity & Security and Security Operations domains.
REAL-WORLD SCENARIO
A remote employee needs to access the internal finance system from home. Rather than exposing that system directly to the internet — a serious risk — the company requires a VPN connection first. Once connected, their laptop behaves as if it's plugged in at the office, and the firewall only allows finance-system traffic from VPN-connected devices.