Karan
Belani.

One of the most common questions from engineers setting up EVE-NG on a 16 GB RAM host is how to simulate PKI, DNS, and HTTPS services without spinning up dedicated Windows or Linux VMs. This lab solves that by running a Root CA, DNS server, and HTTPS web server simultaneously on a single Cisco IOSv instance — keeping the memory footprint minimal while covering three core exam domains in one topology. The same PKI infrastructure built here is directly reusable as the certificate authentication backend for IKEv2 site-to-site VPN, making it a practical foundation for both CCNA students learning DNS and PKI basics, and CCNP Security candidates preparing for certificate-based VPN scenarios.

After going through several resources on configuring MAC Authentication Bypass (MAB) with Cisco ISE, I found that it's quite simple. Most of the configuration is done on the switch, with only minimal setup required on ISE for policies and identity management.

This lab explores how to build a highly resilient enterprise DMVPN architecture. It walks through centralizing internet traffic for security control, while using EIGRP and floating static routes to trigger an automatic failover to local internet if the primary hub goes down.