SEC-02 · Security and Zero Trust
A stateful firewall that runs at packet speed.
Build ACLs, NAT, session tables and a control plane on DPDK, then watch them hold under load.
You build: a stateful firewall service with a control API.
Promise
Build a stateful firewall service on DPDK, with ACLs, NAT, session tables, and a control plane.
Prerequisites
DPK-01 recommended; firewall basics.
Units
1. Firewall evolution and DPDK ch 01–05
.
2. Architecture ch 06–07
FWaaS design, two parts.
3. Data plane ch 08–13
packet processing, forwarding, session table, ACLs, stateful inspection.
4. NAT and crypto ch 14–16
.
5. Load distribution and tuning ch 17, 19–21
.
6. Control plane and monitoring ch 22–24
control plane, observability, DDoS and SYN proxy.
7. Operations ch 26–29
deployment, troubleshooting, ecosystem, next-generation engines.
8. Capstone ch 30
a mini enterprise FWaaS.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| SEC-02ach 11 | ACL first-match and countersPass check: Counters match | sim60 min |
| SEC-02bch 13 | Stateful session tablePass check: Session created, expired | sim90 min |
| SEC-02cch 15 | NAT translationsPass check: Replies return correctly | sim90 min |
| SEC-02dch 19 | Tune the firewall data pathPass check: Throughput before and after | sim120 min |
Capstone project · CAP-10
Congestion-Control Experiment · 2 weeks
A video service stalls on mobile links.
Compare two congestion-control approaches on a defined profile with statistics. Recommend one, with its risks.
Deliverables: Scripts, data, chart, recommendation.
Outcomes
- I can implement an ACL that matches the first rule and counts it.
- I can track a TCP session and expire it correctly.
- I can explain how a SYN proxy protects a server.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.