parti introduction to network security

chapter i understanding network security threats

identify the need for network security

identify the causes of network security problems

technology weakness

policy weakness

configuration weakness

the four primary types of network threats

unstructured threats

structured threats

internal threats

extemal threats

the four primary types of network attack

reconnaissance attacks

access attacks

denial of service (dos) attacks

data manipulation attacks

cisco avvid and safe strategies

avvid

safe

.cisco security wheel

network security policy

why create a network security policy

the balancing act

a security policy is to be shared

who should help create the security policy?

assets and threats

evaluating a network security policy

example of a network security policy

securing the network

wireless communication policy

monitoring network security

improving network security

chapter review

questions

answers

chapter 2 securing the network

secure network design example

inside network

outside network

demilitarized zone (dmz)

securing network devices

physically secure the devices

securing administrative access

using access control lists to secure the network

standard acls

extended access lists

named access lists

time-based access lists

chapter review

questions

answers

part ii securing the network perimeter

chapter 3 cisco aaa security technology

the cisco aaa model

nas servers

why authenticate?

aaa benefits

tacacs+, radius, and kerberos support

aaa system components

aaa as facilitator

authentication

authorization

accounting

testing aaa configuration

the show commands

the debug commands

chapter review

questions

answers

chapter 4 cisco secure acs and tacacs+/radius technologies

describe cisco secure acs

ciscosecure acs for windows and unix

features and architecture of cisco secure acs for windows

features and benefits

cisco secure acs benefits

cisco secure acs for windows internal architecture

system performance

features of ciscosecure acs for unix

features and benefits

preparing to install unix acs

installing cisco secure acs 3.0 for windows

hardware requirements

operating system requirements

third-party software requirements

nas.minimum los requirements

network requirements

back up server data

gathering information required during installation

administering and troubleshooting cisco secure acs for windows

navigation bar

configuration area

display area

accessing the html interface

suggested configuration sequence

tacacs+ overview

configuring cisco secure acs and tacacs+

configure nas to tacacs+ server communication

verifying tacacs+

the show commands

the debug commands

configure nas to radius server communication

chapter review

questions

answers

chapter 5 securing cisco perimeter routers

perimeter router terms and concepts

simple secure network design

eavesdropping

router solutions

hub and switch issues

limit unneeded tcp/ip and other services

tcp and udp "small services"

finger

ntp

cdp

denial of service attacks

controlling directed broadcasts

flood management

antispoofing with rpf checks

unauthorized access

address filtering

dynamic (lock-and-key) access lists

reflexive access lists

lack of legal ip addresses

nat technology and terminology

static nat

dynamic nat

dynamic nat with overloading (pat)

rerouting attacks

event logging on perimeter routers

access list violation logs

chapter review

questions

answers

chapter 6 los firewall feature set—bac

introduction to cisco ios firewall

router-based firewall functionality

integration with cisco ios software

feature summary

context-based access control (cbac)

quick access list review

cbac advantages

cbac limitations

cbac process

configuring cbac

ios firewall management

command line interface

configmaker

chapter review

questions

answers

chapter 7 los firewall--lntrusion detection system

intrusion detection system (ids)

ios firewall intrusion detection system

devices supporting the los firewall ids feature

cisco ids attack signatures

cisco secure ids director support

performance implications

ios ids vs. cisco secure ids

cisco los firewall ids configuration task list

initializing the ios firewall ids

the ip audit smtp spam command

the ip audit po max-events command

initializing the post office

the ip audit notify command

the ip audit po local command

the ip audit po remote command

creating and applying audit rules

creating an audit rule

apply the audit rule to the interface(s)

verifying the ids configuration

the show ip audit statistics command

the show ip audit configuration command

the show ip audit interface command

the show ip audit all command

chapter review

questions

answers

chapter 8 los firewall--authentication proxy

cisco los firewall authentication proxy

how the authentication proxy works

applying the authentication proxy

comparison with the lock-and-key feature

compatibility with other features

security vulnerability issues

before configuring authentication proxy

authentication proxy configuration task list

aaa server configuration

aaa router configuration

enable aaa

define the security server

define login authentication methods list

enable authorization proxy (auth-proxy) for aaa

activate authentication proxy accounting

acl entry for return traffic from the aaa server

configuring the http server

authentication proxy configuration on the router

the ip auth-proxy auth-cache-time command

the ip auth-proxy auth-proxy-banner command

the ip auth-proxy name command

the auth-proxy interface configuration

verify authentication proxy configuration

the auth-proxy cache

the debug commands

cbac configuration

chapter review

questions

answers

part iii virtual private networks (vpns)

chapter 9 cisco los ipsec introduction

virtual private networks

remote-access

site-to-site

layer 2 vpns

layer 3 vpns

other vpn implementations

why use vpns?

vpn analogy

tunneling protocols

layer two forwarding (l2f) protocol

layer 2 tunneling protocol (l2tp)

generic routing encapsulation (gre)

how ipsec works

cisco ios ipsec technologies

ipsec security overview

transport and tunnel mode

ipsec transforms and transform sets

cisco ios cryptosystem components

how encryption works

cryptography types

encryption ahematives

hashing

diffie-hellman key agreement (dh)

security association (sa)

ike sas versus ipsec sas

five steps of ipsec revisited

step 1--determine interesting traffic

step 2--ike phase one

step 3--ike phase two

step 4--ipsec data transfer

step 5--session termination

ipsec support in cisco systems products

chapter review

questions

answers

chapter 10 cisco los ipsec for presharecl keys

configure ipsec encryption tasks

task 1 prepare for ike and ipsec

task 2 configure ike

task 3 configure ipsec

task 4 test and verify ipsec

configuring ipsec manually

configuring ipsec manually is not recommended

chapter review

questions

answers

chapter i i cisco los ipsec certificate authority support

ca support overview

digital certificates

certificate distribution

ipsec with cas

how ca certs are hsed by ipsec peers

cisco ios ca standards

simple certificate enrollment protocol (scep)

ca servers interoperable with cisco routers

enroll a device with a ca

configure ca support tasks

task 1--prepare for ike and ipsec

task 2--configure ca support

task 3--configure ike

task 4--configure ipsec

task 5--test and verify ipsec

rsa encrypted nonces overview

task 2--configure rsa keys

chapter review

questions

answers

chapter 12 cisco los remote access using cisco easy vpn

introduction to cisco easy vpn

cisco easy vpn server

client connection process

cisco easy vpn remote

split tunneling

cisco vpn 3.6 client

how the vpn client works

connection technologies

easy vpn server configuration tasks

preconfiguring the cisco vpn 3.6 client

creating a new connection entry

trying out the new connection

customizing the connection

management center for vpn routers

features and benefits

router mc server requirements

router mc client requirements

router mc user permissions

easy vpn remote phase two

supported vpn servers

phase two features

cisco vpn firewall feature for vpn client

overview of software client firewall feature

defining a client firewall policy

the are you there feature

the central policy protection feature

client/server feature

client firewall statistics

chapter review

questions

answers

chapter 13 cisco vpn hardware overview

cisco products enable a secure vpn

what's newt

cisco vpn 3002 client devices

cisco vpn 3002 client models

client and network extension modes

standards supported

cisco vpn 3002 hardware client features

cisco vpn 3000 concentrator devices

cisco vpn 3000 concentrator models

standards supported

cisco vpn 3000 concentrator features

vpn 3000 concentrator client support

chapter review

questions

answers

chapter 14 cisco vpn 3000 remote access networks

vpn concentrator user interfaces and startup

quick configuration

command-line interface (cli) basics

concentrator manager (web interface)

vpn concentrators in ipsec vpn implementations

remote access networks

lan-tu-lan networks

remote access vpns with preshared keys

preshared keys

initial configuration

setting the public interface

defining the default gateway (optional)

adding the static routes

general system information

define inside address assignment method

define inside address pool for remote users

configuring groups and users

other configuration options

digital certificates

certificate types

vpn concentrator and certificates

enrolling and installing certificates

using scep to manage certificates

using the certificates

configure cisco vpn client support

vpn client autoinitiation feature

the vpndient.ini file

preparation

configuration

vpn 3000 configuration

administer and monitor remote access networks

administration

monitoring

chapter review

questions

answers

chapter 15 configuring cisco vpn 3002 remote clients

the vpn 3002 in the network

vpn modes

ipsec vpns

configuring the 3002 device

command-line interface (ch)

the hardware client manager (web interface)

common configuration tasks

upgrading the software

quick configuration

system status

pppoe support

basic configuration for the vpn 3002

set the system time, date, and time zone

optional--upload an existing configuration file

configure the private interface

configure the public interface

configure the ipsec

choose client (pat) mode or network extension mode

configure dns

configure static routes

change the admin password

modifying options

other vpn 3002 software features

interactive hardware client authentication

individual user authentication

leap bypass

ipsec backup servers

ipsec server load balancing

h.323 support in pat mode

simple certificate enrollment protocol (scep)

xml management

reverse route injection (rill)

aes support and diffie-hellman group 5

push banner to vpn 3002

delete with reason

auto-update feature

vpn 3002 hardware clients

cisco vpn software clients

configuring auto-update

chapter review

questions

answers

chapter 16 cisco vpn 3000 lan-to-lan networks

the vpn concentrators in lan-to-lan vpns

chapter scenario

lan-to-lan networks with preshared keys

configure network lists

define the ike proposals (optional)

create the tunnel

lan-to-lan networks with digital certificates

nat issues

nat transparency

ipsec over tcp

ipsec over nat-t

ipsec over lidp

lan-to-lan vpn with overlapping network addresses

lan-to-lan routing

default gateways

reverse route injection

virtual router redundancy protocol

chapter review

questions

answers

partiv pix firewalls

chapter 17 ciscosecure pix firewalls

firewall and firewall security systems

packet filter

proxy filter

stateful packet filter

ciscosecure pix firewall technology

pix adaptive security algorithm

the pix firewall family

tested and certified

vpn support

pix management options

cisco mobile office support

cisco catalyst 6500 implementation

basic pix firewall configuration

pic command-line interface

the nameif command

the interface command

the ip address command

the nat command

the global command

the route command

chapter review

questions

answers

chapter 18 getting started with the cisco pix firewall

basic pix firewall configuration

verifying configuration and traffic

icmp traffic to the firewall

the show icmp command

the debug icmp trace command

time setting and ntp support

how ntp works

ntp and pix firewalls

syslog configuration

the logging commands

fri' and url logging

verifying and monitoring logging

dhcp server configuration

configuring the dhcp server feature

dhcp client

using nat/pat with dhcp client

firewalls as a dhcp client and server

chapter review

questions

answers

chapter 19 access through the pix firewall

adaptive security algorithm

security levels

stateful system

translations

connections

translations and connections

transport protocols

static translations

network address translation

port address translations (pat)

using nat and pat together

names and name commands

configuring dns support

access control lists (acls)

using access lists

access-group statement

basic acl statements

icmp acl statements

turboacl

downloadable acls

content filtering

activex blocking

java blocking

websense filtering

object grouping

overview of object grouping

getting started with group objects

configuring object groups with acls

nested object groups

conduit statements

configuring conduits

pix routing configuration

the route command

routing options

multicast traffic

chapter review

questions

answers

chapter 20 advanced pix firewall features

remote access

telnet access

http access

secure shell (ssh) access

aaa support for telnet, http, and ssh sessions

aaa on the pix firewall

defining the aaa server

local user database

configuring aaa features

access lists with aaa

command-level authorization

firewall privilege levels

configuring cisco secure acs for windows

advanced protocol handling

application inspection

the tm'up protocol command

supported applications and protocols

fixup protocol examples

other supported protocols and applications

attack guards

dns control

flood defender

fragguara and virtual reassembly

tcp intercept

unicast reverse path forwarding

activex blocking, java filtering, and url filtering

intrusion detection

define default audit actions

disabling individual signatures

create named audit rules

apply the audit rule to the interface(s)

pix firewall ids syslog messages

shunning

managing snmp services

pix firewall snmp support

snmp contact and location

snmp management station

snmp community key

enabling snmp traps

verify snmp configuration

logging to the snmp management station

chapter review

questions

answers

chapter 21 firewalls and vpn features

pix firewall enables a secure vpn

ipsec vpn establishment

five steps of ipsec

ipsec configuration tasks

task 1: prepare to configure vpn support

task 2: configure ike parameters

task 3: configure ipsec. parameters

task 4: test and verify vpn configuration

cisco vpn client

client mode

network extension mode

establishing preliminary connectivity

easy vpn remote configuration

scale pix firewall vpns

network management options

pppoe and the pix firewall

chapter review

configuring ipsec

configuring ipsec for rsa encrypted nonces

configuring ca support tasks

questions

answers

chapter 22 managing and maintaining the pix firewall

pdm overview

versions and device support

pdm operating requirements

pix firewall requirements

workstation requirements

cisco secure policy manager considerations

web browser considerations

prepare for pdm

installing pdm on a pix firewall

minimum pix configuration

starting pdm

using the pdm startup wizard

using pdm to configure the pix firewall

using pdm to create a site-to-site vpn

using pdm to create a remote access vpn

ciscoworks management center for pix firewalls (pix mc)

system requirements

pix failover feature

hnderstanding failover

failover configuration with failover cable

lan-based failover configuration

verifying failover configuration

password recovery

before getting started

pix devices with a floppy drive

pix devices without a floppy drive

upgrading the pix os

older upgrade methods

chapter review

questions

answers

par v intrusion detection systems (ids)

chapter 23 intrusion detection system overview

security threats

internal threats

extemal threats

unstructured threats

structured threats

the attack types and phases

attack types

attack phases

intrusion detection systems overview

host- and network*based idss

ids triggers

summary

questions

answers

chapter 24 cisco secure intrusion detection system

cids operations and functionality

monitoring

analyzing

communications

centralized alarm display and management

sensor response

cids architecture

cids software architecture

cids commands

cids directory structure

cids log files

chapter review

questions

answers

chapter 25 sensor installation and configuration

sensor deployment considerations

network entry points

network size and complexity

the amount and type of traffic

sensor installation

connecting to your network sensor appliance

sensor bootstrap

ids device manager

connecting to the ids device manager

ids device manager gui interface

device area configuration

configuration area

monitoring area

administration area

chapter review

questions

answers

chapter 26 signature and alarm management

cids signatures

signature series

signature implementations

signature structure

signature classes

signature types

signature severity

event viewer

managing alarms

event viewer customization

preference settings

chapter review

review questions

answers

part vi cisco safe implementation

chapter 27 cisco safe implementation

preparation documents

exam topics

security fundamentals

architectural overview

cisco security portfolio

safe small network design

safe medium network design

safe remote-user network implementation

skills required for the exam

chapter review

questions

answers

appendix a access control lists

access list basics

two-step process

numbered acl common characteristics

the numbers matter

standard access lists

building a standard acl

verifying acls

show run command

show access-lists command

show ip interfaces command

extended access lists

creating an extended access list

named access lists

appendix b about the cd

system requirements

leamkey online training

installing and running masterexam

masterexam

electronic book

lab exercises

help

removing installation(s)

technical support

learnkey technical support

index