Table Of Content2408_CCSP.book Page xi Thursday, November 13, 2003 2:38 PM
xi
Threats 31
ationvIntruder Moti 31
s or Networksstanding of Computerk of UnderLac 31
Intruding for Curiosity 32
Intruding for Fun and Pride 32
evengIntruding for Re 32
o(cid:222)tIntruding for Pr 32
olitical PurposesIntruding for P 33
Attacksypes of T 33
ksAttacReconnaissance 34
ksAttacAccess 34
ksAttacDoS 36
oundation SummaryF 37
ulnerabilitiesV 37
abilitiesulnerVSelf-Imposed 37
Threats 38
Intruder Motivation 38
Attacksypes of T 39
Q&A 40
Chapter 3 Defense in Depth 43
Already?(cid:211) QuizThis w (cid:210)Do I Kno 43
opicsToundation and Supplemental F 46
w of Defense in DepthervieOv 46
Components Used for Defense in Depth 47
Physical Security 51
oundation SummaryF 52
Q&A 54
Part II Managing Cisco Routers 56
Chapter 4 Basic Router Management 59
Already?(cid:211) QuizThis w (cid:210)Do I Kno 59
opicsToundation F 63
Router Con(cid:222)guration Modes 63
Accessing the Cisco Router CLI 66
AccessCon(cid:222)guring CLI 68
all FeatureswCisco IOS Fire 69
oundation SummaryF 71
Router Con(cid:222)guration Modes 71
Accessing the Cisco Router CLI 72
all FeatureswCisco IOS Fire 72
Q&A 75
2408_CCSP.book Page xii Thursday, November 13, 2003 2:38 PM
xii
Chapter 5 Secure Router Administration 79
Already?(cid:211) QuizThis w (cid:210)Do I Kno 79
opicsToundation F 83
elsvge LevilePri 83
AccessSecuring Console 84
ordasswCon(cid:222)guring the Enable P 84
etenable secr 86
ord-encryptionservice passw 87
elsvge LevileCon(cid:222)guring Multiple Pri 87
arning BannersW 89
Accesse vInteracti 90
AccessSecuring vty 90
Secure Shell (SSH) Protocol 91
h as an SSH ClientSetting Up a Cisco IOS Router or Switc 91
Port Security for Ethernet Switches 92
ort SecurityCon(cid:222)guring P 93
oundation SummaryF 95
Q&A 96
Part III Authentication, Authorization, and Accounting (AAA) 98
Chapter 6 Authentication 101
Already?(cid:211) QuizThis w (cid:210)Do I Kno 101
opicsToundation F 104
Authentication 104
uthenticationAd assworCon(cid:222)guring Line P 104
uthenticationACon(cid:222)guring Username 105
sRemote Security Server 105
TACACS Overview 106
RADIUS Overview 107
Kerberos Overview 109
AuthenticationAP and CHAP P 109
APP 110
CHAP 110
MS-CHAP 111
oundation SummaryF 112
Q&A 113
Chapter 7 Authentication, Authorization, and Accounting 115
Already?(cid:211) QuizThis w (cid:210)Do I Kno 115
opicsToundation F 119
wervieAAA Ov 119
uthenticationA 119
uthorizationA 120
Accounting 120
2408_CCSP.book Page xiii Thursday, November 13, 2003 2:38 PM
xiii
AAA ServicesCon(cid:222)guring 120
uthenticationAAAA Con(cid:222)guring 121
Configuring Login Authentication Using AAA 122
Enabling Password Protection at the Privileged Level 123
Configuring PPP Authentication Using AAA 124
uthorizationAAAA Con(cid:222)guring 125
AccountingAAA Con(cid:222)guring 128
AAAroubleshooting T 130
oundation SummaryF 133
Q&A 134
Chapter 8 ACACS+ on Cisco IOS SoftwareCon(cid:222)guring RADIUS and T 137
Already?(cid:211) QuizThis w (cid:210)Do I Kno 137
opicsToundation F 140
CS+ on Cisco IOSCAATCon(cid:222)guring 140
uthentication ExamplesACS+ CAAT 141
uthorization ExampleACS+ CAAT 143
Accounting ExampleCS+ CAAT 143
oubleshootingrTCS+ CAATAAA 144
debug aaa authentication 144
debug tacacs 145
debug tacacs events 145
Con(cid:222)guring RADIUS on Cisco IOS 146
uthorization ExampleAuthentication and ARADIUS 148
Accounting Exampleuthorization, and Authentication, ARADIUS 148
ationoubleshooting RADIUS Con(cid:222)gurrTesting and T 150
oundation SummaryF 153
Q&A 154
Chapter 9 Cisco Secure Access Control Server 157
Already?(cid:211) QuizThis w (cid:210)Do I Kno 157
opicsToundation F 161
wsindoWCS for ACisco Secure 161
uthenticationA 162
uthorizationA 164
Accounting 165
Administration 165
Architecturews indoWCS for ACisco Secure 166
CSAdmin 167
uthCSA 167
CSDBSync 168
gCSLo 168
CSMon 168
acacs and CSRadiusCST 168
CS for UNIXACisco 169
2408_CCSP.book Page xiv Thursday, November 13, 2003 2:38 PM
xiv
oundation SummaryF 171
Q&A 172
Chapter 10 Administration of Cisco Secure Access Control Server 175
Already?(cid:211) QuizThis w (cid:210)Do I Kno 175
opicsToundation F 178
CSAactors for Cisco Secure yment FBasic Deplo 178
ementse RequirdwarHar 178
ementsating System RequirOper 178
owser CompatibilityBr 179
CSAInstalling Cisco Secure 179
ested Deployment SequencegSug 181
wsindoWCS for Aroubleshooting Cisco Secure T 182
oblemsuthentication PrA 183
oblemsuthorization PrAoubleshooting rT 183
ation IssuesAdministr 183
oundation SummaryF 185
Q&A 186
Part IV The Cisco IOS Firewall Feature Set 188
Chapter 11 Securing the Network with a Cisco Router 191
Already?(cid:211) QuizThis w (cid:210)Do I Kno 191
opicsToundation F 194
ork Management Protocol (SNMP)Simple Netw 194
owserough a BrThrAccess active olling InterContr 195
Disabling Directed Broadcasts 196
uthenticationAotocol Routing Pr 197
Small Server Services 198
er ServicesingDisabling F 198
otocol (NTP)ime PrTDisabling Network 199
otocol (CDP)very PrDisabling Cisco Disco 199
oundation SummaryF 200
Q&A 201
Chapter 12 Access Lists 203
Already?(cid:211) QuizThis w (cid:210)Do I Kno 203
opicsToundation F 207
Access ListsAre What 207
Access Listse When to Con(cid:222)gur 208
CLsAypes of IP T 208
Standard IP ACLs 208
Extended IP ACLs 212
Reflexive ACLs 212
Time-Based ACLs 213
CLs on a RouterACon(cid:222)guring 214
2408_CCSP.book Page xv Thursday, November 13, 2003 2:38 PM
xv
oundation SummaryF 216
Q&A 217
Chapter 13 The Cisco IOS Firewall 219
Already?(cid:211) QuizThis w (cid:210)Do I Kno 219
opicsToundation F 222
all Feature SetwThe Cisco IOS Fire 222
oxyuthentication PrA 223
otectionDoS Pr 224
ailrTudit Aging and gLo 224
Intrusion Detection 224
o-Application Mappingort-TP 225
System-Defined Port Mapping 225
User-Defined Port Mapping 227
Host-Specific Port Mapping 227
oundation SummaryF 228
Q&A 229
Chapter 14 Context-Based Access Control (CBAC) 231
Already?(cid:211) QuizThis w (cid:210)Do I Kno 231
opicsToundation F 235
Access ControlContent-Based 235
otectionDoS Detection and Pr 235
ailsrTudit AAlerts and 236
orksWC AHow CB 236
UDP Sessions 237
ACL Entries 238
C RestrictionsACB 238
otocolsSupported Pr 238
erformance ImpactMemory and P 239
CACon(cid:222)guring CB 239
Select an Interface 239
CLs at the InterfaceAe IP Con(cid:222)gur 240
esholdsThrimeouts and Te Global Con(cid:222)gur 240
De(cid:222)ne an Inspection Rule 241
Configure Generic TCP and UDP Inspection 243
Configure Java Inspection 243
Apply the Inspection Rule to an Interface 244
CAugging CBerifying and DebV 244
olAccess Contrxt-Based ging ConteugDeb 244
Generic debug Commands 245
Transport Level debug Commands 245
ation ExampleC Con(cid:222)gurACB 245
oundation SummaryF 247
Q&A 248
2408_CCSP.book Page xvi Thursday, November 13, 2003 2:38 PM
xvi
Chapter 15 Authentication Proxy and the Cisco IOS Firewall 251
Already?(cid:211) QuizThis w (cid:210)Do I Kno 251
opicsToundation F 255
Authentication ProxyUnderstanding 255
orksWoxy uthentication PrAHow 255
eoxy Looks Likuthentication PrAWhat 256
allwAuthentication Proxy and the Cisco IOS Fire 258
allwAuthentication Proxy on the Cisco IOS FireCon(cid:222)guring 258
ation Stepsoxy Con(cid:222)guruthentication PrA 259
Step 1: Configure AAA 260
Step 2: Configure the HTTP Server 261
Step 3: Configure the Authentication Proxy 261
Step 4: Verify the Authentication Proxy Configuration 262
ation Examplesoxy Con(cid:222)guruthentication PrA 263
CS+CAATAuthentication Proxy with Using 266
ationStep 1: Complete the Network Con(cid:222)gur 267
ationStep 2: Complete the Interface Con(cid:222)gur 268
oup SetupStep 3: Complete the Gr 269
Authentication Proxy with RADIUSUsing 270
Authentication ProxyLimitations of 272
oundation SummaryF 274
Q&A 276
Chapter 16 Intrusion Detection and the Cisco IOS Firewall 279
Already?(cid:211) QuizThis w (cid:210)Do I Kno 279
opicsToundation F 283
all IDS FeatureswCisco IOS Fire 283
Compatibility with the CSIDS 284
all IDS Con(cid:222)gurationwCisco IOS Fire 285
wall IDS on the RoutereirInitialize the Cisco IOS F 286
Configuring the Notification Type 286
Configure the IOS Firewall IDS and Central Management Post Office Parameters 286
Define the Protected Network 288
Configure the Router Maximum Queue for Alarms 288
esk SignaturAttace Info and Con(cid:222)gur 288
udit RulesAApply eate and Cr 290
Configure the Default Actions 290
Create the IDS Audit Rule 291
Create the IDS Audit Exclusions 291
Apply the IDS Audit Rule 292
ementgalized Manawall IDS to the CentreirAdd the Cisco IOS F 292
all IDS Con(cid:222)gurationwerifying the Cisco IOS FireV 292
giesyment Strateall IDS DeplowCisco IOS Fire 295
2408_CCSP.book Page xvii Thursday, November 13, 2003 2:38 PM
xvii
oundation SummaryF 296
Q&A 298
Part V irtual Private NetworksV 300
Chapter 17 Building a VPN Using IPSec 303
Already?(cid:211) QuizThis w (cid:210)Do I Kno 303
opicsToundation F 307
yseCon(cid:222)guring a Cisco Router for IPSec Using Preshared K 309
orksWHow IPSec 309
sameterarStep 1: Select the IKE and IPSec P 310
Define the IKE (Phase 1) Policy 311
Define the IPSec Policies 313
Verify the Current Router Configuration 317
Verify Connectivity 317
Ensure Compatible Access Lists 318
e IKEStep 2: Con(cid:222)gur 318
Enable IKE 319
Create the IKE Policy 319
Configure Preshared Key 319
Verify the IKE Configuration 320
e IPSecStep 3: Con(cid:222)gur 321
Create the IPSec Transform Set 322
Configure IPSec SA Lifetimes 323
Create the Crypto ACLs 323
Create the Crypto Map 324
Apply the Crypto Map to the Correct Interface 325
ationerify the IPSec Con(cid:222)gurVest and TStep 4: 326
Con(cid:222)guring Manual IPSec 328
Con(cid:222)guring IPSec Using RSA Encrypted Nonces 328
ysee the RSA KCon(cid:222)gur 329
Plan the Implementation Using RSA Keys 329
Configure the Router Host Name and Domain Name 330
Generate the RSA Keys 330
Enter Your Peer RSA Public Keys 330
Verify the Key Configuration 331
Manage the RSA Keys 332
oundation SummaryF 333
yseCon(cid:222)gure a Cisco Router for IPSec Using Preshared K 333
erifying the IKE and IPSec Con(cid:222)gurationV 334
arding Con(cid:222)guring IPSec Manually and Using RSA Encrypted NoncesgExplain the Issues Re 335
Q&A 336
Chapter 18 Scaling a VPN Using IPSec with a Certi(cid:222)cate Authority 339
Already?(cid:211) QuizThis w (cid:210)Do I Kno 339
2408_CCSP.book Page xviii Thursday, November 13, 2003 2:38 PM
xviii
opicsToundation F 343
VPNs Using Cisco Routers and CAsanced IPSec Adv 343
w of Cisco Router CA SupportOvervie 343
VPNs Using CA SupportCon(cid:222)guring the Cisco Router for IPSec 345
Step 1: Select the IKE and IPSec Parameters 345
Step 2: Configure the Router CA Support 346
Step 3: Configure IKE Using RSA Signatures 353
Step 4: Configure IPSec 354
Step 5: Test and Verify the Configuration 355
oundation SummaryF 356
VPNs Using Cisco Routers and CAsanced IPSec Adv 356
Q&A 357
Chapter 19 Con(cid:222)guring Remote Access Using Easy VPN 359
Already?(cid:211) QuizThis w (cid:210)Do I Kno 359
opicsToundation F 362
erVPN ServDescribe the Easy 362
VPN Server FunctionalityEasy 363
VPN ServerCon(cid:222)guring the Easy 364
Prepare the Router for Easy VPN Server 365
Configure the Group Policy Lookup 366
Create the ISAKMP Policy for the Remote VPN Clients 366
Define a Group Policy for a Mode Configuration Push 367
Create the Transform Set 368
Create the Dynamic Crypto Maps with Reverse Route Injection (RRI) 368
Apply the Mode Configuration to the Dynamic Crypto Map 369
Apply the Dynamic Crypto Map to the Interface 369
Enable IKE DPD 370
Configure xauth 370
ationVPN Modes of OperEasy 371
oundation SummaryF 372
erVPN ServDescribe the Easy 372
VPN Server FunctionalityEasy 372
VPN ServerCon(cid:222)guring the Easy 372
ationVPN Modes of OperEasy 375
Q&A 376
Chapter 20 Scaling Management of an Enterprise VPN Environment 379
Already?(cid:211) QuizThis w (cid:210)Do I Kno 379
opicsToundation F 383
VPN RoutersManaging Enterprise 383
orks 2000CiscoW 383
ement Solution (VMS)gVPN/Security Mana 385
s (Router MC)VPN Routerement Center for gMana 385
Concepts of the Router MC 386
2408_CCSP.book Page xix Thursday, November 13, 2003 2:38 PM
xix
gieshnoloecTunneling TSupported 388
orks Common Servicesation with CiscoWgrRouter MC Inte 389
gin to Router MCInstallation and Lo 389
Connecting to the Router MC 392
ork(cid:223)owWRouter MC 392
oundation SummaryF 395
VPN RoutersManaging Enterprise 395
Q&A 398
Part VI Scenarios 400
Chapter 21 Final Scenarios 403
All Locationsask 1: Secure the Routers at T 404
sAll the RouterAccess on ative AdministrAll e Chang 405
AAAuthentication Using Ae Local Database Con(cid:222)gur 406
sAccess of the Routere Method for Remote e a SecurCon(cid:222)gur 406
Disable Unnecessary Services 407
Antispoo(cid:222)ng PurposesCLs for AImplement 408
vityask 2: Secure Site-to-Site ConnectiT 409
sameteraration PVPN Con(cid:222)gurDe(cid:222)ne 409
sameterare the IKE PCon(cid:222)gur 411
sameterare the IPSec PCon(cid:222)gur 413
CLsAe Con(cid:222)gur 414
Apply Crypto Mapseate and Cr 414
ask 3: Con(cid:222)gure CA SupportT 416
e Host Name and Domain NameCon(cid:222)gur 416
e NTPCon(cid:222)gur 417
oll with the CAEnr 418
Accessask 4: Secure Remote T 419
orkask 5: Secure the Enterprise NetwT 420
wall IDSeirImplement the Cisco IOS F 420
oxyuthentication PrAImplement 423
CAImplement CB 424
Appendix Answers to the (cid:210)Do I Know This Already?(cid:211) Quizzes and Q&A Sections 427
Chapter 1 427
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 427
Q&A 427
Chapter 2 429
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 429
Q&A 430
Chapter 3 432
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 432
Q&A 432
2408_CCSP.book Page xx Thursday, November 13, 2003 2:38 PM
xx
Chapter 4 433
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 433
Q&A 433
Chapter 5 435
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 435
Q&A 435
Chapter 6 437
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 437
Q&A 437
Chapter 7 438
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 438
Q&A 438
Chapter 8 440
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 440
Q&A 440
Chapter 9 441
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 441
Q&A 442
Chapter 10 443
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 443
Q&A 443
Chapter 11 444
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 444
Q&A 445
Chapter 12 446
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 446
Q&A 446
Chapter 13 448
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 448
Q&A 448
Chapter 14 449
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 449
Q&A 449
Chapter 15 451
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 451
Q&A 451
Chapter 16 452
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 452
Q&A 453
Chapter 17 454
eady?(cid:211) QuizAlrThis (cid:210)Do I Know 454
Q&A 454
