Table Of ContentCCNA Security
Eric L. Stewart
CCNA Security Exam Cram Associate Publisher
Copyright©2009 by Pearson Education, Inc. David Dusthimer
All rights reserved. No part of this book shall be reproduced, stored in a retrieval sys-
tem, or transmitted by any means, electronic, mechanical, photocopying, recording, or Executive Editor
otherwise, without written permission from the publisher. No patent liability is Brett Bartow
assumed with respect to the use of the information contained herein. Although every
precaution has been taken in the preparation of this book, the publisher and author Development Editor
assume no responsibility for errors or omissions. Nor is any liability assumed for dam-
Andrew Cupp
ages resulting from the use of the information contained herein.
ISBN-13: 978-0-7897-3800-4
Managing Editor
ISBN-10: 0-7897-3800-7
Patrick Kanouse
Library of Congress Cataloging-in-Publication Data
Stewart, Eric L. Project Editor
CCNA security exam cram / Eric L. Stewart. Mandie Frank
p. cm.
Includes bibliographical references and index. Copy Editor
ISBN-13: 978-0-7897-3800-4 (pbk. w/cd) Water Crest
ISBN-10: 0-7897-3800-7 (pbk. w/cd) Publishing
1. Computer networks--Security measures--Examinations--Study guides.
Indexer
2. Cisco Systems, Inc. I. Title.
Ken Johnson
TK5105.59.S758 2009
005.8076--dc22 Proofreader
2008038852 Leslie Joseph
Printed in the United States of America
First Printing: October 2008 Technical Editors
Trademarks William G. Huisman
All terms mentioned in this book that are known to be trademarks or service marks Ryan Lindfield
have been appropriately capitalized. Que Publishing cannot attest to the accuracy of
this information. Use of a term in this book should not be regarded as affecting the Publishing
validity of any trademark or service mark. Coordinator
Cisco, Cisco Systems, and CCNA are registered trademarks of Cisco Systems, Inc. or Vanessa Evans
its affiliates in the U.S. and certain other countries. All other trademarks mentioned in
this book are the property of their respective owners.
Multimedia
Warning and Disclaimer Developer
Every effort has been made to make this book as complete and as accurate as possi- Dan Scherf
ble, but no warranty or fitness is implied. The information provided is on an “as is”
basis. The author and the publisher shall have neither liability nor responsibility to any
Book Designer
person or entity with respect to any loss or damages arising from the information con-
Gary Adair
tained in this book or from the use of the CD or programs accompanying it.
Bulk Sales
Composition
Que Publishing offers excellent discounts on this book when ordered in quantity for
TnT Design, Inc.
bulk purchases or special sales. For more information, please contact
U.S. Corporate and Government Sales
1-800-382-3419
[email protected]
For sales outside the United States, please contact
International Sales
[email protected]
Contents at a Glance
Introduction 1
Self Assessment 5
Part I: Network Security Architecture
CHAPTER 1: Network Insecurity 15
CHAPTER 2: Building a Secure Network Using Security Controls 51
Part II: Perimeter Security
CHAPTER 3: Security at the Network Perimeter 87
CHAPTER 4: Implementing Secure Management and Hardening the Router 147
Part III: Augmenting Depth of Defense
CHAPTER 5: Using Cisco IOS Firewalls to Implement a Network
Security Policy 185
CHAPTER 6: Introducing Cryptographic Services 245
CHAPTER 7: Virtual Private Networks with IPsec 291
CHAPTER 8: Network Security Using Cisco IOS IPS 341
Part IV: Security Inside the Perimeter
CHAPTER 9: Introduction to Endpoint, SAN, and Voice Security 395
CHAPTER 10: Protecting Switch Infrastructure 421
Part V: Practice Exams and Answers
Practice Exam 1 443
Answers to Practice Exam 1 461
Practice Exam 2 471
Answers to Practice Exam 2 487
Part VI: Appendixes
A: What’s on the CD-ROM 499
B: Need to Know More? 503
Index 507
Table of Contents
Introduction.........................................................1
Organization and Elements of This Book..........................1
Contacting the Author..........................................4
Self Assessment.....................................................5
Who Is a CCNA Security? ......................................5
The Ideal CCNA Security Candidate .............................6
Put Yourself to the Test .........................................8
Exam Topics for 640-553 IINS (Implementing Cisco
IOS Network Security) .......................................10
Strategy for Using This Exam Cram.............................12
Part I: Network Security Architecture
Chapter 1:
Network Insecurity..................................................15
Exploring Network Security Basics and the Need for
Network Security............................................16
The Threats.............................................16
Other Reasons for Network Insecurity ......................18
The CIA Triad...........................................18
Data Classification .......................................21
Security Controls ........................................22
Incident Response........................................25
Laws and Ethics .........................................26
Exploring the Taxonomy of Network Attacks .....................29
Adversaries..............................................30
How Do Hackers Think? .................................32
Concepts of Defense in Depth.............................32
IP Spoofing Attacks ......................................34
Attacks Against Confidentiality.............................36
Attacks Against Integrity ..................................38
Attacks Against Availability................................42
Best Practices to Thwart Network Attacks........................45
Administrative Controls...................................45
Technical Controls .......................................46
Physical Controls ........................................46
Exam Prep Questions..........................................47
Answers to Exam Prep Questions ...............................50
Chapter 2:
Building a Secure Network Using Security Controls .......................51
Defining Operations Security Needs.............................52
Cisco System Development Life Cycle for Secure Networks ...52
Operations Security Principles.............................54
Network Security Testing .................................55
Disaster Recovery and Business Continuity Planning..........59
Establishing a Comprehensive Network Security Policy ............61
Defining Assets ..........................................62
The Need for a Security Policy ............................63
Policies.................................................64
Standards, Guidelines, and Procedures ......................65
Who Is Responsible for the Security Policy?.................66
Risk Management........................................67
Principles of Secure Network Design .......................70
Examining Cisco’s Model of the Self-Defending Network ..........73
Where Is the Network Perimeter?..........................73
Building a Cisco Self-Defending Network...................74
Components of the Cisco Self-Defending Network...........75
Cisco Integrated Security Portfolio.........................79
Exam Prep Questions..........................................81
Answers to Exam Prep Questions ...............................84
Part II: Perimeter Security
Chapter 3:
Security at the Network Perimeter .....................................87
Cisco IOS Security Features....................................88
Where Do You Deploy an IOS Router?.....................88
Cisco ISR Family and Features.............................90
vi
CCNA Security Exam Cram
Securing Administrative Access to Cisco Routers ..................91
Review Line Interfaces....................................92
Password Best Practices...................................94
Configuring Passwords....................................94
Setting Multiple Privilege Levels...........................97
Configuring Role-Based Access to the CLI ..................98
Configuring the Cisco IOS Resilient Configuration Feature...101
Protecting Virtual Logins from Attack .....................102
Configuring Banner Messages ............................104
Introducing Cisco SDM ......................................105
Files Required to Run Cisco SDM from the Router..........106
Using Cisco SDM Express ...............................107
Launching Cisco SDM ..................................108
Cisco SDM Smart Wizards...............................110
Advanced Configuration with SDM........................111
Cisco SDM Monitor Mode...............................113
Configuring Local Database AAA on a Cisco Router..............114
Authentication, Authorization, and Accounting (AAA)........114
Two Reasons for Implementing AAA on Cisco Routers.......114
Cisco’s Implementation of AAA for Cisco Routers ...........115
Tasks to Configure Local Database AAA on a Cisco Router...116
Additional Local Database AAA CLI Commands............120
Configuring External AAA on a Cisco Router Using
Cisco Secure ACS ..........................................121
Why Use Cisco Secure ACS?.............................123
Cisco Secure ACS Features...............................123
Cisco Secure ACS for Windows Installation Requirements....124
Cisco Secure ACS Solution Engine and Cisco Secure
ACS Express 5.0 Comparison............................125
TACACS+ or RADIUS? .................................125
Prerequisites for Cisco Secure ACS........................126
Three Main Tasks for Setting Up External AAA.............127
Troubleshooting/Debugging Local AAA, RADIUS,
and TACACS+ ........................................140
AAA Configuration Snapshot.............................141
Exam Prep Questions.........................................142
Answers to Exam Prep Questions ..............................145
vii
Contents
Chapter 4:
Implementing Secure Management and Hardening the Router.............147
Planning for Secure Management and Reporting.................148
What to Log ...........................................149
How to Log............................................150
Reference Architecture for Secure Management
and Reporting.........................................151
Secure Management and Reporting Guidelines..............153
Logging with Syslog.....................................153
Cisco Security MARS....................................154
Where to Send Log Messages.............................154
Log Message Levels.....................................155
Log Message Format ....................................156
Enabling Syslog Logging in SDM.........................156
Using SNMP...........................................157
Configuring the SSH Daemon............................161
Configuring Time Features...............................165
Using Cisco SDM and CLI Tools to Lock Down the Router.......167
Router Services and Interface Vulnerabilities................167
Performing a Security Audit..............................172
Exam Prep Questions.........................................180
Answers to Exam Prep Questions ..............................182
Part III: Augmenting Depth of Defense
Chapter 5:
Using Cisco IOS Firewalls to Implement a Network Security Policy .........185
Examining and Defining Firewall Technologies ..................187
What Is a Firewall?......................................188
Characteristics of a Firewall ..............................189
Firewall Advantages .....................................189
Firewall Disadvantages...................................190
Role of Firewalls in a Layered Defense Strategy.............190
Types of Firewalls.......................................190
Cisco Family of Firewalls.................................201
Firewall Implementation Best Practices ....................202
Creating Static Packet Filters with ACLs........................203
Threat Mitigation with ACLs.............................203
Inbound Versus Outbound ...............................203
viii
CCNA Security Exam Cram
Identifying ACLs .......................................205
ACL Examples Using the CLI............................205
ACL Guidelines ........................................208
Using the Cisco SDM to Configure ACLs..................209
Using ACLs to Filter Network Services....................212
Using ACLs to Mitigate IP Address Spoofing Attacks........213
Using ACLs to Filter Other Common Services..............216
Cisco Zone-Based Policy Firewall Fundamentals .................218
Advantages of ZPF......................................220
Features of ZPF ........................................221
ZPF Actions............................................221
Zone Behavior..........................................221
Using the Cisco SDM Basic Firewall Wizard to
Configure ZPF........................................224
Manually Configuring ZPF with the Cisco SDM............233
Monitoring ZPF........................................238
Exam Prep Questions.........................................241
Answers to Exam Prep Questions ..............................244
Chapter 6:
Introducing Cryptographic Services ...................................245
Cryptology Overview.........................................246
Cryptanalysis...........................................249
Encryption Algorithm (Cipher) Desirable Features ..........251
Symmetric Key Versus Asymmetric Key
Encryption Algorithms .................................251
Block Versus Stream Ciphers .............................254
Which Encryption Algorithm Do I Choose?................255
Cryptographic Hashing Algorithms........................256
Principles of Key Management............................256
Other Key Considerations................................257
SSL VPNs.............................................259
Exploring Symmetric Key Encryption ..........................261
DES ..................................................263
3DES .................................................264
AES...................................................265
ix
Contents
SEAL .................................................266
Rivest Ciphers (RC).....................................267
Exploring Cryptographic Hashing Algorithms and
Digital Signatures...........................................268
HMACs ...............................................270
Message Digest 5 (MD5).................................271
Secure Hashing Algorithm 1 (SHA-1)......................272
Digital Signatures.......................................272
Exploring Asymmetric Key Encryption and Public
Key Infrastructure ..........................................275
Encryption with Asymmetric Keys.........................276
Authentication with Asymmetric Keys......................277
Public Key Infrastructure Overview........................277
PKI Topologies.........................................278
PKI and Usage Keys.....................................279
PKI Server Offload and Registration Authorities (RAs).......280
PKI Standards..........................................280
Certificate Enrollment Process............................282
Certificate-Based Authentication ..........................283
Certificate Applications ..................................284
Exam Prep Questions.........................................286
Answers to Exam Prep Questions ..............................289
Chapter 7:
Virtual Private Networks with IPsec...................................291
Overview of VPN Technology.................................292
Cisco VPN Products ....................................293
VPN Benefits ..........................................293
Site-to-Site VPNs.......................................294
Remote-Access VPNs ...................................295
Cisco IOS SSL VPN ....................................296
Cisco VPN Product Positioning...........................297
VPN Clients ...........................................299
Hardware-Accelerated Encryption.........................300
IPsec Compared to SSL..................................301
