Table of Contents
Introduction.
I. SECURITY OVERVIEW AND
FIREWALLS.
1. Security Threats.
Planning for Security.
Diverse Platforms.
Security Goals.
Causes of Security Problems.
Policy Definitions.
Computer Technologies.
Equipment Configurations.
Types of Security Threats.
External and Internal Threats.
Unstructured and Structured
Threats.
Categories of Threats.
Reconnaissance Attacks.
Access Attacks.
Denial of Service Attacks.
Security Solutions.
Designing a Security Solution.
The Cisco Security Wheel.
Security Checklist.
Additional Information.
Summary.
2. Introduction to Firewalls.
Firewall Overview.
Definition of a Firewall.
Firewall Protection.
Controlling Traffic and
the OSI Reference Model.
OSI Reference Model Overview.
Firewalls and the OSI Reference
Model.
Firewall Categories.
Packet-Filtering Firewalls.
Stateful Firewalls.
Application Gateway Firewalls.
Address-Translation Firewalls.
Host-Based Firewalls.
Hybrid Firewalls.
Firewalls and Other Services.
Firewall Design.
Design Guidelines.
DMZ.
Components.
Component Placement.
Firewall Implementation.
Firewall Administration
and Management.
Cisco IOS Security.
Cisco IOS Uses.
Cisco IOS Security Features.
Cisco IOS Devices and Their
Uses.
When to Use a Cisco IOS
Firewall.
Summary.
II. MANAGING ACCESS TO ROUTERS.
3. Accessing a Router.
Types of Authentication.
No Password Authentication.
Static Password Authentication.
Aging Password Authentication.
One-Time Password Authentication.
Token Card Services.
Methods of User EXEC
Access.
Local Access: Console and
Auxiliary.
Remote Access.
Privileged EXEC Access.
Passwords.
Privilege Levels.
Other Access Items.
Encrypting Passwords.
Banners.
Example Configuration.
Summary.
4. Disabling Unnecessary
Services.
Disabling Global Services.
Cisco Discovery Protocol.
TCP and UDP Small Servers.
Finger.
IdentD.
IP Source Routing.
FTP and TFTP.
HTTP.
SNMP.
Name Resolution.
BootP.
DHCP.
PAD.
Configuration Autoloading.
Disabling Interface Services.
CDP on Insecure Interfaces.
Proxy ARP.
Directed Broadcasts.
ICMP Messages.
Maintenance Operation Protocol.
VTYs.
Unused Interfaces.
Manual Configuration
Example of Disabling Services on a Perimeter Router.
AutoSecure.
Securing Planes.
AutoSecure Configuration.
Summary.
5. Authentication, Authorization,
and Accounting.
AAA Overview.
AAA Functions.
Enabling AAA.
Security Protocols.
Authentication.
Methods of Authentication.
Authentication Configuration.
Authentication Troubleshooting.
Authentication Example.
Authorization.
Methods of Authorization.
Authorization Configuration.
Authorization Troubleshooting.
Authorization Example.
Accounting.
Methods of Accounting.
Accounting Configuration.
Accounting Troubleshooting.
Accounting Example.
Secure Copy.
Preparation for SCP.
SCP Configuration.
SCP Troubleshooting.
SCP Example.
Summary.
III. NONSTATEFUL FILTERING
TECHNOLOGIES.
6. Access List Introduction.
Access List Overview.
ACLs and Filtering.
Types of ACLs.
Processing ACLs.
Basic ACL Configuration.
Creating ACLs.
Activating ACLs.
Editing ACLs.
Wildcard Masks.
Converting a Subnet Mask
to a Wildcard Mask.
Wildcard Mask Mistakes.
Summary.
7. Basic Access Lists.
Types of ACLs.
Standard ACLs.
Extended ACLs.
ACL Verification.
Fragments and Extended
ACLs.
Timed ACLs.
Additional ACL Features.
ACL Remarks.
Logging Updates.
IP Accounting and ACLs.
Turbo ACLs.
Sequenced ACLs.
Protection Against Attacks.
Bogon Blocking and Spoofing.
DoS and Distributed DoS
Attacks.
Simple Reconnaissance Attacks.
Distributed DoS Attacks.
Trojan Horses.
Worms.
Blocking Unnecessary
Services.
An Uphill Battle.
Instant-Messenger Products.
File Sharing: Peer-to-Peer
Products.
Summary.
IV. STATEFUL AND ADVANCED
FILTERING TECHNOLOGIES.
8. Reflexive Access Lists.
Overview of Reflexive
ACLs.
Extended Versus Reflexive
ACLs.
Reflexive ACLs in Action.
Limitations of Reflexive
ACLs.
Configuring Reflexive
ACLs.
Interface Selection.
Configuration Commands.
Reflexive ACL Examples.
Summary.
9. Context-Based Access
Control.
Cisco IOS Firewall Features.
CBAC Functions.
Filtering Traffic.
Inspecting Traffic.
Detecting Intrusions.
Generating Alerts and Audits.
Operation of CBAC.
Basic Operation.
CBAC Enhancements over
RACLs.
Supported Protocols for
CBAC.
RTSP Applications.
H.323 Applications.
Skinny Support.
SIP Support.
CBAC Performance.
Throughput Improvement
Feature.
Connections Per Second
Improvement Feature.
CPU Utilization Improvement
Feature.
CBAC Limitations.
CBAC Configuration.
Step 1: Interface Selection.
Step 2: ACL Configuration.
Step 3: Global Timeouts.
Step 4: Port Application
Mapping.
Step 5: Inspection Rules.
Step 6: Inspection Activation.
Step 7: Troubleshooting
CBAC.
CBAC Removal.
CBAC Examples.
Summary.
10. Filtering Web and Application
Traffic.
Java Applets.
Java Inspection.
Java Blocking .
Java Blocking Example.
URL Filtering.
Operation of URL Filtering.
Advantages and Limitations
of URL Filtering.
URL Filtering Implementation.
URL Filtering Verification.
URL Filtering Example.
Network-Based Application
Recognition.
Components of QoS.
NBAR and Classification.
NBAR Restrictions and Limitations.
Basic NBAR Configuration.
NBAR Verification.
NBAR Examples.
Summary.
V. ADDRESS TRANSLATION AND
FIREWALLS.
11. Address Translation.
Address Translation Overview.
Private Addresses.
Address Translation.
How Address Translation
Works.
Terms Used in Address Translation.
Performing Address Translation.
Limitations of Address
Translation.
Address Translation Configuration.
Configuration of NAT.
Configuration of PAT.
Configuration of Port Address
Redirection.
Dealing with Overlapping
Addresses.
Configuration of Traffic
Distribution.
Configuration of Translation
Limits.
Verifying and Troubleshooting
Address Translation.
NAT and CBAC Example.
Summary.
12. Address Translation
Issues.
Embedded Addressing Information.
Problem with Embedding
Addressing Information.
Supported Protocols and
Applications.
Nonstandard Port Numbers.
Controlling Address Translation.
Using ACLs.
Using Route Maps: Dynamic
Translations.
Using Route Maps: Static
Translations.
Address Translation and
Redundancy.
Static NAT Redundancy with
HSRP.
Stateful Address Translation
Failover.
Traffic Distribution
with Server Load Balancing.
SLB Process.
SLB Advantages and Limitations.
SLB Configuration.
SLB Verification.
SLB Example.
Summary.
VI. MANAGING ACCESS THROUGH
ROUTERS.
13. Lock-and-Key Access
Lists.
Lock-and-Key Overview.
Lock-and-Key and Normal
ACLs.
When to Use Lock-and-Key.
Lock-and-Key Benefits.
Lock-and-Key Process.
Lock-and-Key Configuration.
Configuration Steps.
Allowing Remote Administration
Access.
Verification and Troubleshooting.
Lock-and-Key Example.
Summary.
14. Authentication
Proxy.
Introduction to AP.
AP Features.
AP Process.
AP Usage.
Limitations of AP.
AP Configuration.
Configuring AAA on Your
Router.
Configuring AAA on Your
Server.
Preparing for HTTP or HTTPS.
Configuring AP Policies.
Tuning AP.
Protecting Against Access
Attacks.
Verifying and Troubleshooting
AP.
show Commands.
clear Commands.
debug Commands.
AP Examples.
Simple AP Example.
Complex AP Example: CBAC
and NAT.
Summary.
15. Routing Protocol Protection.
Static and Black Hole
Routing.
Static Routes.
Null Routes.
Policy-Based Routing.
Interior Gateway Protocol
Security.
Authentication.
RIPv2.
EIGRP.
OSPF.
IS-IS.
Other Tools.
HSRP.
BGP Security.
Reverse-Path Forwarding
(Unicast Traffic).
RPF Process.
RPF Usage.
RPF Limitations.
RPF Configuration.
RPF Verification.
Unicast RPF Example.
Summary.
VII. DETECTING AND PREVENTING
ATTACKS.
16. Intrusion-Detection
System.
IDS Introduction.
IDS Implementations.
IDS Solutions.
IDS Concerns.
IDS Signatures.
Cisco Router IDS Solution.
Signature Support.
Router IDS Process.
Memory and Performance
Issues.
IDS Configuration.
Step 1: Initialization
Configuration.
Step 2: Logging and PostOffice
Configuration.
Step 3: Audit Rule Configuration
and Activation.
IDS Verification.
IDS Example.
Summary.
17. DoS Protection.
Detecting DoS Attacks.
Common Attacks.
Symptoms of Attacks.
Examining CPU Utilization
to Detect DoS Attacks.
Using ACLs to Detect DoS
Attacks.
Using NetFlow to Detect
DoS Attacks.
CEF Switching.
TCP Intercept.
TCP SYN Flood Attacks.
TCP Intercept Modes.
TCP Intercept Configuration
and Verification.
CBAC and DoS Attacks.
Timeouts and Thresholds.
CBAC DoS Prevention Verification.
CBAC Example Configuration.
Rate Limiting.
ICMP Rate Limiting.
CAR.
NBAR.
Summary.
18. Logging Events.
Basic Logging.
Log Message Format.
Basic Logging Configuration.
Logging Destinations.
Other Logging Commands.
Logging Verification.
Logging and Error Counts.
Time and Date and the
Cisco IOS.
Router Time Sources.
Manual Time and Date Configuration.
Network Time Protocol Overview.
Router Client Configuration
for NTP.
Router Server Configuration
for NTP.
NTP Security.
Other NTP Commands.
NTP Verification.
NTP Configuration Example.
Embedded Syslog Manager.
ESM Overview.
ESM Filter Modules.
Introduction to ESM Setup
and Configuration.
Additional Logging Information.
What to Look For.
Additional Tools.
Summary.
VIII. VIRTUAL PRIVATE NETWORKS.
19. IPSec Site-to-Site Connections.
IPSec Preparation.
Basic Tasks.
External ACL.
IKE Phase 1: Management
Connection.
Enabling ISAKMP/IKE.
Defining IKE Phase 1 Policies.
IKE Phase 1 Peer Authentication.
Identity Type.
Authentication with Preshared
Keys.
Authentication with RSA
Encrypted Nonces.
Authentication with Certificates.
IKE Phase 2: Data Connection.
Step 1: Building a Crypto
ACL.
Step 2: Creating a Transform
Set.
Step 3: Creating a Crypto
Map.
Step 4: Activating a Crypto
Map.
Step 5: Verifying a Crypto
Map Configuration.
IPSec Connection Troubleshooting.
Examining SAs.
Using debug Commands.
Clearing Connections.
L2L Example.
Summary.
20. IPSec Remote-Access
Connections.
Remote Access Overview.
EasyVPN Introduction.
EasyVPN IPSec Support.
EasyVPN Features.
IPSec Remote-Access Connection
Process.
Step 1: The EVC Initiates
an IPSec Connection.
Step 2: The EVC Sends the
IKE Phase 1 Policies.
Step 3: The EVS Accepts
an IKE Phase 1 Policy.
Step 4: The EVS Authenticates
the User.
Step 5: The EVS Performs
IKE Mode Config.
Step 6: The EVS Handles
Routing with RRI.
Step 7: The IPSec Devices
Build the Data Connections.
IPSec Remote-Access EVS
Setup.
Configuration Process.
Task 1: Authentication
Policies.
Task 2: Group Policies.
Task 3: IKE Phase 1 Policies.
Task 4: Dynamic Crypto
Maps.
Task 5: Static Crypto Map.
Task 6: Remote-Access Verification.
IPSec Remote Access Example.
Summary.
IX. CASE STUDY.
21. Case Study.
Company Profile.
Corporate Office.
Branch Office.
Remote-Access Users.
Proposal.
Case Study Configuration.
Basic Configuration.
Unnecessary Services and
SSH.
AAA.
Access Control Lists.
CBAC and Web Filtering.
Address Translation.
Routing.
Intrusion-Detection System.
Connection Attacks and
CBAC.
Rate Limiting.
NTP and Syslog.
Site-to-Site VPN.
Remote-Access VPNs.
Summary.
Index.