Here’s the information you need to know for the CCSP exams—the goods that you’ll learn in this book. This book is broken into five parts:
Part I—Chapters 1 through 9—focuses on the SECUR exam.
Part II—Chapters 10 through 15—focuses on the CSPFA exam.
Part III—Chapters 16 through 19—focuses on the CSVPN exam.
Part IV—Chapters 20 through 26—focuses on the CSIDS exam.
Part V—Chapters 27 through 30—focuses on the CSI exam.
Chapter 1, “Introduction to Network Security,” introduces you to network security and the basic threats you need to be aware of. Chapter 1 also describes the types of weaknesses that might exist on your network. All organizations must have a well-documented policy; this chapter explains how to develop a solid corporate network security policy and outlines what guidelines it should include.
Chapter 2, “Introduction to AAA Security,” is an introduction to the Cisco Network Access Server (NAS) and AAA security. Chapter 2 explains how to configure a Cisco NAS router for authentication, authorization, and accounting.
4422Book.fm Page xxxv Saturday, January 29, 2005 9:49 PM
xxxvi Introduction
Chapter 3, “Configuring Cisco Secure ACS and TACACS+,” explains how to install, configure, and administer the Cisco Secure ACS on Windows 2000 and Windows NT servers. (Chapter 3 also briefly describes the Cisco Secure ACS on Unix servers.) In addition, this chapter describes how the NAS can use either TACACS+ or RADIUS to communicate user access requests to the ACS.
Chapter 4, “Cisco Perimeter Router Problems and Solutions,” introduces you to the Cisco perimeter router and the problems that can occur from hackers to a perimeter router on your network. This chapter also describes how you can implement solutions to these problems.
Chapter 5, “Context-Based Access Control Configuration,” introduces you to the Cisco IOS Firewall and one of its main components, Context-Based Access Control (CBAC). Chapter 5 explains how CBAC is both different and better than just running static ACLs when it comes to protecting your network.
Chapter 6, “Cisco IOS Firewall Authentication and Intrusion Detection,” discusses the IOS Firewall Authentication Proxy, which allows you to create and apply access control policies to individuals rather than to addresses. In addition, this chapter also explains the IOS Firewall Intrusion Detection System (IDS), which allows your IOS router to act as a Cisco Secure IDS sensor would, spotting and reacting to potentially inappropriate or malicious packets.
Chapter 7, “Understanding Cisco IOS IPSec Support,” introduces the concept of virtual private networks (VPNs) and explains the solutions to meet your company’s off-site network access needs. Chapter 7 also describes how VPNs use IP Security (IPSec) to provide secure communications over public networks.
Chapter 8, “Cisco IPSec Pre-shared Keys and Certificate Authority Support,” explains how to configure IPSec for pre-shared keys—the easiest of all the IPSec implementations—and how to configure site-to-site IPSec for certificate authority support.
Chapter 9, “Cisco IOS Remote Access Using Cisco Easy VPN,” covers a cool development in VPN technology—Cisco Easy VPN. Cisco Easy VPN is a new feature in IOS that allows any capable IOS router to act as a VPN server.
Chapter 10, “PIX Firewall Basics,” introduces you to the basics of firewall technology and how they mitigate security threats. Chapter 10 also describes the types of PIX firewalls and licensing options available. We also discuss the Firewall Service Module (FWSM) and some basic commands on the command-line interface (CLI).
Chapter 11, “PIX Firewall Configuration,” is an introduction to how to configure the Cisco PIX firewall. The chapter explains how to configure DHCP server and client services; NAT and PAT concepts and configurations; and static, dynamic, and multicast routing on the PIX firewall.
Chapter 12, “ACLs, Filtering, Object Grouping, and AAA,” explains how to configure access control lists (ACLs) on the PIX firewall and how object grouping can make ACLs easier to config-ure and modify. We also cover how to configconfig-ure URL filtering using Websense and N2H2 servers.
Finally, we discuss how to install, configure, and administer the Cisco Secure ACS on Windows 2000 and Windows NT servers plus how to implement AAA services on a PIX firewall.
Chapter 13, “Advanced Protocol Handling, Attack Guards, and Intrusion Detection,” intro-duces you to the advanced protocol-handling features of the Cisco PIX firewall and how it can be configured to guard against various denial of service (DoS) attacks. This chapter also describes how you can implement the intrusion detections feature and how to stop attacks.
Introduction xxxvii
Chapter 14, “Firewall Failover and PDM,” introduces you to the failover features of the PIX firewall and how to configure it for stateful failover operation. Chapter 14 explains how to use the Java-based PIX Device Manager to configure the PIX firewall using a generally available web browser.
Chapter 15, “VPNs and the PIX Firewall,” discusses how to implement site-to-site and remote access VPNs on the PIX firewall using the CLI and PDM and how to scale the VPN support using digital certificates. This chapter also addresses how to configure and maintain multiple PIX firewalls in an enterprise using CiscoWorks2000 components and the PIX Cisco Secure Policy Manager.
Chapter 16, “Introduction to Virtual Private Networks,” provides a high-level overview of VPN technologies and the complex group of protocols that are collectively known as IPSec.
Chapter 16 also identifies the key Cisco product offerings for the VPN market.
Chapter 17, “Introduction to Cisco VPN Devices,” briefly describes the VPN 3000 Concen-trator products. This chapter also explains how to set up the Cisco VPN 3000 series hardware and software clients for a number of common VPN configurations. Information on preparing the client for mass rollout is also included.
Chapter 18, “Configuring the VPN Concentrator,” explains how to prepare the VPN Con-centrator for use. This chapter includes basic setup as well as more complex features such as load balancing and automatic software updates. Security features such as client firewalls and protocol filters are also covered.
Chapter 19, “Managing the VPN Concentrator,” covers the many tools for monitoring concentrator usage and troubleshooting problems. The chapter discusses a number of protocols that can be used to remotely monitor, configure, and troubleshoot the system. Chapter 19 also explains the tools available to control access to the administrative interfaces.
Chapter 20, “Introduction to Intrusion Detection and Protection,” is an introduction to the con-cepts of intrusion detection and provides an overview of the Cisco Secure IDS intrusion detection and protection solution. In this chapter, you’ll learn about the different types of security threats and attacks and how the Security Wheel can be applied to successfully ensure the ongoing security of your network. You’ll also be introduced to the different types of intrusion detection systems and learn about Cisco Secure IDS.
Chapter 21, “Installing Cisco Secure IDS Sensors and IDSMS,” focuses on the different Cisco Secure IDS sensor platforms and how to install them on the network. We’ll look at the 4200 series of sensor appliances, the Catalyst 6000/6500 IDS module, and the IDS network module for the Cisco 2600/3600/3700 series routers. You’ll be introduced to the sensor CLI and learn about the underlying architecture of the sensor operating system and applications.
Chapter 22, “Configuring the Network to Support Cisco Secure IDS Sensors,” focuses on the devices and configuration tasks required to successfully capture all traffic from the network seg-ments that you wish to monitor to your sensors. You’ll learn how to configure traffic-capture features on the various Cisco Catalyst switch platforms available and how to enable sensing interfaces on each sensor platform.
Chapter 23, “Configuring Cisco Secure IDS Sensors Using the IDS Device Manager,”
introduces the IDS Device Manager (IDM), which is used to configure sensors via a web-based
xxxviii Introduction
graphical interface. In this chapter, you’ll learn how to perform common configuration tasks using the IDM, and you’ll also learn how to perform the equivalent configuration using the sen-sor command-line interface.
Chapter 24, “Configuring Signatures and Using the IDS Event Viewer,” describes the signa-ture engines included within Cisco Secure IDS and how to tune built-in signasigna-tures and create custom signatures. You’ll learn how to use the IDS Event Viewer (IEV), which is a Java-based application that can monitor alarms generated by up to five sensors and is suitable for small deployments of Cisco Secure IDS sensors.
Chapter 25, “Enterprise Cisco Secure IDS Management,” talks about enterprise manage-ment of Cisco Secure IDS sensors using the CiscoWorks VPN/Security Managemanage-ment Solution (VMS) product. In this chapter, you’ll learn about the CiscoWorks VMS architecture, com-mon components of CiscoWorks VMS, and how to install CiscoWorks VMS. You’ll then learn how to install and use the IDS Management Center (IDS MC) to configure and manage up to 300 sensors.
Chapter 26, “Enterprise Cisco Secure IDS Monitoring,” talks about enterprise monitor-ing of Cisco Secure IDS sensors usmonitor-ing the CiscoWorks VPN/Security Management Solution (VMS) product. In this chapter, you’ll learn how to install and use the Security Monitoring Center (Security MC), which is an application within the CiscoWorks VMS suite that pro-vides monitoring of alarms generated by up to 300 sensors.
Chapter 27, “Security Fundamentals,” is an introduction to the world of SAFE. In this chapter, you’ll learn about the different types of network attacks and how to mitigate them. You’ll also be introduced to the SAFE SMR Network Design.
Chapter 28, “The Cisco Security Portfolio,” focuses on the Cisco products available for implementing a secure environment. We’ll look at the different Cisco routers that support the IOS Firewall Feature Set, PIX firewall, VPN concentrator, IDS, and Cisco Secure ACS. This chapter concludes with an overview of the Cisco AVVID framework.
Chapter 29, “SAFE Small and Medium Network Designs,” focuses on the details involved in utilizing the Small and Medium Network Design approaches. You’ll learn about the different modules of each design as well as the devices involved and attacks they are prone to, and how to mitigate against the attacks. After learning the theory behind this design, you’ll learn how to implement the Cisco products that will make this design a reality.
Chapter 30, “SAFE Remote Access Network Design,” explores one of the most widely used network designs, the Remote Access Network Design. In this chapter, you’ll learn about the dif-ferent options available for implementing a secure remote access design. We’ll also look at the Cisco products involved and how to configure these products.
Appendix A, “Introduction to the PIX Firewall,” found on the accompanying CD, describes the features and basic configuration of the Cisco PIX firewall.
The Glossary on the CD is a handy resource for Cisco terms. It’s a great reference tool for understanding some of the more obscure terms used in this book.
Most chapters include Written Labs, Hands-on Labs, and plenty of review questions on the CD to make sure you’ve mastered the material. Again, don’t skip these tools. They’re invaluable to your success.
Introduction xxxix