Modules: | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | All |

Module 1 - 15 Outline

Module 1: Overview of Network Security |
Module Overview |
1.1 | Overview of Network Security

1.1.1 | The need for network security
1.1.2 | Trends that affect network security
1.1.3 | The goals of network security
1.1.4 | Key elements of network security
1.1.5 | Security awareness

1.2 | Vulnerabilities and Threats

1.2.1 | Network security weaknesses
1.2.2 | Primary network threats
1.2.3 | Reconnaissance
1.2.4 | Eavesdropping
1.2.5 | Access
1.2.6 | Other access attacks
1.2.7 | Denial of service
1.2.8 | Distributed denial of service attacks
1.2.9 | Vulnerabilities - the OSI model layers

1.3 | Security Framework and Policy

1.3.1 | The security wheel
1.3.2 | The security wheel in detail
1.3.3 | Security policy basics
1.3.4 | The nature and levels of security policies
1.3.5 | Network security case studies

1.4 | Security Products and Solutions

1.4.1 | Overview
1.4.2 | Identity
1.4.3 | Firewalls
1.4.4 | Virtual Private Networks
1.4.5 | Intrusion detection
1.4.6 | Monitor, manage, and audit
1.4.7 | SAFE

Module Summary |
Module Quiz |

Module 2: Basic Router and Switch Security |
Module Overview |
2.1 | General Router and Switch Security

2.1.1 | Router topologies
2.1.2 | Installation
2.1.3 | Controlling access
2.1.4 | Passwords
2.1.5 | Privileges and accounts
2.1.6 | Login banner

2.2 | Disable Unneeded Services

2.2.1 | IOS network services
2.2.2 | Routing, proxy arp, ICMP
2.2.3 | NTP, SNMP, router name, DNS

2.3 | Securing the Perimeter Router

2.3.1 | Inbound and outbound traffic
2.3.2 | Network Address Translation (NAT)
2.3.3 | Routing protocol authentication and update filtering
2.3.4 | Traffic filtering
2.3.5 | Filter ICMP
2.3.6 | Cisco IOS firewall

2.4 | Router Management

2.4.1 | Router administration
2.4.2 | Logging
2.4.3 | Time
2.4.4 | Software and configuration maintenance
2.4.5 | Remote management using SSH

2.5 | Securing LAN Access

2.5.1 | Overview
2.5.2 | Layer 2 attacks and mitigation
2.5.3 | Port security
2.5.4 | VLANs

Module Summary |
Module Quiz |

Module 3: Router ACLs and CBAC |
Module Overview |
3.1 | Access Control Lists

3.1.1 | ACL basics
3.1.2 | Understanding ACL concepts
3.1.3 | Summarizing ACLs
3.1.4 | Processing ACLs
3.1.5 | Appling ACLs
3.1.6 | Editing ACLs
3.1.7 | Troubleshooting

3.2 | Types of IP ACLs

3.2.1 | Standard ACLs
3.2.2 | Extended ACLs
3.2.3 | IP named ACLs
3.2.4 | Commented IP ACL entries
3.2.5 | Lock-and-key, dynamic ACLs
3.2.6 | Reflexive ACLs
3.2.7 | Time-based ACLs using time ranges
3.2.8 | Authentication proxy
3.2.9 | Turbo ACLs
3.2.10 | Context-based Access Control

3.3 | Context-based Access Control (CBAC)

3.3.1 | ACL limitations
3.3.2 | How CBAC works
3.3.3 | CBAC supported protocols

3.4 | Configure CBAC (Task 1 and 2)

3.4.1 | Configure alerts and audit trails
3.4.2 | Global timeouts and thresholds
3.4.3 | Global half-open connections limit

3.5 | Task 3: Port to Application Mapping (PAM)

3.5.1 | PAM overview
3.5.2 | System-defined port mapping
3.5.3 | User-defined port mapping

3.6 | Task 4: Define Inspection Rules

3.6.1 | Overview of inspection rules
3.6.2 | Inspection rules for applications
3.6.3 | Inspection rules for IP packet fragmentation
3.6.4 | Inspection rules for URL Filtering
3.6.5 | Inspection rules for ICMP

3.7 | Task 5: Inspection Rules and ACLs Applied to Router Interfaces

3.7.1 | Applying inspection rules and ACLs
3.7.2 | Two interface firewall
3.7.3 | Three interface firewall

3.8 | Task 6: Test and Verify CBAC

3.8.1 | Show and debug commands
3.8.2 | Remove CBAC configuration
3.8.3 | Configuring a null interface

Module Summary |
Module Quiz |

Module 4: Router AAA Security |
Module Overview |
4.1 | AAA Secure Network Access

4.1.1 | Introduction to AAA
4.1.2 | AAA secures network architecture
4.1.3 | Authentication methods
4.1.4 | Authentication - remote PC username and password
4.1.5 | Authentication - one time passwords - S/Key
4.1.6 | Authentication - token cards and servers

4.2 | Network Access Server (NAS) AAA Authentication Process

4.2.1 | Overview of NAS
4.2.2 | AAA security server options
4.2.3 | NAS configuration

4.3 | Cisco Secure ACS

4.3.1 | Overview of Cisco Secure ACS 3.0 Windows NT or 2000
4.3.2 | Troubleshooting techniques for Cisco Secure ACS 3.0 for Windows
4.3.3 | Overview of Cisco Secure ACS for UNIX
4.3.4 | Cisco Secure ACS Solutions Engine

4.4 | AAA Servers Overview and Configuration

4.4.1 | Introduction to TACACS+
4.4.2 | Introductions to RADIUS
4.4.3 | RADIUS versus TACACS+
4.4.4 | Kerberos overview

4.5 | The Cisco IOS Firewall Authentication Proxy

4.5.1 | Introduction to the IOS firewall authentication proxy
4.5.2 | Authentication proxy operation
4.5.3 | Authentication proxy configuration tasks
4.5.4 | HTTPS authentication proxy

Module Summary |
Module Quiz |

Module 5: Router Intrusion Detection, Monitoring, and Management |
Module Overview |
5.1 | IOS Firewall IDS

5.1.1 | Introduction
5.1.2 | Signature implementations
5.1.3 | Response options

5.2 | Setting Up the Cisco Firewall IDS

5.2.1 | Configuring tasks
5.2.2 | Initialize IOS firewall IDS
5.2.3 | Configuring, disabling, and excluding signatures
5.2.4 | Creating and applying audit rules
5.2.5 | Verifying the configuration

5.3 | Monitoring with Logging and Syslog

5.3.1 | The value of logging
5.3.2 | Configure logging
5.3.3 | Configure synchronization of logging messages
5.3.4 | Limiting the error message severity level
5.3.5 | Syslog
5.3.6 | Syslog message parts and codes
5.3.7 | Logging to a server
5.3.8 | Syslog platforms and applications

5.4 | SNMP

5.4.1 | SNMP introduction
5.4.2 | SNMP security
5.4.3 | SNMP version 3 (SNMPv3)
5.4.4 | Configure SNMP
5.4.5 | SNMP management applications

5.5 | Managing the Router

5.5.1 | Concepts
5.5.2 | Access mechanisms for administrators
5.5.3 | Updating the router
5.5.4 | Testing and security validation
5.5.5 | Enterprise monitoring

5.6 | Security Device Manager (SDM)

5.6.1 | Overview
5.6.2 | Accessing SDM
5.6.3 | Downloading and installing the SDM

Module Summary

Module Quiz |

Module 6: Router Site-to-Site VPN |
Module Overview |
6.1 | Virtual Private Networks

6.1.1 | Introduction
6.1.2 | Site-to-site VPN
6.1.3 | VPN technology options
6.1.4 | Tunneling protocols
6.1.5 | Tunnel interfaces

6.2 | IOS Cryptosystem

6.2.1 | Overview
6.2.2 | Symmetrical encryption
6.2.3 | Asymmetric encryption
6.2.4 | Diffie-Hellman
6.2.5 | Data integrity
6.2.6 | HMAC
6.2.7 | Digital certificates

6.3 | IPSec

6.3.1 | Overview
6.3.2 | Authentication Header
6.3.3 | Encapsulating security payload
6.3.4 | Modes
6.3.5 | Security associations
6.3.6 | Five steps of IPSec
6.3.7 | IKE
6.3.8 | Logical flow of IPSec and IKE

6.4 | Site-to-Site IPSec VPN Using Pre-shared Keys

6.4.1 | Tasks to configure IPSec
6.4.2 | Task 1 - prepare for IKE and IPSec
6.4.3 | Task 2 - configure IKE
6.4.4 | Task 3 - configure IPSec
6.4.5 | Task 4 - test and verify IPSec

6.5 | Digital Certificates

6.5.1 | Overview
6.5.2 | Simple Certificate Enrollment Protocol (SCEP)
6.5.3 | CA servers
6.5.4 | Enroll a device with a CA

6.6 | Configure Site-to-Site IPSec VPN Using Digital Certificates

6.6.1 | Configure CA support tasks
6.6.2 | Task 1 - Prepare for IKE and IPSec
6.6.3 | Task 2 - configure CA support
6.6.4 | Task 3 - configure IKE
6.6.5 | Task 4 - configure IPSec
6.6.6 | Take 5 - test and verify IPSec

Module Summary |
Module Quiz |

Module 7: Router Remote Access VPN |

Module Overview |
7.1 | Remote Access VPN

7.1.1 | Introduction
7.1.2 | Remote Access VPN
7.1.3 | Tunneling protocols for remote access

7.2 | Cisco Easy VPN

7.2.1 | Easy VPN Server and Remote
7.2.2 | Overview of the Easy VPN Server
7.2.3 | Configuring the Easy VPN Server

7.3 | Cisco VPN 3.5 Client

7.3.1 | Overview
7.3.2 | How Easy VPN works
7.3.3 | Working with the Cisco VPN 3.5 Client
7.3.4 | VPN Client log
7.3.5 | Setting MTU size
7.3.6 | Connection status

7.4 | VPN Enterprise Management

7.4.1 | Introduction to the Router Management Center (MC)
7.4.2 | Key concepts in the Router MC
7.4.3 | Supported tunneling technologies
7.4.4 | Router MC installation
7.4.5 | Installation process
7.4.6 | Getting started
7.4.7 | Router MC interface

Module Summary |
Module Quiz |

Module 8: PIX Frewall |
Module Overview |
8.1 | Introduction to Firewalls

8.1.1 | Firewalls and firewall technologies
8.1.2 | Firewall technologies
8.1.3 | The firewall marketplace
8.1.4 | Security and VPN certifications

8.2 | The Cisco PIX Security Appliance

8.2.1 | Introduction to the PIX Security Appliance
8.2.2 | The Finesse operating system
8.2.3 | Adaptive Security Algorithm (ASA)
8.2.4 | Cut-through proxy operation
8.2.5 | Failover
8.2.6 | Network Address Translation (NAT)
8.2.7 | The PIX Security Appliance family
8.2.8 | Firewall Services Module (FWSM)
8.2.9 | License types and VPN capabilities

8.3 | Getting Started

8.3.1 | User interface
8.3.2 | Basic PIX Security Appliance configurations commands
8.3.3 | Examine PIX Security Appliance status

8.4 | Routing and Multicast Configuration

8.4.1 | Static routes
8.4.2 | Dynamic routes
8.4.3 | Multicast routing
8.4.4 | Allowing hosts to receive multicast transmissions
8.4.5 | Forwarding multicasts from a transmission source
8.4.6 | View and debug SMR

8.5 | PIX Dynamic Host Configuration Protocol (DHCP)

8.5.1 | Sever and client
8.5.2 | DHCP server
8.5.3 | Configuring the PIX Security Appliance as a DHCP server

Module Summary |
Module Quiz |
Module 9: PIX Security Appliance Translations and Connections |

Module Overview |
9.1 | Transport Protocols

9.1.1 | Sessions in an IP world
9.1.2 | TCP detailed review
9.1.3 | TCP features and interaction with PIX
9.1.4 | UDP features and interaction with PIX

9.2 | Network Address Translations

9.2.1 | Understanding NAT
9.2.2 | Dynamic inside translations
9.2.3 | Static inside translations
9.2.4 | Dynamic outside translations
9.2.5 | Static outside translations
9.2.6 | Identify NAT

9.3 | Configuring DNS Support

9.3.1 | Overview of the alias command
9.3.2 | DNS doctoring process
9.3.3 | Destination NAT with the alias command
9.3.4 | DNS record translation

9.4 | Connections

9.4.1 | Two ways through the PIX Security Appliance
9.4.2 | Statics and conduits

9.5 | Port Address Translation (PAT)

9.5.1 | PAT for the PIX Security Appliance
9.5.2 | PAT using outside interface addresses
9.5.3 | Mapping subnets to PAT addresses
9.5.4 | Backing up PAT addresses by using multiple PATs
9.5.5 | Augmenting a global pool with PAT
9.5.6 | Port redirection

9.6 | Multiple Interfaces on a PIX Security Appliance

9.6.1 | Additional interface support
9.6.2 | Configuring three interfaces on a PIX Security Appliance
9.6.3 | Configuring four interfaces on a PIX Security Appliance

Module Summary |
Module Quiz |
Module 10: PIX Security Appliance ACLs |

Module Overview |
10.1 | Access Control Lists and the PIX Security Appliance

10.1.1 | Access Control List (ACL)
10.1.2 | Configuring ACLs
10.1.3 | Turbo ACLs
10.1.4 | ACLs versus conduits
10.1.5 | Case study - differences in the behavior of conduits and ACLs
10.1.6 | Verifying and troubleshooting ACLs

10.2 | Using ACLs

10.2.1 | Denying web access to the Internet
10.2.2 | Permitting web access to the DMZ
10.2.3 | Two common uses of access lists
10.2.4 | VPN solution: dual DMZ and VPN concentrator
10.2.5 | Ping

10.3 | Filtering

10.3.1 | Malicious applet filtering
10.3.2 | URL filtering

10.4 | Object Grouping

10.4.1 | Grouping objects of similar types
10.4.2 | Using object groups in ACLs
10.4.3 | Configuring object groups
10.4.4 | Applying ACLs to object groups

10.5 | Nested Object Groups

10.5.1 | Overview
10.5.2 | Configuring nested object groups
10.5.3 | Nested object group example
10.5.4 | Multiple object groups in ACLs example
10.5.5 | Verifying and managing object groups

Module Summary |
Module Quiz |
Module 11: PIX Security Appliance AAA |

Module Overview |
11.1 | AAA

11.1.1 | Overview of authentication, authorization, and accounting
11.1.2 | What the user sees
11.1.3 | Cut-through proxy operation
11.1.4 | TACACS+ and RADIUS
11.1.5 | Cisco Secure ACS and the PIX Security Appliance

11.2 | Authentication Configuration

11.2.1 | Configuring the PIX Security Appliance to support authentication
11.2.2 | AAA authentication example
11.2.3 | Authentication of non-Telnet, FTP, or HTTP traffic
11.2.4 | Virtual Telnet
11.2.5 | Virtual HTTP
11.2.6 | Authentication of console access
11.2.7 | Changing authentication timeouts and authentication prompts

11.3 | Authorization and Accounting Configuration

11.3.1 | Configuring the PIX Security Appliance to support AAA authorization
11.3.2 | Providing authorization using downloadable ACLs
11.3.3 | Configuring the PIX Security Appliance to support AAA accounting
11.3.4 | Defining traffic to utilize AAA services
11.3.5 | Monitoring the AAA configuration

11.4 | PPPoE and the PIX Security Appliance

11.4.1 | Overview of PPPoE
11.4.2 | The PIX Security Appliance and PPPoE
11.4.3 | Configuring the PIX Security Appliance to support PPPoE
11.4.4 | Monitoring and troubleshooting the PPPoE client

Module Summary |
Module Quiz |
Module 12: PIX Advanced Protocols and Intrusion Detection |

Module Overview |
12.1 | Advanced Protocols

12.1.1 | Need for advanced protocol handling
12.1.2 | fixup command
12.1.3 | FTP fixup configuration
12.1.4 | Remote shell (rsh) fixup configuration
12.1.5 | SQL*Net fixup configuration
12.1.6 | SIP fixup configuration
12.1.7 | Skinny fixup configuration

12.2 | Multimedia Support

12.2.1 | Why multimedia is an issue
12.2.2 | Real-time streaming protocol
12.2.3 | H.323
12.2.4 | IP phones and the PIX Security Appliance DHCP server

12.3 | Attack Guards

12.3.1 | Mail guard
12.3.2 | DNS guard
12.3.3 | FragGuard and virtual re-assembly
12.3.4 | AAA flood guard
12.3.5 | SYN flood attack
12.3.6 | TCP intercept

12.4 | Intrusion Detection

12.4.1 | Overview of intrusion detection and the PIX Security Appliance
12.4.2 | Information and attack intrusion detection signatures
12.4.3 | Intrusion detection in the PIX

12.5 | Shunning

12.5.1 | Overview of shunning
12.5.2 | Example of shunning an attacker

12.6 | Syslog Configuration on the PIX

12.6.1 | Configure Syslog output to a Syslog server
12.6.2 | Syslog messages

12.7 | SNMP

12.7.1 | SNMP overview
12.7.2 | MIB support
12.7.3 | Example of an SNMP through the PIX

Module Summary |
Module Quiz |
Module 13: PIX Failover and System Maintenance |

Module Overview |
13.1 | Understanding Failover

13.1.1 | PIX Security Appliance failover overview
13.1.2 | IP addresses for failover
13.1.3 | Configuration replication
13.1.4 | Failover and stateful failover
13.1.5 | Failover interface tests

13.2 | Serial Cable Failover Configuration

13.2.1 | Overview of configuring serial cable failover
13.2.2 | Steps 1-4 configuring serial cable failover
13.2.3 | Additional failover commands
13.2.4 | Verifying failover configuration

13.3 | LAN-Based Failover

13.3.1 | LAN-based failover overview
13.3.2 | Steps 1-4: preparing the primary PIX Security Appliance
13.3.3 | Steps 5-10: Preparing the secondary PIX Security Appliance

13.4 | System Maintenance via Remote Access

13.4.1 | Configuring telnet access to the PIX Security Appliance console
13.4.2 | SSH connections to the PIX Security Appliance
13.4.3 | Connecting to the PIX Security Appliance with an SSH client

13.5 | Command Authorization

13.5.1 | Command authorization overview
13.5.2 | (Method 1) enable level command authorization
13.5.3 | (Method 2) local command authorization
13.5.4 | (Method 3) ACS command authorization

13.6 | PIX Security Appliance Password Recovery and Upgrades

13.6.1 | Password Recovery
13.6.2 | Upgrading the image and the activation key

Module Summary |
Module Quiz |
Module 14: PIX VPN |

Module Overview |
14.1 | The PIX Security Appliance Enables a Secure VPN

14.1.1 | PIX Security Appliance VPN capabilities
14.1.2 | PIX Security Appliance VPN topologies
14.1.3 | IPSec enables PIX Security Appliance VPN features
14.1.4 | Overview of IPSec
14.1.5 | IPSec standards supported by the PIX Security Appliance

14.2 | Tasks to Configure VPN

14.2.1 | IPSec configuration tasks overview

14.3 | Task 1 - Prepare to Configure VPN Support

14.3.1 | Step 1 - prepare for IKE
14.3.2 | Step 2 - determine the IKE phase one policy parameters
14.3.3 | Step 3 - plan for IPSec
14.3.4 | Step 4 - determine the IPSec policy
14.3.5 | Step 5 - Ensure that the network works without encryption
14.3.6 | Step 6 - Implicitly permit IPSec bypass

14.4 | Task 2 - Configure IKE Parameters

14.4.1 | Step 1 - enable or disable IKE
14.4.2 | Step 2 - configure an IKE phase one policy
14.4.3 | Step 3 - configure the IKE pre-shared key
14.4.4 | Step 4 - verify IKE phase one policies

14.5 | Task 3 - Configure IPSec Parameters

14.5.1 | Step 1 - configure interesting traffic
14.5.2 | Example crypto ACLs
14.5.3 | Step 2 - configure and IPSec transform set
14.5.4 | Available IPSec transforms
14.5.5 | Step 3 - configure the crypto map
14.5.6 | Step 4 - Apply the crypto map to an interface

14.6 | Task 4 - Test and Verify VPN Configuration

14.6.1 | Verify ACLs and interesting traffic
14.6.2 | Verify correct IKE Phase 1 configuration
14.6.3 | Verify correct IPSec algorithm configuration
14.6.4 | Verify the correct crypto map configuration
14.6.5 | Show and clear the IPSec and IKE SAs
14.6.6 | Debug IKE and IPSec traffic through the PIX Security Appliance

14.7 | The Cisco VPN Client

14.7.1 | Cisco VPN client features
14.7.2 | Topology overview
14.7.3 | PIX Security Appliance assigns the IP address to the VPN client
14.7.4 | Configuring a PIX Security Appliance for a PIX-to-VPN client tunnel
14.7.5 | Configuring a VPN client for a PIx-to-VPN client tunnel

14.8 | Scaling PIX Security Appliance VPNs

14.8.1 | CA server fulfilling requests from IPSec peers
14.8.2 | Enroll a PIX Security Appliance with a CA

Module Summary |
Module Quiz |
Module 15: PIX Security Appliance Management |

Module Overview |
15.1 | PIX Security Appliance Management Tools

15.1.1 | Overview of PIX Security Appliance management tool options
15.1.2 | PIX Device Manager
15.1.3 | Cisco secure policy manager
15.1.4 | PIX Management Center

15.2 | The Cisco PIX Device Manager

15.2.1 | PDM overview
15.2.2 | PDM operating requirements
15.2.3 | Browser requirements of PDM

15.3 | Preparation for PDM

15.3.1 | Configure a new PIX Security Appliance to use PDM
15.3.2 | Configure a new PIX Security Appliance to use PDM
15.3.3 | Configure and existing PIX Security Appliance to use PDM

15.4 | Using PDM to Configure the PIX Security Appliance

15.4.1 | Startup Wizard
15.4.2 | Overall layout of the Cisco PDM
15.4.3 | Access Rules tab
15.4.4 | Translation Rules tab
15.4.5 | VPN tab
15.4.6 | Hosts/NetworkS tab
15.4.7 | System Properties tab
15.4.8 | Monitoring tab
15.4.9 | Interface Graphics panel
15.4.10 | Tools and options

15.5 | Using PDM to Create Site-to-Site VPNs

15.5.1 | Overview
15.5.2 | Setting system options
15.5.3 | Configure IKE
15.5.4 | Configuring certificate support
15.5.5 | Configuring transform sets
15.5.6 | Creating a crypto map
15.5.7 | Creating an IPSec rule

15.6 | Using PDM to Create Remote Access VPNs

15.6.1 | The PIX Security Appliance for Unity and Cisco VPN Clients
15.6.2 | The PIX Security Appliance for Windows 2000 clients
15.6.3 | VPN hardware client setting

15.7 | Enterprise PIX Management

15.7.1 | Management Center for PIX
15.7.2 | Key concepts
15.7.3 | Auto update server (AUS)

Module Summary |
Module Quiz |

| Close Window |

| All contents copyright © 2002 Cisco Systems, Inc. All rights reserved.