Authentication Proxy

Configuring a Cisco Router for IPsec Using Preshared Keys

IPsec is not a protocol but a framework of open-standard protocol suites that provides origin authentication, data integrity, data confidentiality, and antireplay protection. IPsec runs over IP and uses Internet Key Exchange (IKE) to negotiate the security association (SA) between the peers. Parameters must be configured for both IKE and IPsec SAs. Five specific steps are required to create and terminate an IPsec VPN tunnel. The endpoints perform different functions to establish the encrypted...

Authentication

Various types of authentication methods are available today. They range from the simple username and password databases to stronger implementation of token cards and one-time passwords (OTPs). Table 6-2 lists the authentication methods, from the strongest and most complex methods to the weakest and simple methods. Table 6-2. Authentication Methods Table 6-2. Authentication Methods Method Description Token cards and soft tokens Token cards are small electronic devices.

Do I Know This Already Quiz

The purpose of the Do I Know This Already quiz is to help you decide whether you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now. The 10-question quiz, derived from the major sections in the Foundation Topics portion of the chapter, helps you determine how to spend your limited study time. Table 8-1 outlines the major topics discussed in this chapter and the Do I Know This Already quiz questions...

Configuring Radius on Cisco IOS Software

To configure RADIUS on your Cisco router or access server, you must complete the following steps Step 1. Enable AAA. Use the aaa new-model global configuration command to enable AAA. Step 2. Identify the RADIUS server. Use the radius-server host command to specify the IP address. Use the radius-server key command to specify an encryption key that will be used to encrypt all exchanges between NAS and the RADIUS server. Step 3. Configure AAA services. Use the aaa authentication global...

Defining ACLs

ACLs are rules that deny or permit packets coming in or out of an interface. An ACL typically consists of multiple ACL entries (ACE), organized internally by the router. When a packet is subjected to access control, the router searches this linked list in order from top to bottom to find a matching element. The matching element is then examined to determine whether the packet is allowed or denied. Figure 11-1 shows the behavior of a router that has an ACL configured on its interfaces. Figure...

SSH Protocol

SSH was originally intended to replace Telnet and the UNIX r- commands. Both of these session types have vulnerabilities, such as spoofing, man-in-the-middle attacks, and session hijacking, which SSH addresses and mitigates for the most part. For maintaining confidentiality and integrity in accessing a router, it is recommended to deploy SSH rather than Telnet. SSH protects against the following Attacks from machines pretending to be another server, router, or a domain name server Internet...

Configuring Tacacs on Cisco IOS Software

To configure the Cisco access server to support TACACS+, you must complete the following steps Step 1. Enable AAA. Use the aaa new-model command to enable AAA. Step 2. Identify the TACACS+ server. Use the tacacs-server host command to specify the IP address or name of one or more TACACS+ servers. Step 3. Configure AAA services. Use the aaa authentication command to define method lists that use TACACS+ for authentication. Step 4. Apply the method lists to the interfaces. Use line and interface...

Configuring Authentication Proxy on the Cisco IOS Firewall

Authentication proxy enables users to connect through the firewall to a resource only after a AAA server has verified their credentials. After the authentication is complete, the Cisco IOS Firewall receives authorization information from the AAA server in the form of a dynamic access list. It is always a good idea to ensure that all traffic is properly flowing through the Cisco IOS Firewall prior to implementing authentication proxy. Access lists applied to the Cisco IOS Firewall determine the...

STP Manipulation Attacks

STP prevents bridging loops in a redundant switched network environment. By avoiding loops, you can ensure that broadcast traffic does not become a traffic storm. STP is a hierarchical tree-like topology with a root switch at the top. A switch is elected as root based on the lowest configured priority of any switch (0 through 65,535). When a switch boots up, it begins a process of identifying other switches and determining the root bridge. After a root bridge is elected, the topology is...

Mitigating DHCP Starvation Attacks

The methods used to mitigate a MAC address spoofing attack may also prevent DHCP starvation by using the DHCP snooping feature. Implementation of RFC 3118, Authentication for DHCP Message, will also assist in mitigating this type of attack. You can also limit the number of MAC addresses on a switch port, a mitigation strategy for CAM table flooding, to mitigate DHCP starvation attacks. Other features on the Cisco Catalyst switch, such as IP source guard, may also provide additional defense...

Advanced IPsec VPNs Using Cisco Routers and CAs

This section is dedicated to configuring the Cisco router for advanced scalable IPsec VPNs using CAs. It contains an overview of the CA support and configuration steps required to deploy IPsec VPNs using CA support. Clearly, the use of CAs is not a requirement for building IPsec VPNs (as noted in the previous chapter), but the interoperability between Cisco IOS devices and CAs normally results in a more scalable and manageable IPsec solution. Digital Signatures, Certificates, and Certificate...

Debug Commands

The debug commands enable you to determine what is actually happening in the communications between peers. The debug commands are used to view the actual negotiations between peers and are commonly used to troubleshoot connectivity issues. This command is executed from the privileged EXEC mode and is used to display the IKE events as they occur. To terminate this output, use the no debug crypto isakmp command. Example 21-11 depicts the output from the command on the New York router as it...

Selecting EAP

Several types of EAP authentication are available for wired and wireless networks. Table 17-3 shows the types and methods for EAP authentication. Table 17-3. EAP Authentication Types Table 17-3. EAP Authentication Types The following sections describe the most common methods of 802.1x authentication. EAP-MD5 uses Message Digest 5 (MD5)-based challenge-response for authentication. Using this method, the client identity is transmitted over the network, but the password is not sent. The server...

Certification Exam and This Preparation Guide

The questions for each certification exam are a closely guarded secret. The truth is that if you had the questions and could only pass the exam, you would be in for quite an embarrassment as soon as you arrived at your first job that required these skills. The point is to know the material, not just to successfully pass the exam. We do know which topics you must know to successfully complete this exam because they are published by Cisco.

Disabling Directed Broadcasts

On IP networks, a packet can be directed to an individual machine or broadcast to an entire network. When a packet is sent to an IP broadcast address from a machine on the local network, that packet is delivered to all machines on that network. When a packet is sent to that IP broadcast address from a machine outside of the local network, it is broadcast to all machines on the target network. IP broadcast addresses are usually network addresses with the host portion of the address having all 1...

Configuring AAA Services

AAA configuration includes four mandatory steps and two optional steps. It involves enabling AAA, providing security server information, defining the method list, and then applying the method list to the interface of interest. The following steps describe the configuration process Step 1. Activate AAA services by using the aaa new-model command. Step 2. Select the type of security protocols, such as RADIUS, TACACS+, or Kerberos. Step 3. Define the method list's authentication by using the aaa...

Figure 121 Cisco IOS Firewall Functions

Fliewall. Advanced IP Routing) I VPN. Intrusion Preteelior. Fliewall. Advanced IP Routing) The Cisco IOS Firewall and Advanced Security feature set integrate the following technologies VPN services The Cisco IOS Firewall supports dynamic multipoint virtual private networks (VPN). This allows PPP and point-to-multipoint (p2mp) VPNs to be dynamically configured supporting hub-and-spoke or full-mesh architectures with stateful IPsec failover to provide redundancy....

Cisco Secure ACS for Windows

Cisco Secure ACS is a highly scalable and operates as a centralized RADIUS server or TACACS+ server system. It controls the AAA of users who access corporate resources through a network. Cisco Secure ACS for Windows provides AAA services to network devices that function as AAA clients, such as a network access servers (NAS), PIX Firewalls, and routers. The AAA client in Figure 9-1 represents any such device that provides AAA client functionality and uses one of the AAA protocols supported by...

Example 1312 show ip ips signatures Command Partial Output

Signatures were last loaded from flash attack-drop.sdf SDF release version attack-drop.sdf v2 * Marked for Deletion Action (A)larm,(D)rop,(R)eset TI ThrottleInterval AT AlarmThrottle WF WantFrag Ver Signature Version Trait AlarmTraits CT ChokeThreshold FA FlipAddr Signature Micro-Engine SERVICE.SMTP (1 sigs) SigID SubID On Action Sev Trait MH AI Total Active Signatures 82 Total Inactive Signatures C Example 13-13 displays the output from the show ip sdee status command. Example 13-13. show ip...

How 8021x Works

Extensible Authentication Protocol (EAP) is the transport mechanism used in 802.1x to authenticate supplicants against a back-end data store, typically a RADIUS server. EAP was initially defined in RFC 2284 as a general authentication framework running over Layer 2 PPP. In RFC 3748, the EAP definition has been updated to include IEEE 802 as a link layer. The IEEE 802 encapsulation of EAP does not involve PPP, and IEEE 802.1X does not include support for link or network layer negotiations. As a...

Verifying the Cisco Ios Ips Configuration

It is important to ensure that your system is properly configured. You can use three commands to verify the configuration of the Cisco IOS IPS showYou enter the show command in the privileged EXEC mode, and it enables you to see the current Cisco IOS IPS configuration. Table 13-8 lists the show commands with a brief description of each. Displays all available IPS information. Displays additional configuration information, including default values that might not display using the show...

Cisco Secure ACS for Windows Architecture

Cisco Secure ACS is modular and flexible to fit the needs of both simple and large networks. Cisco Secure ACS for Windows operates as a set of Windows 2000 services and controls the AAA, for users accessing networks. When you install Cisco Secure ACS on your server, the installation adds several Windows services. These services provide the core of the Cisco Secure ACS functionality and are as follows CSAdmin Provides the HTML interface for administration of Cisco Secure ACS CSAuth Provides...

Installing Cisco Secure ACS for Microsoft Windows

After confirming your network's system requirements for Cisco Secure ACS for Windows, run the setup program to install the software. Figure 10-1 shows a checklist window that comes up during the first part of the installation process. Figure 10-1. Checklist Window That Appears During the Installation Process for Cisco ACS 3.3 Figure 10-1. Checklist Window That Appears During the Installation Process for Cisco ACS 3.3 As shown in Figure 10-1, the installation process wants you to test and...

The Policy Must Be Technically Feasible

It is important to understand that the creation of a security policy is a management function. The security administrator should review the policy with management and ensure that they are advised as to its technical feasibility. The security administrator should recommend solutions that meet the business needs without compromising the security of the organization. The policy must also be feasible for the users that is, the policy should not be so complicated that...

Caution

The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you do not know the answer to a question or are only partially sure of the answer, you should mark this question wrong for purposes of the self-assessment. Giving yourself credit for an answer you correctly guess skews your self-assessment results and might provide you with a false sense of security. 1. What is the default inactivity expire time period on a Cisco Catalyst switch CAM table 2. What are three...

Router Configuration Modes

Before jumping into the CLI of the Cisco router, it is important to understand the different command modes available. Consider the command mode to be a level where you can perform specific functions. If you are not at the correct level, you cannot perform the correct function (to configure the router). This simplified explanation will make more sense as each mode is discussed. The following are command modes on a Cisco router ROM monitor mode The ROM monitor mode is the mode the router boots to...

Cisco Rtsp Tunnel

RTSP is an application-level protocol used for control over the delivery of data with real-time properties, such as audio and video streams. As defined in Internet Engineering Task Force (IETF) RFC 2326, RTSP may run over UDP, multicast UDP, or TCP. Currently, CBAC supports only TCP-based RTSP, which is supported by a variety of multimedia vendor products, including Cisco IP TV, RealAudio G2 Player, Apple QuickTime 4 software, and RealNetworks. RTSP may use many different data transport modes....

Displaying 8021x Statistics and Status

To verify successful 802.1x configuration, use the following command in privileged EXEC mode show dot1x all interface interface-id statistics interface interface-id begin exclude include expression This command displays 802.1x administrative and operational status for the switch or a specified interface. It also provides statistics information. Table 18-4 describes the command syntax and parameters. Table 18-4. show 802.1x Syntax Description Table 18-4. show 802.1x Syntax Description This...

Optional Configurations

The following section provides the optional command description and examples to activate 802.1x port-based authentication. When a client is authenticated to a switch port using 802.1x, the port remains set with the supplicant attributes until a reboot occurs. To validate the user on an ongoing basis, periodic re-authentication may be enabled on a per-port basis. You can also specify the time period between authentications. Table 18-3 describes the command syntax for periodic re-authentication....

Mandatory Configuration

The following section provides the mandatory command description and examples to activate 802.1x port-based authentication. Enabling 802.1x Authentication To enable 802.1x, port-based AAA must be enabled. To enable AAA, use the aaa new-model command in global configuration mode. After AAA is enabled, you must specify the authentication list for 802.1x. The aaa authentication dot1x command specifies the authentication method list. A method list is a sequential list that describes the...

Securing vty Access

Any vty should be configured to accept connections only with the protocols actually needed. You can do this with the transport input command. A vty expected to receive only Telnet sessions could be configured with transport input telnet, for example, whereas a vty permitting both Telnet and SSH sessions would have transport input telnet ssh. Not configuring a transport input for vty access is also an option if you want to disable the service. One way to reduce this exposure is to configure an...

Configuring Manual IPsec

You can manually configure your IPsec connection from the crypto-map configuration mode. When you manually configure the IPsec parameters, you manually input all the keys necessary to create the connection. This configuration removes the functionality that allows the peers to renegotiate and constantly change the connection parameters and greatly reduces the security of the connection. The commands for configuring manual IPsec are as follows set session-key inbound outbound ah esp spi...