CCIE Security
DHCP Starvation Attacks
As the name implies, a DHCP starvation attack is where a DHCP server is sent so many DHCP requests that eventually there are no more IP addresses available to allocate to legitimate devices, hence rendering the network unusable. A DHCP starvation attack works by broadcasting DHCP requests with spoofed MAC addresses. As you have seen, there are many tools available on the Internet to send out these sorts of frames. The end result may involve the attacker installing their own DHCP server and...
MAC Spoofing Attack
A MAC spoofing attack is where the intruder sniffs the network for valid MAC addresses and attempts to act as one of the valid MAC addresses. The intruder then presents itself as the default gateway and copies all of the data forwarded to the default gateway without being detected. This provides the intruder valuable details about applications in use and destination host IP addresses. This enables the spoofed CAM entry on the switch to be overwritten as well.
Cisco VPN 3000 Concentrator
The Cisco VPN 3000 Series Concentrators are purpose-built, remote access virtual private network (VPN) platforms that incorporate high availability, high performance, and scalability with the most advanced encryption and authentication techniques available today. The VPN 3000 supports a number of secure protocols Point-to-Point Tunneling Protocol (PPTP) Layer 2 Tunneling Protocol (L2TP) over IPSec The Cisco VPN 3000 Series Concentrator supports the widest range of connectivity options,...
Trivial File Transfer Protocol
TFTP is a protocol that allows data files to be transferred from one device to another using the connectionless protocol, UDP. TFTP uses UDP port number 69. TFTP is typically used in environments where bandwidth is not a major concern and IP packets that are lost can be re-sent by the higher layers (typically the application layer). TFTP has little security. In fact, the only way to provide security to TFTP transfer is by defining (on the TFRTP server) the directory on the host TFTP device and...
CAM Table Overflow
This section first reviews exactly how the CAM table operates, so that you appreciate how easily it can be comprised. Figure 3-6 displays a typical Layer 2 switch network with one switch and three PCs labeled with MAC addresses A, B, and C to simplify the figure. Figure 3-6 CAM Table Operation Step 1 Figure 3-6 CAM Table Operation Step 1 CAM Table Port 1 A Port 2 B Port 3 - CAM Table Port 1 A Port 2 B Port 3 C Figure 3-6 displays the typical CAM table population by a Cisco switch. When Device...
Do I Know This Already
RFC 1700 defines what well-known ports for DNS DNS is permitted by RFC 1700 to use both TCP and UDP port 53. DNS applications use TCP port 53 for zone transfers and when the DNS replies are greater than 512 bytes. 2. What supplies DNS security Answer e. None of these DNS has no form of security, so any device can request name-to-IP address mappings. 3. What Cisco IOS command will stop a Cisco router from querying a DNS server when an invalid Cisco IOS command is entered at the EXEC or PRIV...
IP Security
IPSec provides security services at the IP layer by enabling a system to select required security protocols, determine the algorithm(s) to use for the service(s), and put in place any cryptographic keys required to provide the requested services. -RFC 2401, Security Architecture for the Internet Protocol IPSec is a defined encryption standard that encrypts the upper layers of the OSI model by adding a new predefined set of headers. IPSec is not just an encryption standard IPSec provides a...
SNMP Notifications
SNMP's key feature is that it enables you to generate notifications from SNMP agents. Cisco routers can be configured to send SNMP traps or informed requests to a network management system (NMS), where a network administrator can view the data. Figure 2-6 displays the typical communication between an SNMP manager and the SNMP agent (for example, a Cisco-enabled SNMP router). Figure 2-6 Communication Between SNMP Manager and SNMP Agent Trap (no acknowledge) or Inform Requests (acknowledgment...
Password Recovery
Sometimes, the Cisco enable or secret password is unknown and thus you must use password recovery to attain or change the enable or secret password. Password recovery allows the network administrator to recover a lost or unknown password on a Cisco router. For password recovery, an administrator must have physical access to the router through the console or auxiliary port. When an EXEC user enters an incorrect enable password, the user receives an error message similar to the message shown in...
Configuring a PIX Firewall
This section takes a look at configuring the PIX Firewall software and the six basic commands used to configure a PIX Firewall. Figure 6-5 displays a typical DMZ and perimeter network between the inside (protected) and outside (public) networks. Figure 6-5 Typical PIX Firewall Logical Setup Figure 6-5 Typical PIX Firewall Logical Setup PIX Firewall Configuration Task List The following steps show you how the PIX Firewall software is configured for the scenario in Figure 6-5 Step 1 Name the...
Organization of this Book
Each chapter starts by testing your current knowledge on the chapter's topics with a Do I Know This Already quiz. This quiz is aimed at helping you decide whether you need to cover the whole chapter, read only parts of the chapter, or just skip the chapter altogether. See the introduction to each Do I Know This Already quiz for more details. Each chapter then contains a Foundation Topics section with extensive coverage of the CCIE Security exam topics covered in that chapter. This is followed...
Show Commands
The best method to appreciate the use of show commands is to display sample output from a Cisco IOS router. Example 3-6 displays a list of truncated show commands available from the CLI on a Cisco router in PRIV EXEC mode. (Version 12.2 was used to supply this output.) Information on terminal lines used as router Bridge Forwarding Filtering Database verbose Display information about dialup connections Dynamic Host Configuration Protocol status Show diagnostic information for port Dial Plan...
Do I Know This Already Quiz Dmo
The purpose of this assessment quiz is to help you determine how to spend your limited study time. If you can answer most or all of these questions, you might want to skim the Foundation Topics section and return to it later, as necessary. Review the Foundation Summary section and answer the questions at the end of the chapter to ensure that you have a strong grasp of the material covered. If you already intend to read the entire chapter, you do not necessarily need to answer these questions...
Do I Know This Already Klo
When defining an extended access list, what TCP port numbers can you use Answer c. 0 to 65,535 TCP port numbers from 0 to 65,535 can be used when defining an extended access list devices such as PCs go from 1023 to 65535. 3. When defining an extended access list, what UDP port numbers can you use Answer c. 0 to 65,535 UDP port numbers from 0 to 65,535 can be used when defining an extended access list. 4. Which of the following is not a TCP service Answer a. who 5. Which of the following is not...
Basic ISDN Configuration 6 Points
The basic ISDN configuration task information is as follows ISDN switch type basic-5ess Configure the ISDN interfaces on R3 and R5 as follows Ensure that only R3 can call R5, and R3 should never challenge R5 for a username or password pairing. ISDN switch type is basic-5ess. Do not configure any SPIDs. If traffic exceeds more than 65 percent, the second ISDN B channel will be used. (Hint Enable ppp multilink.) If there is an error rate of 20 percent or higher, the interface on R3 should show...
NAT Operation on Cisco Routers
When a packet leaves the inside network, NAT translates the inside address to a unique InterNIC address for use on the outside network, as previously shown in Figure 6-2. The R1 Router in Figure 6-2 will be configured for an address translation and will maintain a NAT table. When an IP packet returns from the outside network, the NAT router will then perform an address translation from the valid InterNIC address to the original local inside address. Several internal addresses can be translated...
Introduction
The Cisco Certified Internetwork Expert (CCIE) Security Certification is an increasingly popular internetworking certification and one of the most popular security certifications in the world. Although CCIE certification builds on the foundation you may have established from CCNA certification, CCNP certification, and other certifications, there is no prerequisite to attempt to gain CCIE certification. However, attaining CCNA and CCNP certifications will help you understand the Cisco subjects...
Goal of This Lab
This lab should assist you in your final preparation for the CCIE Security lab exam. Sample solutions are provided here, but you need to research other various solutions on your own. Feel free to modify the questions to suit any design scenario and discover new IOS commands by using the Cisco Universe CD-ROM. This lab is not the only tool you should use rather, it is provided here to demonstrate the minimum level of difficulty you will encounter when attempting the CCIE Security lab exam. This...
CCIE Security Examinations
This appendix describes some study tips and options for you to consider while preparing for the CCIE Security written and lab examinations. CCIE is regarded as the most sought-after certification in the industry today more and more vendors are devising their own certification programs and trying to catch up to the industry-leading Cisco Systems. Working in the CCIE program for the past two years, I have seen many changes and challenges facing potential CCIEs every day. At the end of 2004, there...
Steps Required to Achieve CCIE Security Certification
The CCIE Security certification requires a candidate to pass two exams A 2-hour, computer-based written exam ( 350-018) consisting of 100 questions. The pass mark is approximately 70 percent, but varies according to statistics and could float between 65 and 75 percent. This book is designed to help prepare you for this written exam. An 8-hour lab exam. The passing score is set at 80 percent. Historically, the lab exam was a full 2-day lab that changed October 1, 2001. All CCIE lab exam versions...
CCIE Security Lab Exam
NOTE Although the focus of this book is to prepare you for the CCIE Security written exam only, you can find bonus material, such as this section, that helps start your preparation for the lab exam. Passing the written exam is the easier part of the CCIE Security certification journey. For the lab exam, your life needs to change dramatically, and you need to study on routers full time for at least 3 to 6 months. The good news is that the format of the lab exam has changed from 2 full days to 1...
IDS Placement
The HIDS is typically placed in a number of locations, such as the DMZ, behind a firewall, inline inside a Catalyst 6500, or on the inside network. Figure 5-2 displays a typical IDS placement and shows how this technology can be used to prevent attacks from within and from outside an organization. Figure 5-2 displays a network with three NIDSs in place communicating back to an IDS Device Manager (IDM). Figure 5-2 displays a network with three NIDSs in place communicating back to an IDS Device...
Border Gateway Protocol
BGP is an exterior routing protocol used widely on the Internet. It is commonly referred to as BGP4 (version 4). BGP4, defined in RFC 1771, allows you to create an IP network free of routing loops between different autonomous systems. (As defined in Table 11-1, an autonomous system is a set of routers under the same administrative control.) BGP is called a path vector protocol because it carries a sequence of autonomous system numbers that indicates the path taken to a remote network. This...
Basic Frame Relay Setup 5 Points
Configure the network in Figure 8-2 for basic physical Frame Relay connectivity. The following are the parameters You must use static Frame Relay maps for IP and disable Frame Relay inverse ARP. (Hint Use no frame-relay inverse-arp on all frame-enabled interfaces.) For the connection between R1 and R4, you are not permitted the keyword broadcast when mapping IP between the R1 R4 Frame Relay link. No dynamic mapping is permitted. No Frame Relay subinterfaces are permitted on any router. Assume...
CCIE Security Written Exam Blueprint
Table I-1 lists the CCIE Security written exam blueprint topics and the corresponding chapters where you can find the material covered in this book. As you can see, the blueprint places the objectives into eight categories. The book covers all of these topics. This blueprint is a guideline for the type of content that is likely to appear on the exam. You can also find it at Remote Authentication Dial-In User Service (RADIUS) Terminal Access Controller Access Control System Plus (TACACS+)...
Secure Shell and Cisco Ios Ssh
Secure Shell (SSH) is a protocol that provides a secure connection to a router. Cisco IOS supports version 1 and 2 of SSH, which enables clients to make a secure and encrypted connection to a Cisco router. Cisco refers to this SSH support as Cisco IOS SSH. Before SSH was implemented, the only form of security available when accessing devices such as routers was Telnet username password authentication, which is clearly visible with a network sniffer. Telnet is insecure because a protocol...
Domain Name System
This section covers the Domain Name System (DNS) and sample DNS configurations used on Cisco IOS routers. The primary use of DNS is to manage Internet names across the World Wide Web. To enable users or clients to use names instead of 32-bit IP addresses, the TCP IP model designers developed DNS to translate names into IP addresses. DNS uses TCP and UDP port number 53. TCP port 53 is also used for DNS zone transfers. UDP 53 is used for DNS lookups and browsing. In a large IP environment,...
Debugging Cisco Routers
The debug command is one of the best sets of tools you will encounter on Cisco routers. The debug command is available only from PRIV EXEC mode. Cisco IOS routers' debugging includes hardware and software to aid in troubleshooting internal problems and problems with other hosts on the network. The debug privileged EXEC mode commands start the console display of several classes of network events. For debug output to display on a console port, you must ensure that debugging to the console has not...
Cisco Inline IDS Intrusion Prevention System
Recently Cisco marketing released security concept, Intrusion Prevention System (IPS), along with the new router platforms, namely the 1800, 2800, and 3800. IPS is designed to leverage Cisco PIX software and Cisco IDS sensor technologies, combined with IOS software features. Cisco IOS IPS is an inline, deep-packet, inspection-based solution that helps enable Cisco IOS software to effectively mitigate network attacks. Cisco inline IDS (or IPS) allows for traffic to be dropped, can send an alarm,...
CCIE Security Self Study Lab
This chapter is designed to assist you in your final preparation for the CCIE Security exam by providing you with an extensive lab that incorporates many of the technologies and concepts covered throughout this book. This lab requires a broad perspective and knowledge base. Any knowledge you have acquired through the practical examples presented in this guide and reallife network implementations will help you achieve the end goal a routable network according to the security design criteria. The...
Cisco Secure ACS
Cisco Secure Access Control Server (ACS) is a network security software application that provides a number of security features such as logging, debugging, authorization, and authentication of users. Cisco ACS supports both RADIUS and TACACS+. You can download a trial version of the software that is supported on a Windows-based platform at http cisco.com public sw-center . Click the link to Cisco Secure Software. Although the CCIE Security written exam does not heavily test this application, it...
Simple Mail Transfer Protocol
SMTP, defined in RFC 821, is used to provide e-mail services to IP devices over the Internet. Typically, two mail servers talk SMTP to exchange e-mail. After the e-mail is exchanged, the users can retrieve their mail from the mail server and read it. This can be done using any mail client, such as Pine, Eudora, Outlook, and so on, which use different protocols, such as Post Office Protocol 3 (POP3), to connect to the server. SMTP uses well-known ports TCP port 25 and UDP port 25. Typically,...
Protecting Cisco IOS from Intrusion
Now that you have a snapshot of modern security concerns, look at Cisco IOS and the configuration commands you can use to deny intruders the ability to harm valuable network resources that are typically connected behind a Cisco router. In particular, this section covers how you can stop DoS attacks. There are, of course, various Cisco IOS vulnerabilities that can only be protected against by new software releases and regular Cisco IOS bulletins and e-mail blasts from Cisco Systems to ensure...
Wireless Best Practices
Cisco Architecture for Voice, Video and Integrated Data (AVVID) also contains details on best practices for wireless networks. As wireless networks grow around the globe, Cisco intends to ensure that you can connect wherever you are, 24 hours a day, thereby boosting your connectivity to the workplace. This means, of course, that connectivity is required in areas where there are no cables, such as caf s, airplanes, street corners, and hotel lobbies. Wireless networks have become one of the most...
Extensible Authentication Protocol Protected EAP and Temporal Key Integrity Protocol
Extensible Authentication Protocol (EAP) enables the dynamic selection of the authentication mechanism at authentication time based on information transmitted in the Access-Request (that is, via RADIUS). PPP also supports EAP during the link establishment phase. EAP allows the authenticator to request more information before determining the specific authentication mechanism. A proposal jointly submitted to the IEEE by Cisco Systems, Microsoft, and various other organizations introduced...
Extended Access Lists
Extended access lists range from 100 through 199 and 2000 through 2699. Alternatively, you can use a named access list with Cisco IOS release 12.0 or later. As mentioned earlier in this chapter, extended access lists can be applied to both source and destination addresses, as well as to filter protocol types and port numbers. Following are some examples of extended access lists that allow you to filter several different types of traffic. For Internet Control Message Protocol (ICMP) traffic, use...
IP Host Lookup and Disable DNS 1 Point
Configure local IP host addresses on each router (R1 through R5) so that when an EXEC or privileged user types the router name (R1, R2, R3, R4, or R5), the user can ping or telnet without having to type the full IP address. Do not configure a DNS server on any router, and disable DNS lookup entries so that incorrect commands on the EXEC or PRIV prompt are not sent to any DNS server. (Hint This saves you time as well the IOS command no ip domain-lookup disables DNS queries.) IP Host Lookup and...
Advanced Security Concepts
A wealth of security concepts have been covered in the previous chapters now, you are ready to look at some of the techniques that are used to secure areas of your network that are vulnerable to attacks, in particular the demilitarized zone (DMZ). The DMZ is defined as an isolated part of the network that is easily accessible to hosts outside of the network, such as the Internet. Figure 6-1 displays a typical network design where a DMZ is defined with a number of bastion hosts (first line of...
VLAN Hopping
VLAN hopping is a network attack whereby an end system sends out packets destined for a system on a different VLAN that cannot normally be reached by the end system. Typically, for a device to reach another device in a different VLAN, a Layer 3 device such as a router or Layer 3-aware switch is required. The attacker manipulates the frame and sends the traffic based on a different VLAN ID. The attacker may even attempt to be a trunk port and send 802.1q frames with data inside those frames....
CCIE Security Lab Exam FAQs
The following are some frequently asked questions about the difficult 1-day CCIE Security lab exam. 1. When did the lab format change from 2 days to 1 day October 2001. All CCIE certification labs worldwide now test candidates in the 1-day format. 2. Where can I take the CCIE Security lab exam Locations where you can take the CCIE Security lab exam follow Research Triangle Park (RTP), North Carolina, USA You can find more information at scheduling_lab_exam.html. 3. What is the maximum score and...
CBAC Configuration Task List
Configuring CBAC requires the following tasks 1. Pick an interface internal or external. 2. Configure IP access lists at the interface. 3. Configure global timeouts and thresholds. 5. Apply the inspection rule to an interface. 6. Configure logging and audit trail. 7. Following other guidelines for configuring a firewall. Example 6-6 shows a router named R1 with two Ethernet interfaces, one defined as the inside interface (EthernetO) and the other defined as the outside interface (Ethernetl)....
Vulnerabilities Attacks and Common Exploits
This section covers some of the vulnerabilities in TCP IP and the tools used to exploit IP networks. TCP IP is an open standard protocol, which means that both network administrators and intruders are aware of the TCP IP architecture and vulnerabilities. NOTE There are a number of network vulnerabilities, such as insufficient password protection, lack of authentication mechanisms, use of unprotected routing protocols, and firewall holes. This section concentrates on TCP IP vulnerabilities....
Sample CCIE Routing and Switching Lab II
This appendix is designed to assist you in your final preparation for the lab portion of the most popular CCIE certification to date, CCIE Routing and Switching (CCIE R& S). This second bonus version of the R& S lab examination contains only four routers, for those readers who do not have access to a large number of routers. This sample lab has been added after receiving many e-mails from readers who bought the previous edition of this book. I hope that it proves to be a useful...
Routing Protocols
This section covers four main routing protocols Routing Information Protocol (RIP) Enhanced Interior Gateway Routing Protocol (EIGRP) Open Shortest Path First (OSPF) Border Gateway Protocol (BGP) Before discussing the characteristic of each protocol, this section covers how routers (Cisco routers, in particular) generally route IP packets. Routing is a process whereby a path to a destination host is selected by either a dynamic or static routing protocol. A routing protocol is an algorithm that...
Spanning Tree Protocol Manipulation
Another common attack against switches is to manipulate the STP configuration by sending valid bridge protocol data units (BPDUs) and changing the topology of the network so as to create a spanning-tree loop. A Layer 2 loop in any network will bring down the entire broadcast domain and render all services unusable. Sometimes, in fact, spanning-tree loops occur naturally, so do not always assume that a Layer 2 loop is the result of an attacker's involvement without first properly investigating....
Do I Know This Already Nxo
A remote user tries logging into a remote network but fails after three additional tries and is disconnected. What useful information should the network administrator gather (Select the best two answers.) The network administrator needs the invalid username (because it is not an allowable username) and the invalid password used, to determine whether the intruder is using a text-based algorithm to generate usernames and passwords. 2. If a remote user Telnets to a router but accidentally types...
Cisco Ios Ssh
The Cisco IOS implementation of SSH (which has been available for several years now), called Cisco IOS SSH (available in S, E, and T trains of Cisco IOS software), is a service feature that is available in the service provider Cisco IOS revision levels. Cisco IOS SSH is used to ensure that remote devices are managed securely Telnet is a very insecure protocol, because all segments are sent in clear text. Cisco IOS SSH allows an administrator to remotely manage a Cisco IOS device, such as a...
ISDN Layer 2 Protocols
ISDN can use a number of Layer 2 encapsulation types. Point-to-Point Protocol (PPP) and HighLevel Data Link Control (HDLC) are the only methods tested in the qualification exam. NOTE X.25 is not tested in the CCIE Security written exam. HDLC is a WAN protocol encapsulation method that allows point-to-point connections between two remote sites. Typically, HDLC is used in a leased-line setup. HDLC is a connectionless protocol that relies on upper layers to recover any frames that have encountered...
Network Address Translation and Port Address Translation
NAT is a router function, which allows it to translate the addresses of hosts behind a firewall. This also helps to overcome IP address shortage, and provides security by hiding the entire network and its real IP addresses. NAT is typically used for internal IP networks that have unregistered (not globally unique) IP addresses. NAT translates these unregistered addresses into legal addresses on the outside (public) network. PAT provides additional address expansion but is less flexible than...
General Lab Guidelines and Setup
Follow these general guidelines during this lab Static and default routes are not permitted unless directly stated in a task. This includes floating static routes. Use the DLCIs provided in the Frame Relay diagram (presented shortly). All routers and switches should be able to ping any interface using the optimal routing path. Do not configure any authentication or authorization on any console or aux ports unless specified. Routes to Null0 generated by any routing protocol are permitted. Full...
Tacacs Versus RADIUS
Table 4-4 compares the main differences between TACACS+ and RADIUS. Table 4-4 TACACS+ RADIUS Comparison Encrypts only the password in the access-request packet from the client to the server. Encrypts the entire body of the packet but leaves a standard TCP header. Combines authentication and authorization. Uses the AAA architecture, separating authentication, authorization, and accounting. Supports other protocols, such as AppleTalk, NetBIOS, and IPX. Can pass a privilege level down to the...
Virtual Private DialUp Networks VPDN
A VPDN is a network that extends remote access dialup clients to a private network. VPDN tunnels use either Layer 2 forwarding (L2F) or Layer 2 Tunnel Protocol (L2TP). Cisco introduced L2F in RFC 2341. It is also used to forward PPP sessions for Multichassis Multilink PPP. L2TP, introduced in RFC 2661, combines the best of the Cisco L2F protocol and Microsoft Point-to-Point Tunneling Protocol (PPTP). Moreover, L2F supports only dial-in VPDN, while L2TP supports both dial-in and dial-out VPDN....
Telephony Best Practices
IP networks are a prime target for intruders and hackers. Traditionally, voice networks were secure because the PBXs in place did not have any IP connectivity. In today's Voice over IP (VoIP) telephony-based networks, every IP phone contains a routable IP address and thus is a prime target. For example, a hacker could program the Cisco Call Manager (CCM) to make every IP phone call the number 911 (or 000, depending on what part of the world you are in). If you do not secure the voice networks...
Cisco Works VMS
CiscoWorks VPN Security Management Solution (VMS) is core management software that provides a centralized means of defining and distributing security policies, providing patches and software updates, and ensuring communication with all agents. A Cisco Security Agent is defined as an endpoint software device that resides on servers or desktops laptops and autonomously enforces local policies that prevent attacks. CiscoWorks VMS is an integral part of the SAFE Blueprint. The following are some of...
Intrusion Detection System
Intrusion detection systems (IDSs) are designed to detect and thwart network attacks. Based on their location, IDSs can be either of the following Network-based IDS (NIDS) Examines or sniffs every packet flowing across the network and generates an alarm upon detection of a network attack signature. Host-based IDS (HIDS) Examines operating system information, such as logs or system processes, against a base line. When the system deviates from the normal values because of an attack, alarms are...
Radius Configuration Task List
A RADIUS server is usually software that runs on a variety of platforms, including Microsoft Windows 2000 Server and various UNIX hosts. RADIUS can authenticate router users and even validate IP routes. To configure RADIUS on your Cisco router or NAS, perform the following tasks Step 1 Enable AAA with the aaa new-model global configuration command. AAA must be configured if you plan to use RADIUS. Step 2 Use the aaa authentication global configuration command to define method lists for RADIUS...
Dynamic Access List Lock and Key Feature 5 Points
Make sure that during normal operation it is not possible to ping from R2 (Ethernet0 0) to R3 (FastEthernet0 0). After a Telnet login from R2 to R3, pings are allowed, but make sure that after 5 minutes of inactivity normal operation is restored. Routing should still be in place in both circumstances. Dynamic Access List Lock and Key Feature Solution This is an example where dynamic access lists are used to allow access only after a valid username password has been entered. Access is denied...
Diffie Hellman
The Diffie-Hellman protocol allows two parties to establish a shared secret over insecure channels, such as the Internet. This protocol allows a secure shared key interchange over the public network, such as the World Wide Web, before any secure session and data transfer is initiated. Diffie-Hellman ensures that, by exchanging just the public portions of the key, both devices can generate a session and ensure that data is encrypted and decrypted by valid sources only. Only public keys (clear...
Fast Ether Channel
Fast EtherChannel (FEC) is a Cisco method that bundles 100-Mbps Fast Ethernet ports into a logical link. The existence of any redundant paths between two switches results in some ports being in a blocking state, thus reducing available bandwidth. Figure 1-4 displays a switched network with two 100-Mbps connections between them. Because of STP, one of the links (Switch A, in this case) will be in a blocking state after the election of a root bridge. Switch B will block one of the paths to ensure...
Cisco Secure VPN Client
The Cisco Secure VPN Client is a low-cost application available to the Internet community. You may need to purchase a license at a minimal cost. The VPN Client is free when you buy a VPN gateway and support contract, and is included with all models of Cisco VPN 3000 Series Concentrators and most Cisco PIX 500 Security Appliances. Customers with Cisco SMARTnet support contracts and encryption entitlement may download the Cisco Secure VPN Client from the Cisco Software Center at no additional...
Network Based Intrusion Detection Systems
You will be forgiven for looking at this new blueprint objective and wondering what exactly is to be expected of a candidate taking the new CCIE Security written exam. This section unravels this objective and provides you with the best preparation possible to ensure that you pass this portion of the exam on your first attempt. Network-based intrusion detection has been defined by many security vendors, such as Cisco, which has defined IDS as a method of detecting an illegal packet within your...
Scenario Routing IP on Cisco Routers
Figure 1-21 displays a network with one Cisco router and two directly attached Ethernet interfaces. Use Figure 1-21 to answer the following questions. E0 IP address 1.1.1.100 MAC address 3333.3333.3333 E1 IP address 2.1.1.100 MAC address 4444.4444.4444 E0 IP address 1.1.1.100 MAC address 3333.3333.3333 E1 IP address 2.1.1.100 MAC address 4444.4444.4444 1. In Figure 1-21, PC1 cannot communicate with PC2. What is the likely cause of the problem, assuming that the router is configured correctly a....
Additional Advanced Lab Topics No Solutions Provided
Presented here are some advanced CCIE Security questions with no lab solutions so that you may investigate and try to solve them on your own, just as you would have to do in the lab exam. These bonus CCIE Security lab topics are added because they are not covered in the main section of this chapter. Hopefully they will provide you with some example questions and help you discover your own exam techniques to help you achieve maximum success in the CCIE Security lab. In every CCIE lab exam that I...
Cisco Router and Security Device Manager
Cisco Router and Security Device Manager (SDM) is an intuitive, secure, web-based embedded device manager of Cisco IOS-enabled devices. SDM provides intelligent wizards, detects mis-configured devices, steps security managers through firewall and VPN configurations, and has been certified and recommended by some key organizations within Cisco, such as the Cisco Network Supported Accounts (NSA), a group of expert engineers within Cisco whose services are sold to high-end clients. SDM is the TAC...
Access Lists on Cisco Routers
By default, a Cisco router permits all IP and TCP traffic unless an access list is defined and applied to the appropriate interface. Figure 3-4 illustrates the steps taken if an access list is configured on a Cisco router. If an incoming IP packet is received on a router and no access list is defined, the packet is forwarded to the IP routing software. If an access list is defined and applied, the packet is checked against the access list, and the appropriate permit or deny action is taken. The...
Cisco Security Agent and Host Based IDS
CSA provides threat protection for servers and PCs. CSA identifies and prevents malicious behavior, thereby eliminating known and unknown security risks. Typically, devices with antivirus software do not detect the latest worms or code violations. CSA fills in this gap by triggering an alert to the system or the management server any time an application or packet tries to use the kernel inside a Windows-based system. CSA also blocks the attack. CSA can be installed as a standalone client or in...
Tacacs Configuration Task List
To configure your router to support TACACS+, you must perform the following tasks Step 1 Use the aaa new-model global configuration command to enable AAA, which must be configured if you plan to use TACACS+. For more information about using the aaa new-model command, refer to Step 2 Use the tacacs-server host command to specify the IP address of one or more TACACS+ daemons tacacs-server host hostname single-connection port integer timeout integer key string Use the tacacs-server key command to...
FAQs About the CCIE Security Written Exam
This section answers some common questions about the written CCIE Security exam. These frequently asked questions should help dispel any confusion surrounding this exam. 1. How many questions are on the CCIE Security written exam There are 100 questions. All questions are multiple choice. Some questions require a single answer, whereas other questions require more than one answer to earn a point. Cisco no longer publishes a set passing score for the written exam. Instead, Cisco supplies you...
Message Digest 5 and Secure Hash Algorithm
Several hashing algorithms are available. The two discussed here are MD5 and SHA. There is a slight, unknown difference between SHA and SHA-1. NSA released SHA and then later discovered a flaw (undisclosed). NSA fixed it, and called the new version SHA-1. In this guide, SHA refers to SHA-1 also. Message hashing is an encryption technique that ensures that a message or data has not been tampered with or modified. MD5 message hashing is supported on Cisco IOS routers. A variable-length message is...