You are on page 1of 90

Table of Contents

Chapter 1
Network Security Principles ..................3

CCNA Security 640-554
Quick Reference

Chapter 2
Perimeter Security ............................... 23
Chapter 3
Cisco IOS Firewalls............................... 39
Chapter 4
Site-to-Site VPNs.................................. 50
Chapter 5
Cisco IOS IPS ........................................ 66
Chapter 6
LAN, SAN, Voice,
and Endpoint Security .......................... 79

Anthony Sequeira
CCIE, CCSI, VCP, Data Center Specialist

ciscopress.com

[2]
CCNA Security 640-554 Quick Reference

About the Author
Anthony Sequeira, CCIE No. 15626, is a Cisco Certified Systems Instructor and author regarding all levels and
tracks of Cisco Certification. Anthony formally began his career in the information technology industry in 1994 with
IBM in Tampa, Florida. He quickly formed his own computer consultancy, Computer Solutions, and then discovered
his true passion—teaching and writing about Microsoft and Cisco technologies. Anthony joined Mastering
Computers in 1996 and lectured to massive audiences around the world about the latest in computer technologies.
Mastering Computers became the revolutionary online training company KnowledgeNet, and Anthony trained there
for many years. Anthony is currently pursuing his second CCIE in the area of Security and is a full-time instructor
for the next generation of KnowledgeNet, StormWind Live.

About the Technical Editor
Sean Wilkinsis an accomplished networking consultant for SR-W Consulting (http://www.sr-wconsulting.com)
and has been in the field of IT since the mid 1990s working with companies such as Cisco, Lucent, Verizon and
AT&T. Sean currently holds certifications with Cisco (CCNP/CCDP), Microsoft (MCSE), and CompTIA (A+
and Network+). He also has a master’s of science degree in Information Technology with a focus in Network
Architecture and Design, a master’s of science degree in Organizational Management, a master’s certificate in
Network Security, a bachelor’s of science degree in Computer Networking, and an associate’s degree in Applied
Science in Computer Information Systems. In addition to working as a consultant, Sean spends a lot of his time as a
technical writer and editor for various companies.

© 2012 Pearson, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

Network Security Objectives Network security should provide the following: ■ Data confidentiality ■ Data integrity ■ Data and system availability © 2012 Pearson Education. intrusion prevention systems (IPS). This publication is protected by copyright. blank or default passwords are used. All rights reserved. Internal threats are the most serious. Why Do We Need Network Security? Network threats include internal and external threats. These threats often occur because best practices are not followed. Please see page 89 for more details. For example. . External threats typically rely on technical methods to attack the network. or in-house developers use insecure programming practices.[3] CCNA Security 640-554 Quick Reference Chapter 1 Network Security Principles Network Security Fundamentals This section covers the need for network security and the security objectives found within most organizations. Firewalls. Inc. routers with access control lists (ACL). The CCNA in Security focuses on combating these attacks using technical means. and other methods are the focus. This section also examines the different types of attacks that modern networks can experience.

Common categories include policy flaws. An organization must classify its assets. There is a National Vulnerability Database and also a Common Vulnerabilities and Exposures document. Powerful methods to ensure confidentiality are encryption and access controls. A countermeasure is a safeguard that mitigates against potential risks. or fail an entire network with a large quantity of information. Integrity ensures that data has not been changed by an unauthorized individual. and Threats Assets are anything of value to the organization. A threat is a potential danger to information or systems. Not all assets have the same value. protocol weaknesses. A vulnerability is a weakness in a system or a design that might be exploited.[4] Chapter 1: Network Security Principles Confidentiality ensures that only authorized individuals can view sensitive data. This publication is protected by copyright. and physical controls. Assets. technical. These attacks typically try to fail a system using an unexpected condition or input. . Countermeasures are typically administrative. Vulnerabilities. Information security risk is the measure of the impact of threat vectors exploiting the vulnerabilities of the assets you must to protect. Denial-of-service (DoS) attacks attempt to compromise data availability. All rights reserved. and software vulnerabilities. Availability ensures that access to the data is uninterrupted. Data Classification Public-sector classification levels include the following: ■ Unclassified ■ Sensitive but unclassified (SBU) © 2012 Pearson Education. Please see page 89 for more details. Inc.

. the sensitivity of data typically decreases. ■ Age: With time. Inc. Please see page 89 for more details. ■ Useful life: Information can be made obsolete with newer information. All rights reserved. This publication is protected by copyright. Classification roles include the following: ■ Owner ■ Custodian (responsible for the day-to-day management of the data) ■ User © 2012 Pearson Education. ■ Personal association: The data is associated with sensitive issues or individuals.[5] Chapter 1: Network Security Principles ■ Confidential ■ Secret ■ Top-secret Private-sector classification levels include the following: ■ Public ■ Sensitive ■ Private ■ Confidential Classification criteria include the following: ■ Value: This is the most important factor.

and administrative law. Controls are categorized as preventative. civil. Physical controls are mostly mechanical. deterrent. Studying these attacks is the first step to defend against them. opportunity. and means. or detective. All rights reserved.[6] Chapter 1: Network Security Principles Security Controls Administrative controls involve policies and procedures. The system should not be shut down or rebooted before the investigation begins. Inc. Ethics refer to values that are even higher than the law. Laws and Ethics Security policy must attempt to follow criminal. and software. Responses Investigators must prove motive. © 2012 Pearson Education. Technical controls involve electronics. . Network Attack Methodologies You must understand the command types of attacks that a network can experience. This publication is protected by copyright. Please see page 89 for more details. hardware.

All rights reserved. . A risk is the likelihood that a specific attack will exploit a particular vulnerability of a system. Inc. An exploit happens when computer code is developed to take advantage of a vulnerability. This publication is protected by copyright. Please see page 89 for more details.[7] Chapter 1: Network Security Principles Motivations and Classes of Attack A vulnerability is a weakness in a system that can be exploited by a threat. The main vulnerabilities of systems are categorized as follows: ■ Design errors ■ Protocol weaknesses ■ Software vulnerabilities ■ Misconfiguration ■ Hostile code ■ Human factor Potential adversaries can include the following: ■ Nations or states ■ Terrorists ■ Criminals ■ Hackers ■ Corporate competitors ■ Disgruntled employees ■ Government agencies © 2012 Pearson Education.

3. they run scripts written by other. Escalate privileges. Please see page 89 for more details. Instead. Install back doors. ■ Academic hackers: People who enjoy designing software and building programs with a sense for aesthetics and playful cleverness. All rights reserved. How Does a Hacker Usually Think? 1. . 6. software cracking. Inc. 4. including the following: ■ Hackers: Individuals who break into computer networks and systems to learn more about them. ■ Hacktivists: Individuals who have a political agenda in doing their work. This publication is protected by copyright. 7. Manipulate users to gain access. They do not write their own code. © 2012 Pearson Education. and the modification of computer hardware and other electronic devices. ■ Crackers (criminal hackers): Hackers with a criminal intent to harm information systems.[8] Chapter 1: Network Security Principles Many different classifications are assigned to hackers. ■ Script kiddies: Individuals with low skill level. 2. Leverage the compromised system. Gather additional passwords and secrets. ■ Phreakers (phone breakers): Individuals who compromise telephone systems. Enumerate applications and operating systems. ■ Hobby hacker: Focuses mainly on computer and video games. Perform footprint analysis (reconnaissance). more skilled attackers. 5.

This publication is protected by copyright. ■ Defend the enclave boundaries. Inc. Please see page 89 for more details. or a DoS type of attack. These reconnaissance attacks are typically the first steps in a much larger more damaging attack. ■ Build layered defenses. the attacker sends messages to a computer with an IP address that indicates the message is coming from a trusted host. All rights reserved. ■ Deploy IDS or IPS. IP spoofing is often the first step in the abuse of a network service. ■ Use robust key management. . Hackers can guess or predict the TCP sequence numbers that are used to construct a TCP packet without receiving any responses from the server. In IP spoofing. Their prediction allows them to spoof a trusted host on a local network. Enumeration and Fingerprinting Ping sweeps and port scans are common practices to identify all devices and services on the network. © 2012 Pearson Education. ■ Use robust components. The basis of IP spoofing lies in an inherent security weakness in TCP known as sequence prediction.[9] Chapter 1: Network Security Principles Defense in Depth The defense-in-depth strategy recommends several principles: ■ Defend in multiple places. ■ Defend the computing environment. IP Spoofing IP spoofing refers to forging the source address information of a packet so that the packet appears to come from some other host in the network.

Source routing is the capability of the source to specify within the IP header a full routing path between endpoints. All rights reserved. Please see page 89 for more details. This publication is protected by copyright. An attacker sniffs to identify the client and server IP addresses and relative port numbers. drop such packets by default. The attacker replies to the client using a modified packet with the source address of the server and the destination address of the client. The ACK packet contains the sequence number of the next packet that the client expects. . Inc. Spoof attacks are often combined with IP source-routing options set in packets. The attacker waits to receive an ACK packet from the client communicating with the server. Man-in-the-middle attacks are often the result of TCP/IP spoofing. This packet results in a reset that disconnects the legitimate client. Cisco IOS routers drop all source-routed packets if the no ip sourceroute global command is configured. Man-in-theMiddle Host A Host B R1 R2 Figure 1-1 Man-in-the-Middle Attack © 2012 Pearson Education. The attacker then modifies his packet headers to spoof TCP/IP packets from the client. such as Cisco PIX 500 Series Security Appliances and the Cisco ASA 5500 Series Adaptive Security Appliances. Security devices.[ 10 ] Chapter 1: Network Security Principles IP spoofing attacks are categorized in one of two ways: ■ Nonblind spoofing: The attacker sniffs the sequence and acknowledgment numbers and does not need to “predict” them. ■ Blind spoofing: The attacker sends several packets to the target machine to sample sequence numbers and then predicts them for the attack. Figure 1-1 shows a man-in-the-middle attack. The attacker takes over communications with the server by spoofing the expected sequence number from the ACK previously sent from the legitimate client to the server.

Pharming is an attack aimed at redirecting the traffic of one website to another website. such as usernames. Following are some of the common methods: ■ Packet sniffing: Eavesdropping and logging traffic that passes over a digital network or part of a network. Inc. . and identity theft: Phishing is an attempt to criminally acquire sensitive information. This publication is protected by copyright.[ 11 ] Chapter 1: Network Security Principles Confidentiality Attacks Attackers can use many methods to compromise confidentiality. © 2012 Pearson Education. ■ Overt channels: The ability to hide information within a transmission channel based on tunneling one protocol inside another. by masquerading as a trustworthy entity. and credit card details. ■ Phishing. ■ Port scanning: Searching a network host for open ports. ■ Dumpster diving: Searching through company dumpsters. ■ Emanations capturing: Capturing electrical transmissions from the equipment of an organization to obtain information about the organization. All rights reserved. Steganography is an example of an overt channel: hiding messages in digital pictures and digitized audio. ■ Data diddling: Changing data before or as it is input into a computer. Integrity Attacks Hackers can use many types of attacks to compromise integrity: ■ Salami attacks: A series of minor data security attacks that together result in a larger attack. ■ Wiretapping: Monitoring the telephone or Internet conversations of a third party. pharming. Please see page 89 for more details. ■ Covert channels: The ability to hide information within a transmission channel based on encoding data using another set of events. passwords. looking for information that can provide a valuable source of information for hackers. ■ Social engineering: Using social skills to manipulate people inside the network to provide the information needed to access the network.

. or both.[ 12 ] Chapter 1: Network Security Principles ■ Trust exploits: An individual taking advantage of a trust relationship within a network. This publication is protected by copyright. Perhaps the trust relationship is between a system in the DMZ and a system in the inside network. password. airflow. water. ■ Computer environment: Temperature. © 2012 Pearson Education. This is a form of DoS. ■ SYN floods: The system is sent many different false SYN requests for TCP communication channels. worms. malware that combines the characteristics of viruses. humidity. ■ DoS (denial-of-service): An attack seeks to make a system or service unavailable after the system is sent large amounts of traffic. and others. Inc. or spikes. Availability Attacks Hackers can use many types of attacks to compromise availability: ■ Botnets: A collection of software robots that run autonomously and automatically. Please see page 89 for more details. ■ DDoS (Distributed DoS): Hackers use a terminal to scan for systems to hack. Trojan horses. ■ Electrical power: Attacks involve power loss. and gas. ■ Session hijacking: The exploitation of a valid computer session to gain unauthorized access to information or services in a computer system. spyware. Blended Threats A growing trend is for attacks to combine techniques. All rights reserved. The hacker then installs zombie software on them. ■ ICMP floods: The system is sent many false ICMP packets. For example. reduction. ■ Password attacks: Any attack that attempts to identify a user account.

Please see page 89 for more details. ■ Perform backups and test the backed-up files on a regular basis. ■ Control physical access to systems. Security Architecture Design Guidelines ■ Defense in depth ■ Compartmentalization ■ Least privilege ■ Weakest link ■ Separation and rotation of duties ■ Hierarchically trusted components and protection © 2012 Pearson Education. ■ Use strong passwords.[ 13 ] Chapter 1: Network Security Principles Best Practices for Mitigation These include the following: ■ Keep patches up-to-date. ■ Educate employees about the risks of social engineering. ■ Avoid unnecessary web page inputs. ■ Implement security hardware and software. ■ Develop a written security policy for the company. Inc. ■ Shut down unnecessary services and ports. ■ Encrypt and password-protect sensitive data. This publication is protected by copyright. All rights reserved. . and change them often.

■ Operations and maintenance: Includes configuration management and control. All rights reserved. ■ Acquisition and development: Includes a risk assessment. security control development. security functional requirements analysis. media sanitization. and continuous monitoring. Inc. security planning. cost considerations and reporting. and hardware and software disposal. ■ Implementation: Includes inspection and acceptance.[ 14 ] Chapter 1: Network Security Principles ■ Mediated access ■ Accountability and traceability ■ Regulatory compliance ■ Strengthened enforcement ■ Global spread of data breach notification laws ■ More prescriptive regulations ■ Growing requirements regarding third parties (business partners) ■ Risk-based compliance on the rise ■ Compliance process streamlined and automated ■ Examples: HIPAA. Please see page 89 for more details. developmental security test and evaluation. security assurance requirements analysis. . FISMA. and other planning components. system integration. security certification. and security accreditation. © 2012 Pearson Education. and GLB Operation Security Secure Network Life Cycle Management A general system development life cycle (SDLC) includes five phases: ■ Initiation: Consists of a security categorization and a preliminary risk assessment. This publication is protected by copyright. ■ Disposition: Includes information preservation.

All rights reserved.11 or wireless LAN testing) ■ Penetration testing The following list is a collection of popular tools: ■ Nmap ■ GFI LANguard ■ Tripwire ■ Nessus ■ Metasploit ■ SuperScan by Foundstone. a division of McAfee © 2012 Pearson Education. .[ 15 ] Chapter 1: Network Security Principles Security Testing Many types of testing techniques are available: ■ Network scanning ■ Vulnerability scanning ■ Password cracking ■ Log review ■ Integrity checkers ■ Virus detection ■ War dialing ■ War driving (802. Inc. Please see page 89 for more details. This publication is protected by copyright.

and all operations must be moved. ■ Catastrophe: The facilities are destroyed. ■ Business Continuity Concepts ■ Maximum Tolerable Downtime (MTD): The maximum length of time a business function can be discontinued without causing irreparable harm to the business © 2012 Pearson Education. This publication is protected by copyright. . All rights reserved. recovery ■ Post-incident activities Computer Crime Investigations ■ Motive: Why did they do it? ■ Opportunity: Were they able to do it? ■ Means: Were they capable of doing it? Disaster Recovery Possible disruptions can be categorized as follows: ■ Nondisaster: A situation in which business operations are interrupted for a relatively short period of time. Please see page 89 for more details. eradication.[ 16 ] Chapter 1: Network Security Principles Incident Management ■ Preparation ■ Detection and analysis ■ Containment. Inc. ■ Disasters: These cause interruptions of at least a day.

Please see page 89 for more details. Borderless security products include the following: ■ Secure-X and context-aware security ■ Threat control and containment ■ Cloud security and data loss prevention ■ Secure connectivity through VPNs ■ Security management © 2012 Pearson Education. It features broad coverage. Inc. This publication is protected by copyright. ■ Warm site: A facility with similar equipment to the original site but is unlikely to have current data because of a lack of frequent replication with the original site. persistent connectivity. All rights reserved. The borderless end zone consists of intelligent endpoint traffic routing. . and advanced security. A secure virtualized data center is another key component. Borderless Networking Mobility is dissolving the borders of networks.[ 17 ] Chapter 1: Network Security Principles ■ Recovery Time Objective (RTO): The duration of time that a service level within a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity ■ Recovery Point Objective (RPO): The maximum tolerable period in which data might be lost from an IT service due to a major incident Backups ■ Hot site: A completely redundant site with similar equipment to the original site. servers and routers). ■ Cold site: Does not typically contain redundant computing equipment (for example.

such as routing protocols ■ Data plane. The components of SecureX include the following: ■ Context awareness ■ Cisco AnyConnect Client ■ TrustSec: End-to-end security using security group tags on traffic ■ Cisco Security Intelligence Operations: Cloud-based security service Threats in cloud services ■ Abuse of cloud computing ■ Insecure interfaces and APIs ■ Malicious insiders ■ Shared technology issues ■ Data loss or leakage ■ Account or service hijacking ■ Unknown risk profile Network Foundation Protection Understanding the device planes: ■ Control plane. This publication is protected by copyright. Inc.[ 18 ] Chapter 1: Network Security Principles ■ ■ Cisco SecureX: SecureX is an access control strategy that enables effective. All rights reserved. Please see page 89 for more details. . high-level policy creation and enforcements for mobile users. forwarding of data packets ■ Management plane. used by management sessions © 2012 Pearson Education.

Transport Layer Security (TLS). © 2012 Pearson Education. . Routing protocol authentication. Network Time Protocol (NTP). and AutoSecure ■ Management Plane: Authentication. Zone-Based Firewall. and IOS Intrusion Prevention System (IPS) Developing a Network Security Policy This section details the creation of a network security policy—an important document that details the security objectives and procedures for the organization. such as the following: ■ Making employees aware of their security-practice obligations ■ Identifying specific security solutions required to meet the goals of the security policy ■ Acting as a baseline for ongoing security monitoring Components of the Security Policy What are the components found in the network security policy? This section covers these details. Secure Shell (SSH). and Accounting (AAA). Why Do You Need One? Aside from protecting organization assets. and command-line interface (CLI) views ■ Data Plane: Access control lists (ACLs). Control Plane Protection (CPPr). Authorization. Layer 2 controls. a security policy serves other purposes. This publication is protected by copyright. Syslog. Inc. All rights reserved. Simple Network Management Protocol (SNMP). Please see page 89 for more details.[ 19 ] Chapter 1: Network Security Principles Cisco NFP Toolkit ■ Control Plane: Control Plane Policing (CoPP).

rather than the governing policy. . All rights reserved. © 2012 Pearson Education. Following are typical elements of this section: ■ Identification of the issue addressed by the policy ■ Discussion of the organization’s view of the issue ■ Examination of the relevance of the policy to the work environment ■ Explanation of how employees must comply with the policy ■ Enumeration of appropriate activities. actions. Inc. Please see page 89 for more details.[ 20 ] Chapter 1: Network Security Principles Governing Policy At a high level. and processes ■ Explanation of the consequences of noncompliance Technical Policies Technical policies provide a more detailed treatment of an organization’s security policy. a governing policy addresses security concepts deemed important to an organization. This publication is protected by copyright. Elements of this section include the following: ■ E-mail ■ Wireless networks ■ Remote access End-User Policies End-user policies address security issues and procedures relevant to end users.

Also. Senior security or IT personnel are usually directly involved with the creation of the security policy. Senior management typically oversees the development of a security policy. Examples of senior security or IT personnel include the following: ■ Chief security officer (CSO) ■ Chief information officer (CIO) ■ Chief information security officer (CISO) Risk Analysis. ■ Qualitative analysis: Uses a scenario model. and ARO is the annualized rate of occurrence. This is risk analysis.[ 21 ] Chapter 1: Network Security Principles More Detailed Documents More detailed documents are often contained in a security policy: ■ Standards: Support consistency within a network ■ Guidelines: Tend to be suggestions ■ Procedures: Detailed documents providing step-by-step instructions for completing specific tasks Roles and Responsibilities The ultimate responsibility for an organization’s security policy rests on the shoulders of senior management. analysis must be performed of the probability that a threat will occur and the severity of that threat. A sample quantitative analysis formula is ALE = AV * EF * ARO. Inc. you can use one of two approaches: ■ Quantitative analysis: Mathematically models the probability and severity of a risk. this formula calculates the annualized loss expectancy (ALE). . This publication is protected by copyright. All rights reserved. © 2012 Pearson Education. and Avoidance Network designers identify threats to the network using threat identification practices. When performing risk analysis. AV is an asset value. Management. EF is the exposure factor. Please see page 89 for more details. where scenarios of risk occurrence are identified. The ALE produces a monetary value that you can use to help justify the expense of security solutions.

Benefits ■ Reduced integration costs ■ Proactive. ■ Adaptive: The network can intelligently evolve and adapt the threats. This publication is protected by copyright. Analysis. All rights reserved. ■ Collaborative: Collaboration occurs among the service and devices throughout the network.[ 22 ] Chapter 1: Network Security Principles Creating the Cisco Self-Defending Network This type of network is built in three phases: ■ Integrated: Every element is a point of defense. planned upgrades ■ Improves efficiency of security management Key Tools Note MARS is currently End of Sale/End of Life. Please see page 89 for more details. . and Response System): Provides security monitoring for network security devices and host applications made by Cisco and other providers © 2012 Pearson Education. Inc. ■ Cisco Security Manager: Powerful but easy-to-use solution that enables you to centrally provision all aspects of device configurations and security policies for the Cisco family of security products ■ MARS (Cisco Security Monitoring.

Inc. Please see page 89 for more details. scalable delivery of mission-critical business applications. . 1800 Series. security. This publication is protected by copyright. All rights reserved. and 3800 Series.[ 23 ] CCNA Security 640-554 Quick Reference Chapter 2 Perimeter Security Securing Administrative Access to Routers It is critical to secure administrative access to the routers that help power your network infrastructure. 2800 Series. embedding data. voice. and wireless in the platform portfolio for fast. Router Security Principles Following are three areas of router security: ■ Physical security ■ Operating system ■ Router hardening Cisco Integrated Services Router Family Cisco Integrated Services Routers feature comprehensive security services. This section details exactly how you must do this. Models include the 800 Series. © 2012 Pearson Education.

To create username and password entries in the local accounts database. Inc. These commands can be used: ■ Console password line console 0 login password cisco ■ Virtual terminal password line vty 0 4 login password cisco ■ Enable password enable password cisco ■ Secret password enable secret cisco All these passwords are in clear text in the configuration files with the exception of the enable secret command. . To disable the ability to access ROMMON to disable password recovery on your router. All rights reserved. Please see page 89 for more details. use the syntax username name secret { [0] password | 5 encrypted-secret}. such as HTTP or Telnet/SSH. © 2012 Pearson Education. To encrypt the passwords that are clear text. This publication is protected by copyright. You can also configure minimum password lengths with the security passwords min-length length command. To configure idle timeouts for router lines. use no service password-recovery.[ 24 ] Chapter 2: Perimeter Security Configuring Secure Administrative Access You need to secure administrative access for local access (console port) and remote access. use the command service password-encryption. You must password-protect your router. use the command exec-timeout minutes [seconds].

These views contain the specific commands available for different administrators. levels 1 through 14 are levels you can customize. Use the parser view view-name command to create a new view. Please see page 89 for more details. To configure role-based CLI. © 2012 Pearson Education.” If a user has level 13 access. that user also gains access to the commands in levels 1 through 12. To see these protected files. Use the configure terminal command to enter global configuration mode. Remember that privilege levels “cascade. These protected files do not appear in a dir listing of flash. All rights reserved. STEP 6. . The syntax for this command is privilege mode {level level command | reset command}. Use the enable view command to enable the feature. complete the following steps: STEP 1. use the show secure bootset command. Inc. STEP 4. different administrators have different “views” of the CLI. Verify using the enable view command. and the command secure boot-config protects the running configuration. The secure boot-image command protects the IOS image. STEP 5. Using this approach. 0 through 15. This publication is protected by copyright.[ 25 ] Chapter 2: Perimeter Security Setting Multiple Privilege Levels You can configure multiple privilege levels on the router for different levels of your administrators. Enable AAA. Role-Based CLI Access A new approach to having various levels of access for different administrators is called role-based CLI access. Use the command commands parser-mode {include | include-exclusive | exclude} [all] [interface interfacename | command] to assign commands to the selected view. and level 15 is reserved for privileged mode commands. Securing the Cisco IOS image and Configuration Files You can now secure copies of the IOS and your configuration file in memory so that they cannot be maliciously or accidentally erased. Level 0 is reserved for user-level access privileges. Use the secret command to assign a password to the view. STEP 2. STEP 3. There are 16 privilege levels. use the privilege command from the global configuration mode. To assign privileges to levels 2 through 14. STEP 7.

With these messages. ■ show login Verifies that the login block-for command is issued. Banner Messages Banner messages are important. This command is mandatory. This publication is protected by copyright. © 2012 Pearson Education. Please see page 89 for more details. The devices that match a permit statement in the ACL are exempt from the quiet period.[ 26 ] Chapter 2: Perimeter Security Enhanced Security for Virtual Logins The following commands have been added to enhance security for virtual logins: ■ login block-for seconds attempts tries within seconds This command configures your Cisco IOS device for login parameters that help provide denial-of-service (DoS) detection. The syntax for this command is banner {exec | incoming | login | motd | slip-ppp} d message d. All rights reserved. you can ensure that unauthorized personnel are informed that they will be prosecuted for illegal access. . ■ login on-failure log [every login] Generates logging messages for failed login attempts. all other commands here are optional. ■ login delay seconds Configures a delay between successive login attempts. ■ login on-success log [every login] Generates logging messages for successful login attempts. Inc. ■ login quiet-mode access-class {acl-name | acl-number} This command specifies an ACL that is to be applied to the router when it switches to quiet mode.

10. © 2012 Pearson Education.1. you can access CCP from your PC web browser by going to http://10. All rights reserved. Inc.com. Supporting CCP CCP is factory-installed on some router models. This publication is protected by copyright.[ 27 ] Chapter 2: Perimeter Security Cisco Configuration Professional (CCP) CCP is a powerful graphical user interface you can use to configure and monitor your Cisco router. . Please see page 89 for more details. It is also available on a CD-ROM included with new routers and can be downloaded from Cisco.10. configure the following services for CCP to access the router properly: ■ Set up a username and password that has privilege level 15: username name privilege 15 secret password ■ Enable the HTTP server: ip ip ip ip ■ http http http http server authentication local secure-server (for enabling HTTPS access to CCP) timeout-policy idle 600 life 86400 request 1000 Define the protocol to use to connect to the Telnet and Secure Shell (SSH) vty lines: line con 0 login local line vty 0 4 privilege level login local transport input line vty 5 15 privilege level login local transport input 15 telnet ssh 15 telnet ssh On a new router. If the router is an existing router and is not configured with the CCP default configuration.

. This publication is protected by copyright. When you click either Configure or Monitor. authorization. This section details the use of these services with a local database on the router or switch.[ 28 ] Chapter 2: Perimeter Security Running CCP To launch Cisco CCP from a PC. All rights reserved. Templates. choose Start > Programs (All Programs) > Cisco Systems > Cisco CCP > Cisco CCP. Configure. and Monitor are the main buttons you need to use. © 2012 Pearson Education. Inc. ■ Communities: Groups of devices that share common components ■ Templates: Allows the simple replication of settings ■ User profiles: GUI views that provide role-based access control for different administrators Using AAA with the Local Database Authentication. and User Profiles. open an HTTP or HTTPS connection to the IP address of the Ethernet interface on the router. Navigating in CCP Home. Please see page 89 for more details. To launch CCP from the router flash memory. Many of these options lead to a wizard that aids in the configuration. These appear on the top button bar. These features include Communities. and accounting (AAA) services are a powerful security addition to any organization. many options appear down the button bar on the left side of the screen. Building Blocks for Ease of Management There are some new additions to the Cisco Configuration Professional that directly address the ease of management for larger environments.

.[ 29 ] Chapter 2: Perimeter Security Authentication. and then the router authenticates using the local database. use the aaa local authentication attempts max-fail command in global configuration mode. Authorization. Then choose Configure > Router > AAA > AAA Summary to ensure that AAA is enabled. This publication is protected by copyright. To configure in CCP. Please see page 89 for more details. Then choose Configure > Router > AAA > Authentication Policies > Login to configure the local setting. Use the clear aaa local user lockout command in privileged EXEC mode to unlock a locked-out user. Authorization dictates what these users can do after they are authenticated. Accounting tracks what users do. To display the attributes collected for a AAA session. All rights reserved. the router prompts for a username and password. Inc. and packet mode 0 (when the user tries to connect through the router for access to the network beyond). For example. the user connects to the router. and Accounting Authentication requires users and administrators to prove that they actually are who they say they are. use the show aaa user {all | unique id} command in privileged EXEC © 2012 Pearson Education. Cisco provides four methods to implement AAA: ■ Self-contained AAA using the local database ■ Cisco Secure Access Control Server (ACS) for Microsoft Windows Server ■ Cisco Secure ACS Express (entry-level version appropriate for 350 users) ■ Cisco Secure ACS Solution Engine (rack-mountable hardware version) Local Authentication Using the local authentication method. to specify the maximum number of unsuccessful authentication attempts before a user is locked out. You can use AAA (pronounced “triple A”) to control administrative access to the device and access to the network through the device. To display a list of all locked-out users. use the show aaa local user lockout command in privileged EXEC mode. You can make additional settings at the command line. The two modes are character mode (when the user tries to connect to the router for admin). choose Configure > Router > Router Access > User Accounts/View to add user accounts.

use the debug aaa authentication command in privileged EXEC command mode. ■ The aaa authentication login default local command defines the default method list for login authentication using the local database. To display information about AAA authentication. many of the most modern security features require the use of the open-standard RADIUS protocol.[ 30 ] Chapter 2: Perimeter Security mode. Also. CCP creates the necessary commands at the CLI from the GUI. You can use the show aaa sessions command to show the unique ID of a session. All rights reserved. ■ The username command adds a username and password to the local security database. TACACS+ offers the following features: ■ Separates authentication and authorization ■ Supports a large number of features ■ Encrypts all communications ■ Uses TCP port 49 RADIUS offers the following features: ■ Scales well ■ Uses UDP ports 1645 or 1812 for authentication and UDP ports 1646 or 1813 for accounting © 2012 Pearson Education. . TACACS+ is more secure. Of the two. Please see page 89 for more details. but RADIUS is an open standard. Using AAA with Cisco Secure ACS ACS is a more scalable solution than trying to create and maintain user accounts on separate Cisco devices. the Cisco device uses TACACS+ or RADIUS. This publication is protected by copyright. Inc. To communicate with the external Cisco Secure ACS. CCP uses the following commands on the router: ■ The aaa new-model command enables AAA.

Rule-based policies provide a more flexible approach that can match on a variety of access conditions found in current networks. STEP 2.[ 31 ] Chapter 2: Perimeter Security To configure the router for AAA with ACS. Then choose Configure > Router > AAA > Authentication Policies > Login to create a policy. © 2012 Pearson Education. Configure access services to process request. This section details how to ensure that this traffic does not represent a security breach. To configure this rule-based approach in ACS. All rights reserved. use CCP and choose Configure > Router > AAA > AAA Servers and Groups > Servers and add the servers. STEP 5. complete the following steps: STEP 1. STEP 3. This publication is protected by copyright. Create an authorization policy. time.2: Rule-Based Policies You can use this system to grant permissions on conditions other than the identity alone. Configure identity groups and identity store. Implementing Secure Management and Reporting Management traffic is often a necessity in the network infrastructure. . location. This would include access. STEP 4. access type. You can apply a policy that you create using Configure > Router > Router Access > VTY. and so forth. Create an identity policy. Please see page 89 for more details. Add router as AAA client. Cisco ISE The Cisco Identity Services Engine (ISE) is a next-generation identity and access control solution. date. It integrates the functionality of ACS and NAC solutions. Inc. New in ACS 5.

[ 32 ]
Chapter 2: Perimeter Security

The Architecture for Secure Management and Reporting
The information flow between management hosts and the managed devices can take two paths:

Out-of-band (OOB): Information flows within a network on which no production traffic resides.

In-band: Information flows across the enterprise production network.

Overall guidelines for secure management and reporting include the following:

Keep clocks on hosts and network devices synchronized.

Record changes and archive configurations.

OOB Management Guidelines
Help ensure that management traffic is not intercepted on the production network.

In-Band Management Guidelines

Apply only to those devices that truly need to be managed in this manner.

Use IPsec, SSH, or SSL.

Decide whether monitoring needs to be constant or periodic.

Syslog
Syslog is the current standard for logging system events in a Cisco infrastructure. It is the most popular option for storing Cisco router
log messages. The Cisco Security Monitoring, Analysis, and Response System (MARS) is a Cisco security appliance that can receive
and analyze syslog messages from various networking devices and hosts.

© 2012 Pearson Education, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

[ 33 ]
Chapter 2: Perimeter Security

Router log messages can also be sent to using the following:

Console

Terminal lines

Internal buffer

SNMP traps

Figure 2-1 shows the various Cisco log severity levels.
Cisco router log messages contain three main parts:

Time stamp

Log message name and severity level

Message text

© 2012 Pearson Education, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

[ 34 ]
Chapter 2: Perimeter Security

Level

Name

Description

0

Emergencies

A panic condition normally
broadcast to all users

1

Alerts

A condition that should be
corrected immediately, such as
a corrupted system database

2

Critical

Critical conditions; for example,
hard device errors

3

Errors

Errors

4

Warnings

Warning messages

5

Notifications

Conditions that are not error
conditions, but should possibly
be handled specially

6

Information

Informational messsages

7

Debugging

Messages that contain
information normally of use only
when debugging a program

Figure 2-1 Cisco Log Severity Levels
Figure 2-2 shows this message format.

© 2012 Pearson Education, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

[ 35 ]
Chapter 2: Perimeter Security
Name and Severity Level
Date/Time

*Apr 27 17:31:13.389: %SYS-5-CONFIG_I: Configured from console by console

The Message Text

Figure 2-2 Cisco Log Message Format
To enable syslog log on your router using CCP, choose Configure > Router > Logging. To view the syslog information, choose
Monitor > Logging.

Simple Network Management Protocol (SNMP)
Versions 1 and 2c of SNMP use clear-text passwords called community strings. This offers little to no security.
SNMP 3 uses a combination of authenticating and encrypting packets over the network to provide secure access to devices. SNMP 3
provides message integrity, authentication, and encryption.
SNMP 3 supports all three of the following security levels:

noAuth: Community string

auth: HMAC or MD5 (hashing for integrity)

Priv: DES, 3DES, or AES (encryption for confidentiality)

When actually implemented on a router, these levels can be combined. For example, authPriv enables the use of authentication and
encryption.
To use the CCP to configure SNMP, choose Configure > Router > SNMP > Edit.
© 2012 Pearson Education, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

[ 36 ]
Chapter 2: Perimeter Security

SSH
The SSH daemon is a feature that enables an SSH client to make a secure, encrypted connection to a Cisco router. Use SSH rather
than Telnet to manage Cisco devices. Cisco IOS Release 12.1(1)T and later support SSH Version 1 (SSHv1), and Cisco IOS Release
12.3(4)T and later support both SSHv1 and SSH Version 2 (SSHv2). The Cisco router acts as the SSH server, and the client must be
acquired to connect to the server. A sample client is PuTTY.
To use SDM to configure SSH, choose Configure > Additional Tasks > Router Access > SSH.
After enabling SSH on the router, configure the vty lines to support SSH. To use Cisco SDM to configure SSH on the vty lines,
choose Configure > Additional Tasks > Router Access > VTY.
To use the command line for the configuration, follow these steps:
STEP 1. Configure the IP domain name of your network using the ip domain-name domain_name command in global
configuration mode.
STEP 2. If there are any existing key pairs, overwrite them using the command crypto key zeroize rsa.
STEP 3. Generate keys to be used with SSH by generating RSA keys using the crypto key generate rsa generalkeys modulus modulus-size command in global configuration mode.
STEP 4. Configure how long the router waits for the SSH client to respond using the ip ssh timeout seconds command in global configuration mode; this step is optional.
STEP 5. Configure the number of SSH retries using the ip ssh authentication-retries integer command in
global configuration mode; this step is optional.
STEP 6. Enable vty inbound SSH sessions; use the transport input ssh command.

Locking Down the Router
Cisco provides two powerful methods for locking down the router. This means disabling or protecting unused services, and making
other configuration changes necessary for a secure network infrastructure.

© 2012 Pearson Education, Inc. All rights reserved. This publication is protected by copyright. Please see page 89 for more details.

To access this feature. it does not support the configuration of SNMP 3. . All rights reserved. ■ One-Step Lockdown does not configure antispoofing access control lists. it does not support the enabling of Service Control Point or the disabling of other access services and file transfer services. IPv6 IPsec is the IETF standard for IPv6 network security. ■ One-Step Lockdown does not support the enabling of TCP intercepts. CCP One-Step Lockdown The CCP One-Step Lockdown method for securing a router uses a wizard in the CCP graphical interface.[ 37 ] Chapter 2: Perimeter Security AutoSecure The AutoSecure IOS feature is invoked by issuing the auto secure command from the CLI. © 2012 Pearson Education. Please see page 89 for more details. ■ One-Step Lockdown does not support the configuration of AAA. This publication is protected by copyright. ■ Although One-Step Lockdown does support the disabling of SNMP. and IPsec support is mandatory. ■ Although One-Step Lockdown does support the configuration of SSH access. ■ One-Step Lockdown does not support the setting of Selective Packet Discard (SPD) values. choose Configure > Security > Security Audit > One Step Lockdown. Inc. Following are some distinctions between the two approaches: ■ One-Step Lockdown does not support the disabling of NTP. This provides a secure end-to-end solution for internetworking. You can also use an informative Security Audit feature before performing the One-Step Lockdown.

IPv6 has some new vulnerabilities: ■ Training and planning. Inc. ■ Reliance on multicast and ICMP Version 6. ■ Secure each protocol in transition approaches. ■ Header extensions can be exploited. Please see page 89 for more details. This publication is protected by copyright. © 2012 Pearson Education. . Unfortunately. dual stack is preferred. All rights reserved. ■ Control the use of tunneling. ■ Consider current and future security enhancements. Recommended Practices for IPv6 Security ■ Ingress filtering is key. ■ Tunneling and dual stacking become vulnerabilities.[ 38 ] Chapter 2: Perimeter Security Many of the threats faced in an IPv6 environment are the same found in an IPv4 environment. ■ End nodes exposed to many more threats such as address configuration.

Please see page 89 for more details. Advantages of these firewalls include the following: ■ Based on simple permit and deny sets ■ Low impact on network performance © 2012 Pearson Education. ■ Be the only transit point. examining packets one at a time and are implemented on a Cisco router using access control lists (ACL). This publication is protected by copyright. Inc. ■ Enforce the access control policy of the organization. All rights reserved. Static Packet-Filtering Firewalls These work at Layers 3 and 4. This section details their evolution and the technologies that have resulted. . Firewall Fundamentals The firewall should ■ Be resistant to attacks.[ 39 ] CCNA Security 640-554 Quick Reference Chapter 3 Cisco IOS Firewalls Firewall Technologies Firewalls are a key security technology in the modern network infrastructure.

Please see page 89 for more details. Sometimes. not devices ■ Make it harder for hackers to spoof and implement denial-of-service (DoS) attacks ■ Can monitor and filter application data ■ Can provide detailed logging © 2012 Pearson Education. Inc. and generate audit records about the traffic they transfer. All rights reserved. Application Layer Gateways Application layer firewalls (also called proxy firewalls or application gateways) operate at Layers 3.[ 40 ] Chapter 3: Cisco IOS Firewalls ■ Easy to implement ■ Supported on most routers ■ Initial security at a low network layer ■ Perform most of what high-end firewalls do at a lower cost Disadvantages of these firewalls include the following: ■ Susceptible to IP spoofing. 4. application layer firewalls support only a limited number of applications. and 7 of the OSI model. they do not maintain any state information for added protection. Proxy services are specific to the protocol that they are designed to forward and can provide increased access control. ■ Complex ACLs are difficult to implement and maintain correctly. . ■ Packet filters cannot dynamically filter certain services. ■ Packet filters do not filter fragmented packets well. This publication is protected by copyright. Application layer firewalls offer advantages: ■ Authenticate individuals. ■ Packet filters are stateless. 5. provide careful detailed checks for valid data.

© 2012 Pearson Education. .and disk-intensive Dynamic or Stateful Packet-Filtering Firewalls Stateful inspection is a firewall architecture classified at the network layer. for some applications it can analyze traffic at Layers 4 and 5. This publication is protected by copyright. although. The state table is part of the internal structure of the firewall. too. Unlike static packet filtering. It tracks all sessions and inspects all packets passing through the firewall. Although this is the primary Cisco Firewall technology. ■ Not all protocols are stateful. Inc. it has some limitations: ■ Cannot prevent application layer attacks. stateful inspection tracks each connection traversing all interfaces of the firewall and confirms that they are valid. Please see page 89 for more details. Stateful packet filtering maintains a state table and allows modification to the security rules dynamically. All rights reserved. ■ Some applications open multiple connections. ■ Does not support user authentication.[ 41 ] Chapter 3: Cisco IOS Firewalls The disadvantages are as follows: ■ Process packets in software ■ Support a small number of applications ■ Sometimes require special client software ■ Are memory.

Cisco Firewall Family Cisco IOS Firewall features follow: ■ Zone-based policy framework for intuitive policy management ■ Application firewalling for web. remote server support. All rights reserved. Advantages include the following: ■ Are aware of the state of Layer 4 and Layer 5 connections ■ Check the conformity of application commands at Layer 5 ■ Can and affect Layer 7 ■ Can prevent more kinds of attacks than stateful firewalls can Transparent firewalls (Cisco PIX and Cisco Adaptive Security Appliance Software Version 7. Inc. Please see page 89 for more details. e-mail. This publication is protected by copyright. and other traffic ■ Instant messenger and peer-to-peer application filtering ■ VoIP protocol firewalling ■ Virtual routing and forwarding (VRF) firewalling ■ Wireless integration ■ Stateful failover ■ Local URL whitelist and blacklist support. .[ 42 ] Chapter 3: Cisco IOS Firewalls Other Types Application inspection firewalls ensure the security of applications and services. through Websense or SmartFilter © 2012 Pearson Education.0) can deploy a security appliance in a secure bridging mode as a Layer 2 device to provide security services at Layer 2 through Layer 7.

■ Firewalls are the primary security device. All rights reserved. This publication is protected by copyright. Inc. Please see page 89 for more details.[ 43 ] Chapter 3: Cisco IOS Firewalls Cisco PIX 500 Series Security Appliance features follow: ■ Advanced application-aware firewall services ■ Market-leading VoIP and multimedia security ■ Robust site-to-site and remote-access IP security (IPsec) VPN connectivity ■ Award-winning resiliency ■ Intelligent networking services ■ Flexible management solutions Cisco ASA 5500 Series Adaptive Security Appliance features follow: ■ World-class firewall ■ Voice and video security ■ SSL and IPsec VPN ■ IPS ■ Content security ■ Modular devices ■ High scalability Best Practices Firewall best practices include the following: ■ Position firewalls at key security boundaries. © 2012 Pearson Education. but it is unwise to rely exclusively on a firewall for security. .

Please see page 89 for more details. ■ Remember that firewalls primarily protect from technical attacks originating from the outside. ■ Outbound ACLs: Incoming packets are routed to the outbound interface and then are processed through the outbound ACL. © 2012 Pearson Education. Inc. port numbers.[ 44 ] Chapter 3: Cisco IOS Firewalls ■ Deny all traffic by default and permit only services that are needed. ■ Ensure that physical access to the firewall is controlled. If there is no matching permit or deny statement and the entire access list has been processed. ■ Regularly monitor firewall logs. and Response System (MARS) is especially useful in monitoring firewall logs. the packet is denied by an implicit deny all at the end of the access list. This publication is protected by copyright. ■ Practice change management. . Cisco Security Monitoring. ■ Extended ACLs: Check both the source and destination packet addresses. and other parameters. All rights reserved. Static Packet Filters Using ACLs Fundamentals of ACLs ACLs operate in two ways: ■ Inbound ACLs: Incoming packets are processed before they are routed to an outbound interface. Cisco routers support two types of IP ACLs: ■ Standard ACLs: Check the source addresses of packets that can be routed. Analysis. They can also check for specific protocols.

Inc.3 or later features IP access list entry sequence numbering to assist in the management of ACLs. All rights reserved. or named ACL. ■ If you apply an ACL to an interface. This publication is protected by copyright. ■ Every ACL should have at least one permit statement. ■ Your ACL should be organized to allow processing from the top down. by default the ACL denies all traffic that fails to match any of the ACL lines. extended. the ACL filters traffic going through the router but does not filter traffic that the router generates. ■ Only one ACL per protocol. ■ Unless you end your ACL with an explicit permit any statement. per direction. and per interface is allowed. choose a standard. You must put the standard ACL as close as possible to the destination of the traffic you want to deny. Please see page 89 for more details. Cisco IOS Release 12.[ 45 ] Chapter 3: Cisco IOS Firewalls You can use two general methods to create ACLs: ■ Numbered ACLs: Use a number for identification. ■ Named ACLs: Use an alphanumeric string for identification. Follow these guidelines with ACLs: ■ Based on the test conditions. numbered. Organize your ACL so that the more specific references to a network or subnet appear before ones that are more general. © 2012 Pearson Education. . ■ You should create the ACL before applying it to an interface. ■ You should typically place extended ACLs as close as possible to the source of the traffic that you want to deny.

The first two octets of the wildcard mask will be 0. the administrator first converts the starting range number to binary: 16 = 0 0 0 1 0 0 0 0 Notice the administrator does not care about the binary values in the last four bit positions.0.0.0/24. the administrator does not care at all about any bit in the last octet.255. you can use the keyword host.0 since 172.255. you can use the keyword any. All rights reserved.40.0. Figure 3-1 shows an example of wildcard masking.255 Figure 3-1 Wildcard Masking You can use abbreviations in your wildcard masks. Inc. the wildcard mask is: 0 0 0 0 1 1 1 1 = 15 Also.0/24 to 172.16.16. An administrator wants to match the subnets 172. so this octet is all 1 values: 1 1 1 1 1 1 1 1 = 255 The resulting address and wildcard mask used in the ACL are: 172. This publication is protected by copyright.40 must be matched exactly.[ 46 ] Chapter 3: Cisco IOS Firewalls ACL Wildcard Masking Wildcard masking for IP address bits uses the numerals 1 and 0 to specify how to treat the corresponding IP address bits: ■ Wildcard mask bit 0: Match the corresponding bit value in the address.40.0. ■ Wildcard mask bit 1: Ignore the corresponding bit value in the address.40.255.15.31. For the third octet. © 2012 Pearson Education. Please see page 89 for more details. For example.0 0. Instead of 255. therefore. instead of 0. .

[ 47 ] Chapter 3: Cisco IOS Firewalls ACL Creation To create the standard ACL. Please see page 89 for more details. IPv6 Access Lists IPv6 access lists have the same structure and operational framework as in IPv4. Inc. . All rights reserved. and use show ip interface to check for assignment. The Cisco Configuration Professional (CCP) offers an excellent GUI for ACL creation. use access-list access-list-number {deny | permit} source [source-wildcard] To assign the standard ACL to an interface. use ip access-group {access-list-number | access-list-name} {in | out} To assign an ACL to a vty line. Choose Configure > Router > > ACL > ACL Editor. © 2012 Pearson Education. use access-class access-list-number {in [vrf-also] | out} To create an extended ACL. Implicit entries exist at the end of each IPv6 ACL to enable neighbor discovery. use access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log | log-input] [time-range time-range-name] [fragments] [established] Use the show access-list command to verify the ACL. The syntax is ipv6 traffic-filter to assign to the interface and ipv6 access-list to create. This publication is protected by copyright. You can match on the extension headers.

All rights reserved. ■ Policies are applied between zones.and host-specific policies. . © 2012 Pearson Education. Overview Cisco IOS Release 12. This section details this new technology. Inc. ■ DoS mitigation. ■ Combining service lists with network and host address lists is allowed.[ 48 ] Chapter 3: Cisco IOS Firewalls Cisco IOS Zone-Based Policy Firewall One of the most exciting developments for Cisco in the area of IOS Firewalls has been the new zone-based firewall. This publication is protected by copyright. including the following: ■ Stateful packet inspection. This new model presented the Cisco IOS zone-based policy. ■ Default deny-all policy. ■ Application inspection.4(6)T introduced a new configuration model for the Cisco IOS Firewall feature set. ■ Virtual private network (VPN) VRF-aware Cisco IOS Firewall. ■ Subnet. ■ URL filtering. which provides the following: ■ Intuitive policies for multiple interface routers ■ A greater level of granularity for firewall policy application ■ The ability to prohibit traffic between firewall zones until an explicit policy is applied to allow desirable traffic via a default deny-all policy The new zone-based policy inspection interface supports almost all the firewall features implemented in earlier releases and much more. Please see page 89 for more details.

navigate to Configure > Router > NAT > Create NAT > Configuration > Basic NAT. © 2012 Pearson Education. All rights reserved. choose Configure > Security > Firewall > Firewall > Create Firewall > Basic Firewall. Please see page 89 for more details.[ 49 ] Chapter 3: Cisco IOS Firewalls ■ Clearer statement of firewall policies. click Basic Firewall. This publication is protected by copyright. ■ Unidirectional policy between zones. Policies may be made up of combinations of the following: ■ IP addresses or subnets using ACLs ■ Protocols ■ Application services ■ Application-specific policies The zone-based firewall approach takes three possible actions: ■ Inspect: Causes Cisco IOS stateful packet inspection ■ Drop: Analogous to a deny statement in an ACL ■ Pass: Analogous to a permit statement in an ACL Configuring the Zone-Based Firewall with the Basic Firewall Wizard To configure a zone-based firewall using the Basic Firewall Wizard. Inc. From the Create Firewall tab. . Start Basic NAT Wizard To configure Network Address Translation using the Basic NAT Wizard in the Cisco Configuration Professional (CPP).

You should understand these principles before studying VPN technologies. Inc. The attacker uses a brute-force attack to try keys until decryption with the correct key produces a meaningful result. © 2012 Pearson Education. ■ A known-plain-text (the usual brute-force) attack: The attacker has access to the cipher text of several messages but also knows something about the plain text underlying that cipher text. A cipher is an algorithm for performing encryption and decryption. Following are examples of attacks: ■ Brute-force attack: The attacker tries every possible key with the decryption algorithm. Please see page 89 for more details. The attacker must deduce the key or keys used to encrypt the messages to decrypt other messages encrypted with the same keys. The Vigenère cipher is a polyalphabetic cipher that encrypts text by using a series of different Caesar ciphers based on the letters of a keyword. This publication is protected by copyright. ■ A cipher-text-only attack: The attacker has the cipher text of several messages but no knowledge of the underlying plain text.[ 50 ] CCNA Security 640-554 Quick Reference Chapter 4 Site-to-Site VPNs Cryptographic Services This section covers the key topics of cryptography. Cryptanalysis is the practice of breaking codes to obtain the meaning of encrypted data. ■ A chosen-plain-text attack: The attacker chooses what data the encryption device encrypts and observes the cipher-text output. Overview Cryptology is the science of making and breaking secret codes. All rights reserved. .

Please see page 89 for more details. 192-.and 168-bit keys ■ AES: 128-. and 256-bit keys ■ International Data Encryption Algorithm (IDEA): 128-bit keys © 2012 Pearson Education. Symmetric and Asymmetric Encryption Algorithms Following are two classes of encryption algorithms. ■ Create an avalanche effect. All rights reserved. . ■ Birthday attack: A form of brute-force attack against hash functions. ■ Do not have export or import restrictions. This publication is protected by copyright. ■ Meet-in-the-middle attack: The attacker knows a portion of the plain text and the corresponding cipher text. which differ in their use of keys: ■ Symmetric encryption algorithms: Same key to encrypt and decrypt data ■ Asymmetric encryption algorithms: Different keys to encrypt and decrypt data The following are well-known encryption algorithms that use symmetric keys: ■ DES: 56-bit keys ■ Triple Data Encryption Standard (3DES): 112.[ 51 ] Chapter 4: Site-to-Site VPNs ■ A chosen-cipher-text attack: The attacker can choose different cipher texts to be decrypted and has access to the decrypted plain text. Following are features that good encryption algorithms provide: ■ Resist cryptographic attacks. ■ Support variable and long key lengths and scalability. Inc.

depending on when they are encountered during the encryption process. RC4. typically bits. and 256-bit keys ■ Blowfish: 32. 192-. Unlike block ciphers. results in decryption.to 256-bit keys ■ RC5: 0. © 2012 Pearson Education. RC5.and 64-bit keys ■ RC4: 1. With a stream cipher. DES has a block size of 64 bits. Inc. Please see page 89 for more details. stream ciphers operate on smaller units of plain text.to 448-bit keys Because of their fast speed. This publication is protected by copyright. RC4 is a common stream cipher. for many block ciphers is typically 128 bits.to 2040-bit keys ■ RC6: 128-. symmetric algorithms are frequently used for encryption services. the transformation of these smaller plain-text units varies.[ 52 ] Chapter 4: Site-to-Site VPNs ■ The RC series: RC2. and RC6 ■ RC2: 40. Currently. . using the same secret key. Applying the reverse transformation to the cipher-text block. with additional key management algorithms providing secure key exchange. All rights reserved. the fixed length. also known as the block size. The best-known asymmetric cryptographic algorithms follow: ■ RSA ■ ElGamal ■ Elliptic curve algorithms Block ciphers transform a fixed-length block of plain text into a block of cipher text of the same length.

Please see page 89 for more details.[ 53 ] Chapter 4: Site-to-Site VPNs Cryptographic Hashes Hashing is a mechanism used for data integrity. The user makes an outbound connection to TCP port 443. The key is used to encrypt the SSL session. STEP 2. Key Management Key management consists of the following components: ■ Key generation ■ Key verification ■ Key storage ■ Key exchange ■ Key revocation and destruction SSL VPNs SSL-based VPNs provide remote-access connectivity from almost any Internet-enabled location using a standard web browser and its native SSL encryption. and the result of the hash function is the fixed-length hash. © 2012 Pearson Education. STEP 4. All rights reserved. The router responds with a digital certificate. Data of arbitrary length is input into the hash function. . which contains a public key digitally signed by a trusted certificate authority (CA). typically using a web browser. The user computer generates a shared-secret symmetric key that both parties use. STEP 3. STEP 5. Inc. The shared secret is encrypted with the public key of the router and transmitted to the router. This publication is protected by copyright. The router software can easily decrypt the packet using its private key. The steps of SSL VPN establishment follows: STEP 1. Now both participants in the session know the shared secret key.

This publication is protected by copyright. where it encrypts data in 64-bit blocks. . This section describes this important technology. Lengths of 80 bits or longer are considered trusted. Inc. Please see page 89 for more details. ■ Use DES in CBC mode. ■ Use 3DES rather than DES. ■ Use a secure channel to communicate the DES key from the sender to the receiver.[ 54 ] Chapter 4: Site-to-Site VPNs Symmetric Encryption Symmetric encryption is a common approach to encryption used with VPNs. DES This encryption algorithm typically operates in block mode. ■ Test a key to see whether it is weak before using it. ■ Cipher Block Chaining (CBC): Each 64-bit plain-text block is exclusive ORed (XORed) bitwise with the previous ciphertext block and then is encrypted using the DES key. DES uses two standardized block cipher modes: ■ Electronic Code Book (ECB): Serially encrypts each 64-bit plain-text block using the same 56-bit key. Key Lengths Symmetric encryption algorithms typically use keys of length 40 to 256 bits. Guidelines for DES usage include the following: ■ Change keys frequently to help prevent brute-force attacks. All rights reserved. © 2012 Pearson Education.

This provides nine different combinations of key length and block length. 192. . especially if pure software encryption is used. or 256 bits. This publication is protected by copyright. Rivest Ciphers Widely used RC algorithms include the following: ■ RC2: A variable key-size block cipher designed as a replacement for DES ■ RC4: A variable key-size Vernam stream cipher often used in file-encryption products and for secure communications © 2012 Pearson Education. and it cannot be hardware-based encryption. AES The AES algorithm currently specifies how to use keys with a length of 128. Software-Optimized Encryption Algorithm (SEAL) SEAL is an alternative algorithm to software-based DES. ■ The Cisco router and the other peer must support the k9 subsystem.[ 55 ] Chapter 4: Site-to-Site VPNs 3DES The technique of applying DES three times in a row to a plain-text block is called 3DES. 3DES. 192. SEAL encryption uses a 160-bit encryption key and has less impact on the CPU compared to other software-based algorithms. Inc. AES is more suitable for high-throughput. Restrictions for SEAL include the following: ■ The Cisco router and the other peer must support IPsec. This feature is available only on Cisco equipment. AES was chosen to replace DES and 3DES because the key length of AES is much stronger than DES and AES runs faster than 3DES on comparable hardware. Both block length and key length can be extended easily in multiples of 32 bits. All rights reserved. Please see page 89 for more details. or 256 bits to encrypt blocks with a length of 128. and AES. low-latency environments.

© 2012 Pearson Education. All rights reserved. based on the SHA-1 hashing algorithm Cisco products use hashing for entity-authentication. based on the MD5 hashing algorithm ■ Keyed SHA-1. ■ Cisco IOS routers use hashing with secret keys to add authentication information to routing protocol updates.[ 56 ] Chapter 4: Site-to-Site VPNs ■ RC5: A fast block cipher that has variable block size and variable key size ■ RC6: A block cipher designed by Rivest. data-integrity. Please see page 89 for more details. Inc. Hash Message Authentication Codes (HMAC) Hashing is typically used for the following: ■ To provide proof of the integrity of data. such as IPsec or routing protocol authentication Cisco technologies use two HMAC functions: ■ Keyed MD5. digitally signed contracts. and Public Key Infrastructure (PKI) certificates ■ To provide proof of authenticity when it is used with a symmetric secret authentication key. This publication is protected by copyright. . such as that provided with file integrity checkers. Sidney. and Yin and is based on RC5 (meant to meet the design requirements of AES) Cryptographic Hashes This section details the most common cryptographic hashes in use today. and data-authenticity purposes: ■ IPsec gateways and clients use hashing algorithms to provide packet integrity and authenticity.

© 2012 Pearson Education. The message length is also encoded into the digest. 256-. Please see page 89 for more details. The output of the algorithm is a set of four 32-bit blocks. The algorithm is slightly slower than MD5. . which concatenate to form a single 128-bit hash value. MD5 MD5 is a one-way function that makes it easy to compute a hash from the given input data but makes it unfeasible to compute input data given only a hash. but the larger message digest makes it more secure against brute-force collision and inversion attacks. and 512-bit versions of SHA.[ 57 ] Chapter 4: Site-to-Site VPNs ■ Cisco Software images have an MD5-based checksum available so that customers can check the integrity of downloaded images. All rights reserved. ■ Protect HMAC secret keys. These blocks are then rearranged with simple operations in a main loop. ■ Hashing can also be used in a feedback-like mode to encrypt data. SHA-1 The SHA-1 algorithm takes a message of no less than 264 bits in length and produces a 160-bit message digest. 384-. There are also 224-. The input is a data block plus a feedback of previous blocks. The 512-bit blocks are divided into 16 32-bit sub-blocks. This publication is protected by copyright. Best practices include the following: ■ Avoid MD5 if possible. which consists of four rounds. Inc. ■ Consider using MD5 only if speed is an issue. TACACS+ uses MD5 to encrypt its session.

and the signature it generates ■ To prove the authenticity and integrity of PKI certificates ■ To provide a secure time stamp The following steps indicate how digital signatures function: STEP 1. Inc. data-integrity. the signature algorithm generates its output. ■ Cisco SSL endpoints and the Cisco Adaptive Security Device Manager (ASDM) use digital signatures to prove the identity of the SSL server. A user wants to sign some data. which is usually public. only the signer knows this signature key. All rights reserved. STEP 4. the document was not changed after signing. The receiving device inputs the message. and the verification key into the verification algorithm. This publication is protected by copyright. STEP 6. The sending device attaches the digital signature to the message and sends the message to the receiver. the digital signature. and data-authenticity purposes: ■ IPsec gateways and clients use digital signatures to authenticate their Internet Key Exchange (IKE) sessions. which checks the validity of the digital signature. STEP 5. Based on the input data and a signature key. called a digital signature. If the check is successful. © 2012 Pearson Education. STEP 2.[ 58 ] Chapter 4: Site-to-Site VPNs Digital Signatures Digital signatures are often used in the following situations: ■ To provide a unique proof of data source ■ To authenticate a user by using that person’s private key. and the document was originated by the signer of the document. ■ Some of the service-provider-oriented voice management protocols use digital signatures to authenticate the involved parties. The user uses a signature algorithm with a personal signature key. STEP 3. The receiving device verifies the signature with the verification key. Please see page 89 for more details. . Cisco products use digital signatures for entity-authentication.

but the private key must be kept secret. using an agreed-upon algorithm. which is often a symmetric key. a public key and a private key. . The public key can be published. or both by generating digital signatures Diffie-Hellman (DH) The DH algorithm is the basis of most modern automatic key exchange methods. Please see page 89 for more details. STEP 4. Inc. RSA is mainly used for two services: ■ To ensure confidentiality of data by performing encryption ■ To perform authentication of data. STEP 3. User A uses User B’s public key to encrypt a message. User B uses his private key to decrypt. User A transmits the encrypted message. This publication is protected by copyright. User A acquires User B’s public key. © 2012 Pearson Education. The RSA algorithm is based on the fact that each entity has two keys. The IKE protocol in IPsec VPNs uses DH algorithms extensively. nonrepudiation of data.[ 59 ] Chapter 4: Site-to-Site VPNs Asymmetric Encryption Following are the steps used in asymmetric encryption: STEP 1. RSA The RSA keys are usually 512 to 2048 bits. All rights reserved. STEP 2. the message. and reveal.

Inc.509 is a well-known standard that defines basic PKI formats.[ 60 ] Chapter 4: Site-to-Site VPNs PKI A PKI provides a framework upon which you can base security services. Simple Certificate Enrollment Protocol (SCEP) is a PKI communication protocol used for automated VPN PKI enrollment. The standard has been widely used with many Internet applications. Please see page 89 for more details. It provides the following in the network: ■ Cost savings ■ Security ■ Scalability ■ Compatibility with broadband © 2012 Pearson Education. VPN Overview IPsec is the primary technology used in VPNs. such as SSL and IPsec. and nonrepudiation. ■ Certificate: A document that has been signed by the CA. All rights reserved. This binds the name of the security entity with its public key. This publication is protected by copyright. . X. Coverage includes critical topics such as the function of IPsec and IKE. Two important PKI terms follow: ■ Certificate authority (CA): The trusted third party that signs the public keys of entities in a PKI-based system. such as encryption. IPsec VPN Fundamentals This section ensures that you understand the fundamentals of the modern IPsec VPN. or there may be a complex hierarchy of CAs. A PKI enables scalable solutions and is becoming an extremely important authentication solution for VPNs. The CA may be a single entity. authentication.

and Adaptive Security Appliances. ■ Security is provided at the network layer. IPsec Overview IPsec has many advantages. ■ Encapsulating Security Payload (ESP): Provides confidentiality and authentication. ■ IPsec is extremely scalable. This publication is protected by copyright. it provides authentication of the IPsec traffic only. IPsec features two main framework protocols. Please see page 89 for more details. using any number of media. All rights reserved. as shown in Figure 4-1: ■ Authentication Header (AH): Used only when confidentiality is not required. . firewalls. running over any number of networks. Inc. upper layers are unaffected. including routers. including the following: ■ Offers protection for any number of applications.[ 61 ] Chapter 4: Site-to-Site VPNs Following are two types: ■ Site-to-site ■ Remote-access Many Cisco devices can work together to form the VPN. © 2012 Pearson Education.

these hosts handle the encryption/decryption process. The following are some of the standard algorithms that IPsec uses: ■ DES ■ 3DES ■ AES ■ MD5 © 2012 Pearson Education. All rights reserved. ■ Tunnel mode: Encapsulates the original IP header and creates a new IP header that is sent unencrypted across the untrusted network. Transport mode protects the payload of the packet but leaves the original IP address in the clear.[ 62 ] Chapter 4: Site-to-Site VPNs Authentication Header (AH) Data in plaintext R1 Provides: • Authentication • Integrity R2 Encapsulating Security Payload (ESP) Data encrypted R1 Provides: • Encryption • Authentication • Integrity R2 Figure 4-1 IPsec Security Protocols You can apply ESP and AH to IP packets in two different modes: ■ Transport mode: Security is provided only for the transport layer and above. This publication is protected by copyright. Inc. . Please see page 89 for more details. ESP transport mode is used between two hosts that are both configured to support IPsec.

. and so on. © 2012 Pearson Education. that need encryption key material for operation. how long keys should remain active. DPD. ■ Aggressive mode: Compresses the IKE SA negotiation phases that are described thus far into three packets. IKE Phase 2 is used to build IPsec SAs. used for management traffic. Inc. and whether perfect forward secrecy should be enforced. This publication is protected by copyright. IKE executes the following phases: ■ IKE Phase 1: Two IPsec peers perform the initial negotiation of SAs. Additional service negotiations occur in IKE Phase 1. Phase 1 generates an Internet Security Association and Key Management Protocol (ISAKMP) SA. such as IPsec. Please see page 89 for more details. Mode Config. The proposal sent by the initiator defines which encryption and authentication protocols are acceptable. All rights reserved. ■ IKE Phase 2: SAs are negotiated by the IKE process ISAKMP on behalf of other services. ■ Quick mode: Similar to aggressive mode IKE negotiation. except that negotiation is protected within an IKE SA. which are for passing end-user data.[ 63 ] Chapter 4: Site-to-Site VPNs ■ SHA-1 ■ DH IKE IPsec uses the IKE protocol for the following: ■ Negotiation of security association (SA) characteristics ■ Automatic key generation ■ Automatic key refresh ■ Manageable manual configuration IKE uses three modes of operation: ■ Main mode: An IKE session begins with one computer sending a proposal to another computer.

Please see page 89 for more details. 2. In IKE Phase 1. 2. The IPsec tunnel terminates when the IPsec SAs are deleted or when their lifetime expires. Use the crypto isakmp policy command to define an IKE policy. The crypto ACL defines which traffic should be sent through the IPsec tunnel and be protected by the IPsec process. 4. All rights reserved. This publication is protected by copyright. An IPsec tunnel is initiated when Host A sends “interesting” traffic to Host B. 4. Define the IPsec transform set. After the peers are authenticated. a secure tunnel is created using ISAKMP. 3. Traffic is considered interesting when it travels between the IPsec peers and meets the criteria defined in the crypto ACL. © 2012 Pearson Education. the IPsec peers (Routers A and B) negotiate the established IKE SA policy. In IKE Phase 2. Operations VPN negotiation occurs as follows: 1.[ 64 ] Chapter 4: Site-to-Site VPNs Site-to-Site VPN Construction This section details the exact steps in creating the popular site-to-site VPN. 5. . Create a crypto ACL. The IPsec tunnel is created. Inc. follow these steps: 1. and data is transferred between the IPsec peers based on the IPsec parameters configured in the IPsec transform sets. Use the crypto ipsec transform-set global configuration command. the IPsec peers use the authenticated and secure tunnel to negotiate IPsec SA transforms. VPN Configuration To configure a site-to-site IPsec VPN. 3. Configure an ISAKMP policy to determine the ISAKMP parameters that will be used to establish the tunnel. Ensure that existing access lists are compatible with IPsec. The definition of the transform set defines the parameters that the IPsec tunnel uses and can include the encryption and integrity algorithms. The negotiation of the shared policy determines how the IPsec tunnel is established. use show access-lists.

The CCP VPN Wizards use two sources to create a VPN connection: ■ User input during a step-by-step wizard process ■ Preconfigured VPN components The CCP provides some default VPN components: ■ Two IKE policies ■ An IPsec transform set for the Quick Setup Wizard © 2012 Pearson Education. The crypto map is applied to the outgoing interface of the VPN device.[ 65 ] Chapter 4: Site-to-Site VPNs 5. Usually. and show crypto map. This publication is protected by copyright. Create and apply a crypto map. Inc. Configure the interface ACL. show crypto ipsec transform-set. block all traffic that is not IPsec or IKE). 6. The crypto map groups the previously configured parameters and defines the IPsec peer devices. Please see page 89 for more details. All rights reserved. there are restrictions on the interface that the VPN traffic uses (for example. VPN Configuration with CCP Choose Configure > Security > VPN to open the VPN page. .Verification commands include show crypto isakmp policy. Use the crypto map global configuration command and interface configuration command.

Prevention is possible by the sensor because it is operates inline with packet flows. Detection cannot prevent the attacks because it operates on copies of packets. Please see page 89 for more details. . or it might be to prevent the attack from dropping the packet at a device. However you decide to implement the technology. the goal is the same: to take some action based on an attack introduced to your network. This publication is protected by copyright. Detection cannot prevent these attacks from occurring. Sensors operating using intrusion detection run in promiscuous mode. Inc. or you might add this functionality using a network module inserted into a router or a switch. © 2012 Pearson Education. Often. or a particular network segment. You might add this powerful tool to your network via a dedicated hardware appliance known as a sensor.[ 66 ] CCNA Security 640-554 Quick Reference Chapter 5 Cisco IOS IPS Understanding Intrusion Prevention and Detection Cisco provides intrusion detection and prevention in a variety of ways in its current security portfolio. All rights reserved. Intrusion Prevention Versus Intrusion Detection Intrusion detection is powerful in that you can be notified when potential problems or attacks are introduced into your network. these copies of packets are received from another Cisco device (typically a switch). This action might be to alert the network administrator via an automated notification. Intrusion prevention is more powerful in that potential threats and attacks can be stopped from entering your network.

False Alarms False alarms are IPS events that you do not want occurring in your implementation. Inc. For example. This publication is protected by copyright. Vulnerability A vulnerability is a weakness that compromises the security or functionality of a particular system in your network. There are two types of these alarms: false positive and false negative. Exploit An exploit is a mechanism designed to take advantage of vulnerabilities that exist in your systems. © 2012 Pearson Education. This type of traffic is often referred to as benign traffic. a password-cracking package might be the exploit aimed at this vulnerability. False Negative A false negative occurs when attack traffic does not trigger an alert on the IPS device. All rights reserved. An example of a vulnerability is a web form on your public website that does not adequately filter inputs and guards against improper data entry. This is often viewed as the worst type of false alarm. Both are unwanted. if you have poor passwords in use in your network. . for obvious reasons. False Positive A false positive means that an alert has been triggered. An attacker might enter invalid characters in an attempt to corrupt the underlying database. but it was for traffic that does not constitute an actual attack. Please see page 89 for more details.[ 67 ] Chapter 5: Cisco IOS IPS IPS/IDS Terminology You should be aware of many security terms related to intrusion detection and prevention technologies.

Promiscuous Versus Inline Mode IDS/IPS sensors operate in promiscuous mode by default. Inc. It can detect an attack and send an alert (and take other actions). This publication is protected by copyright. . the device performs intrusion detection. Figure 5-2 shows an example of inline mode IPS. All rights reserved. but it does not prevent the attack from entering the network or a network segment. This makes the device more effective against worms and atomic attacks (attacks that are carried out by a single packet). Both true positives and true negatives are wanted. © 2012 Pearson Education. If a Cisco IPS device operates in inline mode. Because the device works with a copy of the traffic. Please see page 89 for more details. Figure 5-1 shows an example of a promiscuous mode IDS implementation. True Positive A true positive means that an attack was recognized and responded to by the IPS device. It cannot prevent the attack because it is not operating on traffic “inline” in the forwarding path. True Negative This means that nonoffending or benign traffic did not trigger an alarm. This means that a device (often a switch) captures traffic for the sensor and forwards a copy for analysis to the sensor. This is because the IPS device is in the actual traffic path.[ 68 ] Chapter 5: Cisco IOS IPS True Alarms There are two types of true alarms in IPS terminology. it can do prevention as opposed to mere detection.

. Please see page 89 for more details. All rights reserved. Inc. This publication is protected by copyright.[ 69 ] Chapter 5: Cisco IOS IPS Copy of Attack Attack Management System Figure 5-1 Promiscuous Mode (IDS) © 2012 Pearson Education.

Cisco Intrusion Prevention System (IPS) Version 6. you require two monitoring interfaces defined in the sensor as an inline pair. . This enables one segment to be monitored for intrusion detection only. Inc.0 software permits a device to perform promiscuous mode and inline mode simultaneously. A sensor could be configured inline but could be set up so that it alerts only and doesn’t drop packets. This is an example of an inline configuration in which only intrusion detection is performed. All rights reserved. Please see page 89 for more details. whereas another segment features intrusion prevention protection. This publication is protected by copyright.[ 70 ] Chapter 5: Cisco IOS IPS Attack Management System Figure 5-2 Inline Mode (IPS) To configure inline mode. This pair of interfaces acts as a transparent Layer 2 structure that can drop an attack that fires a signature. © 2012 Pearson Education.

As different types of attacks are created. these signatures can be added. This section describes these various approaches. Because it can be so difficult to define what is normal activity for a given network. whereas policy-based is more concerned with enforcing the security policy of the organization. Anomaly-Based This type of IPS technology is often called profile-based. and updated to deal with the new attacks. It attempts to discover activity that deviates from what an engineer defines as “normal” activity. Cisco releases signatures that are added to the device that identify a pattern that the most common attacks present.[ 71 ] Chapter 5: Cisco IOS IPS Approaches to Intrusion Prevention A device can take many different approaches to securing the network using IPS. Please see page 89 for more details. Signature-Based Although Cisco uses a blend of detection and prevention technologies. This is much less prone to false positives and ensures that IPS devices are stopping common threats. Inc. and the nonstatistical method uses information coded by the vendor. tuned. . All rights reserved. signature-based IPS is the primary tool used by Cisco IPS solutions. © 2012 Pearson Education. this approach tends to be prone to a high number of false positives. Signature-based focuses on stopping common attacks. This type of approach is also known as pattern matching. the security policy is “written” into the IPS device. The statistical approach learns about the traffic patterns on the network. Alarms are triggered if activities are detected that violate the security policy coded by the organization. Policy-Based With this type of technology. This publication is protected by copyright. The two common types of anomaly-based IPS are statistical anomaly detection and nonstatistical. w this differs from signature-based.

Obfuscation is one way in which control characters. © 2012 Pearson Education. Exploring Evasive Techniques Because attackers are aware of IPS technologies. they have developed ways to counter these devices in an attempt to continue attacks on network systems. This publication is protected by copyright. Inc. Fragmentation With this evasive measure. but the protocol-analysis-based approach can do much deeper packet inspection and is more flexible in finding some types of attacks. Most signatures examine rather common settings. not using fragmentation in the approach. the attacker spreads around the attack using a large number of small packets. Session In this type of attack. Fragmentation adds a layer of complexity for the sensor. String Match In this type of attack. . strings in the data are changed in minor ways in an attempt to evade detection. hexadecimal representation. it looks deeper into packets thanks to a protocol-based inspection of the packet payload that can occur.[ 72 ] Chapter 5: Cisco IOS IPS Protocol Analysis-Based Although this approach is similar to signature-based. Another string match type of evasive technique is to just change the case of the string. the attacker breaks the attack packets into fragments so that they are more difficult to recognize. or Unicode representation help to disguise the attack. You can use TCP segment reassembly to combat this evasive measure. All rights reserved. Please see page 89 for more details. which now must engage in the resource-intensive process of reassembling the packets.

the IPS sensor sees a different data stream than the end system because of the manipulation of the TTL field in the IP header. care must be taken to ensure that encrypted sessions cannot be established by attackers. Inc. The end system ignores the harmless data and processes only the attack data. This publication is protected by copyright. attackers simply try to overwhelm the physical device or the staff in charge of monitoring by flooding the device with alarm conditions. Because this method of foiling the IPS device exists. © 2012 Pearson Education. With this evasive procedure. Encryption-Based This is an effective means to have attacks enter the network. Evasion With this type of evasive technique. .[ 73 ] Chapter 5: Cisco IOS IPS Insertion In this evasive technique. which results in an attack. the attacker has the sensor see a different data stream than the intended victim. TTL-Based One way to implement an insertion attack is to manipulate the Time-To-Live (TTL) value of fragments. Unlike the insertion attack. Resource Exhaustion Another evasive approach is to just overwhelm the sensor. Please see page 89 for more details. The IPS sensor does not fire an alert based on the harmless data. the attacker inserts data that is harmless along with the attack data. the end system sees more data than the sensor. The attacker sends the attack via an encrypted session. All rights reserved. The encrypted attack cannot be detected by the IPS device. Often.

■ Improved Cisco IPS Device Manager (IDM): New and improved GUI for management. including the following: ■ Virtualization support: Allowing different policies for different segments monitored by a single sensor. ■ Enhanced password recovery: Password recovery no longer requires reimaging. ■ Improved risk. Inc. This CCNA Security Quick Reference focuses on Cisco products that can run Version 6.0 version adds many new features. ■ Passive operating system fingerprinting: A set of features that enables Cisco IPS to identify the OS of the victim of an attack. . All rights reserved.[ 74 ] Chapter 5: Cisco IOS IPS Cisco Solutions and Products Cisco offers many products and solutions that address your need for intrusion detection/prevention in your network infrastructure. ■ Anomaly detection: Designed to detect worm-infested hosts. This publication is protected by copyright.and threat-rating system: The risk rating helps with alerts and is now based on many different components to improve the performance and operation of the sensor. Please see page 89 for more details. ■ New signature engines: Additions to cover Server Message Block and Transparent Network Substrate traffic. This 6. Cisco Sensor Family The Cisco Sensor family includes the following devices: ■ Cisco IOS IPS ■ Cisco IDS Network Module ■ Cisco IDS 4215 Sensor ■ Cisco IDS 4240 Sensor © 2012 Pearson Education.0 of the Cisco IPS Sensor Software. ■ External product interface: Enables sensors to subscribe for events from other devices.

Also. The components include the following: ■ Event Store (provides storage for all events) ■ SSH and Telnet (by default. Inc. Telnet is disabled) ■ Intrusion Detection Application Programming Interface (IDAPI) ■ MainApp ■ SensorApp (for packet capture and analysis) ■ Sensor interfaces © 2012 Pearson Education. . IPS Sensor Software Architecture IPS Sensor Software Version 6. Please see page 89 for more details. This publication is protected by copyright.0 software: ■ Cisco IDS 4235 Sensor ■ Cisco IDS 4250 XL Sensor Sensor Software Solutions Many options are available for configuration and management of Cisco sensors.0 runs on the Linux OS.[ 75 ] Chapter 5: Cisco IOS IPS ■ Cisco ASA AIP-SSM ■ Cisco IPS 4255 Sensor ■ Cisco Catalyst 6500 Series IDSM-2 ■ Cisco IPS 4260 Sensor The following legacy devices can also run IPS 6. All rights reserved. the sensor operating systems and overall architecture is worth exploring for the certification exam and beyond.

. it can protect many hosts at the same time. Because the sensor is analyzing network traffic. The Cisco host IPS is called Cisco Security Agent. It complements network IPS by protecting the integrity of applications and operating systems.[ 76 ] Chapter 5: Cisco IOS IPS Management Options For single-device (element) management. This solution does not require additional hardware (sensors). options include the following: ■ Command-line interface (CLI) ■ Cisco IDM (a graphical user interface) For multiple-device management (enterprise management). This publication is protected by copyright. © 2012 Pearson Education. Host IPS A host IPS solution features software installed on servers and workstations. All rights reserved. Inc. Analysis. options include the following: ■ Cisco IPS Event Viewer ■ Cisco Security Manager ■ Cisco Security MARS (Cisco Security Monitoring. and Response System) Network IPS Network IPS refers to the deployment of devices (typically sensors) in the network that capture and analyze traffic as it traverses the network. Please see page 89 for more details.

■ Your management and monitoring options: The number of sensors often dictates the level of management you need. Inc. and the amount and type of traffic. This publication is protected by copyright.[ 77 ] Chapter 5: Cisco IOS IPS Deploying Sensors Technical factors to consider when selecting sensors for deployment in an organization include the following: ■ Network media in use ■ Performance of the sensor ■ Overall network design ■ IPS design (Will the sensor analyze and protect many systems or just a few?) ■ Virtualization (Will multiple virtual sensors be created in the sensor?) Important issues in an IPS design include the following: ■ Your network topology: Size and complexity. connections. Locations that generally need to be protected include the following: ■ Internet: Sensor between your perimeter gateway and the Internet ■ Extranet: Between your network and extranet connection ■ Internal: Between internal data centers ■ Remote access: Hardens perimeter control ■ Server farm: Network IPS at the perimeter and host IPS on the servers © 2012 Pearson Education. ■ Sensor placement: It is recommended that these be placed at those entry and exit points that provide sufficient IPS coverage. All rights reserved. Please see page 89 for more details. .

[ 78 ] Chapter 5: Cisco IOS IPS Configuring Cisco IOS IPS Using Cisco Configuration Professional (CCP) Cisco IOS IPS signatures include the following advanced features: ■ Regular-expression string pattern matching ■ Support for various response actions ■ Alarm summarization ■ Threshold configuration ■ Anti-evasive techniques To configure IPS using the CCP. choose Monitor > Logging > Syslog. All rights reserved. © 2012 Pearson Education. To view SDEE alarm messages in CCP. . Inc. This publication is protected by copyright. Please see page 89 for more details. choose Configure > Security > Advanced Security > Intrusion Prevention. choose Monitor > Logging > SDEE Message Log. To view alarms generated by Cisco IOS IPS.

■ Isolation between processes: An operating system should provide isolation between processes. Trojan horses. and Endpoint Security Endpoint Security Securing endpoints in the network infrastructure is also important. Overview The Cisco strategy for addressing host security is based on three broad elements: ■ Endpoint protection: Cisco Security Agent protects endpoints against threats posed by viruses. Cisco NAC. This publication is protected by copyright. . This section details the Cisco approach to this important security area. this prevents rogue applications from affecting the operating system or other application. The following techniques help protect an endpoint from operating system vulnerabilities: ■ Least-privilege concept: A process should never be given more privilege than is necessary to perform a job.[ 79 ] CCNA Security 640-554 Quick Reference Chapter 6 LAN. and Intrusion Prevention System (IPS) provide this service. Voice. ■ Network infection containment: Containment focuses on automating key elements of the infection response process. Cisco Security Agent. ■ Cisco Network Admission Control (NAC): Ensures that every endpoint complies with network security policies before being granted access to the network. © 2012 Pearson Education. Inc. All rights reserved. Please see page 89 for more details. SAN. and worms.

■ Penetrate phase: Exploit code is transferred to the vulnerable target.[ 80 ] Chapter 6: LAN. Buffer overflows are used to root a system or to cause a DoS attack. ■ Small. This publication is protected by copyright. Buffer Overflows Buffer overflow exploits overwrite memory on an application stack by supplying too much data into an input buffer. SAN. . Inc. All rights reserved. ■ Propagate phase: Extends the attack to other targets. Please see page 89 for more details. and Endpoint Security ■ Reference monitor: An access control concept that refers to a mechanism that mediates all access to operating system and application objects. Worm Attacks A worm attack consists of the following: ■ Enabling vulnerability ■ Propagation mechanism ■ Payload The worm attack occurs in phases: ■ Probe phase: Identifies vulnerable targets. easily verifiable pieces of software managed and monitored by a reference monitor. ■ Paralyze phase: Actual damage is done to the system. ■ Persist phase: The code tries to persist on the target system. verifiable pieces of code: Small. © 2012 Pearson Education. Voice. Rooting a system is hacking a system so that the attacker has root privileges.

All rights reserved. . with a focus on e-mail and web security products. This publication is protected by copyright. Please see page 89 for more details. The Cisco NAC Appliance includes the following components: ■ Cisco NAC Appliance Server (NAS): Performs network access control ■ Cisco NAC Appliance Manager (NAM): Centralized administrative interface ■ Cisco NAC Appliance Agent (NAA): Client software that facilitates network admission ■ Rule-set updates: Automatic updates Cisco Security Agent This product consists of the following: ■ Management Center for Cisco Security Agents ■ Cisco Security Agent © 2012 Pearson Education. and Endpoint Security IronPort Cisco IronPort security appliances protect enterprises against Internet threats.[ 81 ] Chapter 6: LAN. SAN. Inc. The following are the security appliance products that IronPort offers: ■ IronPort C-Series: E-mail security appliances ■ IronPort S-Series: Web security appliance ■ IronPort M-Series: Security management appliance Cisco NAC Cisco NAC products are designed to allow only authorized and compliant systems to access the network and to enforce network security policy. Voice.

manage. LUN masking is an authorization process that makes a LUN available to some hosts and unavailable to others. Overview A storage-area network (SAN) is a specialized network that enables fast. a logical unit number (LUN) is an address for an individual disk drive and the disk device itself. SAN. All rights reserved. with a special emphasis on security for SANs. Voice. . Please see page 89 for more details. Logical Unit Number Masking In computer storage. reliable access among servers and external storage resources. This publication is protected by copyright. Cisco solutions for intelligent SANs provide a better way to access. and protect growing information resources across a consolidated Fibre Channel. Inc. Gigabit Ethernet. Internet Small Computer Systems Interface (iSCSI). and optical network. © 2012 Pearson Education.[ 82 ] Chapter 6: LAN. and Endpoint Security Protection of end systems is provided by the following: ■ File system interceptor ■ Network interceptor ■ Configuration interceptor ■ Execution space interceptor Storage-Area Network Security Storage-area networking is another topic becoming more important. This topic is explored in this section. Fibre Channel over IP (FCIP).

Please see page 89 for more details. . Zoning can also use name servers in the switches to either allow or block access to particular WWNs in the fabric. SAN.[ 83 ] Chapter 6: LAN. This publication is protected by copyright. All rights reserved. Virtual SAN A virtual storage-area network (VSAN) is a collection of ports from a set of connected Fibre Channel switches that form a virtual fabric. You can partition ports within a single switch into multiple VSANs. and Endpoint Security World Wide Names A World Wide Name (WWN) is a 64-bit address that Fibre Channel networks use to uniquely identify each element in a Fibre Channel network. Inc. one device should not necessarily be allowed to interact with all the other devices in the SAN. Fibre Channel Fabric Zoning Fibre Channel zoning is the partitioning of a Fibre Channel fabric into smaller subsets. Zoning can use WWNs to assign security permissions. Voice. SAN Security Scope SAN security should focus on six areas: ■ SAN management access ■ Fabric access ■ Target access ■ SAN protocol ■ IP storage access ■ Data integrity and secrecy © 2012 Pearson Education. If a SAN contains several storage devices.

[ 84 ] Chapter 6: LAN.248 is similar to MGCP. and Endpoint Security Voice Security Voice over IP is becoming more popular. All rights reserved. ■ MGCP: Originally developed by Cisco. . but it is more flexible in its support for gateways and applications. It defines the necessary control mechanism to allow a media gateway controller to control gateways to support multimedia streams across networks. Voice. SAN. a Cisco Unified Communications server) via a series of events and signals. such as VoIP gateways and gatekeepers.323: A suite of protocols that also defines certain devices. ■ H. This section details this technology and lists important related security topics. This publication is protected by copyright. Overview You can find the following components in the VoIP network: ■ IP phones: ■ Call agents: Replace many of the features previously provided by PBXs ■ Gateways: Can forward calls between different types of networks ■ Gatekeepers: Can be thought of as the “traffic cops” of the WAN ■ Multipoint control units (MCU): Useful for conference calling ■ Application servers: Offer additional services such as voice mail ■ Videoconference stations: Devices/software that allow a calling or called party to view/transmit video as part of their telephone conversation Common VoIP protocols include the following: ■ H. Media Gateway Control Protocol enables a client (for example. Please see page 89 for more details. © 2012 Pearson Education. an analog port in a voice-enabled router) to communicate with a server (for example. Inc. ■ SIP: Session Initiation Protocol is a popular protocol to use in mixed-vendor environments.248: H.

or SPIT) ■ Vishing (similar to phishing. ■ RTP: Real-time Transport Protocol carries the voice payload. ■ Security appliances. SAN. © 2012 Pearson Education. Please see page 89 for more details. All rights reserved. ■ SRTP: Secure RTP secures the RTP traffic. but refers to maliciously collecting such information over the phone) ■ SIP attacks (man-in-the-middle attacks and manipulation of SIP messages) Protection Mechanisms Mechanisms and methods to help secure the VoIP network include the following: ■ Auxiliary VLANs (with voice traffic getting its own VLAN).[ 85 ] Chapter 6: LAN. Common Voice Security Issues Common attacks include the following: ■ Accessing VoIP resources without proper credentials ■ Gleaning information from unsecured networks ■ Launching a denial-of-service (DoS) attack ■ Capturing telephone conversations ■ VoIP spam (more commonly referred to as spam over IP telephony. Voice. and Endpoint Security ■ SCCP: Skinny Client Control Protocol is a Cisco-proprietary signaling protocol. This publication is protected by copyright. Inc. . ■ Use IPsec protected VPNs. ■ RTCP: RTP Control Protocol provides information about an RTP flow.

but it should not be. Inc. Voice. This section details many important security practices you must follow. Please see page 89 for more details. VLAN Hopping Attackers can send traffic into another VLAN by double-tagging 802. All rights reserved. SAN.1Q information in the frame and using the native VLAN. ■ Root Guard: Denies a new root switch from being elected in the topology from an unauthorized port. Mitigating Layer 2 Attacks Layer 2 is often omitted from security practices. Also. One easy way to combat this is to create an empty VLAN for the native VLAN and then use this as the native VLAN on all links. This publication is protected by copyright. © 2012 Pearson Education. ■ Disable gratuitous ARP. . ■ Disable unneeded services. ensure that switch ports are not using Dynamic Trunking Protocol (DTP) by using the switchport nonegotiate command. and Endpoint Security ■ Disable web access. STP Protections Consider the following protection mechanisms: ■ BPDU Guard: Ensures that bridges plugged into PortFast ports do not cause a temporary Layer 2 loop.[ 86 ] Chapter 6: LAN.

use the command switchport port-security. To enable the feature and configure options. ■ Selectively use Simple Network Management Protocol (SNMP).[ 87 ] Chapter 6: LAN. Voice. SAN. This publication is protected by copyright. ■ Use port security. and Endpoint Security Port Security Use this feature to lock down a port for authorized MAC address usage. © 2012 Pearson Education. Please see page 89 for more details. broadcast. . or multicast frames in the LAN ■ MAC address notifications: Alerts when the MAC address on a port changes Layer 2 Best Practices Layer 2 best practices include the following: ■ Manage switches securely. Figure 6-1 shows an example of port security configurations. ■ Use a dedicated VLAN for trunks. Switch1(config)# switchport port-security Switch1(config)# switchport port-security maximum 2 Switch1(config)# switchport port-security violation restrict Switch1(config)# switchport port-security aging time 120 Figure 6-1 Port Security Additional Security Features ■ Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN): Copy frames to a destination port for analysis ■ Storm control: Prevents an excess of unicast. All rights reserved. ■ Do not use VLAN 1. ■ Set user ports to nontrunking. Inc.

■ Disable unused ports. All rights reserved. Voice. Inc. This publication is protected by copyright. Please see page 89 for more details. . © 2012 Pearson Education. and place them in a VLAN.[ 88 ] Chapter 6: LAN. SAN. ■ Trim Cisco Discovery Protocol (CDP). and Endpoint Security ■ Enable STP security features.

No part of this digital Quick Reference may be reproduced or transmitted in any form or by any means. Corporate and Government Sales The publisher offers excellent discounts on this digital Quick Reference when ordered in quantity for bulk purchases or special sales. Inc.com. Reader feedback is a natural continuation of this process. except for the inclusion of brief quotations in a review. without written permission from the publisher. Each book is crafted with care and precision.com. recording. Inc. Inc. marketing focus. Inc. The information is provided on an “as is” basis. Cisco Press or Cisco Systems.. All rights reserved. shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this digital Quick Reference. This publication is protected by copyright. cannot attest to the accuracy of this information. Corporate and Government Sales 1-800-382-3419 corpsales@pearsontechgroup. but no warranty or fitness is implied.S. and Cisco Systems. including photocopying. For more information. please contact: U. or by any information storage and retrieval system. .[ 89 ] CCNA Security 640-554 Quick Reference CCNA Security 640-554 Quick Reference Anthony Sequeira Copyright © 2012 Pearson Education. Please be sure to include the digital Quick Reference title and ISBN in your message. and branding interests. Indiana 46240 USA All rights reserved. Cisco Press. our goal is to create in-depth technical books of the highest quality and value. electronic or mechanical.com The opinions expressed in this digital Quick Reference belong to the author and are not necessarily those of Cisco Systems. We greatly appreciate your assistance. Feedback Information At Cisco Press. © 2012 Pearson Education. Trademark Acknowledgments All terms mentioned in this digital Quick Reference that are known to be trademarks or service marks have been appropriately capitalized. Use of a term in this digital Quick Reference should not be regarded as affecting the validity of any trademark or service mark. First Release May 2012 ISBN-13: 978-1-58714-317-5 Warning and Disclaimer This digital Quick Reference is designed to provide information about the CCNA Security Certification. Published by Cisco Press 800 East 96th Street Indianapolis. For sales outside the United States please contact: International Sales international@pearsoned. If you have any comments on how we could improve the quality of this digital Quick Reference. which may include electronic versions and/or custom covers and content particular to your business.. undergoing rigorous development that involves the unique expertise of members of the professional technical community. you can contact us through e-mail at feedback@ciscopress. or otherwise alter it to better suit your needs. training goals. Every effort has been made to make this digital Quick Reference as complete and accurate as possible. Inc. The author.