Cisco.Press.CCIE.Security.Practice.Labs

[ LiB ] Table of Contents Index CCIE Security Practice Labs By Fahim Hussain Yusuf Bhaiji Publisher: Cisco Press Pub Date: February 24, 2004 ISBN: 1-58705-134-6 Pages: 552 Seven comprehensive CCIE security labs to hone configuration and troubleshooting skills Prepare for the CCIE Security lab exam and hone your security configuration and troubleshooting skills with seven complete practice scenarios that cover: • • • • • • • Basic device configuration Routing configuration ISDN configuration Cisco PIX Firewall configuration VPN configuration, including IPSec, GRE, L2TP, and PPTP VPN-3000 Concentrator configuration Intrusion Detection System (IDS) 42xx Appliance configuration • • • • • Cisco IOS Firewall configuration AAA configuration Advanced security issues IP services and protocol-independent features Security violations The explosive growth of the Internet economy over the past several years and new IP-based enterprise applications has heightened requirements for continuous availability of mission-critical data Today's network administrators and managers are under big pressure to satisfy ever-increasing demands from customers, suppliers, and employees for 100 percent network resource availability and access to applications and data The end result is that the cost of a network security breach has never been higher Accordingly, the demand for networking professionals with expert-level network security configuration and troubleshooting skills is also great The Cisco Systems CCIE Security certification is a prestigious program that sets the professional benchmark for internetworking expertise, validating proficiency with advanced technical skills required to design, configure, and maintain a wide range of network security technologies CCIE Security Practice Labs provides a series of complete practice labs that mirror the difficult hands-on lab exam Written by a CCIE Security engineer and Cisco Systems CCIE proctor, this book lays out seven end-to-end scenarios that are both complex and realistic, providing you with the practice needed to prepare for your lab examination and develop critical-thinking skills that are essential for resolving complex, real-world security problems While many engineers are able to configure single technologies in standalone environments, most will struggle when dealing with integrated technologies in heterogeneous environments CCIE Security Practice Labs consists of seven full-blown labs The book does not waste time covering conceptual knowledge found in other security manuals, but focuses exclusively on these complex scenarios The structure of each chapter is the same, covering a broad range of security topics Each chapter starts with an overview, equipment list, and general guidelines and instructions on setting up the lab topology, including cabling instructions, and concludes with verification, hints, and troubleshooting tips, which highlight show and debug commands The companion CD-ROM contains solutions for all of the labs, including configurations and common show command output from all the devices in the topology "Security is one of the fastest-growing areas in the industry There is an ever-increasing demand for the experts with the knowledge and skills to it." -Gert De Laet, Product Manager, CCIE Security, Cisco Systems CCIE Security Practice Labs is part of a recommended study program from Cisco Systems that includes simulation and hands-on training from authorized Cisco Learning Partners and self-study products from Cisco Press [ LiB ] [ LiB ] Table of Contents Index CCIE Security Practice Labs By Fahim Hussain Yusuf Bhaiji Publisher: Cisco Press : February 24, Pub Date 2004 ISBN: 1-58705-134-6 Pages: 552 Copyright About the Author About the Technical Reviewers Acknowledgments Foreword Why Security Certifications? Why CCIE Security? Introduction The Need for Security Certification Overview of the CCIE Certification Overview of the CCIE Security Exam Security Written Qualification Exam Security Lab Exam Equipment List Target Audience About the Book Wrap-Up Final Word Icons Used in This Book Command Syntax Conventions Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (10 points) Section 2.0: Routing Configuration (25 points) Section 3.0: ISDN Configuration (8 points) Section 4.0: PIX Configuration (5 points) Section 5.0: IPSec/GRE Configuration (10 points) Section 6.0: IOS Firewall + IOS IDS Configuration (10 points) Section 7.0: AAA (7 points) Section 8.0: Advanced Security (10 points) Section 9.0: IP Services and Protocol-Independent Features (10 points) Section 10.0: Security Violations (5 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec/GRE Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (10 points) Section 2.0: Routing Configuration (25 points) Section 3.0: ISDN Configuration (7 points) Section 4.0: PIX Configuration (5 points) Section 5.0: IPSec/GRE Configuration (15 points) Section 6.0: IOS Firewall Configuration (8 points) Section 7.0: AAA (7 points) Section 8.0: Advanced Security (8 points) Section 9.0: IP Services and Protocol-Independent Features (10 points) Section 10.0: Security Violations (6 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec/GRE Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (8 points) Section 2.0: Routing Configuration (27 points) Section 3.0: ISDN Configuration (7 points) Section 4.0: PIX Configuration (10 points) Section 5.0: IPSec Configuration (10 points) Section 6.0: IOS Firewall Configuration (8 points) Section 7.0: AAA (8 points) Section 8.0: Advanced Security (6 points) Section 9.0: IP Services and Protocol-Independent Features (10 points) Section 10.0: Security Violations (6 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (10 points) Section 2.0: Routing Configuration (26 points) Section 3.0: ISDN Configuration (5 points) Section 4.0: PIX Configuration (8 points) Section 5.0: IPSec/GRE Configuration (10 points) Section 6.0: IOS Firewall Configuration (8 points) Section 7.0: AAA (7 points) Section 8.0: Advanced Security (10 points) Section 9.0: IP Services and Protocol-Independent Features (10 points) Section 10.0: Security Violations (6 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec/GRE Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (13 points) Section 2.0: Routing Configuration (25 points) Section 3.0: ISDN Configuration (7 points) Section 4.0: PIX Configuration (8 points) Section 5.0: IPSec Configuration (10 points) Section 6.0: Intrusion Detection System (IDS) (6 points) Section 7.0: AAA (6 points) Section 8.0: Advanced Security (7 points) Section 9.0: IP Services and Protocol-Independent Features (12 points) Section 10.0: Security Violations (6 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec Configuration Section 6.0: Intrusion Detection System (IDS) Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (15 points) Section 2.0: Routing Configuration (25 points) Section 3.0: ISDN Configuration (7 points) Section 4.0: PIX Configuration (6 points) Section 5.0: IPSec/PPTP Configuration (10 points) Section 6.0: IOS Firewall Configuration (6 points) Section 7.0: AAA (4 points) Section 8.0: Advanced Security (7 points) Section 9.0: IP Services and Protocol-Independent Features (12 points) Section 10.0: Security Violations (8 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec/PPTP Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Chapter Practice Lab Equipment List General Guidelines Setting Up the Lab Practice Lab Exercises Section 1.0: Basic Configuration (15 points) Section 2.0: Routing Configuration (20 points) Section 3.0: ISDN Configuration (6 points) Section 4.0: PIX Configuration (7 points) Section 5.0: IPSec/PPTP Configuration (10 points) Section 6.0: IOS Firewall Configuration (8 points) Section 7.0: AAA (8 points) Section 8.0: Advanced Security (8 points) Section 9.0: IP Services and Protocol-Independent Features (10 points) Section 10.0: Security Violations (8 points) Verification, Hints, and Troubleshooting Tips Section 1.0: Basic Configuration Section 2.0: Routing Configuration Section 3.0: ISDN Configuration Section 4.0: PIX Configuration Section 5.0: IPSec/PPTP Configuration Section 6.0: IOS Firewall Configuration Section 7.0: AAA Section 8.0: Advanced Security Section 9.0: IP Services and Protocol-Independent Features Section 10.0: Security Violations Index [ LiB ] [ LiB ] Copyright Copyright 2004 Cisco Systems, Inc Cisco Press logo is a trademark of Cisco Systems, Inc Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review Printed in the United States of America First Printing February 2004 Library of Congress Cataloging-in-Publication Number: 2003100540 Warning and Disclaimer This book is designed to provide information to help you prepare for the CCIE Security Certification Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied The information is provided on an "as is" basis The author, Cisco Press, and Cisco Systems, Inc shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized Cisco Press or Cisco Systems, Inc cannot attest to the accuracy of this information Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of members from the professional technical community Readers' feedback is a natural continuation of this process If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through e-mail at feedback@ciscopress.com Please make sure to include the book title and ISBN in your message Credits We greatly appreciate your assistance Publisher John Wait Editor-in-Chief John Kane Executive Editor Brett Bartow Cisco Representative Anthony Wolfenden Cisco Press Program Manager Sonia Torres Chavez Production Manager Patrick Kanouse Senior Development Editor Christopher Cleveland Project Editor Marc Fowler Technical Editors Gert De Laet, Gert Schauwers Team Coordinator Tammi Barnett Book Designer Gina Rexrode Cover Designer Louisa Adair Composition Interactive Composition Corporation Corporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CA 95134-1706 USA www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 European Headquarters Cisco Systems International BV Haarlerbergpark Haarlerbergweg 13-19 1101 CH Amsterdam The Netherlands www-europe.cisco.com Tel: 31 20 357 1000 Fax: 31 20 357 1100 Americas Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CA 95134-1706 USA www.cisco.com Tel: 408 526-7660 Fax: 408 527-0883 Asia Pacific Headquarters Cisco Systems, Inc Capital Tower 168 Robinson Road #22-01 to #29-01 Singapore 068912 www.cisco.com Tel: +65 6317 7777 Fax: +65 6317 7799 Cisco Systems has more than 200 offices in the following countries and regions Addresses, phone numbers, and fax numbers are listed on the Cisco.com Web site at www.cisco.com/go/offices