CCNP Security SECURE

CCNP

_Security

SECURE 642-637

Official Cert Guide

Sean

Wilkins

Franklin H. Smith III

x CCNP

Security

SECURE 642-637 Official Cert Guide

Contents

Introduction xxxiii

PartI Network

_{Security Technologies}

Overview

Chapter

1 Network

_Security

Fundamentals 3 "Do I Know This

_Already?"

_Quiz 3 Foundation

_Topics

7

Defining

Network

_Security

7

Building

Secure Networks 7

Cisco SAFE 9 SCF Basics 9

SAFE/SCFArchitecture

_Principles

12

SAFE/SCF NetworkFoundationProtection

_(NFP)

14 SAFE/SCF_Design

_Blueprints

14

SAFE

_Usage

15

Exam

_Preparation

17

Chapter2 Network

_Security

Threats 21 "Do r KnowThis

Already?"

Quiz 21 Foundation

_Topics

24

Vulnerabilities 24

Self-imposed

NetworkVulnerabilities 24 IntruderMotivations 29

Lack

_{of Understanding of Computers}

orNetworks 30

In

_{truding fo}

rCuriosity 3 0

Intruding for

Fun andPride 30

Intruding for

Revenge 30

Intruding for Profit

31

Intruding for

Political

_Purposes

31

Types

of Network Attacks 31 Reconnaissance Attacks 32 Access Attacks 33

DoSAttacks 35 Exam

_Preparation

36

Chapter

3 Network Foundation Protection

_(NFP)

Overview 39

"DoI Know This

_{Already?" Quiz}

39 Foundation

_Topics

42

XI

Control Plane 43

Data Plane 44

Management Plane 45

Identifying

NetworkFoundation Protection

_Deployment

Models 45

Identifying

Network Foundation Protection Feature

_Availability

48 Cisco

_Catalyst

Switches 48

Cisco

_Integrated

Services Routers

_(ISR)

49 Cisco

_{Supporting Management Components}

50

Exam

_Preparation

53

Chapter

4

_Configuring

and

_Implementing

Switched DataPlane

Security

Solutions 57

"Do I Know This

_{Already?" Quiz}

57

Foundation

_Topics

60

SwitchedDataPlane Attack

Types

60 VLAN

_Hopping

Attacks 60

CAM

_Flooding

Attacks 61 MACAddress

_Spoofing

63

SpanningTreeProtocol (STP)

Spoofing

Attacks 63

DHCPStarvation Attacks 66

DHCPServer

_Spoofing

67 ARP

_Spoofing

67

SwitchedData Plane

_Security

_Technologies

67 Port

_{Configuration}

67

Port

_Security

71

RootGuard,BPDUGuard,and PortFast 74 DHCP

_Snooping

75

Dynamic

ARP

_{Inspection (DAI)}

77 IP Source Guard 79

Private VLANs(PVLAN) 80 Exam

_Preparation

84

Chapter5 802.1X and Cisco

_{Identity-Based Networking}

Services

_(IBNS)

91

"Do I Know This

_{Already?" Quiz}

91 Foundation

_Topics

94

Identity-Based Networking

Services (IBNS) andIEEE 802.1x Overview 94

CCNP

_Security

SECURE 642-637 Official Cert Guide 8 02.lx Interworking 97

Extensible Authentication Protocol

_(EAP)

97 EAPoverLAN(EAPOL) 98

EAP

_{Message Exchange}

99

PortStates 100

PortAuthentication Host Modes 101 EAP

_Type

Selection 102

EA_P-MessageD

_igest

A

_Igo

rithm 5 102

Protected EAPw/MS-CHAPv2 102 Cisco

Lightweight

EAP 103

EAP-Transport

Layer

Security

104

EAP-Tunneled

_Transport

Layer Security 104

EAP-Flexible Authentication via Secure

_Tunneling

105 Exam

_Preparation

106

Chapter6

_Implementing

and

_Configuring

Basic 802.1X 109 "Do I Know This

_{Already?" Quiz}

109

Foundation

_Topics

112

Plan Basic 802.1X

_Deployment

onCisco

Catalyst

IOSSoftware

Gathering Input

Parameters 113

Deployment

Tasks 113

Deployment

Choices 114

General

Deployment

Guidelines 114

Configure

and

_Verify

Cisco

_Catalyst

IOSSoftware802.1X

Authenticator 115

Configuration

Choices 115

Configuration

Scenario 115

Verify

Basic 802.1X

_{Functionality}

121

Configure

and

_Verify

Cisco ACS for EAP-FAST 121

Configuration

Choices 122

Configuration

Scenario 122

Configure

the Cisco Secure Services Client 802.1X

Supplicant

128

Task 1: Create the CSSC

_{Configuration Profile}

128 Task 2: CreateaWired Network

Profile

128

Tasks 3 and 4:

_(Optional)

Tune 802.1X Timers and Authentication Mode 130

Task 5:

_Configure

theInner and Outer EAP Mode

_for

the

Xiil

Task6: Choose the

_Login

Credentialsto BeUsed

for

Authentication 132

Task7:Create the CSSC Installation

_Package

133 Network

_Login

134

Verify

andTroubleshoot 802.1 X

_Operations

134

Troubleshooting

Flow 134

Successful

Authentication 135

Verify

Connection Status 135

Verify

Authentication onAAAServer 135

Verify

Guest/Restricted VLAN Assignment 135 802.1X ReadinessCheck 135

Unresponsive

Supplicant

135

Failed Authentication: RADIUS

_{Configuration}

Issues 135 Failed Authentication:Bad Credentials 135

Exam

_Preparation

136

Chapter

7

_Implementing

and

_Configuring

Advanced 802.1X 139 "Do I KnowThis

_{Already?" Quiz}

139

Foundation

_Topics

143

Plan the

_Deployment

of Cisco Advanced 802.IXAuthentication

Features 143

Gathering

InputParameters 143

Deployment

Tasks 144

Deployment

Choices 144

Configure and

Verify

EAP-TLS Authentication on Cisco IOS ComponentsandCiscoSecure ACS 145

EAP-TLS with 802.1X

Configuration

Tasks 145

Configuration

Scenario 146

Configuration

Choices 146

Task 1:

_Configure

RADIUSServer 147

Task 2:Install

Identity

and

_Certificate

_{Authority Certificates}

onAll

Clients 147

Task 3:

_Configure

an

Identity Certificate

onthe Cisco Secure ACS

Server 147

Task 4:

_Configure

_{Support of}

EAP-TLS onthe Cisco Secure

ACS Server 149

Task 5:

_(Optional)

_Configure

EAP-TLSSupport

Using

the

_Microsoft

Windows Native

_Supplicant

151

xiv CCNP

_Security

SECURE 642-637 Official Cert Guide

Implementation

Guidelines 153

Feature

_Support

153

Verifying

EAP-TLS

_{Configuration}

153

Deploying

User and MachineAuthentication 153

Configuring

User and Machine Authentication Tasks 154

Configuration

Scenario 154

Task1:Install

_Identity

and

_{Certificate Authority Certificates}

onAll

Clients 155

Task2:

Configure

Support

of

EAP-TLSonCisco Secure

ACS Server 155

Task3:

_Configure

_Support

_of

Machine AuthenticationonCisco Secure

ACS Server 156

Task4:

_Configure

_Support

_of

Machine Authenticationon

Microsoft

WindowsNative 802.1X

_Supplicant

156

Task 5:

_{(Optional) Configure}

Machine Authentication

_{Support Using}

the Cisco Secure Services Client

_(CSSC)

_Supplicant

157

Task 6:

_{(Optional) Configure}

Additional User

_{Support Using}

the Cisco Secure Services Client(CSSC)

Supplicant

158

Implementation

Guidelines 158

Feature

_Support

158

Deploying

VLAN and ACL

_Assignment

159

Deploying

VLAN_{and ACL Assignment Tasks} 159

Configuration

Scenario 159

Configuration

Choices 160

Task 1:

_Configure

Cisco IOS

_Software

802.1XAuthenticator Authorization 160

Task2:

_{(Optional) Configure}

VLAN

_Assignment

on Cisco

Secure ACS 161

Task3:

_(Optional)

_Configure

and

_Prepare

_for

ACL

_Assignment

onCisco

IOS

_Softwa

reSwitch 162

Task4:

_{(Optional) Configure}

ACL

_Assignment

on Cisco Secure ACS

Server 162

Verification

of

VLANandACL

_Assignment

with Cisco IOS

Software

CLI 164

Verification of

VLAN and ACL

_Assignment

onCisco

Secure ACS 165

Configure

and

_Verify

Cisco Secure ACS MACAddress

_Exception

Policies 165

Cisco

_Catalyst

IOS

_Software

MAC Authentication

XV

Configuration

Tasks 166

Configuration

Scenario 166

Tasks 1 and2:

_Configure

MAC Authentication

_Bypass

onthe Switch andACS 167

Verification

of

Configuration

168

Implementation

Guidelines 168

Configure

and

_Verify

Web AuthenticationonCisco IOS Software LAN

Switches and Cisco Secure ACS 168

Configuration

Tasks 169

Configuration

Scenario 169

Task h

_Configure

Web Authenticationonthe Switch 169

Task 2:

_Configure

Web Authenticationonthe Cisco Secure

ACS Server 171

Web Authentication

_Verification

172 User

_Experience

172

ChooseaMethodto

Support Multiple

Hostson a

Single

Port 172

Multiple

Hosts

Support

Guidelines 172

Configuring Support

of Multiple

Hostson a

Single

Port 172

Configuring Fail-Open

Policies 174

Configuring

CriticalPorts 174

Configuring Open

Authentication 176

Resolve 802.1X

Compatibility

Issues 176 Wake-on-LAN (WOL) 176

Non-802.1XIP Phones 177

PrebootExecution Environment(PXE) 177

Exam_Preparation 178

PartII Cisco IOS FoundationSecurity Solutions

Chapter8 ImplementingandConfiguringCisco IOS Routed Data PlaneSecurity 183

"DoIKnow This

_Already?"

Quiz 183 Foundation

_Topics

186

RoutedData PlaneAttack

_Types

186 IP

_Spoofing

186

Slow-Path Denial

_of

Service 186

Traffic Flooding

187

CCNP

_Security

SECURE 642-637 Official Cert Guide Flexible Packet

_Matching

196 Flexible NetFlow 203

Unicast Reverse Path

_Forwarding

_{(Unicast RPF)} 209 Exam

_Preparation

212

Chapter

9

_Implementing

and

_Configuring

CiscoIOS Control Plane_Security 219

"DoI KnowThis

_Already?"

Quiz 219

Foundation Topics 222

ControlPlaneAttack

_Types

222

Slow-Path Denial

_of

Service 222

Routing

Protocol

_Spoofing

222 Control Plane

_{Security Technologies}

222 ControlPlane

_{Policing (CoPP)}

222 Control Plane Protection

_(CPPr)

226

Routing

Protocol Authentication 232 Exam

_Preparation

237

Chapter10

_Implementing

and

_Configuring

Cisco IOSManagement

Plane

_Security

245

"Do I Know This

_Already?"

Quiz 245 Foundation

_Topics

248

Management

Plane Attack

_Types

248

Management

Plane

_Security

_Technologies

248

Basic

_{Management Security}

and

_Privileges

248 SSH 254

SNMP 256

CPUand

_Memory

_Thresholding

261

Managemen

tPlane Protection 2 62 AutoSecure 263

Digitally Signed

Cisco

_Software

265 Exam

_Preparation

267

Chapter

11

_Implementing

and

_Configuring

NetworkAddress

Translation

_(NAT)

275

"Do I Know This

_Already?"

Quiz 2 75

Foundation

_Topics

278

Network Address Translation 278 Static NAT

_Example

280

XVII

PAT

_Example

281 NAT

_{Configuration}

282

Overlapping

NAT 287 Exam

_Preparation

290

Chapter

12

_Implementing

and

_Configuring

Zone-Based _Policy Firewalls 295 "Do I KnowThis

Already?" Quiz

295

Foundation

_Topics

298

Zone-Based

_Policy

FirewallOverview 298

Zones/SecurityZones 298 Zone Pairs 299

Transparent

Firewalls 300

Zone-Based

_Layer

3/4

_Policy

Firewall

_{Configuration}

301 Class

_{Map Configuration}

302

Parameter

_{Map Configurations}

304

Policy Map Configuration

306 Zone

_{Configuration}

308 Zone Pair

_{Configuration}

309

Portto

Application Mapping (PAM) Configuration

310

Zone-Based

_Layer

7

_Policy

Firewall

_{Configuration}

312 URL Filter 313

HTTP

_Inspection

318 Exam

_Preparation

323

Chapter 13

_Implementing

and

_Configuring

IOS Intrusion Prevention

System (IPS)

333

"Do I Know This

_{Already?" Quiz}

333 Foundation

_Topics

336

Configuration

Choices, BasicProcedures,and

_{Required Input}

Parameters 336

Intrusion Detection and Prevention_{with Signatures} 337

Sensor

_Accuracy

339

Choosing

aCiscoIOSIPSSensorPlatform 340

Software-Based

Sensor 340 Hardware-BasedSensor 340

Deployment

Tasks 341

Deployment

Guidelines 342

Deploying

Cisco IOS Software IPSSignature Policies 342

xviii CCNPSecurity SECURE642-637 Official Cert Guide

Configuration

Scenario 342

Verification

346 Guidelines 347

TuningCiscoIOSSoftware IPS

_Signatures

347 EventRisk

Rating System

Overview 348 EventRisk RatingCalculation 348 EventRisk Rating

Example

349

Signature

Event Action Overrides

(SEAO)

349

Signature

EventActionFilters

(SEAF)

349

Configuration

Tasks 350

Configuration

Scenario 350

Verification

355

Implementation

Guidelines 355

Deploying

Cisco IOS Software IPSSignature

Updates

355

Configuration

Tasks 356

Configuration

Scenario 356

Task 1; Install

Signature Update

License 356 Task2:

_Configure

Automatic

_Signature

_Updates

357

Verification

357

MonitoringCisco IOSSoftwareIPSEvents 358 Cisco IOS

_Software

IPS Event Generation 358 Cisco IMEFeatures 358

Cisco IME MinimumSystem

Requirements

359

Configuration

Tasks 359

Configuration

Scenario 360

Task 2: Add the Cisco IOS

_Software

IPS SensortoCisco IME 361

Verification

362

Verification:

Local Events 362

Verification:

IME Events 363 Cisco IOS Software IPS Sensor 363

Troubleshooting

Resource Use 365 Additional

_Debug

Commands 365

Exam

_Preparation

366

Chapter 14 IntroductiontoCisco IOS Site-to-SiteSecuritySolutions 369

"Do I KnowThis

_{Already?" Quiz}

3 69

Foundation

Topics

372

XIX

Input

Parameters

_for

Choosing theBestVPNLAN

_Topology

373

General

_Deployment

Guidelines

for Choosing

the Best VPN LAN

Topology

373

Choosean

Appropriate

VPN WAN

Technology

373

Input

Parameters

_for

Choosingthe Best VPN WAN

_Technology

374 General

_Deployment

Guidelines

_{for Choosing}

the Best VPN WAN

Technology

376

Core Features of IPsec VPN

_Technology

376 IPsec

_Security

Associations 3 77

Internet

_{Key Exchange (IKE)}

377 IPsec Phases 377

IKE Main and

_Aggressive

Mode 378

Encapsulating Security Payload

378

Choose_AppropriateVPN

Cryptographic

Controls 379

IPsec_SecurityAssociations 379

Algorithm

Choices 379

General

_Deployment

Guidelines

_for

Choosing

Cryptographic

Controls

_for

aSite-to-Site VPN

Implementation

381

Design

and

_{Implementation}

Resources 382 Exam

_Preparation

383

Chapter15 DeployingVTI-Based Site-to-Site IPsec VPNs 387 "Do I Know This

_Already?"

Quiz 387

Foundation

_Topics

390

PlanaCisco IOSSoftwareVTI-Based Site-to-Site VPN 390

Virtual Tunnel

_Interfaces

390

Input

Parameters 392

Deployment

Tasks 393

Deployment

Choices 393

General

_Deployment

Guidelines 393

Configuring

Basic IKE

_Peering

393

Cisco IOS

_{Software Default}

IKE PSK-Based Policies 394

Configuration

Tasks 394

Configuration

Choices 395

Configuration

Scenario 395

Task 1:

_(Optional)

_Configure

anIKE

Policy

onEachPeer 395

Tasks 2 and3:Generate and

_Configure

Authentication Credentials

onEachPeer 396

XX CCNPSecurity SECURE 642-637 OfficialCertGuide

Verify

Local IKE Policies 396

Verify

a

Successful

Phase 1

_Exchange

397

Implementation

Guidelines 397

Troubleshooting

IKEPeering 397

Troubleshooting

Flow 397

Configuring

Static Point-to-Point IPsec VTI Tunnels 398

Default

Cisco IOS

_Software

IPsec

_Transform

Sets 398

Configuration

Tasks 398

Configuration

Choices 399

Configuration

Scenario 399

Task 1:

_{(Optional) Configure}

anIKE

Policy

onEachPeer 399 Task2:

_{(Optional) Configure}

anIPsec

_Transform

Set 399 Task3:

_Configure

anIPsecProtection

Profile

400

Task4:

_Configure

a VirtualTunnel

Interface

(VTI) 400

Task5:

_Apply

theProtection

_Profile

tothe Tunnel

_Interface

401

Task 6;

_{Configure Routing}

into the VTI Tunnel 401

Implementation

Guidelines 401

Verify

Tunnel Status and

_Traffic

401

Troubleshooting

Flow 402

Configure Dynamic

Point-to-Point IPsec VTI Tunnels 403 Virtual

_Templates

and Virtual Access

_Interfaces

403 ISAKMP

_Profiles

404

Configuration

Tasks 404

Configuration

Scenario 404 Task1:

_Configure

IKEPeering 405

Task 2:

_{(Optional) Configure}

anIPsec

_Transform

Set 405 Task 3:

Configure

anIPsec Protection

Profile

405

Task4:

_Configure

a Virtual

Template Interface

406

Task 5:

_Map

Remote Peertoa Virtual

Template

Interface

406

Verify

Tunnel Statusonthe Hub 407

Implementation

Guidelines 407 ExamPreparation 408

Part III Cisco IOS ThreatDetection and Control

Chapter

16 DeployingScalable Authentication in Site-to-Site IPsec VPNs 411 "Do I Know This

_Already?"

Quiz 411

Foundation

_Topics

414

XXI

Trusted

_Introducing

414

Public Key

Infrastructure: Certificate

Authorities 416 X.509

_{Identity Certificate}

417

Certificate

Revocation

_Checking

418

Using Certificates

in Network

_Applications

419

Deployment

Choices 420

Deploy

men t

Steps

420

Input

Parameters 421

Deployment

Guidelines 421

Configure,

Verify,

andTroubleshootaBasic Cisco IOS Software CertificateServer 421

Configuration

Tasks

_for

aRoot

Certificate

Server 422

Configuration

Scenario 423

Task 1: CreateanRSA

Key

Pair 423 Task2: CreateaPK1

Trustpoinr

424

Tasks3and4: Create the CS and

_Configure

the Database

Location 424

Task5:

_Configure

an

Issuing Policy

425 Task6:

_Configure

the Revocation

_Policy

425 Task 7:

_Configure

the SCEP

_Interface

426 Task 8: Enable the

_Certificate

Server 426 Cisco

_{Configuration Professional Support}

426

Verify

the Cisco IOS

_Software

_Certificate

Server 427 Feature

_Support

427

Implementation

Guidelines 428

Troubleshooting

Flow 429

PKI and Time: AdditionalGuidelines 429

EnrollaCisco IOS SoftwareVPNRouter intoaPKI and Troubleshoot the

EnrollmentProcess 429

PKI Client Features 42 9

Simple Certificate

EnrollmentPro tocol 43 0

Key Storage

430

Configuration

Tasks 430

Configuration

Scenario 431 Task1: CreateanRSA

Key

Pair 431

Task2: CreateanRSA

Key

Pair 432

Task3:Authenticatethe PKI

_{Certificate Authority}

432

xxii CCNP

Security

SECURE 642-637 Official Cert Guide

Task5:Issue theClient

_Certificate

ontheCA Server 434

Certificate

Revocationon the Cisco IOS

Software

Certificate

Server 434

Cisco

_{Configuration Professional}

_Support

434

Verify

the CA and

_{Identity Certificates}

435 Feature

_Support

435

Implementation

Guidelines 436

Troubleshooting

Flow 436

Configure

and

_Verify

theIntegrationofaCiscoIOS Software

VPN Routerwith SupportingPKI Entities 436

IKE Peer Authentication 436

IKEPeer

_Certificate

Authorization 437

Configuration

Tasks 437

Configuration

Scenario 437

Task 1:

_Configure

anIKE

Policy

438

Task 2:

_Configure

an1SAKMP

Profile

438

Task3:

_Configure

_{Certificate-Based}

Authorization

_of

Remote Peers 438

Verify

IKE SA Establishment 43 9 Feature

_Support

439

Implementation

Guidelines 440

Troubleshooting

Flow 44 0

Configuring

Advanced PKI_Integration 440

Configuring

CRL

Handling

onPKIClients 441

Using

OCSPorAAAonPKIClients 441

ExamPreparation 442

Chapter

17 DeployingDMVPNs 447

"Do IKnowThis

_Already?"

_Quiz

447

Foundation Topics 451

Understanding

theCisco IOS Software DMVPN

Architecture 451

Building

Blocks

_of

DMVPNs 452

Hub-and-Spoke

Versus On-Demand

_Fully

MeshedVPNs 452 DMVPN Initial State 453

DMVPN

_{Spoke-to-Spoke}

Tunnel Creation 453 DMVPN

_Benefits

and Limitations 454

Plan the

_Deployment

ofaCisco IOS SoftwareDMVPN 455

Deployment

Tasks 455

Deployment

Choices 456

General

_Deployment

Guidelines 456

Configure

and

_Verify

Cisco IOS SoftwareGRETunnels 456

GRE Features and Limitations 456

Point-to-PointVersus

_{Point-to-Multipoint}

GRETunnels 457 Point-to-PointTunnel

_{Configuration Example}

457

Configuration

Tasks

_for

a

Hub-and-Spoke

Network 459

Configuration

Scenario 459

Task1:

_Configure

anmGRE

Interface

onthe Hub 459

Task2:

_Configure

aGRE

Interface

onthe

Spoke

459

Verify

the StateofGRE Tunnels 460

Configure

and

_Verify

aCisco IOS Software NHRP Client andServer 461

(m)GREand NHRP

_Integration

461

Configuration

Tasks 461

Configuration

Scenario 461

Task 1:

_Configure

anNHRP Server 461

Task 2:

_Configure

anNHRP Client 462

Verify

NHRP

_Mappings

462

Debugging

NHRP 463

Configure

and

_Verify

a Cisco IOS Software DMVPN Hub 464

Configuration

Tasks 464

Configuration

Scenario 464

Task 1:

_{(Optional) Configure}

anIKE

Policy

464

Task 2; Generate and/or

_Configure

Authentication Credentials 465

Task 3:

_Configure

anIPsec

Profile

465

Task 4: CreateanmGRETunnel

Interface

465

Task 5:

_Configure

the NHRP Server 465

Task 6: Associate the IPsec

_Profile

with themGRE

Interface

466 Task 7:

_Configure

IP Parametersonthe mGRE

Interface

466

Cisco

_{Configuration Professional Support}

466

Verify Spoke Registration

466

Verify Registered

Spoke

Details 467

Implementation

Guidelines 468 Feature

_Support

468

xxiv CCNP

Security

SECURE 642-637Official Cert Guide

Configuration

Tasks 468

Configuration

Scenario 469

Task 1:

(Optional) Configure

anIKE

Policy

469

Task 2: Generate and/or

Configure

AuthenticationCredentials 469

Task3:

Configure

anIPsec

Profile

469 Task4: CreateanmGRETunnel

Interface

470 Task5:

_Configure

theNHRPClient 470

Task6: AssociatetheIPsec

_Profile

with themGRE

Interface

470

Task7:

_Configure

IP ParametersonthemGRE

_Interface

471

Verify

TunnelStateand

_Traffic

Statistics 471

Configure

and

_{Verify Dynamic}

RoutinginaCisco IOS

Software DMVPN 471 EIGRP Hub

_{Configuration}

472 OSPF Hub

_{Configuration}

473

Hub-and-Spoke Routing

and IKE

_Peering

on

Spoke

473

Full Mesh

_Routing

and IKE

_Peering

on

Spoke

474

TroubleshootaCisco IOS Software DMVPN 474

Troubleshooting

Flow 475

ExamPreparation 476

Chapter 18 _{Deploying High Availability}inTunnel-Based IPsecVPNs 481

"DoIKnowThis

_Already?"

Quiz 481 Foundation

_Topics

484

Plan the

_Deployment

ofCisco IOSSoftwareSite-to-Site IPsec VPN

_{High-Availability}

Features 484

VPNFailureModes 484

PartialFailure

_of

the

_Transport

Network 484

PartialorTotal Failure

of

the ServiceProvider (SP)

Transport

Network 485

PartialorTotalFailure

of

aVPN Device 485

Deployment

Guidelines 485

Use

_Routing

Protocols for VPN Failover 486

Routing

to VPN Tunnel

_Endpoints

486

Routing

Protocol Inside the VPN Tunnel 486

Recursive

_Routing

Hazard 487

Routing

ProtocolVPN

Topologies

487

XXV

Choosethe Most

_Optimal

Method of

_Mitigating

Failure in

aVTI-Based VPN 488

Path

_Redundancy

_Using

a

Single-Transport

Network 489 Path

_{Redundancy Using}

Two

_Transport

Networks 489

Path and Device

_Redundancy

in

_{Single-Transport}

Networks 489 Path and Device

_Redundancy

with

_{Multiple-Transport}

Networks 489

Choose the Most

Optimal

Methodof

_Mitigating

Failure inaDMVPN 490

Recommended Architecture 490 Shared IPsecSAs 490

Configuring

aDMVPN witha

Single-Transport

Network 490

Configuring

aDMVPNover

Multiple-Transport

Networks 493

Exam_Preparation 495

Chapter

19

_Deploying

GET VPNs 499

"DoI Know This

_{Already?" Quiz}

499

Foundation

_Topics

502

Describethe

_Operation

ofaCisco IOS Software GET VPN 502

Peer Authentication and

_{Policy Provisioning}

502

GET VPN

_{Traffic Exchange}

504

Packet

_Security

Services 504

Key Management

Architecture 505

Rekeying

Methods 505

Traffic

Encapsulation

507

Benefits

and Limitations 507

Plan the

_Deployment

ofaCisco IOSSoftware GETVPN 508

Input

Parameters 508

Deployment

Tasks 508

Deployment

Choices 509

Deployment

Guidelines 509

Configure

and

_Verify

aCiscoIOSSoftware GET VPN

Key

Server 509

Configuration

Tasks 509

Configuration

Choices 510

Configuration

Scenario 510

Task 1:

_(Optional)

_Configure

anIKE

Policy

511

Task 2:Generate and/or

_Configure

Authentication

Credentials 511

xxvi CCNPSecuritySECURE 642-637 Official Cert Guide

Task4:

_Configure

a

Traffic

Protection

Policy

onthe

Key

Server 512

Task 5:Enableand

_Configure

theGETVPN

_Key

Server

Function 512

Task 6:

(Optional)

Tune theRekeying

Policy

513

Task7: Create and

Apply

the GET VPN

_{Crypto Map}

513

Cisco

Configuration Professional Support

514

Verify

BasicKeyServer

_Settings

514

Verify

the Rekey

Policy

514 ListAll

_Registered

Members 515

Implementation

Guidelines 515

Configure

and

_Verify

CiscoIOSSoftware GET VPN

Group

Members 515

Configuration

Tasks 516

Configuration

Choices 516

Configuration

Scenario 516

Task 1:

_Configure

anIKE

Policy

516

Task2: Generate and/or

_Configure

Authentication Credentials 517

Task3:Enable the GET VPN

_Group

Member Function 518 Task 4: Create and

Apply

the GET VPN

_{Crypto Map}

518

Task5:

(Optional) Configure

aFail-Closed

Policy

518

Cisco

Configuration Professional Support

519

Verify

Registration

of

the

Group

Member 519

Implementation

Guidelines 519

Troubleshooting

Flow 519

Configure

and

_Verify

High-Availability

Mechanisms inaGET VPN 520

Network

_Splits

and Network Merges 521

Configuration

Tasks 521

Configuration

Scenario 521

Task 1: Distribute the

_Rekey

RSA

_Key

Pair 522

Task2:

_Configure

aFull Mesh

of Key

Server IKEPeering 522

Task 3:

_Configure

COOP 522

Tasks4 and5:

_{Configure Traffic}

Protection

_Policy

and

_Multiple

Key Serverson

Group

Members 523

Verify

IKE

_Peering

523

XXVil

Implementation

Guidelines 524

Troubleshooting

Flow 524

Exam_Preparation 525

Part IV

_Managing

and

_Implementing

Cisco IOS Site-to-Site

Security

Solutions

Chapter20

_Deploying

Remote Access Solutions

_Using

SSL VPNs 529 "Do I Know This

_{Already?" Quiz}

529

Foundation

_Topics

533

Choosean

Appropriate

Remote Access VPN

Technology

533

Cisco IOS

_Software

Remote Access VPN

_Options

533 Full

_Tunneling

Remote Access SSL VPN: Features 533 Full

_Tunneling

RemoteAccess SSL VPN:

_Benefits

andLimitations 534

Clientless RemoteAccessSSL VPN:Features 534 ClientlessSSLVPN:

Benefits

andLimitations 535

Software

ClientRemoteAccessIPsec_{VPN (EZVPN):}Features 535 Hardware ClientRemote Access IPsec VPN(EZVPN):Features 536 Remote Access IPsec VPN:

_Benefits

andLimitations 53 6

VPN AccessMethods: Use Cases 536

Choose

_Appropriate

Remote Access VPN

_{Cryptographic}

Controls 537

SSL/TLS

_Refresher

537

Algorithm

Choices in Cisco SSL Remote Access VPNs 539 IKE Remote Access VPN Extensions 53 9

Algorithm

Choices in Cisco IPsec Remote Access VPNs 540

Deploying

Remote Access Solutions

_Using

SSL VPNs 541 Solution

_Components

541

Deployment

Tasks 541

Input

Parameters 542

Configure

and

_Verify

Common SSL VPN Parameters 542

Configuration

Tasks 543

Configuration

Choices 543

Configuration

Scenario 543

Task 1:

_{(Optional) Verify}

SSL VPN

Licensing

544 Task 2: Provisionan

Identity

Server SSL/TLS

Certificate

tothe ISR 544

xxviii CCNP

_Security

SECURE 642-637 Official Cert Guide

Task 5:

_{(Optional) Configure Gateway High Availability}

545

Gateway Verification

545

Implementation

Guidelines 546

Configure

and

_Verify

Client Authentication and Policies

onthe SSL VPN

Gateway

546

Gateway,

Contexts,and

_{Policy Groups}

546

BasicUser Authentication Overview 546

Configuration

Tasks 547

ConfigurationScenario 547

Task 1: Createand

_Apply

a

Default Policy

548

Task 2:Enable UserAuthentication

_Using

LocalAAA 548

Implementation

Guidelines 548

Configure

and

_Verify

Full

_{Tunneling Connectivity}

onthe Cisco 10S SSL

VPN

_Gateway

549

Configuration

Tasks 549

Configuration

Scenario 549

Task 1: Enable Full

_Tunneling

Access 549

Task 2:

_Configure

LocalIP_{Address Assignment} 550 Task3:

_(Optional)

_Configure

Client

_{Configuration}

551 Task 4:

_(Optional)

_{Configure Split Tunneling}

551 Task 5:

_{(Optional) Configure}

AccessControl 551 Cisco

Configuration

Professional

Support

552

Install and

Configure

theCisco

_AnyConnect

Client 552

AnyConnect

2.4-Supported Platforms

553

Configuration

Tasks 553

Configuration

Scenario 553

Task1: Enable Full

_Tunneling

Access 553

Task2:

_Verify

Server

_Certificate

Authentication Chain 554 Task 3:

_Configure

Basic

_{AnyConnect Profile Settings}

554

Task 4: Establish the SSLVPN Connection 554 Client-Side

_Verification

554

Gateway-Side Verification

555 Cisco

_{Configuration}

_Professional

556

Configure

and

_Verify

Clientless Accessonthe Cisco IOS SSL VPN

Gateway

556

BasicPortalFeatures 556

xxix

Port

_{Forwarding Benefits}

andLimitations 558 Portal ACLs 558

Configuration

Tasks 558

Configuration

Scenario 559

Task1: EnableFull

_Tunneling

Access 560

Task 2:

_(Optional)

_Configure

Port

_Forwarding

560 Task 3:

_{(Optional) Configure}

Cisco Secure

_Desktop

561

Task4:

_{(Optional) Configure}

Access Control 561 Basic Portal

_Verification

562

Web

_Application

Access 562 File ServerAccess 562 Port

_Forwarding

Access 562

Cisco Secure

_{Desktop Verification}

563

Gateway-Side Verification

563

Troubleshoot the BasicSSLVPN

_Operation

563

Port

_Forwarding

Access 563

Troubleshooting

Flow(VPN Establishment) 563

Troubleshooting

Flow_(Data

_Flow)

563

Gateway-Side

Issue 564

Client-Side Issues:

_Certificates

564

Exam_Preparation 565

Chapter21 Deploying Remote Access SolutionsUsingEZVPNs 569 "Do I Know This

_Already?"

Quiz 569

Foundation

_Topics

572

Plan the

_Deployment

ofa Cisco IOS Software EZVPN 572

Solution

_Components

573

Deployment

Tasks 573

Input

Parameters 574

Deployment

Guidelines 574

Configure

and

_Verify

aBasic Cisco IOS Software VTI-Based EZVPN

Server 575

Group

Pre-Shared

_Key

Authentication 575

ExtendedAuthentication

_(XAUTH)

Overview 575

Configuration Groups

and ISAKMP

_Profiles

576

Configuration

Tasks 576

Configuration

Scenario 576

XXX CCNPSecuritySECURE 642-637 Official Cert Guide

Task 2:

_Configure

anIPsec

Transform

Set and

Profile

577 Task3:

_Configure

a

Dynamic

VTI

Template

577

Task 4; CreateaClient

Configuration Group

578

Task 5: CreateanISAKMP

Profile

578

Tasks 6 and 7:

_Configure

and EnableUserAuthentication 579 Cisco

_{Configuration Professional Support}

579

Implementation

Guidelines 580

Configure

theCiscoVPNClient 580

Configuration

Tasks 580

Configuration

Scenario 580

Task1:Install theCisco VPNClient

_Software

580

Task2:

_Configure

the VPN Client Connection

_Entry

580 Task3:Establish theEZVPN Connection 581

Client-Side

_Verification

581

Gateway-Side Verification

581

Configure

and

_Verify

VTI-Based EZVPN Remote Client

_{Functionality}

onthe Cisco ISR 582

EZVPN Remote Modes 582

Configuration

Tasks 583

Configuration

Scenario 583

Task1:

_Configure

EZVPN Remote

_Profile

583 Task2;

_Designate

EZVPN

_Interface

Roles 584

Implementation

Guidelines 584

Configure

and

_Verify

EZVPN Server and VPN ClientPKIFeatures 585

Head-EndPKI

_{Configuration}

585

VPNClient

_{Configuration:}

SCEP Enrollment 585 VPNClientEnrollment

_Verification

586

VPNClient

_{Configuration:}

_Profile

586

TroubleshootBasic EZVPN

_Operation

587

Troubleshooting

Flow: VPNSession Establishment 587

Troubleshooting

Flow. VPNDataFlow 587

Exam

_Preparation

588

Chapter

22 FinalPreparation 591

Tools for Final

_Preparation

591

Pearson Cert Practice_{Test Engine and Questions}ontheCD 591

Install the

_Software

_from

the CD 592

xxxi

Activating

Other Exams 593 Premium Edition 593

Cisco

_Learning

Network 593

MemoryTables 593

Chapter-Ending

Review Tools 594

Suggested

Plan for Final

_Review/Study

594

Step1: Review the Key

Topics,

the DIKTAQuestions,and theFill inthe

Blanks Questions 595

Step2:

Complete

theMemoryTables 595

Step

3: Do Hands-OnPractice 595

Step

4:Build

Configuration

Checklists 596

Step

5: Use theExamEngine 596

Appendix

A Answers toChapterDIKTAQuizzesand Fill in the Blanks Questions 599

Appendix

B CCNP

_Security

642-637 SECUREExam

_Updates,

Version 1.0 621 Index 622

ElementsAvailableonCD AppendixC _MemoryTables

AppendixD

_Memory

Table Answers