Table Of Content

1526fmfw95.book Page i Wednesday, March 22, 2006 1:07 PM CCSP SNPA Official Exam Certification Guide Third Edition Michael Gibbs Greg Bastien Earl Carter Christian Abera Degu Cisco Press Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA 1526fmfw95.book Page ii Wednesday, March 22, 2006 1:07 PM ii CCSP SNPA Official Exam Certification Guide, Third Edition Michael Gibbs Greg Bastien Earl Carter Christian Abera Degu Copyright © 2006 Cisco Systems, Inc. Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 First Printing: April 2006 Library of Congress Cataloging-in-Publication Number: 2006922897 ISBN: 1-58720-152-6 Warning and Disclaimer This book is designed to provide information about the Securing Networks with PIX and ASA (SNPA) 642-522 exam toward the Cisco Certified Security Professional (CCSP) certification. Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc., shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it. The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc. Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of people from the professional technical community. Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through e-mail at feedback@cisco- press.com. Please include the book title and ISBN in your message. We greatly appreciate your assistance. Corporate and Government Sales Cisco Press offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales. For more information please contact: U.S. Corporate and Government Sales 1-800-382-3419 [email protected] For sales outside the U.S. please contact: International Sales [email protected] 1526fmfw95.book Page iii Wednesday, March 22, 2006 1:07 PM iii Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Publisher: John Wait Cisco Representative: Anthony Wolfenden Editor-in-Chief: John Kane Cisco Press Program Manager: Jeff Brady Executive Editor: Brett Bartow Production Manager: Patrick Kanouse Senior Development Editor: Christopher Cleveland Senior Project Editor: San Dee Phillips Copy Editor: Carlisle Communications Technical Editors: David Chapman Jr., Kevin Hofstra, and Bill Thomas Editorial Assistant: Raina Han Book and Cover Designer: Louisa Adair Composition: Mark Shirar Indexer: Eric Schroeder 1526fmfw95.book Page iv Wednesday, March 22, 2006 1:07 PM iv About the Authors Michael Gibbs is the vice president of Consulting for Security Evolutions, Inc. (SEI), where he is responsible for the overall technical management of SEI’s Cisco-centric IT security consulting services. Mr. Gibbs has more than 10 years of hands-on experience with Cisco Systems routers, switches, firewalls, IDSs, and other CPE equipment and IOS Software versions. He has been involved in IP network design, IP network engineering, and IT security engineering for large service provider backbone networks and broadband infrastructures. Mr. Gibbs is proficient in designing, implementing, and operating backbone IP and VoIP networks, implementing network operation centers, and designing and configuring server farms. Mr. Gibbs is also the author of multiple patents on IP data exchanges and QoS systems. As SEI’s technical leader for Cisco-centric IP network engineering and IT security consulting services, Mr. Gibbs provided technical program management, as well as technical support, for clients who utilize Cisco Systems CPE devices at the network ingress/egress. His hands-on, real-world experience designing and implementing Cisco-centric security countermeasures provided valuable experience in the authoring of this book. Greg Bastien, CCNP, CCSP, CISSP, is the chief technical officer for Virtue Technologies, Inc. He provides consulting services to various federal agencies and commercial clients and holds a position as adjunct professor at Strayer University, teaching networking and network security classes. He completed his undergraduate and graduate degrees at Embry-Riddle Aeronautical University while on active duty as a helicopter flight instructor in the U.S. Army. Earl Carter has been working in the field of computer security for approximately 11 years. He started learning about computer security while working at the Air Force Information Warfare Center. Earl's primary responsibility was securing Air Force networks against cyber attacks. In 1998, he accepted a job with Cisco to perform IDS research for NetRanger (currently Cisco IPS) and NetSonar (Cisco Secure Scanner). Currently, he is a member of the Security Technologies Assessment Team (STAT) that is part of Consulting Engineering (CE). His duties involve performing security evaluations on numerous Cisco products and consulting with other teams within Cisco to help enhance the security of Cisco products. He has examined various products from the PIX Firewall to the Cisco CallManager. Presently, Earl is working on earning his CCIE certification with a security emphasis. In his spare time, Earl is very active at church as a youth minister and lector. He also enjoys training in Taekwondo where he is currently a third-degree black belt and working on becoming a certified American Taekowndo Association (ATA) instructor. Christian Abera Degu, CCNP, CCSP, CISSP, works as a senior network engineer for General Dynamics Network Systems Signal solutions, as consultant to the U.S. Federal Energy Regulatory commission. He holds a master's degree in computer information systems. Christian resides in Alexandria, Virginia. v About the Technical Reviewers David W. Chapman Jr. CISSP-ISSAP, CCNP, CCDP, CSSP, is president and principal consultant for SecureNet Consulting, LLC, an information security consulting firm in Fort Worth, Texas, specializing in vulnerability assessments, penetration testing, and the design and implementation of secure network infrastructures. Mr. Chapman divides his time between teaching Cisco security courses and writing about network security issues. He is a senior member of the IEEE. Kevin Hofstra, CCIE No. 14619, CCNP, CCDP, CCSP, CCVP, is a network optimization engineer within the Air Force Communications Agency of the U.S. Department of Defense. Mr. Hofstra has a computer science degree from Yale University and a master’s of engineering in telecommunications from the University of Colorado. Bill Thomas, CISSP, CCIE, CCSP, is a consulting engineer for Cisco Systems, within the Advanced Technology organization. Mr. Thomas currently focuses on design and implementation of security solutions for large, corporate customers of Cisco. He is a frequent public speaker in forums such as ISC2 and ISSA. 1526fmfw95.book Page vi Wednesday, March 22, 2006 1:07 PM vi Dedication This book is dedicated to Mustang Sallie. 1526fmfw95.book Page vii Wednesday, March 22, 2006 1:07 PM vii Acknowledgments I’d like thank David Kim and the SEI team for the opportunity to write this book. Thanks to David Chapman, Kevin Hofstra, and Bill Thomas for keeping me straight when it came to deciphering the labyrinth of technical specifics. A big thank you goes out to the production team for this book. Brett Bartow, Christopher Cleveland, and San Dee Phillips have been a pleasure to work with and incredibly professional. I couldn’t have asked for a finer team. Finally, I would like to thank my wife for putting up with me throughout the creation of this book. No woman is more understanding. 1526fmfw95.book Page ix Wednesday, March 22, 2006 1:07 PM ix Contents at a Glance Foreword xxv Introduction xxvi Chapter 1 Network Security 3 Chapter 2 Firewall Technologies and the Cisco Security Appliance 23 Chapter 3 Cisco Security Appliance 37 Chapter 4 System Management/Maintenance 75 Chapter 5 Understanding Cisco Security Appliance Translation and Connection 109 Chapter 6 Getting Started with the Cisco Security Appliance Family of Firewalls 137 Chapter 7 Configuring Access 177 Chapter 8 Modular Policy Framework 199 Chapter 9 Security Contexts 223 Chapter 10 Syslog and the Cisco Security Appliance 247 Chapter 11 Routing and the Cisco Security Appliance 269 Chapter 12 Cisco Security Appliance Failover 303 Chapter 13 Virtual Private Networks 327 Chapter 14 Configuring Access VPNs 395 Chapter 15 Adaptive Security Device Manager 453 Chapter 16 Content Filtering on the Cisco Security Appliance 497 Chapter 17 Overview of AAA and the Cisco Security Appliance 513 Chapter 18 Configuration of AAA on the Cisco Security Appliance 537 Chapter 19 IPS and Advanced Protocol Handling 587 Chapter 20 Case Study and Sample Configuration 623 Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Sections 669 Index 712 1526fmfw95.book Page x Wednesday, March 22, 2006 1:07 PM x Contents Foreword xxv Introduction xxvi Chapter 1 Network Security 3 How to Best Use This Chapter 3 “Do I Know This Already?” Quiz 3 Foundation and Supplemental Topics 7 Overview of Network Security 7 Vulnerabilities, Threats, and Attacks 8 Vulnerabilities 8 Threats 8 Types of Attacks 8 Reconnaissance Attacks 9 Access Attacks 10 DoS Attacks 11 Security Policies 11 Step 1: Secure 12 Step 2: Monitor 13 Step 3: Test 13 Step 4: Improve 13 Network Security as a “Legal Issue” 13 Defense in Depth 14 Cisco AVVID and Cisco SAFE 14 Cisco AVVID? 14 Cisco SAFE 16 Foundation Summary 17 Network Security 17 Vulnerabilities, Threats, and Attacks 17 Vulnerabilities 17 Threats 17 Attacks 18 Security Policies 18 Network Security as a Process 19 Defense in Depth 19 Cisco AVVID 19 Cisco SAFE 20 Key Terms 20 Q&A 21 Chapter 2 Firewall Technologies and the Cisco Security Appliance 23 How to Best Use This Chapter 23 “Do I Know This Already?” Quiz 23 Foundation Topics 27