| Introduction |
|
xxvii | |
| Securing Cisco IOS Networks Assessment Test 1 |
|
lii | |
| Cisco Secure PIX Firewall Advanced Assessment Test 2 |
|
lxiii | |
| Cisco Secure Virtual Private Networks Assessment Test 3 |
|
lxviii | |
| Cisco Secure Intrusion Detection Systems Assessment Test 4 |
|
lxxi | |
| Cisco Safe Implementation Assessment Test 5 |
|
lxxvii | |
|
Part I Securing Cisco IOS Networks (SECUR) |
|
|
1 | (218) |
|
Introduction to Network Security |
|
|
3 | (20) |
|
Types of Network Security Threats |
|
|
5 | (1) |
|
Types of Security Weaknesses |
|
|
6 | (4) |
|
|
|
6 | (1) |
|
|
|
7 | (2) |
|
|
|
9 | (1) |
|
|
|
10 | (9) |
|
|
|
12 | (2) |
|
Denial-of-Service Attacks |
|
|
14 | (1) |
|
|
|
15 | (1) |
|
|
|
16 | (1) |
|
Masquerade Attack (IP Spoofing) |
|
|
16 | (1) |
|
Session Hijacking or Replaying |
|
|
16 | (1) |
|
|
|
17 | (1) |
|
|
|
17 | (1) |
|
|
|
17 | (1) |
|
|
|
18 | (1) |
|
Man-in-the-Middle Attacks |
|
|
18 | (1) |
|
Application-Layer Attacks |
|
|
18 | (1) |
|
Trojan Horse Programs, Viruses, and Worms |
|
|
19 | (1) |
|
|
|
19 | (1) |
|
The Corporate Security Policy |
|
|
19 | (1) |
|
|
|
20 | (1) |
|
|
|
21 | (2) |
|
Introduction to AAA Security |
|
|
23 | (28) |
|
Understanding Network Access Server and Cisco AAA |
|
|
24 | (2) |
|
|
|
26 | (9) |
|
|
|
28 | (1) |
|
Security Server Authentication |
|
|
28 | (2) |
|
PAP and CHAP Authentication |
|
|
30 | (2) |
|
|
|
32 | (3) |
|
Configuring the NAS for AAA |
|
|
35 | (14) |
|
Securing Access to the Exec Mode |
|
|
35 | (3) |
|
Enabling AAA Locally on the NAS |
|
|
38 | (1) |
|
Configuring Authentication on the NAS |
|
|
39 | (2) |
|
Configuring Authorization on the NAS |
|
|
41 | (3) |
|
Configuring Accounting on the NAS |
|
|
44 | (2) |
|
Verifying the NAS Configuration |
|
|
46 | (1) |
|
Troubleshooting AAA on the Cisco NAS |
|
|
47 | (2) |
|
|
|
49 | (1) |
|
|
|
50 | (1) |
|
Configuring Cisco Secure ACS and TACACS+ |
|
|
51 | (32) |
|
Introduction to the Cisco Secure ACS |
|
|
52 | (5) |
|
Using User Databases for Authentication |
|
|
54 | (1) |
|
Populating the User Database |
|
|
55 | (1) |
|
|
|
56 | (1) |
|
Installing Cisco Secure ACS 3.0 |
|
|
57 | (7) |
|
Administering Cisco Secure ACS |
|
|
64 | (7) |
|
|
|
71 | (1) |
|
|
|
72 | (2) |
|
|
|
74 | (4) |
|
Cisco Secure User Database NAS Configuration for Radius |
|
|
74 | (4) |
|
|
|
78 | (3) |
|
|
|
81 | (1) |
|
|
|
81 | (2) |
|
Cisco Perimeter Router Problems and Solutions |
|
|
83 | (18) |
|
Solving Eavesdropping and Session Replay Problems |
|
|
85 | (1) |
|
Deferding Against Unauthorized Access, Data Manipulation, and Malicious Destruction |
|
|
86 | (2) |
|
Solving Lack of Legal IP Addresses Problems |
|
|
88 | (1) |
|
Fighting Rerouting Attacks |
|
|
88 | (2) |
|
Fighting Denial-of-Service Attacks |
|
|
90 | (2) |
|
Turning Off and Configuring Network Services |
|
|
92 | (7) |
|
|
|
92 | (1) |
|
|
|
92 | (1) |
|
Turning Off BOOTP and Auto-Config |
|
|
93 | (1) |
|
Disabling the HTTP Interface |
|
|
93 | (1) |
|
Disabling IP Source Routing |
|
|
94 | (1) |
|
|
|
94 | (1) |
|
Disabling Redirect Messages |
|
|
94 | (1) |
|
Disabling the Generation of ICMP Unreachable Messages |
|
|
94 | (1) |
|
Disabling Multicast Route Caching |
|
|
95 | (1) |
|
Disabling the Maintenance Operation Protocol |
|
|
95 | (1) |
|
Turning Off the X.25 PAD Service |
|
|
95 | (1) |
|
Enabling the Nagle TCP Congestion Algorithm |
|
|
95 | (1) |
|
|
|
96 | (1) |
|
Disabling Cisco Discovery Protocol |
|
|
96 | (1) |
|
|
|
96 | (1) |
|
Configuring Exec Timeout Values |
|
|
97 | (1) |
|
Disabling the Default Forwarded UDP Protocols |
|
|
97 | (2) |
|
|
|
99 | (1) |
|
|
|
99 | (2) |
|
Context-Based Access Control Configuration |
|
|
101 | (20) |
|
Understanding the Cisco IOS Firewall |
|
|
102 | (1) |
|
Authentication Proxy and IDS |
|
|
103 | (1) |
|
Context-Based Access Control |
|
|
103 | (4) |
|
|
|
103 | (3) |
|
|
|
106 | (1) |
|
Introduction to CBAC Configuration |
|
|
107 | (12) |
|
Using Audit Trails and Alerts |
|
|
108 | (1) |
|
Configuring Global Timeouts and Thresholds |
|
|
108 | (2) |
|
|
|
110 | (4) |
|
Defining Inspection Rules |
|
|
114 | (2) |
|
Applying Inspection Rules and ACLs to Router Interfaces |
|
|
116 | (1) |
|
Configuring IP ACLs at the Interface |
|
|
117 | (1) |
|
Testing and Verifying CBAC |
|
|
117 | (2) |
|
|
|
119 | (1) |
|
|
|
120 | (1) |
|
Cisco IOS Firewall Authentication and Intrusion Detection |
|
|
121 | (28) |
|
Introduction to the Cisco IOS Firewall Authentication Proxy |
|
|
123 | (12) |
|
Configuring the AAA Server |
|
|
125 | (3) |
|
|
|
128 | (4) |
|
Configuring the Authentication Proxy |
|
|
132 | (1) |
|
Testing and Verifying Your Configuration |
|
|
133 | (2) |
|
Introduction to the Cisco IOS Firewall IDS |
|
|
135 | (4) |
|
Initializing the Cisco IOS Firewall IDS |
|
|
137 | (1) |
|
Configuring, Disabling, and Excluding Signatures |
|
|
137 | (2) |
|
Creating and Applying Audit Rules |
|
|
139 | (4) |
|
|
|
139 | (2) |
|
|
|
141 | (1) |
|
|
|
142 | (1) |
|
Verifying the Configuration |
|
|
143 | (2) |
|
Stopping the IOS Firewall IDS |
|
|
145 | (1) |
|
|
|
146 | (1) |
|
|
|
147 | (2) |
|
Understanding Cisco IOS IPSec Support |
|
|
149 | (18) |
|
What Is a Virtual Private Network? |
|
|
150 | (1) |
|
Introduction to Cisco IOS IPSec |
|
|
151 | (6) |
|
|
|
152 | (2) |
|
|
|
154 | (3) |
|
|
|
157 | (8) |
|
|
|
157 | (2) |
|
Internet Key Exchange (IKE) |
|
|
159 | (6) |
|
|
|
165 | (1) |
|
|
|
165 | (2) |
|
Cisco IOS IPSec Pre-shared Keys and Certificate Authority Support |
|
|
167 | (42) |
|
Configuring Cisco IOS IPSec for Pre-shared Keys Site-to-Site |
|
|
168 | (18) |
|
Preparing for IKE and IPSec |
|
|
169 | (1) |
|
|
|
169 | (6) |
|
|
|
175 | (9) |
|
Testing and Verifying IPSec |
|
|
184 | (2) |
|
Configuring IPSec Manually |
|
|
186 | (6) |
|
Configuring IPSec for RSA-Encrypted Nonces |
|
|
187 | (5) |
|
Configuring Cisco IOS IPSec Certificate Authority Support Site-to-Site |
|
|
192 | (14) |
|
Configuring CA Support Tasks |
|
|
193 | (1) |
|
Preparing for IKE and IPSec |
|
|
193 | (1) |
|
|
|
193 | (5) |
|
|
|
198 | (1) |
|
|
|
198 | (7) |
|
Testing and Verifying IPSec for CA |
|
|
205 | (1) |
|
|
|
206 | (1) |
|
|
|
206 | (3) |
|
Cisco IOS Remote Access Using Cisco Easy VPN |
|
|
209 | (10) |
|
Configuring IOS Remote Access Using Cisco Easy VPN |
|
|
210 | (3) |
|
Introduction to Cisco Easy VPN |
|
|
210 | (1) |
|
|
|
211 | (2) |
|
Introduction to the Cisco VPN Software Client |
|
|
213 | (4) |
|
Easy VPN Server Configuration Tasks |
|
|
215 | (1) |
|
Preconfiguring the Cisco VPN Software Client |
|
|
216 | (1) |
|
Router and Security Device Manager Overview |
|
|
216 | (1) |
|
|
|
217 | (1) |
|
|
|
218 | (1) |
|
Part II Cisco Secure PIX Firewall Advanced |
|
|
219 | (244) |
|
|
|
221 | (36) |
|
Understanding a Firewall's Role in Network Security |
|
|
222 | (2) |
|
|
|
222 | (2) |
|
What Are the Potential Threats? |
|
|
224 | (1) |
|
Reviewing Firewall Technologies |
|
|
224 | (6) |
|
|
|
225 | (1) |
|
Packet-Filtering Firewalls |
|
|
225 | (1) |
|
|
|
226 | (1) |
|
Firewall Technology Combinations |
|
|
227 | (3) |
|
Hardware and Software Components of the Cisco Secure PIX Firewall |
|
|
230 | (7) |
|
|
|
230 | (1) |
|
|
|
231 | (6) |
|
|
|
237 | (4) |
|
|
|
237 | (1) |
|
|
|
238 | (1) |
|
The Adaptive Security Algorithm and Security Levels |
|
|
239 | (2) |
|
Working with the Firewall Services Module |
|
|
241 | (5) |
|
Overview of Configuration |
|
|
241 | (1) |
|
Configuring an IOS Switch |
|
|
242 | (2) |
|
Configuring a CatOS Switch |
|
|
244 | (1) |
|
|
|
244 | (1) |
|
|
|
245 | (1) |
|
Using the PIX Firewall CLI |
|
|
246 | (9) |
|
|
|
246 | (1) |
|
|
|
247 | (1) |
|
|
|
248 | (1) |
|
|
|
249 | (6) |
|
|
|
255 | (1) |
|
|
|
256 | (1) |
|
PIX Firewall Configuration |
|
|
257 | (50) |
|
Preparing for Firewall Configuration |
|
|
258 | (1) |
|
Using Common Global Configuration Commands |
|
|
259 | (8) |
|
The Remote Access Commands |
|
|
259 | (2) |
|
|
|
261 | (1) |
|
|
|
262 | (1) |
|
The domain-name and hostname Commands |
|
|
263 | (1) |
|
|
|
264 | (1) |
|
|
|
264 | (2) |
|
|
|
266 | (1) |
|
Configuring PIX Firewall Interfaces |
|
|
267 | (6) |
|
Naming an Interface and Assigning a Security Level |
|
|
267 | (2) |
|
Setting Interface Properties and Shutting Down the Interface |
|
|
269 | (2) |
|
|
|
271 | (1) |
|
Setting the Maximum Transfer Unit |
|
|
272 | (1) |
|
|
|
273 | (25) |
|
Understanding Address Translation |
|
|
273 | (3) |
|
|
|
276 | (1) |
|
|
|
277 | (9) |
|
|
|
286 | (4) |
|
Configuring NAT on Multiple Interfaces |
|
|
290 | (8) |
|
|
|
298 | (8) |
|
Configuring Dynamic Routing |
|
|
299 | (2) |
|
Configuring Static Routing |
|
|
301 | (3) |
|
Configuring Multicast Routing |
|
|
304 | (2) |
|
|
|
306 | (1) |
|
|
|
306 | (1) |
|
ACLs, Filtering, Object Grouping, and AAA |
|
|
307 | (34) |
|
|
|
308 | (4) |
|
|
|
309 | (1) |
|
|
|
310 | (1) |
|
Converting Conduits to ACLs |
|
|
311 | (1) |
|
|
|
312 | (3) |
|
How Does URL Filtering Work? |
|
|
312 | (1) |
|
Configuring the PIX Firewall for URL Filtering |
|
|
313 | (2) |
|
PPPoE and the PIX Firewall |
|
|
315 | (4) |
|
Configuring the PPPoE Client Username and Password |
|
|
316 | (1) |
|
Enabling PPPoE on the PIX Firewall |
|
|
317 | (1) |
|
Verifying PPPoE Operation |
|
|
318 | (1) |
|
|
|
319 | (5) |
|
Configuring Object Groups |
|
|
320 | (3) |
|
|
|
323 | (1) |
|
Authentication, Authorization, and Accounting (AAA) Services |
|
|
324 | (14) |
|
Installing Cisco Secure ACS for Windows 2000/NT |
|
|
324 | (6) |
|
Implementing AAA on the PIX Firewall |
|
|
330 | (7) |
|
|
|
337 | (1) |
|
|
|
338 | (1) |
|
|
|
339 | (2) |
|
Advanced Protocol Handling, Attack Guards, and Intrusion Detection |
|
|
341 | (30) |
|
Advanced Protocol Handling |
|
|
342 | (11) |
|
Special Protocol Support Basics |
|
|
343 | (2) |
|
|
|
345 | (3) |
|
|
|
348 | (1) |
|
|
|
349 | (1) |
|
|
|
350 | (2) |
|
Alternative Solutions to Problem Protocols |
|
|
352 | (1) |
|
|
|
353 | (9) |
|
|
|
353 | (1) |
|
|
|
354 | (1) |
|
|
|
355 | (4) |
|
|
|
359 | (3) |
|
|
|
362 | (1) |
|
|
|
362 | (8) |
|
|
|
362 | (7) |
|
|
|
369 | (1) |
|
|
|
370 | (1) |
|
|
|
370 | (1) |
|
Firewall Failover and PDM |
|
|
371 | (34) |
|
|
|
372 | (5) |
|
|
|
372 | (4) |
|
Fault-Tolerant Strategies |
|
|
376 | (1) |
|
|
|
377 | (13) |
|
PIX Firewall Failover Features |
|
|
377 | (1) |
|
PIX Firewall Failover Requirements |
|
|
378 | (1) |
|
How PIX Firewall Failover Works |
|
|
378 | (7) |
|
|
|
385 | (1) |
|
Basic Failover Configuration |
|
|
386 | (4) |
|
Cisco PIX Device Manager (PDM) |
|
|
390 | (13) |
|
|
|
390 | (1) |
|
|
|
391 | (1) |
|
|
|
392 | (2) |
|
Using PDM to Configure the PIX Firewall |
|
|
394 | (9) |
|
|
|
403 | (1) |
|
|
|
403 | (2) |
|
VPNs and the PIX Firewall |
|
|
405 | (58) |
|
Preparing to Configure VPN support |
|
|
406 | (1) |
|
Configuring IKE on a Firewall |
|
|
407 | (8) |
|
|
|
407 | (1) |
|
Configuring the IKE Policy |
|
|
407 | (2) |
|
Configuring Pre-shared Keys |
|
|
409 | (1) |
|
Configuring the Use of Certificate Authorities (CAs) on a Firewall |
|
|
410 | (5) |
|
Configuring IPSec on a Firewall |
|
|
415 | (7) |
|
|
|
415 | (1) |
|
Creating and Configuring Transform Sets |
|
|
416 | (2) |
|
Setting the Tunnel Lifetime |
|
|
418 | (1) |
|
|
|
419 | (3) |
|
Verifying and Troubleshooting IPSec Configuration on a Firewall |
|
|
422 | (4) |
|
Viewing Configuration Information |
|
|
422 | (4) |
|
Understanding Error and Status Messages |
|
|
426 | (1) |
|
|
|
426 | (1) |
|
Understanding Remote Access VPN |
|
|
426 | (6) |
|
Extended Authentication (Xauth) |
|
|
426 | (1) |
|
IKE Mode Config for Dynamic Addressing |
|
|
427 | (1) |
|
Pushing Additional Attributes to the VPN Client |
|
|
428 | (1) |
|
|
|
429 | (3) |
|
Installing and Configuring the Cisco VPN Client |
|
|
432 | (7) |
|
|
|
433 | (6) |
|
|
|
439 | (12) |
|
Setting Up a Site-to-Site VPN |
|
|
441 | (5) |
|
Setting Up a Remote Access VPN |
|
|
446 | (5) |
|
Enterprise PIX Firewall Management and Maintenance |
|
|
451 | (9) |
|
Cisco Secure Policy Manager (CSPM) |
|
|
452 | (1) |
|
PIX Management Center (MC) |
|
|
453 | (3) |
|
|
|
456 | (4) |
|
|
|
460 | (1) |
|
|
|
460 | (3) |
|
Part III Cisco Secure Virtual Private Networks |
|
|
463 | (164) |
|
Introduction to Virtual Private Networks |
|
|
465 | (28) |
|
|
|
466 | (4) |
|
|
|
466 | (1) |
|
|
|
467 | (3) |
|
|
|
470 | (14) |
|
|
|
471 | (1) |
|
IPSec Building Blocks: AH and ESP |
|
|
471 | (5) |
|
|
|
476 | (1) |
|
|
|
476 | (1) |
|
Diffie-Hellman Key Exchange |
|
|
477 | (1) |
|
|
|
478 | (3) |
|
|
|
481 | (2) |
|
IPSec Security Associations |
|
|
483 | (1) |
|
|
|
484 | (6) |
|
Defining Interesting Traffic |
|
|
485 | (1) |
|
|
|
486 | (1) |
|
|
|
487 | (1) |
|
|
|
488 | (2) |
|
|
|
490 | (1) |
|
|
|
490 | (1) |
|
|
|
490 | (1) |
|
|
|
491 | (1) |
|
|
|
491 | (1) |
|
|
|
491 | (1) |
|
|
|
492 | (1) |
|
Introduction to Cisco VPN Devices |
|
|
493 | (40) |
|
Introducing the VPN 3000 Concentrators |
|
|
494 | (6) |
|
Overview of the VPN 3005 Concentrator |
|
|
495 | (2) |
|
Overview of VPN 3015 through 3080 Concentrators |
|
|
497 | (2) |
|
VPN Concentrator Client Support |
|
|
499 | (1) |
|
Introducing the 3002 VPN Hardware Client |
|
|
500 | (20) |
|
Configuring the 3002 CLI Quick Configuration Utility |
|
|
501 | (4) |
|
Configuring the Hardware Client with the Quick Configuration Utility |
|
|
505 | (8) |
|
Managing the Hardware Client |
|
|
513 | (1) |
|
Additional VPN 3002 Client Features |
|
|
514 | (6) |
|
Introducing the VPN Software Clients |
|
|
520 | (9) |
|
Configuring the Connection |
|
|
521 | (1) |
|
Setting Authentication Properties |
|
|
521 | (2) |
|
Setting Connection Properties |
|
|
523 | (1) |
|
|
|
523 | (3) |
|
Preconfiguring the VPN Client |
|
|
526 | (3) |
|
Overview of the Cisco VPN Software Client Auto-Initiation |
|
|
529 | (2) |
|
|
|
531 | (1) |
|
|
|
532 | (1) |
|
Configuring the VPN Concentrator |
|
|
533 | (64) |
|
Using the CLI for Initial Configuration |
|
|
536 | (7) |
|
|
|
536 | (7) |
|
Using Web Quick Configuration Mode |
|
|
543 | (6) |
|
Configuring Physical Interfaces |
|
|
545 | (1) |
|
Setting System Information |
|
|
545 | (1) |
|
Setting the Tunnel-Creation Method |
|
|
546 | (1) |
|
Setting the Address Assignment |
|
|
546 | (1) |
|
Configuring Authentication |
|
|
547 | (1) |
|
|
|
548 | (1) |
|
Changing the admin Password |
|
|
549 | (1) |
|
Configuring User and Policy Management |
|
|
549 | (25) |
|
|
|
550 | (1) |
|
|
|
550 | (9) |
|
|
|
559 | (1) |
|
Configuring an Authentication Server |
|
|
559 | (1) |
|
Configuring Access Hours and Filters |
|
|
560 | (3) |
|
Configuring Backup on the Hardware Client |
|
|
563 | (1) |
|
Configuring Load Balancing |
|
|
564 | (2) |
|
Configuring Lan-to-Lan IPSec |
|
|
566 | (2) |
|
Updating Clients Automatically |
|
|
568 | (3) |
|
Setting Up the Stateful Firewall |
|
|
571 | (3) |
|
Configuring the Use of IPSec Digital Certificates |
|
|
574 | (12) |
|
Introducing the Public Key Infrastructure |
|
|
574 | (1) |
|
Requesting and Installing Concentrator Certificates |
|
|
575 | (8) |
|
Requesting and Installing Client Certificates |
|
|
583 | (3) |
|
Firewall Feature Set for the IPSec Software Client |
|
|
586 | (5) |
|
Software Client's Are You There Feature |
|
|
587 | (1) |
|
Software Client's Stateful Firewall Feature |
|
|
587 | (1) |
|
Software Client's Central Policy Protection Feature |
|
|
587 | (1) |
|
Client Firewall Statistics |
|
|
588 | (2) |
|
Customizing Firewall Policy |
|
|
590 | (1) |
|
Configuring the VPN 3000 Concentrator for IPSec over UDP and IPSec over TCP |
|
|
591 | (4) |
|
Overview of Port Address Translation |
|
|
592 | (1) |
|
Configuring IPSec over UDP |
|
|
592 | (2) |
|
Configuring NAT-Transversal |
|
|
594 | (1) |
|
Configuring IPSec over TCP |
|
|
594 | (1) |
|
|
|
595 | (1) |
|
|
|
595 | (2) |
|
Managing the VPN Concentrator |
|
|
597 | (30) |
|
Monitoring the VPN Concentrator |
|
|
598 | (18) |
|
Viewing Concentrator Monitoring Information |
|
|
599 | (10) |
|
Configuring Logging and SNMP Traps |
|
|
609 | (7) |
|
Administering the VPN Concentrator |
|
|
616 | (8) |
|
Configuring Access Rights |
|
|
616 | (4) |
|
|
|
620 | (1) |
|
Administering File Management |
|
|
620 | (3) |
|
|
|
623 | (1) |
|
|
|
624 | (1) |
|
|
|
624 | (1) |
|
|
|
625 | (2) |
|
Part IV Cisco Secure Intrusion Detection Systems |
|
|
627 | (438) |
|
Introduction to Intrusion Detection and Protection |
|
|
629 | (54) |
|
Understanding Security Threats |
|
|
630 | (16) |
|
|
|
631 | (1) |
|
|
|
632 | (14) |
|
Implementing Network Security |
|
|
646 | (12) |
|
|
|
646 | (9) |
|
Monitoring Network Security |
|
|
655 | (1) |
|
|
|
656 | (1) |
|
Improving Network Security |
|
|
657 | (1) |
|
Understanding Intrusion Detection Basics |
|
|
658 | (7) |
|
|
|
658 | (3) |
|
|
|
661 | (3) |
|
|
|
664 | (1) |
|
Cisco Secure Intrusion Protection |
|
|
665 | (2) |
|
Introduction to Cisco Secure IDS |
|
|
667 | (14) |
|
Cisco Secure IDS Features |
|
|
668 | (4) |
|
Cisco Secure Sensor Platforms |
|
|
672 | (4) |
|
Cisco Secure IDS Management Platforms |
|
|
676 | (2) |
|
|
|
678 | (3) |
|
|
|
681 | (1) |
|
|
|
682 | (1) |
|
Installing Cisco Secure IDS Sensors and IDSMs |
|
|
683 | (52) |
|
Deploying Cisco Secure IDS |
|
|
684 | (9) |
|
Sensor Selection Considerations |
|
|
684 | (4) |
|
Sensor Deployment Considerations |
|
|
688 | (5) |
|
Installing and Configuring Cisco Secure IDS Sensors |
|
|
693 | (39) |
|
Planning the Installation |
|
|
694 | (1) |
|
Physically Installing the Sensor |
|
|
695 | (9) |
|
Gaining Initial Management Access |
|
|
704 | (4) |
|
|
|
708 | (2) |
|
Configuring the Sensor for the First Time |
|
|
710 | (14) |
|
|
|
724 | (4) |
|
Cisco Secure IDS Architecture |
|
|
728 | (4) |
|
|
|
732 | (1) |
|
|
|
733 | (2) |
|
Configuring the Network to Support Cisco Secure IDS Sensors |
|
|
735 | (48) |
|
|
|
736 | (1) |
|
Configuring Traffic Capture for the 4200 Series Sensors |
|
|
737 | (24) |
|
Configuring Traffic Capture Using Span |
|
|
743 | (7) |
|
Configuring Traffic Capture Using RSPAN |
|
|
750 | (11) |
|
Configuring Traffic Capture for the IDSM |
|
|
761 | (18) |
|
Configuring Span for the IDSM-2 |
|
|
765 | (2) |
|
Configuring Traffic Capture Using VACLs |
|
|
767 | (7) |
|
Configuring Traffic Capture using the mls ip ids Command |
|
|
774 | (2) |
|
Configuring the Sensing Interface to Control Trunk Traffic |
|
|
776 | (1) |
|
Restricting VLANs on CatOS |
|
|
777 | (1) |
|
Restricting VLANs on Cisco IOS |
|
|
778 | (1) |
|
Assigning the Command-and-Control Port VLAN |
|
|
778 | (1) |
|
Configuring the Command-and-Control VLAN on CatOS |
|
|
779 | (1) |
|
Configuring the Command-and-Control VLAN on Cisco IOS |
|
|
779 | (1) |
|
Configuring Traffic Capture for the NM-CIDS |
|
|
779 | (2) |
|
|
|
781 | (1) |
|
|
|
781 | (2) |
|
Configuring Cisco Secure IDS Sensors Using the IDS Device Manager |
|
|
783 | (82) |
|
IDS Device Manager Introduction |
|
|
784 | (6) |
|
IDM Components and System Requirements |
|
|
784 | (1) |
|
Accessing the IDM for the First Time |
|
|
785 | (3) |
|
|
|
788 | (2) |
|
Configuring Cisco Secure IDS Sensors Using the IDM |
|
|
790 | (50) |
|
Performing Sensor Setup Using the IDM |
|
|
790 | (6) |
|
Configuring Intrusion Detection Using the IDM |
|
|
796 | (17) |
|
Configuring Blocking Using the IDM |
|
|
813 | (24) |
|
Configuring Auto Update Using the IDM |
|
|
837 | (3) |
|
Administering and Monitoring Cisco Secure IDS Sensors Using the IDM |
|
|
840 | (21) |
|
|
|
841 | (13) |
|
|
|
854 | (7) |
|
|
|
861 | (1) |
|
|
|
862 | (3) |
|
Configuring Signatures and Using the IDS Event Viewer |
|
|
865 | (76) |
|
Cisco Secure IDS Signatures |
|
|
866 | (18) |
|
Cisco Secure IDS Signature Engines |
|
|
868 | (5) |
|
Signature Engine Parameters |
|
|
873 | (11) |
|
Configuring Cisco Secure IDS Signatures |
|
|
884 | (14) |
|
Configuring Signatures Using the IDM |
|
|
884 | (9) |
|
Configuring Signatures Using the CLI |
|
|
893 | (5) |
|
Introduction to the IDS Event Viewer |
|
|
898 | (5) |
|
|
|
900 | (1) |
|
Accessing the IEV for the First Time |
|
|
901 | (2) |
|
|
|
903 | (35) |
|
Adding Sensors to the IEV |
|
|
903 | (4) |
|
Configuring Filters and Views |
|
|
907 | (7) |
|
|
|
914 | (7) |
|
Configuring Application Settings and Preferences |
|
|
921 | (3) |
|
Administering the IEV Database |
|
|
924 | (14) |
|
|
|
938 | (1) |
|
|
|
939 | (2) |
|
Enterprise Cisco Secure IDS Management |
|
|
941 | (76) |
|
Introduction to CiscoWorks VMS |
|
|
942 | (6) |
|
CiscoWorks VMS Components |
|
|
942 | (2) |
|
CiscoWorks VMS System Requirements |
|
|
944 | (4) |
|
Installing CiscoWorks VMS |
|
|
948 | (14) |
|
Installing CiscoWorks Common Services |
|
|
948 | (4) |
|
Installing the IDS Management Center and Security Monitoring Center |
|
|
952 | (4) |
|
Starting the CiscoWorks Desktop |
|
|
956 | (3) |
|
|
|
959 | (1) |
|
Licensing CiscoWorks VMS Components |
|
|
960 | (2) |
|
Configuring IDS Sensors Using the IDS MC |
|
|
962 | (44) |
|
IDS Management Center Architecture |
|
|
963 | (1) |
|
Starting the IDS Management Center |
|
|
964 | (2) |
|
Configuring Sensor Groups |
|
|
966 | (2) |
|
Adding Sensors to the IDS MC |
|
|
968 | (3) |
|
Configuring Sensors Using the IDS MC |
|
|
971 | (25) |
|
Saving, Generating, Approving, and Deploying Sensor Configurations |
|
|
996 | (7) |
|
Updating Cisco Secure IDS Sensors |
|
|
1003 | (3) |
|
|
|
1006 | (8) |
|
Configuring System Configuration Settings |
|
|
1006 | (1) |
|
Configuring Database Rules |
|
|
1007 | (4) |
|
Configuring Report Settings |
|
|
1011 | (3) |
|
|
|
1014 | (1) |
|
|
|
1014 | (3) |
|
Enterprise Cisco Secure IDS Monitoring |
|
|
1017 | (48) |
|
Introduction to the Security Monitor |
|
|
1018 | (5) |
|
Security Monitor Features |
|
|
1018 | (1) |
|
Supported Devices for the Security Monitor |
|
|
1019 | (1) |
|
Accessing the Security Monitor for the First Time |
|
|
1020 | (3) |
|
Configuring the Security Monitor |
|
|
1023 | (7) |
|
Configuring Sensors to Support the Security Monitor |
|
|
1023 | (1) |
|
Defining Devices to Monitor |
|
|
1023 | (6) |
|
Verifying Sensor Connection Status |
|
|
1029 | (1) |
|
|
|
1030 | (22) |
|
|
|
1030 | (15) |
|
Defining Notifications Using Event Rules |
|
|
1045 | (7) |
|
Administering the Security Monitoring Center |
|
|
1052 | (9) |
|
Configuring System Configuration Settings |
|
|
1053 | (3) |
|
Configuring Database Rules |
|
|
1056 | (1) |
|
|
|
1057 | (4) |
|
|
|
1061 | (1) |
|
|
|
1062 | (3) |
|
Part V Cisco SAFE Implementation |
|
|
1065 | (96) |
|
|
|
1067 | (26) |
|
Identifying the Need for Network Security |
|
|
1068 | (3) |
|
|
|
1071 | (8) |
|
Application Layer Attacks |
|
|
1072 | (1) |
|
Denial of Service (DOS) or Distributed Denial of Service (DDOS) |
|
|
1072 | (1) |
|
|
|
1073 | (1) |
|
Man-in-the-Middle Attacks |
|
|
1074 | (1) |
|
|
|
1074 | (1) |
|
|
|
1075 | (1) |
|
|
|
1076 | (1) |
|
|
|
1077 | (1) |
|
|
|
1077 | (1) |
|
|
|
1077 | (1) |
|
|
|
1078 | (1) |
|
|
|
1078 | (1) |
|
Network Security Policies |
|
|
1079 | (1) |
|
Management Protocols and Functions |
|
|
1079 | (3) |
|
|
|
1080 | (1) |
|
|
|
1080 | (1) |
|
|
|
1081 | (1) |
|
|
|
1081 | (1) |
|
|
|
1081 | (1) |
|
SAFE Architectural Overview |
|
|
1082 | (3) |
|
SAFE SMR Design Fundamentals |
|
|
1084 | (1) |
|
|
|
1084 | (1) |
|
|
|
1085 | (4) |
|
|
|
1086 | (1) |
|
|
|
1087 | (1) |
|
|
|
1087 | (1) |
|
|
|
1088 | (1) |
|
|
|
1088 | (1) |
|
Intrusion Detection Systems Mitigate Attacks |
|
|
1088 | (1) |
|
Secure Management and Reporting Mitigate Attacks |
|
|
1089 | (1) |
|
Identifying the Security Wheel |
|
|
1089 | (2) |
|
|
|
1091 | (1) |
|
|
|
1091 | (2) |
|
The Cisco Security Portfolio |
|
|
1093 | (18) |
|
Cisco Security Portfolio Overview |
|
|
1094 | (1) |
|
Secure Connectivity: Virtual Private Network Solutions |
|
|
1095 | (7) |
|
Site-to-Site VPN Solution |
|
|
1097 | (2) |
|
Remote Access VPN Solution |
|
|
1099 | (2) |
|
Firewall-Based VPN Solution and Perimeter Security |
|
|
1101 | (1) |
|
Understanding Intrusion Protection |
|
|
1102 | (2) |
|
|
|
1103 | (1) |
|
|
|
1104 | (1) |
|
|
|
1105 | (2) |
|
Cisco Secure Access Control Server (ACS) |
|
|
1106 | (1) |
|
Understanding Security Management |
|
|
1107 | (1) |
|
|
|
1107 | (2) |
|
|
|
1109 | (1) |
|
|
|
1109 | (2) |
|
SAFE Small and Medium Network Designs |
|
|
1111 | (30) |
|
Small Network Design Overview |
|
|
1112 | (5) |
|
Corporate Internet Module |
|
|
1112 | (3) |
|
|
|
1115 | (2) |
|
Medium Network Design Overview |
|
|
1117 | (6) |
|
Corporate Internet Module |
|
|
1118 | (2) |
|
|
|
1120 | (2) |
|
|
|
1122 | (1) |
|
Implementation of Key Devices |
|
|
1123 | (15) |
|
|
|
1123 | (1) |
|
Implementing the ISP Router |
|
|
1123 | (4) |
|
Implementing the IOS-based Firewall |
|
|
1127 | (7) |
|
Implementing the PIX Firewall |
|
|
1134 | (4) |
|
|
|
1138 | (1) |
|
|
|
1138 | (3) |
|
SAFE Remote Access Network Design |
|
|
1141 | (20) |
|
Remote Access Network Design Overview |
|
|
1142 | (2) |
|
|
|
1143 | (1) |
|
Implementing the Remote Access Devices |
|
|
1144 | (15) |
|
|
|
1144 | (5) |
|
Remote Site Firewall Option |
|
|
1149 | (2) |
|
VPN Hardware Client Option |
|
|
1151 | (5) |
|
Remote Site Router Option |
|
|
1156 | (3) |
|
|
|
1159 | (1) |
|
|
|
1159 | (2) |
| Index |
|
1161 | |
Other versions by this Author
