Introduction |
|
xxv | |
|
Part I General Deployment |
|
|
|
Chapter 1 Introduction to Cisco Secure Firewall and IPS |
|
|
2 | (22) |
|
"Do I Know This Already?" Quiz |
|
|
3 | (1) |
|
|
4 | (1) |
|
Evolution of Next-Generation Firewall |
|
|
4 | (4) |
|
Cisco Secure Firewall Solutions |
|
|
8 | (3) |
|
Product Evolution and Lifecycle |
|
|
11 | (3) |
|
Software and Hardware Architecture |
|
|
14 | (4) |
|
Scalability and Resiliency |
|
|
18 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
Resiliency in Connectivity |
|
|
21 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
Complete Tables and Lists from Memory |
|
|
23 | (1) |
|
|
23 | (1) |
|
Chapter 2 Deployment of Secure Firewall Virtual |
|
|
24 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
24 | (2) |
|
|
26 | (1) |
|
Cisco Secure Firewall on a Virtual Platform |
|
|
26 | (1) |
|
Hosting Environment Settings |
|
|
27 | (1) |
|
Virtual Resource Allocation |
|
|
28 | (1) |
|
Software Package Selection |
|
|
28 | (2) |
|
|
30 | (1) |
|
|
31 | (1) |
|
Virtual Network for Management Traffic |
|
|
32 | (1) |
|
Virtual Network for Data Traffic |
|
|
33 | (2) |
|
Virtual Machine Creation for Secure Firewall |
|
|
35 | (6) |
|
System Initialization and Validation |
|
|
41 | (4) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
Complete Tables and Lists from Memory |
|
|
46 | (1) |
|
|
46 | (2) |
|
Chapter 3 Licensing and Registration |
|
|
48 | (22) |
|
|
48 | (2) |
|
|
50 | (1) |
|
Cisco Licensing Architecture |
|
|
50 | (2) |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
53 | (1) |
|
Cisco Secure Firewall Licenses |
|
|
54 | (1) |
|
|
54 | (1) |
|
Export-Controlled License |
|
|
55 | (1) |
|
|
56 | (3) |
|
|
59 | (2) |
|
|
61 | (1) |
|
Best Practices for Registration |
|
|
61 | (1) |
|
Configurations on Threat Defense |
|
|
62 | (1) |
|
Configurations on Management Center |
|
|
63 | (2) |
|
Management Communication over the Internet |
|
|
65 | (2) |
|
Validation of Registration |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
69 | (1) |
|
|
69 | (1) |
|
Complete Tables and Lists from Memory |
|
|
69 | (1) |
|
|
69 | (1) |
|
Chapter 4 Firewall Deployment in Routed Mode |
|
|
70 | (20) |
|
"Do I Know This Already?" Quiz |
|
|
70 | (2) |
|
|
72 | (1) |
|
|
72 | (1) |
|
Best Practices for Routed Mode Configuration |
|
|
73 | (1) |
|
|
73 | (2) |
|
Enabling the Routed Firewall Mode |
|
|
75 | (1) |
|
Configuration of the Routed Interface |
|
|
75 | (1) |
|
Configuring Interfaces with Static IP Addresses |
|
|
76 | (4) |
|
Configuring Interfaces with Automatic IP Addresses |
|
|
80 | (2) |
|
Validation of Interface Configuration |
|
|
82 | (6) |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
89 | (1) |
|
Complete Tables and Lists from Memory |
|
|
89 | (1) |
|
|
89 | (1) |
|
Chapter 5 Firewall Deployment in Transparent Mode |
|
|
90 | (30) |
|
"Do I Know This Already?" Quiz |
|
|
90 | (2) |
|
|
92 | (1) |
|
Transparent Mode Essentials |
|
|
92 | (1) |
|
Best Practices for Transparent Mode Configuration |
|
|
93 | (1) |
|
|
94 | (1) |
|
Enabling the Transparent Firewall Mode |
|
|
95 | (1) |
|
Configuring Transparent Mode in a Layer 2 Network |
|
|
96 | (1) |
|
Configuring the Physical and Virtual Interfaces |
|
|
96 | (7) |
|
Verifying the Interface Status |
|
|
103 | (1) |
|
Verifying Basic Connectivity and Operations |
|
|
104 | (4) |
|
Deploying a Threat Defense Between Layer 3 Networks |
|
|
108 | (1) |
|
Selecting a Default Action |
|
|
108 | (3) |
|
Adding an Access Control Rule for a Routing Protocol |
|
|
111 | (2) |
|
Creating an Access Control Rule for the SSH Protocol |
|
|
113 | (2) |
|
Verifying Access Control Lists |
|
|
115 | (3) |
|
Integrated Routing and Bridging (IRB) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
Chapter 6 IPS-Only Deployment in Inline Mode |
|
|
120 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
120 | (2) |
|
|
122 | (1) |
|
|
122 | (1) |
|
Inline Mode Versus Passive Mode |
|
|
123 | (2) |
|
Inline Mode Versus Transparent Mode |
|
|
125 | (1) |
|
Best Practices for Inline Mode |
|
|
125 | (1) |
|
Inline Mode Configuration |
|
|
126 | (1) |
|
|
126 | (1) |
|
|
127 | (2) |
|
|
129 | (3) |
|
|
132 | (3) |
|
Event Analysis in IPS-Only Mode |
|
|
135 | (1) |
|
|
136 | (1) |
|
|
136 | (1) |
|
|
136 | (1) |
|
|
137 | (1) |
|
|
137 | (1) |
|
Chapter 7 Deployment in Detection-Only Mode |
|
|
138 | (18) |
|
"Do I Know This Already?" Quiz |
|
|
139 | (2) |
|
|
141 | (1) |
|
Detection-Only Mode Essentials |
|
|
141 | (1) |
|
Passive Monitoring Technology |
|
|
141 | (1) |
|
Interface Modes: Inline, Inline Tap, and Passive |
|
|
142 | (1) |
|
Best Practices for Detection-Only Deployment |
|
|
143 | (2) |
|
|
145 | (1) |
|
Configuration of Inline Tap Mode |
|
|
145 | (2) |
|
Verification of Inline Tap Configuration |
|
|
147 | (2) |
|
|
149 | (1) |
|
Configuration of Passive Interface Mode |
|
|
149 | (1) |
|
Configuring Passive Interface Mode on a Threat Defense |
|
|
150 | (1) |
|
Configuring a SPAN Port on a Switch |
|
|
151 | (1) |
|
Verification of Passive Interface Configuration |
|
|
152 | (1) |
|
Event Analysis in Detection-Only Mode |
|
|
153 | (1) |
|
|
154 | (1) |
|
|
154 | (1) |
|
|
155 | (1) |
|
Complete Tables and Lists from Memory |
|
|
155 | (1) |
|
|
155 | (1) |
|
Part II Basic Security Operations |
|
|
|
Chapter 8 Capturing Traffic for Advanced Analysis |
|
|
156 | (16) |
|
"Do I Know This Already?" Quiz |
|
|
157 | (1) |
|
|
158 | (1) |
|
Packet Capture Essentials |
|
|
158 | (2) |
|
Best Practices for Capturing Traffic |
|
|
160 | (2) |
|
Capturing of Packets Using Secure Firewall |
|
|
162 | (1) |
|
|
162 | (3) |
|
|
165 | (4) |
|
Packet Capture versus Packet Tracer |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
Chapter 9 Network Discovery Policy |
|
|
172 | (22) |
|
"Do I Know This Already?" Quiz |
|
|
172 | (2) |
|
|
174 | (1) |
|
Network Discovery Essentials |
|
|
174 | (1) |
|
|
175 | (1) |
|
Network Discovery Operations |
|
|
176 | (2) |
|
Best Practices for Network Discovery |
|
|
178 | (1) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
181 | (2) |
|
|
183 | (3) |
|
|
186 | (1) |
|
Analyzing Application Discovery |
|
|
186 | (1) |
|
|
186 | (2) |
|
|
188 | (3) |
|
|
191 | (1) |
|
|
191 | (1) |
|
|
191 | (1) |
|
Complete Tables and Lists from Memory |
|
|
192 | (1) |
|
|
192 | (2) |
|
Chapter 10 Access Control Policy |
|
|
194 | (30) |
|
"Do I Know This Already?" Quiz |
|
|
194 | (2) |
|
|
196 | (1) |
|
Access Control Policy Essentials |
|
|
196 | (1) |
|
|
196 | (2) |
|
|
198 | (1) |
|
Best Practices for Access Control Policy |
|
|
199 | (1) |
|
Access Control Policy Configuration |
|
|
200 | (1) |
|
|
201 | (1) |
|
|
202 | (6) |
|
|
208 | (14) |
|
|
222 | (1) |
|
|
222 | (1) |
|
|
222 | (1) |
|
Complete Tables and Lists from Memory |
|
|
222 | (1) |
|
|
222 | (2) |
|
Chapter 11 Prefilter Policy |
|
|
224 | (24) |
|
"Do I Know This Already?" Quiz |
|
|
224 | (2) |
|
|
226 | (1) |
|
Prefilter Policy Essentials |
|
|
226 | (1) |
|
Prefilter Policy: Rules and Actions |
|
|
226 | (1) |
|
Bypassing Deep Packet Inspection |
|
|
227 | (3) |
|
Best Practices for a Prefilter Policy |
|
|
230 | (1) |
|
Enabling Bypass Through a Prefilter Policy |
|
|
230 | (1) |
|
|
230 | (1) |
|
Configuring a Rule in a Prefilter Policy |
|
|
230 | (5) |
|
Invoking a Prefilter Policy into an Access Control Policy |
|
|
235 | (2) |
|
Establishing Trust Through an Access Control Policy |
|
|
237 | (3) |
|
|
240 | (2) |
|
Managing Encapsulated Traffic Inspection |
|
|
242 | (3) |
|
|
245 | (1) |
|
|
245 | (1) |
|
|
245 | (1) |
|
Complete Tables and Lists from Memory |
|
|
246 | (1) |
|
|
246 | (2) |
|
Chapter 12 Security Intelligence |
|
|
248 | (34) |
|
"Do I Know This Already?" Quiz |
|
|
249 | (2) |
|
|
251 | (1) |
|
Security Intelligence Essentials |
|
|
251 | (5) |
|
Best Practices for Security Intelligence |
|
|
256 | (1) |
|
|
257 | (2) |
|
Automatic Blocking Using Cisco Intelligence Feed |
|
|
259 | (3) |
|
Verifying the Action of Cisco Intelligence Feed |
|
|
262 | (3) |
|
Overriding the Cisco Intelligence Feed Outcome |
|
|
265 | (2) |
|
Instant Blocking Using Context Menu |
|
|
267 | (1) |
|
Adding an Address to the Block List |
|
|
267 | (1) |
|
Deleting an Address from the Block List |
|
|
268 | (1) |
|
Manual Blocking Using Custom List |
|
|
269 | (3) |
|
Enabling Security Intelligence in Monitor-Only Mode |
|
|
272 | (2) |
|
Threat Intelligence Director |
|
|
274 | (2) |
|
Enabling Threat Intelligence Director |
|
|
276 | (1) |
|
Adding Sources and Importing Indicators |
|
|
277 | (3) |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
281 | (1) |
|
Complete Tables and Lists from Memory |
|
|
281 | (1) |
|
|
281 | (1) |
|
Chapter 13 Domain Name System (DNS) Policy |
|
|
282 | (28) |
|
"Do I Know This Already?" Quiz |
|
|
282 | (2) |
|
|
284 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
Blocking of a DNS Query Using a Secure Firewall |
|
|
285 | (2) |
|
|
287 | (1) |
|
Actions That Can Interrupt DNS Queries |
|
|
288 | (4) |
|
Actions That Allow DNS Queries |
|
|
292 | (1) |
|
|
293 | (2) |
|
Best Practices for Blocking DNS Queries |
|
|
295 | (1) |
|
|
296 | (1) |
|
|
297 | (1) |
|
Add a New Rule to a DNS Policy |
|
|
298 | (3) |
|
|
301 | (1) |
|
|
302 | (5) |
|
|
307 | (1) |
|
|
307 | (1) |
|
|
308 | (1) |
|
Complete Tables and Lists from Memory |
|
|
308 | (1) |
|
|
308 | (2) |
|
|
310 | (32) |
|
"Do I Know This Already?" Quiz |
|
|
310 | (2) |
|
|
312 | (1) |
|
|
312 | (1) |
|
|
312 | (2) |
|
|
314 | (1) |
|
|
315 | (2) |
|
Best Practices for URL Filtering Configuration |
|
|
317 | (5) |
|
|
322 | (1) |
|
Blocking URLs of a Certain Category |
|
|
323 | (2) |
|
Verifying the Operation of a URL Filtering Rule |
|
|
325 | (4) |
|
|
329 | (2) |
|
Analyzing the Default Category Override |
|
|
331 | (4) |
|
Handling Uncategorized URLs |
|
|
335 | (3) |
|
Investigating the Uncategorized URLs |
|
|
338 | (2) |
|
|
340 | (1) |
|
|
341 | (1) |
|
|
341 | (1) |
|
Complete Tables and Lists from Memory |
|
|
341 | (1) |
|
|
341 | (1) |
|
Part III Advanced Configurations |
|
|
|
Chapter 15 Network Analysis and Intrusion Policies |
|
|
342 | (38) |
|
"Do I Know This Already?" Quiz |
|
|
343 | (2) |
|
|
345 | (1) |
|
Intrusion Prevention System Essentials |
|
|
345 | (1) |
|
|
346 | (1) |
|
|
346 | (6) |
|
System-Provided Variable Sets |
|
|
352 | (1) |
|
System-Provided Base Policies |
|
|
353 | (3) |
|
Best Practices for Intrusion Policy Deployment |
|
|
356 | (3) |
|
Configuring a Network Analysis Policy |
|
|
359 | (5) |
|
Configuring an Intrusion Policy |
|
|
364 | (1) |
|
Creating a Policy with a Default Ruleset |
|
|
364 | (1) |
|
Incorporating Intrusion Rule Recommendations |
|
|
365 | (3) |
|
Enabling or Disabling an Intrusion Rule |
|
|
368 | (1) |
|
Setting Up a Variable Set |
|
|
369 | (2) |
|
|
371 | (2) |
|
|
373 | (6) |
|
|
379 | (1) |
|
|
379 | (1) |
|
|
379 | (1) |
|
Complete Tables and Lists from Memory |
|
|
379 | (1) |
|
|
379 | (1) |
|
Chapter 16 Malware and File Policy |
|
|
380 | (36) |
|
"Do I Know This Already?" Quiz |
|
|
380 | (2) |
|
|
382 | (1) |
|
|
382 | (1) |
|
|
382 | (1) |
|
|
382 | (4) |
|
Best Practices for File Policy Configuration |
|
|
386 | (1) |
|
|
387 | (3) |
|
Configuring a File Policy |
|
|
390 | (1) |
|
|
390 | (6) |
|
|
396 | (2) |
|
|
398 | (1) |
|
|
399 | (5) |
|
|
404 | (1) |
|
The Management Center Is Unable to Communicate with the Cloud |
|
|
404 | (4) |
|
The Management Center Performs a Cloud Lookup |
|
|
408 | (1) |
|
The Threat Defense Blocks Malware |
|
|
409 | (3) |
|
Overriding a Malware Disposition |
|
|
412 | (1) |
|
|
413 | (1) |
|
|
414 | (1) |
|
|
414 | (1) |
|
|
414 | (1) |
|
Complete Tables and Lists from Memory |
|
|
415 | (1) |
|
|
415 | (1) |
|
Chapter 17 Network Address Translation (NAT) |
|
|
416 | (44) |
|
"Do I Know This Already?" Quiz |
|
|
417 | (1) |
|
|
418 | (1) |
|
|
418 | (2) |
|
|
420 | (2) |
|
|
422 | (1) |
|
Best Practices for NAT Deployment |
|
|
423 | (2) |
|
|
425 | (2) |
|
|
427 | (1) |
|
Masquerading a Source Address (Source NAT for Outbound Connection) |
|
|
427 | (1) |
|
Configuring a Dynamic NAT Rule |
|
|
427 | (6) |
|
Verifying the Configuration |
|
|
433 | (1) |
|
Verifying the Operation: Inside to Outside |
|
|
434 | (7) |
|
Verifying the Operation: Outside to Inside |
|
|
441 | (5) |
|
Connecting to a Masqueraded Destination (Destination NAT for Inbound Connection) |
|
|
446 | (1) |
|
Configuring a Static NAT Rule |
|
|
446 | (3) |
|
Verifying the Operation: Outside to DMZ |
|
|
449 | (8) |
|
|
457 | (1) |
|
|
457 | (1) |
|
|
457 | (1) |
|
Complete Tables and Lists from Memory |
|
|
458 | (1) |
|
|
458 | (2) |
|
Chapter 18 Traffic Decryption Policy |
|
|
460 | (22) |
|
"Do I Know This Already?" Quiz |
|
|
460 | (2) |
|
|
462 | (1) |
|
Traffic Decryption Essentials |
|
|
462 | (1) |
|
Overview of SSL and TLS Protocols |
|
|
462 | (4) |
|
Decryption Techniques on Secure Firewall |
|
|
466 | (1) |
|
Best Practices for Traffic Decryption |
|
|
467 | (1) |
|
Configuring a Decryption Policy |
|
|
468 | (1) |
|
|
468 | (1) |
|
|
469 | (1) |
|
|
469 | (1) |
|
|
470 | (4) |
|
|
474 | (1) |
|
|
474 | (2) |
|
|
476 | (4) |
|
|
480 | (1) |
|
|
480 | (1) |
|
|
481 | (1) |
|
Complete Tables and Lists from Memory |
|
|
481 | (1) |
|
|
481 | (1) |
|
Chapter 19 Virtual Private Network (VPN) |
|
|
482 | (54) |
|
"Do I Know This Already?" Quiz |
|
|
483 | (1) |
|
|
484 | (1) |
|
|
484 | (1) |
|
|
485 | (3) |
|
|
488 | (1) |
|
|
489 | (1) |
|
|
490 | (2) |
|
Security Association and Key Exchange |
|
|
492 | (1) |
|
|
492 | (2) |
|
|
494 | (1) |
|
|
495 | (1) |
|
Site-to-Site VPN Deployment |
|
|
496 | (1) |
|
|
496 | (3) |
|
|
499 | (4) |
|
|
503 | (1) |
|
|
504 | (3) |
|
|
507 | (6) |
|
Remote Access VPN Deployment |
|
|
513 | (1) |
|
|
513 | (3) |
|
|
516 | (1) |
|
|
517 | (1) |
|
|
518 | (1) |
|
|
518 | (3) |
|
Network and IP Address Pool |
|
|
521 | (1) |
|
|
522 | (5) |
|
|
527 | (7) |
|
|
534 | (1) |
|
|
535 | (1) |
|
|
535 | (1) |
|
Complete Tables and Lists from Memory |
|
|
535 | (1) |
|
|
535 | (1) |
|
Chapter 20 Quality of Service (QoS) |
|
|
536 | (20) |
|
"Do I Know This Already?" Quiz |
|
|
536 | (2) |
|
|
538 | (1) |
|
Quality of Service Essentials |
|
|
538 | (3) |
|
Best Practices for Enabling QoS |
|
|
541 | (1) |
|
|
541 | (1) |
|
|
542 | (4) |
|
|
546 | (4) |
|
Analyzing QoS Events and Statistics |
|
|
550 | (4) |
|
|
554 | (1) |
|
|
554 | (1) |
|
|
554 | (1) |
|
Complete Tables and Lists from Memory |
|
|
555 | (1) |
|
|
555 | (1) |
|
Chapter 21 System Logging (Syslog) |
|
|
556 | (26) |
|
"Do I Know This Already?" Quiz |
|
|
557 | (1) |
|
|
558 | (1) |
|
Secure Firewall Logging Essentials |
|
|
558 | (2) |
|
Best Practices for Logging |
|
|
560 | (1) |
|
|
560 | (4) |
|
Sending Syslog from Threat Defense |
|
|
564 | (1) |
|
Add a Syslog Server on Platform Settings |
|
|
564 | (4) |
|
Enable Logging on Access Control Policy |
|
|
568 | (1) |
|
|
568 | (1) |
|
Sending Syslog from Management Center |
|
|
569 | (1) |
|
|
569 | (3) |
|
|
572 | (2) |
|
Correlate Events to Send Syslog Alerts |
|
|
574 | (4) |
|
|
578 | (3) |
|
|
581 | (1) |
|
|
581 | (1) |
|
|
581 | (1) |
|
Complete Tables and Lists from Memory |
|
|
581 | (1) |
|
|
581 | (1) |
|
|
|
Chapter 22 Final Preparation |
|
|
582 | (6) |
|
Getting Ready for the Exam |
|
|
582 | (1) |
|
|
582 | (1) |
|
|
583 | (1) |
|
|
583 | (1) |
|
Pearson Cert Practice Test Engine and Questions on the Website |
|
|
583 | (1) |
|
Accessing the Pearson Test Prep Software Online |
|
|
584 | (1) |
|
Accessing the Pearson Test Prep Software Offline |
|
|
584 | (1) |
|
|
585 | (1) |
|
|
585 | (1) |
|
|
586 | (1) |
|
Chapter-Ending Review Tools |
|
|
586 | (1) |
|
|
586 | (2) |
|
|
|
Appendix A Answers to the "Do I Know This Already?" Questions |
|
|
588 | (10) |
|
Appendix B CCNP Security Cisco Secure Firewall and Intrusion Prevention System Official Cert Guide Updates |
|
|
598 | (3) |
Glossary |
|
601 | (7) |
Index |
|
608 | |