CCNP ISCW Portable Command Guide

Cover......Page 1
Contents......Page 10
Introduction......Page 16
 Cisco Service-Oriented Network Architecture......Page 18
 Cisco Enterprise Composite Network Model......Page 19
 Configuration Example: DSL Using PPPoE......Page 20
  Virtual Private Dial-Up Network (VPDN) Programming......Page 22
  Step 2: Configure the Dialer Interface......Page 23
  Step 3: Define Interesting Traffic and Specify Default Routing......Page 24
  Step 4a: Configure NAT Using an ACL......Page 25
  Step 4b: Configure NAT Using a Route Map......Page 26
  Step 6: Apply NAT Programming......Page 27
 Configuring PPPoA......Page 28
  Step 1: Configure PPPoA on the WAN Interface (Using Subinterfaces)......Page 29
  For Challenge Handshake Authentication Protocol (CHAP)......Page 30
  Step 3: Verify a PPPoA Connection......Page 31
 Configuring a Cable Modem Connection......Page 32
  Step 1: Configure WAN Connectivity......Page 33
  Step 2: Configure Local DHCP Service......Page 34
  Step 4: Configure Default Routing......Page 35
  Step 1: Configure Global Bridging Parameters......Page 36
 Configuring L3 Routing Using a Cisco Cable Modem HWIC......Page 37
  Step 3: Configure WAN Connectivity......Page 38
 Configuring Cisco Express Forwarding......Page 40
  Troubleshooting CEF......Page 41
 Configuring MPLS on a Frame Mode Interface......Page 42
 Configuring MTU Size in Label Switching......Page 43
  R1 Router......Page 44
  R2 Router......Page 45
  R3 Router......Page 47
Chapter 4 IPsec VPNs......Page 50
 Configuring a Teleworker to Branch Office VPN Using CLI......Page 51
  Step 2: Configure Policies for the Client Group(s)......Page 52
  Step 4: Configure Router AAA and Add VPN Client Users......Page 53
  Step 6: Configure the Crypto Map (IKE Phase 2)......Page 54
  Step 8: Verify the VPN Service......Page 55
  Step 1: Configure the ISAKMP Policy (IKE Phase 1)......Page 56
  Step 3: Configure the Crypto ACL (Interesting Traffic, Secure Data Transfer)......Page 57
  Step 4: Configure the Crypto Map (IKE Phase 2)......Page 58
  Step 7: Verify the VPN Service......Page 59
 Configuring IPsec Site-to-Site VPNs Using SDM......Page 60
  Step 1: Create the GRE Tunnel......Page 63
  Step 3: Specify the IPsec VPN IKE Proposals......Page 64
  Step 4: Specify the IPsec VPN Transform Sets......Page 65
  Step 5b: Specify Routing with OSPF for the GRE over IPsec Tunnel......Page 66
 Configuring a Static IPsec Virtual Tunnel Interface......Page 67
  Step 2: Configure Static Routing......Page 68
  Step 3: Create IKE Policies and Peers......Page 69
  Step 5: Create an IPsec Profile......Page 71
  Step 6: Create the IPsec Virtual Tunnel Interface......Page 72
 Configuring High Availability VPNs......Page 74
  Step 1: Configure Hot Standby Routing Protocol Configuration on HSRP1......Page 75
  Tunnel Traffic Filter......Page 76
  IPsec Tunnel......Page 77
  IPsec Tunnel......Page 78
  Step 3: Add Programming for Crypto Redundancy Configuration......Page 79
  Step 4: Define the Interdevice Communication Protocol (HSRP1 and HSRP)......Page 80
 Configuring Easy VPN Server Using Cisco SDM......Page 82
 Implementing the Cisco VPN Client......Page 86
Chapter 5 Cisco Device Hardening......Page 88
 Disabling Unneeded Services and Interfaces......Page 89
 Disabling Path Integrity Mechanisms......Page 91
 Terminal Access Security......Page 92
 Locking Down Routers with AutoSecure......Page 93
 Optional AutoSecure Parameters......Page 99
  SDM Security Audit Wizard......Page 100
  One-Step Lockdown......Page 105
 Setting Cisco Passwords and Password Security......Page 107
 Securing ROMMON......Page 111
 Setting a Login Failure Rate......Page 112
 Setting Multiple Privilege Levels......Page 114
 Configuring Banner Messages......Page 115
 Role-Based CLI......Page 117
 Secure Configuration Files......Page 119
 Tips for Using Access Control Lists......Page 120
  IP Address Spoofing: Inbound......Page 121
  IP Address Spoofing: Outbound......Page 123
  DoS TCP SYN Attacks: Blocking External Attacks......Page 124
  DoS TCP SYN Attacks: Using TCP Intercept......Page 125
  DoS Smurf Attacks......Page 126
  Filtering ICMP Messages: Inbound......Page 127
  Filtering ICMP Messages: Outbound......Page 128
  Filtering UDP Traceroute Messages......Page 129
 Mitigating Dedicated DoS Attacks with ACLs......Page 130
  Mitigating TRIN00......Page 131
  Mitigating Stacheldraht......Page 132
  Mitigating Trinity v3......Page 134
  Mitigating SubSeven......Page 135
 Configuring an SSH Server for Secure Management and Reporting......Page 138
 Configuring Syslog Logging......Page 139
 Configuring an SNMP Managed Node......Page 140
 Configuring NTP Clients and Servers......Page 142
  Winnipeg Router (NTP Source)......Page 144
  Dauphin Router (Client Router)......Page 145
  TACACS+......Page 146
  Authentication......Page 147
  Accounting......Page 148
 Configuring AAA on Cisco Routers Using SDM......Page 149
 Configuring an IOS Firewall from the CLI......Page 156
  Step 2: Configure an IP ACL for the Interface......Page 157
  Step 3: Set Audit Trails and Alerts......Page 158
  Step 4: Define the Inspection Rules......Page 159
  Step 5: Apply the Inspection Rules and the ACL to the Outside Interface......Page 160
  Step 6: Verify the Configuration......Page 161
 Configuring a Basic Firewall Using SDM......Page 162
 Configuring an Advanced Firewall Using SDM......Page 166
 Verifying Firewall Activity Using SDM......Page 175
 Configuring Cisco IOS Intrusion Prevention System from the CLI......Page 177
  Step 2: Configure the Failure Parameter......Page 178
  Step 4: Apply the IPS Rule to an Interface......Page 179
  IPS Enhancements......Page 180
 Configuring Cisco IOS IPS from the SDM......Page 182
 Viewing Security Device Event Exchange Messages Through SDM......Page 187
 Tuning Signatures Through SDM......Page 188
Appendix: Create Your Own Journal Here......Page 192