Cisco 2t3w2

{permit | deny} 2. Defining an IP NAT pool for the inside network using the command: ip nat pool <pool-name> <start-ip> <end-ip> {netmask | prefix-length <prefix-length>} [type-rotary] Note that type-rotary is optional command. It indicates that the IP address range in the address pool identifies hosts among which T load is distributed. 3. Mapping the access-list to the IP NAT pool by using the command: ip nat inside source list pool <pool-name> 4. Enabling NAT on at least one inside and one outside interface using the command: ip nat {inside | outside} The following command configures a static NAT translation by mapping inside local address to the inside global address. ip nat inside source static 192.168.0.100 88.248.153.137 Here, 192.168.0.100 is the inside local address, and 88.248.153.137 is the inside global address. A packet's source address 192.168.0.100 is changed to 88.248.153.137 by the NAT device. When you are configuring NAT, NAT should be enabled on at least one inside and one outside interface. The correct syntax for enabling dynamic NAT to translate many inside hosts to an inside global IP address is: ip nat inside source list pool <pool-name> overload where is the standard access list number, and <pool-name > is the pool name. Note that the option 'overload' specifies many to one relationship. This configuration is typically used when many hosts with private IP addresses need to access Internet through a specified globally unique IP address.

Example: Please refer to the figure. Hosts on the network 192.168.1.0/24 are configured to access the Internet through router configured for NAT. Assuming that the NAT is working properly, which of the following could be the source address of packets leaving port s0 of the NAT router?

Solution: Note that the packets leaving port S0 on the NAT router should have global IP addresses. The source IP address should be within the pool allocated. In this case, only one IP address is allocated with "overload" command. Hence, the public IP 200.200.1.1 will be used as the source IP address for a packet leaving the NAT router. NAT traversal (or network address translation traversal): is a computer networking methodology that ensures IP connectivity across gateways that implement network address translation (NAT). NAT breaks the principle of end-to-end connectivity originally envisioned in the design of the Internet. Following are true about NAT Traversal: 1. By default, ESP packets can not through a NAT device. 2. NAT-T encapsulates ESP packets inside UDP and assigns both the Source and Destination ports as 4500. 3. When NAT-T is enabled, it encapsulates the ESP packet with UDP when it encounters a NAT device. 4. NAT-T always use the standard port, UDP- 4500. It is not configurable. Hairpinning behavior: Hairpin is a behavior where a NAT device forwards packets from a host in internal network (lets call it host A) back to some other host (host B) in the same internal network, when it detects that the (public IP address) destination of the packet is actually a mapped IP address that was created for the internal host (host B). This is a desirable behavior of a NAT, but unfortunately not all NAT devices this. Lacking this behavior, two (internal) hosts behind the same NAT will not be able to communicate with each other if they exchange their public addresses (resolved by STUN above) to each other. Traditional NAT handles only outbound transactions; clients on the local network initiate requests and servers on the Internet send back responses. However, sometimes, we may want to have a device on the outside network initiate a transaction with one on the inside. To permit this, we need a Bidirectional NAT, Two-Way NAT, or Inbound NAT. All of these convey the concept that the transactions initiated from the outside network. However, the internal network consists of private addresses that are hidden from the Internet. There are two methods to resolve the hidden address problem.



One is to use static mapping for devices like servers on the inside network that need to be accessed from the outside. When static mapping is employed, the global address of the device that is using the static mapping will be publicly known. This is known as static NAT.



The other solution is to make use of the T/IP Domain Name System (DNS). DNS protocol allows requests to be sent as names instead of IP addresses; the DNS server translates these names to their corresponding addresses. It is possible to integrate DNS and NAT so they work together. This process is described in RFC 2694, DNS extensions to Network Address Translators (DNS_ALG). ALG stands for Application Layer Gateway.

5. Cisco Firewall Technologies 5.3 Implement Zone-Based firewall

The following are the important features of Zone Based Firewalls (ZBF): 1. Interfaces are placed into zones 2. In ZBFs, the policies are implemented in a single direction (for example, inside to outside). Reverse traffic is automatically taken care of because of stateful inspection. 3. If you want to allow initial traffic (originating packets) in both directions, you create two unidirectional policies for traffic to be allowed and inspected from the inside to the outside, and also from the outside to the inside. 4. Additional interfaces may simply be added to the zones, and no further configuration is necessary. The existing policies will automatically apply to the newly added interface. Following are true about Zone-Based firewall 1. The default zone, known as self zone is a logical zone 2. A zone can have one or more interfaces assigned to it 3. An interface can be applied to only one zone 4. For interfaces that are of the same zone, all traffic is permitted by default. 5. By default, any traffic to or from the self zone is allowed 6. Any traffic initiated by the router is considered as leaving the self zone. Any traffic with the destination address of the router is considered as entering the self zone. 7. A policy needs to be created for forwarding traffic from one zone to another zone. By default, no traffic is allowed between two different zones. As seen in the figure below, zone pairs are required to control access from inside network to outside network, and outside network to the DMZ. The number of zones given is three (Inside, Outside, and DMZ). The number of zone pairs is two (into-out, and out-to-DMZ).

The following are the three components of Zone Based Firewall policy: 1. Class maps 2. Policy maps, and 3. Service policies.

Class maps filter traffic based on certain rules. They classify traffic using ACLs, ToS, protocol, etc. Classification may happen anywhere between layer-3 to layer-7. The output from the Class map is used by the Policy map for further action. A policy map is an association of traffic classes and actions. It specifies what actions should be performed on defined traffic classes. An action is a specific function, and it is typically associated with a traffic class. For example, inspect and drop is action. Service policy is where you apply the policies, identified from a policy map, to a zone pair. This step actually implements the policy. The following are true about policy map 1. An ACL that has been created to identify which traffic should be encrypted is called a crypto ACL 2. Crypto ACL is not applied directly to any interface, but instead it is referenced by a policy called a crypto map 3. The crypto map is directly applied to an interface. 4. Crypto map is applied at the interface configuration mode Policy map action: Inspect - Permit and statefully inspect the traffic. This is used on transit traffic initiated by s who expect to get replies from servers on the other side of the firewall. - Permits the traffic but does not create an entry in the Stateful database. Traffic that doesn't need a reply. Also in the case of protocols that do not inspection, this policy could be applied to the zone pair for specific outbound traffic, and be applied to a second zone pair for inbound traffic. Drop - Deny the packet. Traffic you do not want to allow between the zones where this policy map is applied. Log - Log the packets. For example, you may want to formation about packets that were dropped because of policy, and then you can add this option. Following are true about service policy in configuring a ZBF 1. A service policy is applied to a zone pair. 2. A specific zone pair can have only a single service policy assigned to it. 3. The zone pair represents a unidirectional flow of traffic between two zones. 4. If a policy is not applied to a zone pair, the default behavior is to drop traffic Traffic interactions between two zones in ZBF 1. If no zones are defined for Ingress and Egress interfaces, the traffic is forwarded 2. If a no zone is defined for Ingress interface, but the Egress interface belongs to a zone, then traffic is dropped 3. If both Ingress and Egress interfaces belong to the same zone, then the traffic is forwarded, irrespective of policy defined or not. 4. If both interfaces are in different zones, and if no policy is applied to zone pair, then the traffic is dropped 5. If both interfaces are in different zones, and a policy is applied to zone pair, then the traffic is forwarded according to the applied policy

1. class-map type inspect match-any MyClassMap1: Create a ZBF-related class map that will be a match if any of its entries is a match

2. policy-map type inspect MyPolicyMap1: Create a ZBF-related policy map 3. class type inspect MyPolicyMap1: Used inside of a ZBF policy map to call on the classification services of a zone-based class map 4. zone-pair security INOUT source INSIDE destination OUTSIDE: Create a zone pair that identifies an initial unidirectional flow of traffic The sequence of steps is as given below: 1. Define zones. 2. Define zone-pairs. 3. Define class-maps that describe traffic that must have policy applied as it crosses a zone-pair. 4. Define policy-maps to apply action to your class-maps' traffic. 5. Apply policy-maps to zone-pairs. 6. Assign interfaces to zones. Though, the sequence of steps is not important, but some events must be completed in order. For example, you must configure a class-map before you assign a class-map to a policy-map. Similarly, you cannot assign a policy-map to a zonepair until you have configured the policy. If you try to configure a section that relies on another portion of the configuration that you have not configured, the router responds with an error message.

5. Cisco Firewall Technologies 5.4 Firewall features on the Cisco Adaptive Security Appliance (ASA) Firewalls configured in transparent mode are also sometimes referred to as bridging, layer-2 or stealth firewalls since they operate at layer 2 of the OSI reference model. A transparent firewall can use packet based filtering, stateful filtering, application inspection. Usually, Transparent firewall is applied where it is not possible to apply other types of firewall due to reasons like separation of duties etc. Some corporations may also find benefits in deploying a transparent firewall in their wireless segments. IronPort Email Security Appliances: Provides granular control of email providing thorough security against email services IronPort Web Security Appliances (WSA): Provides granular control of web traffic by tracking thousands of applications and enforce security policies to protect networks against threats. ASA Firewall: ASA stands for Adaptive Security Appliance. In brief, Cisco ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defence that stops attacks before they spread through the network. Cisco 5500 series devices are examples of Cisco ASA capable devices. Integrated Services Router (ISR): As the name implies, ISR routers provide integrated services such as VOIP, Video, and firewall functionality. ISR routers are primarily intended for branch office use. IPS: Short for Intrusion Prevention System, a device enabled with IPS scans network activity, and logs for any malicious activity, and blocks it before it does any damage to the network. IPS may be considered as an extension to IDS (Intrusion Detection System). The difference being that IPS detects intrusions before they really occur. ScanSafe: Cisco ScanSafe is a cloud hosted web filtering service which enables you to create, enforce and monitor Web usage policies. Layering real time rule-based filters with up-to-date and accurate categorization database. Web Filtering enforces your organization's acceptable usage policy, protecting you from the legal liabilities of inappropriate content, reducing bandwidth congestion and improving employee productivity. Cisco SecureX architecture enforces security policies across the entire distributed network, not just at a single point in the data stream. Cisco SecureX:



Establishes and enforces context-aware policy across your entire distributed network



Creates a converged security strategy across your wired, wireless, and VPN networks



Gives you the ability to create policies that correlate directly with IT enforcement needs and business rules



Uses the Cisco Security Intelligence Operation (SIO) for real-time insight into the global threat environment

Cisco's SecureX architecture has the following elements: 1. Context awareness: May be used to confirm parameters like authentication, access control, etc. Actual tools to implement this include ISE, NAC, and AAA. 2. AnyConnect Client: With AnyConnect Client, you can establish Secure Sockets Layer (SSL) or IPsec VPNs for clients. 3. TrustSec: This creates a distributed access policy enforcement mechanism, and can also provide confidentiality using encryption. It is used to control end-to-end security, based on who are connected to the network, and analyse whether the end systems are secure or not. Actual tools to implement this include ISE, NAC, and AAA. 4. Security Intelligence Operations: Security Intelligence Operations (SIO) is a cloud-based service that Cisco manages. This service identifies and correlates real-time threats so that the network resources may be secured using real time information. A prior knowledge of network threats enables network s to take appropriate preventive action.

1. The ASA s both standard and extended access lists. 2. ASA doesn't use a wildcard mask. Instead, it uses netmask in the access control list (ACL) for permit, deny statements. Graphical tools used with ASA firewall:



ASDM (Stands for Adaptive Security Device Manager) - used with the ASA firewall;



C (Stands for Cisco Configuration Professional) - used with Cisco IOS routers



IDM (Stands for IPS Device Manager) - used to manage the IPS functionality on various platforms that intrusion prevention



IME (Stands for IDM Express) - same as IDM



CSM (Stands for Cisco Security Manager) - a GUI tool that enables you to configure, manage, and monitor IOS routers, ASA firewall appliances, IPS sensors, and Catalyst series switches.

You can use several tools to manage an ASA, including the following: 1. Command-line interface (CLI): Functions similar to IOS 2. ASA Security Device Manager (ASDM): GUI included with the ASA and specifically meant for managing ASA. 3. Cisco Security Manager (CSM): An enterprise GUI tool that can manage Cisco routers, switches, and security appliances such as the ASA Note that C (Cisco Configuration Professional) does not ASA. Cisco ASA Interface security levels The figure shows WSA connected in transparent proxy mode, that the won't be seeing it. The sequence of operations involved in fulfilling a request from Internet inside the community is shown.

5. Cisco Firewall Technologies 5.1 Different Firewall technologies Application Layer Gateways Application layer firewalls (also called proxy firewalls) are specific to the protocol that they are designed to forward and can provide increased access control. Sometimes, application layer firewalls only a limited number of applications. Application layer firewalls offer advantages: 1. Authenticate individuals, not devices 2. Make it harder for hackers to spoof and implement denial-of-service (DoS) attacks 3. Can monitor and filter application data 4. Can provide detailed logging The disadvantages are as follows: 1. Process packets in software, and may be slow 2. a small number of applications 3. Sometimes require special client software 4. Are memory- and disk-intensive The Packet Filters work at Network Layer of OSI model. 1. The Application Layer Proxy works at the Application Layer of OSI model 2. Network Address Translation (NAT) is primarily used to hide internal network from external network, such as the Internet. A NAT basically translates the internal IP addresses to external IP addresses and vice-versa. This functionality assures that external s do not see the internal IP addresses, and hence the hosts. 3. A Firewall implemented with stateful technology (like Checkpoint Firewall) works at all layers of the OSI model.

DMZ is short for DeMilitalized Zone: If a company intends to host its own servers to be accessed from public Internet, a DMZ is most preferred solution. The network segment within the DMZ is secured by two firewalls, one interfacing with the public Internet, and the other interfacing the internal corporate network. Thus, a DMZ provides additional layer of security to internal corporate network. The type of servers that are hosted on DMZ may include web servers, email servers, file servers, DNS servers, etc. Types of Firewalls 1. Packet Filtering Firewalls: Packet Filtering Firewalls work at theNetwork Layer of OSI Model. Packet Filtering Firewalls work on the Basis of Rules defined by Access Control Lists. They check all the Packets and screen them against the rules defined by the Network as per the ACLs. Advantages include lower cost and resource utilization. 2. Circuit Level Gateway Firewalls: Circuit level gateways are deployed at the Session layer of the OSI model and they monitor sessions like T three way handshake to see whether a requested connection is legitimate or not. 3. Application level Firewalls: Application level gateways work on the Application layer of the OSI model and provide protection for a specific Application Layer Protocol. Proxy server is the best example of Application Leyer Firewall. Application level firewalls can also be configured as Caching Servers which in turn increase the network performance and makes it easier to log traffic. They may also be used for reverse proxy server. The following example illustrates the concept of reverse proxy: Consider 3 systems as below.



X = your computer, or "client" computer on the internet



Y = the reverse proxy web site, proxy.example.com



Z = the web site you want to visit, www.example.net

Normally, one would connect directly from X -> Z. However, in some scenarios, it is better for the of z to restrict or disallow direct access, and force visitors to go through Y first. So, as before, we have data being retrieved by Y -> Z on behalf of X, which chains as follows: X -> Y > Z. What is different this time compared to a "forward proxy," is that this time the X does not know he is accessing Z, because the X only sees he is communicating with Y. The server Z is invisible to clients and only the reverse proxy Y is visible externally. A reverse proxy requires no (proxy) configuration on the client side. The client X thinks he is only communicating with Y (X -> Y), but the reality is that Y forwarding all communication (X -> Y -> Z again). Reverse proxy is also useful in cloud environment, where you have multiple computers sharing the load. 4. Stateful Multilayer Inspection Firewalls: Stateful multilayer Inspection Firewall is a combination of all the firewalls that work at different layers of OSI model. They can Filter packets at Network layer using ACLs, check for legitimate sessions on the Session Layers and they also evaluate packets on the Application layer. Stateful Multilayer Inspection firewall can also implement algos that are protocol specific, making the connections and data transfer more secure. Compare stateful vs stateless firewall



A Stateful firewall re the state of a connection (for example, a client going out to a web server) and dynamically allows the return traffic back to the client.



Provides more control over which packets are allowed through and which are blocked than a stateless firewall



It is fairly easy to spoof packets and get them to through a stateless firewall whereas it is difficult to do the same across a stateful firewall



The stateful firewall keeps a track of all t connections made through the firewall and knows which IP addresses are currently being connected to. It also knows which unprivileged ports are used either side of the firewall it blocks any packet not using these IP addresses and port numbers and it tracks T flags (ack, syn, fin, data etc).

5. Cisco Firewall Technologies

5.2 Implement NAT on cisco ASA 9.x Network Address Translation (NAT) you choose to implement depends on what your goals are for NAT and your public address management. NAT methods include Static NAT: Puts a permanent mapping between an internal private address and a public address. In this scenario, 192.168.8.50 will always map out to 192.0.2.75. This type of NAT may be used for allowing traffic into a mail server or web server that is internal to your network. Dynamic NAT: Puts a dynamic mapping between an internal private address and a public address. This also creates a one-to-one relationship on a first-come-first-served basis. The public address that is used by private devices can change over time and cannot be trusted. Overloading: This is also known as Port Address Translation (PAT). In this case, multiple internal devices are able to share one public address, as mappings are placed into the mappings table based on the source and destination ports that are used. As long as ports are available to be remapped, then any number of devices can share a very small pool of public addresses or just one public address. Overlapping: NAT can be used when public or ed addresses are used inside your network. In this case, you may use a public address block on multiple internal networks. NAT allows you to translate those "internal" addresses to other publicly accessible addresses when you connect to the "public" side of the router. The following are true about NAT 1. NAT allows several hosts be connected to Internet by using fewer globally unique IP addresses. This in turn results in conserving the scarce public IP addresses. The public / global is used in the sense that the IP addresses are globally unique and officially ed. 2. NAT s load sharing on inside machines. The inside machines are accessed in a round robin fashion, thus sharing load. 3. NAT offers some degree of security since IP addresses are not easily traceable. This is because, the actual host IP that is accessing the Internet is translated into outside IP address and vice versa. Thus, NAT offers protection against hacking. 4. One disadvantage of NAT is that it increases delay. This is obvious since address translation is involved. 5. Another disadvantage of NAT is that, when an application uses physical IP address, it may not function properly. This is because the physical IP address is changed by NAT. Important Network Address Translation (NAT) of inside local, inside global, outside local, and outside global are explained below: 1. Inside local : A private IP address assigned to a host on the inside network. 2. Inside global : A public IP address that represents one or more inside local IP addresses to the outside world. 3. Outside local : The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from an address space routable on the inside. 4. Outside global : The IP address assigned to a host on the outside network. The address is allocated from a globally routable address or network space. The following two statements are true about dynamic NAT translations: 1. The inside IP addresses eligible for address translation are defined in a standard IP access-list. 2. Only packets moving between inside and outside networks will get translated. This is true even for static NAT. If a packet is destined for another host, but does not require to cross the NAT boundary, the packet source/destination addresses are not translated. This is understandable, since the packet is not crossing the inside network boundary. Enable dynamic NAT on an interface include the following: 1. Defining a standard IP access-list using the command: access-list {permit | deny} 2. Defining an IP NAT pool for the inside network using the command: ip nat pool <pool-name> <start-ip> <end-ip> {netmask | prefix-length <prefix-length>} [type-rotary]

Note that type-rotary is optional command. It indicates that the IP address range in the address pool identifies hosts among which T load is distributed. 3. Mapping the access-list to the IP NAT pool by using the command: ip nat inside source list pool <pool-name> 4. Enabling NAT on at least one inside and one outside interface using the command: ip nat {inside | outside} The following command configures a static NAT translation by mapping inside local address to the inside global address. ip nat inside source static 192.168.0.100 88.248.153.137 Here, 192.168.0.100 is the inside local address, and 88.248.153.137 is the inside global address. A packet's source address 192.168.0.100 is changed to 88.248.153.137 by the NAT device. When you are configuring NAT, NAT should be enabled on at least one inside and one outside interface. The correct syntax for enabling dynamic NAT to translate many inside hosts to an inside global IP address is: ip nat inside source list pool <pool-name> overload where is the standard access list number, and <pool-name > is the pool name. Note that the option 'overload' specifies many to one relationship. This configuration is typically used when many hosts with private IP addresses need to access Internet through a specified globally unique IP address. Example: Please refer to the figure. Hosts on the network 192.168.1.0/24 are configured to access the Internet through router configured for NAT. Assuming that the NAT is working properly, which of the following could be the source address of packets leaving port s0 of the NAT router?

Solution: Note that the packets leaving port S0 on the NAT router should have global IP addresses. The source IP address should be within the pool allocated. In this case, only one IP address is allocated with "overload" command. Hence, the public IP 200.200.1.1 will be used as the source IP address for a packet leaving the NAT router. NAT traversal (or network address translation traversal): is a computer networking methodology that ensures IP connectivity across gateways that implement network address translation (NAT). NAT breaks the principle of end-to-end connectivity originally envisioned in the design of the Internet. Following are true about NAT Traversal: 1. By default, ESP packets can not through a NAT device. 2. NAT-T encapsulates ESP packets inside UDP and assigns both the Source and Destination ports as 4500. 3. When NAT-T is enabled, it encapsulates the ESP packet with UDP when it encounters a NAT device. 4. NAT-T always use the standard port, UDP- 4500. It is not configurable. Hairpinning behavior: Hairpin is a behavior where a NAT device forwards packets from a host in internal network (lets call it host A) back to some other host (host B) in the same internal network, when it detects that the (public IP address)

destination of the packet is actually a mapped IP address that was created for the internal host (host B). This is a desirable behavior of a NAT, but unfortunately not all NAT devices this. Lacking this behavior, two (internal) hosts behind the same NAT will not be able to communicate with each other if they exchange their public addresses (resolved by STUN above) to each other. Traditional NAT handles only outbound transactions; clients on the local network initiate requests and servers on the Internet send back responses. However, sometimes, we may want to have a device on the outside network initiate a transaction with one on the inside. To permit this, we need a Bidirectional NAT, Two-Way NAT, or Inbound NAT. All of these convey the concept that the transactions initiated from the outside network. However, the internal network consists of private addresses that are hidden from the Internet. There are two methods to resolve the hidden address problem.



One is to use static mapping for devices like servers on the inside network that need to be accessed from the outside. When static mapping is employed, the global address of the device that is using the static mapping will be publicly known. This is known as static NAT.



The other solution is to make use of the T/IP Domain Name System (DNS). DNS protocol allows requests to be sent as names instead of IP addresses; the DNS server translates these names to their corresponding addresses. It is possible to integrate DNS and NAT so they work together. This process is described in RFC 2694, DNS extensions to Network Address Translators (DNS_ALG). ALG stands for Application Layer Gateway.

4. Secure Routing and Switching 4.6 VLAN Security Describe the security implications of a native VLAN 1. Avoid using native VLAN (VLAN1) for management traffic. 2. Limit the number of MAC addresses learned on a given port with the port security feature. 3. Use BPDU guard and root guard to prevent attackers from controlling STP 4. Turn off Cisco Discovery Protocol (CDP) on ports facing untrusted or unknown networks 5. On a new switch, shut down all ports and assign them to a VLAN that is not used for anything else other than a parking lot. Describe Security implication of PVLAN PVLAN: Private VLAN Edge is a feature that may also be referred to as PVLAN Edge or protected switchport. It is a very simple configuration that restricts the direct layer 2 communications between any two devices that has it enabled. Assume, that a 20 port switch connects ports 23, and 24 to the printer and router respectively. The ports 1-22 are used for connecting to the workstations. Further, you want all workstations to use resources on ports 23-24 but not communicate with one another. The resulting configuration is one that prevents communications between workstations, but permits communication with the resources that are required for the s to do their day to day functions. Typical configuration commands on the switch are as given below: //the host ports Switch(config)#spanning-tree Switch(config)#interface Switch(config-if-range)#switchport Switch(config-if-range)#switchport protected

portfast range fa0/1

-

default 22 access

-

24

mode

//the resource ports //note the absence of "switchport protected" Switch(config)#interface range fa0/23 Switch(config-if-range)#switchport mode access This is a switch based solution and needs to be implemented on individual switches.

VLAN Trunking best practices: 1. Setting the native vlan to anything other than vlan 1. Setting the native vlan is important because it doesn't tag packets over the trunk link. 2. Disable trunk negotiation. Dynamic Trunking Protocol (DTP) is useful when the status of a switch on the opposite side may be changing over time, but can also be a security issue because it can allow an attacker to connect to a port and autonegotiate as a trunk port and see more traffic. You use the command switchport nonnegotiate for this purpose. 3. Allow VLANs that need to communicate down the trunk link. Use the command "switchport trunk allow vlan X,Y,Z" to allow only desired VLANS. Otherwise, it allows ALL VLANs to traverse that pipe. By restricting the number of VLANs, you are cutting down on security risks.

4. Secure Routing and Switching 4.5 Mitigation procedures Implementing DH Snooping DH Snooping - Prevents rogue DH servers from gaining access to the network information. Dynamic Host Configuration Protocol (DH) snooping enables 1. a networking device (say, a switch) to filter untrusted DH packets in a subnet. 2. Ward off MiM attacks, such as a rogue DH server sending false DH server reply packets with the intention of misdirecting other s. 3. DH snooping can also stop unauthorized DH servers and prevent errors stemming from misconfiguration of DH servers. DH snooping is often used with Dynamic ARP Inspection (DAI) and IP Source Guard. Given below are the basic configuration steps involved in configuring DH snooping. Note that even though DH Snooping is enabled globally, you still need to define the VLANs (atleast one VLAN is required to be configured) that participate in DH Snooping. Step 1: Enable DH Snooping Globally: sw(config)#ip dh snooping Step 2: Enable DH Snooping on one or more VLANs : sw(config)#ip dh snooping vlan 20 Step 3: Configure the switch interface as a trusted interface: sw(config-if)#ip dh snooping trust step 4: Configure the DH Snooping database agent to store the bindings : sw(config)#ip dh snooping databasetftp://172.16.1.1/dhbase-file Implementing Dynamic ARP Inspection(DAI): DAI, short for Dynamic ARP Inspection, validates ARP packets in the subnet. DAI intercepts, and goes through each ARP request and discards ARP packets with invalid IP to MAC address bindings. This takes care of man in the middle attacks, and any spurious behavious of the network. The interface on which the DH server is connected should be a trusted interface. Minimum configuration steps involved in configuring DAI on a switch are given below: Step 1: 1. To enable DAI on VLANs, perform this task: 2. You can enable DAI on a single VLAN or a range of VLANs: 3. To enable a single VLAN, enter a single VLAN number.

4. To enable a range of VLANs, enter a dash-separated pair of VLAN numbers. 5. You can enter a comma-separated list of VLAN numbers and dash-separated pairs of VLAN numbers. Example: vlan 20,21,22,23 or vlan 20-23 sw(config)#ip arp inspection vlan 20 Step 2: Specifies the interface connected to another switch, and enter interface configuration mode sw(config)#interface fa0/0/14 Configures the connection between switches as trusted (default: untrusted). sw(config-if)#ip arp sw(config-if)#exit sw(config)#do show ip arp inspection vlan 20

inspection

trust

The command "do show ip arp inspection vlan 20" displays the list of vlans that had been DAI enabled and whether the vlans are active. Dynamic ARP Inspection (DAI) enables the Brocade device to 1. Intercept and examine all ARP request and response packets in a subnet and discard packets with invalid IP-toMAC address bindings. 2. DAI can prevent common man-in-the-middle (MiM) attacks such as ARP cache poisoning, and 3. Disallow mis-configuration of client IP addresses. Layer 2 mechanisms that can be used to protect the data plane include the following: 1. Port security to protect against MAC addresses flooding and CAM (content-addressable memory) overflows attacks. 2. Dynamic Host Configuration Protocol (DH) snooping - Used to prevent a rogue DH server taking over from a genuine DH server. 3. Dynamic ARP inspection (DAI) - Protects against Address Resolution Protocol (ARP) spoofing, and ARP poisoning. DAI validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from some man-in-the-middle attacks 4. IP Source Guard, when implemented on a switch, verifies that IP spoofing is not occurring by devices on that switch. In other words, IP Source Guard provides source IP address filtering on a Layer 2 port and prevents a rogue host from impersonating a legitimate host by assuming the legitimate host's IP address. The feature uses dynamic DH snooping and static IP source binding to match IP addresses to hosts on un-trusted Layer 2 access ports Two switch features available with Cisco switches for preventing un-intentional BPDUs are: a. root guard: The root guard feature provides a way to enforce the root bridge placement in the network. The root guard ensures that the port on which root guard is enabled is the designated port. Normally, root bridge ports are all designated ports, unless two or more ports of the root bridge are connected together. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP state. This root-inconsistent state is effectively equal to a listening state. No traffic is forwarded across this port. In this way, the root guard enforces the position of the root bridge. When configured at the interface level, BPDU Guard shuts the port down as soon as the port receives a superior BPDU. By default, it is disabled on all switch ports. To enable root guard, use the command: switch(config-if)#spanning-tree guard root

root guard feature forces an interface to become a designated port to prevent surrounding switches from becoming a root switch. In other words, Root Guard provides a way to enforce the root bridge placement in the network. The Root Guard feature prevents a Designated Port from becoming a Root Port. If a port on which the Root Guard feature receives a superior BPDU, it moves the port into a root-inconsistent state (effectively equal to a listening state), thus maintaining the current Root Bridge status. b. bpdu guard: BPDU Guard is a feature that will automatically shut down a port when BPDU's are received on that particular port. It is common to configure PortFast and BPDU Guard on host access ports.Here if any BPDU (superior or not) is received on a port configured with BPDU guard, the port is immediately put into errdisable state. The port is effectively shutdown and it must either be enabled manually or by use of a timeout function. By default, it is disabled on all ports. To enable BPDU guard use the command at interface configuration mode: switch(config-if)#spanning-tree bpduguard enable BPDU Guard puts an interface configured for STP PortFast into the err-disable state upon receipt of a BPDU. The BPDU Guard feature is used to protect the Spanning Tree domain from external influence. BPDU Guard is disabled by default but is recommended for all ports on which the Port Fast feature has been enabled. This prevents false information from being injected into the Spanning Tree domain on ports that have Spanning Tree disabled. A port that is shutdown will continue to be in errdisable state even if the BPDUs are no longer received. It is recommended to use bpdu guard on all ports that have portfast enabled. The protection is useful for access layer nodes where the end 's computers are expected to be connected. c. Loop Guard: Provides additional protection against Layer 2 forwarding loops (STP loops). A bridging loop happens when an STP blocking port in a redundant topology erroneously transitions to the forwarding state. This usually occurs because one of the ports of a physically redundant topology (not necessarily the STP blocking port) has stopped receiving STP BPDUs. d. IP Source Guard: Prevents IP address spoofing by hosts. For example, a rogue host may use different IP addresses as source and flood the switch. The following commands configure spanning-tree root guard on interface fa0/2 on switch SW1 SW>enable SW1#configure SW1(config)#interface fastethernet SW1(config-if)#spanning-tree rootguard

terminal 0/2

Important points on STP BPDU guard and root guard



The STP root guard feature prevents a port from becoming root port or blocked port. If a port configured for root guard receives a superior BPDU, the port immediately goes to the root-inconsistent (blocked) state. Usually STP root guard is configured on primary and secondary root switches.



BPDU Guard basically means that if the port has portfast enabled, connecting an unauthorized switch to it (by someone such as an end-) will cause that original switch to receive a BPDU from the second switch, making the port shut down to prevent frames from the second switch entering into the network. This is called err disabled state. The needs to bring up the port manually or programmatically after elapse of certain quiet period.



Root guard provides a way to enforce the root bridge placement in the network. The configuration of root guard is on a per-port basis. Root guard does not allow the port to become an STP root port, so the port is always STPdesignated. If a better BPDU arrives on this port, root guard does not take the BPDU into and elect a new STP root. Instead, root guard puts the port into the root-inconsistent STP state. You must enable root guard on all ports where the root bridge should not appear. In a way, you can configure a perimeter around the part of the network where the STP root is able to be located

Storm Control - Limits the amount of broadcast or multicast traffic flowing through the switch. Storm control provides a way for s to limit the amount of traffic that es through a switch by way of broadcasts and multicasts. By implementing storm control, s may prevent excess resource used by an attacker, and prevent broadcast flooding. Port Security: Controls the number of MAC addresses that can be learned on a single switch port. It is because; an attacker may floor the switch with several fictitious MAC addresses on a single port, thus over flowing the switch's MAC

table. By using Port security, it is possible to limit the number of MAC addresses that could be learned from a single switch port. The command switchport port-security maximum 5 sets the maximum number of allowable MAC addresses to 5. The default is 1 allowable MAC address. The default violation action is to shut down the port. Alternatively, we can configure the violation response to be to "protect," which will not shut down the port but will deny any frames from new MAC addresses over the set limit. The "restrict" action does the same as protect but generates a syslog message, as well. The purpose of port security is to prevent access to the LAN from un-authorized hosts. The command "Switch1(config-if)# switchport port-security violation protect" , will not allow MAC address frames above the set maximum. The command is used in conjunction with the command Switch(config-if)# switchport port-security maximum The default action if protect command is not given is that the port will be shut down.

Port-security can only be allowed to access ports but not trunks. "Switchport port-security maximum ". This command sets the maximum number of secure mac address allowed on the switch port, default is 1. Security-violation: A security violation occurs if the maximum number of secure MAC addresses has been added to the address table and a workstation whose MAC address is not in the address table attempts to access the interface. To set the action to be taken when a security violation is detected, use the switchport port-security violation command. To revert to the default settings, use the no form of this command. switchport port-security violation { protect | no switchport port-security violation { protect | restrict | shutdown }

restrict

|

shutdown

}

Syntax description: 1. Protect: Drops all the packets from the insecure hosts at the port-security process level but does not increment the security-violation count. 2. Restrict: Drops all the packets from the insecure hosts at the port-security process level and increments the securityviolation count. 3. Shutdown: Shuts down the port if there is a security violation

4. Secure Routing and Switching 4.4 Common Layer 2 attacks 1. Disable IP Source Route: Disables the ability of an attacker to control the path that a packet will take to reach its destination. 2. Disable Finger Service: Disables an attacker from knowing who is logged in to a device. 3. Disabling IP Identification Service: denies an attacker from querying a T port for identification. If enabled, one can learn the routers make, model, and the IOS version. This information may be used to design attacks against the router. 4. Disabling CDP: CDP provides make, model number and the Cisco IOS software version being run. This information may be used to design attacks against the router.

ARP Poisoning and DH snooping are layer-2 attacks, where as IP Snooping, ICMP attack, and DoS attack with fake IPs are layer-3 attacks. IP address spoofing: IP address spoofing is a technique that involves replacing the IP address of an IP packet's sender with another machine's IP address. The IP address spoofing technique can enable an attacker to send packets on a network without having them be intercepted by the packet filtering system (firewall). Firewall systems are usually based on filtering rules indicating the IP addresses that are authorized to communicate with the network's internal machines. IP Spoofing attack: IP Spoofing is a technique used to gain unauthorized access to machines, whereby an attacker illicitly impersonate another machine by manipulating IP packets. IP Spoofing involves modifying the packet header with a forged (spoofed) source IP address, a checksum, and the order value.

A hacker may attack a computer in a number of ways. Given below are brief descriptions of some important attacks types from exam point of view: a. Man-in-the-middle attack: A man-in-the-middle attack occurs when an attacker reroutes communication between two s without the knowledge of the two communicating s. The attacker can monitor and read the traffic before sending it on to the intended recipient. Each in the communication unknowingly sends traffic to and receives traffic from the attacker, all while thinking they are communicating only with the intended . This could happen at layer-2, where in the attacker spoofs the Layer 2 MAC addresses to make the communicating hosts on a LAN believe that the Layer 2 address of the attacker is the Layer 2 address of default gateway. You could use techniques such as dynamic Address Resolution Protocol (ARP) inspection (DAI) on switches to prevent spoofing of the Layer 2 addresses. A man-in-the-middle attack can occur at Layer 3 by a rogue router being placed on the network and then tricking the other routers into believing that the new router has a better path. You can mitigate attacks such as these by using routing authentication protocols. Best way is to use encryption such as ssh or https to ensure that the data in motion is not plain text data. b. Denial-of-service attack: In a denial-of-service (DoS) attack, an attacker attempts to prevent legitimate s from accessing information or services. By targeting your computer and its network connection, or the computers and network of the sites you are trying to use, an attacker may be able to prevent you from accessing email, websites, online s (banking, etc.), or other services that rely on the affected computer. A more advanced type of DDoS attack is called a reflected DDoS (RDDoS) attack. An RDDoS takes place when the source of the initial (query) packets is actually spoofed by the attacker. The response packets are then "reflected" back from the unknowing participant to the victim of the attack; that is, the original (spoofed) source of the initial (query) packets. c. Spoofing attack: Spoofing is an impersonation of a , device or client on the Internet. It's often used during a cyber attack to disguise the source of attack traffic. The most common forms of spoofing are: 1. DNS server spoofing - Modifies a DNS server in order to redirect a domain name to a different IP address. It's typically used to spread viruses. 2. ARP spoofing - Links a perpetrator's MAC address to a legitimate IP address through spoofed ARP messages. It's typically used in denial of service (DoS) and man-in-the-middle assaults. 3. IP address spoofing - Disguises an attacker's origin IP. It's typically used in DoS assaults. d. Reconnaissance attack: In computer security reconnaissance is a type of computer attack in which an intruder engages with the targeted system to gather information about vulnerabilities. The attacker first discovers any vulnerable ports by using software's like port scanning. After a port scan, an attacker usually exploits known vulnerabilities of services associated with open ports that were detected. To prevent most port scan attacks or reconnaissance attacks is to use a good firewall and intrusion prevention system (IPS). The firewall controls which ports are exposed and to whom they are visible. The IPS can detect port scans in progress and shut them down before the attacker can gain a full map of your network e. STP attack: An attacker who is physically connected to the network and who has the ability to create BPDU frames with specific characteristics can use the STP to cause various kinds of havoc, from stealing data to disrupting the network. There are a couple of simple methods to prevent the exploitation of the STP vulnerability in your network. For any STP attack to be feasible, the switch must accept BPDUs on a port that the attacker has access to. It is therefore possible to make such an attack impossible by denying access to STP enabled ports to ordinary s. This can be done by disabling STP on access ports, having port security enabled on all ports, and restricting physical access to network equipment. With disabled STP on ports, the attacker would have to access the switch physically and use a switch-to-switch port to connect his computer to (assuming all non-used ports are either disabled or have STP disabled). If you cannot restrict physical access to your network devices, other measures must be taken to ensure network security. Port security is a feature that allows the switch to accept frames from only a given number (usually the first learned) of source MAC addresses. Enabling port security on ports will make the attack unfeasible without prior network sniffing or hijacking a 's workstation. ICMP Attack: There are several types of ICMP attacks.

1. ICMP tunnel attack: This is a form of covert channel that is created wherein the information flow is not controlled by any security mechanism. An ICMP tunnel establishes a channel between the client and server, forcing a firewall not to trigger an alarm if data are sent via ICMP. 2. Smurf attack: The Smurf attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address. 3. DoS attack: DoS and DDoS attacks are form of attacks wherein the attacker spoofs the source address and attack the victims computer. DDoS, the attack is distributed. Several computers are compromised in DDoS attack and the attacker may plan to carry out the attack in a co-ordinated way to impart maximum damage to the the network availability. The main damage caused by DoS and DDoS is that they severely limit the access to network resources to the victim computers by spreading fake IP packets. The Internet architecture provides an unregulated network path to attack innocent hosts. Denial-of-service (DoS) attacks exploit this to target mission-critical services. DoS attacks, are explicit attempts to block legitimate s system access by reducing system availability. Any physical or host-based intrusions are generally addressed through hardened security policies and authentication mechanisms. Although software patching defends against some attacks, it fails to safeguard against DoS flooding attacks, which exploit the unregulated forwarding of Internet packets. DH Spoofing attack: In DH Spoofing attack, an attacker broadcasts large number of DH REQUEST messages with spoofed source MAC addresses. If the legitimate DH Server in the network start responding to all these bogus DH REQUEST messages, available IP Addresses in the DH server scope will be depleted within a very short span of time. DH snooping is a mechanism that provides protection to clients from DH spoofing attack. The security features implemented on routers (Layer-3 devices) include the following: 1. Reflexive access lists 2. Context based access lists (CBAC) 3. Zone based firewall 4. ACLs 5. AAA 6. Routing protocols authentication 7. Secure management protocols (https, ssh, etc) A CAM overflow attack happens when an attacker connects to one or more switch ports and then runs on any program that mimics the existence of thousands of random MAC addresses on that switch port(s). The switch writes MAC addresses into the CAM table, and eventually the CAM table fills to capacity. When a switch is in this state, no more new MAC addresses can be learned; therefore, the switch starts to flood any traffic from new hosts out of all ports on the switch. A CAM overflow attack turns a switch into a hub, which enables the attacker to eavesdrop on a conversation and perform man-in-themiddle attacks. VLAN hopping attack: VLAN hopping attack can be possible by two different approaches, Switch Spoofing or Double tagging. Switch Spoofing : Trunks on switches carry traffic for all VLANs. If an attacker can convince a switch to go into trunking mode for connected port to the attacker PC, the attacker could then see traffic for all VLANs. This can be then simply used for "sniffing" all the traffic on all VLANs. Cisco Catalyst switch ports default to auto mode for trunking. This means that the ports are in "dynamic desirable" mode and they will automatically become trunk ports if they receive Dynamic Trunking Protocol (DTP) frames. Disable DTP on switch ports where it is not necessary. Double tagging: For this kind of attack to work, the following conditions must exist in the network configuration:



The attacker is connected to an access switch port.



The switch must have an 802.1Q trunk.



The trunk must have the attacker's access VLAN as its native VLAN

The attacker, for example, situated on VLAN 10, sends frames that are double tagged as if an 802.1Q trunk is being used. Naturally, the attacker is not connected to a trunk; he is using switch spoofing to turn his switch interface to trunking mode. He is using trunk encapsulation to trick the switch into making the frames hop over to another VLAN. The real frame maybe with some malicious data is first given an 802.1Q tag with the VLAN ID of the target VLAN, in this case VLAN 20. Then a second bogus 802.1Q tag is added with the attacker's access VLAN ID - the VLAN 10 in our example. When the local switch on the left receives a double tagged frame, it decides to forward it out the trunk interface. This is because the first "VLAN 10? tag has the same VLAN ID as the trunk's native VLAN. The "VLAN 10? tag is removed as the frame is sent on the trunk. The switch sends all frames from the native VLAN untagged that is normal. Now the second "VLAN 20? tag is posted on the trunk. When switch on the right side receives the frame, it finds second 802.1Q tag. The spoofed tag for VLAN 20 is found and the tag is then removed and the frame is forwarded to VLAN 20. In that moment the attacker has successfully sent a frame from VLAN 10 and gotten the frame injected onto VLAN 20 by not using the router. He made it all through Layer 2 switching. Botnet: A botnet, also known as zombie army, is a group of computers connected in a coordinated fashion for malicious purposes. Each computer in a botnet is called a bot. These bots form a network of compromised computers, which is controlled by a third party and used to transmit malware or spam, or to launch attacks. DDoS is an example of attack where botnet computers attack a resource, making the resource unavailable to its s. Exploitation: The goal of a trust exploitation attacker is to compromise a trusted host, using it to stage attacks on other hosts in a network. If a host in a network of a company is protected by a firewall (inside host), but is accessible to a trusted host outside the firewall (outside host), the inside host can be attacked through the trusted outside host. For example, if a host in a DMZ is compromised, an attacker may use the compromised host to attack inside hosts (hosts within the organizations internal network). Reconnaissance: This is the discovery process used to find information such as IP addresses used, open ports, etc. about a computer network. This is usually the first step taken, to discover what is on the network and to determine potential vulnerabilities. ARP Poisoning: The Address Resolution Protocol (ARP) is used to resolve IP addresses into MAC addresses (hardware addresses). Computers in a network send messages to each other through MAC addresses. ARP cache poisoning involves poisoning the ARP cache of a victim by flooding it with ARP replies containing MAC addresses to a proxy host.

4. Secure Routing and Switching 4.3 Securing the control plane For complete security, a router's traffic is typically segmented into three planes, each with a clearly identified objective. The data plane enables forwarding of traffic securely; the control plane enables forwarding of traffic originating at the networking device such as routing protocol traffic securely and the management plane enables forwarding of traffic that is originated by a network securely Function of control plane policing Cisco recommends three ways to protect Control plane. These are: 1. CoPP (Control Plane Policing): This feature allows s to configure a QoS filter that manages the traffic flow of control plane packets to protect the of Cisco IOS routers and switches against various attacks like Denial-of-Service (DoS). Hence a set of rules can be established and associated to the input and output ports of the . 2. CoPPr: Although it is similar to Control Plane Policing (CoPP), Pr has the ability to restrict/police traffic using finer granularity than that used by CoPP. Pr divides the aggregate control plane into three separate control plane categories, known as subinterfaces: (1) host, (2) transit, and (3) CEF-exception. Pr protects the control and management planes of a Cisco IOS device, which maintains routing stability, network reachability, and packet delivery. Overall, Pr increases the reliability, confidentiality (security), integrity, and availability of network devices. Using Pr you can rate-limit and filter this type of traffic with a more fine-toothed comb than CoPP. 3. Routing protocol authentication: By using routing protocol authentication, it is possible to eliminate the routing traffic from an attacker using a rogue router on the network. By using a rogue router, an attacker will be able learn the network architecture, and inject his own routes to drive the traffic to the rogue router, thereby compromising the network security.

4. Secure Routing and Switching 4.2 Securing routing protocols telnet and http protocols are insecure, i.e., information is transmitted in plain text. They use T port numbers 23 and 80 respectively.

ssh and https are secure protocols, i.e., they carry information in encrypted form. They use T port numbers 22 and 443 respectively. Authenticated Routing Protocol Updates: Routing protocol authentication options for the most often used routing protocols such as EIGRP, OSPF, RIP and BGP are preferred due to reasons such as route manipulation or poisoning. There are two ways to do this: 1. Using a routing protocol centric solution that configures the s or keys to use within the routing protocol configuration, or 2. By using separately configured keys that are able to be used by multiple routing protocols. The configuration of both RIP and EIGRP utilize key chains for their authentication configuration. The following security measures may be applied to Data Plane: 1. Access Control Lists (ACLs) 2. Private VLANs 3. Spanning Tree Protocol guards 4. IOS IPS, and 5. Zone-based firewall OSPF authentication can be enabling in two ways: 1. Per interface: Authentication is enabling per interface using the "ip ospf athentication" command. 2. Area authentication: Authentication for area can enable using "area authentication" command. Types of Authentication : There are three different types of authentication available for OSPF version 2: 1. Null authentication: provides no authentication, this is the default on Cisco routers. 2. Clear text authentication: s are exchanged in clear text on the network 3. Cryptographic authentication: uses the open standard MD5 encryption.

4. Secure Routing and Switching 4.1 Security on Cisco routers Multiple Privilege levels When you connect to a Cisco router, you will be provided with mode privilege level. It has lowest priority, 0. After entering the privilege mode (by providing appropriate credentials), you will be moved to privilege level 15 (the highest available privilege level). In between, you can configure privilege levels 1 through 14. In enterprise environment, having different privilege levels are useful, so that s may be provided with required command sets to perform their duties, nothing less or nothing more. Cisco IOS role-based CLI access Similar to making different commands available to different s using privilege levels, role-based command-line interface (CLI) views can be used to provide different sets of configuration information to different s. However, unlike making commands available via privilege levels, using role-based CLI views you can control precisely the commands that an has access to. Cisco Security Agent (CSA): CSA is an application that provides IPS services on a host. Therefore, CSA is called a Hostbased Intrusion Prevention System (HIPS) application. Security Device Manager (SDM): Cisco SDM provides a graphical interface for configuring a variety of security features (for example, IPS, IPsec site-to-site VPN, and firewall features). It also provides features of configuring routers.

The Cisco Secure Access Control Server (ACS) application provides an authentication, authorization, and ing (AAA) function. Implement Cisco IOS re-silent configuration: Given below are the recommended practices for choosing s: 1. s are at least 10 characters long 2. Does not contain any dictionary words 3. Create a policy as to how and when a be changed 4. A should contain alphabets (caps and small letters), numerics, and special characters. In IOS, space is a valid special character. Leading spaces in are ignored. Strong : A strong will typically have at least 8 characters long, and consists of numerals, characters, and special characters. The purpose is to make guessing more difficult for the attacker. It is bad idea to use dictionary , or just alpha numeric characters. To configure the console and secret follow below instructions Step 1 : Enter global configuration mode R1>enable R1#configure terminal Step 2 : Set the enable to "certexam" R1(config)#enable certexam Step 3: Set the enable secret to "certtest" R1(config)#enable secret certtest Step 4 : Set the console to "certtest" for line console 0 R1(config)#line R1(config-line)# R1(config-line)# certtest

console 0

To set the vty for lines 0 to 4 follow below instructions Step 1 : Enter global configuration mode R1>enable R1#configure terminal Step 2 : Set the telnet access to "certexam" for line vty 0-4, this will enable remote s to telnet into vty ports 0-4 R1(config)#line R1(config-line)# R1(config-line)# certexam

vty 0

4

The following are the IOS based security features: 1. Stateful inspection - Performs stateful inspection using Context Based Access Control (CBAC). 2. Virtual Private Networks (VPN) - Provides tunnels for virtual private communication. 3. Intruder Prevention System (IPS) - Cisco IOS may be configured to detect an attacker and prevent him from proceeding further, and report the same. 4. VPN Routing and Forwarding - aware Firewall - A VRF-aware firewall maintains a separate routing and forwarding table for each VPN, Most of the Integrated Services Routers contain one or more USB drives, which may be used for digital signatures, IOS image updates, and backing up configuration files.

Integrated Services Modules various modules to facilitate faster response times, and off-load work from the router's processor and memory. These include the following: 1. Cisco HWIC-AP: An IEEE 802.11 wireless module ing a variety of wireless standards. 2. Cisco IDS Network Module: Includes a hard drive containing multiple signatures of well-known attacks. Used to detect and subsequently prevent malicious traffic. 3. Cisco Content Engine: Includes a hard drive for caching web content. 4. Cisco Network Analysis Module (NAM): Provides a detailed analysis of traffic flow. 5. AIM-VPN - Several models available, used for VPN processing and relieves router processor off VPN processing load. There are several methods that Cisco recommends for securing management plane. These include the following: 1. s - At the very least, network s can secure the network devices using hard to guess s. 2. Authentication using AAA - One disadvantage of using just s is that it is not possible to know who had accessed a network device. By using name and combination, s can keep track of who had logged in. The authentication services may be provided by AAA (Authentication, Authorization, and ing) server. 3. Role Based Access Control (RBAC) - Role-based access control (RBAC) is a method of regulating access to computer or network devices based on the roles of individual s within an enterprise. In this context, access is the ability of an individual to perform a specific task, such as view, create, or modify a file. you can control this through AAA and custom privilege levels/parser views. 4. Encrypted management protocols - You can use secure protocols, such as https (instead of http), and ssh for securely communicating to the network device. 5. Secure system files - By securing IOS images, and configuration files, you make it difficult to delete or modify those files by the attacker. 6. Logging - Logging ensures that events are recorded for future analysis. Different types of logging include a) commands logging, b) system events logging, c) error messages logging, etc. 7. Network Time Protocol (NTP) - NTP enables to maintain proper time stamps and keep all devices in time sync. It makes logging messages more trust worthy. The following two commands are used to secure boot image, and boot configuration on an IOS router: Router1(config)#secure !

boot-image Secure

the

startup-config

Router1(config)#secure

boot-config

[flash:.runcfg-20111234-230123.ar] The !

following

command may

be

used

to the

Router1(config)# do show secure bootset Displays the status of configuration resilience and the primary bootset filename

3. VPN 3.3 Site-to-site VPN

the

boots

set: bootset

1. Headend VPN device: It is located at the head quarters, and serves as primary VPN device. 2. VPN access device: It is located at the remote end (of a teleworkers or a branch office) and works as remote end VPN access device. 3. VPN tunnel: It is logical pipe through which the data flows from one end of the VPN tunnel to the other end. 4. Broadband service: Of course, it the service normally provided by the ISP over which an organization or a teleworkers accesses the Internet. IPSEC: The two primary security services that are provided by IPSec are: 1. Authentication Header (AH), and 2. Encapsulating Security Payload Given below are the important protocols or suite of protocols used frequently with IPSec: ESP: Encapsulating Security Payload (ESP) provides confidentiality, in addition to authentication, integrity, and anti-replay. ESP can be used alone, or in combination with AH. ESP uses HMAC-MD5 and HMAC-SHA algorithms to provide authentication functions. VPN uses Data Encryption Standard (DES), triple-DES (3DES), RC5, RC4, or Advanced Encryption Standard (AES) for encryption The figure below shows the ESP packet. As shown in the figure, the following fields are encrypted: 1. Application Data 2. ESP Trailer consisting of a) Padding, b) Padding Length, and c) Next Header fields.

The following fields are signed for data integrity, but not encrypted: 1. ESP Header 2. ESP Authentication Note that IP Header field is neither signed nor encrypted. AH: Authentication Header (AH) provides authentication, integrity, and anti-replay for the entire packet (both the IP header and the data payload carried in the packet). It does not provide confidentiality, which means it does not encrypt the data. The data is readable, but protected from modification. AH uses the HMAC algorithms. HMAC Authentication. It provides the authentication of the sender, and ESP provides encryption of the payload Hash-based message authentication code (HMAC): HMAC is a mechanism for calculating a message authentication code involving a hash function in combination with a secret key. This can be used to the integrity and authenticity of a message. Other hash based algorithms include DES, triple DES, and AES. Diffie-Hellman (DH) can be used to dynamically generate symmetrical keys to be used by symmetrical algorithms. The proper order for creating IPSEC tunnel (Phase 2) that is usually followed is given below: 1. Create extended ACL: create an access-list and define the traffic we would like the router to through the VPN tunnel

Example: In this example, it would be traffic from one network to the other, 10.10.10.0/24 to 20.20.20.0/24. Access-lists that define VPN traffic are sometimes called crypto access-list or interesting traffic access-list. R1(config)# ip access-list R1(config-ext-nacl)# permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255

extended VPN-TRAFFIC

2. Create IPSec Transform: Next step is to create the transform set used to protect our data. Example: R1(config)#crypto ipsec transform-set TSET esp-3des esp-md5-hmac The above command defines the following: ESP-3DES - Encryption method MD5 - Hashing algorithm TSET is the transform set we have created 3. Create Crypto Map: The Crypto map is the last step of our setup and connects the ISAKMP (defined in Phase 1) and IPSec configuration (Phase 2) together: R1(config)# crypto R1(config-crypto-map)# set R1(config-crypto-map)# set R1(config-crypto-map)# match address VPN-TRAFFIC

map CMAP 10 ipsec-isakmp peer 2.2.2.2 transform-set TSET

We've named our crypto map CMAP. The ipsec-isakmp tag tells the router that this crypto map is an IPsec crypto map. Although there is only one peer declared in this crypto map (2.2.2.2), it is possible to have multiple peers within a given crypto map 4. Apply crypto map to the public interface: The final step is to apply the crypto map to the outgoing interface of the router. Here, the outgoing interface is FastEthernet 0/1. R1(config)# interface FastEthernet0/1 R1(config- if)# crypto map CMAP Note that you can assign only one crypto map to an interface. As soon as we apply crypto map on the interface, we receive a message from the router that confirms isakmp is on: "ISAKMP is ON". At this point, we have completed the IPSec VPN configuration on the Site 1 router. ing IPSEC VPN: 1. show crypto isakmp sa detail - See the details for the IKE Phase 1 tunnel that is in place 2. show crypto ipsec sa detail - See the details for the IKE Phase 2 tunnels that are in place. There is one inbound Security Association (SA) and one outbound. They both have different SA numbers used for tracking these sessions. 3. show crypto engine connections active - Command provides stats to if the encryption and decryption is working. 4. show crypto map - Provides the details of the crypto map, and where it is applied, showing the contents of the IKE Phase 2 transform sets, the current peer and other information. Once you configure PKI, it is necessary to whether all the policies are in place. You can issue the command show crypto isakmp policy for this purpose. This command has no arguments. The following is sample output from the show crypto isakmp policy command, after two IKE policies have been configured (with priorities 15 and 20, respectively):

The command shows the map name, peer ip address, Extended Access List, Security Association life time, List of transform sets, whether PFS is used or not. This show command is very useful in finding bugs with the VPN configuration. Typical output is as given below:

show crypto ipsec sa command shows IPsec Security Associations (SAs) built between peers. This output shows an example of the show crypto ipsec sa command. interface : FastEthernet0 Crypto map tag: test, local addr. 14.1.1.1 local ident (addr/mask/prot/port) : (20.2.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port) : (10.2.1.0/255.255.255.0/0/0) current_peer: 14.1.1.2 PERMIT, flags={origin_is_acl,} #pkts encaps: 8867918, #pkts encrypt : 8867918, #pkts digest 8867918 #pkts decaps: 8860382, #pkts decrypt : 8860382, #pkts 8860382 #pkts compressed: 0, #pkts decompressed : 0 #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0, #send errors 1, #recv errors 0 local crypto endpt.: 14.1.1.1, remote crypto endpt. : 14.1.1.2 path mtu 1500, media mtu 1500 The encrypted tunnel is built between 14.1.1.1 and 14.1.1.2 for traffic that goes between networks 20.2.1.0 and 10.2.1.0. You can see the two Encapsulating Security Payload (ESP) SAs built inbound and outbound. show crypto map - Displays which components are included in the crypto map, including the ACL, the peer address, the transform set, and where the crypto map is applied. show crypto ipsec sa - Shows whether the IPSec tunnel is operational. The IPsec or IKE Phase 2 consists of two unidirectional tunnels. There is one in forward direction and the other in the reverse direction. They have different SPIs (Security Parameter Indexes), but together, these two uni-directional tunnels make up the "IPsec" tunnel.

show crypto isakmp sa - See the details for the IKE Phase 2 tunnels that are in place.show crypto engine connection active Site-to-Site VPN tunnels is established in 2 phases Phase 1 negotiations include these steps: A. The devices exchange credentials: The credentials can be a certificate or a pre-shared key. Both gateway endpoints must use the same credential method. If one peer uses a pre-shared key, the other peer must also use a pre-shared key, and the keys must match. If one peer uses a certificate, the other peer must also use a certificate. B. The devices identify each other: Each device provides a Phase 1 identifier, which can be an IP address, domain name, domain information, or an X500 name. The VPN configuration on each peer contains the Phase 1 identifier of the local and the remote device, and the configurations must match. C. The peers decide whether to use Main Mode or Aggressive Mode. Phase 1 negotiations can use one of two different modes: Main Mode or Aggressive Mode. The device that starts the IKE negotiations (the initiator) sends either a Main Mode proposal or an Aggressive Mode proposal. The responder can reject the proposal if it is not configured to use that mode. Aggressive Mode is less secured but faster than Main Mode. When you use Aggressive mode, the number of exchanges between two endpoints is fewer than it would be if you used Main Mode, and the exchange relies mainly on the ID types used in the exchange by both appliances. Aggressive Mode does not ensure the identity of the peer. Main Mode ensures the identity of both peers, but can only be used if both sides have a static IP address. D. The peers agree on Phase 1 parameters. Whether to use NAT traversal Whether to send IKE keep-alive messages E. The peers agree on Phase 1 Transform settings. Transform settings include a set of authentication and encryption parameters and the maximum amount of time for the Phase 1 SA. The settings in the Phase 1 transform must exactly match a Phase 1 transform on the IKE peer, or IKE negotiations fail. The items you can set in the transform are: 1. Authentication: The type of authentication (SHA1 or MD5). 2. Encryption: The type of encryption algorithm (DES, 3DES or AES). 3. SA Life: The amount of time until the Phase 1 Security Association expires. 4. Key Group: The Diffie-Hellman key group

3DES, RC4 are legacy encryption schemes, and it is recommended to replace the same with AES. MD5 is an older integrity check algorithm, and it is recommended to replace the same with SHA-256 or better. SHA-256, SHA-384, and SHA-512 are next gen algorithms for integrity check.

3. VPN 3.2 Remote access VPN To use ASDM, you need to enable the HTTPS server, and allow HTTPS connections to the security appliance. All of these tasks are completed if you use the setup command Remote Access VPN: Remote access VPN connections enable s working at home or on the road to access a server on a private network using the infrastructure provided by a public network, such as the Internet. From the 's perspective, the VPN is a point-to-point connection between the computer (the VPN client) and an organization's server. The may not be aware of the networking used as it appears logically that the data is sent over a dedicated private link.

Gateway-to-Gateway VPN: a gateway-to-gateway VPN connection allows for two routers to securely connect to each other and for a client on one end to logically appear as if they are a part of the network on the other end. This enables data and resources to be shared more easily and securely over the Internet. Configuration must be done on both routers to enable a gateway-to-gateway VPN. AnyConnect Always-on VPN - The ASA can configure AnyConnect to automatically establish and maintain an SSLVPN session as soon as the logs into their operating system. If you use identity certificates, instead of a name/, the will not be prompted at all and the VPN experience will be totally transparent and in the background. 1. A GUI based device management tool for working with and monitoring Cisco routers. 2. Enables network s to organize and manage multiple routers in the site by grouping, called device community. 3. C does not require a separate license 4. C Express may be run as a Java applet from the computer that is connecting to the router. C Express is a watered down version of C Professional. 5. C is a software tool that is typically installed on a Windows computer and run in conjunction with Cisco networking device(s) The following are the important features of C (Cisco Configuration Professional): 1. Cisco Configuration Professional s secure protocols such as Secure Shell (SSH) Protocol and Secure HTTP (HTTPS) to communicate with the devices. 2. Cisco Configuration Professional manages only Cisco devices 3. Currently there is no limitation on the number of communities that can be created. 4. When you move away a router from one community to another, you need to rediscover the routers in the new community. 5. Cisco Configuration Professional is a GUI device-management tool for Cisco IOS Software-based access routers, the Cisco Integrated Services Routers 6. A community is a group of devices that are managed together Cisco Configuration Professional menu bar contains the following options: 1. Manage Community- allows you to create a new community or choose an existing community. 2. Create Profile - allows you to restrict s from using all of the features that are available in the left navigation pane. 3. Import Profile - allows you to import a profile. 4. Options-allows you to set preferences such as log level, show community at startup, and show CLI preview parameters. 5. Template - allows you to create, edit, or apply a template. 6. Work Offline - allows you to work with Cisco Configuration Professional in offline mode. 7. Exit-Exits the Cisco Configuration Professional application.

As shown in the figure above, Cisco Configuration Professional (C) display consists of the following: 1. Menu Bar-The row of menus across the top of the window. It offers application services, a list of open windows, and online help. 2. Toolbar-The row of icons directly below the menu bar. They represent the most often used application services and most often configured networking features. 3. Left Navigation Pane-The scalable on the left side of the content pane in which you select the features to configure and monitor. 4. Content Pane-The right side of the workspace, in which windows appear. You view reports here and enter information that configures networking features. 5. Status Bar-The bar at the bottom of the window. Where Cisco displays the status of the application The following conditions should be satisfied for successful communication with router using C: The router should be enabled to HTTP or HTTPS. Use the command: Router(config)# ip http authentication local Or Use the following command for enabling https Router(config)# ip http secure-server 2. name with privilege level 15 rights should be created on the router. Use the command: Router(config)# name privilege 15 secret cisco 3. The authentication for HTTP/S should be set to use the local database (the runningconfig) on the router. Use the command:

Router(config)# ip http authentication local Of course, you need to connect to the router physically, using an Ethernet or cross over cable, and the router interface should be reachable. You can the reachability using a ping command to the router interface at the DOS prompt. Important points on C 1. A router needs to a community before being istered using C 2. A community may contain a maximum of 10 devices 3. To have C discover all the devices in a community, check the Discover All Devices check box, 4. To a community, you should provide IP address or hostname and the name and information for the device. 5. When using C, in appropriate signature screen, highlight signature, click the Enable button, and then click the Unretire button (just to confirm that it is not retired). 6. When you click the Apply Changes button, C applies the changes to the router, which requests the router to recompile the changes. Features of AnyConnect SSL VPN Client: 1. Full install of AnyConnect software is required on the client machine. 2. Full access to the corporate network as if you were accessing the local network 3. Clients are assigned their own virtual IP address to use while accessing the corporate network. 4. AnyConnect is ed on several operating systems including Windows, Linux, Android, etc. Features of Clientless SSL VPN: 1. Clientless SSL VPN lets s establish a secure, remote-access VPN tunnel to a security appliance using a web browser. s do not need a software or hardware client. 2. Clientless SSL VPN provides secure and easy access to a broad range of web resources and web-enabled applications from almost any computer on the Internet. 3. Browser cookies are required for the proper operation of clientless SSL VPN. When cookies are disabled on the web browser, the links from the web portal home page open a new window prompting the to once more

SSL VPN is provided for Windows, Macintosh, Linux, Apple's iOS, Android, and Windows Mobile with the appropriate licenses on the server, where the licenses are managed. Split tunneling: Split tunneling is a computer networking concept which allows a mobile to access dissimilar security domains like a public network (e.g., the Internet) and a local LAN or WAN at the same time, using the same or different network connections. With split tunneling enabled on the remote VPN client machine, it separates corporate traffic and web-bound traffic. Only the traffic bound to the corporate office may be tunneled using secure VPN, while all other traffic such as visiting www sites etc. may be forwarded directly to the web instead of going to the ASA firewall through VPN tunnel. The negative side is that the security of the internal network may be weakened if proper security measures are not taken on the remote client machine. Installing IDS on the remote machine is preferred when split tunneling is configured. Split tunnel option enables AnyConnect and Remote Access VPNs is to send traffic down the VPN only if it is destined for specific networks located at the headquarter site. All other traffic is sent normally, outside the VPN. This way, the bandwidth could be saved as there will be less amount of traffic traversing VPN tunnel via head-quarters. However, note that there is some amount of compromise on the security aspect, as the split tunnel is not secure as the outside traffic is sent normally and no encryption takes place.

You can monitor the remote access VPN s by navigating to Monitoring > VPN > VPN Statistics > Sessions in your ASA Security Device Manager. Cisco Anyconnect VPN client: Employees may connect to the Internet from several public locations, such as airports and cafes, they had no acceptable use policy enforcement, minimal protection against malware, and are at a higher risk of data loss. Cisco's AnyConnect Secure Mobility may be used to extend the network perimeter to remote endpoints, enabling the seamless integration with the Corporate network. Cisco has developed the AnyConnect Secure Mobility Client as a "next generation" Virtual Private Network (VPN) client. The connection is secure because both the and device must be authenticated and validated prior to being provided access to the corporate network. When a opens a VPN session using Cisco AnyConnect, the AnyConnect client connects to the adaptive security appliance using SSL. The client authenticates with the adaptive security appliance and is assigned an internal IP address on the network. AnyConnect Clients are available on various platforms, including the following: 1. Cisco anyconnect VPN client windows 7 2. Cisco anyconnect VPN for windows 8 3. Cisco VPN windows 10 4. Cisco Anyconnect VPN for Android 5. Cisco anyconnect VPN client iPhone iPad 6. Cisco anyconnect VPN client for mac It is important to note that Cisco AnyConnect Client is central to BYOD concept and its borderless networking concept.

Note that remote s connecting to the internal resources using secure VPN tunnel use their internal IP address. As such, they should be treated as internal s and should be exempted from NAT translation. Similarly, you should not use NAT on traffic coming from inside devices (say, file server) and going out to the VPN clients.

3. VPN 3.1 VPN Concepts Two types of VPNs that are widely used: 1. Remote access VPNs - here a teleworker may access head quarters securely using VPN access using public Internet. Remote-access VPNs can use IPsec or SSL technologies for their VPN. 2. Site-to-site VPNs - here, the VPN connectivity is provided between two sites. By this, anybody accessing any host on the second site can connect and transfer information securely even though there is no secure connectivity from the host. Communication will be secured when the packet leaves the corporate network. The VPN tunnel ends after it enters the remote site. Site-to-site VPNs traditionally use a collection of VPN technologies called Ipsec. The benefits of implementing Virtual Private Networks (VPNs) include the following: The benefits of implementing Virtual Private Networks (VPNs) include the following: 1. Data integrity - the data contained in the packets can't be changed by attacker 2. Data confidentiality or privacy - an attacker will not be able to see or read the data 3. Authentication - the sender is the one who claims to be. 4. No replay - it is not possible to replay properly configured, secure VPN communication. The VPN can be implemented in any of the following combinations: 1. Gateway-to-gateway VPN 2. Gateway-to-host VPN 3. Host-to-gateway VPN

4. Host-to-host VPN

The host-to-host configuration provides the highest security for the data. However, a Gate-to-Gateway VPN is transparent to the end s. IKE Phase 1 configuration: 1. Specify the interface to be used for VPN 2. Specify the remote peer IP address 3. Provide pre-shared key (or digital certificate). Required for authenticating itself with the peer. 4. Specify IKE Phase 1 Policies (Optional, you may use default or custom) IKE Phase 2 configuration: 1. Define transform-sets (Optional): The policies used for IKE Phase 2 are called transform sets. A transform set refers to the methods of encryption and hashing that you want to use for the IKE Phase 2 tunnels. that whatever you choose here, you also need to configure on the other router, as well. 2. Configuring the ACL used to classify which traffic should be protected by IPsec 3. Finish or commit the configuration changes. The next step would be to configure the peer router. For this purpose, an option called "Configure Mirror" is available soon after finishing one end. You can make necessary changes (if any) and commit the configuration to the peer router with one click. IKE Phase 1 steps: Step 1: Negotiate the IKE Phase 1 Tunnel. The end points of the VPN tunnel need to agree on: 1. Hash algorithm: This could be message digest 5 algorithm (MD5) or Secure Hash (SHA) on most devices. 2. Encryption algorithm: This could be DES/3DES/AES 3. Diffie-Hellman (DH) group to use: Group 1 uses 768 bits, group 2 uses 1024, and group 5 uses 1536. 4. Authentication method: Used for ing the identity of the VPN peer on the other side of the tunnel. Uses preshared key (PSK) or RSA signatures 5. Lifetime: How long until this IKE Phase 1 tunnel should be torn down Step 2: Run the DH Key Exchange Step 3: Authenticate the Peer; the authentication could be done either using a PSK or using RSA digital signatures. The purpose of IKE phase 2 is to negotiate IPSec SAs to set up the IPSec tunnel. IKE phase 2 performs the following functions: 1. Negotiates IPSec SA parameters protected by an existing IKE SA 2. Establishes IPSec security associations 3. Periodically renegotiates IPSec SAs to ensure security 4. Optionally performs an additional Diffie-Hellman exchange This IKE Phase 1 tunnel is used for only management purpose. To protect the end 's packets, the two VPN devices build a second tunnel for the sole purpose of encrypting the end- packets. This second tunnel is called the IKE Phase 2 tunnel; it is also commonly referred to as the IPsec tunnel. The basic configuration steps are as given below. Given below are the steps involved in configuring clientless VPN connection using ASASDM: 1. Enter Connection profile name and SSL VPN Interface

2. Select the Digital Certificate to used to authenticate the ASA 3. Connection Group Alias/URL 4. Authentication 5. Create/Modify Group Policy 6. Create/Edit Bookmark Lists Note that a clientless VPN connection does not require any software be installed specially on the client machine.

There are several types of VPN technologies available, and not all are used for the same purpose. MPLS VPN, GRE, and IPSec are most popular VPN technologies used in site-to-site VPN. IPSec and SSL are most widely used for remote access VPN.

2. Secure Access 2.3 802.1X authentication IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. Important features of 802.1X on wired networks: 1. Visibility: 802.1X provides greater visibility into the network because the authentication process provides a way to link a name with an IP address, MAC address, switch, and port. 2. Security: 802.1X provides a strong authentication method. 802.1X acts at Layer 2 in the network, allowing you to control network access at the access edge. 3. Identity-based services: 802.1X enables you to leverage an authenticated identity to dynamically deliver customized services. For example, a might be authorized into a specific VLAN or assigned a unique access list that grants appropriate access for that . 4. Transparency: It is possible to deploy 802.1X in a way that is transparent to the end . 5. and device authentication: 802.1X can be used to authenticate devices and s. Features not available in 802.1X: 1. Legacy endpoint : By default, 802.1X provides no network access to endpoints that cannot authenticate because they do not 802.1X. 2. Delay: By default, 802.1X allows no access before authentication. 802.1X authentication involves three parties: 1. Supplicant: The supplicant is a client device (such as a laptop) that wishes to attach to the LAN/WLAN. The term "supplicant" is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software ing the RADIUS and EAP protocols. 2. Authenticator: The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. With 802.1X port-based authentication, the supplicant provides credentials, such as name/ or digital certificate, to the authenticator. 3. Authentication server: An authenticator forwards the credentials to the authentication server for verification. If the authentication server determines the credentials are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network. Example: Consider the following configuration commands: authentication authentication

order priority

mab mab

dot1x dot1x

web-auth web-auth

authentication event authentication fallback web-auth

fail

action

next-method

Supplicant authentication using MAB and IEEE 802.1X are failing, and the third authentication method Web-Auth is not enabled . Solution: As per the given commands, MAB (MAC Authentication By) will be tried first. If MAB fails, dot1x authentication will be tried, and lastly the web-auth authentication. Since, both MAB and dot1x are failing, and web-auth is not enabled yet, the supplicant will never get any kind of access to the network. There are some variations possible in the configuration. For example, consider: authentication authentication priority dot1x mab

order

authentication event authentication event no-response authorize VLAN 123

mab fail

action

dot1x next-method

In the above command sequence, if the auth-fail VLAN is configured, endpoints that fail IEEE 802.1X authentication after successful MAB will be placed in the auth-fail VLAN, and no other methods will be attempted. This will ensure, indefinite attempts are not made to dot1x after each successful mab attempt. The same is depicted in the figure below:

Example: A Cisco switch is configured with the following commands: authentication order authentication priority authentication event fail action authorize vlan 123

mab dot1x

dot1x mab

Though MAB is authenticating, supplicant authentication using IEEE 802.1X is failing. If a device fails IEEE 802.1X authentication after successful MAB (short for MAC Authentication By), the device will have temporary network access between the time MAB succeeds and IEEE 802.1X authentication fails. What happens next depends on the configured event-fail behavior.

1. If next-method is configured and a third authentication method (such as WebAuth) is not enabled, then the switch will return to the first method (MAB) after the held period. MAB will succeed, and the device will again have temporary access until and unless the supplicant tries to authenticate again. This behavior is supplicant dependent. Some supplicants will give up on IEEE 802.1X authentication after some number of failures, and some may continue forever. If the supplicant stops attempting IEEE 802.1X authentication altogether, then the device will eventually end up with MAB-authorized access. 2. If the supplicant continues to attempt IEEE 802.1X authentication, then the device will have intermittent access as it cycles between successful MAB and failed IEEE 802.1X authentication. To avoid this potential loop, you can specify an authentication failure behavior. The two options are a) Next-method with local WebAuth and b) the auth-fail VLAN Internet edge: It typically houses ASA firewall, WLC, and MDM devices. MDM (Mobile Device Management) module provides all policies and profiles, digital certificates, applications, and configuration settings for all the BYOD devices. The WAN module in cloud-based deployment provides: 1. MPLS VPN connectivity for the branch office to corporate network, 2. Internet access to the branch offices, 3. Access to cloud-based MDM functionality. MDM provides all the policies and profiles, digital certificates, applications and configuration settings for all BYOD devices.

2. Secure Access 2.2 AAA Concepts AAA stands for Authentication, Authorization, and ing. Four important aspects of security are authentication, authorization, integrity, and non-repudiation. Authentication: Authentication provides the method of identifying s, primarily using and . The communication is usually encrypted. Authentication is the way a is identified prior to being allowed access to the network and network services. Authentication is the process of identifying an individual, usually based on a name and . Authentication is based on the idea that each individual will have unique information that sets him or her apart from other s. Authorization: Authorization provides authorization for access to network resources. Remote security servers, such as RADIUS and TACACS+, authorize s for accessing specific resources by associating attribute-value (AV) pairs, which define those rights, with the appropriate . The authorization process determines whether the has the authority to issue such commands. Simply put, authorization is the process of enforcing policies: determining what types or qualities of activities, resources, or services a is permitted. Usually, authorization occurs within the context of authentication. Once you have authenticated a , they may be authorized for different types of access or activity. Authorization is the process of granting or denying a access to network resources once the has been authenticated through the name and . The amount of information and the amount of services the has access to depend on the 's authorization level. ing: ing is carried out by logging of session statistics and usage information and is used for authorization control, billing, trend analysis, resource utilization, and capacity planning activities. ing is the process of keeping track of a 's activity while accessing the network resources, including the amount of time spent in the network, the services accessed while there and the amount of data transferred during the session. ing data is used for trend analysis, capacity planning, billing, auditing and cost allocation. By default, a Cisco IOS device performs authentication based on a line and authorization based on a level 15 enable . This is a problem for any organization that desires granularity or the ability to track activities back to one of multiple s. The solution to this is AAA, an acronym for Authentication, Authorization and ing. This allows an to configure granular access and audit ability to an IOS device. To enable this more advanced and granular control in IOS, we must first use the "aaa new-model" command. Integrity: Integrity ensures that the data is not compromised. A simple integrity checker is parity. By ensuring that the parity of a transmitted message is correct, you can accept the message. For complex systems, where confidential information is involved, encryption is used for ing the integrity of a transmitted message. Non-repudiation: Non-repudiation ensures that the sender, as well as the receiver cannot refute having sent or received a message. For example, you receive an email from your perspective employer. By using an unsigned email, it might so

happen that your employer later denies having sent any such email. Non-repudiation ensures that neither the sender nor the receiver can deny the transmission or the reception of a message respectively. Given below are the steps in brief that one needs to go through for configuring AAA. On the client side: 1. Configure AAA aaa new model 2. Specify AAA server to be accessed by the client tacacs-server host 192.168.1.2 key cisco@123 3. Create a name method list. MYAUTHLIST is used for example only. You can use whichever name you want. aaa authentication MYAUTHLIST group tacacs+ local 4. Create authorization method list to apply on s that have been authenticated. aaa authorization exec MYAUTHORIZATIONLIST group tacacs+ local 5. Apply the method lists to a device interface line vty 0 4 authentication MYAUTHLIST authorization exec MYUAUTHORIZATIONLIST The given command is: aaa authentication CONSOLE line In the above command: i) The named list is CONSOLE. ii) There is only one authentication method (line). Once a named list (in this example, CONSOLE) is created, it must be applied to a line or interface for it to come into effect. This is done using the authentication list name command: line exec-timeout 0 cisco authentication CONSOLE

con 0 0

You need to enter the "cisco" (configured on line con 0) to get console access. The default list, if specified, is used on tty, vty and aux. The syntax for a method list is as follows: aaa type { default | list-name} method-1 [ method-2 method-3 method-4] Given the AAA command: aaa authentication default group radius local In the above command: 1. AAA type is authentication 2. The named list is the default one (default). 3. There are two authentication methods (group radius and local). All s are authenticated using the Radius server (the first method). If the Radius server doesn't respond, then the router's local database is used (the second method). For local authentication, define the name name and :name xxx yyy Because we are using the list default in the aaa authentication command, authentication is automatically applied for all connections (such as tty, vty, console and aux)

Example1: Creating the method list. R1(config)# aaa authentication AUTHLIST local ! Applying the method list to the VTY lines 0-4 R1(config)# line vty 0 4 R1(config-line)# authentication AUTHLIST R1(config-line)# exit If you want to see which method lists were applied to your vty lines, just navigate to Configure > Router > Router Access > VTY Example2: The sequence of steps in creating and applying a method list on a router are: 1. Enable AAA 2. Create method lists for authentication. You may create more than one method. The second method (local) is used only when the first method fails. 3. Apply the method lists per line/ per interface The following security measures are appropriate for each plane in Network Foundation Protection strategy: 1. Management Plane: AAA; Authenticated Network Time Protocol (NTP); SSH, SSL/TLS, Protected syslog, SNMPv3, TACACS+, VTY ACLs 2. Control Plane: Control plane policing (CoPP), and control plane protection (Pr), Authenticated routing protocol updates 3. Data plane: ACLs, Layer 2 controls, such as private VLANs, Spanning Tree Protocol (STP) guards IOS IPS, Zone-Based Firewall 4. T Intercept: protect servers and other resources from denial of service (DoS) attacks, specifically T SYN attacks 5. Unicast Reverse Path Forwarding: limit the appearance of spoofed addresses on a network 6. IOS IPS: uses signature matches to look for malicious traffic. 7. ACLs: filters traffic based on pre-determined rules For the authentication method list and authorization method list to be used we need to apply these method lists to the VTY lines. The following security measures may be applied to Management Plane: 1. Authentication, Authorization, and ing (AAA) 2. Network Time Protocol (NTP) 3. Secure Shell (SSH) 4. SSL/TLS 5. Protected syslog 6. SNMPv3 7. Parser views Below is the configuration steps to apply the authentication and authorization method list to first 5 vty lines R1>enable R1#configure R1(config)#line R1(config-line)# R1(config-line)#authorization exec authortest

vty 0

terminal 4 authentication authentest

TACACS+ Technology:TACACS+ is a security application that provides centralized validation of s attempting to gain access to a router or network access server. TACACS+ services are maintained in a database on a TACACS+ daemon

running, typically, on a UNIX or Windows NT workstation. We must have access to and must configure a TACACS+ server before the configured TACACS+ features on a network access server are available. It provides for separate and modular authentication, authorization, and ing facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each service authentication, authorization, and ing independently. Each service can be tied into its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon. The goal of TACACS+ is to provide a methodology for managing multiple network access points from a single management service. The Cisco family of access servers and routers and the Cisco IOS interface (for both routers and access servers) can be network access servers. Syntax: Router(config)# tacacs-server host key Ex: Router(config)#tacacs-server host 192.168.10.1 key cisco123 Feature of TACACS+ Server 1. Granular control: TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and ing. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and ing. TACACS+ is very commonly used for device istration. 2. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. 3. TACACS+ is a Cisco proprietary protocol (later became an Open standard), and very widely ed by various vendors offering AAA servers. Note that RADIUS is an Open Standard and widely ed too. 4. TACACS+ uses T port (port #49) to communicate between the server and the client. Example: With respect to the given command " test aaa group tacacs+ Frisco123 legacy ", the following are true: 1. It enables you to that the ACS to router authentication component is working 2. Frisco123 is the shared secret that has been configured on the ACS server 3. It tests the reachability of ACS server 4. tacacs+ is the group name TACACS+ provides two methods to control the authorization of router commands on a per- or per-group basis. The first method is to assign privilege levels to commands and have the router with the TACACS+ server whether or not the is authorized at the specified privilege level. The second method is to explicitly specify in the TACACS+ server the commands that are allowed, on a per- or per-group basis. TACACS offers multiprotocol . RADIUS Server: The following are the important features of RADIUS server: 1. Open standard, and widely ed. Note that TACACS+ is a Cisco proprietary standard, but well ed too. 2. Use UDP port 3. Provides extensive ing capability when compared with TACACS+ server 4. Only the is encrypted in packets transiting between the RADIUS server and the client (any device acting as client, such as a router or a switch or a host computer). On the other hand, TACACS+ provides complete encryption for communication between the TACACS+ server and the client. 5. There is a new upgrade expected, named Diameter. 6. RADIUS does not allow s to control which commands can be executed on a router and which cannot. Therefore, RADIUS is not as useful for router management or as flexible for terminal services. 7. RADIUS messages are sent as Datagram Protocol (UDP) messages. Only one RADIUS message is included in the UDP payload of a RADIUS packet. RADIUS does not these protocols:



AppleTalk Remote Access (ARA) protocol



NetBIOS Frame Protocol Control protocol



Novell Asynchronous Services Interface (NASI)



X.25 PAD connection

Authentication and Authorization using ACS: Cisco Access Control Server uses several components as described below: 1. Network device groups: Groups of network devices consisting of routers and switches 2. Network devices: The individual network devices such as routers and switches that go into the device groups. 3. Identity groups: / groups 4. s: Individual / s that are associated with identity groups. 5. Authorization profiles: control the permitted rights given to / groups and/or the network device groups. Cisco Identity Services Engine (ISE) provides context-aware identity management in the following areas: 1. Cisco ISE determines whether s are accessing the network on an authorized, policy-compliant device. 2. Cisco ISE establishes identity, location, and access history, which can be used for compliance and reporting. 3. Cisco ISE assigns services based on the assigned role, group, and associated policy (job role, location,device type, and so on). 4. Cisco ISE grants authenticated s with access to specific segments of the network, or specific applications and services, or both, based on authentication results. Cisco ISE functions include the following: 1. Combines authentication, authorization, ing (AAA), posture, and profiler into one appliance 2. Enforces endpoint compliance, including 802.1X environments 3. Provides for discovery, profiling, policy-based placement, and monitoring of endpoint devices on the network 4. s scalability to a number of deployment scenarios from small office to large enterprise environments 5. ISR (Integrated Services Router): Provides WAN and Internet access to branch offices and home offices. They can provide VPN connectivity to BYOD devices while accessing the Corporate network. 6. ASR (Aggregation Services Router): Provides WAN and Internet access at Corporate campus, and also work as aggregation point for home and branch offices connecting back to the Corporate network. 7. CWS (Cloud Web Security): Provides enhanced security to BYOD devices while accessing the Internet. 8. ASA (Adaptive Security Appliance): Cisco ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defense that stops attacks before they spread through the network.

2. Secure Access 2.1 Secure management SNMPv3: The SNMPv3 Agent s the following set of security levels as defined in the USM MIB (RFC 2574) : noAuthnoPriv - Communication without authentication and privacy.

authNoPriv - Communication with authentication and without privacy. The protocols used for Authentication are MD5 and SHA (Secure Hash Algorithm). authPriv - Communication with authentication and privacy. The protocols used for Authentication are MD5 and SHA ; and for Privacy, DES (Data Encryption Standard) may be used. The main difference between SNMPv3 and v2 (or v1) is that the v3 version addresses the security and privacy issues. For example, in SNMPv2, s are transmitted in plain text, whereas v3 uses encryption. The advantages are given below, in brief: 1. Authentication 2. Privacy 3. Authorization and Access Control 4. Remote configuration and istration capabilities Security Models and Security Levels ed by Cisco IOS

Security Model

Security Level

Authentication

Encryption Type

SNMPv1

noAuthNoPriv

Community string

None

SNMPv2c

noAuthNoPriv

Community string

None

SNMPv3

noAuthNoPriv

name

None

AuthNoPriv

MD5 or SHA

None

authPriv

MD5 or SHA

CBC-DES (DES-56)

Access-List: There are two types of access lists, Standard Access Lists and Extended Access Lists. Extended Access Lists can use the following information for packet filtering: 1. Source address 2. Destination address 3. Source port 4. Destination port 5. T synchronization information. Wild card masking : Wild card masking is used to permit or deny a group of addresses. For example, if we have a source address 185.54.13.2 and want all the hosts on the last octet to be considered, we use a wild card mask, 185.54.13.255. Special cases : Host 185.54.13.2 is same as 185.54.13.2 with a wild card mask of 0.0.0.0, considers only specified IP. Any is equivalent to saying 0.0.0.0 with a wild card mask of 255.255.255.255. This means none of the bits really matter. All IP addresses need to be considered for meeting the criteria. The following options are true about access lists: 1. Controlling traffic through a router, and 2. Controlling VTY access to a router's VTY ports

Broadcast traffic may be controlled by using storm control or other means. An ACL can not identify any virus or malware. You need special anti-malware software, such as Advanced Malware Protection (AMP) for doing this function. AMP also continuously analyzes file activity across your extended network, so you can quickly detect, contain, and remove advanced malware. The following commands can be used to view access lists: sh ip access-list sh access-list The command sh ip access-list displays all ip access lists. The command sh access-list displays the details of particular access-list number defined. Static packet filtering uses access lists for applied on incoming/outgoing interfaces of a network device such as a router. Monitoring IP access-list 1. Show ip interface: Provides lot of information on interface and protocol status. An example command output is given below: router>show ip interface

Ethernet 0 is up, line protocol is up IP address is 10.210.93.51 /16 MTU 1500 bytes, BW 0 Mbps

Loopback 0 is up, line protocol is up IP address is 10.10.10.10 /32 MTU 32768 bytes, BW 0 Mbps POS 1/1/2 is istratively down, line protocol is down IP address is 206.1.1.10 /24 MTU 4470 bytes, BW 622 Mbps 2. show running-configuration The show running-config command shows the router, switch, or firewall's current configuration. The running-configuration is the config that is in the router's memory. Any changes to the config is not saved until you do a copy running-configuration startup-configuration. This command can be abbreviated sh run. 3. show access-list: Displays access-list information. 4. show protocol: Displays the protocols. Typical output is shown in figure below: Router#show protocols

Global values: Internet Protocol routing is enabled FastEthernet0/0 is up, line protocol is up Internet address is 20.0.0.2/24 FastEthernet0/1 is up, line protocol is up Internet address is 33.0.0.2/24 Loopback0 is up, line protocol is up Internet address is 3.3.2.2/24

Compare the same with "show ip protocol", which has a typical output as shown below: Router#show ip protocols

Routing Protocol is "ospf 1" Outgoing update filter list for all interfaces is not set Incoming update filter list for all interfaces is not set Router ID 3.3.2.2 Number of areas in this router is 1. 1 normal 0 stub 0 nssa Maximum path: 4 Routing for Networks: 0.0.0.0 255.255.255.255 area 0 Reference bandwidth unit is 100 mbps Routing Information Sources: Gateway Distance Last Update 4.4.3.3 110 00:02:12 1.1.1.1 110 00:00:21 Distance: (default is 110) Example: Please refer to the figure. The access-list has been configured on S0/0 of RTA in the outbound direction. Which packets will be permitted by the access-list?

Solution: The subnet mask for the IP subnet 192.168.2.32 can be calculated by subtracting the wildcard mask 0.0.0.15 from 255.255.255.255. (255.255.255.255 - 0.0.0.15 = 255.255.255.240). Once you know the subnet mask, and the subnet id, you can find the hosts that are denied by the access list. Therefore, host address range that is denied by the access-list 101 is 192.168.2.33 - 192.168.2.46. Note that the IP address 192.168.2.47 is broadcast address for the subnet. The IP addresses 192.168.2.49 and 192.168.2.30 are outside the subnet (192.168.2.32/28) denied by the access-list 101, and hence be allowed by RTA through its outgoing port S0/0. NTP: The device with ip address 192.168.7.1 is NTP master. The first entry shows 192.168.7.1. This indicates that the local machine has synced with itself. Generally, only an NTP master syncs with itself. The third column shows how many hops that the master clock is away from the local machine. It is called stratum in NTP terminology. 192.168.13.33 is 3 hops away as seen in the output.

1. 192.168.3.7 is the IP address of the peer the system is synchronized to. 2. precision is 2**19 is the precision of the clock of this system 3. Clock offset is 7.22 msec refers to the offset of system time to synchronized peer. 4. root delay - Total delay along the path to the root clock (in milliseconds) Router> show ntp status

Clock is synchronized, stratum 4, reference is 192.168.3.7 nominal freq is 250.0000 Hz, actual freq is 249.9990 Hz, precision is 2**19 reference time is AFE2525E.70597B34 (00:10:22.438 PDT Mon Jul 5 2014) clock offset is 7.22 msec, root delay is 132.36 msec root dispersion is 125.28 msec, peer dispersion is 5.98 msec The command "show clock [detail]" displays the time and date from the system software clock. The optional "detail" keyword indicates the clock source (NTP, VINES, hardware clock, and so on).

The following indicate whether the time is authoritative and synchronized: (blank) Time is authoritative. Example: Router> show clock detail

15:29:03.158 PST Thursday May 25 2017 Time source is NTP In the above example, the time is authoritative and the time source is NTP. The clock is synchronized. *Time is not authoritative. Ex: *15:29:03.158 PST Thursday May 25 2017 Time is authoritative, but NTP is not synchronized. Ex: .15:29:03.158 PST Thursday May 25 2017

1. Security Concepts 1.4 Network Topologies CAN: A campus area network (CAN) is a network of multiple interconnected local area networks (LAN) in a limited geographical area. A CAN is smaller than a wide area network (WAN) or metropolitan area network (MAN). A CAN is also known as a corporate area network (CAN).

Small office/home office (SOHO): Short for small office/home office, a term that refers to the small or home office environment and the business culture that surrounds it. A SOHO is often thought of as being the smallest of small businesses. It is a privately owned and operated business or individuals who are self-employed. SOHO is often characterized as being a small in both the size of the office space and number of employees. Cloud, Wide Area Network(WAN): Cloud networking (and Cloud based networking) is a term describing the access of networking resources from a centralized third-party provider using Wide Area Networking (WAN) or Internet-based access technologies. In cloud networking, the network can be shared as well as the computing resources. Cloud networking is related the concept of cloud computing, in which centralized computing resources are shared for customers or clients. In cloud networking, the network can be shared as well as the computing resources. It has spurred a trend of pushing more network management functions into the cloud, so that fewer customer devices are needed to manage the network. Data Center: Data centers are often served by communications networks that help aggregate data and allow them to flow through the system. This can be done in many ways, and some models have emerged for data center topology. For example, some follow a tree-based topology, including what is called a "three-tier data center" network with three layers: access, aggregate and core. A "fat tree" architecture is related to this general model. Other data center topologies include systems where one server "hub" is connected to many other servers or where different servers are cross-linked or cross-indexed for various types of functionality. For example, a "leaf-spine" approach adds various components to a central "spine layer" serving networks with heavy directional traffic. Other topologies, like the BCube, are made for a modular or "shipping container" data center approach. A "flattened butterfly" approach operates on a more two-dimensional level than many of the "cube" topologies, for some energy savings.

1. Security Concepts 1.3 Cryptography Concepts Hashing is used for data integrity that is ensuring that the data is not compromised. The three most popular types of hashes are as follows: 1. Message digest 5 (MD5): This creates a 128-bit digest. 2. Secure Hash Algorithm 1 (SHA-1): This creates a 160-bit digest. 3. Secure Hash Algorithm 2 (SHA-2): Options include a digest between 224 bits and 512 bits. Among the two hashing algorithms (MD5, 124 bit and SHA1 160 bit) SHA1 provides a stronger hashing algorithm. The following are true about encryption algorithms: 1. AES (Advanced Encryption Standard) is more secure than DES or 3DES. 2. AES is a symmetric block cipher that can encrypt (encipher) or decrypt (decipher) information 3. AES is based on Rijndael algorithm 4. PGP (Pretty Good Privacy) can use Diffie-Hellman or RSA algorithms, but not AES or DES. A transform set specifies one or two IPSec security protocols (either Encapsulation Security Protocol or Authentication Header or both) and specifies which algorithms to use with the selected security protocol. A cryptographic hash function is a "one-way" operation. It is practically not possible to deduce the input data that had produced the output hash. Hash Algorithms: Hash algorithms produce a hash of a message and encrypt it. They use a mathematical formula for hashing, and it is extremely difficult to tamper with the message and still produce the same hash. Basically, Hashing enable a recipient to check whether a message is received intact without being tampered by a third party. SHA (Secure Hashing Algorithms): There are several Secure Hashing Algorithms and they primarily differ in the hash length. They are SHA-1, SHA-256, SHA-384 and SHA-512. In SHA-1 the bit length is 160 bits, in SHA-256 it is 256 bits, for SHA-384, 384 bits and in SHA-512 it is 512 bits. MD2, MD4, MD5 (Message Digest Series Algorithms): These are another type of hash algorithms. These algorithms were developed by Rivest. All three algorithms take a message of arbitrary length and produce a 128-bit message digest. MD2 is meant for 8 bit machines and MD4, MD5 are suitable for 32 bit machines. These algorithms are primarily used for digital signature applications. Examples of acceptable transform combinations are:

1. ah-md5-hmac 2. esp-des 3. esp-3des and esp-md5-hmac 4. ah-sha-hmac and esp-des and esp-sha-hmac 5. comp-lzs It is very important to know the distinction between Hashing, Digital signature, and Encryption. Hashing produces a small footprint (basically, signature) of the original message. It is used to the integrity of a message. Hash is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same hash value. In other words, Hash used to ensure that transmitted messages have not been tampered with. Hashing ensures that the message is not tampered with, during transit or storage. Note that Hashing not necessarily encode or encrypt a message. A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message. A digital signature can be used with encrypted or even un-encrypted message. A digital certificate contains the digital signature of the certificate-issuing authority so that anyone can that the certificate is real. Digital signature ensures that the sender cannot repudiate having sent the message at a future date. Typically, the sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message (by using the same formula that was used to produce the Hash by the sender), and compares the two hashes. If they're the same, there is a very high probability that the message was transmitted intact. Encryption is used to translate a message in to secret code. To read an encrypted file, you must have access to a secret key that enables you to decrypt it. Encrypted data is referred to as cipher text. Encryption ensures that the message cannot be read by any person who do not have matching key to decode the coded message To define a transform set, use the command: crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]] where transform1, transform2 and transform3 are the allowable transforms. Example: crypto ipsec transform-set newer esp-3des esp-sha-hmac The following are authentication algorithms that could be used with the crypto ipsec transform-set command: ah-md5-hmac - AH with the MD5 (HMAC variant) authentication algorithm ah-sha-hmac - AH with the SHA (HMAC variant) authentication algorithm esp-md5-hmac - ESP with the MD5 (HMAC variant) authentication algorithm esp-sha-hmac - ESP with the SHA (HMAC variant) authentication algorithm The following are the encryption algorithms: esp-des - ESP with the 56-bit DES encryption algorithm esp-3des - ESP with the 168-bit DES encryption algorithm (3DES or Triple DES) esp-null - Null encryption algorithm To create the Public/Private key pair used by SSH, the following command sequence is used. Hostname other than the default "router" needs to be configured first before issuing the command crypto key generate rsa. You also need to configure the domain name before issuing the crypto key generate command. The correct sequence of commands would be: hostname Frisco ip domain-name cisco.com crypto key generate rsa The following is a sample output from the "show ssh" command:

Router# show ssh

Strong Encryption scheme DES: DES is an old "data encryption standard" from the seventies. Its key size is too short for proper security (56 effective bits; this can be brute-forced). Also, DES uses 64-bit blocks, which raises some potential issues when encrypting several gigabytes of data with the same key. 3DES reuses DES implementations by cascading three instances of DES (with distinct keys). 3DES is believed to be secure up to at least "2112" security (which is quite a lot, and quite far in the realm of "not breakable with today's technology"). But it is very slow, especially in software. AES: The Advanced Encryption Standard (AES), also known by its original name Rijndael is the successor of DES as standard symmetric encryption algorithm for US federal organizations and worldwide. AES accepts keys of 128, 192 or 256 bits, uses 128-bit blocks, and is efficient in both software and hardware. It was selected through an open competition involving hundreds of cryptographers during several years. Basically, you cannot have better than that. Note that AES is a symmetric cryptographic algorithm, while RSA is an asymmetric (or public key) cryptographic algorithm. Encryption and decryption is done with a single key in AES, while you use separate keys (public and private keys) in RSA. AES, the Advanced Encryption Standard is a symmetric block algorithm. AES is used to encrypt data. Both the sender and received need to have the key to encrypt and decrypt the data respectively. It is "symmetric" because the key allows for both encryption and decryption. SHA isn't encryption, it's a one-way hash function. AES (Advanced_Encryption_Standard) is a symmetric encryption standard. You use SHA functions to take a large document and compute a "digest" (also called "hash") of the input. It's important to realize that this is a one-way process. Any alteration to the document will produce a different hash, and you can easily recognize that the document had been tampered as the reproduced hash is different from the original hash value. It is impossible to reproduce the original hash after altering the document. In other words, "hash" positively identifies if a received document is altered or not. 1. Peer IP addresses: Implemented by Crypto map 2. Traffic to encrypt: Implemented by Crypto ACL, 3. Encryption method: Transform set, which is referred to in the crypto map 4. Hashing (HMAC) method: Transform set, which is referred to in the crypto map 5. Perfect Forward Secrecy (PFS) - Crypto map Message Authentication Codes (MACs): MAC also called "keyed hashes", are used to the authenticity of a message. Let us say, Jane (the sender of a message) and Mike (the recipient) share a secret key. Jane uses the message and the key to compute the MAC, and sends the MAC along with the message. When Mike receives the message, he computes the MAC, and then checks to see if his MAC matches Jane's. If it does, then he knows the message is from Jane and that nobody has changed it since she sent it.

A certificate revocation list (CRL) is a list of certificates, which have been revoked, and are no longer valid. PKI:In cryptography, X.509 is a standard for a public key infrastructure (PKI) and Privilege Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm. In public key infrastructure: 1. A key is required to encode/decode a message, and the security of a message depends on the security of key. 2. A cipher text is the encoded message, and

3. A certificate is a digitally signed document by a trusted authority. Public Key Infrastructure consists of two important certificates: 1. Root certificates - Identifies the Certificate Authority, CA, and 2. Identity certificates, which identify devices such as servers and other devices that want to participate in PKI. Configuring PKI on gateway router The command crypto map <map name> command is given at the interface level. The correct sequence is: Router1(config)# interface GigabitEthernet 1/0 Router1(config-if)# crypto map MyCmap -1 Router1(config-if)# exit Certificate Revocation List (CRL): It is a list of certificates with their serial numbers that had been revoked by the CA for whatsoever reason. Usually, the reasons are like expiry of the certificate (the time limit for validity of the certificate has expired) or that the private key has been compromised, and a new certificate had been issued, etc. A CRL could be accessed by several protocols, including LDAP and HTTP. A CRL could also be obtained via SCEP. Simple Certificate Enrolment Protocol (SCEP) is a protocol used for enrolment and other Public Key Infrastructure (PKI) operations Online Certificate Status Protocol (OS): Here, a client sends a request to find the status of a certificate and gets a response without having to know the complete list of revoked certificates The Public-Key Cryptography Standards (in short, referred to as PKCS) are specifications produced by RSA Laboratories in cooperation with secure systems developers worldwide. Contributions from the PKCS series have become part of many formal and de facto standards, including ANSI X9 documents, PKIX, SET, S/MIME, and SSL. PKCS #1: Provides standards for implementing RSA algorithm-based public key cryptographic encryption schemes and digital signature schemes with appendix. PKCS #3: Describes a method for implementing Diffie-Hellman key agreement, whereby two parties can agree upon a secret key that is known only to them (and, in particular, is not known to an eavesdropper listening to the dialogue by which the parties agree on the key). This secret key can then be used, for example, to encrypt further communications between the parties. PKCS #7: Describes Cryptographic Message Syntax (CMS): CMS defines the syntax that is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. PKCS #10: Certification Request Syntax Standard PKCS #12: Personal Information Exchange Syntax Standard. PKCS #12 v1.0 describes transfer syntax for personal identity information, including private keys, certificates, miscellaneous secrets, and extensions. Simple Certificate Enrollment Protocol (SCEP): SCEP is a protocol used for enrollment and other Public Key Infrastructure (PKI) operations. SCEP is not an Open Standard, and only Cisco devices and a few others it. You could easily configure SCEP using ASDM. Enrollment and usage of SCEP generally follows this work flow: 1. Obtain a copy of the Certificate Authority (CA) certificate and validate it. 2. Generate a CSR and send it securely to the CA. 3. Poll the SCEP server in order to check whether the certificate was signed. 4. Re-enroll as necessary in order to obtain a new certificate prior to the expiration of the current certificate. 5. Retrieve the CRL as necessary. The following are the important components of Public Key Infrastructure (PKI):

The needs to make a phone call to the CA to confirm the Public key of the root certificate. 1. show crypto isakmp sa detail - See the details for the IKE Phase 1 tunnel that is in place 2. show crypto ipsec sa detail - See the details for the IKE Phase 2 tunnels that are in place. There is one inbound Security Association (SA) and one outbound. They both have different SA numbers used for tracking these sessions. 3. show crypto engine connections active - Command provides stats to if the encryption and decryption is working. 4. show crypto map - Provides the details of the crypto map, and where it is applied, showing the contents of the IKE Phase 2 transform sets, the current peer and other information. Identifying a signature in a single packet Atomic signatures can match on a single packet, as compared to a string of packets. Service signature engine examines the application layer service and the string micro engine examines one or more packets (multiple packets) for any malicious content. Symmetric and Asymmetric algorithm Two main types of encryption are asymmetric encryption (also called public-key encryption) and symmetric encryption. A symmetric algorithm is one which uses the same key for encryption and decryption. Examples of symmetric algorithm are DES, 3DES, AES, and IDEA. An asymmetric algorithm is one which uses different keys for encryption and decryption. Examples of asymmetric algorithm are RSA, and Diffie-Hellman. RSA signatures provide a stronger method for authentication compared to PSK. Note that 3DES is not an authentication protocol but it is used for encryption. DH is used for key exchange. Public key cryptography: Uses a pair of mathematically related cryptographic keys. If one key is used to encrypt information, then only the related key can decrypt that information. If you know one of the keys, you cannot easily calculate what the other one is. As a result, in a public key system you have the following: A public key: This is something that you make public - it is freely distributed and can be seen by all s. A corresponding (and unique) private key: This is something that you keep secret - it is not shared amongst s. Your private key enables you to prove, unequivocally, that you are who you claim to be. The Public Key used for Encryption Another person uses your public encryption key when they want to send you confidential information. The information to be sent is encrypted using your public key*. You can provide your public key to the sender, or it can be retrieved from the directory in which it is published. Note: In normal practice, the actual information being sent is encrypted using a secret key algorithm (symmetric cryptography). Symmetric algorithms are much faster than public/private key algorithms (asymmetric cryptography). A random key (the session key) is generated, and it is used with the symmetric algorithm to encrypt the information. The public key is then used to encrypt that key and both are sent to the recipient. The Private Key used for Decryption

A private key is used to decrypt information that has been encrypted using its corresponding public key. The person using the private key can be certain that the information it is able to decrypt must have been intended for them, but they cannot be certain who the information is from. Note: In normal practice the private key is used to decrypt the session key, and that key is used to decrypt the actual information rather than the private key decrypting all the information. The Private Key for Signature If the sender wishes to prove to a recipient that they are the source of the information (perhaps they accept legal responsibility for it) they use a private key to digitally sign a message (a digital signature). Unlike the handwritten signature, this digital signature is different every time it is made. A unique mathematical value, determined by the content of the message, is calculated using a 'hashing' or 'message authentication' algorithm, and then this value is encrypted with the private key - creating the digital signature for this specific message. The encrypted value is either attached to the end of the message or is sent as a separate file together with the message. The public key corresponding to this private key may also be sent with the message, either on its own or as part of a certificate. Note: Anyone receiving information protected simply by a digital signature can check the signature and can read and process the information. Adding a digital signature to information does not provide confidentiality. Consider the command, Router(config-isakmp)# group 14 In the above command, group 14 specifies the Diffie-Hellman (DH) group identifier. By default, DH group 1 is used. 1- 768-bit DH (No longer recommended.) 2 -1024-bit DH (No longer recommended) 5 -1536-bit DH (No longer recommended) 14 - Specifies the 2048-bit DH group. 15 - Specifies the 3072-bit DH group. 16 - Specifies the 4096-bit DH group. 19 - Specifies the 256-bit elliptic curve DH (ECDH) group. 20 - Specifies the 384-bit ECDH group. 24 - Specifies the 2048-bit DH/DSA group. The group chosen must be strong enough (have enough bits) to protect the IPsec keys during negotiation. A generally accepted guideline recommends the use of a 2048-bit group after 2013 (until 2030). Group 14 or higher (where possible) can be selected to meet this guideline. Even if a longer-lived security method is needed, the use of Elliptic Curve Cryptography is recommended, but group 15 and group 16 can also be considered.

1. Security Concepts 1.2 Common Security threats Attacks may be categorized as below: 1. ive attack - The hacker will not be visible, like analysing captured packets. 2. Active attack - The hacker is online, like trying to get un-authorized access to a resource. 3. Close-in attack - The attacker is in close proximity, like direct access to the physical hardware. 4. Insider attack - The attacker is probably having the knowledge of how the network works, and its physical location. Here the attacker is usually an employee of the organization. 5. Distribution attack - Here the attacker introduces a "back door" into a piece of hardware or software. When the same is distributed to the clients, the attacker may gain back door access to the resources in the box. As per Cisco, the following are the commonly used Confidentiality attacks:

1. Packet capture 2. Ping sweep and port scan 3. Dumpster driving 4. EMI interception 5. Wire tapping 6. Social engineering 7. Sending information on over or covert channels As per Cisco, Integrity attacks include the following: 1. Salami attack 2. Trust relationship exploitation 3. Data diddling 4. attack 5. Botnet 6. Hijacking a session Given below are the most frequently used attacks on the availability of a resource: 1. Denial of Service 2. Distributed denial of service 3. TSYN flood 4. ICMP attacks 5. Electrical disturbances 6. Physical attacks on resources The two important components of Cisco suite of security management tools are: 1. Cisco security manager, and 2. Cisco security MARS (short for Monitoring, Analysis, and Reporting System). Attack type and Defensive mechanism Cisco recommends "Defensive Depth" to secure against intrusion or hacking. These include multiple layers of security. For example, ive security may include encryption of data across the network as the primary security mechanism, and employing applications with integrated security as second layer of protection. Similarly, active hacker may be prevented with a primary security mechanism of Firewalls, and HIPS as second layer of security. SIO, short for Security Intelligence Operations service provides global threat information, reputation based services, and sophisticated analysis of network attacks. IPS Manager Express (IME) and Cisco Security Manager (CSM) are two methods where you get alerts via SDEE. Defence in depth refers to a layered security approach, where multiple devices may have overlapping security responsibilities. The objective is to prevent any single point failure from taking down a network.

1. Security Concepts 1.1 Common Security principles Describe confidentiality, integrity, availability (CIA) Confidentiality, integrity and availability, also known as the CIA triad, is a model designed to guide policies for information security within an organization. The elements of the triad are considered the three most crucial components of security. Confidentiality is a set of rules that limits access to information, integrity is the assurance that the information is trustworthy and accurate, and availability is a guarantee of reliable access to the information by authorized people. Confidentiality ensures that the information remains private. It is accessed only by the authorized people. Confidentiality ensures that a message is not disclosed to any unintended parties. Note that integrity is to do with the correctness of information, and authorization refers to privileges to access a given resource. Authentication is used in conjunction with validation of a or a process to . Common Security : The US government has classified information into 1. Top secret 2. Secret 3. Confidential depending on the nature of information. Confidential: Data that has a reasonable probability of causing damage if disclosed to an unauthorized party Secret: Data that has a reasonable probability of causing serious damage if disclosed to an unauthorized party Top-secret: Data that has a reasonable probability of causing exceptionally grave damage if disclosed to an unauthorized party Unclassified: Data that has few or no privacy requirements Sensitive but unclassified (SBU): Data that could cause embarrassment but not constitute a security threat if revealed Cisco has recommended organizational information be classified into four classes. These are: 1. Public - Information for public consumption, such as information brochures 2. Sensitive - internal information, such as routine circulars. Public disclosure may cause some inconvenience to the organization, but no threat to the organization. 3. Private - Information that should be kept secret. Disclosure to unauthorized parties may cause some loss to the organization. Examples include formulas and patents. 4. Confidential - Sensitive information such as employee records According to Cisco, security solutions for an organization may be broadly divided into three categories. These are: A. Physical security: The following form physical security 1. Security cameras, and other monitoring devices 2. Security personnel 3. Climatic controls for proper temperature, humidity, etc. 4. Physical barriers B. istrative security: the following form istrative security 1. Maintaining log books 2. Screening employees, and security personnel

3. Maintaining security policies 4. Security awareness programs, etc. C. Logical security 1. Authentication systems 2. Firewalls 3. Encryption schemes, etc. Usually, people think of only technical solution to information. But, technical solution alone is not sufficient for data security. istrative and Physical security are also very vital for comprehensive security. SIEM technology: Security information and event management (SIEM) combines SIM (security information management) and SEM (security event management) functions into one security management system. A SIM system collects data into a central repository for trend analysis and provides automated reporting for compliance and centralized reporting. A SIEM system collects logs and other security-related documentation for analysis. Most SIEM systems work by deploying multiple collection agents in a hierarchical manner to gather security-related events from end- devices, servers, network and security devices such as firewalls, antivirus or intrusion prevention systems. The collectors forward events to a centralized management console, which performs inspections and flags anomalies. To allow the system to identify anomalous events, it's important that the SIEM first creates a profile of the system under normal event conditions. Given below are the important features of SIEM 1. Log collection of event records from sources throughout the organization provides important diagnostic tools and comply with regulator requirements. 2. Normalization maps log messages from different systems into a common data model, enabling the organization to connect and analyze related events from diverse environments. 3. Correlation links logs and events from disparate systems or applications, speeding detection of and reaction to security threats. 4. Aggregation reduces the volume of event data by consolidating duplicate event records. 5. Reporting presents the correlated, aggregated event data in real-time monitoring and long-term summaries.

Cisco 2t3w2

Overview 5o1f4z

More details 6z3438

Related Documents c2h70

Cisco 2t3w2

Cisco 2t3w2

Cisco 2t3w2

Cisco 2t3w2

Cisco 2t3w2

Cisco 2t3w2

More Documents from "Mohamed Wahieb" 5s5w5f

Cisco 2t3w2

Toyota Sienna Service Manual 3326t

Rp-a201 1t5q1b

Bmhr5103_may12 2j3e32

Pf_johnson Screens Multi Rake Bar Screen Defender Duo 5o461c

6g3p1u