CCIE Security v4.0 Practice Labs

CCIE Security v4.0 Practice Labs   The material covered in CCIE Security v4.0 Practice Labs is designed to help candidates prepare for the CCIE Security exam by providing a complex topology and two practice labs that force problem solving, troubleshooting, and policy design using topics and equipment that are detailed in the official exam documents.   Each solution is explained in detail to help reinforce a concept and topic. Tech Notes present other deployment options or enhancements and provide additional practical implementation tips. Initial and Final configuration files that can be cut and pasted onto lab devices for further testing and verification are also included.   These labs serve as a practice tool for prospective CCIE Security exam candidates and, through the use of a real-world lab topology and in-depth solutions and technical notes, are also a useful reference for any security professional involved with practical customer deployments that use Cisco products and solutions.

Table of Contents:
Introduction xxiii Part I Lab Topology Components, Cabling, and Routing and Switching Configuration 1 Equipment List 2 General Guidelines 4 Prelab Setup Instructions 5     Catalyst Switchport Cabling Diagram 5     Lab Topology Diagram 7     Lab Guide Addressing Scheme 8     Lab Guide IP Routing Details 11     VPN Solutions Diagrams 15     Initial Device Configurations 18 Final Configuration Files 18 CCIE Security Exam Study and Preparation Tips 18     CCIE Security Written Exam 18 Part II Practice Lab 1 19 Section 1 Perimeter Security and Services 19 Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode 19     Notes 21 Exercise 1.2: Configure Routing and Basic Access on ASA2 21     Notes 22 Exercise 1.3: Configure IP Services on ASA1 22     Task 1: Configure Network Object NAT 23     Task 2: Configure Twice NAT 23     Task 3: Configure and Troubleshoot NTP Services Using Authentication 23     Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1 23 Exercise 1.4: Configure IP Routing Security on ASA2 23     Task 1: BGP Connectivity Through the ASA2 24     Task 2: OSPF Authentication for Routing Update Security 24 Section 2 Intrusion Prevention and Content Security 25 Exercise 2.1: Initialize and Deploy the Cisco IPS Sensor Appliance 25     Task 1: Initialize the Cisco IPS Sensor 25     Task 2: Deploy the Cisco IPS Sensor in Inline VLAN Pair Mode 26     Task 3: Deploy the Cisco IPS Sensor in Inline Interface Pair Mode 27     Task 4: Deploy the Cisco IPS Sensor in Promiscuous Mode 27 Exercise 2.2: Initialize the Cisco WSA 27 Exercise 2.3: Enable Web Content Features on the Cisco WSA 29     Task 1: Configure WCCPv2 Proxy Support on the WSA (Client) and ASA1 (Server) 29     Task 2: Configure Proxy Bypass on the WSA 30     Task 3: Create a Custom URL Access Policy on the WSA 30 Section 3 Secure Access 30 Exercise 3.1: Configure and Troubleshoot IPsec EZVPN 30 Exercise 3.2: Troubleshoot DMVPN Phase 3: DMVPNv3 32 Exercise 3.3: Configure Security Features on the Cisco WLC 33     Task 1: Initialize the WLC and Establish Control over the Cisco Access Points (AP) 33     Task 2: Enable IP Services on the WLC to Enhance Security 35     Task 3: Creating and Assigning Security Policy to WLANs and Users 35 Exercise 3.4: Configure the Cisco IOS Certificate Server 36 Section 4 System Hardening and Availability 37 Exercise 4.1: Configure SPAN on the Cisco Catalyst Switch 37 Exercise 4.2: Troubleshoot Secure Routing Using OSPFv3 in Cisco IOS 38 Exercise 4.3: Configure Control Plane Policing (CoPP) 39 Exercise 4.4: Troubleshoot Management Plane Protection 39 Exercise 4.5: Device Hardening on the Cisco WLC 40     Task 1: Disable SSID Broadcasting 40     Task 2: Protect the WLC Against Associating with a Rogue AP 40     Task 3: Enable Infrastructure Management Frame Protection on the WLC 40     Task 4: Enable Encryption for CAPWAP Packets 40     Task 5: Create a Rate Limiting Policy for Guest Users on the Guest WLAN 40 Section 5 Threat Identification and Mitigation 41 Exercise 5.1: Troubleshoot IPv6 in IPv4 Tunnel 41 Exercise 5.2: Mitigating DHCP Attacks on a Cisco Catalyst Switch 41 Exercise 5.3: Identifying Attacks with NetFlow and Mitigating Attacks Using Flexible Packet Matching 42 Exercise 5.4: Application Protocol Protection 43 Section 6: Identity Management 43 Exercise 6.1: Configure Router Command Authorization and Access Control 43 Exercise 6.2: Configure Cut-Through Proxy on ASA2 Using TACACS+ 45 Exercise 6.3: Configure Support for MAB/802.1X for Voice and Data VLANs 45 Exercise 6.3a: Authentication and Authorization Using MAB 45 Exercise 6.3b: Authentication and Authorization Using 802.1X 47 Part II Practice Lab 1 Solutions 51 Section 1 Perimeter Security and Services 51 Solution and Verification for Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode 51     Skills Tested 51     Solution and Verification 52         Basic Parameters 52         Admin Context Parameters 53         Context c1 Parameters 54         Context c2 Parameters 56     ASA1 Configuration 57     Tech Notes 60 Solution and Verification for Exercise 1.2: Configure Routing and Basic Access on ASA2 62     Skills Tested 62     Solution and Verification 62     Configuration 66     Tech Notes 67 Solution and Verification for Exercise 1.3: Configure IP Services on ASA1 68     Skills Tested 68     Solution and Verification 68         Task 1: Network Object NAT 69         Task 2: Twice NAT 69         Task 3: NTP with Authentication 70         Task 4: Tunneling ipv6ip 71     Configuration 71     Tech Notes 72 Solution and Verification for Exercise 1.4: Configure IP Routing Security on ASA2 77     Skills Tested 77     Solution and Verification 77         Task 1: BGP Connectivity Through ASA2 77         Task 2: OSPF Authentication for Routing Update Security 78     Configuration 79     Tech Notes 80 Section 2 Intrusion Prevention and Content Security 80 Solution and Verification for Exercise 2.1: Initialize and Deploy the Cisco IPS Sensor Appliance 80     Skills Tested 80     Solution and Verification 81         Task 1: Initialize the Cisco IPS 81         Task 2: Deploy the Cisco IPS Sensor in Inline VLAN Pair Mode 82         Task 3: Deploy the Cisco IPS Sensor in Inline Interface Pair Mode 83         Task 4: Deploy the Cisco IPS Sensor in Promiscuous Mode 83     Configuration 84     Tech Notes 85 Solution and Verification for Exercise 2.2: Initialize the Cisco WSA 86     Skills Tested 86     Solution and Verification 86     Tech Notes 88 Solution and Verification for Exercise 2.3: Enable Web Content Features on the Cisco WSA 89     Skills Tested 89     Solution and Verification 89         Task 1: Configure WCCPv2 Proxy Support on the Cisco WSA (Client) and the Cisco ASA (Server) 90         Task 2: Configure Proxy Bypass on the Cisco WSA 91         Task 3: Create a Custom URL Access Policy on the Cisco WSA 92     Configuration 92     Tech Notes 92         WCCP Support Across Cisco Products 92         Transparent Proxy Versus Explicit Proxy 92         Connection Assignment and Redirection 93         Service Groups 94 Section 3 Secure Access 95 Solution and Verification for Exercise 3.1: Configure and Troubleshoot IPsec EZVPN 95     Skills Tested 95     Solution and Verification 95     Configuration 100     Tech Notes 101         Initiating the EZVPN Tunnel 101         Split Tunnel Options 101         EZVPN Client Modes of Operation in Cisco IOS 102         Client U-Turn Versus IPsec Hairpinning 102         External Versus Internal Policy 102 Solution and Verification for Exercise 3.2: Troubleshoot DMVPN Phase 3: DMVPNv3 103     Skills Tested 103     Solution and Verification 103         NHRP Spoke Registration 104         Spoke-to-Spoke Connection from R4 to R3 108         Verification 113     Configuration 121     Tech Notes 123         DMVPNv1 123         DMVPNv2 124         DMVPNv3 125 Solution and Verification for Exercise 3.3: Configure Security Features on the Cisco WLC 127     Task 1: Initialize the Cisco WLC and Establish Control over the Cisco Access Points 127     Task 2: Enable IP Services on the Cisco WLC to Enhance Security 128     Task 3: Creating and Assigning Security Policy to WLANs and Users 129     Configuration 132     Solution and Verification for Exercise 3.4: Configure the Cisco IOS Certificate Server 132     Skills Tested 132     Solution and Verification 133     Configuration 135     Tech Notes 135 Section 4 System Hardening and Availability 136 Solution and Verification for Exercise 4.1: Configure SPAN on the Cisco Catalyst Switch 136     Skills Tested 136     Solution and Verification 136     Configuration 138     Tech Notes 138         SPAN Versus RSPAN 138         SPAN and RSPAN Terminology and Guidelines 138         VLAN-Based SPAN 139 Solution and Verification for Exercise 4.2: Troubleshoot Secure Routing     Using OSPFv3 in Cisco IOS 140     Skills Tested 140     Solution and Verification 140     Configuration 143     Tech Notes 144 Solution and Verification for Exercise 4.3: Configure Control Plane Policing (CoPP) 145     Skills Tested 145     Solution and Verification 145         Verification 146     Configuration 150     Tech Notes 151         Router Planes 151         CoPP Versus CPPr 152 Solution and Verification for Exercise 4.4: Troubleshoot Management Plane Protection 153     Skills Tested 153     Solution and Verification 153     Configuration 154 Solution and Verification for Exercise 4.5: Device Hardening on the Cisco WLC 154     Skills Tested 154     Solution and Verification 154         Task 1: Disable SSID Broadcasting 155         Task 2: Protect the WLC Against Associating with a Rogue AP 155         Task 3: Enable Infrastructure Management Frame Protection on the Cisco WLC 156         Task 4: Enable Encryption for CAPWAP Packets 157         Task 5: Create a Rate Limiting Policy for Guest Users on the Guest WLAN 157     Configuration 158     Tech Notes 159         Summary of Wireless Attacks 159         Management Frame Protection via 802.11w 160 Section 5 Threat Identification and Mitigation 160 Solution and Verification for Exercise 5.1: Troubleshoot IPv6 in IPv4 Tunnel 161     Skills Tested 161     Solution and Verification 161     Configuration 163 Solution and Verification for Exercise 5.2: Mitigating DHCP Attacks on a Cisco Catalyst Switch 164     Skills Tested 164     Solution and Verification 164     Configuration 166     Tech Notes 166     DHCP Implementation Notes 167         DHCP Option 82 167         DHCP Snooping and the DHCP Server on Cisco IOS Routers 168 Solution and Verification for Exercise 5.3: Identifying Attacks with NetFlow and Mitigating Attacks Using Flexible Packet Matching 169     Skills Tested 169     Solution and Verification 169     Configuration 171 Solution and Verification for Exercise 5.4: Application Protocol Protection 171     Skills Tested 171     Solution and Verification 171     Configuration 173 Section 6 Identity Management 174 Solution and Verification for Exercise 6.1: Configure Router Command Authorization and Access Control 174     Skills Tested 174     Solution and Verification 174         ACS Solution 177     Configuration 183     Tech Notes 184         Tracing the Command Authorization Process 184         Understanding AAA and Login on the Router Lines 186         Test AAA Commands 188         AAA Accounting 189 Solution and Verification for Exercise 6.2: Configure Cut-Through Proxy on ASA2 Using TACACS+ 189     Skills Tested 189     Solution and Verification 189         CiscoSecure ACS Configuration 190     Configuration 193     Tech Notes 193 Solution and Verification for Exercise 6.3: Configure Support for MAB/802.1X for Voice and Data VLANs 193     Skills Tested 193         Verification: Part A 195         Verification: Part B 196     Configuration 197     Cisco ISE Configuration 198     Tech Notes 203 Part III Practice Lab 2 205 Section 1 Perimeter Security 205 Exercise 1.1: Configure a Redundant Interface on ASA2 205 Exercise 1.2: SSH Management Authentication and Local Command Authorization on ASA1 206 Exercise 1.3: Configuring Advanced Network Protection on the ASA 206     Task 1: Botnet Traffic Filtering on ASA1 206     Task 2: Threat Detection on ASA2 207     Task 3: IP Audit on ASA1 207 Exercise 1.4: Configure IPv6 on ASA2 207 Exercise 1.5: Cisco IOS Zone-Based Firewall with Support for Secure Group Tagging 208 Section 2 Intrusion Prevention and Content Security 209 Exercise 2.1: Configuring Custom Signatures on the Cisco IPS Sensor 209     Custom Signature to Track OSPF TTL 209     Custom Signature to Identify and Deny Large ICMP Packets 210     Custom Signature to Identify and Deny an ICMP Flood Attack 210 Exercise 2.2: Enable Support for HTTPS on the Cisco WSA 211 Exercise 2.3: Enable User Authentication for Transparent Proxy Using LDAP 212 Exercise 2.4: Guest User Support on the Cisco WSA 213 Section 3 Secure Access 214 Exercise 3.1: Configure and Troubleshoot IPsec Static VTI with IPv6 214 Exercise 3.2: Troubleshoot and Configure GETVPN 216 Exercise 3.3: SSL Client and Clientless VPNs 218 Exercise 3.4: Configure and Troubleshoot FlexVPN Site-to-Site Using RADIUS Tunnel Attributes 219 Exercise 3.5: Configure and Troubleshoot FlexVPN Remote Access (Client to Server) 221 Section 4 System Hardening and Availability 222 Exercise 4.1: BGP TTL-Security Through the Cisco ASA 222 Exercise 4.2: Configure and Troubleshoot Control Plane Protection 223 Exercise 4.3: Control Plane Protection for IPv6 Cisco IOS 223 Section 5 Threat Identification and Mitigation 223 Exercise 5.1: Preventing IP Address Spoofing on the Cisco ASA 223 Exercise 5.2: Monitor and Protect Against Wireless Intrusion Attacks 224 Exercise 5.3: Identifying and Protecting Against SYN Attacks 224 Exercise 5.4: Using NBAR for Inspection of HTTP Traffic with PAM and Flexible NetFlow 225 Section 6 Identity Management 226 Exercise 6.1: Cisco TrustSec–Dynamically Assigning Secure Group Tagging and SGACLs: 802.1X and MAB 227     Part A: Configuring SGTs on the Cisco ISE 227     Part B: Dynamically Assigning SGTs via 802.1X and MAB 227         Task 1: Cisco Access Point as an 802.1X Supplicant with SGTs 227         Task 2: Cisco IP Phone Using MAB and SGTs 228     Part C: Create the SGA Egress Policy 229 Exercise 6.2: Cisco TrustSec–NDAC and MACsec 230 Exercise 6.3: Cisco TrustSec–SGT Exchange Protocol over TCP 231 Part III Practice Lab 2 Solutions 233 Section 1 Perimeter Security 233 Solution and Verification for Exercise 1.1: Configure a Redundant Interface on ASA2 233     Skills Tested: 233     Solution and Verification 233     Configuration 236 Solution and Verification for Exercise 1.2: SSH Management Authentication and Local Command Authorization on ASA1 236     Skills Tested 236     Solution and Verification 236     Configuration 239     Tech Notes 240 Solution and Verification for Exercise 1.3: Configuring Advanced Network Protection on the ASA 240     Skills Tested 240     Solution and Verification 241         Task 1: Botnet Traffic Filtering on ASA1 241         Task 2: Threat Detection on ASA2 243         Task 3: IP Audit 243     Configuration 244     Tech Notes 245 Solution and Verification for Exercise 1.4: Configure IPv6 on ASA2 246     Skills Tested 246     Solution and Verification 246     Configuration 248     Tech Notes 248         IPv6 Addressing Review 248         IPv6 Addressing Notation 249         IPv6 Address Types 249         IPv6 Address Allocation 251         IPv6 Addressing Standards 251 Solution and Verification for Exercise 1.5: Cisco IOS Zone-Based Firewall with Support for Secure Group Tagging 252     Skills Tested 252     Solution and Verification 252     Configuration 257     Tech Notes 259 Section 2 Intrusion Prevention and Content Security 263 Solution and Verification for Exercise 2.1: Configuring Custom Signatures on the Cisco IPS Sensor 263     Skills Tested 263     Solution and Verification 263         Custom Signature to Track OSPF TTL 264         Custom Signature to Identify and Deny Large ICMP Packets 265         Custom Signature to Identify and Deny an ICMP Flood Attack 266     Configuration 268     Tech Notes 270         Risk Ratings 270         Understanding Threat Rating 271 Solution and Verification for Exercise 2.2: Enable Support for HTTPS on the Cisco WSA 272     Skills Tested 272     Solution and Verification 272     Configuration 274 Solution and Verification for Exercise 2.3: Enable User Authentication for Transparent Proxy Using LDAP 274     Skills Tested 274     Solution and Verification 274 Solution and Verification for Exercise 2.4: Guest User Support on the Cisco WSA 278     Skills Tested 278     Solution and Verification 278     WSA Configuration 279 Section 3 Secure Access 280 Solution and Verification for Exercise 3.1: Configure and Troubleshoot IPsec Static VTI with IPv6 280     Skills Tested 280     Solution and Verification 280     Configuration 286     Tech Notes 289         Tip and Tricks 289         Static VTIs for IPv6 Using Preshared Keys 289 Solution and Verification for Exercise 3.2: Troubleshoot and Configure GETVPN 290     Skills Tested 290     Solution and Verification 290         Verify Network Connectivity 292         Configure and Verify the COOP Key Servers 293         Configure and Verify the Group Members 298         Configure and Verify DPD and Authorization 302     Configuration 303     Tech Notes 308         Key Server Design Considerations for IKE 308         Key Server Design Considerations for IPsec 309         Key Server Design Considerations for Traffic Encryption Key Lifetime 309         Key Server Design Considerations for ACLs in a Traffic Encryption Policy 310         Key Server Design Considerations for Key Encryption Key Lifetime 311         Rekey Retransmit Interval 311         Time-Based Antireplay 311         Key Server Design Considerations for Authentication Policies for GM Registration 312         Implementing Rekeying Mechanisms 312         Unicast Rekeying 313         Implementing Multicast Rekeying with No ASA Considerations 313         Implementing Multicast Rekeying Through the ASA in Routed Mode 314 Solution and Verification for Exercise 3.3: SSL Client and Clientless VPNs 315     Skills Tested 315     Solution and Verification 315     Configuration 321     Tech Notes 323         Importing Third-Party Trusted CA Certificates 323         Default Group Policy and Attribute Inheritance 328 Solution and Verification for Exercise 3.4: Configure and Troubleshoot FlexVPN Site-to-Site Using RADIUS Tunnel Attributes 328     Skills Tested 328     Solution and Verification 328     Configuration 332     Tech Notes 334         IKEv2 Smart Defaults 334         IKEv2 Anti-Clogging Cookie 334         RADIUS Tunnel Attributes and IKEv2 335 Solution and Verification for Exercise 3.5: Configure and Troubleshoot FlexVPN Remote Access (Client to Server) 337     Skills Tested 337     Solution and Verification 337     Configuration 341     Tech Notes 343         Debugging FlexVPN 343         Understanding IKEv2 Routing Options 348 Section 4 System Hardening and Availability 349 Solution and Verification for Exercise 4.1: BGP TTL-Security through the Cisco ASA 349     Skills Tested 349     Solution and Verification 349     Configuration 351     Tech Notes 351 Solution and Verification for Exercise 4.2: Configure and Troubleshoot Control Plane Protection 352     Skills Tested 352     Solution and Verification 352     Configuration 354     Tech Notes 354 Solution and Verification for Exercise 4.3: Control Plane Protection for IPv6 Cisco IOS 354     Skills Tested 354     Solution and Verification 355     Configuration 356 Section 5 Threat Identification and Mitigation 357 Solution and Verification for Exercise 5.1: Preventing IP Address Spoofing on the Cisco ASA 357     Skills Tested 357     Solution and Verification 357     Configuration 358     Tech Notes 359         Understanding Unicast Reverse Path Forwarding in Cisco IOS: Technology Overview 359         Understanding Unicast Reverse Path Forwarding: Deployment Guidelines 359         Understanding Unicast Reverse Path Forwarding: Other Guidelines 360 Solution and Verification for Exercise 5.2: Monitor and Protect Against Wireless Intrusion Attacks 361     Skills Tested 361     Solution and Verification 361     Configuration 362 Solution and Verification for Exercise 5.3: Identifying and Protecting Against SYN Attacks 362     Skills Tested 362     Solution and Verification 362     Configuration 363     Tech Notes 364         Configuring Maximum Connections 364         TCP Intercept and Limiting Embryonic Connections 364 Solution and Verification for Exercise 5.4: Using NBAR for Inspection of HTTP Traffic with PAM and Flexible NetFlow 365     Skills Tested 365     Solution and Verification 365     Configuration 369     Tech Notes 370         Configuring a NetfFlow Exporter 370         Comparing NetFlow Types 370         Migrating from Traditional Netflow to Flexible Netflow 371 Section 6 Identity Management 372 Solution and Verification for Exercise 6.1: Cisco TrustSec–Dynamically Assigning Secure Group Tagging and SGACLs: 802.1X and MAB 372     Skills Tested 372     Solution and Verification 372         Part A: Configuring SGTs on the Cisco ISE 373         Part B: Dynamically Assigning SGT’s via 802.1X and MAB 374         Part C: Create the SGA Egress Policy 376     Configuration 377     Tech Notes 378         IP Device Tracking 378 Solution and Verification for Exercise 6.2: Cisco TrustSec–NDAC and MACsec 378     Skills Tested 378     Solution and Verification 378     Configuration 389     Tech Notes 390         Protected Access Credential 390         MACsec Overview 391 Solution and Verification for Exercise 6.3: Cisco TrustSec–SGT Exchange Protocol over TCP 393     Skills Tested 393     Solution and Verification 393     Configuration 398     Tech Notes 399         SXP on the Cisco WLC 399         Summary of Secure Group Access Features 400 Part IV Appendixes Appendix A Manual Configuration Guide 401 Cisco Catalyst Switches: SW1, SW2 401 Cisco Routers R1, R2, R3, R4, R5, R6, R7 402 Cisco Router R6: Also Used as the CME Server 403 Cisco ASA Appliances ASA1, ASA2 403 Cisco WLC 405 Cisco IPS Sensor 406 Cisco WSA 407 Appendix B Preparing for the CCIE Exam 411 CCIE Certification Process 411 CCIE Security Written Exam 411 CCIE Security Lab Exam 412 Planning Resources 413 Assessing Strengths and Weaknesses 414 Training, Practice Labs, and Boot Camps 414 Books and Online Materials 414 Lab Preparation 415 Lab Exam Tips 415 A Word on Cheating... 416 Appendix C Sample Written Exam Questions and Answers 417   9781587144141   TOC   4/22/2014