CCSP Cisco Secure PIX Firewall Advanced Exam Certification Guide, Second Edition [Electronic resources] نسخه متنی

Certification Exam and This Preparation Guide

The questions for each certification exam are a closely guarded secret. The truth is that if you had the questions and could only pass the exam, you would be in for quite an embarrassing situation as soon as you arrived at your first job that required PIX skills. The point is to know the material, not just to pass the exam successfully. We do know what topics you must know to complete this exam. Coincidentally, these are the same topics required for you to be proficient with the PIX Firewall. We have broken down these topics into foundation topics and have covered each topic in the book. Chapter 2 discusses those technologies and the advantages of the technology utilized by the PIX Firewall.

2
PIX Firewall Models

There are currently six different models of the PIX Firewall. Chapter 3 discusses each model, its specifications, and how/when each model would be applied.

3

PIX Services Module

The PIX Firewall Services Module (FWSM) is a blade that provides PIX Firewall functionality to the Catalyst 6000 Series switches. This component is discussed in Chapter 19.

4

PIX Firewall Licensing

Chapter 3 discusses the different licensing options available for the PIX Firewall and how each license applies.

5

User Interface

The command-line interface (CLI) is one of the methods used to configure the PIX Firewall. Chapter 6 covers the CLI and many of the commands used to configure the firewall.

6

Examining the PIX Firewall Status

Verifying the configuration of the PIX Firewall will assist you in troubleshooting connectivity issues. Troubleshooting is discussed as part of each task within the book.

7

ASA Security Levels

The Adaptive Security Algorithm (ASA) is a key component of the PIX Firewall. It is discussed in great detail in Chapters 2, 3, 5, and 6.

8

Basic PIX Firewall Configuration

The basic configuration of the PIX Firewall is discussed in Chapter 6.

9

Syslog Configuration

The logging features of the PIX Firewall are covered in Chapter 8.

10

DHCP Server Configuration

The PIX Firewall can function both as a Dynamic Host Configuration Protocol (DHCP) server and client. These configurations are covered in Chapters 3, 6, and 12.

11

PPPoE and the PIX Firewall

Point-to-Point Protocol over Ethernet (PPPoE) is used to connect multiple hosts using a single dial-up or broadband connection. Some PIX Firewall models support PPPoE. This topic is covered in Chapter 12.

12

Transport Protocols

The transport protocols and how they are handled by the PIX Firewall are discussed in Chapters 5 and 8.

13

Network Address Translation

Network Address Translation (NAT) is used by many different firewalls to secure network segments. This is discussed in Chapters 5 and 6.

14

Configuring DNS Support

As a perimeter device, the PIX Firewall will be required to support the Domain Name Service (DNS). Configuring DNS on the PIX is discussed in Chapter 6.

15

Port Address Translation

Port Address Translation (PAT) is a method used by the PIX Firewall to NAT multiple internal sources to a single external address. This configuration is covered in Chapters 5 and 6.

16

ACLs

Access control lists (ACLs) are used to allow or deny traffic between different network segments that attach by the PIX Firewall. Configuring ACLs is discussed in Chapter 7.

17

Converting Conduits to ACLs

Conduits are from a command set that predated ACLs. They tend to be broader in their function. Conduits and ACLs are covered in Chapter 7.

18

Using ACLs

Configuring and using ACLs are discussed in Chapter 7.

19

Overview of Object Grouping

Service, host, and network objects can be grouped to make processing by the firewall more efficient. Object grouping is discussed in Chapter 7.

20

Getting Started with Object Groups

Object grouping is discussed in Chapter 7.

21

Configuring Object Groups

Object grouping is discussed in Chapter 7.

22

Nested Object Groups

Object groups can be nested into other object groups. Object grouping is discussed in Chapter 7.

23

Advanced Protocols

Many advanced protocols require special handling by the firewall. Some protocols require multiple inbound and outbound connections. The handling of advanced protocols by the PIX Firewall is discussed in Chapters 7 and 18.

24

Multimedia Support

Multimedia protocols are considered advanced protocols. The handling of advanced protocols by the PIX Firewall is discussed in Chapters 7 and 18.

25

Attack Guards

The PIX Firewall can be configured to recognize an attack and react to it. This is covered in Chapter 18.

26

Intrusion Detection

The PIX Firewall can be configured to perform as an intrusion detection system (IDS) as well as a firewall. It also can be configured to work with external IDSs. These issues are covered in Chapter 18.

27

Overview of AAA

AAA is a method of ensuring that you can verify who is accessing your network resources, restrict their access to specific resources, and keep track of what actions they take on the network. Configuring the PIX Firewall to support AAA is discussed in Chapters 16 and 17.

28

Installation of Cisco Secure ACS for Windows NT/2000

Cisco Secure ACS is a Cisco AAA server product. Installing and configuring Cisco Secure ACS is covered in Chapter 17.

29

Authentication Configuration

Configuring Cisco Secure ACS is discussed in Chapters 16 and 17.

30

Downloadable ACLs

Configuring Cisco Secure ACS is discussed in Chapters 16 and 17.

31

Understanding Failover

Mission-critical systems require high-availability solutions to minimize any chance of network outages. Two PIX Firewalls can be configured as a high-availability solution. This configuration is covered in Chapter 10.

32

Serial Failover Configuration

PIX failover configuration is discussed in Chapter 10.

33

LAN-Based Failover Configuration

PIX failover configuration is discussed in Chapter 10.

34

PIX Firewall Enables a Secure VPN

Dedicated circuits between different locations can be cost-prohibitive. It is much less expensive and just as secure to create an encrypted connection between those locations across public network space. Configuring VPNs is discussed in Chapter 11.

35

Prepare to Configure VPN Support

Both ends of a VPN must have a termination point. The PIX Firewall can be configured as a VPN termination point. Configuring VPNs is discussed in Chapter 11.

36

Configure IKE Parameters

Internet Key Exchange (IKE) is a key exchange method used to ensure that the encrypted connection is not easily compromised. Configuring VPNs is discussed in Chapter 11.

37

Configure IPSec Parameters

IP Security (IPSec) is a standard for creating an encrypted VPN connection. Configuring VPNs is discussed in Chapter 11.

38

Test and Verify VPN Configuration

Configuration and troubleshooting of VPNs is discussed in Chapter 11.

39

Cisco VPN Client

Remote users can create a VPN from their computers to the company network using VPN client software. Configuring VPNs and VPN client software is discussed in Chapter 12.

40

Scale PIX Firewall VPNs

Configuring VPNs is discussed in Chapter 11.

41

Remote Access

The PIX Firewall can be managed either locally or remotely. Configuring the PIX to allow remote access is discussed in Chapter 4.

42

Command Authorization

Remote management of the PIX Firewall is discussed in Chapter 4.

43

PDM Overview

The PIX Device Manager (PDM) is a web-enabled tool for remote management of the PIX Firewall. Remote management of the PIX using the PDM is discussed in Chapter 13.

44

Prepare for PDM

The PDM is a web-enabled tool for remote management of the PIX Firewall. Remote management of the PIX using the PDM is discussed in Chapter 13.

45

Using PDM to Configure the PIX Firewall

The PDM is a web-enabled tool for remote management of the PIX Firewall. Remote management of the PIX using the PDM is discussed in Chapter 13.

46

Using PDM to Create a Site-to-Site VPN

The PDM is a web-enabled tool for remote management of the PIX Firewall. Remote management of the PIX using the PDM is discussed in Chapter 13.

47

Using PDM to Create a Remote Access VPN

The PDM is a web-enabled tool for remote management of the PIX Firewall. Remote management of the PIX using the PDM is discussed in Chapter 13.

48

Configuring Access and Translation Rules

The PIX MC is used for management of multiple PIX Firewalls on an enterprise network. Installation, configuration, and use of the PIX MC are addressed in Chapter 14.

49

Reporting, Tools, and Administration

The PIX MC is used for management of multiple PIX Firewalls on an enterprise network. Installation, configuration, and use of the PIX MC are addressed in Chapter 14.

50

Introduction to the Auto Update Server

The auto update server is a component within the PIX MC that can be used to update the PIX Firewall. The auto update server is discussed in Chapter 14.

51

PIX Firewall and AUS Communication Settings

The Auto Update Server (AUS) is a component within the PIX MC that can be used to update the PIX Firewall. The AUS is discussed in Chapter 14.

52

Devices, Images, and Assignments

Use of the PIX MC and the AUS is covered in Chapter 14.

53

Reporting and Administration

Use of the PIX MC and the AUS is covered in Chapter 14.

54

FWSM Overview

The PIX FWSM is a blade that provides PIX Firewall functionality to the Catalyst 6000 Series switches. This component is discussed in Chapter 19.

55

Using PDM with FWSM

The PIX FWSM is a blade that provides PIX Firewall functionality to the Catalyst 6000 Series switches. Management of the FWSM using the PDM is discussed in Chapters 13 and 19.