CCSP Cisco Secure PIX Firewall Advanced Exam Certification Guide, Second Edition [Electronic resources] نسخه متنی

Foundation Summary

The "Foundation Summary" provides a convenient review of many key concepts in this chapter. If you are already comfortable with the topics in this chapter, this summary can help you recall a few details. If you just read this chapter, this review should help solidify some key facts. If you are doing your final preparation before the exam, this summary provides a convenient way to review the day before the exam.

Adaptive Security Algorithm

The ASA is an algorithm used by the PIX Firewall to provide better security than packet filters and better performance than application proxies. Each interface of the firewall is assigned a security level. Traffic flows through the firewall are managed by the security level combined with ACLs or conduits. TCP sequence numbers for outbound connections are randomly generated by the PIX Firewall to greatly reduce the chances of an inbound TCP session being hijacked.

Cut-Through Proxy

Cut-through proxy is the method used by the PIX Firewall to authorize users and then allow the connection to occur at the network level after completing the ASA process. This greatly improves firewall performance over application proxy firewalls because every packet traversing the firewall is not inspected.

Cisco PIX Firewall Models and Features

The following is a list of the Cisco PIX Firewall models. Chapter 19.

• PIX 501 Designed for SOHO use and has two effective interfaces, a single outside interface and a four-port inside switch.

• PIX 506E Designed for ROBO use and has a single outside interface and a single inside interface.

• PIX 515E Designed for small- to medium-size networks.

• PIX 525 Designed for large enterprise networks.

• PIX 535 Designed for large enterprise networks and ISPs.

• FWSM A firewall blade designed for the Cisco Catalyst 6500 Series Switch and 7600 Series Router.

Intrusion Protection

PIX firewalls were designed to independently detect and react to a variety of attacks. They can also be integrated with the Cisco Secure Intrusion Detection System to dynamically react to different threats.

AAA Support

The PIX Firewall supports the following AAA technologies:

• Local database It is possible to configure a local AAA database on the PIX Firewall; however, it is not recommended because the additional processing required to utilize the local database can adversely effect the performance of the firewall.

• RADIUS The PIX Firewall supports RADIUS.

• TACACS+ The PIX Firewall supports TACACS+.

X.509 Certificate Support

The PIX Firewall supports X.509 certificates for digital identity verification. X.509 certificates are used in conjunction with encryption for the following:

• Authentication Digital certificates are used to authenticate the identity of a user or server.

• Integrity A digital certificate becomes invalid if the digitally signed data has been altered.

• Token verification Digital certificates can be used as a replacement for passwords.

• Encryption Digital certificates simplify the identity authentication process when negotiating a VPN connection.

The Cisco PIX Firewall supports the Simple Certificate Enrollment Protocol (SCEP) and can be integrated with the following X.509 digital identification solutions:

• Entrust Technologies, Inc. Entrust/PKI 4.0

• Microsoft Corp. Windows 2000 Certificate Server 5.0

• VeriSign Onsite 4.5

• Baltimore Technologies UniCERT 3.05

Network Address Translation/Port Address Translation

The PIX Firewall can perform both NAT and PAT.

Firewall Management

PIX firewalls can be managed using one of three methods:

• Cisco command-line interface (CLI)

• PIX Device Manager (PDM)

• CiscoWorks Management Center for Firewalls (PIX MC)

Simple Network Management Protocol

PIX firewalls allow limited SNMP support. Because SNMP was designed as a network management protocol and not a security protocol, it can be used to exploit a device. For this reason, the PIX Firewall allows only read-only access to remote connections. This allows the manager to remotely connect to the device and monitor SNMP traps but does not allow the manager to change any SNMP settings.

Syslog Support

PIX firewalls log four different types of events onto syslog:

• Security

• Resource

• System

• Accounting

Virtual Private Networks

All PIX firewalls are designed to function as a termination point, or VPN gateway, for VPNs. This functionality enables administrators to create encrypted connections with other networks over the Internet.