Table of Contents
1. Network Security Fundamentals
2. Network Security Threats
3. AAA Fundamentals
4. Firewall Fundamentals
5. IDS/IPS Fundamentals
6. Site-to-Site ××× Technologies
7 Remote Access Fundamentals
Part II. Cisco IOS Foundation Security Solutions
8. Cisco Network Foundation Protection (NFP) Overview
9. Configuring and Implementing Layer 2 Security Solutions (IPSG, PACL, Port Security, DAI, DHCP Snooping)
10. Cisco Identity Based Networking Services (IBNS) Overview
11. Cisco Secure ACS Foundation, Configuration and Implementation
12. Implementing and Configuring 802.1x
13. Implementing and Configuring Cisco IOS Data Plane Security (uRPF, ACLs)
14. Implementing and Configuring Cisco IOS Control Plane Security (CoPP, CPPr)
15. Implementing and Configuring Cisco IOS Management Plane Security (Passwords, SSH, Privileges, Views, Autosecure)
Part III. Cisco IOS Threat Detection and Control
16. Implementing and Configuring Network Address Translation (NAT)
17. Implementing and Configuring Basic Zone Based Firewalls
18. Implementing and Configuring Advanced Zone Based Firewalls
19. Implementing and Configuring IOS Intrusion Protection System (IPS)
Part IV. Managing and Implementing Cisco IOS Site-to-Site Security Solutions
20. Implementing and Configuring VTI-Based IPSec ×××s (Including HA Features)
21. Implementing and Configuring Scalable Authentication and PKI Site-to-Site ××× Solutions
22. Implementing and Configuring Dynamic Multipoint ×××s
23. Implementing and Configuring Group Encrypted Transport (GET) ×××s
Part V. Managing and Implementing Cisco IOS Secure Remote Access Solutions
24. Implementing and Configuring IOS Based SSL ×××s
25. Implementing and Configuring IOS Based ××× Solutions using Ez×××
Part VI. Exam Preparation
26. Final Exam Preparation
Pre-Production Design
- Choose ASA Perimeter Security technologies/features to implement HLD based on given security requirements
- Choose the correct ASA model to implement HLD based on given performance requirements
- Create and test initial ASA appliance configurations using CLI
- Determine which ASA licenses will be required based on given requirements
Complex Operations Support
-
Optimize ASA Perimeter Security features performance, functions, and configurations
-
Create complex ASA security perimeter policies such as ACLs, NAT/PAT, L3/L4/L7 stateful inspections, QoS policies, cut-thru proxy, threat detection, botnet detection/filter using CLI and/or ASDM
-
Perform initial setup on the AIP-SSM and CSC-SSM using CLI and/or ASDM
-
Configure, verify and troubleshoot High Availability ASAs (A/S and A/A FO) operations using CLI and/or ASDM
-
Configure, verify and troubleshoot static routing and dynamic routing protocols on the ASA using CLI and/or ASDM
-
Configure, verify and troubleshoot ASA transparent firewall operations using CLI
-
Configure, verify and troubleshoot management access/protocols on the ASA using CLI and/or ASDM
Describe Advanced Troubleshooting
-
Advanced ASA security perimeter configuraiton/software/hardware troubleshooting using CLI and/or ASD fault finding and repairing
Implement secure networks using Cisco ASA Firewalls
Perform basic firewall Initialization
Configure device management
Configure address translation (nat, global, static)
Configure ACLs
Configure IP routing
Configure object groups
Configure VLANs
Configure filtering
Configure failover
Configure Layer 2 Transparent Firewall
Configure security contexts (virtual firewall)
Configure Modular Policy Framework
Configure Application-Aware Inspection
Configure high availability solutions
Configure QoS policies
Implement secure networks using Cisco IOS Firewalls
Configure CBAC
Configure Zone-Based Firewall
Configure Audit
Configure Auth Proxy
Configure PAM
Configure access control
Configure performance tuning
Configure advanced IOS Firewall features
Implement secure networks using Cisco ××× solutions
Configure IPsec LAN-to-LAN (IOS/ASA)
Configure SSL ××× (IOS/ASA)
Configure Dynamic Multipoint ××× (DM×××)
Configure Group Encrypted Transport (GET) ×××
Configure Easy ××× (IOS/ASA)
Configure CA (PKI)
Configure Remote Access ×××
Configure Cisco Unity Client
Configure Clientless Web×××
Configure AnyConnect ×××
Configure XAuth, Split-Tunnel, RRI, NAT-T
Configure High Availability
Configure QoS for ×××
Configure GRE, mGRE
Configure L2TP
Configure advanced Cisco ××× features
Configure Cisco IPS to mitigate network threats
Configure IPS 4200 Series Sensor Appliance
Initialize the Sensor Appliance
Configure Sensor Appliance management
Configure virtual Sensors on the Sensor Appliance
Configure security policies
Configure promiscuous and inline monitoring on the Sensor Appliance
Configure and tune signatures on the Sensor Appliance
Configure custom signatures on the Sensor Appliance
Configure blocking on the Sensor Appliance
Configure TCP resets on the Sensor Appliance
Configure rate limiting on the Sensor Appliance
Configure signature engines on the Sensor Appliance
Use IDM to configure the Sensor Appliance
Configure event action on the Sensor Appliance
Configure event monitoring on the Sensor Appliance
Configure advanced features on the Sensor Appliance Configure and tune Cisco IOS IPS
Configure SPAN & RSPAN on Cisco switches
Implement Identity Management
Configure RADIUS and TACACS+ security protocols
Configure LDAP
Configure Cisco Secure ACS
Configure certificate-based authentication
Configure proxy authentication
Configure 802.1x
Configure advanced identity management features
Configure Cisco NAC Framework
Implement Control Plane and Management Plane Security
Implement routing plane security features (protocol authentication, route filtering)
Configure Control Plane Policing
Configure CP protection and management protection
Configure broadcast control and switchport security
Configure additional CPU protection mechanisms (options drop, logging interval)
Disable unnecessary services
Control device access (Telnet, HTTP, SSH, Privilege levels)
Configure SNMP, Syslog, AAA, NTP
Configure service authentication (FTP, Telnet, HTTP, other)
Configure RADIUS and TACACS+ security protocols
Configure device management and security
Configure Advanced Security
Configure mitigation techniques to respond to network attacks
Configure packet marking techniques
Implement security RFCs (RFC1918/3330, RFC2827/3704)
Configure Black Hole and Sink Hole solutions
Configure RTBH filtering (Remote Triggered Black Hole)
Configure Traffic Filtering using Access-Lists
Configure IOS NAT
Configure TCP Intercept
Configure uRPF
Configure CAR
Configure NBAR
Configure NetFlow
Configure Anti-Spoofing solutions
Configure Policing
Capture and utilize packet captures
Configure Transit Traffic Control and Congestion Management
Configure Cisco Catalyst advanced security features
Identify and Mitigate Network Attacks
Identify and protect against fragmentation attacks
Identify and protect against malicious IP option usage
Identify and protect against network reconnaissance attacks
Identify and protect against IP spoofing attacks
Identify and protect against MAC spoofing attacks
Identify and protect against ARP spoofing attacks
Identify and protect against Denial of Service (DoS) attacks
Identify and protect against Distributed Denial of Service (DDoS) attacks
Identify and protect against Man-in-the-Middle (MiM) attacks
Identify and protect against port redirection attacks
Identify and protect against DHCP attacks
Identify and protect against DNS attacks
Identify and protect against Smurf attacks
Identify and protect against SYN attacks
Identify and protect against MAC Flooding attacks
Identify and protect against VLAN hopping attacks
Identify and protect against various Layer2 and Layer3 attacks
Security：
中文书：
CCIE安全认证考试指南
管理cisco网络安全
CS×××认证考试指南
CSPFA认证考试指南
Cisco入侵检测系统
网络安全原理与实践
英文书：（原版及影印）
Ciscopress CCIE practical labs :security
Ciscopress CCIE Security Exam Certification Guide
Ciscopress CCIE Practical Studies Security
Ciscopress Cisco Designing Perimeter Security
Ciscopress Cisco Designing ××× Security
CiscoPress Network Security Principles and Practices
CiscoPress Web Security Field Guide
CiscoPress Cisco Router Firewall Security
ciscopress ccsp SECUR study guide
CiscoPress SECUR exam certification guide
ciscopress ccsp CS××× study guide
CiscoPress CS××× Exam Certification Guide
ciscopress ccsp CSPFA study guide
CiscoPress CSPFA Exam Certification Guide
ciscopress ccsp CSIDS study guide
ciscopress ccsp CSI study guide
ciscopress CSI exam certification guide
实验内容及设备
2009年4月9号后安全LAB考试新大纲:
CCIE SECURITY TRACK
Lab Exam Blueprint v3.0
The lab exam requires a depth of understanding difficult to obtain without hands-on experience. Early in your preparation you should arrange access to the equipment and the Cisco IOS Software versions indicated below. Occasionally, you may see more recent Cisco IOS Software versions installed in the lab, but you will not be tested on the new features of a release, unless indicated in the list below.
Cisco 3800 Series Integrated Services Routers (ISR)
Cisco 1800 Series Integrated Services Routers (ISR)
Cisco Catalyst 3560 Series Switches
Cisco ASA 5500 Series Adaptive Security Appliances
Cisco IPS Series 4200 Intrusion Prevention System sensors
Cisco Secure Access Control Server for Windows
Note: The IPS sensor can be configured using CLI and managed through the IPS Device Manager.
Software Versions
Cisco ISR Series running IOS Software Version 12.4T Advanced Enterprise Services feature set is used on all routers
Cisco Catalyst 3560 Series Switches running Cisco IOS Software Release 12.2(44)SE or above
Cisco ASA 5500 Series Adaptive Security Appliances OS Software Version 8.x
Cisco IPS Software Release 6.1.x
Cisco ××× Client Software for Windows, Release 5.x
Cisco Secure ACS for Windows Version 4.1
CCIE SECURITY TRACK
Lab Exam Blueprint v3.0
Please review the Lab Exam Overview for general information about the CCIE Security lab exam. This lab exam blueprint v3.0 is a detailed outline of the topics likely to appear on the lab exam effective mid-April 2009. Knowledge of troubleshooting is an important skill and candidates are expected to diagnose and solve issues as part of the CCIE lab exam. The topics listed are guidelines and other relevant or related topics may also appear. Candidates for lab exams scheduled in mid April'09 or later should prepare using the v3.0 blueprints below. In general, new product features become eligible for testing on CCIE lab exams six months after general release.
Implement secure networks using Cisco ASA Firewalls
Perform basic firewall Initialization
Configure device management
Configure address translation (nat, global, static)
Configure ACLs
Configure IP routing
Configure object groups
Configure VLANs
Configure filtering
Configure failover
Configure Layer 2 Transparent Firewall
Configure security contexts (virtual firewall)
Configure Modular Policy Framework
Configure Application-Aware Inspection
Configure high availability solutions
Configure QoS policies
Implement secure networks using Cisco IOS Firewalls
Configure CBAC
Configure Zone-Based Firewall
Configure Audit
Configure Auth Proxy
Configure PAM
Configure access control
Configure performance tuning
Configure advanced IOS Firewall features
Implement secure networks using Cisco ××× solutions
Configure IPsec LAN-to-LAN (IOS/ASA)
Configure SSL ××× (IOS/ASA)
Configure Dynamic Multipoint ××× (DM×××)
Configure Group Encrypted Transport (GET) ×××
Configure Easy ××× (IOS/ASA)
Configure CA (PKI)
Configure Remote Access ×××
Configure Cisco Unity Client
Configure Clientless Web×××
Configure AnyConnect ×××
Configure XAuth, Split-Tunnel, RRI, NAT-T
Configure High Availability
Configure QoS for ×××
Configure GRE, mGRE
Configure L2TP
Configure advanced Cisco ××× features
Configure Cisco IPS to mitigate network threats
Configure IPS 4200 Series Sensor Appliance
Initialize the Sensor Appliance
Configure Sensor Appliance management
Configure virtual Sensors on the Sensor Appliance
Configure security policies
Configure promiscuous and inline monitoring on the Sensor Appliance
Configure and tune signatures on the Sensor Appliance
Configure custom signatures on the Sensor Appliance
Configure blocking on the Sensor Appliance
Configure TCP resets on the Sensor Appliance
Configure rate limiting on the Sensor Appliance
Configure signature engines on the Sensor Appliance
Use IDM to configure the Sensor Appliance
Configure event action on the Sensor Appliance
Configure event monitoring on the Sensor Appliance
Configure advanced features on the Sensor Appliance
Configure and tune Cisco IOS IPS
Configure SPAN & RSPAN on Cisco switches
Implement Identity Management
Configure RADIUS and TACACS+ security protocols
Configure LDAP
Configure Cisco Secure ACS
Configure certificate-based authentication
Configure proxy authentication
Configure 802.1x
Configure advanced identity management features
Configure Cisco NAC Framework
Implement Control Plane and Management Plane Security
Implement routing plane security features (protocol authentication, route filtering)
Configure Control Plane Policing
Configure CP protection and management protection
Configure broadcast control and switchport security
Configure additional CPU protection mechanisms (options drop, logging interval)
Disable unnecessary services
Control device access (Telnet, HTTP, SSH, Privilege levels)
Configure SNMP, Syslog, AAA, NTP
Configure service authentication (FTP, Telnet, HTTP, other)
Configure RADIUS and TACACS+ security protocols
Configure device management and security
Configure Advanced Security
Configure mitigation techniques to respond to network attacks
Configure packet marking techniques
Implement security RFCs (RFC1918/3330, RFC2827/3704)
Configure Black Hole and Sink Hole solutions
Configure RTBH filtering (Remote Triggered Black Hole)
Configure Traffic Filtering using Access-Lists
Configure IOS NAT
Configure TCP Intercept
Configure uRPF
Configure CAR
Configure NBAR
Configure NetFlow
Configure Anti-Spoofing solutions
Configure Policing
Capture and utilize packet captures
Configure Transit Traffic Control and Congestion Management
Configure Cisco Catalyst advanced security features
Identify and Mitigate Network Attacks
Identify and protect against fragmentation attacks
Identify and protect against malicious IP option usage
Identify and protect against network reconnaissance attacks
Identify and protect against IP spoofing attacks
Identify and protect against MAC spoofing attacks
Identify and protect against ARP spoofing attacks
Identify and protect against Denial of Service (DoS) attacks
Identify and protect against Distributed Denial of Service (DDoS) attacks
Identify and protect against Man-in-the-Middle (MiM) attacks
Identify and protect against port redirection attacks
Identify and protect against DHCP attacks
Identify and protect against DNS attacks
Identify and protect against Smurf attacks
Identify and protect against SYN attacks
Identify and protect against MAC Flooding attacks
Identify and protect against VLAN hopping attacks
Identify and protect against various Layer2 and Layer3 attacks
