Hand notes-CCNA Security 210-260-Part-2
Securing
Routing Protocols and the Control Plane
Securing
the Control Plane
The control plane ensures that the management and data planes are
maintained and operational. Control plane packets are network device–generated
or received packets that are used for the creation and operation of the network
itself. Some examples of control plane functions include routing protocols
(for example, BGP, OSPF, EIGRP), as well as protocols like Internet Control
Message Protocol (ICMP) and the Resource Reservation Protocol (RSVP).
In many cases, you can disable the reception and transmission of certain types
of packets on an interface to minimize the amount of CPU load that is required
to process unneeded packets.
Process switched traffic falls into two primary categories:
+ Receive adjacency traffic: This traffic contains an entry in the
Cisco Express Forwarding (CEF) table whereby the next router hop is the
device itself, which is indicated by the term receive in the show ip
cef CLI. Any of the IP
addresses/subnets for which “receive” is listed as the Next Hop indicates that
packets destined for this address space will end up hitting the control plane
and CPU.
+ Data plane traffic requiring special processing by the CPU: The
following types of data plane traffic require special processing by the CPU
resulting in a performance impact on the CPU:
+ Access control list
(ACL) logging:
+ Unicast Reverse Path
Forwarding (Unicast RPF)
+ IP options: Any IP
packets with options included must be processed by the CPU
+ Fragmentation: Any
IP packet that requires fragmentation must be passed to the CPU for processing
+ Time-To-Live (TTL)
expiry: Packets that have a TTL value less than or equal to 1 require
“Internet Control Message Protocol Time Exceeded
+ ICMP unreachables:
Packets that result in ICMP unreachable messages due to routing, maximum transmission unit
(MTU), or filtering are processed by the CPU
+ Traffic requiring an
ARP request: Destinations for which an ARP entry does not exist require
processing by the CPU
+ Non-IP traffic: All
non-IP traffic is processed by the CPU
Control
Plane Policing
Control plane policing (CoPP) can be used to identify the type and
rate of traffic that reaches the control plane of the Cisco IOS device.
# show policy-map
control-plane
CoPP is a Cisco IOS-wide feature designed to allow users to manage the
flow of traffic handled by the route processor of their network devices.
In Example 13-2, only BGP and Secure Shell (SSH) traffic from trusted
hosts (that is, devices in the 192.168.1.0/24 subnet) is permitted to reach the
Cisco IOS device CPU. In addition, certain types of ICMP traffic destined to
the network infrastructure (that is, devices with IP addresses in the
10.1.1.0/24 subnet) will be rate-limited to 5000 packets per second (pps).
!
access-list 101
permit icmp any 10.1.1.0 0.0.0.255 echo
access-list 101
permit icmp any 10.1.1.0 0.0.0.255 echo-reply
access-list 101
permit icmp any 10.1.1.0 0.0.0.255 time-exceeded
access-list 101
permit icmp any 10.1.1.0 0.0.0.255 ttl-exceeded
access-list 123 permit
tcp 192.168.1.0 0.0.0.255 any eq 22
access-list 123 permit
udp 192.168.1.0 0.0.0.255 any eq bgp
access-list 123 deny tcp any any eq 22
access-list 123 deny udp any any eq bgp
access-list 123
deny ip any any
!
class-map
match-all ICMP
match access-group 101
class-map
match-all UNDESIRABLE-TRAFFIC
match access-group 123
!
policy-map COPP-INPUT-POLICY
class UNDESIRABLE-TRAFFIC
drop
class ICMP
police 50000 5000 5000 conform-action
transmit exceed-action drop
!
control-plane
service-policy input COPP-INPUT-POLICY
!
CCNA-Router-1#
show policy-map control-plane
Control
Plane Protection
Control plane protection (CPPr) is another feature, similar to
control plane policing, that can help to mitigate the effects on the CPU of
traffic that requires processing by the CPU.
CPPr can restrict traffic with finer
granularity by dividing the aggregate control plane into three separate
control plane categories known as subinterfaces:
+ Host subinterface
+ Transit subinterface
+ CEF-Exception subinterface
CPPr feature also additionally provides the following:
+ Port-filtering feature: Enables the policing and dropping of packets
that are sent to closed or nonlistening TCP or UDP ports
+ Queue-thresholding feature: Limits the number of packets for a
specified protocol that are allowed in the control-plane IP input queue
Securing
Routing Protocols
MD5 authentication is still susceptible to brute-force and dictionary
attacks if weak passwords are chosen. You are advised to use passwords with
sufficient randomization.
Implement
Routing Update Authentication on OSPF
MD5 authentication for OSPF requires configuration at both the interface
level, that is, for each interface in which OSPF will be used, as well within
the router OSPF process itself. Use the ip ospf authentication-key
interface command to specify this password.
If you enable MD5 authentication with the message-digest keyword,
you must configure a password with the ip ospf message-digest-key
interface command.
!
interface GigabitEthernet0/1
ip
address 192.168.10.1 255.255.255.0
ip
ospf authentication message-digest
ip
ospf message-digest-key 1 md5 CCNA
!
router ospf 65000
router-id
192.168.10.1
area
0 authentication message-digest
network
10.1.1.0 0.0.0.255 area 10
network
192.168.10.0 0.0.0.255 area 0
!
Implement
Routing Update Authentication on EIGRP
As with OSPF, MD5 authentication for EIGRP requires configuration at the
interface level, there is no specific configuration required within the router
EIGRP process itself. EIGRP authentication also makes use of a key chain that
is configured in global configuration mode.
!
key chain CCNA
key
1
key-string
CCNA-SECURITY
!
!
interface Loopback0
ip
address 192.168.100.1 255.255.255.0
!
interface GigabitEthernet0/1
ip
address 192.168.10.1 255.255.255.0
ip
authentication mode eigrp 65000 md5
ip
authentication key-chain eigrp 65000 CCNA
!
router eigrp 65000
network
192.168.10.0
network
192.168.100.0
!
Implement
Routing Update Authentication on RIP
RIP Version 1 (RIPv1) does not support authentication. If you are sending
and receiving RIPv2 packets, you can enable RIP authentication on an interface.
!
key chain CCNA
key
1
key-string
CCNA-SECURITY
!
!
interface Loopback0
ip
address 192.168.100.1 255.255.255.0
!
!
interface GigabitEthernet0/1
ip
address 192.168.10.1 255.255.255.0
ip
rip authentication mode md5
ip
rip authentication key-chain CCNA
!
router rip
version
2
network
192.168.10.0
network
192.168.100.0
!
Implement Routing Update Authentication on BGP
Peer authentication with MD5
creates an MD5 digest of each packet sent as part of a BGP session. Peer
authentication with MD5 is configured with the password option to the neighbor BGP router configuration command.
interface Loopback1
ip
address 192.168.15.1 255.255.255.0
!
interface GigabitEthernet0/1
ip
address 192.168.10.1 255.255.255.0
!
router bgp 65000
bgp log-neighbor-changes
network 192.168.15.0
neighbor 192.168.10.2 remote-as 65100
neighbor 192.168.10.2 password CCNA-SECURITY
CCNA-Router-1#show
ip bgp neighbors | include Option Flags – Verifying MD5 authentication between BGP Peers
Understanding
Firewall Fundamentals
The word firewall commonly describes systems or devices that are placed
between a trusted and an untrusted network. Complete separation means that no
network connectivity exists, which does not serve anyone very well. By allowing
specific traffic through the firewall, you can implement a balance of the
required connectivity and security.
Firewall
Technologies
A firewall is a concept that can be implemented by a single device, a
group of devices, or even simply software running on a device such as a host or
a server. Could be implemented by the following:
+ A router or other Layer 3 forwarding device that has an access
list or some other method used to filter traffic that is trying to go between
two of its interfaces. Adaptive Security Appliance (ASA) firewall.
+ A switch that has two virtual LANs (VLAN) without any routing in
between them, which would absolutely keep traffic from the two different
networks separate (by not being able to have inter-VLAN communications).
+ Hosts or servers that are running software that prevents certain
types of received traffic from being processed and controls which traffic can
be sent. This is an example of a software firewall.
Objectives
of a Good Firewall
+ It must be resistant to attacks
+ Traffic between networks must be forced through the firewall
+ The firewall enforces the access control policy of the organization
Protective
Measures Provided by a Firewall
+ Exposure of sensitive systems to untrusted individuals: By
hiding most of the functionality of a host or network device, and permitting
only the minimum required connectivity to that given system
+ Exploitation of protocol flaws: configure a firewall to inspect
protocols to ensure compliance with the standards for that protocol at multiple
layers of the protocol stack.
+ Unauthorized users: By using authentication methods, a firewall
could control which user’s traffic is allowed through the firewall
+ Malicious data: A firewall can detect and block malicious data
Potential
Firewall Limitations
+ Configuration mistakes have serious consequences
+ Not all network applications were written to survive going through the
firewall
+ Individuals who are forced to go through a firewall might try to engineer
a way around it
+ Latency being added by the firewall
The Defense-in-Depth
Approach
Having just one single point of
control/security for your entire network is not wise. One solution, which is
really more an idea than a solution, is to use a defense-in-depth approach or
what is known as a layered approach to security. In short, it cannot be just a
single device protecting all of your network; it needs to be a team effort by
nearly all the devices.
Firewall
Methodologies
Network-based firewalls provide key features used for perimeter security.
May include:
+ Simple packet-filtering techniques
+ Proxy servers
+ NAT
+ Stateful inspection firewalls
+ Transparent firewalls
+ Next-generation context and application-aware firewalls
Static
Packet Filtering
Static packet filtering is based on Layer 3 and Layer 4 of the OSI model.
ACLs. Stateless (does not
maintain session information for current flows of traffic going through the
router).
Application
Layer Gateway
Application layer firewalls, which are also sometimes called proxy
firewalls or application gateways, can operate at Layer 3 and higher in the OSI
reference model. Most of these proxy servers include specialized application
software that takes requests from a client, puts that client on hold for a
moment, and then turns around and makes the requests as if it is its own
request out to the final destination. No direct communication occurs between
the client and the destination server.
Stateful
Packet Filtering
Stateful packet filtering is one of the most important firewall
technologies in use today. It is called stateful because it remembers the state
of sessions that are going through the firewall. In short, the reply traffic
goes back to the users successfully, but attackers on the outside trying to
initiate sessions are denied by default.
Application
Inspection
An application inspection firewall can analyze and verify protocols all
the way up to Layer 7 of the OSI reference model, but does not act as a proxy between
the client and the server being accessed by the client.
+ Can see deeper into the conversations
+ Awareness of the details at the application layer
+ Can prevent more kinds of attacks than stateful filtering on its own
Transparent
Firewalls
A transparent firewall is more about how we inject the firewall into the
network as opposed to what technologies it uses for filtering. A transparent
firewall can use packet-based filtering, stateful filtering, application
inspection as we discussed earlier, but the big difference with transparent
firewalls is that they are implemented at Layer 2.
Next-Generation
Firewalls
An example of an NGFW is the Cisco ASA with FirePOWER Services.
Using
Network Address Translation
Network Address Translation (NAT) is an important feature that is
often implemented on firewalls.
Inside,
Outside, Local, Global
+ Inside local: The real IP configured on an inside host
+ Inside global: The mapped/global address that the router is swapping
out for the inside host during NAT
+ Outside local: If performing NAT on outside devices (outside NAT), this
is the mapped address of the outside device (such as Server A) as it would
appear to inside hosts. If not doing outside NAT on the router, this appears as
the normal outside device’s IP address to the inside devices
+ Outside global: The real IP configured on an outside host, such as the
IP on Server A
NAT is also used to allow communications between two networks that
otherwise would have incompatible IP addressing (such as overlapping
addresses), and with the use of PAT, we have been able to extend the lifetime
of IPv4 for a least a decade longer than it should have been used.
Port
Address Translation
PAT device keeps track of individual sessions based on port numbers and
other unique identifiers, and then forwards all packets using a single source
IP address, which is shared - NAT with overload.
NAT
Deployment Options
+ Static NAT: This is a one-to-one permanent mapping
+ Dynamic NAT: Dynamic NAT involves having a pool of global
addresses and only mapping those global addresses to inside devices when those
inside devices have and need to go out to the Internet.
+ Dynamic PAT (NAT with overload): It combines the benefits of
dynamically assigning global addresses only when needed, and it uses overload
so that literally thousands of inside devices can be translated to the same
global IP address
+ Policy NAT/PAT: Policy-based NAT is based on a set of rules,
such as what is the source IP address, what is the destination IP address, and
which ports are used that would qualify that packet to have NAT/PAT applied to
it.
Creating
and Deploying Firewalls
Firewall
Technologies
Most commercial firewalls today can do packet filtering, application
layer inspection, stateful packet filtering, NAT (in all its flavors), AAA
functions, and perform virtual private network (VPN) services.
Firewall
Design Considerations
+ Firewalls should be placed at security boundaries
+ Firewalls should be a primary security device, but not the only
security device or security measure on the network.
+ A policy that starts with a “deny all” attitude and then specifically
only permits traffic that is required is a better security posture than a
default “permit all” attitude first and then denying traffic specifically not
wanted
+ Leverage the firewall feature that best suits the need
+ Make sure that physical security controls and management access to the
firewall devices, and the infrastructure that supports them such as cables and
switches, are secure
+ Have a regularly structured review process looking at the firewall logs
+ Practice change management for any configuration modification on the
firewalls
Firewall
Access Rules
+ Rules based on service control: access to web servers, both HTTP
and HTTPS, is allowed while all other types of traffic are denied
+ Rules based on address control: These rules are based on the
source/destination addresses involved
+ Rules based on direction control: These rules specify where the
initial traffic can flow.
+ Rules based on user control: This can be implemented via AAA
services
+ Rules based on behavior control
Packet-Filtering
Access Rule Structure
In the context of packet filtering, an ACL is applied to an interface
either inbound or outbound on that interface.
Firewall
Rule Design Guidelines
+ Use a restrictive approach as opposed to a permissive approach for all
interfaces and all directions of traffic.
+ Presume that your internal users’ machines may be part of the security
problem
+ Be as specific as possible in your permit statements, such as avoiding
the use of the keyword any or all IP protocols if possible
+ Recognize the necessity of a balance between functionality and security
+ Filter bogus traffic, and perform logging on that traffic. Even if you
think your service provider will deny the traffic, you should implement the
same filtering on your perimeter routers as well
+ Periodically review the policies that are implemented on the firewall
to verify that they are current and correct
Rule
Implementation Consistency
For any changes that will be
made to a firewall, a change control procedure should identify exactly what is
going to be done, why it is going to be done, and the approval of the person in
charge of making that authorization for the work to be done.
Results
of Inconsistent or Ill-Considered Rule Implementation
+ Rules that are too promiscuous: allow more access than is
necessary for the business requirement
+ Redundant rules: If a rule is already in place as allowing a
specific flow of traffic, a second rule for that does not need to be added to
the control lists
+ Shadowed rules: incorrect placement of ACL. Access control entries are added by default to the bottom of an ACL
+ Orphaned rules: This most likely results from a configuration
error that is referencing incorrect IP addresses that would never be seen by
the firewall
+ Incorrectly planned rules: This may be due to a lack of
understanding what protocols (and/or ports) are really used by the devices in
the network with the applications in use.
+ Incorrectly implemented rules: This results from an
administrator implementing the incorrect port, protocol, or IP information on
the firewall
ACLs can be configured in Cisco IOS and Cisco ASA to permit or deny
traffic. An ACL is a sequential list of rules that includes at least one permit
statement and may also include one or more deny statements.
IP packets are routed to the egress interface and then processed by the
outbound ACL.
Implementing
Cisco IOS Zone-Based Firewalls
Cisco has implemented a stateful firewall feature set in Cisco IOS
Software called zone-based firewall (ZBF).
How
Zone-Based Firewall Operates
With ZBFs, interfaces are placed into zones. Zones are created by the
network administrator, using any naming convention that makes sense (although
names such as inside, outside, and demilitarized zone [DMZ] are quite common).
Specific
Features of Zone-Based Firewalls
+ Stateful inspection
+ Application inspection
+ Packet filtering
+ URL filtering
+ Transparent firewall
+ Support for virtual routing and forwarding (VRF)
+ Access control lists (ACL) are not required as a filtering method to
implement the policy
Uniform resource locator (URL) filtering refers to the ability to
control what traffic is permitted or denied (mostly denied) based on the URL
that is trying to be accessed by the client.
VRFs are virtual routing tables on a Cisco router
that can be used to compartmentalize the routing tables on the router instead
of keeping all the routes in the global (primary) routing tables.
Zones
and Why We Need Pairs of Them
A zone is a logical area where devices with similar trust levels reside.
By default, any traffic to or from the self zone (the router itself)
is allowed, but you can change this policy. For the rest of the
administrator-created zones, no traffic is allowed between interfaces in different
zones. For interfaces that are members of the same zone, all traffic is
permitted by default.
Putting
the Pieces Together
Cisco uses a language called the Cisco Common Classification Policy
Language (C3PL) for the implementation of the policy. This process
has three primary components:
+ Class maps: These are used to identify traffic, such as traffic
that should be inspected. L3 to L7. A class map can specify that all match
statements have to match (which is a match-all condition) or can specify
that matching any of the entries is considered a match (which is a match-any condition).
+ Policy maps: These are the actions that should be taken on the
traffic. The primary actions that can be implemented by the policy map are inspect
(which means that stateful inspection should happen), permit (which
means that traffic is permitted but not inspected), drop, or log.
+ Service policies: This is where you apply the policies,
identified from a policy map, to a zone pair.
The default policy for traffic that is trying to be initiated between two
zones is an implicit deny.
Policy Map Actions
+ Inspect (stateful): This should be used on transit traffic
initiated by users who expect to get replies from devices on the other side of
the firewall
+ Pass (no stateful): traffic that does not need a reply
+ Drop: Traffic you do not want to allow between the zones
+ Log
Service
Policies
A service policy is applied to a zone pair. The zone pair represents a
unidirectional flow of traffic between two zones. A specific zone pair can have
only a single service policy assigned to it.
Create de class-map to match either telnet or ICMP packets (match-any)
R3(config)#
class-map type inspect match-any MY-CLASS-MAP
R3(config-cmap)#
match protocol telnet
R3(config-cmap)#
match protocol icmp
Create the policy which will use the class-map
R3(config)#
policy-map type inspect MY-POLICY-MAP
R3(config-pmap)#
class type inspect MY-CLASS-MAP
R3(config-pmap-c)#
inspect
Create security zones
R3(config)# zone
security inside
R3(config)# zone
security outside
Create a zone-pair
R3(config-sec-zone)#
zone-pair security in-to-out source inside destination outside
Use the policy-map
R3(config-sec-zone-pair)#
service-policy type inspect MY-POLICY-MAP
Put interfaces in zones
R3(config)#
interface GigabitEthernet3/0
R3(config-if)#
description Belongs to outside zone
R3(config-if)#
zone-member security outside
R3(config)#
interface GigabitEthernet1/0
R3(config-if)#
description Belongs to inside zone
R3(config-if)#
zone-member security inside
The
Self Zone
Traffic directed to the router itself (as opposed to traffic going
through the router as transit traffic that is not destined directly to the
router) involves the self zone. Regarding the self zone, if there is a zone
pair but no policy is applied, the default behavior is to forward all traffic.
Configuring
and Verifying Cisco IOS Zone-Based Firewalls
First Things First
When configuring the ZBF Wizard, you can choose from three security
levels:
+ High Security: With this setting, the firewall identifies and
drops instant messaging and peer-to-peer traffic.
+ Medium Security: This is similar to the High Security option,
but it does not check web and e-mail traffic for protocol compliance.
+ Low Security: The router does not perform any application layer
inspection. It does do generic TCP and UDP inspection.
Verifying
the Configuration from the Command Line
R3# show class-map
type inspect
R3# show
policy-map type inspect zone-pair ccp-zp-in-out sessions
Implementing
NAT in Addition to ZBF
R3(config)# access-list 2 permit 10.0.0.0 0.0.0.255
R3(config)#
interface GigabitEthernet3/0
R3(config-if)# ip
nat outside
R3(config)#
interface GigabitEthernet1/0
R3(config-if)# ip
nat inside
R3(config)# ip nat
inside source list 2 interface GigabitEthernet3/0 overload
Verifying Whether
NAT Is Working
R3# show ip nat
translations
Configuring
Basic Firewall Policies on Cisco ASA
ASA Features and
Services
+ Packet filtering: Simple packet filtering normally represents an
access list. The most significant difference between an access-list on an ASA
versus an access list on a router is that the ASA never ever uses a wildcard
mask.
+ Stateful filtering: by default, the ASA enters stateful tracking
information about packets that have been initially allowed through the
firewall. Probably the most significant and most used feature on the ASA.
+ Application inspection/awareness: The ASA can listen in on
conversations between devices on one side and devices on the other side of the
firewall. The benefit of listening in is so that the firewall can pay attention
to application layer information. The challenge with this is that the initial
packets for this data connection are initiated from the server on the outside
sometimes.
+ Network Address Translation (NAT): It supports inside and
outside NAT, and both static and dynamic NAT and PAT, including Policy NAT,
which is only triggered based on specific matches of IP addresses or ports.
Also it supports NAT exemption (certain traffic should not be translated) – NAT
zero.
+ DHCP: The ASA can act as a Dynamic Host Configuration Protocol
(DHCP) server or client or both.
+ Routing: RIP, EIGRP, OSPF, static.
+ Layer 3 or Layer 2 implementation: The ASA can be implemented as
a traditional Layer 3 firewall, which has IP addresses assigned to each of its
routable interfaces. The other option is to implement a firewall as a
transparent firewall
+ VPN support: The ASA can operate as either the head-end or
remote-end device for VPN tunnels.
+ Object groups: An object group is a configuration item on the
ASA that refers to one or more items. The benefit of an object group is that a
single entry in an ACL could refer to an object group as the source IP or
destination IP address in an individual access control entry.
+ Botnet traffic filtering: A botnet is a collection of computers
that have been compromised.
+ Advanced malware protection (AMP): The Cisco ASA provides
next-generation firewall (NGFW) capabilities
+ High availability: By using two firewalls in a high-availability
failover combination, you can implement protection against a single system
failure
+ AAA support: locally or external ACS server.
ASA
Security Levels
The ASA uses security levels associated with each routable interface. The
security level is a number between 0 and 100. The bigger the number, the more
trust you have for the network that the interface is connected to. So, you do
three things to make interfaces on the ASA operational:
+ Assign a security level to the interface
+ Assign a name to the interface
+ Bring up the interface with the no shutdown command
The best practice for allowing users to access a resource on your network
is to avoid placing your server on your internal private network - a common
name assigned to this third interface is the demilitarized zone (DMZ).
The
Default Flow of Traffic
By default ASA forwards traffic from a high security level host to a
lower security level host. By default, if two interfaces are both at the exact
same security level, traffic is not allowed between those two interfaces. Also
by default the ASA does not like to (meaning it will not) receive a packet on a
specific interface and route the same packet out of the exact same interface
(hairpin routing).
Packet
Filtering on the ASA
To provide access, you can implement packet filtering ACLs on the
interfaces.
+ Inbound to an interface: Traffic that is going into an interface
(any interface).
+ Inbound from a security level perspective: Traffic that is being
routed by the ASA from a lower-security interface to a higher-security
interface
+ Outbound to an interface: Traffic that is exiting an interface
(any interface) is also referred to as egress traffic (from an interface
perspective).
+ Outbound from a security level perspective: Traffic that is
being routed by the ASA from a high-security interface to a lower-security interface
Implementing
a Packet-Filtering ACL
The big challenge with ACLs comes into play when you apply them inbound
on a high-security interface such as the inside interface. So, if you are using
ACLs on each interface of the ASA, the security levels no longer control what
the initial traffic flows may be.
Modular
Policy Framework
For IOS ZBFs, class maps are used to identify traffic, policy maps are
used to implement actions on that traffic, and the application of those
policies is done with the service policy commands. On the ASA, you also use
class maps to identify traffic, policy maps to identify the actions you are
going to take on that traffic, and service policy commands to implement the
policy you are going to take on that traffic, and service policy commands to
implement the policy. The service policies can attach the policy to a specific
interface or can be applied globally, which would affect all interfaces on the
ASA.
Modular Policy Framework (MPF) is to allow the ASA to perform
application layer inspection on FTP traffic, to listen in and dynamically allow
the data connection to commence from the server.
Class maps can identify traffic based on Layer 3 and Layer 4:
+ Referring to an ACL
+ Looking at the differentiated services code point (DSCP)/IP Precedence
fields of the packet
+ TCP or UDP ports
+ IP Precedence
+ Real-time Transport Protocol (RTP) port numbers
+ VPN tunnel groups
Configuring
the ASA
IP Addresses for
Clients
Configuration >
Device Management > DHCP > DHCP Server in ASDM or CLI:
ASA1(config)#
dhcpd address 10.0.0.101-10.0.0.132 inside
ASA1(config)#
dhcpd enable inside
ASA1(config)#
dhcpd dns 10.8.8.8 interface inside
ASA1(config)#
dhcpd domain example.org interface inside
The ASA, by default, assigns itself as the default gateway for the DHCP
clients to use.
Basic
Routing to the Internet
Configuration >
Device Setup > Routing.
From this location, you can view or manage static routes and dynamic routing
protocols.
ASA1(config)#
route outside 0.0.0.0 0.0.0.0 23.1.2.7
NAT
and PAT
Configuration
> Firewall > NAT Rules
Create an object group to use for translation
ASA1(config)#
object network Inside_Hosts
ASA1(config-network-object)#
subnet 10.0.0.0 255.255.255.0
ASA1(config-network-object)#
description Inside_Hosts
Make the translation
ASA1(config)# nat
(inside,outside) 1 source dynamic Inside_Hosts interface
Permitting
Additional Access Through the Firewall
Configuration >
Firewall > Access Rules
Using
Packet Tracer to Verify Which Packets Are Allowed
ASA1#
packet-tracer input inside tcp 10.0.0.101 1065 22.33.44.55 80
Cisco
IDS/IPS Fundamentals
Cisco intrusion detection systems (IDS) and intrusion
prevention systems (IPS) are some of many systems used as part of a
defense-in-depth approach to protecting the network against malicious traffic.
IPS
Versus IDS
What
Sensors Do
A sensor is a device that looks at traffic on the network and then makes
a decision based on a set of rules to indicate whether that traffic is okay or
whether it is malicious in some way.
Difference
between IPS and IDS
You can place a sensor in the network to analyze network traffic in one
of two ways. The first option is to put a sensor inline with the
traffic, which just means that any traffic going through your network is forced
to go in one physical or logical port on the sensor. At the sensor, the traffic
is analyzed. That is the concept behind intrusion prevention systems (IPS).
IDS is detecting the attack (hence the term
intrusion detection system) but is not preventing the attack.
Sensor
Platforms
+ A dedicated IPS appliance, such as the 4200 series
+ Software running on the router in versions of IOS that support
it
+ A module in an IOS router, such as the AIM-IPS or NME-IPS
modules
+ A module on an ASA firewall in the form of the AIP module
for IPS
+ A blade that works in a 6500 series multilayer
switch
+ Cisco FirePOWER 8000/7000 series appliances
+ Virtual Next-Generation IPS (NGIPSv) for VMware
+ ASA with FirePOWER services
Positive/Negative
Terminology
+ False positive: the sensor generates an alert about traffic and
that traffic is not malicious or important as related to the safety of the
network
+ False negative: there is malicious traffic on the network, and
for whatever reason the IPS/IDS did not trigger an alert
+ True positive: there was malicious traffic and that the sensor
saw it and reported on it
+ True negative: there was normal nonmalicious traffic, and the
sensor did not generate any type of alert
Identifying
Malicious Traffic on the Network
There are several different methods that sensors can be configured to use
to identify malicious traffic, including the following:
+ Signature-based IPS/IDS: A signature is just a set of rules
looking for some specific pattern or characteristic in either a single packet
or a stream of packets. It is the most significant method used on sensors
today.
+ Policy-based IPS/IDS: This type of traffic matching can be
implemented based on the security policy for your network.
+ Anomaly-based IPS/IDS: An example of anomaly-based IPS/IDS is
creating a baseline of how many TCP sender requests are generated on average
each minute that do not get a response; used to identify worms that may be
propagating through the network
+ Reputation-based IPS/IDS: collects input from systems all over
the planet that are participating in global correlation; may include
descriptors such as blocks of IP addresses, URLs, DNS domains, and so on as
indicators of the sources for these attacks.
Possible
Sensor Responses to Detected Attacks
+ Deny attacker inline: denies packets from the source IP address
of the attacker for a configurable duration of time, after which the deny
action can be dynamically removed.
+ Deny connection inline: terminates the packet that triggered the
action and future packets that are part of the same TCP connection
+ Deny packet inline: terminates the packet that triggered the
event
+ Log attacker (source) packets: begins to log future packets
based on attacker’s source IP address
+ Log victim (destination) packets: begins to log all IP packets
with a destinations address of the victim
+ Log pair (source, destination) packets
+ Produce alert: This is the default behavior for most signatures
enabled on a sensor.
+ Produce verbose alert: same as above plus it includes a copy of
the packets that triggered the alert
+ Request block connection: This action causes the sensor to
request a blocking device to block based on the source IP address of the
attacker, the destination IP address of the victim, and the ports involved in
the packet that triggered the alert.
+ Request block host: blocks the attacker’s/destination’s IP
address regardless of the port used
+ Request SNMP trap
+ Reset TCP
connection: send a proxy TCP reset to
the attacker.
Controlling
Which Actions the Sensors Should Take
This is implemented using a calculated result called a risk rating. The
maximum value for risk rating is 100.
There are three primary factors, or influencers, of the final risk rating
value:
+ Signature fidelity rating (SFR): The accuracy of the signature
as determined by the person who created that signature
+ Attack severity rating (ASR): The criticality of the attack as
determined by the person who created that signature
+ Target value rating (TVR): The value that you, as an
administrator, have assigned to specific destination IP addresses or subnets
where the critical servers/ devices live.
Implementing
Actions Based on the Risk Rating
Although it is true that you can implement actions as properties of
individual signatures, it makes the most sense, and it is much more scalable to
manage, to configure actions based on the risk rating that is created as a
result of the signature matches.
IPS/IDS
Evasion Techniques
+ Traffic fragmentation: the attacker splits malicious traffic
into multiple parts; IPS/IDS does complete session reassembly to see the entire
traffic
+ Traffic substitution and insertion: The attacker substitutes
characters in the data using different formats that have the same final meaning
+ Protocol level misinterpretation: Cisco does TTL analysis and
TCP checksum validation
+ Timing attacks (for example, “low and slow” attacks): attacker
sending packets at lower packets per second
+ Encryption and tunneling
+ Resource exhaustion: If thousands of alerts are being generated
by distracter attacks; dynamic and configurable summarization.
Managing
Signatures
The most effective way to identify malicious traffic in the Cisco IPS/IDS
systems is through the use of signature-based matching. Cisco organizes its
signatures into groups that have similar characteristics. For each of its
groups, a signature micro-engine is used to govern that set of signatures.
Micro-Engines
(Groupings of Signatures)
+ Atomic: Signatures that can match on a single packet, as
compared to a string of packets
+ Service: Signatures that examine application layer services,
regardless of the operating system
+ String or Multistring: Supports flexible pattern matching and
can be identified in a single packet or group of packets, such as a session
+ Other: Miscellaneous signatures that may not specifically fit
into the previously mentioned other categories
Signature
or Severity Levels
Instead of having to set a numeric value for the severity, the interface
for IPS/IDS prompts us for one of four levels:
+ Informational
+ Low
+ Medium
+ High
Monitoring
and Managing Alarms and Alerts
Three main protocols are used in delivering alerts. They are Security
Device Event Exchange (SDEE), syslog, and SNMP. SDEE is
used for real-time delivery of alerts, and is the most secure method for
delivering alerts. Applications: IPS Manager Express (IME), Cisco Security
Manager (CSM).
Security
Intelligence
So, in short, the more sensors you have reporting, the more granular and
complete the information is going to be about the attacks and the patterns that
exist in the network. With global correlation, we can increase the risk rating
for specific attacks if they are from source addresses that we identified as
suspect in information learned from external sensors through the global
correlation process. Global correlation is available on the sensor appliances
but does not have to be enabled – Cisco Security Intelligence Operations
(SIO)
IPS/IDS
Best Practices
+ Implement an IPS so that you can analyze traffic going to your critical
servers and other mission-critical devices, or the “crown jewels” for your
organization.
+ If you cannot afford dedicated appliances, use modules or IOS
software-based IPS/IDS
+ Take advantage of global correlation to improve your resistance against
attacks that may be targeting your organization
+ Use a risk-based approach, where countermeasures occur based on the
calculated risk rating as opposed to manually assigning countermeasures to
individual signatures
+ Use automated signature updates when possible instead of manually
installing updates
+ Continue to tune the IPS/IDS infrastructure as traffic flows and
network devices and topologies change
Cisco
Next-Generation IPS Solutions
+ Cisco FirePOWER 8000/7000 series appliances
+ Virtual Next-Generation IPS (NGIPSv) for VMware
+ ASA with FirePOWER Services
+ FireSIGHT Management Center
Mitigation
Technologies for E-mail Based and Web-Based Threats
The Cisco E-mail Security Appliances (ESA) and the Cisco Web
Security Appliance (WSA) provide a great solution designed to
protect corporate users against these threats. Cisco has added Advanced
Malware Protection (AMP) to the ESA and WSA to allow security
administrators to detect and block malware and perform continuous analysis and
retrospective alerting.
Mitigation
Technology for E-mail-Based Threats
E-mail-Based
Threats
+ Spam: unsolicited e-mail messages that can be advertising a
service or (typically) a scam or a message with malicious intent
+ Malware attachments: mail messages containing malicious software
+ Phishing: an attacker’s attempt to fool a user that such e-mail
communication comes from a legitimate entity or site, such as banks, social
media websites, online payment processors, or even corporate IT communications.
+ Spear phishing: These phishing e-mails are directed to specific
individuals or organizations
Cisco
Cloud E-mail Security
Cisco cloud e-mail security provides a cloud-based solution that allows
companies to outsource the management of their e-mail security management.
Cisco
Hybrid E-mail Security
The Cisco hybrid e-mail security solution combines both cloud-based and
on-premises ESAs.
Cisco E-mail Security Appliance
+ Cisco X-Series E-mail Security Appliances
+ Cisco X1070:
High-performance ESA for service providers and large enterprises
+ Cisco C-Series E-mail Security Appliances
+ Cisco C680: The
high-performance ESA for service providers and large enterprises
+ Cisco C670: Designed for
medium-size enterprises
+ Cisco C380: Designed for
medium-size enterprises
+ Cisco C370: Designed for
small- to medium-size enterprises
+ Cisco C170: Designed for
small businesses and branch offices
Features
supported by the Cisco ESA:
+ Access control: Controlling access for inbound senders according
to the sender’s IP address, IP address range, or domain name.
+ Antispam
+ Network Antivirus
+ Advanced malware
protection (AMP): Allows security administrators
to detect and block malware and perform continuous analysis and retrospective
alerting
+ DLP: The ability to detect any sensitive e-mails
and documents leaving the corporation
+ E-mail encryption
+ Outbreak filters: Preventive protection against new security
outbreaks and e-mail-based scams with SIO
The Cisco ESA acts as the e-mail gateway to the organization, handling
all e-mail connections, accepting messages, and relaying them to the
appropriate systems.
The Cisco ESA uses listeners to handle incoming SMTP connection requests.
A listener defines an e-mail processing service that is configured on an
interface in the Cisco ESA. The following listeners can be configured:
+ Public listeners for e-mail coming in from the Internet
+ Private listeners for e-mail coming from hosts in the corporate
(inside) network
Cisco
ESA Initial Configuration
+ Step 1. Log in to the Cisco ESA. The default username is admin,
and the default password is ironport
+ Step 2. Use the systemsetup command in CLI of the Cisco ESA to
initiate the System Setup Wizard
Mitigation
Technology for Web-Based Threats
The core solutions for mitigating web-based threats are the Cisco Cloud
Web Security (CWS) offering and the integration of advanced malware
protection (AMP) to the Cisco Web Security Appliance (WSA).
Cisco
CWS
Cisco CWS is a cloud-based security service from Cisco that provides
worldwide threat intelligence, advanced threat defense capabilities, and
roaming user protection. Cisco customers can connect to the Cisco CWS service
directly by using a proxy
autoconfiguration (PAC) file in the user endpoint or through connectors
integrated into the following Cisco products:
+ Cisco ISR G2 routers
+ Cisco ASA
+ Cisco WSA
+ Cisco AnyConnect Secure Mobility Client
Cisco
WSA
The Cisco WSA uses cloud-based intelligence from Cisco to help protect
the organization before, during, and after an attack. The Cisco WSA can be
deployed in explicit proxy mode or as a transparent proxy using the Web Cache Communication Protocol (WCCP).
The following are the different Cisco WSA models:
+ Cisco WSA S680: 6-12k users, 2 rack unit (RU), 2 octa core CPUs,
32GB of mem, 4,8TB of space
+ Cisco WSA S670
+ Cisco WSA S380: 1,5 to 6k users
+ Cisco WSA S370
+ Cisco WSA S170: up to 1,5k users, 1 RU, 1 dual core CPUs, 4GB of
mem, 500GB of space
The Cisco WSA runs Cisco AsyncOS operating system.
Cisco
Content Security Management Appliance
Cisco Security Management Appliance (SMA) is a Cisco product that
centralizes the management and reporting for one or more Cisco ESAs and Cisco
WSAs.
Mitigation
Technologies for Endpoint Threats
Antivirus
and Antimalware Solutions
The following are the most common types of malicious software:
+ Computer viruses: A malicious software that infects a host file
or system area to perform undesirable outcomes such as erasing data, stealing
information, or corrupting the integrity of the system
+ Worms: Viruses that replicate themselves over the network
infecting numerous vulnerable systems
+ Mailers and mass-mailer worms: A type of worm that sends itself
in an e-mail message
+ Logic bombs: A type of malicious code that is injected into a
legitimate application
+ Trojan horses: A type of malware that executes instructions
determined by the nature of the Trojan to delete files, steal data, and
compromise the integrity of the underlying operating system
+ Back doors: A piece of malware or configuration change that
allows attackers to control the victim’s system remotely
+ Exploits: A malicious program designed to “exploit” or take
advantage of a single vulnerability or set
+ Downloaders: A piece of malware that downloads and installs
other malicious content from the Internet to perform additional exploitation on
an affected system
+ Spammers: the act of sending unsolicited messages via e-mail,
instant messaging, newsgroups, or any other kind of computer or mobile device
communications
+ Key loggers: A piece of malware that captures the user’s
keystrokes on a compromised computer or mobile device
+ Rootkits: A set of tools that are used by an attacker to elevate
their privilege to obtain root-level access to be able to completely take
control of the affected system
+ Ransomware: A type of malware that compromises a system and then
demands a ransom from the victim to often pay the attacker in order for the
malicious activity to cease or for the malware to be removed from the affected
system – ex: Crypto Locker and Crypto Wall
Known antivirus programs:
+ Avast
+ AVG Internet Security
+ Bitdefender Antivirus Free
+ ZoneAlarm PRO Antivirus + Firewall and ZoneAlarm Internet Security
Suite
+ F-Secure Antivirus
+ Kaspersky Anti-Virus
+ McAfee Antivirus
+ Panda Antivirus
+ Sophos Antivirus
+ Norton AntiVirus
+ ClamAV: sponsored and maintained by Cisco and non-Cisco engineers
+ Immunet: a free community-based antivirus software maintained by Cisco
Sourcefire
Personal
Firewalls and Host Intrusion Prevention Systems
Are software applications that you can install on end-user machines or
servers to protect them from external security threats and intrusions.
Advanced
Malware Protection for Endpoints
Cisco AMP for Endpoints provides mitigation capabilities that go beyond
point-in-time detection. It uses threat intelligence from Cisco to perform retrospective
analysis and protection. Cisco AMP for Endpoints also provides device and file
trajectory capabilities to allow the security administrator to analyze the full
spectrum of the attack.
Cisco acquired a security company called ThreatGRID that provides
cloud-based and on-premise malware analysis solutions. Cisco integrated Cisco
AMP and ThreatGRID to provide a solution for advanced malware analysis with
deep threat analytics.
Hardware
and Software Encryption of Endpoint Data
E-mail
Encryption
When people refer to e-mail encryption, they often are referring to
encrypting the actual e-mail message so that only the intended receiver can
decrypt and read the message.
To effectively protect your e-mails, you should make sure of the
following:
+ The connection to your e-mail provider or e-mail server is actually
encrypted
+ Your actual e-mail messages are encrypted
+ Your stored, cached, or archived e-mail messages are also protected
The following are examples of e-mail encryption solutions:
+ Pretty Good Privacy (PGP): requires you to generate a
public and private key
+ GNU Privacy Guard (GnuPG)
+ Secure/Multipurpose Internet Mail Extensions (S/MIME):
requires you to install a security certificate on your computer
+ Web-based encryption e-mail service like Sendinc or JumbleMe
Encrypting
Endpoint Data at Rest
Much commercial and free software enables you to encrypt files in an
end-user workstation or mobile device. The following are a few examples of free
solutions:
+ GPG: GPG also enables you to encrypt files and folders on a
Windows, Mac, or Linux system
+ The built-in MAC OS X Disk Utility: enables you to create secure
disk images by encrypting files with AES 128-bit or AES 256-bit encryption
+ TrueCrypt: free encryption tool for Windows, Mac, and Linux
systems
+ AxCrypt: free Windows-only file encryption tool
+ BitLocker: Full disk encryption feature included in several
Windows operating systems
+ Many Linux distributions such as Ubuntu
+ MAC OS X FileVault: Supports full disk encryption on Mac OS X
systems
Virtual
Private Networks
Many organizations deploy virtual private networks (VPN) to provide data
integrity, authentication, and data encryption to ensure confidentiality of the
packets sent over an unprotected network or the Internet.
Many different protocols are used for VPN implementations, including the
following:
+ Point-to-Point Tunneling Protocol (PPTP) – very weak security
+ Layer 2 Forwarding (L2F) Protocol
+ Layer 2 Tunneling Protocol (L2TP)
+ Generic routing encapsulation (GRE)
+ Multiprotocol Label Switching (MPLS) VPN
+ Internet Protocol Security (IPsec)
+ Secure Sockets Layer (SSL)
VPN implementations can be categorized into two distinct groups:
+ Site-to-site VPNs: Enable organizations to establish VPN tunnels
between two or more network infrastructure devices in different sites so that
they can communicate over a shared medium such as the Internet. Many
organizations use IPsec, GRE, or MPLS VPN as site-to-site VPN protocols.
+ Remote-access VPNs: Enable users to work from remote locations
such as their homes, hotels, and other premises as if they were directly
connected to their corporate network. Many organizations use IPsec and SSL VPN
for remote access VPNs.
+ RADIUS is mainly used to allow users to authenticate into a network
+ TACACS is used to authenticate administrators
+ #show mac address-table count – number of MAC addresses
+ shutting down a switch port it removes all the MAC addresses
dynamically learned
+ CAM table overflow attack comes through MAC spoofing; use
Port-Security to protect (max MAC)
+ we need to specify a port in access mode in order to activate
port-security
+ the default behavior of port-security violation is shutdown
+ #show interfaces status err-disabled – shows ports in
err-disable state
+ use DHCP snooping to protect against rogue DHCP servers;
enable trusted ports on the switch
+ VLAN Hopping involves tricking a switch to have an access port
be trunk so we can communicate with other VLANs; protect through disabling
autonegotiation (Dynamic Trunking Protocol – DTP) on a port; manually
designate the port for what it needs to be – access or trunk port
+ #switchport mode access – removes the DTP and manually sets a
port in access
+ #switchport nonegociate - turn off trunking mode
+ never user VLAN 1; use separate VLAN for management (out-of-band), use
different native VLAN
+ unused ports should be put in shutdown and moved to some unused VLAN,
like 999
+ STP can be used to attack a network so to protect we use BPDU
Guard feature (globally or locally)
+ BPDU Filter doesn’t allow BPDU packets through but doesn’t
shutdown the port
+ #spanning-tree portfast default
+ # spanning-tree portfast bpduguard default – enable
globally Portfast and BPDU Guard
+ #spanning-tree portfast
+ #spanning-tree bpduguard enable – enable per interface Portfast
and BPDU Guard
+ #show spanning-tree summary – show information on STP regarding
Portfast and BPDU Guard
+ Gratuitous ARP – someone is sending its information without
anyone asking; it’s used for L2 Man-in-the-Middle attack; to protect we use DHCP
Snooping and Dynamic ARP Inspection (DAI)
+ Securing Data Plane: DHCP Snooping, Port-Security, no
DTP/trunking, BPDU Guard, DAI
+ Parser View is a “filter”
+ #show parser view – current view
+ Control-Plane Host – restrict what management protocols are
allowed
+ To activate RSA key for SSH we need a domain name and
hostname changed to other than Router.
+ #crypto key generate rsa modulus 1024 – command to create a key
+ #management-interface fa2/0 allow ssh https – restrict protocols
for management on interface
+ enable logging and send that information to a syslog server
+ enable IP Unicast RPF to check the direction the packets are
coming from
+ authenticate NTP process to have correct clock on the router
+ Use SNMPv3 because higher security with authentication; can use
trap to send information upstream
+ Cisco Configuration Professional (CCP) doesn’t support SNMPv3
+ use Secure-Boot to protect the IOS image and the start-up
configuration file
+ #show secure bootset – information about securing the IOS and
start-up file
+ To control the Data Plane we use ACLs for packet
filtering
+ Router self-generated traffic passes through an ACL with a deny ip any
any line; outbound ACL only filters transit traffic
+ an empty ACL lets all the traffic pass
+ Standard ACL can only match based on L3 source address; no. 1-99,
1300-1999
+ Extended ACL used to match destination source, port, protocol L3+L4;
no. 100-199, 2000-2699
+ ACLs can use object groups
+ IPv6 user send Router Solicitation (RS) message to get an
IPv6 address and receives a Router Advertisement (RA) message from a
router on the network running IPv6; autoconfiguration without DHCPv6
+ IPv6 has no ARP or broadcast; uses Network Discovery Protocol (NDP);
hosts join a multicast group and asks there what’s the address of someone
+ First group IPv6 from 2000 to 3FFF it’s a Global IPv6 address
+ Link local IPv6 address starts with FE80; used by routing protocols in advertisements
+ every address that starts with FF is a multicast address
+ ::1 is the local loopback
+ for OSPF routing protocol we need to have a router-ID, which can be an
IPv4 address, if none exists then we have to specify a router-ID
+ Secure IPv6: physical security, device hardening (close unused
services/), services, features, AAA
+ Secure Neighbor Discovery (SEND) used to mitigate rogue
DHCP servers in IPv6 – RA Snooping
+ to transport IPv6 traffic across IPv4 networks use tunneling; don’t use
Auto 6to4
+ use Proxy to hide a host from the outside traffic; ex: www traffic goes
through a proxy server which does all the communication on behalf of the local
host with the www server
+ Reflexive ACL like Stateful Filtering allow returned
traffic; use reflect name attribute to create a dynamic inbound
ACL from the outside to allow return traffic; create an inbound ALC on the
outside interface that evaluates name and denies everything else
+ Context Based Access Control (CBAC) it does stateful
filtering; uses inspect function ports
#ip inspect name
REMEMBER TCP
#ip inspect name
REMEMBER UDP
#ip inspect name
REMEMBER ICMP
#ip inspect
REMEMBER out – apply the inspection on
packets leaving the outside interface
+ Zone-Based Firewall (ZBF), default there is no traffic
between zones
+ ZBF identifies traffic by class-maps
+ ZBF’s policy-map takes the action: allow, pass and drop.
+ ZBF creates zone-pair, unidirectional
+ ZBF uses service-policy to say where to apply the action
+ ZBF contains a Self zone by default, which is the router; all traffic
is allowed between other zones and self- zone
+ ASA initial traffic from higher to lower security level is allowed
+ ASA initial traffic from lower to higher security level is denied
+ ASA features: stateful inspection, application and protocol inspection,
NAT/PAT, VPN, BotNet filter
+ ASA won’t accept HTTP requests for management, only HTTPS
+ IDS used in promiscuous mode
+ IDS could send messages to the router or/and the firewall to tell them
to block a source IP; on the router it does it by modifying an ACL, on a
firewall that’s done with a SHUN;
+ we can have a software IPS on a router – an IOS/IPS
+ IPS: physical appliance, software on IOS, hardware module, host based
software
+ True positive: threat detected, generated an alert and acted on it
+ False positive: acting by mistake on traffic that wasn’t malware; must
be eliminated – set exception
+ True negative: no malicious traffic happening – normal traffic
+ False negative: traffic that doesn’t seem malicious but it is
+ Signature matching is the first option for malicious traffic detection
(ping sweep, port scan etc); thousands created by Cisco exist on the appliances
or software IOS
+ Policy-based is another tool to identify malicious or unwanted traffic
+ Anomaly based method scans the traffic that goes over certain accepted
levels; ex 20 half sessions are accepted on the network within a minute, if
60/90/200 or more are seen that is an indication that there is a worm in the
network, for instance; then IPS steps in
+ Reputation based method uses global databases information on attacks
that happened to others
+ deny connections is better than IP addresses
+ log traffic to analyze later for better understanding on what’s
happening on the network
+ alerts generated let us know what’s happening; uses SDEE protocol on
top TCP.
+ Verbose alert sends the alert and the packet which triggered the alert
+ IDS/IPS can ask for help to block traffic, for example
+ IDS/IPS can ask for a TCP reset by sending it on behalf of the victim
(spoofing)
+ IOSv5 supports the latest IPS software based (has same signatures as
the appliance)
+ we need to download from Cisco the packages with the signatures and
update them regularly
+ we need the public key from Cisco to verify the packages
+ Security Device Events Exchange SDEE is in action
+ IPS software based uses separate files for the signatures, it doesn’t
put them in the running-config
+ Un-retired and retired signatures use memory
+ Cisco Security Manager (CSM) is used in corporate
networks
+ Event Action Filter (EAF)
+ Event Action Override uses Risk Rating (RR) to override
the default countermeasures
+ RR (Severity, Fidelity, Target Value Rating) = (SVR*Fid*TVR)/10.000;
1-100 value
+ an Enabled and Retired signature doesn’t do anything.
+ verify Source (IP Source Guard) to check spoofed addresses; IP Unicast
Reverse-Path can be used too
+ Confidentiality handles Encryption and Authentication
+ Symmetrical encryption uses one single Key for encryption and
decrypting
+ Symmetrical algorithms: DES, 3DES, AES (Advanced
Encryption Standard), IDEA
+ Asymmetrical algorithms use 2 Keys – pair, one to encrypt the message,
which is private, and a second to decrypt the message with its pair public key
+ Symmetrical is used to encrypt bulked data moved across the network
+ Asymmetrical is used for authentication functions
+ Asymmetrical algorithms used are RSA, DSA etc
+ Hashing helps us check the integrity of the packets: SHA, MD5-128
+ R1#veryfy /md5 flash:c2801xxx.bin – verify the flash of a
downloaded IOS
+ this method can be hacked because the hash itself is not secure; we use
Hashed Message Authentication Code (HMAC) to secure it with a secret key
+ with a Digital Signature we prove who is sending the data; the receiver
gets the public key
+ the encrypted hash IS the digital signature
+ Data – hash (checksum/digest) – encrypt the hash with the private key
(digital signature)
+ Primary objective of IPSec is Confidentiality
+ Second is Integrity with hashing
+ 3rd is Authentication, with a pre-shared key (PSK),
RSA signatures
+ 4th is to Prevent Anti-Replay attacks; it counts
packets
+ with IPSec there are two tunnels involved
+ basic IPSec without GRE doesn’t use IP addresses on the VPN tunnel
+ IKE – Internet Key Exchange; IKE Phase1 Tunnel – private conversation
between routers
+ IKE Phase2 Tunnel is for user traffic – the IPSec tunnel
+ SA – Security Association
+ DH group happens in step 2 of IKE Phase1; allows two
devices to negotiate and establish secrets – dynamically for
symmetrical algorithms, even though itself is an asymmetrical algorithm
+ Has 2 modes: Main mode (with more packets back and forth) and Aggressive
mode (IKE Phase2 is Quick mode)
+ PFS (Perfect Secrecy) works with IKE Phase2 tunnel
+ the routers during the IKE Phase1 can disagree on
one single option, the Lifetime; all others mush match
+ PSK are used once in IKE Phase1 for authentication, before the DH
+ Transform Set is in fact the IKE Phase2 setup for negotiation
+ the ACL is called a crypto ACL
+ Inside IPSec are two protocols: ESP (Encapsulation
Security Payload) and AH (Authentication Header), which is
not used now; is a L4 protocol 50
+ RC4 is a symmetrical encryption algorithm used with SSL
+ the public key comes inside a Digital Certificate, released by a
trusted Certificate Authority, with validity dates, issuer etc
+ user encrypts the key it wants to use with the server using the public
key it received so when it sends the key encrypted the server can decrypt it
using its private key so now both have the key for encrypting
+ user proves who he is by authentication with username and password,
usually
+ Clientless SSL VPN doesn’t use a IPSec VPN client on the user’s machine
(ex Cisco AnyConnect)
+ With SSL we don’t use Site-to-Site VPN
+ use more gate security
+ Smurf attack, one spoofs its address and request sessions from
you and you unwillingly reply to the real network which is also under attack,
not by you
+ Cisco Security Agent (CSA) is the host based IPS
+ Scan Safe from Cisco analyzes traffic, for cloud based services
(it is in the cloud)
+ IronPort can help against viruses and spam travelling through
emails
+ Cisco Security Manager (CSM) to manage many appliances at
once
+ enable secret takes precedence over enable password
+ the only password encrypted by default is the enable secret, with MD5
+ top layer Stratum 0 is for GPS and atomic watches with NTP
+ a Cisco router can’t serve as a Stratum 0 device, nor can it get it’s
time directly from one
+ a Cisco router can be a server, client or a peer in NTP process
+ use NTPv3 or higher, offers security features
+ to manually set the time and date you need to disable NTP first (any
active association)
+ NTP uses UDP port 123
+ when configure a Cisco router with NTP and it synchronizes it
gets Stratum level 8 by default; this value will change depending
on how further way it is from the Master
+ for unsynchronized clocks the Stratum level is 16
+ 127.127.7.1 is the IP address that the Master is using for a reference for itself
+ #show ntp status and #show ntp associations – most
important for troubleshoot
+ while telnet allows a single password as a valid entry ssh
requires both username and password
+ with ssh you must: define a domain, no “router”
named router and issue #crypto key generate rsa
+ telnet is disable by default
+ Password required, but not set error message – no password
defined on the VTY lines
+ if no enable passwords are set the remote user can’t get into
privileged mode – % No password set
error
+ if #privilege level 15 is set on VTY lines then the user telnets
directly into the privileged mode with the password set on VTY lines
+ if a username exists and login local is set on the VTY lines then that
user and passwords are used
+ SNMPv1/2 have “passwords” – the community strings, which are known, not
secure
+ SNMPv3 is not supported in Cisco Configuration Professional
+ to work with parser view you need two things: enable secret
and aaa new-model
+ TCP intercept can run in intercept mode or watch mode to protect
againt SYN-flood attack (DoS)
#ip tcp intercept
mode intercept/watch
create an ACL to link to the TCP intercept
#ip tcp intercept
list x
+ in exec mode dir doesn’t work for secure files
+ secure bootset cat be activated remotely, but not deactivated
+ VLAN hopping attacks: switch spoofing (with DTP), double tagging
+ BPDU Guard takes action upon receiving any BPDUs on the
port; works only with portfast
+ Root Guard takes action upon receiving superior BPDUs;
configured at the port level
+ #switchport port-security is issued on access ports
+ the defaults for port-security are: 1 MAC and shutdown action
+ DAI is performed or ARP messages received (not sent) by the device;
enabled with DHCP spooping
+ same as DHCP snooping all ports are by default untrusted
+ #ip arp inspection vlan
+ #show ip arp inspection
[interfaces]
+ RADIUS UDP 1812
+ TACACS+ TCP 49
+ TACACS+ server messages: accept, reject, continue
(more info required) or error (not failed auth)
