CISCO SECURE FIREWALL SERVICES MODULE (FWSM)
CONTENTS PART I INTRODUCTION CHAPTER TYPES OF FIREWALLS UNDERSTANDING PACKET-FILTERING FIREWALLS ADVANTAGES CAVEATS UNDERSTANDING APPLICATION/PROXY FIREWALLS UNDERSTANDING REVERSE-PROXY FIREWALLS UTILIZING PACKET INSPECTION REUSING IP ADDRESSES NAT PAT SUMMARY OVERVIEW OF THE FIREWALL SERVICES MODULE SPECIFICATIONS INSTALLATION PERFORMANCE VIRTUALIZATION COMPARING THE FWSM TO OTHER SECURITY DEVICES IOS FW PIX ASA HARDWARE ARCHITECTURE SOFTWARE ARCHITECTURE INTRODUCTION EXAMINING MODES OF OPERATION WORKING WITH TRANSPARENT MODE DISADVANTAGES TRAFFIC FLOW MULTIPLE BRIDGE GROUPS WORKING WITH ROUTED MODE REFERENCES UNDERSTANDING SECURITY LEVELS TRAFFIC FLOW BETWEEN INTERFACES NETWORK ADDRESS TRANSLATION/PORT ADDRESS TRANSLATION STATIC NAT NUMBER OF SIMULTANEOUS TCP CONNECTIONS NUMBER OF EMBRYONIC CONNECTIONS DNS NORANDOMSEQ TCP UDP STATIC PAT DYNAMIC NAT DYNAMIC PAT NAT CONTROL NAT BYPASS NAT 0 OR IDENTITY NAT STATIC IDENTITY NAT UNDERSTANDING CONTEXTS BENEFITS OF MULTIPLE CONTEXTS SEPARATING SECURITY POLICIES LEVERAGING THE HARDWARE INVESTMENT DISADVANTAGES OF MULTIPLE CONTEXTS ADDING AND REMOVING CONTEXTS ADDING A CONTEXT REMOVING A CONTEXT STORING CONFIGURATION FILES CHANGING BETWEEN CONTEXTS UNDERSTANDING RESOURCE MANAGEMENT MEMORY PARTITIONS PART II INITIAL CON?GURATION CON?GURING AND SECURING THE 6500/7600 CHASSIS UNDERSTANDING THE INTERACTION BETWEEN THE HOST-CHASSIS AND THE FWSM ASSIGNING INTERFACES SECURING THE 6500/7600 (HOST-CHASSIS) CONTROLLING PHYSICAL ACCESS BEING MINDFUL OF ENVIRONMENTAL CONSIDERATIONS CONTROLLING MANAGEMENT ACCESS DISABLING UNNECESSARY SERVICES CONTROLLING ACCESS USING PORT-BASED SECURITY CONTROLLING SPANNING TREE LEVERAGING ACCESS CONTROL LISTS SECURING LAYER LEVERAGING CONTROL PLANE POLICING PROTECTING A NETWORK USING QUALITY OF SERVICE EMPLOYING ADDITIONAL SECURITY FEATURES CON?GURING THE FWSM CONFIGURING FWSM IN THE SWITCH EXPLORING ROUTED MODE EXPLORING TRANSPARENT MODE USING MULTIPLE CONTEXT MODE FOR FWSM CONTEXT CONFIGURATIONS SYSTEM CONTEXT CONFIGURATIONS ADMIN CONTEXT CONFIGURATIONS PACKET CLASSIFIER IN FWSM CONTEXT MODE UNDERSTANDING RESOURCE MANAGEMENT IN CONTEXTS CONFIGURATION STEPS FOR FIREWALL SERVICES MODULE TYPE 1: CONFIGURING SINGLE CONTEXT ROUTED MODE TYPE 2: CONFIGURING SINGLE CONTEXT TRANSPARENT MODE TYPE 3: CONFIGURING MULTIPLE CONTEXT MIXED MODE ACCESS CONTROL LISTS INTRODUCING TYPES OF ACCESS LISTS UNDERSTANDING ACCESS CONTROL ENTRY UNDERSTANDING ACCESS LIST COMMIT UNDERSTANDING OBJECT GROUPS MONITORING ACCESS LIST RESOURCES CONFIGURING OBJECT GROUPS AND ACCESS LISTS WORKING WITH PROTOCOL TYPE WORKING WITH NETWORK TYPE WORKING WITH SERVICE TYPE WORKING WITH NESTING TYPE WORKING WITH ETHERTYPE CON?GURING ROUTING PROTOCOLS SUPPORTING ROUTING METHODS STATIC ROUTES DEFAULT ROUTES OPEN SHORTEST PATH FIRST SPF ALGORITHM OSPF NETWORK TYPES CONCEPT OF AREAS OSPF LINK STATE ADVERTISEMENT TYPES OF STUB AREA IN OSPF OSPF IN FWSM OSPF CONFIGURATION IN FWSM INTERFACE-BASED CONFIGURATION FOR OSPF PARAMETERS SUMMARIZATION STUB CONFIGURATION NSSA CONFIGURATION DEFAULT ROUTE INFORMATION TIMERS OSPF DESIGN EXAMPLE ROUTING INFORMATION PROTOCOL RIP IN FWSM CONFIGURATION EXAMPLE OF RIP ON FWSM BORDER GATEWAY PROTOCOL BGP IN FWSM BGP TOPOLOGY WITH FWSM AAA OVERVIEW UNDERSTANDING AAA COMPONENTS AUTHENTICATION IN FWSM AUTHORIZATION IN FWSM ACCOUNTING IN FWSM COMPARING SECURITY PROTOCOLS UNDERSTANDING TWO-STEP AUTHENTICATION UNDERSTANDING FALLBACK SUPPORT CONFIGURING FALLBACK AUTHENTICATION CONFIGURING LOCAL AUTHORIZATION UNDERSTANDING CUT-THROUGH PROXY IN FWSM CONFIGURING CUSTOM LOGIN PROMPTS USING MAC ADDRESSES TO EXEMPT TRAFFIC FROM AUTHENTICATION AND AUTHORIZATION MODULAR POLICY USING MODULAR POLICY IN FWSM UNDERSTANDING CLASSIFICATION OF TRAFFIC UNDERSTANDING APPLICATION ENGINES DEFINING POLICY MAPS CONFIGURING GLOBAL POLICY CONFIGURING SERVICE POLICY UNDERSTANDING DEFAULT POLICY MAP SAMPLE CONFIGURATION OF MODULAR POLICY IN FWSM PART III ADVANCED CON?GURATION UNDERSTANDING FAILOVER IN FWSM CREATING REDUNDANCY IN THE FWSM UNDERSTANDING ACTIVE/STANDBY MODE UNDERSTANDING ACTIVE/ACTIVE MODE UNDERSTANDING FAILOVER LINK AND STATE LINK REQUIREMENTS FOR FAILOVER SYNCHRONIZING THE PRIMARY AND SECONDARY FIREWALLS MONITORING INTERFACES CONFIGURING POLL INTERVALS DESIGN PRINCIPLE FOR MONITORING INTERFACES CONFIGURING SINGLE CONTEXT FWSM FAILOVER CONFIGURING MULTIPLE CONTEXT FWSM FAILOVER UNDERSTANDING APPLICATION PROTOCOL INSPECTION INSPECTING HYPERTEXT TRANSFER PROTOCOL INSPECTING FILE TRANSFER PROTOCOL WORKING WITH SUPPORTED APPLICATIONS CONFIGURING ARP INSPECTING ARP CONFIGURING PARAMETERS FOR ARP CONFIGURING MAC ENTRIES ADDING STATIC ENTRIES FILTERING WORKING WITH URLS AND FTP CONFIGURING ACTIVEX AND JAVA MANAGING AND MONITORING THE FWSM USING TELNET USING SECURE SHELL USING ADAPTIVE SECURITY DEVICE MANAGER CONFIGURING THE FWSM USING ASDM MANAGING THE FWSM FROM THE CLIENT SECURING ACCESS CONFIGURING THE FWSM FOR VPN TERMINATION CONFIGURING THE VPN CLIENT WORKING WITH SIMPLE NETWORK MANAGEMENT PROTOCOL EXAMINING SYSLOG WORKING WITH CISCO SECURITY MANAGER MONITORING ANALYSIS AND RESPONSE SYSTEM MULTICAST PROTOCOL INDEPENDENT MULTICAST UNDERSTANDING RENDEZVOUS POINT PIM INTERFACE MODES IGMP PROTOCOL MULTICAST STUB CONFIGURATION MULTICAST TRAFFIC ACROSS FIREWALLS FWSM 1 X AND 2 X CODE RELEASES FWSM 3 X CODE RELEASE CONFIGURATION METHODS METHOD 1: CONFIGURATION EXAMPLE FOR MULTICAST THROUGH FIREWALL IN SINGLE CONTEXT ROUTED MODE METHOD 2: CONFIGURATION EXAMPLE FOR MULTICAST THROUGH FIREWALL VIA GRE METHOD 3: CONFIGURATION EXAMPLE FOR MULTICAST THROUGH TRANSPARENT FIREWALL IN MULTIPLE CONTEXT MODE ASYMMETRIC ROUTING ASYMMETRIC ROUTING WITHOUT A FIREWALL ASYMMETRIC TRAFFIC FLOW IN A FIREWALL ENVIRONMENT AVOIDING ASYMMETRIC ROUTING THROUGH FIREWALLS OPTION 1: SYMMETRIC ROUTING THROUGH FIREWALLS OPTION 2: FIREWALL REDUNDANCY AND ROUTING REDUNDANCY SYMMETRY SUPPORTING ASYMMETRIC ROUTING IN FWSM ASYMMETRIC ROUTING SUPPORT IN ACTIVE/STANDBY MODE ASYMMETRIC ROUTING SUPPORT IN ACTIVE/ACTIVE MODE CONFIGURING ASR IN FWSM FIREWALL LOAD BALANCING REASONS FOR LOAD BALANCING FIREWALLS DESIGN REQUIREMENTS FOR FIREWALL LOAD BALANCING FIREWALL LOAD-BALANCING SOLUTIONS FIREWALL LOAD BALANCING WITH POLICY-BASED ROUTING FIREWALL LOAD BALANCING WITH CONTENT SWITCH MODULE CONFIGURING THE CSM SNAPSHOT CONFIGURATION FOR CSM SUPPORTING FIREWALL LOAD BALANCING FIREWALL LOAD BALANCING USING THE APPLICATION CONTROL ENGINE ACE DESIGN FOR FIREWALL LOAD BALANCING FIREWALL LOAD BALANCING CONFIGURATION EXAMPLE OUT2IN POLICY CONFIGURATION FIREWALL CONFIGURATION IN2OUT POLICY CONFIGURATION IP VERSION UNDERSTANDING IPV6 PACKET HEADER EXAMINING IPV6 ADDRESS TYPES NEIGHBOR DISCOVERY PROTOCOL IPV6 IN FWSM CONFIGURING MULTIPLE FEATURES OF IPV6 IN FWSM INTERFACE CONFIGURATION ROUTER ADVERTISEMENT DUPLICATE ADDRESS DETECTION TIMER FOR DUPLICATE ADDRESS DETECTION CONFIGURING ACCESS LISTS CONFIGURING STATIC ROUTES CONFIGURING IPV6 TIMERS IN FWSM CONFIGURING IPV6 IN FWSM CONFIGURING PFC (LAYER 3 DEVICE) ON THE OUTSIDE SECURITY DOMAIN CONFIGURING FWSM CONFIGURING A LAYER 3 DEVICE ON THE INSIDE SECURITY DOMAIN VERIFY THE FUNCTIONALITY OF FWSM WORKING WITH THE SHOW COMMAND FOR IPV6 IN FWSM PREVENTING NETWORK ATTACKS PROTECTING NETWORKS SHUNNING ATTACKERS SPOOFING UNDERSTANDING CONNECTION LIMITS AND TIMEOUTS CONFIGURING CONNECTION LIMITS CONFIGURING TIMEOUTS TROUBLESHOOTING THE FWSM UNDERSTANDING TROUBLESHOOTING LOGIC ASSESSING ISSUES LOGICALLY CONNECTIVITY TEST OF A FLOW AT THE FWSM TROUBLESHOOTING FLOW ISSUES FAQS FOR TROUBLESHOOTING HOW DO YOU VERIFY WHETHER THE TRAFFIC IS FORWARDED TO A PARTICULAR INTERFACE IN THE FWSM? HOW DO I VERIFY ACL RESOURCE LIMITS? HOW DO I VERIFY THE CONNECTIVITY AND PACKET FLOW THROUGH THE FIREWALL? WHAT IS NETWORK ANALYSIS MODULE? WHAT ARE SOME USEFUL MANAGEMENT AND MONITORING TOOLS? HOW DO I RECOVER PASSWORDS? PART IV DESIGN GUIDELINES AND CON?GURATION EXAMPLES DESIGNING A NETWORK INFRASTRUCTURE DETERMINING DESIGN CONSIDERATIONS DOCUMENTING THE PROCESS DETERMINING DEPLOYMENT OPTIONS DETERMINING PLACEMENT WORKING WITH FWSM AND THE ENTERPRISE PERIMETER FWSM IN THE DATACENTER THROUGHPUT FLEXIBILITY AVAILABILITY SUPPORTING VIRTUALIZED NETWORKS REFERENCE DESIGN SCENARIOS LAYER 3 VPN (VRF) TERMINATIONS AT FWSM CONFIGURING THE PFC CONFIGURING THE FWSM FAILOVER CONFIGURATION IN MIXED MODE INTERDOMAIN COMMUNICATION OF DIFFERENT SECURITY ZONES THROUGH A SINGLE FWSM FWSM CONFIGURATION DYNAMIC LEARNING OF ROUTES WITH FWSM SINGLE BOX SOLUTION WITH OSPF DATA CENTER ENVIRONMENT WITH THE FWSM METHOD 1: LAYER 3 VPN SEGREGATION WITH LAYER 3 FWSM (MULTIPLE CONTEXT MODE) METHOD 2: LAYER 3 VPN SEGREGATION WITH LAYER 2 FWSM (MULTIPLE CONTEXT MODE) PVLAN AND FWSM PVLAN CONFIGURATION IN FWSM DESIGN SCENARIO 1 FOR PVLAN IN FWSM DESIGN SCENARIO 2 FOR PVLAN IN FWSM CONFIGURING PVLAN PART V FWSM 4 X FWSM 4 X PERFORMANCE AND SCALABILITY IMPROVEMENTS INCREASING PERFORMANCE BY LEVERAGING THE SUPERVISOR USING THE PISA FOR ENHANCED TRAFFIC DETECTION IMPROVING MEMORY PARTITIONING MEMORY REALLOCATING RULES OPTIMIZING ACL UNDERSTANDING FWSM 4 X ROUTING AND FEATURE ENHANCEMENTS CONFIGURING EIGRP CONFIGURING ROUTE HEALTH INJECTION UNDERSTANDING APPLICATION SUPPORT CONFIGURING REGULAR EXPRESSIONS UNDERSTANDING APPLICATION INSPECTION IMPROVEMENTS ADDITIONAL SUPPORT FOR SIMPLE NETWORK MANAGEMENT PROTOCOL MANAGEMENT INFORMATION BASE MISCELLANEOUS SECURITY FEATURES DYNAMIC HOST CONFIGURATION PROTOCOL OPTION SMARTFILTER HTTPS SUPPORT