The network designer should be able to guarantee to the company the following important system characteristics:
- Confidentiality
- Integrity
- Availability
Before a network designer offers security consultancy services (e.g., risk assessment or business impact analysis), the designer must understand the real threats to the network infrastructure. The different categories of threats to confidentiality, integrity, and availability include the following:
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
- Spoofing (masquerading)
- Telnet attacks
- Password-cracking programs
- Viruses
- Trojans and worms
Firewalls can be deployed in multiple modes, including routed and transparent, and most of them can be virtualized into security contexts to provide cost-effective solutions. The virtual firewall partitions a physical firewall into multiple logical devices, each with its own configuration. This is similar to having multiple standalone firewalls but without having to buy separate devices. Security contexts are distinct and independent firewalls in the sense of having their own attributes, such as the following:
- Security policies
- Assigned interfaces
- NAT rules
- ACLs
- Administrators
The active/active failover mechanism used on firewall devices leverages the virtual context feature. The best results are obtained when the two devices configured with active/active failover have an identical platform and operating system. The two firewalls must be connected with a failover state link and this can be accomplished in three ways:
- Single physical link: Both the failover and stateful information are transmitted on this link.
- Dual physical links: The failover information is exchanged on one interface and the stateful information (maintaining the TCP connection and translation rules) is exchanged on another.
- Dual redundant physical links: These act as a single logical link that carries both the failover and stateful information between the firewalls.
Private VLANs (PVLANs) are an option for adding an extra security layer in the Enterprise Campus module or data center submodule, especially in the e-commerce submodule. A PVLAN divides a VLAN into more logical components and this allows groups of servers or individual servers to be isolated, quarantining them from other devices.
A zone-based policy firewall is an IOS feature that can leverage the existing ISR routers by configuring firewall functionalities on them, as opposed to using dedicated ASA devices or firewall modules. Cisco Zone Based Firewall (ZBF) functionality was introduces in Cisco IOS 12.4(6)T as an evolution from traditional firewall implementation, which was an interface-based model (the “ip inspect” command can be applied on an interface in the inbound or outbound direction). The limitations imposed by traditional firewall implementation led to the development of zone-based firewalls, which work by following these steps:
- 1. Create security zones.
- 2. Place an interface or multiple interfaces into each security zone.
- 3. Create unidirectional zone pairs to define relationships between zones.
- 4. Apply a modular, flexible, granular policy (using class maps, policy maps, and service policy) to the zone pairs.
Cisco Network Admission Control (NAC) is a service that tries to guarantee that various endpoints are compliant with the network security polices enforced by network devices (e.g., firewalls, switches, or routers). Cisco NAC provides access to compliant devices and then it ensures that non-compliant devices are denied access, are placed in quarantine, or are given restricted access to certain resources. NAC products are categorized as follows:
- The NAC framework, which is a system that provides security for network environments (LAN, WAN, WiFi, extranet, and remote access)
- The NAC appliance
One of the first design decisions involves selecting the location in which the NAC solution will be implemented. The following aspects should be considered in this decision process:
- Choosing between a virtual and a real IP gateway
- Choosing In-Band or Out-of-Band deployment mode
- Choosing a Layer 2 or a Layer 3 client mode
- Choosing a central or edge physical deployment
The modern Cisco NAC solution includes the Identity Service Engine (ISE), which uses Cisco network devices to extend access enforcement throughout a network and consists of the following components:
- Policy administration and decision component: Cisco ISE.
- LAN policy enforcement points: Cisco Catalyst switches, ASA devices, or ISR routers.
- Policy information component on the endpoints: Cisco NAC Agent, Web Agent, Cisco AnyConnect client, or native 802.1x supplicants.
The major difference between Intrusion Prevention Systems (IPSs) and Intrusion Detection Systems (IDSs) is that IPS devices operate in line with the traffic, while IDS devices receive only a copy of the traffic so they can analyze it.
Cisco offers a wide range of products that offer IPS/IDS functionality in Enterprise Networks, including:
- Cisco 4200 and 4300 series IPS sensor appliances
- Cisco AIP-SSM modules for ASA devices
- Cisco IDSM modules for Catalyst 6500 switches
- Cisco ISR routers with IOS IPS functionality
Sensor placement is a very important aspect, as IPS devices should be placed strategically throughout the organization:
- Outside of the firewall
- Inside the firewall
- On the same VLAN as the critical servers (DMZ or server farm)
Some of the challenges in deploying IDSs and IPSs include:
- Asymmetric traffic flows
- High availability issues
- Choosing an appropriate IPS device
- Choosing the appropriate management and monitoring solution
- Regularly updating IPS signatures
Secure Sockets Layer (SSL) VPN is also referred to as Web-VPN, even though Cisco does not use this term any more. Understanding SSL VPN deployments is of great importance for network security designers, as this technology can be configured either on Cisco ISR routers (as part of the router IOS) or on Cisco ASA devices.
SSL VPN is a technology that provides remote access through a gateway that can offer many different features, access methods, group configurations, and group policies. End-users can access the gateway from a wide variety of different endpoints. From a design standpoint, network designers must understand the different access methods, including:
- Clientless access
- Thin client (port forwarding) access
- Full tunnel access
The most common SSL VPN design types are:
- The parallel design
- The inline design
- The DMZ design
Site-to-site IPsec VPN is an overlay solution that can be implemented across multiple types of networks, including peer-to-peer, hub-and-spoke, full mesh, or partial mesh. Some of the most popular designs for placing the VPN devices on the network include:
- Parallel design
- DMZ design
- Integrated design
Dynamic Multipoint VPN (DMVPN) creates a dynamic mesh, where the number of tunnels is actually lower than that of a full mesh design, because the tunnel relationships are created and disabled automatically between spoke devices over a DMVPN cloud. DMVPN involves less configuration on the hub device because it relies on a couple of protocols that work together to allow the spoke sites to dynamically find the public spoke’s IP address:
- Next Hop Resolution Protocol (NHRP)
- Multipoint GRE (mGRE)
With the rapid deployment of multicast processes, audio, video streaming, and any-to-any communications (like VoIP), it is important to have a secure solution that does not rely on an overlay VPN or on building tunnels. When using the Group Encrypted Transport (GET) VPN approach, routers become part of a trusted grouping of VPN devices and secure packets flow between these routers, with their original IP header preserved.
A network security implementation must include the following actions:
- Block outside malicious users from getting access to the network
- Allow system, hardware, and application access only to authorized users
- Prevent attacks from being sourced internally
- Support different levels of user access using an access control policy
- Safeguard the data from being changed, modified, or stolen
Vulnerabilities are measurements of the probability of being negatively influenced by a threat (e.g., reconnaissance attack, unauthorized access, or DoS attack). Vulnerabilities are often measured as a function of risk and this might include:
- Risk to data confidentiality
- Risk to data integrity
- Risk to the authenticity of systems and users
- Risk to the availability of networking devices