Troubleshooting Cisco IOS Security Features Chapter Summary

The following section is a summary of the major points you should be aware of in this chapter:

Cisco IOS Security Fundamentals

1. The communications architecture of all switches and routers is segmented into 3 planes
2. The communications architecture planes of network devices are:

1. The Management Plane
2. The Control Plane
3. The Forwarding Plane

1. The management plane is used to manage a device through its connection to the network
2. The management plane is responsible for management functions
3. The management plane also coordinates functions among all other the planes
4. Management protocols are used for device monitoring and CLI access
5. Management protocols include SNMP, Telnet, HTTP, HTTPS and SSH, NetFlow, Syslog
6. Console access, i.e. via the Console port, is also used to manage devices
7. A control plane is a collection of processes that run at the process level on a route processor
8. All traffic directly or indirectly destined to a router or switch is handled by the control plane
9. Control plane protocols include routing protocols, as well as Layer 2 protocols
10. The forwarding or data plane is responsible for the actual forwarding of data
11. The data plane is typically populated using information derived from the control plane

Management Plane Security and Troubleshooting

1. Management plane troubleshooting involves troubleshooting the management protocols
2. SSH provides a more secure method for access and administration than Telnet
3. Cisco IOS software requires a VTY password and login enabled for remote management
4. SSH is enabled by default; however, the following must be manually configured:

1. A valid domain name must be configured on the local device
2. Security keys must be generated on the local device

1. FTP and SCP require additional configuration to allow file copies and transfers from devices
2. AAA provides the framework that controls and also monitors network access
3. AAA services can be performed using the local database or an external security server
4. Two commonly used AAA security protocols are RADIUS and TACACS+
5. RADIUS stands for Remote Authentication Dial-In User Service
6. RADIUS is an open-standard protocol that is distributed in C source code format
7. RADIUS uses UDP as the Transport layer protocol for client and server communications
8. RADIUS uses port 1812 for Authentication and Authorization, and 1813 for Accounting
9. Earlier deployments of RADIUS use port 1645 for Authentication and Authorization
10. Earlier deployments of RADIUS use port 1646 for Accounting
11. TACACS+ stands for Terminal Access Controller Access Control System Plus
12. TACACS+ is a Cisco-proprietary protocol that is used in the AAA framework
13. TACACS+ uses TCP as a Transport Layer protocol, using TCP port 49
14. Unlike RADIUS, TACACS+ separates the three AAA architectures
15. TACACS+ encrypts data between the user and server; RADIUS encrypts only the password
16. TACACS+ supports multiple protocols; RADIUS had limited protocol support
17. AAA services are based on method lists
18. In AAA, there are two basic types of method lists: named and default method lists

Control Plane Security and Troubleshooting

1. Troubleshooting at the control plane is dependent on the specific protocol or technology
2. Troubleshooting for additional control plane features centers on configuration

Forwarding Plane Security and Troubleshooting

1. Troubleshooting data plane issues depends on the technology that has been implemented
2. Tools that are used to secure the data plane include the following:

1. Router and Switch Access Control Lists
2. Catalyst Switch Port Security
3. Private VLANs
4. IEEE 802.1x Port-Based Authentication
5. Trunking
6. The Cisco IOS Firewall

1. Cisco IOS software supports RACLs, PACLs and VACLs on router and switch platforms
2. RACLs are applied to routed interfaces or SVIs
3. RACLs can be applied in either the inbound or outbound direction
4. PACLs are similar to RACLs but are applied to Layer 2 ports
5. PACLs do not affect Layer 2 control packets such as Cisco Discovery Protocol
6. PACLs can only be applied in the inbound direction
7. PACLs can take the form of either IP ACLs or MAC ACLs
8. VACLs are similar to RACLs but are applied to VLANs
9. VACLs have no sense of direction
10. VACLs can filter on both routed and bridged traffic
11. Port security mitigates against CAM table overflow or MAC address flooding attacks
12. Private VLANs prevent inter-host communication
13. The three types of VLANs used in PVLANs are:

1. The Primary VLAN
2. Isolated VLAN
3. Community VLAN

1. 802.1x simply mitigates against any rogue devices from gaining unauthorized access
2. There are three primary components (or roles) in the 802.1x authentication process:

1. Supplicant or Client
2. Authenticator
3. Authentication Server

1. Trunk links are used to carry traffic from multiple VLANs
2. The main objective of VLAN hopping is to compromise a device residing on another VLAN
3. There are two primary methods used to perform VLAN hopping attacks:

3. Switch spoofing
4. Double-tagging

Cisco IOS Firewall Fundamentals

1. The Cisco IOS Firewall is comprised of the following functions and technologies:

1. Cisco IOS Stateful Packet Inspection
2. Context-Based Access Control
3. Intrusion Prevention System
4. Authentication Proxy
5. Port-to-Application Mapping
6. Network Address Translation
7. Zone-Based Policy Firewall

1. Cisco IOS SPI maintains state information and counters of connections
2. CBAC provides dynamic traffic filtering capabilities
3. The main features of Context-Based Access Control (CBAC) are:

1. It protects the internal network from external intrusion or other threats
2. It provides Denial of Service (DoS) protection
3. It provides per-application control mechanisms
4. It examines Layer 3 and Layer 4, as well as Application Layer information
5. It maintains state information for every connection
6. It generates real-time event alert failures and log messages
7. It provides enhanced audit trail features

1. The Cisco IOS IPS is an inline intrusion detection and prevention sensor
2. Some key features of the Cisco IOS Intrusion Prevention System are:

1. It protects the network from viruses, worms and a large variety of threats and exploits
2. It eliminates the need for a standalone IPS device
3. It provides integrated inline deep-packet inspection
4. It complements the Cisco IOS Firewall and VPN solutions for superior threat protection
5. It supports about 2000 attack signatures
6. It uses Cisco IOS routing capabilities to deliver integrated functionality
7. It enables distributed network-wide threat mitigation
8. It sends a Syslog message or an alarm in SDEE format when a threat is detected

1. The Authentication Proxy feature intercepts HTTP or HTTPS sessions
2. PAM allows administrators to customize TCP or UDP ports numbers for network services
3. NAT is used to hide internal addresses from networks that are external to the firewall
4. ZPF allows Stateful inspection to be applied on a zone-based model
5. ZPF provides greater granularity, flexibility, and scalability than that of CBAC