Cisco IOS Catalyst switches and routers support several security features that are designed not only to protect the switches and routers themselves, but users connected to those switches. In addition to demonstrating a solid understanding of these features, it is also necessary to sometimes troubleshoot security-feature related network problems. The TSHOOT certification exam objectives that are covered in this chapter are:
- Troubleshoot private VLANS
- Troubleshoot port security
- Troubleshoot general switch security
- Troubleshoot VACL and PACL
- Troubleshoot configuration issues related to accessing the AAA server for authentication
- Troubleshoot Layer 3 Security
- Troubleshoot issues related to ACLs used to secure access to Cisco routers
- Troubleshoot security issues related to IOS services (i.e., finger, NTP, HTTP, FTP, RCP)
From a conceptual perspective, switches and routers have a communications architecture that is comprised of three different planes, all of which are vulnerable to security attacks. It is therefore important to understand the functionality of each of these planes as well as the tools that are available in Cisco IOS software that can be used to secure each individually. In addition to this, it is also important to understand common problems associated with these technologies and how to troubleshoot and resolve them. This chapter is divided into the following sections:
- Cisco IOS Security Fundamentals
- Management Plane Security and Troubleshooting
- Control Plane Security and Troubleshooting
- Forwarding Plane Security and Troubleshooting
- Cisco IOS Firewall Fundamentals
- Troubleshooting Cisco IOS Security Features Chapter Summary
NOTE: While this is not a security exam, as a network engineer you are expected to have some basic understanding of general security principles, configuration and troubleshooting. While this guide will not be going into detail on all Cisco IOS software security features, you can find additional information in the current CCNA Security study guide that is available online.