Securing Cisco Network Devices with PIX

Audience

This course is for all staff interested in passing the Cisco Secure PIX Firewall Course Exam 642-523. This is one of the exams associated with the CCSP (Cisco Certified Security Professional) Certification and the Cisco Firewall Specialist certifications.

Prerequisites

Familiarity with networking concepts and firewall technology is assumed. This understanding can be obtained by attending on one of our events shown below:  

• Introduction to firewalls
• Securing Cisco Network Devices with PIX – an introduction
• Cisco CCNA Part 1

Duration

3 days. Hands on.

Course Objectives

The training lab is equipped with Cisco PIX security devices and you will be able to configure your own firewall as the event unfolds. After the course, you will be able to:

• Describe the features, functions and benefits of Cisco PIX Firewall.
• Perform basic configuration like routing, send messages, DHCP
• Use advanced techniques such as special protocol handling and AAA.
• Learn the techniques of shunning, VPN and testing and verifying PIX Firewall operations

Course Content

Install and Configure a Security Appliance for Basic Network Connectivity
Describe the Security Appliance hardware and software architecture
Determine the Security Appliance hardware and software configuration and verify if it is correct
Use setup or the CLI to configure basic network settings, including interface configurations
Use appropriate show commands to verify initial configurations
Configure NAT and global addressing to meet user requirements
Configure DHCP client option
Set default route
Configure logging options
Describe the firewall technology
Explain the information contained in syslog files
Configure static address translations
Configure Network Address Translations: PAT
Verify network address translation operation

Configure a Security Appliance to Restrict Inbound Traffic
Configure access-lists to filter traffic based on address, time, and protocols
Configure object-groups to optimize access-list processing
Configure Network Address Translations: Nat0
Configure Network Address Translations: Policy NAT
Configure java/activeX filtering
Configure URL filtering
Verify inbound traffic restrictions
Configure static port redirection
Configure a net static
Set embryonic and connection limits on the Security Appliance

Configure a Security Appliance Using Site-to-Site VPNs
Explain the basic functionality of IPsec
Configure IKE with preshared keys
Differentiate between the types of encryption
Configure IPsec parameters
Configure crypto-maps and ACLs

Configure A Security Appliance to Provide Secure Connectivity Using Remote Access VPNS
Explain the functions of EasyVPN
Configure IPsec using EasyVPN Server/Client
Configure the Cisco Secure VPN client
Explain the purpose of SSL VPN
Configure WebVPN services: Server/Client
Verify VPN operations
Install and Configure SVCs
Install and Configure Cisco Secure Desktop

Configure Transparent Firewall, Virtual Firewall, and High Availability Firewall Features on a Security Appliance
Explain differences between L2 and L3 operating modes
Configure Security Appliance for transparent mode (L2)
Explain purpose of virtual firewalls
Configure Security Appliance to support virtual firewall
Monitor and maintain virtual firewall
Explain the types, purpose and operation of fail-over
Install appropriate topology to support cable-based or LAN-based fail-over
Explain the hardware, software and licensing requirements for high-availability
Configure the Security Appliance for active/standby fail-over
Configure the Security Appliance for stateful fail-over
Configure the Security Appliance for active-active fail-over
Verify fail-over operation
Recover from a fail-over
Allocate resources to virtual firewalls

Configure AAA services for the Security Appliance
Configure ACS for Security Appliance support
Configure Security Appliance to use AAA feature
Configure authentication using both local and external databases
Configure authorization using an external database
Configure the ACS server for downloadable ACLs
Configure accounting of connection start/stop
Verify AAA operation

Configure Routing and Switching on a Security Appliance
Enable DHCP server and relay functionality
Configure VLANs on a Security Appliance interface
Configure Security Appliance to pass multi-cast traffic

Configure Security Appliance Advanced Application Layer and Modular Policy Features
Configure a class-map
Configure a policy-map
Configure a service-policy
Configure a ftp-map
Configure a http-map
Configure an inspection protocol
Explain the function of protocol inspection
Explain DNS guard feature
Describe the AIP-SSM HW and SW
Load IPS SW in the AIP-SSM
Verify AIP-SSM
Configure an IPS modular policy
Describe the CSC-SSM HW and SW
Configure a typed class map
Configure a typed policy map
Use typed policy maps to specify granular inspection
parameters for a policy map
Configure regex class maps
Create regular expressions
Load CSC SW on the SSM
Verify the CSC-SSM
Divert traffic to the CSC-SSM
Initialize the CSC-SSM

Monitor and Manage an Installed Security Appliance
Obtain and apply OS updates
Backup and restore configurations and software
Explain the Security Appliance file management system
Perform password/lockout recovery procedures
Obtain and upgrade license keys
Configure passwords for various access methods: Telnet, serial, enable, SSH
Configure various access methods: Telnet, SSH, ASDM
Configure command authorization and privilege levels
Configure local username database
Verify access control methods
Enable ASDM functionality
Verify a Security Appliance configuration via ASDM
Verify the licensing available on a Security Appliance
Add, delete, and modify syslog messages