CCSP CSVPN Exam Cram 2 (Exam Cram 642-511)

CSVPN David Minutella CSVPN Exam Cram 2 (642-511) Publisher Copyright © 2004 by Que Certification Paul Boger All ...

Author: David Minutella

70 downloads 1245 Views 5MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

CSVPN David Minutella

CSVPN Exam Cram 2 (642-511)

Publisher

Copyright © 2004 by Que Certification

Paul Boger

All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein. International Standard Book Number: 0-789-73026-X Library of Congress Catalog Card Number: 2003109274 Printed in the United States of America

Associate Publisher Jeff Riley

Acquisitions Editor Carol Ackerman

Development Editor John Gosney

Managing Editor Charlotte Clapp

First Printing: November 2003 06

05

04

03

4

3

2

1

Trademarks All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Que Certification cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

Warning and Disclaimer Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the CD or programs accompanying it.

Project Editor Sheila Schroeder

Copy Editor Margo Catts

Indexer Ken Johnson

Proofreader Tracy Donhardt

Technical Editors Steven Thomas Ed Yanez

Team Coordinator Bulk Sales Que Certification offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales. For more information, please contact

Pamalee Nelson

Multimedia Developer Dan Scherf

U.S. Corporate and Government Sales 1-800-382-3419 [email protected] For sales outside of the U.S., please contact International Sales 1-317-428-3341 [email protected]

Interior Designer Louisa Adair

Cover Designer Charis Ann Santillie

Page Layout Bronkella Publishing

Que Certification • 800 East 96th Street • Indianapolis, Indiana 46240

A Note from Series Editor Ed Tittel You know better than to trust your certification preparation to just anybody. That’s why you, and more than two million others, have purchased an Exam Cram book. As Series Editor for the new and improved Exam Cram 2 series, I have worked with the staff at Que Certification to ensure you won’t be disappointed. That’s why we’ve taken the world’s best-selling certification product—a finalist for “Best Study Guide” in a CertCities reader poll in 2002—and made it even better. As a “Favorite Study Guide Author” finalist in a 2002 poll of CertCities readers, I know the value of good books. You’ll be impressed with Que Certification’s stringent review process, which ensures the books are high-quality, relevant, and technically accurate. Rest assured that at least a dozen industry experts—including the panel of certification experts at CramSession—have reviewed this material, helping us deliver an excellent solution to your exam preparation needs. We’ve also added a preview edition of PrepLogic’s powerful, full-featured test engine, which is trusted by certification students throughout the world. As a 20-year-plus veteran of the computing industry and the original creator and editor of the Exam Cram series, I’ve brought my IT experience to bear on these books. During my tenure at Novell from 1989 to 1994, I worked with and around its excellent education and certification department. This experience helped push my writing and teaching activities heavily in the certification direction. Since then, I’ve worked on more than 70 certification-related books, and I write about certification topics for numerous Web sites and for Certification magazine. In 1996, while studying for various MCP exams, I became frustrated with the huge, unwieldy study guides that were the only preparation tools available. As an experienced IT professional and former instructor, I wanted “nothing but the facts” necessary to prepare for the exams. From this impetus, Exam Cram emerged in 1997. It quickly became the best-selling computer book series since “…For Dummies,” and the best-selling certification book series ever. By maintaining an intense focus on subject matter, tracking errata and updates quickly, and following the certification market closely, Exam Cram was able to establish the dominant position in cert prep books. You will not be disappointed in your decision to purchase this book. If you are, please contact me at [email protected]. All suggestions, ideas, input, or constructive criticism are welcome!

The Smartest Way To Study for Your CCSP Certification! Exam Cram 2 offers the concise, focused coverage you need to pass your CCSP exams. These books are designed to be used as a refresher on important concepts, as well as a guide to exam topics and objectives. Each book offers: • • •

CD that includes a PrepLogic Practice Exam Two text-based practice exams with detailed answers Tear-out Cram Sheet that condenses the important information into a handy two-page study aid

•

Key terms and concepts, notes, exam alerts, and study tips

Check out these CCSP Exam Cram 2 titles:

CCSP SECUR Exam Cram 2, Exam 642-501

CCSP CSVPN Exam Cram 2, Exam 642-511

CCSP CSPFA Exam Cram 2, Exam 642-521

ISBN: 0789730251

ISBN: 078973026x

ISBN: 0789730235

$29.99

$29.99

$29.99

Buy the pack and

SAVE! Get all five CCSP Exam Cram 2 titles with CDs for just $124.99! ISBN: 0789731118

CCSP CSIDS Exam Cram 2, Exam 642-531

CCSP CSI Exam Cram 2, Exam 642-541

ISBN: 0789730227

ISBN: 0789730243

$29.99

$29.99

Books are available online or at your favorite bookstore.

www.examcram2.com

I would like to dedicate this book to Marsha and my family. Marsh, you have shown me a life of endless inspiration and joy that I did not imagine was possible. What I wouldn’t give to see life as you do through your eyes. For these reasons and about a million more, anything you have scheduled in your little planner sounds perfect to me just as long as it involves us being together. And to my family who has been an unwavering influence. Your infinite support, encouragement, and love made me the person I am today. Hopefully, nobody will hold that against you. ❧

About the Author

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Dave Minutella has been working in the IT and telecom industry for more than ten years. He currently serves as a senior Cisco instructor for The Training Camp, specializing in accelerated Cisco and A+/Network+ training. He has primarily taught CCNA, CCDA, and CCNP courses for about two years. He is also currently developing the CCSP course while preparing himself for achieving his CCIE. He has already passed the qualification exam and is currently studying for the lab. He holds the following certifications: CCNP, CCDP, CCSP, INFOSEC, CISSP, MCSA, Security+, Network +, and A+. Prior to working with the Training Camp, Dave worked for Broadwing Communications as the Senior Manager of Customer Premise Equipment. Dave and his group were responsible for implementing equipment solutions for customers across the country. Over the past 6 years, Dave has configured, installed, and troubleshot thousands of Cisco systems, as well as other types of WAN equipment.

About the Technical Editors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Steven Thomas (Seven Lakes, NC) is the Chief Technical Officer of Meridian Networks (http://www.mnetworks.net.) - a North Carolina-based network systems integration firm. Prior to this position, he developed and coordinated the Network Administration and Support curriculum at Sandhills Community College. Prior to his appointment at SCC, he served as President of Gate City Consulting where he specialized in consulting, technical training, testing, researching, authoring, and development services related to data and telecommunication technology. Steven is a Cisco Certified Academy Instructor as well as a Microsoft Certified Trainer. In addition, he holds the MCSE, MCSA, CCSP, CCDA, CCNP, CCNA, A+, Network+, MCP+I, and the CNA. He is also the author of the widely acclaimed and successful Windows NT 4.0 Registry for Computing McGraw-Hill. Ed Yanez has been in the computer industry for 14 years, working with Cisco products for 8 years. He trained on Novell, Windows, and Cisco and has worked for Zenith Data Systems, BCS/Tech Center, Cox Communications (high-speed Internet division), and KnowledgeNet, where he is currently a Cisco instructor teaching the advanced courses for DQoS, CSPFA, CSIDS, SECUR, CSVPN, CSI, CCIE R/S, CCIE Security, as well as others. Ed has also been a Cisco network troubleshooter and designer consultant. He lives in Gilbert, AZ with his wife, Carolina, and two children, Jaycee and Stephanie. Ed holds the following certifications: Security+, MCSE+I, CCNA, CCDA, CCDP, CCNP, CSS1, CCIE #6784 (R/S and Security).

Acknowledgments

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

In no way, shape, or form could this book have been completed without the talented efforts of several people. Specifically, I would like to thank everybody at QUE Publishing for giving me this opportunity. That thanks extends to management all the way down to the press operators who print the pages. I would especially like to thank Carol Ackerman, who has been a fantastic tour guide through this maiden voyage. I wouldn’t have it any other way. To my technical editors Ed Yanez and Steven Thomas, thank you for your incredible input. Your contributions were invaluable in the formation of this book. Thank you to John Gosney, who has an amazing “decrypting” talent. You made sense of that which could not be deciphered by normal people. My deepest appreciation goes out to Sheila Schroeder, who practiced infinite patience with my constant changes, and to Margo Catts, whose phenomenal editing abilities dispelled any beliefs that I was good in English grammar. I would also like to take an opportunity to thank my friends that have supported me during the writing of this book. As you all know I was out of sight and usually out of my mind. I especially would like to thank my good friends Melissa Bjordal and Michael Sheppard in Austin who provided me with everything I needed to maintain my sanity through these times. Thanks also must go to my friends at The Training Camp, who supported and applauded my magical disappearing acts when I needed to get work done. This includes Jesse Lee DeGarmo, who has been an amazing brother and friend, Dan Newman, who walked every mile in my circus shoes with me on this book, and Ross Brunson, who brought this opportunity to my attention. Finally, I wish to thank all my friends from Delaware, including Mike and Meg McKinley, Chad Deamond, and Rick King, who have probably forgotten what I look like since I went into hiding. I think of you all often when my mind is not slipping into a VPN coma.

Contents at a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction xix Self-Assessment xxviii Chapter 1

Cisco Certification Exams 1

Chapter 2

Overview of VPN and IPSec Technologies 7

Chapter 3

Cisco VPN 3000 Concentrator Hardware 31

Chapter 4

Cisco VPN 3000 Remote Access Preshared Key Configuration 47

Chapter 5

Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates 85

Chapter 6

VPN 3000 Concentrator Advanced Features Configuration 107

Chapter 7

Software Client Firewall Features 141

Chapter 8

Monitoring and Administration of Cisco VPN 3000 Concentrator 159

Chapter 9

Cisco VPN 3002 Hardware Client 191

Chapter 10

VPN Windows Client Configuration 219

Chapter 11

Practice Exam 1 249

Chapter 12

Practice Exam 1 Answer Key 281

Chapter 13

Practice Exam 2 303

Chapter 14

Practice Exam 2 Answer Key 329

Appendix A

VPN 3000 Concentrator Configuration Manager Navigation Menus 351

Appendix B

Resources 361

Appendix C

What’s on the CD-ROM? 363

Appendix D

Using the PrepLogic Practice Exams, Preview Edition Software 365 Glossary 373 Index 387

Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Introduction .....................................................................xix Self-Assessment ............................................................xxviii Chapter 1 Cisco Certification Exams .....................................................1 Assessing Exam Readiness 2 The Exam Situation 2 Exam Layout and Design 3 Exam-Taking Basics 4 Mastering the Inner Game 5 Additional Resources 6

Chapter 2 Overview of VPN and IPSec Technologies ..................................7 VPN Defined 8 Three Types of VPN 9 Cisco VPN Equipment and Software Solutions 10 Cisco VPN-Enabled IOS Routers 10 Cisco PIX Firewall Series 11 Cisco VPN 3000 Concentrator Series 11 Cisco VPN Software Client 12 Cisco VPN 3002 Hardware Client 12 Certicom IPSec Client 12 IPSec Overview 13 What Is IPSec? 13 IPSec Data Confidentiality 13 IPSec Data Integrity 17 IPSec Authentication 17 IPSec Anti-Replay Protection 19 IPSec Protocol Framework 19 Transport Mode and Tunnel Mode 19 Internet Key Exchange (IKE) 20

xii

Table . . . .of. Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Five Steps of IPSec: Tying it All Together Summary 22 Exam Prep Questions 25 Need to Know More? 29

21

Chapter 3 Cisco VPN 3000 Concentrator Hardware ..................................31 SOHO Cisco VPN 3002 Hardware Client 32 Small ROBO VPN 3000 Concentrators 33 Medium ROBO VPN 3000 Concentrator 34 Main Office and Service Provider VPN 3000 Concentrators 35 Cisco VPN 3000 Concentrator Fault Tolerance 36 Cisco VPN 3000 Concentrator Load Balancing 37 Cisco VPN 3000 Concentrator Bandwidth Management 37 Summary 38 Exam Prep Questions 40 Need to Know More? 46

Chaper 4 Cisco VPN 3000 Remote Access Preshared Key Configuration ........47 Elements of IPSec Remote Access 48 Initial Configuration of the VPN 3000 Concentrator 49 VPN 3000 Concentrator Series Manager Navigation 54 Defining User and Group Parameters for Preshared Keys 56 Base Group General Tab Parameters 58 Base Group IPSec Tab Parameters 60 Base Group Client Config or Mode Config Tab 63 Base Group Client FW and HW Client Tabs 67 Base Group PPTP/L2TP Tab 67 Individual Group Configuration Parameters 68 Group Identity Tab 69 Inherit Column 70 User Account Creation and Modification 70 User Identity Tab 70 In-depth Configuration Information 71 IPSec Security Association Activation 71 Network Lists 74 Access Hours 75 Summary 75 Exam Prep Questions 78 Need to Know More? 84

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Table . . .of. Contents . . . . .

Chapter 5 Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates .....................................................................85 Digital Certificate Advantages 86 Certificate Authorities 88 Public Key Infrastructures 89 Certificate Revocation and Validation 90 Cisco VPN 3000 Concentrator Digital Certificate Configuration Certificate Enrollment 92 Certificate Management 97 Applying Certificates for Authentication 97 Summary 100 Exam Prep Questions 101 Need to Know More? 106

91

Chapter 6 VPN 3000 Concentrator Advanced Features Configuration ...........107 Rules and Filters 108 VPN Concentrator Routing 113 Static Routes and Default Gateway 113 RIP and OSPF Dynamic Routing Protocols DHCP Relay 114 VPN Concentrator Redundancy 114 Reverse Route Injection 116 VPN Concentrator Load Balancing 118 Bandwidth Management Policies 120 Concentrator NAT and PAT 124 NAT Transparency 125 IPSec LAN-to-LAN Tunnels 127 IPSec LAN-to-LAN NAT 130 Summary 131 Exam Prep Questions 134 Need to Know More? 139

113

Chapter 7 Software Client Firewall Features ........................................141 Split Tunneling Security 142 Four Firewall Features 143 Firewall Parameters in VPN 3000 Concentrator

145

xiii

xiv


Firewall Scenarios 148 No Firewall Enforcement 148 Firewall AYT Policy Scenario 149 Firewall CPP Policy Scenario 149 Summary 150 Exam Prep Questions 152 Need to Know More? 158

Chapter 8 Monitoring and Administration of Cisco VPN 3000 Concentrator .....159 Administration Parameters 160 Administer Sessions 160 Software Updates 162 System Reboot 167 Ping and Monitor Refresh 168 The Four A’s: Access Rights, Administrative Accounts, ACLs, and AAA Servers 170 File Management 173 Monitoring Menus 175 Routing Table 176 Interpreting the Event Logs 176 System Status 178 Monitoring Sessions 179 General Statistics 180 Summary 181 Exam Prep Questions 183 Need to Know More? 189

Chapter 9 Cisco VPN 3002 Hardware Client ..........................................191 Cisco VPN 3002 Features 192 Client Mode 192 Network Extension Mode 194 Interactive Hardware Client Authentication 194 Individual User Authentication 195 VPN 3002 Hardware Client Configuration 196 3002 Hardware Client Manager Quick Config 197 Additional Configuration Parameters 202 VPN 3000 Concentrator Hardware Client Parameters Interactive and Individual Login 204

203


VPN 3002 Administration 206 VPN 3002 Monitoring 208 Summary 210 Exam Prep Questions 213 Need to Know More? 217

Chapter 10 VPN Windows Client Configuration .......................................219 Client Installation 220 Client Automatic Silent Installation 221 Client Entry Configuration 222 The General Tab 223 The Authentication Tab 224 The Connections Tab 224 Options Menu 226 Connecting the VPN Tunnel 227 Client Auto-Initiation Feature 229 Viewing the Connection Status 231 The General Tab 231 The Statistics Tab 232 The Firewall Tab 233 Disconnecting the VPN Tunnel 235 Managing the VPN Client 235 Cisco VPN Client Version 4.0 236 Summary 241 Exam Prep Questions 243 Need to Know More? 248

Chapter 11 Practice Exam 1 ..............................................................249 Questions, Questions, Questions 249 Picking Proper Answers 250 Decoding Ambiguity 251 Working Within the Framework 251 Deciding What to Learn 252 Preparing for the Test 253 Taking the Test 253 Practice Exam 1 254

Chapter 12 Practice Exam 1 Answer Key ...............................................281 Answer Key Explanations

282

xv

xvi


Chapter 13 Practice Exam 2 .............................................................303 Practice Exam 2

304

Chapter 14 Practice Exam 2 Answer Key ...............................................329 Answer Key Explanations

330

Appendix A VPN 3000 Concentrator Configuration Manager Navigation Menus .351 Configuration Menus 352 Administration Menus 356 Monitoring Menus 358

Appendix B Resources .....................................................................361 Appendix C What’s on the CD-ROM ......................................................363 The PrepLogic Practice Exams, Preview Edition Software An Exclusive Electronic Version of the Text 364

363

Appendix D Using the PrepLogic Practice Exams, Preview Edition Software .....365 The Exam Simulation 365 Question Quality 366 The Interface Design 366 The Effective Learning Environment 366 Software Requirements 366 Installing PrepLogic Practice Exams, Preview Edition 367 Removing PrepLogic Practice Exams, Preview Edition from Your Computer 367 How to Use the Software 368 Starting a Practice Exam Mode Session 368 Starting a Flash Review Mode Session 369 Standard PrepLogic Practice Exams, Preview Edition Options 369 Seeing Time Remaining 370 Getting Your Examination Score Report 370 Reviewing Your Exam 370


Contacting PrepLogic 371 Customer Service 371 Product Suggestions and Comments License Agreement 371

371

Glossary .......................................................................373 Index ............................................................................387

xvii

We Want to Hear from You!

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

As the reader of this book, you are our most important critic and commentator. We value your opinion and want to know what we’re doing right, what we could do better, what areas you’d like to see us publish in, and any other words of wisdom you’re willing to pass our way. As an executive editor for Que Certification I welcome your comments. You can email or write me directly to let me know what you did or didn’t like about this book—as well as what we can do to make our books better. Please note that I cannot help you with technical problems related to the topic of this book. We do have a User Services group, however, where I will forward specific technical questions related to the book. When you write, please be sure to include this book’s title and author as well as your name, email address, and phone number. I will carefully review your comments and share them with the author and editors who worked on the book. Email: [email protected] Mail:

Jeff Riley Executive Editor Que Certification 800 East 96th Street Indianapolis, IN 46240 USA

For more information about this book or another Que Certification title, visit our Web site at www.examcram2.com. Type the ISBN (excluding hyphens) or the title of a book in the Search field to find the page you’re looking for.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Welcome to the CSVPN Exam Cram 2! Whether this is your first or your fifteenth Exam Cram 2 series book, you’ll find information here that will help ensure your success as you pursue knowledge, experience, and certification. This introduction explains Cisco’s certification programs in general and talks about how the Exam Cram 2 series can help prepare you for Cisco Certified Security Specialist exams. Chapter 1 discusses the basics of Cisco certification exams, including a description of the testing environment, and a discussion of test-taking strategies. Chapters 2 through 10 are designed to remind you of everything you’ll need to know to take—and pass—the 642-511 Cisco CSVPN certification exam. The two sample tests at the end of the book should give you a reasonably accurate assessment of your knowledge—and, yes, we’ve provided the answers and their explanations to the tests. Read the book and understand the material, and you’ll stand a very good chance of passing the test. Exam Cram 2 books help you understand and appreciate the subjects and materials you need to pass Cisco certification exams. Exam Cram 2 books are aimed strictly at test preparation and review. They do not teach you everything you need to know about a topic. Instead, I present and dissect the questions and problems I’ve found that you’re likely to encounter on a test. I’ve worked to bring together as much information as possible about Cisco certification exams. Nevertheless, to completely prepare yourself for any Cisco test, I recommend that you begin by taking the Self-Assessment that is included in this book, immediately following this introduction. The Self-Assessment tool will help you evaluate your knowledge base against the requirements for a Cisco Certified Security Specialist or Cisco Certified VPN Specialist under both ideal and real circumstances. Based on what you learn from the Self-Assessment, you might decide to begin your studies with some classroom training, some practice with Cisco VPN technologies, or some background reading. On the other hand, you might decide to pick up and read one of the many study guides available from Cisco or third-party vendors on certain topics. We also recommend that you

xx

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

supplement your study program with visits to www.examcram2.com to receive additional practice questions, get advice, and track the CCSP program. I also strongly recommend, if you can manage it, that you find and experiment with Cisco VPN equipment; nothing beats hands-on experience and familiarity when it comes to understanding the questions you’re likely to encounter on a certification test. Book learning is essential, but without a doubt, hands-on experience is the best teacher of all. The CD contains the PrepLogic Practice Exams, Preview Edition exam simulation software. The Preview Edition exhibits most of the full functionality of the Premium Edition, but offers questions sufficient for only one practice exam. To get the complete set of practice questions and exam functionality, visit www.preplogic.com.

Taking a Certification Exam After you’ve prepared for your exam, you need to register with a testing center. Each computer-based exam costs $125, and if you don’t pass, you can retest for an additional $125 for each additional try. In the United States and Canada, tests are administered by Prometric and by VUE. Here’s how you can contact them: ➤ Prometric—You can sign up for a test through the company’s Web site, at www.prometric.com. Within the United States and Canada, you can register by phone at 800-755-3926. If you live outside this region, you should check the Prometric Web site for the appropriate phone number.

➤ VUE—You can sign up for a test or get the phone numbers for local test-

ing centers through the Web at www.vue.com/ms. To sign up for a test, you must possess a valid credit card or contact either Prometric or VUE for mailing instructions to send a check (in the United States). Only when payment is verified or your check has cleared can you actually register for the test. To schedule an exam, you need to call the number or visit either of the Web pages at least one day in advance. To cancel or reschedule an exam, you must call before 7 p.m. Pacific standard time the day before the scheduled test time (or you might be charged, even if you don’t show up to take the test). When you want to schedule a test, you should have the following information ready:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . . ➤ Your name, organization, and mailing address. ➤ Your Cisco test ID. ➤ The name and number of the exam you want to take. ➤ A method of payment. (As mentioned previously, a credit card is the most

convenient method, but alternate means can be arranged in advance, if necessary.) After you sign up for a test, you are told when and where the test is scheduled. You should try to arrive at least 15 minutes early. You must supply two forms of identification—one of which must be a photo ID—and sign a nondisclosure agreement to be admitted into the testing room. All Cisco exams are completely closed book. In fact, you are not permitted to take anything with you into the testing area, but you are given a blank sheet or pad of paper and a pen (or in some cases an erasable plastic sheet and an erasable pen). We suggest that you immediately write down on that sheet of paper all the information you’ve memorized for the test. In Exam Cram 2 books, this information appears on a tear-out sheet inside the front cover of each book. You are given some time to compose yourself, record this information, and take a sample orientation exam before you begin the real thing. I suggest that you take the orientation test before taking your first exam, but because all the certification exams are more or less identical in layout, behavior, and controls, you probably don’t need to do this more than once. When you complete a Cisco certification exam, the software tells you immediately whether you’ve passed or failed. If you need to retake an exam, you have to schedule a new test with Prometric or VUE and pay another $125. Any time you fail a test (which you hope to be never), Cisco requires a 72-hour waiting period before you can retake the test.

Tracking Cisco Status When you pass any Cisco exam, you can track your status with the Cisco Certification tracking tool. Cisco generates transcripts that indicate which exams you have passed. You can view a copy of your transcript at any time by going to the Cisco secured site and print a copy of your current transcript and confirm your certification status.

xxi

xxii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

After you pass the necessary set of exams, you are certified. Official certification is normally granted after three to six weeks, so you shouldn’t expect to get your credentials overnight. The package for official certification that arrives includes a Welcome Kit that contains a number of elements (see Cisco’s Web site for other benefits of specific certifications): ➤ A certificate that is suitable for framing, along with a wallet card. ➤ A license to use the applicable logo, which means you can use the logo in

advertisements, promotions, and documents, as well as on letterhead, business cards, and so on. Along with the license comes a logo sheet, which includes camera-ready artwork. (Note that before you use any of the artwork, you must sign and return a licensing agreement that indicates you’ll abide by its terms and conditions.) Many people believe that the benefits of CCSP certification go well beyond the perks that Cisco provides to newly anointed members of this elite group. We’re starting to see more job listings that request or require applicants to have CCSP and other certifications, and many individuals who complete Cisco certification programs can qualify for increases in pay and/or responsibility. As an official recognition of hard work and broad knowledge, one of the CCSP credentials is a badge of honor in many IT and telecom organizations.

How to Prepare for an Exam Preparing for the CSVPN-related test requires that you obtain and study materials designed to provide comprehensive information about the product and its capabilities that will appear on the specific exam for which you are preparing. The following list of materials can help you study and prepare: ➤ The Cisco equipment documentation CD. Cisco ships all their products with

resource CDs containing a plethora of information concerning the hardware that is tested in this exam. If you are not fortunate enough to own any of the hardware products and their respective CDs, Cisco’s Web page contains all the documentation. This Web page contains PDFs for all the latest Release Notes of software, in addition to information about installating, initializing, configuring, and troubleshooting the equipment. It also includes configuration examples and Cisco TAC certified troubleshooting solutions for common problems. The Web page is located at www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:Cisco_ VPN_3000_Concentrator and contains information that you will find useful in preparing for the test.

xxiii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . . ➤ The exam preparation advice, practice tests, questions of the day and dis-

cussion groups on the www.examcram2.com e-learning and certification destination Web site. In addition, you might find any or all of the following materials useful in your quest for CSVPN expertise: ➤ Cisco Press Exam Certification Guides—This series of books is specifically

designed to give you in-depth information about exam topics. ➤ Study guides—Several publishers—including Que Publishing—offer certi-

fication titles. Que Publishing offers the Exam Cram 2 series. These books give you information about the material you need to know to pass the tests. ➤ Classroom training—CTECs, online partners, and third-party training

companies (such as the Training Camp, Learning Tree, and Global Knowledge) all offer classroom training on Cisco Secure VPN. These companies aim to help you prepare to pass Exam 642-511 (or other exams). Although such training runs upward of $350 per day in class, most of the individuals lucky enough to partake find this training to be quite worthwhile. ➤ Other publications—There’s no shortage of materials available about Cisco

VPN implementations and products. The “Need to Know More?” resource sections at the end of each chapter in this book give you an idea of where I think you should look for further discussion. This set of required and recommended materials represents an unparalleled collection of sources and resources on Cisco Secure VPN and related topics. I hope that you’ll find that this book belongs in this company.

What This Book Will Not Do This book will not teach you everything you need to know about Cisco VPN, or even about a given topic. Nor is this book a thorough introduction to VPN technology. If you’re new to virtual private networks and looking for an initial preparation guide, check out www.InformIT.com, where you will find related material more suited to learning about the topic. This book reviews what you need to know before you take the test, with the fundamental purpose of reviewing the information you need to know for the Cisco 642-511 certification exam. This book uses a variety of teaching and memorization techniques to analyze the exam-related topics and to provide you with ways to input, index, and

xxiv Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

retrieve everything you need to know to pass the test. Once again, it is not an introduction to application development.

What This Book Is Designed to Do This book is designed to be read as a pointer to the areas of knowledge on which you will be tested. In other words, you may want to read the book one time, just to get an insight into how comprehensive your knowledge of VPN is. The book is also designed to be read shortly before you go for the actual test and to give you a distillation of the entire field of Cisco VPN implementations in as few pages as possible. You can use this book to get a sense of the underlying context of any topic in the chapters—or to skim-read for Exam Alerts, bulleted points, summaries, and topic headings. I’ve drawn on material from Cisco’s own listing of knowledge requirements, from other preparation guides, and from the exams themselves. I’ve also drawn from a battery of third-party test-preparation tools and technical Web sites, as well as from my own experience with application development and the exam. My aim is to walk you through the knowledge you will need— looking over your shoulder, so to speak—and point out those things that are important for the exam (Exam Alerts, practice questions, and so on). The 642-511 exam makes a basic assumption that you already have a strong background of experience with the Cisco VPN platform and its terminology. On the other hand, because the Cisco VPN products are relatively new, no one can be a complete expert. I’ve tried to demystify the jargon, acronyms, terms, and concepts. Also, wherever I think you’re likely to blur past an important concept, I’ve defined the assumptions and premises behind that concept.

About This Book If you’re preparing for the 642-511 certification exam for the first time, I’ve structured the topics in this book to build upon one another. Therefore, the topics covered in later chapters might refer to previous discussions in earlier chapters. I suggest you read this book from front to back. You won’t be wasting your time, because nothing I’ve written is a guess about an unknown exam. I’ve had to explain certain underlying information on such a regular basis that I’ve included those explanations here.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . .

After you’ve read the book, you can brush up on a certain area by using the Index or the Table of Contents to go straight to the topics and questions you want to reexamine. I’ve tried to use the headings and subheadings to provide outline information about each given topic. After you’ve been certified, I think you’ll find this book useful as a tightly focused reference and an essential foundation of Cisco VPN technologies.

Chapter Formats Each Exam Cram 2 chapter follows a regular structure, along with graphical cues about especially important or useful material. The structure of a typical chapter is as follows: ➤ Opening hotlists—Each chapter begins with lists of the terms you’ll need to

understand and the concepts you’ll need to master before you can be fully conversant with the chapter’s subject matter. I follow the hotlists with a few introductory paragraphs, setting the stage for the rest of the chapter. ➤ Topical coverage—After the opening hotlists, each chapter covers the top-

ics related to the chapter’s subject. ➤ Alerts—Throughout the topical coverage section, I highlight material

most likely to appear on the exam by using a special Exam Alert layout that looks like this: This is what an Exam Alert looks like. An Exam Alert stresses concepts, terms, software, or activities that will most likely appear in one or more certification exam questions. For that reason, I think any information found offset in Exam Alert format is worthy of unusual attentiveness on your part.

Even if material isn’t flagged as an Exam Alert, all the content in this book is associated in some way with test-related material. What appears in the chapter content is critical knowledge. ➤ Notes—This book is an overall examination of Cisco VPN technology. As

such, I dip into many aspects of Cisco configuration for this technology. Where a body of knowledge is deeper than the scope of the book, I use notes to indicate areas of concern or specialty training. Cramming for an exam will get you through a test, but it won’t make you a competent IT professional. Although you can memorize just the facts you need to become certified, your daily work in the field will rapidly put you in water over your head if you don’t know the underlying principles of application development.

xxv

xxvi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ Tips—I provide tips that will help you build a better foundation of knowl-

edge or focus your attention on an important concept that will reappear later in the book. Tips provide a helpful way to remind you of the context surrounding a particular topic under discussion. You should also read Chapter 1, “Cisco Certification Exams,” for helpful strategies used in taking a test. The introduction to Practice Exam #1 in Chapter 11 contains additional tips on how to figure out the correct response to a question and what to do if you draw a complete blank.

➤ Practice questions—This section presents a short list of test questions relat-

ed to the specific chapter topic. Each question has an explanation of both correct and incorrect answers. The practice questions highlight the areas I found to be most important on the exam. ➤ Need To Know More?—Every chapter ends with a section titled “Need To

Know More?” This section provides pointers to resources that I found helpful in offering further details on the chapter’s subject matter. If you find a resource you like in this collection, use it, but don’t feel compelled to use all these resources. I use this section to recommend resources that I have used on a regular basis, so none of the recommendations will be a waste of your time or money. These resources may go out of print or be taken down (in the case of Web sites), so I’ve tried to reference widely accepted resources. The bulk of the book follows this chapter structure, but there are a few other elements that we would like to point out: ➤ Practice Exams—The practice exams, which appear in Chapters 11 and 13

(with answer keys in Chapters 12 and 14), provide very close approximations of the types of questions you are likely to see on the current 642-511 exam. ➤ Answer keys—These provide the answers to the sample tests, complete with

explanations of both the correct responses and the incorrect responses. ➤ Glossary—This is an extensive glossary of important terms used in this

book. ➤ Cram Sheet—This appears as a tear-away sheet, inside the front cover of

this Exam Cram 2 book. It is a valuable tool that represents a collection of the most difficult-to-remember facts and numbers we think you should

xxvii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Introduction . . . . . . .

memorize before taking the test. Remember, you can dump this information out of your head onto a piece of paper as soon as you enter the testing room. These are usually facts that I’ve found require brute-force memorization. You need to remember this information only long enough to write it down when you walk into the test room. Be advised that you will be asked to surrender all personal belongings before you enter the exam room itself. You might want to look at the Cram Sheet in your car or in the lobby of the testing center just before you walk into the testing center. The Cram Sheet is divided under headings, so you can review the appropriate parts just before each test. ➤ CD—The CD contains the PrepLogic Practice Exams, Preview Edition

exam simulation software. The Preview Edition exhibits most of the full functionality of the Premium Edition, but offers questions sufficient for only one practice exam. To get the complete set of practice questions and exam functionality, visit www.preplogic.com.

Contacting the Author I’ve tried to create a real-world tool that you can use to prepare for and pass the 642-511 CSVPN certification exam. I’m interested in any feedback you would care to share about the book, especially if you have ideas about how I can improve it for future test-takers. I’ll consider everything you say carefully and will respond to all reasonable suggestions and comments. You can reach me via email at [email protected]. Let me know if you found this book to be helpful in your preparation efforts. I’d also like to know how you felt about your chances of passing the exam before you read the book and then after you read the book. Of course, I’d love to hear that you passed the exam—and even if you just want to share your triumph, I’d be happy to hear from you. Thanks for choosing me as your personal trainer, and enjoy the book. I would wish you luck on the exam, but I know that if you read through all the chapters and work with the product, you won’t need luck—you’ll pass the test on the strength of real knowledge!

Self-Assessment

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This section of the book is included to help you ascertain your readiness to undertake the CCSP certification. Specifically, it is geared toward giving you an understanding of your current knowledge and skill levels to determine the amount of focus required to pass the CSVPN exam. Let’s look at the SelfAssessment with an initial discussion of the ideal CCSP candidate, followed by some resource recommendations that can help increase your knowledge base.

CCSPs in the Real World Now that you have decided to embark on this journey into the CCSP world, it is important to understand the niche into which a CCSP candidate fits in the real world. Specifically, security specialists today are in greater demand than ever. With the substantial increase in cybercrime attacks, companies are looking for protection of their assets. Many of these companies have looked to Cisco to provide this protection due to Cisco’s renowned high-quality products and services in today’s market. The CCSP certification is an accreditation given to those who can prove their fundamental understanding in implementing the various security products that Cisco provides. With enough motivation and desire, you will be able to attain this goal and join the ranks of several others in the industry. Because this is a relatively new certification, you have an opportunity to be a pioneer and discover the benefits that this certification holds. These benefits are comparable to the other Cisco career certifications that are available today. Namely, Cisco offers the following career certifications: ➤ CCNA—This certification serves as an introduction to basic Cisco rout-

ing and switching fundamentals and how they apply to networking technologies found today. This certification is a prerequisite for the CCSP certification. ➤ CCDA—The CCDA is an introductory course for those who wish to

design and implement Cisco in small to mid-range internetworks.

xxix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Self-Assessment . . . . . . . . . ➤ CCNP—The CCNP entails advanced Cisco concepts geared toward mid-

size and large network infrastructures and network management. ➤ CCDP—This certification is for high-level Cisco designs that encompass

network technologies for global enterprises and other larger-scaled internetworks. ➤ CCIP—The CCIP certification is designed for large enterprises and ISPs

that need to utilize large-scale protocols and Internet/intranet technologies. ➤ CCIE—One of the most sought-after certifications, the CCIE includes

several flavors, in which your knowledge of that technology is tested to its full extent because of its difficult examinations. A CCIE is proficient at all levels of internetwork design, management, and support.

INFOSEC In recent developments, Cisco’s courseware and examinations have been recognized by the National Security Agency (NSA) and the Committee on National Security Systems (CNSS) as curriculum worthy of the Information Systems Security (INFOSEC) Professional title. To achieve this certification title, you must pass the CSVPN, SECUR, CSPFA, and CSIDS examinations. The following section examines what qualities are found in an ideal CCSP and INFOSEC Professional candidate. Mind you, these qualities are just that—ideal. It is rare to meet this criteria completely, so do not despair if you do not fit the profile altogether. The key is to compare your own skill set and determine what you can do to elevate your experience to a comparable level.

The Ideal CCSP and INFOSEC Professional Candidate The ideal CCSP and INFOSEC Professional candidate described in this section is the quintessential contender for the CCSP and INFOSEC certification. This candidate has a background in education and experience that most likely is above the typical candidate. Recall that this individual is intended to serve as only a reference to help you determine in which areas you may need to work.

xxx Self-Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ Academic or professional training in basic networking theory, operations,

and systems. This includes a thorough understanding in basic networking media and technologies. ➤ Two-plus years hands-on experience installing and implementing net-

working components. This experience entails working with Cisco routers, in addition to other components. ➤ A thorough understanding of CCNA concepts and terminology. The

CCNA is a prerequisite for the CCSP certification and covers concepts that are expanded upon throughout the CCSP certification course. ➤ General understanding of the technologies involved in VPN implementa-

tions and design. Hands-on experience definitely serves as an advantage, especially with Cisco VPN products, protocols, and services. ➤ Familiarity with basic networking and security services such as DHCP,

AAA, TACACS+, RADIUS, DNS, Telnet, SSH, TFTP, FTP, HTTPS, ARP, SNMP, OSPF, and firewalls. ➤ Knowledge of—as well as experience with—security products such as the

VPN 3000 Concentrator, Cisco VPN Unity software client, Cisco VPN 3002 Hardware Client, and Cisco PIX firewalls. ➤ Three-plus years experience with the Windows operating system.

Additional knowledge of Linux and UNIX operating systems are a plus. Most likely, less than 25% of candidates match this profile, but having certain aspects of this candidate are always better than none. Many other aspiring technicians have achieved this certification without meeting these criteria.

Put Yourself to the Test The following reflective questions help you ponder what amount of work you should invest before taking the plunge. It is important to be honest with the questions and take their advice into consideration to avoid losing money and confidence by retaking the test. 1. Have you ever taken any computer-related courses?

If yes, proceed to question 2; if no, proceed to question 3. 2. Have you ever taken a Cisco-related course before?

If yes, you have a substantial foundation for several topics discussed in this book. However, additional knowledge of VPN and security technologies is a must. Additional training or reading may be required

xxxi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Self-Assessment . . . . . . . . .

depending on the Cisco course that was taken. Be sure to review ACLs, TCP/IP protocols and addressing, and routing protocols. If no, I highly recommend you enroll in a Cisco course. Specifically, I recommend seeking Cisco training on the Managing Cisco Network Security (MCNS) to form a solid starting point in Cisco security technologies and implementations. If you cannot attend this course, it may be suitable to read the Exam Cram 2 MCNS (Que Publishing, 1st edition, ISBN 0789730251) or, if time allows, Managing Cisco Network Security (Cisco Press; 1st edition, ISBN 1578701031) on the subject. 3. Have you done any reading on general security concepts or information

security? If yes, review the requirements stated in the first paragraph after question number 2. If you meet those requirements, move on to the next section. If no, review the requirements stated in the second paragraph in question 2 before you move forward to the next section.

Hands-On Experience The most important key to success on the Cisco VPN test is hands-on experience. If I leave you with only one realization after taking this SelfAssessment, it should be that you can’t find any substitute for time spent installing, configuring, and using repeatedly and in depth the various Cisco equipment on which you’ll be tested. 4. Have you installed, configured, operated, and supported a Cisco VPN

3000 Concentrator, VPN 3002 Hardware client, or Cisco Unity Software client? If yes, make sure you understand VPN technologies, NAT/PAT, LANto-LAN tunnels, AAA, and ACLs. If your experience is limited to only one or two of the above Cisco security products, I highly recommend you rent or purchase the other items because you will be tested on all dimensions. If no, I recommend you obtain access to at least one if not all Cisco VPN devices and software so that you can explore the concepts that you will be learning. These items can be rented for several days or purchased used online. Before you even think about taking any Cisco exam, make sure that you’ve spent enough time with the related equipment and software to understand

xxxii Self-Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

how to install, configure, monitor, and troubleshoot it. This will help you during the exam and in real life! If you cannot afford to purchase or utilize your company’s Cisco security appliances, there are certain distributors such as www.digitalwarehouse.com that rent the equipment.

Testing Your Exam Readiness Whether you attend a formal class on a specific topic to get ready for an exam or use written materials to study on your own, some preparation for the Cisco VPN exam is essential. At $125 a try, pass or fail, you want to do everything you can to pass on your first try. That is where studying comes in. This book includes two practice exams, so if you don’t score that well on the first test, you can study more and then tackle the second test. If you still don’t hit a score of at least 90% after these tests, you should investigate the practice test resources mentioned here (feel free to use your favorite search engine to look for more; this list is by no means exhaustive): ➤ PrepLogic—www.preplogic.com ➤ MeasureUp—www.measureup.com ➤ Trancender—www.transcender.com

For any given subject, consider taking a class if you have tackled self-study materials, taken the test, and failed anyway. The opportunity to interact with an instructor and fellow students can make all the difference in the world, if you can afford that privilege. For information about Cisco VPN classes, use your favorite search engine with a string such as “Cisco VPN class” or “Cisco VPN training.” Even if you can’t afford to spend much at all, you can still invest in some low-cost practice exams from commercial vendors. 5. Have you taken a Cisco VPN 642-511 practice exam?

If yes, and you scored 90% or better, you are probably ready to tackle the real thing. If your score isn’t above that threshold, keep at it until you break that barrier. If no, obtain all the free and low-budget practice tests you can find (check pointers at www.examcram.com and www.cramsession.com, or scope out offerings from the for-a-fee practice test vendors listed earlier in this chapter) and get to work. Keep at it until you can break the passing threshold comfortably.

xxxiii . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Self-Assessment . . . . . . . . .

When it comes to assessing your test readiness, no better way exists than to take a good-quality practice exam and pass with a score of 90% or better. When I’m preparing, I shoot for 95%-plus, just to leave room for the “weirdness factor” questions that sometimes show up on Cisco exams.

Assessing Readiness for the CSVPN Exam In addition to general exam-readiness information in the previous section, there are several things you can do to prepare for the Cisco VPN exam. As you’re getting ready for the CSVPN, visit the Cisco Web site at www.cisco.com. Its open forum and technical tips sections are great places to ask questions and get good answers or to watch questions that others ask (along with the answers, of course). Also visit the www.examcram and www. cramsession.com Web sites. You can sign up for “Question of the Day” services for several exams, so watch for the VPN exam these sites.

Onward, Through the Fog! After you have assessed your readiness, undertaken the background studies, obtained the hands-on experience that will help you understand the products and technologies at work, and reviewed the many source of information to help you prepare for a test, you’ll be ready to take a round of practice tests. When your scores come back positive enough to get you through the exam, you’re ready to go after the real thing. If you follow the assessment regime, you’ll not only know what you need to study, but you’ll be ready to make a test date. Good luck!

1 Cisco Certification Exams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Radio button ✓ Check box ✓ Multiple-choice ✓ Simulations

Techniques you’ll need to master: ✓ Assessing your exam readiness ✓ Preparing to take a certification exam ✓ Familiarizing yourself with exam layouts ✓ Mastering the different exam formats ✓ Guessing strategies

2

Chapter . . . . .1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

You are starting to sweat, your hands are shaking, and you are pacing all around the room. When it comes close to test time, it is not uncommon to cycle through every nervous habit you have. But how can you determine when you are ready for the exam? Chances are, nobody ever really feels 100% ready to take an exam. There is always some hesitation that looms over and taunts us that there is something that will surprise us on the exam. After reading the material in this book, you should have built up your confidence level to a point where you can come up with the goods for the test. It is important to note that it is sometimes not enough to know the materials for the test. It also takes good test-taking practices as well as mental preparation and strategies. This chapter introduces the formats that you will encounter and how you can master any question they throw at you.

Assessing Exam Readiness An excellent and speedy test of your readiness is to read over the SelfAssessment in the beginning of this book and determine where you stand. The Self-Assessment was created to reveal any experience weaknesses that you might want to overcome before tackling the exam. If you feel comfortable with your assessment, then be sure to work through the chapter materials in this book to grasp the terms and key concepts. In addition, test your knowledge by taking the chapter tests at the end of each chapter. In the back of this book, there are a multitude of practice questions and answers that can serve as a scale to measure your readiness. If you achieve percentages of 90% and higher, you very well could be ready for the exam. If you do not get at least 90% of the questions correct, try again and take note of the topics in which you are getting stuck. Using this method, you can reread the chapter or topics that you are not fully grasping. At this point, you can go back and retake the practice exams and see whether you have improved. While retaking the quiz, try not to just recognize the answers from previous attempts. Think about the question and try to relate the topics you read to the answers you are choosing.

The Exam Situation When you arrive at the testing center, the test administrator will request two forms of identification (one must be a photo ID) and have you sign their testing log. When your time comes up (no pun intended), you will be escorted

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Cisco . . .Certification . . . . . . Exams . . . .

to the testing room and asked to leave all materials, books, bags, and jackets behind. The room typically has several computer stations that have some means of a divider or space between them so there is no temptation to look at your neighbor’s screen. You obviously cannot take any notes in the room with you, but you can unload anything you have stored in your short-term memory from the Cram Sheet card (in the front of this book) and other materials. Use the provided paper and pen or pencil to jot down your memorized information before the actual test starts. Also, it is imperative that you make yourself as comfortable as possible and settle in so you can focus clearly on the task ahead of you. The testing center will be monitored by the testing proctor, so it is important not to talk, look at other testers’ screens, or do anything questionable. The test proctor has the authority to stop the test if anything appears suspicious. You are given a certain amount of time for each exam. At the time of this writing, the entire test is allotted 110 minutes. Twenty of those minutes are used for reading Cisco’s certification agreement, completing the Cisco survey, and practicing simulation questions in the exam tutorial that you are likely to encounter on the exam. The remaining 90 minutes are for completing the actual exam, which is made up of 60–70 questions. It is always a good idea to keep track of your time. If you find yourself spending too much time on a particular question, it is probably a good idea to take a guess and move on. The worst thing you can do is sacrifice a multitude of questions for the sake of trying to get that one question correct. However, using your time well does not by any means entail panicking and watching the clock. Just be sure to manage your time and be wary if you find yourself spending an exorbitant amount of time—especially in the beginning of the exam.

Exam Layout and Design The questions are administered in several formats and the number will vary from test to test. It is important to become familiar with these question formats so you can focus on the actual questions without worrying about their design. Multiple-choice questions are pretty straightforward when it comes to answering them. Cisco exams predominantly use this type of question. When presented with a question with a single correct answer, select the round radio button that corresponds with the most correct answer and click the Next button. In instances where multiple answers are required, the question instructs

3

4

Chapter . . . . .1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

you to choose a specific number or perhaps all answers that apply. An excellent indicator of multiple answers is the presence of check boxes in the answer selection. Rest easy in the knowledge that Cisco does not let you proceed if the question specifies a number of answers and you did not check enough boxes. The following demonstrates an example of a multiple-answer question with check boxes:

Question 1 Which answer is the correct answer? (Choose two.) ❑ a. Not me ❑ b. Me neither ❑ c. I am ❑ d. Hey, me too

The CSVPN exam also may contain drag-and-drop questions. This type of question asks you to drag graphic or text source objects to appropriate targets in the supplied empty boxes. These questions might be used to test your knowledge of a command syntax, sequential order of events, or terminology definition. Drag the correct value(s) into the empty boxes until you have filled all the appropriate blank spaces. A short time ago, Cisco introduced a new format of questions to their exams, in which they present a simulation of a configuration. These simulations appear like the actual equipment and are used to demonstrate your hands-on capabilities with the hardware. These questions are typically weighed heavier than the rest because of the multiple steps involved, and they are likely to consume more time than the multiple-choice and drag-and-drop questions. Be sure to scroll down any windows that appear above the simulation to get all the necessary information from the question. The simulation is graded based upon your completion of the objectives. As long as you meet those objectives, you will get full credit for the question.

Exam-Taking Basics For every question, the best thing to do is read the question carefully. A single word could throw you off and cause you to get the question wrong. After reading the question once (twice if time allows), look at every answer available to you. It is not a bad idea to read the answers in reverse order (from the bottom to the top), to force your brain to look at every answer. This way, you

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Cisco . . .Certification . . . . . . Exams . . . .

do not hastily choose an answer on the top when there may be a better option below it. When you know the answer, select it and click the next button to proceed to the next question. It is critical to note that Cisco exams do not let you navigate to previously answered questions! You also do not have an option to mark the question and review it at the end of the exam, as other certifications allow. You must make a guess on the question before you can proceed with the rest of the exam. Best practices dictate that you go with your gut feeling and select the best answer with confidence and move on to the next question.

If you are in a bind and cannot determine the correct answer, try using a process of elimination and rule out the answers you know are incorrect. You can sometimes distinguish these answers by their unrecognizable terms or by noticing that the answer is being used in the wrong context for the question. Try not to be lured in the wrong direction by assuming an unrecognizable term is the correct answer. The wrong answers are meant to be misleading, so do not take the bait if you can help it. After the removal of the incorrect answers, you can determine the most correct option from the remaining answers. In multiple-choice scenarios, using this elimination method can drastically improve your odds when all else has failed.

Mastering the Inner Game When I took my first technical test, my class instructor passed on some great wisdom which I, in turn, tell my students each time they are about to test. He told me, “Be the windshield, not the bug.” Despite the disturbing mental imagery, the message always rings true. Namely, take the test with the utmost confidence that you can pass it. In the testing room, the majority of problems arise when we start doubting ourselves. If we start to question our knowledge of the material, we fall prey to a slippery slope in which the outcome that we fear the most becomes inevitable. To avoid this self-fulfilling prophecy, trust the knowledge you have about the subject and do not let a couple of unknown questions seal your fate. If you take a couple of deep breaths and realize that the world is not crashing down around you, you have a fighting chance to maintain your mindset and be successful. To build up your confidence, I recommend reading this book thoroughly. At the end of each chapter, answer the supplied practice questions. If you do not get them correct or you do not feel strong enough in the subject matter covered, use the references listed in the “Need to Know More?” section at the

5

6

Chapter . . . . .1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

end of the chapter to solidify your understanding of the material. After you have completed all the chapters, test your knowledge in the practice exams (located in the back of the book) and review any areas in which your test results are insufficient. With enough preparation and determination, you can pass this exam and further your status in your Cisco career. Good Luck!

Additional Resources The primary source for your Cisco certification information should be the horse’s mouth. Be sure to visit Cisco’s certification section on their Web page, which contains the test objectives that are covered in the 642-511 exam. The link for the certification is located at www.cisco.com/warp/ public/10/wwtraining/certprog/testing/current_exams/642-511.html. Cisco also has a simulation tutorial that demonstrates the test question formats discussed in this chapter. I highly recommend visiting this site to make yourself comfortable with the types of questions that you will encounter. That tutorial is located at www.cisco.com/warp/public/10/wwtraining/certprog/ testing/simulation/tutorial.html. Another untapped resource is to browse newsgroups and get information from fellow test-takers to see whether they can provide any feedback about the CSVPN exam or the CCSP certification track. The newsgroup alt. certification.cisco is an excellent playground where you can meet new certification friends and tap their brains for information.

Coping with Changes on the Web Change is inevitable and the Web pages referenced in this book are no exception. Unfortunately, we cannot control the altering of Web page references, so it may require some additional digging to locate some of the resources listed. If you are unfortunate enough to come across a link in this book and the Web page displays 404 File not found, do not give up hope. Cisco’s Web page is in a constant state of flux and can probably locate the information if you perform a search of their Web page. In addition, searching resources, such as www.google.com, www.excite.com, and www.search.com, can deliver a wealth of information when you perform a search for CSVPN exam material.

2 Overview of VPN and IPSec Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ VPN ✓ IPSec ✓ Symmetric/asymmetric keys ✓ DES/3DES/RSA/AES encryption ✓ MD5/SHA-1 hashes ✓ Diffie-Hellman groups ✓ Authentication Header (AH) ✓ Encapsulation Security Protocol (ESP) ✓ Internet Key Exchange (IKE) ✓ Transport and tunnel modes ✓ Security Association (SA)

Techniques you’ll need to master: ✓ Identify the three types of VPNs ✓ Determine the appropriate VPN device for businesses ✓ Understand the four functions of IPSec ✓ Identify ESP and AH tunnel mode versus transport mode ✓ Know the five steps of IPSec communication

8

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This chapter introduces many of the protocols and standards that are consistent throughout the entire book. The purpose of this chapter is to help you develop a firm foundation of these technologies, as well as introduce the Cisco hardware platforms that utilize these technologies.

VPN Defined Imagine you witness a security carrier with a briefcase attached to his wrist by a set of handcuffs. You can’t help but wonder what is inside the briefcase. It could be government documents, it could be money, or it could be nothing. Such is the nature of modern secure Virtual Private Networks (VPNs). It is the VPN’s job to perform the security carrier’s role and securely protect its payload. By using tunneling protocols (the briefcase), it can provide a secure transport of its contents from origin to destination. By definition, a VPN is merely a secure connection between two or more networks across a public infrastructure. By taking advantage of the Internet as an access method, corporations can securely connect their users and remote locations over widely available communications. To enforce privacy, VPNs employ tunneling protocols to provide a protective barrier around the original data before sending it across an unsafe infrastructure. Prior to modern VPNs, corporations wishing to securely connect their networks together had to lease circuits from providers. The installations of these circuits were timely and expensive in comparison to modern VPNs. Not to mention, the installed leased lines were fixed and could not be changed without requiring an overhaul of the network. As the company expanded, the inconvenient process would need to repeat for each location. In addition, mobile users requiring connectivity to the central office were required to use slow analog modems and dial into an access server while incurring long distance charges. The solution to all of these downfalls is to make the connection virtual and utilize the Internet as an infrastructure. This modern connectivity is far more scalable and significantly cheaper than traditional VPNs utilizing leased lines. It must be said that the term “secure” is used relatively throughout this entire book. VPNs provide additional security when traversing the Internet; however, no solution is totally secure. Even the toughest security carriers can be compromised if the attacker is resourceful enough.

. . . . . . . . . . . . . . . . . . . . . . . . . . Overview . . . . . of . .VPN . . and . . .IPSec . . . Technologies . . . . . . .

Three Types of VPN VPNs can fall into one of three categories: remote access, site-to-site intranet, and business-to-business extranet. Figure 2.1 depicts an illustration of each of these categories. Remote access VPNs enable telecommuters and mobile users to connect to the main office via tunneling protocols such as Layer 2 Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP), and IPSec. With the abundance of Internet access via analog, ISDN, cable, DSL, and mobile IP, remote users can access resources in the corporate network as if they were directly connected to the network inside the corporate office. Remote offices can connect to each other as well as to the main office over the public Internet via site-to-site intranet VPNs. This is more flexible and less expensive than traditional remote office connections, such as packet-switched networks with frame relay and ATM, as well as leased line connections. Business-to-business extranet VPNs utilize VPN tunnels to connect to extranet business partners or other networks that are not part of the corporation. Access rights to the corporate network from the extranet should be defined by the corporation’s security policy.

Main Office Headquarters

Internal Corporation

Internet

Site-to-Site Intranet

External Supplier Remote Access Business-to-Business Extranet

Figure 2.1 Three VPN categories.

9

10

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Cisco VPN Equipment and Software Solutions The following sections look at the specific solutions that Cisco offers for VPN connectivity. Specifically, they examine the Cisco Router IOS, PIX firewall, VPN 3000 Concentrators, and the Cisco 3002 hardware and software clients and considers their functionality in the previously described VPN network types. Also, it is imperative to determine which products should be implemented in small office/home office (SOHO) environments, a remote office/branch office (ROBO) workplace, or enterprise central sites/service providers.

Cisco VPN-Enabled IOS Routers Cisco offers several different models for VPN connectivity employing Cisco IOS routers, starting from the 800 series SOHO routers all the way up to the 7200 enterprise router. In addition, Cisco offers hardware encryption modules and cards to offload the processing and memory responsibilities for encrypting and decrypting traffic that traverses the VPN tunnel. The VPN routers can terminate several remote access tunnels; however, the Cisco IOS VPN routers are predominantly used for intranet and extranet site-to-site connections. Table 2.1 lists the available Cisco models, along with their features and throughput. Table 2.1 Cisco VPN Routers Model

Performance

Hardware Encryption

Site

800

384Kbps/10 Tunnels

NA

SOHO

uBR900

6Mbps/20 Tunnels

Integrated

SOHO

1700

8Mbps/100 Tunnels*

MOD1700-VPN

Small ROBO

2600

24Mbps/800 Tunnels*

AIM-VPN/BP/EP

Medium ROBO

3600

40Mbps/1800 Tunnels*

AIM-VPN/MP/HP

Large ROBO

7100


VAM or ISM/ISA

Central Site

7200


VAM or ISA

Central Site

* Actual performance is based upon VPN hardware accelerated models using 1400 byte packets. Software performance is considerably less.


Cisco has simplified remote policy administration with the creation of its Easy VPN (EzVPN) configurations. This software enhancement, starting with IOS release 12.2(8)T, enables you to define many of the daunting VPN policies at the Easy VPN Server and have them pushed down to Easy VPN clients, thus allowing a minimal configuration for the client sites.

Cisco PIX Firewall Series When the security administration in the organization controls the VPN deployment, the Cisco PIX firewall might be the solution of choice for any intranet or extranet site-to-site needs. Similar to the Cisco IOS routers, the PIX firewall models can be upgraded with a VPN accelerator card. Table 2.2 lists the various PIX models and their respective features. Table 2.2 Cisco PIX Firewalls Model

Performance

Hardware Encryption

Site

PIX 501

3Mbps/5 Tunnels

NA

SOHO

PIX 506

17Mbps/25 Tunnels

NA

Small ROBO

PIX 515


VAC

Small-Medium ROBO

PIX 525


VAC

Central Site/SP

PIX 535


VAC

Central Site/SP

* Actual performance is based upon VPN hardware accelerated models using 1400 byte packets. Software performance is considerably less.

Cisco VPN 3000 Concentrator Series The VPN 3000 Concentrator provides a robust solution for providing termination for remote-access tunnels. Also capable of creating LAN-to-LAN connections to other concentrators or IPSec gateways, the VPN 3000 is a highly versatile device capable of handling up to 10,000 simultaneous sessions. The 642-511 exam expects you to know the VPN 3000 Concentrator’s capabilities and performance. In addition, be sure you are able to correctly determine which model belongs to a given location.

Many of the 3000 series also support field-swappable hardware encryption modules called scalable encryption processors (SEPs). These SEP modules contain programmable digital signal processing (DSP), which can be updated for future enhancements. Although they are discussed in greater detail

11

12

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

later, Table 2.3 familiarizes you with the Cisco VPN 3000 Concentrators and their capabilities. Table 2.3 Cisco VPN 3000 Concentrators Model

Performance

Hardware Encryption

Site

3005

4Mbps/100 Remote Sessions

NA

Small ROBO

3015


NA

Small ROBO

3030


1 SEP Module

Medium ROBO

3060


2 SEP Modules

Central Site/SP

3080

100Mbps/10,000 Remote Sessions

4 SEP Modules

Central Site /SP

Cisco also produced the 5000 series of concentrators geared toward the enterprise market. At the time of this writing, the Cisco VPN 5000 Concentrator series has reached end-of-life status.

Cisco VPN Software Client Bundled with the 3000 Concentrator, the Cisco VPN 3000 Software Client (often referred to as the Unity Client) enables end stations with dissimilar operating systems to establish a secure VPN tunnel to the central site’s concentrator. The Unity Client is discussed in greater detail in Chapter 10.

Cisco VPN 3002 Hardware Client When faced with a SOHO with a multitude of clients requiring encrypted tunnels back to the main office, it is superfluous to install the VPN software client on each system in the office. Assuming you do not already own a VPN gateway router or similar VPN-capable device, you can implement the Cisco 3002 Hardware Client to act as a client and encrypt traffic on behalf of the end stations. The Cisco VPN 3002 is available in a single Ethernet LAN model or as the 3002-8E model, which has an embedded 8-port switch in it for LAN connectivity.

Certicom IPSec Client The Certicom movian Client is a wireless client for devices such as PDAs and other handheld mobile devices. These clients use elliptical curve cryptography (discussed later), which is faster and less processor-intensive for these small processor devices.


IPSec Overview Cisco products support several tunneling protocols for VPNs, such as PPTP, L2TP, and IPSec. PPTP and L2TP are both popular tunneling protocols, but they require additional overhead and do not offer the same security enhancements that IPSec provides. For this very reason, Cisco (as well as this book) de-emphasizes PPTP and L2TP tunneling protocols. Thus, the following sections examine the different aspects of IPSec protocols and how they can be utilized to provide a secure pathway between pairs of gateways and other gateways or hosts.

What Is IPSec? It is a common misconception that IPSec is a secure protocol unto itself. In all actuality, it is a framework of protocols that operate at the Network Layer (Layer 3) of the OSI model. IPSec is used to offer security services for IP traffic and establish tunnels between VPN gateways and hosts. Specifically, the security services that IPSec can provide are confidentiality, data integrity, authentication, and anti-replay protection. The 642-511 exam expects you to understand the services that IPSec can provide and the aspects of each of those services.

IPSec Data Confidentiality One of the most prominent features of IPSec, data confidentiality, is synonymous with IPSec’s capability to encrypt data before traversing the shared network. If you think back to the briefcase example, the contents of the briefcase are scrupulously guarded from any form of prying eyes. With IPSec encryption, you can make it extremely difficult for eavesdroppers to interpret any intercepted data communications. Encryption is achieved by employing several different algorithms (a mathematical function) which, in turn, are composed of different lengths (strengths) of keys. Clear text data is input into the algorithm and combined with the key to produce an encrypted text called cipher text. Unless you have the appropriate decrypting key, you cannot effortlessly compromise the contents of the data.

13

14

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Encryption Keys Encryption keys are strings of digits of varying lengths that are used by the encryption algorithms to produce cipher text. The longer the length of the keys, the more difficult the encryption is to decipher; however, longer keys require extra processing power and time. Common key lengths are 56 bits, 128 bits, and 160 bits, although key lengths have been known to be up to 2048 bits and beyond. Encryption keys can be one of two types: ➤ Symmetric keys—Symmetric keys are characterized by the use of the same

key on both sides of the tunnel to encrypt and decrypt the data. They are kept private because these keys should never be transmitted across a public infrastructure or they might be intercepted. In the briefcase example, this would be the same key that locks and unlocks the handcuffs. ➤ Asymmetric keys—Asymmetric keys utilize a public/private key pair.

What one key encrypts the other key can decrypt. Data is encrypted with the public key (which can be publicly known) and can only be decrypted by its corresponding private key (which is secret and not shared). Figure 2.2 depicts the differences between the two types of encryption keys. Notice in the top illustration that the symmetric keys are identical to encrypt and decrypt the data. The bottom diagram represents asymmetric encryption, which utilizes two separate keys—a public key for encryption and the private key for decryption. Because they require little processing power and are relatively fast, symmetric keys are typically utilized in encrypting and decrypting bulk data. Because symmetric keys need to be known by both parties for encryption and decryption, there must be a method of exchanging keys before the actual encryption takes place. Symmetric keys can be exchanged either manually or dynamically. Manual key exchange entails administrators exchanging the keys, usually by some out-of-band means such as via a secure phone call or mail carrier. Because this can be a daunting task, symmetric keys can also be exchanged dynamically by a method known as the Diffie-Hellman exchange. It is not necessary to understand the complex mathematical calculations for the Diffie-Hellman exchange. It is more pertinent to understand the utility of DiffieHellman and which groups Cisco supports.

To dynamically obtain symmetric keys for bulk encryption in a secure manner, the sender has to encrypt keying materials to produce the symmetric


keys with yet another encryption key called the secret key. This secret key is a mathematical derivative of the peer’s declared public key and the local private key. Figure 2.3 illustrates this concept by displaying two IPSec peers that are initiating an IPSec tunnel. Both sides exchange their public keys which are mathematically combined with their local private keys. The output of this calculation is an identical secret key which can be used to secure subsequent messages, including device-level authentication and the exchange of keying material to generate symmetric keys for bulk encryption. The latter is depicted in Figure 2.3 as a locked safe which is secured and opened with the matching secret key. Symmetric

#W% R&K$ D@W

The sky is blue

Clear Text

Symmetric Key

Cipher Text

The sky is blue

Symmetric Key

Clear Text

Asymmetric

#W% R&K$ D@W

The sky is blue

Clear Text

Asymmetric Public Key

Cipher Text

The sky is blue

Asymmetric Private Key

Clear Text

Figure 2.2 Symmetric and asymmetric encryption.

Diffie-Hellman is the key exchange method over insecure channels in which both sides of the IPSec session formulate the matching secret key. In addition, this shared key is never sent across the tunnel, thus forcing any eavesdropper to require each individual integer used in the mathematical calculation of that key to compromise the transfer. However, it is possible for attackers to launch a man-in-the-middle attack if they are capable of intercepting both sides’ public keys during the initial exchange. Cisco supports four groups of Diffie-Hellman exchange: Diffie-Hellman Group 1 (768 bit), Diffie-Hellman Group 2 (1024 bit), and Diffie-Hellman Group 7 (variable bit), which uses elliptical curve cryptography (ECC) for

15

16

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

small processor devices that use Certicom movian wireless clients (described in the following section). Later software releases for the VPN 3000 Concentrator also support 1536-bit Diffie-Hellman group 5. Receiver

Sender

+

Receiver’s Public Key

Sender’s Public Key

+

= Diffie-Hellman Matching Secret Key

Diffie-Hellman Matching Secret Key

Symmetric Key

Symmetric Key

Matching Secret Key

Matching Secret Key

Figure 2.3 Diffie-Hellman key exchange.

Encryption Algorithms Numerous encryption algorithms are used today for encryption. For the purposes of this book, we will focus on the four that are employed by Cisco: DES, 3DES, RSA, and AES encryption algorithms. Data encryption standard (DES) is a long-standing encryption algorithm that has been around since the late 1970s. DES comprises a 56-bit key which is applied to 64-bit blocks of data. DES was once considered a strong encryption algorithm; however, super-computers can break the DES encryption in a relatively short time. In response to this cryptographic possibility, 3DES 56 was created to offer roughly 2 times more strength than encryption over DES. It does this by encrypting, decrypting, and then encrypting once again with three independent 56-bit keys (aggregate of 168 bits). Both DES and 3DES are symmetric algorithms, which means that they use the same symmetric key to encrypt and decrypt data. The U.S. National Institute of Standards and Technology (NIST) proposed a challenge to form an algorithm standard that could replace DES and perhaps 3DES. The winner of this contest was the Rijndael algorithm, which the NIST implemented as the Advanced Encryption Standard (AES) algorithm in 2000. Similar to DES and 3DES, AES is a symmetric algorithm that uses


matching keys to encrypt and decrypt data. AES, however, supports variablelength keys of 128, 192, and 256 bits to variable-length blocks of data, making it versatile for different IPSec implementations. RSA is an asymmetric encryption algorithm that was named after its creators Ron Rivest, Adi Shamir, and Leonard Adleman. RSA’s key length varies in size depending on the level of encryption security (and processing) you want to use. Data encryption is performed by combining clear-text data with the receiver’s public key. With this method, only the receiver can decrypt the data with its own private key. Although RSA can be used for encryption and decryption of data, RSA is quite often used for creating digital signatures (discussed in Chapter 5). Another noteworthy encryption algorithm is Elliptical Curve Cryptography (ECC). This asymmetric algorithm was created by Certicom and is used quite often in devices with low processing power. ECC is capable of speeding up asymmetric operations because of its remarkable mathematical algorithm, which makes it ideal for wireless clients such as the Certicom movian wireless client.

IPSec Data Integrity IPSec data integrity is maintained by a hash algorithm to ensure that the data was not manipulated in transit by a man-in-the-middle attack. These algorithms take the data and combine it with a shared secret key to calculate a smaller fixed-length representation of the actual message (called a message digest). This whole hashing mechanism is known as a hashed message authentication code (HMAC). If any of the data payload has been changed in transit, it is reflected when the receiving party performs the same algorithm and the results do not match. Cisco supports a keyed HMAC variant of the two hashing algorithms Message Digest 5 (MD5) and Secure Hash Algorithm-1 (SHA-1). MD5 utilizes a 128-bit key in the hashing algorithm and produces a 128-bit message digest, whereas SHA-1 offers more cryptographic strength with a 160-bit secret key, which produces a 160-bit message digest.

IPSec Authentication When the recipient of the briefcase receives the package, how can he be sure that it actually came from the true original sender? Perhaps if the sender signed his name to the contents of the briefcase or used a secret handshake of some sort, the recipient could validate the sender. Similarly, when establishing a VPN tunnel (before the tunnel is considered secure), you have to

17

18

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ensure that the device at the far end of the tunnel is truly the one which you mean to connect. This machine-level authentication is necessary because Diffie-Hellman exchanges are susceptible to man-in-the-middle attacks. The three methods that Cisco accepts to authenticate peers are preshared keys, RSA signatures, and RSA-encrypted nonces. Preshared keys are characterized by having identical keys at each end of the tunnel. This key has to be manually configured in both devices that terminate the tunnel. The local device performs a keyed hash of data with the preshared key and sends the resulting message digest along with the data to the remote peer. When the remote peer uses the same preshared key to perform the hash and the message digest values match, the local device is authenticated. The reverse must also transpire before both sides can truly be considered authenticated. Although they are relatively easy to configure, preshared keys do not scale well in large VPN environments, because you would have to maintain a preshared key for each VPN peer with which you have to communicate. If the preshared key is somehow compromised, the reconfiguration involved could be significant. Preshared keys fall into three different types: unique, group, and wildcard. Unique preshared keys utilize IP addresses, in addition to the key, for authentication. This is not a suitable design for remote access in which remote-end dynamic IP addresses constantly change. In such instances, group preshared keys would be appropriate because they tie a group name as opposed to an IP address for authentication. The last preshared key type, called wildcard preshared keys, does not use IP addresses or groups for authentication data. This is the least secure of the preshared keys because an authenticating device does not require any other proof aside from the preshared key. RSA Digital Signatures utilize the RSA asymmetric algorithm discussed earlier. In contrast to normal encryption, digital signatures are created by digitally signing a set of data with the sender’s private key. A hash of identity information is digitally signed with the sender’s private key and is sent to the peer device, along with a digital certificate containing the local device’s public key. The local device is authenticated when the remote uses the public key in the digital certificate and validates the hash output with its own hash. Cisco also supports another digital signature algorithm that is not as common as RSA. This algorithm, known as digital signature algorithm (DSA), is used only for digital certificate signing (as opposed to encryption). DSA is less susceptible to attacks than RSA and is typically used by the U.S. government.


A final authentication method that is unique to Cisco is to use RSA encrypted nonces. Similar to RSA digital signatures, both sides of the VPN tunnel contain a public and private key; however, the public key is exchanged only via a secure out-of-band channel. After this is complete, both sides of the tunnel generate a pseudorandom number (nonce), which is encrypted with the peer’s public key. Both sides exchange this information and decrypt it with their private key. Finally, both sides hash that output and send it to their peer, to be validated by a locally performed hash of their own nonces.

IPSec Anti-Replay Protection IPSec utilizes sequence numbers to ensure that there are no instances of packet duplication. If the packet sequence number is the same or less than the previous packet’s, the packet is discarded and possibly logged.

IPSec Protocol Framework IPSec is a framework of protocols that comprises a combination of standards and technologies. The protocol framework itself is open and flexible in that it does not mandate a specific key length or algorithm. IPSec contains two basic security protocols as part of the IPSec protocol standard: ➤ Authentication Header (AH)—A protocol that is utilized when data confi-

dentiality is not a concern. It does not perform any form of encryption for the data itself, but rather performs an integrity checksum to ensure that the payload was not modified during transit. AH is a Layer 4 (Transport layer) protocol that can be identified by the IP header’s protocol field value of 51. ➤ Encapsulating Security Payload (ESP)—This protocol can actually ensure

data confidentiality with encryption, as well as data integrity and authentication. ESP protects the IP data payload by encrypting it and adding (encapsulating) an additional header and trailer. ESP can be used in conjunction with AH to provide authentication and integrity of the data, or ESP can provide this functionality within itself. When ESP authentication is enabled, the data contained between the ESP header and trailer is authenticated. ESP is also a Layer 4 (Transport layer) protocol that can be identified by the IP header’s protocol field value of 50. It is important to note that when ESP encryption and authentication is enabled on a local device, encryption is performed before any authentication. This way, when the receiver examines the datagram, it validates the authentication checksum before decrypting the packet, saving time and process cycles.

19

20

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Transport Mode and Tunnel Mode ESP and AH can operate in either transport mode or tunnel mode. The key difference between the two modes is what portion of the IP datagram is being authenticated and encrypted. Transport mode actually adds the AH and/or ESP header before the original IP header. By leaving the original IP header in front of the secured payload, routing devices can still determine the original source and destination addresses, as opposed to the tunnel endpoints. Transport mode is commonly used between end systems. In tunnel mode, the entire original IP packet is secured, including the original IP header, and a new IP header is created for tunnel routing information. This mode is common between two IPSec gateways or an IPSec end station and a gateway, because the IPSec device is securing data on behalf of the network behind itself. Figure 2.4 shows the differences between ESP in transport and tunnel modes. Original IP Header

Original Data Payload

Encrypted

Original IP Header

Transport Mode

ESP Header


ESP Trailer

ESP Auth

ESP Trailer

ESP Auth

Authenticated Encrypted

Tunnel Mode

New IP Header

ESP Header

Original IP Header


Authenticated

Figure 2.4 ESP in transport and tunnel mode.

Internet Key Exchange (IKE) IKE is a hybrid protocol derived from the Internet Security Association and Key Management Protocol (ISAKMP), the Secure Key Exchange Mechanism (SKEME) protocol, and the Oakley protocol. IKE automatically handles the preliminary negotiation and authentication between IPSec peers. This negotiation aspect of IKE entails an agreement between both


IPSec peers, in which matching encryption and hash algorithms, as well as peer authentication methods, tunnel modes, and IPSec policy lifetimes, are also determined. As you can discern from the acronym, IKE also negotiates and implements the Diffie-Hellman groups for key exchanges.

Five Steps of IPSec: Tying it All Together Now that we have discussed some of the fundamentals of IPSec, it is important to examine the mechanisms that take place when initiating and terminating an IPSec tunnel. It is imperative to remember these five steps of IPSec. It is especially important to recognize the names and the number of steps involved in each phase of IKE negotiations.

1. Interesting Traffic—In this initial step, traffic is deemed interesting in

accordance with IPSec’s policy parameters. These parameters define IPSec peers and the type of encryption and authentication methods that are enabled on the local device for those given peers. This policy configuration determines which traffic is to be secured or sent in the clear. 2. IKE Phase 1—In phase 1, IKE can operate in one of two modes: main

mode or aggressive mode. Main mode comprises three 2-way interactions. The first exchange involves both sides requesting secure negotiations. In this process, both sides try to secure IKE communications by finding matching policy parameters, such as hash and encryption algorithms. When the policy is successfully negotiated, it is known as a security association (SA). After this is accomplished, Diffie-Hellman performs its key exchange, followed by peer authentication. In aggressive mode, the process is considerably shorter. In the initial exchange, the initiating device sends a multitude of information, including the Diffie-Hellman public keys. The receiver completes the exchange, thus establishing a security association that uses less time and fewer packets than main mode does. The disadvantage to aggressive mode is that it is susceptible to eavesdropping because the key is advertised before a secure channel is established.

21

22

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3. IKE Phase 2—Unlike IKE phase 1, phase 2 has only one mode, called

quick mode. In quick mode, IPSec SAs are established by both devices negotiating a set of security parameters and rules called a transform set. An IPSec SA must be established for each unidirectional inbound and outbound IPSec session. 4. IPSec Encrypted Traffic—After IKE has established security parameters,

traffic destined for the tunnel is secured in accordance with those policies defined in the established SA. Security associations have a lifetime determined by a number of seconds or bytes. If the SAs expire and the traffic still warrants secure traffic over that session, IKE phase 2 quick mode reoccurs and a new key and SA is created before the existing SA expires to ensure uninterrupted secure data transfer. 5. IPSec Tunnel Termination—The tunnel terminates when the SA lifetime

expires or the tunnel is manually deleted.

Summary VPNs comprise secure connections between two endpoints and utilizes protocols such as L2TP, PPTP, and IPSec. VPNs can fall into three categories: remote access, site-to-site intranet, and business-to-business extranet. Remote access VPNs are used by telecommuters and mobile users to connect to a central office. Site-to-site intranet VPNs are characterized by interjoining remote offices and the central office via a secure VPN tunnel. Businessto-business extranet VPNs are secure tunnels to external business partners or suppliers that are not part of the corporation. Cisco offers several solutions for VPN connectivity, depending on the size of the location, the performance, and the number and type of VPN sessions required. Table 2.4 summarizes the Cisco VPN products. Table 2.4 Cisco VPN Products Remote Access

Site-to-Site Routers

Site-to-Site PIX

SOHO

3002 Client, Software Client

800, uBR900

501, 506

Small ROBO

3005, 3015

1700,2600,3600

506, 515

Medium ROBO

3030

3600, 7100

515

Main Office, SP

3060, 3080

7100, 7200

525, 535

IPSec is used to provide a secure pathway between a pair of IPSec gateways or hosts and gateways. IPSec’s functionality entails the following: confidentiality, integrity, peer authentication, and anti-replay services.


IPSec confidentiality is synonymous with secure data encryption. Encryption entails securing data by running an encryption algorithm with an encryption key to produce cipher text. Key algorithms can either be symmetric or asymmetric. Symmetric keys are characterized by the way they utilize matching keys for encrypting the data and decrypting it on the remote end. Asymmetric keys contain a public and private key pair. The private key is never communicated and is kept secret, whereas the public key is communicated to IPSec peers that wish to encrypt data destined for your device. Data is encrypted locally with the remote peer’s public key and decrypted by the remote using its private key. Cisco supports 56-bit DES and 168-bit 3DES for symmetric key algorithms, and RSA (variable bit) and ECC (variable bit) for asymmetric key alogrithms. Cisco also supports symmetric algorithm AES in software version 3.6 and above, which has keys of 128, 192, or 256 bits in length. Cisco keys can be exchanged manually or automatically via Diffie-Hellman groups 1 (768-bit), 2 (1024-bit), 5 (1536-bit), or 7 (variable bit). IPSec integrity is obtained through HMACs. IPSec devices create and send a keyed message digest to the far-end peer, along with the actual message. If any bit was changed in the data transmission, the remote detects it when it performs the same hash on the message and they do not match. Cisco supports the HMAC variant of MD5 (128-bit) and SHA-1 (160-bit). IPSec peer authentication is a crucial step in IKE phase 1, in which the IPSec device validates the remote peer. Cisco supports the following three methods of peer authentication: preshared keys, RSA signatures, and RSA encrypted nonces. Preshared keys are manually configured on both devices of the IPSec tunnel. RSA signatures are a dynamic authentication in which the IPSec device encrypts identification information with its own private key, which is validated by the remote through the use of the sender’s public key. RSAencrypted nonces utilize a pseudorandom number to validate the remote IPSec peer. Anti-replay services in IPSec entail sequence numbers to ensure that the IPSec device is not receiving out-of-sync or duplicate data from an intruder. The IPSec protocol is actually a framework consisting of a collection of secure protocols and standards. IPSec uses two primary protocols for its confidentiality and integrity services. AH is a protocol used for data integrity and sender authentication only. ESP can be utilized for encryption, as well as data integrity and authentication. IKE is a protocol responsible for the preliminary phase of IPSec communication, in which SAs are established for IKE and IPSec. This entails encryption and hash algorithms, transform sets, Diffie-Hellman key exchange, SA lifetimes, tunnel modes, and SA lifetimes.

23

24

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

IPSec can exist in one of two modes, determined in the IPSec transform set negotiation of IKE phase 2. Tunnel mode consists of encrypting and authenticating the entire original payload, whereas transport mode maintains the original IP header and protects only the upper-layer payload. Communications with IPSec can be summarized in five steps: 1. Determining interesting traffic 2. IKE phase 1 negotiation, DH key exchange, and peer authentication 3. IKE phase 2 IPSec transform set negotiation 4. Encrypting IPSec traffic 5. Tunnel termination


Exam Prep Questions Question 1 An external supplier for your company plans to implement a VPN tunnel to your headquarters. What type of VPN does this indicate? ❍ A. Site-to-site intranet VPN ❍ B. Business-to-business extranet VPN ❍ C. Remote access VPN ❍ D. External access VPN

Because we are connecting to a supplier not in our company, answer B is correct. A and C are used for VPNs within our company. D is not an actual type of VPN.

Question 2 Your security department plans on managing and controlling VPNs for a medium-sized business. What VPN device should they use? ❍ A. Cisco PIX 501 firewall ❍ B. Cisco 3640 IOS router ❍ C. Cisco VPN 3005 Concentrator ❍ D. Cisco PIX 515 firewall

Answer D is correct. Because this is a medium-sized business and the security department is managing the VPNs, the PIX 515 is the best model to choose. A is incorrect because the PIX 501 is not a suitable device for medium-sized businesses. B and C are capable devices; however, they may not be under the control of the security department.

25

26

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 3 Which of the Diffie-Hellman groups are supported by Cisco VPN products? (Choose all that apply.) ❑ A. Group 1 ❑ B. Group 2 ❑ C. Group 3 ❑ D. Group 5 ❑ E. Group 7 ❑ F. Group 8 ❑ G. Group 9

Answers A, B, D, and E are correct. Cisco VPN products can support groups 1, 2, and 7. Diffie-Hellman group 1 is 768-bit and Diffie-Hellman 2 is 1024bit. Diffie-Hellman 5 was supported starting with software version 3.6 and is 1536-bit. Diffie-Hellman group 7 is used for mobile devices such as PDAs and IP phones. Answers C, F, and G are not supported by Cisco.

Question 4 Which of the following are IKE modes? (Choose all that apply.) ❑ A. Main mode ❑ B. Fast mode ❑ C. Aggressive mode ❑ D. Quick mode ❑ E. Diffie-Hellman mode

Answers A, C, and D are correct. Main mode and aggressive mode are in IKE phase 1 negotiation, and quick mode is in IKE phase 2. Answers B and E are not actual modes of IKE.

Question 5 Which of the following is not a step in IPSec communications? ❍ A. IPSec encrypted data ❍ B. Interesting traffic ❍ C. IKE phase 3 ❍ D. Tunnel termination


Answer C is the correct answer. IKE Phase 3 does not exist.

Question 6 What type of Diffie-Hellman group would you expect to be utilized on a wireless device? ❍ A. Group 4 ❍ B. Group 7 ❍ C. Group 5 ❍ D. Group 3

Answer B is correct. Wireless clients typically use Diffie-Hellman Group 7 for small processor devices such as wireless devices. Answers A, C, and D are incorrect because these groups would not typically be found on wireless or other small processor devices.

Question 7 Which one of these encryption algorithms is asymmetric? ❍ A. DES ❍ B. 3DES ❍ C. RSA ❍ D. AES

Answer C is correct. RSA utilized a private key and a public key pair for encryption. Answers A, C, and D are incorrect because AES, DES, and 3DES are symmetric algorithms, which use the same key to encrypt and decrypt.

Question 8 Which one of the following is not a service provided by the IPSec protocol framework? ❍ A. Authentication ❍ B. Authorization ❍ C. Anti-Replay ❍ D. Confidentiality ❍ E. Data Integrity

27

28

Chapter . . . . .2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer B is correct. IPSec can provide confidentiality, data integrity, authentication, and anti-replay protection. Authorization is not a service that is provided by IPSec.

Question 9 Which one of the following devices would not typically be implemented at an enterprise main office or service provider? ❍ A. Cisco 7200 Router ❍ B. VPN 3060 Concentrator ❍ C. PIX 535 Firewall ❍ D. VPN 3030 Concentrator

Answer D is correct. An enterprise main office or service provider would require robust equipment to handle the throughput required at such large locations. Typical equipment for such a site would be the VPN 3060 and 3080 Concentrators, Cisco 7100 and 7200 Routers, and PIX 525 and 535 firewalls. The 3030 Concentrator is better suited at a Medium ROBO.

Question 10 Which process is true regarding asymmetric encryption (Choose 2) ❑ A. Both devices use matching keys. ❑ B. Both devices use different keys. ❑ C. The sender uses the receiver’s public key for encrypting the data. ❑ D. The sender uses the receiver’s private key for encrypting the data.

Answers B and C are correct. Asymmetric encryption is characterized by both ends utilizing different keys. The sender uses the receiver’s public key to encrypt the bulk data, which is decrypted by the sender using its private key. Answer A is incorrect because that is a characteristic of symmetric encryption. Answer D is incorrect because the sender must never know the receiver’s private key.


Need to Know More? Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. Mel, H. X. and Baker, Doris. Cryptography Decrypted. Reading, MA: Addison-Wesley, 2000. Cisco Security and VPN Devices:

www.cisco.com/pcgi-bin/Support/

browse/index.pl?i=Hardware%20Products&f=595

For definitions and articles concerning security, visit searchSecurity. com at http://searchsecurity.techtarget.com/

29

3 Cisco VPN 3000 Concentrator Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Client mode ✓ Network Extension mode ✓ SEP ✓ SEP-E ✓ VRRP ✓ VCA protocol

Techniques you’ll need to master: ✓ Identifying the default hardware components of the VPN 3000 Concentrators ✓ Identifying the standard performance statistics for the VPN 3000 Concentrators ✓ Understanding SEP redundancy ✓ Comprehending the utilization of VRRP for concentrator redundancy ✓ Understanding concentrator load balancing functionality ✓ Recognizing the principle of bandwidth management

32

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This chapter introduces the hardware platforms for Cisco’s VPN 3002 Hardware Client and the VPN 3000 Concentrator series. It is crucial that you understand the hardware aspect of the equipment before the actual configuration to provide a foundation for the components that you are configuring. Table 3.1 illustrates the Cisco VPN Concentrator and Client offerings and the locations in which you would implement these appliances. Table 3.1 Cisco VPN Concentrator and Client Platform Overview Concentrator Model

Performance

Hardware Encryption

Site

3002 Hardware Client

2.2Mbps/1 Session

NA

SOHO

3005


NA

Small ROBO

3015


NA

Small ROBO

3030


1 SEP Module

Medium ROBO

3060


2 SEP Modules

Central Site/SP

3080

100Mbps/10,000 Remote Sessions

4 SEP Modules

Central Site /SP

SOHO Cisco VPN 3002 Hardware Client The 3002 Hardware Client provides hardware stability for small offices in which remote access VPN tunnels to the main office are required. Instead of installing the software client on multiple end-devices, the Cisco VPN 3002 Hardware Client offloads that responsibility onto itself by initiating the VPN tunnel on behalf of the clients behind it. This functionality, known as Client mode, utilizes Port Address Translation (PAT) to hide the devices behind the hardware client. The 3002 can also support site-to-site connectivity in Network Extension mode. Configuration is simple because of its pushed-policy feature in which the 3002 inherits configuration parameters from the head-end VPN concentrator. The VPN 3002 Hardware Client is capable of providing up to 10Mbps of throughput of unencrypted data and 2.2Mbps of software-based encrypted

. . . . . . . . . . . . . . . . . . . . . . . . . . .Cisco . . . VPN . . .3000 . . .Concentrator . . . . . . . Hardware . . . . .

Model CVPN 3002-8E CONSOLE

10/100 PUBLIC

10/100 PRIVATE

data over a single VPN tunnel. It comes standard with a public 10/100 Ethernet interface, which connects to an external Internet WAN router. The CVPN-3002 model has a single private 10/100 Ethernet interface, whereas the CVPN-3002-8E model has an embedded auto-MDIX 8-port switch. The fact that this appliance does not need to rely on unstable computer platforms and can maintain substantial throughput, means the VPN 3002 Hardware Client is a robust solution in comparison to software-based clients. Figure 3.1 illustrates the CVPN 3002-8E model.

Figure 3.1 Cisco CVPN 3002-8E Hardware Client.

Small ROBO VPN 3000 Concentrators When your Cisco VPN concentrator is implemented in a small remote office for remote access VPN tunnel termination and site-to-site connectivity, the 3005 and 3015 are ideal VPN concentrators. Depicted in Figure 3.2, the 3005 has a relatively small footprint, taking up one rack unit. Utilizing software for encryption, the Cisco 3005 VPN Concentrator can support up to 100 simultaneous sessions. The 3005 comes standard with 32MB of SRAM and two autosensing 10/100 Ethernet interfaces. The left Ethernet interface is the private Ethernet interface, which connects to the inside corporate network. To connect to the outside world, the other Ethernet interface, called the public interface, connects to a perimeter Internet router or a firewall. Because the 3005 Concentrator is a smaller fixed model, it is not capable of being upgraded with Scalable Encryption Processing (SEP) or Enhanced SEP (SEP-E) hardware modules for hardwarebased VPN acceleration. SEP and SEP-E modules provide an increase in performance and throughput over software-only encryption by offloading the encryption processing from the concentrator central processing unit. Private

Public

Figure 3.2 ESP Cisco VPN 3005 Concentrator.

33

34

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

In comparison to the 3005, the Cisco 3015 VPN Concentrator is larger and takes up two rack units. The 3015 is bundled standard with 64MB of SRAM and three autosensing 10/100 Ethernet interfaces. The private and public interfaces are still present in this model, but the 3015 has an additional interface located on the right of the chassis named the external interface. This Ethernet interface connects to the corporate DMZ. Similar to the 3005, the 3015 VPN Concentrator uses software encryption; however, the 3015 is capable of being upgraded with an SEP module. When it utilizes software encryption, it can support up to only 100 remote access and site-to-site sessions. Starting with software version 3.6, the 3015 VPN Concentrators and up support Advanced Encryption Standard (AES). In addition, the VPN concentrators running software version 4.0 support AES hardware acceleration with the SEP-E module. You cannot combine SEP-E with SEP modules in the same chassis. Be sure to carefully read the questions concerning the concentrator’s ability to support AES. Unless the SEP-E accelerator cards are specifically mentioned, the VPN 3000 Concentrator performs AES encryption via software.

The 3015 also has an optional slot for a redundant power supply. Figure 3.3 displays the hardware design for the 3015.

Private

Public

External

Figure 3.3 Cisco VPN 3015 Concentrator.

Medium ROBO VPN 3000 Concentrator When a regional office requires considerable throughput and simultaneous VPN sessions, the Cisco VPN 3030 is the concentrator of choice. The 3030 comes standard with 128MB of SRAM and one SEP module for hardwarebased encryption to support up to 1500 remote access sessions and 500 siteto-site sessions. The VPN 3030 Concentrator has a hardware chassis with three Ethernet interfaces and an optional redundant power supply, just like the 3015 Concentrator (refer to Figure 3.2).


Main Office and Service Provider VPN 3000 Concentrators In an enterprise environment in which thousands of remote users need VPN connectivity to the main office, it is necessary to implement a more robust model of VPN Concentrator. The Cisco 3060 and 3080 VPN Concentrators have the scalability to support 100Mbps of throughput. Both models are two rack units high (same chassis as 3015 and 3030) and come standard with 256MB of SRAM. A key difference between the 3060 and 3080 is that the 3060 comes standard with two SEP modules, whereas the 3080 has four. Because the 3080 has double the amount of SEP processing power, it can terminate up to 10,000 simultaneous sessions, as compared to the 3060, which can maintain up to 5,000 sessions. Both models can support up to 1,000 siteto-site sessions for intranet and extranet VPNs. A final difference is that the 3060 has an optional redundant power supply slot, but the 3080 includes a standard redundant power supply. Table 3.2 summarizes all the models of the Cisco 3000 VPN Concentrator family. Table 3.2 Cisco VPN 3000 Concentrator Comparison 3005

3015

3030

3060

3080

Remote Sessions

100

100

1,500

5,000

10,000

Site-to-Site Tunnels

100

100

500

1,000

1,000

Rack Units

1

2

2

2

2

Performance

4Mbps

4Mbps

50Mbps

100Mbps

100Mbps

Memory (SRAM)

32

64

128

256

256

Encryption

Software

Software

Hardware

Hardware

Hardware

SEP (Standard)

0

0

1

2

4

Ethernet Interfaces

2

3

3

3

3

Upgradeable

No

Yes

Yes

Yes

N/A

Redundant Power

No

Optional

Optional

Optional

Standard

It is important to know for the examination the standard hardware and functionality for the VPN 3000 Concentrator series.

35

36

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Cisco VPN 3000 Concentrator Fault Tolerance The VPN 3000 series of concentrators have capabilities to do SEP load balancing, as well as provide concentrator redundancy. Models 3015 and above have the capabilities to support up to 4 SEP modules. Maximum throughput can be achieved with two of these modules, while the other two serve as redundant SEPs in case of SEP failure. SEP redundancy is a top-down function: In instances where the top SEP fails, the bottom one takes over. In such instances, sessions are automatically transitioned to the bottom SEP and sessions remain connected. If both the top and bottom SEP modules fail, the SEP processing is handled by the other top SEP module. If there are no more additional redundant modules, the sessions will be handled by the concentrator’s software. In both of these instances, however, sessions are lost and users need to reconnect. SEP redundancy is automatic and does not need to be configured. Figure 3.4 displays SEP redundancy.

Power Status

Power Status

Power Status

Power Status

Saves Sessions

Loses Sessions

Figure 3.4 Cisco VPN 3080 Concentrator with SEP redundancy.

Concentrator redundancy comes into play when multiple concentrators are running in parallel with each other at the same site. For this fault tolerance to work correctly, all parallel concentrators must have their private interfaces in the same LAN and the public interfaces must be in their own LANs (different from the private interface’s LAN). The VPN 3000 Concentrators achieve this fault tolerance via a protocol called Virtual Router Redundancy Protocol (VRRP). With this protocol, the concentrators maintain a virtual router to which all VPN services are being forwarded. One concentrator is the master of the VRRP group, which is dedicated to maintain requests to the virtual router’s IP address. If the master fails, the other concentrators stop receiving VRRP hellos on both interfaces. When this occurs, an idle backup concentrator becomes the master within three to ten seconds and continues forwarding requests being sent to the virtual router’s IP. Remote access sessions are disconnected and require the far-end devices to reconnect. For LAN-to-LAN (site-to-site) tunnels, the switchover is automatic and no reconnection is required.


Cisco VPN 3000 Concentrator Load Balancing Similar to redundancy, concentrator load balancing entails several concentrators running in parallel. There is also a master concentrator and a protocol to maintain the group, or cluster, called the Virtual Clustering Agent (VCA) load balancing protocol. Load balancing entails all concentrators agreeing on a public virtual IP address that remote clients use to connect. At any given time, connections to this IP address are being serviced by the master of the cluster. The VCA protocol is the medium in which non-master concentrators report their current load value to the master. Because the master knows the load distribution of all the concentrators in the cluster, it can send a redirect message to the remote client during IKE negotiation. This message contains the public address of the underutilized concentrator to which the remote client can resume its connection. This is much more versatile because multiple devices can service tunnel sessions and offload interface and processing overhead. For load balancing to work, you must enable VCA filters on the public and private interfaces. You cannot run load balancing in conjunction with redundancy. When configured for redundancy, the other concentrators are in an idle state, which nullifies the load balancing functionality.

Cisco VPN 3000 Concentrator Bandwidth Management Starting with software version 3.6, the 3000 Concentrators are capable of performing bandwidth allocation. You can apply defined bandwidth policies to a specific interface or on a group-by-group basis, by either policing the amount of traffic allowed or reserving a portion of bandwidth. Policing entails using rate-limiting bandwidth to ensure that traffic does not exceed what is stated in the policy, whereas bandwidth reservation enables you to set aside a minimum amount of bandwidth in times of high utilization.

37

38

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Summary Precluding the actual configuration of the VPN 3000 Concentrator series, it is imperative to understand the hardware aspects of these VPN devices. The VPN 3002 Hardware Client supports a single VPN tunnel in which it can either act as a client to the head-end concentrator or initiate a site-to-site connection. When acting in Client mode, the 3002 Hardware Client hides the devices behind it by utilizing PAT. In Network Extension mode, the 3002 creates a tunnel to bridge the two networks together. In a small branch office, the VPN 3005 and 3015 Concentrators both offer software-based encryption for up to 100 remote access and site-to-site sessions. The 3005 is a fixed design with 32MB of SRAM, whereas the 3015 has 64MB of SRAM inside a larger, modular design, which can be upgraded with a hardware encryption SEP module and an optional redundant power supply. A medium-sized branch office should contain the Cisco VPN 3030 Concentrator, which can sustain up to 1,500 remote access sessions and 500 site-to-site sessions. The 3030 comes standard with 128MB of SRAM and one SEP module to support hardware encryption. The large main office and service provider arena requires enterprise-size models of concentrators. The 3060 and 3080 can provide robust performance and throughput for this sized solution. Both models come standard with 256MB of SRAM and can support up to 1,000 site-to-site tunnels. The 3060 Concentrator has an optional bay for a redundant power supply and two SEP modules for hardware-based encryption support of up to 5,000 sessions. The Cisco VPN 3080 Concentrator ships standard with a redundant power supply and utilizes four SEP modules for support of up to 10,000 remote access sessions. Cisco VPN 3000 Concentrators offer a great deal of versatility in the form of redundancy, load balancing, and bandwidth management. SEP redundancy is achieved in a top-down method in which sessions are saved as long as both the top and bottom SEP do not fail. If such a failure occurs, the sessions are lost and subsequent sessions are offloaded to the next-top SEP or to the concentrator’s software if no redundant SEPs are active. When concentrators are running in parallel, you can achieve load balancing or redundancy. The latter is provided via the VRRP protocol, in which a master concentrator is responsible for servicing datagrams addressed to a virtual router IP address. If the master should happen to fail, a backup assumes the role of the master and continues to service the VPN traffic. Load balancing shares a similar concept; however, load-balanced concentrators utilize


the VCA protocol to offload VPN sessions to underutilized concentrators. It is the master’s responsibility to send redirect messages to connecting clients during the IKE negotiations. Bandwidth management is available in software version 3.6. The VPN 3000 Concentrators enable you to create policies to either police the amount of bandwidth being utilized or to reserve bandwidth during high utilization.

39

40

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exam Prep Questions Question 1 Your company requires 800 LAN-to-LAN sessions. What model of concentrator should you provide at the main office? (Choose two.) ❑ A. Cisco 3060 VPN Concentrator ❑ B. Cisco 3030 VPN Concentrator ❑ C. Cisco 3080 VPN Concentrator ❑ D. Cisco 3800 VPN Concentrator

Answers A and C are correct. The VPN 3060 and 3080 Concentrators handle up to 1,000 LAN-to-LAN sessions. B is incorrect because the 3030 VPN Concentrator supports 500 LAN-to-LAN sessions. D is incorrect because there is no such model as the 3800 VPN Concentrator.

Question 2 What are the standard SEP and SRAM amounts in the 3030 Concentrator? ❍ A. 2 SEP, 128MB of SRAM ❍ B. 1 SEP, 64MB of SRAM ❍ C. 0 SEP, 128MB of SRAM ❍ D. 1 SEP, 128MB of SRAM

Answer D is correct. The 3030 Concentrator comes with 1 SEP module for hardware encryption and 128MB of SRAM. Answer A is incorrect because the standard 3030 Concentrator ships with only one SEP module. Answer B is incorrect because the 3030 Concentrator comes with 128MB of SRAM. Answer C is incorrect because the VPN 3030 comes with one SEP module.

Question 3 What are the two modes of 3002 Hardware Client? (Choose two.) ❑ A. Network Extension mode ❑ B. Network bridge mode ❑ C. Software mode ❑ D. Client mode


Answers A and D are correct. The 3002 Hardware Client utilizes Client mode with PAT support to hide the clients behind the device, and Network Extension mode, which connects the two networks and does not hide the end-devices. Answers B and C are incorrect because network bridge mode and software mode do not exist.

Question 4 Which of the following are not upgradeable? ❍ A. Cisco VPN 3005 Concentrator ❍ B. Cisco VPN 3015 Concentrator ❍ C. Cisco VPN 3030 Concentrator ❍ D. Cisco VPN 3060 Concentrator

Answer A is correct. The VPN 3005 is a fixed design and cannot be upgraded. Answers B, C, and D are incorrect because they all share a similar chassis, which can be upgraded with up to four SEP modules.

Question 5 Which protocol is utilized for concentrator redundancy? ❍ A. VCA ❍ B. VAC ❍ C. VRRP ❍ D. HSRP

Answer C is correct. Concentrators use VRRP to enable redundancy, among other parallel concentrators. Answer A is incorrect because VCA is a protocol utilized for load balancing. Answer B is incorrect because VAC is an accelerator card for PIX firewalls. D is incorrect because HSRP is a redundancy protocol utilized by Cisco routers, not Cisco VPN Concentrators.

41

42

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 6 The 3080 Concentrator’s top and bottom left modules fail. What happens to the existing sessions when the unit offloads the sessions to the correct SEPs? ❍ A. They are automatically reconnected. ❍ B. This functionality does not exist. ❍ C. They are lost and need to be reconnected. ❍ D. Only LAN-to-LAN sessions are saved.

Answer C is correct. When two SEP modules fail in the same column, the sessions are lost and have to be rebuilt. Answer A is incorrect because this happens only when the top SEP fails. Answer B is incorrect because SEP redundancy exists and is automatically running on models 3015 and higher. Answer D is incorrect because all sessions are lost—remote access as well as LAN-to-LAN.

Question 7 Your standard 3015 Concentrator’s top SEP module fails. What happens to the existing sessions? ❍ A. The redundant SEP module resumes the sessions. ❍ B. This functionality does not exist. ❍ C. All sessions are lost and users will not be able to connect because the only SEP module has failed. ❍ D. Users need to reconnect their sessions, which the concentrator’s software will encrypt.

Answer D is correct. When all SEP modules fail, the concentrator’s software encrypts subsequent sessions. Answer A is incorrect because the 3015 does not come with a redundant SEP. Answer B is incorrect because SEP redundancy exists and is automatically running on models 3015 and higher. C is incorrect because subsequent sessions are handled via the concentrator’s software.


Question 8 Your company has decided to use the VPN 3000 Concentrator for its enterprise headquarters. The company consists of roughly 9,000 sales employees, who typically travel to customers’ locations or are working from home. Because this sales force comprises the majority of the company, management wants to ensure complete redundancy at any expense. What solution would you suggest to management? ❍ A. A VPN 3030 Concentrator at the headquarters and VPN 3002 Hardware Clients for the sales force ❍ B. A VPN 3080 Concentrator at the headquarters and Cisco software clients for the sales force ❍ C. Two VPN 3080 Concentrators at the headquarters running VRRP and Cisco software clients for the sales force ❍ D. Two VPN 3030 Concentrators at the headquarters running VCA and Cisco software clients for the sales force

Answer C is correct. To ensure complete redundancy for the central headquarters, you should choose the VPN 3080 model because it ships standard with four SEP modules (two for redundancy) and two power supplies (one for redundancy). In addition, the fact that there will be two parallel VPN 3080 Concentrators running VRRP increases redundancy by providing SEP and power supply redundancy, as well as concentrator redundancy, in case one of the concentrators fails. Answers A and D suggests a 3030 Concentrator, which does not include SEP or power redundancy. Answer B uses the appropriate model, but a single concentrator failure will still cause downtime if it happens to fail.

Question 9 You have two VPN 3000 Concentrators running VRRP at the central location. When the master concentrator fails, which sessions need to be reconnected? ❍ A. Remote access sessions need to be reconnected; however, LAN-toLAN sessions are automatically saved. ❍ B. LAN-to-LAN sessions need to be reconnected; however, remote access sessions are automatically saved. ❍ C. Both LAN-to-LAN and remote access sessions are saved. ❍ D. Neither LAN-to-LAN or remote access sessions are saved.

43

44

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer A is correct. When running two or more parallel concentrators with VRRP, if the master concentrator fails, only LAN-to-LAN sessions are automatically saved. Remote access sessions need to be reconnected by the clients; however, clients do not need to reconfigure their settings to reconnect. Answers B and D are incorrect because the LAN-to-LAN sessions do not need to be reconnected. Answer C is incorrect because remote access sessions need to be re-established by the clients.

Question 10 You have decided to utilize concentrator load balancing by using the Virtual Clustering Agent (VCA) protocol. You enabled the VCA protocol on the parallel concentrators, but users are always being connected to the master concentrator of the cluster. What is a possible cause for the load balancing to fail? (Choose two.) ❑ A. Load balancing requires all the concentrators to run VRRP. ❑ B. The concentrators in the cluster do not have the same virtual IP address configured for the VCA protocol. ❑ C. The concentrators do not have the VCA filters assigned to the public interface. ❑ d. The concentrators do not have the VCA filters assigned to the public and the private interfaces.

Answers B and D are correct. Concentrator load balancing requires that all the parallel concentrators have the same virtual IP address assigned. In addition, VCA protocols are not permitted to be sent or received on the interfaces unless you assign VCA filters to permit the protocol on the public and the private interfaces. Answer A is incorrect because the concentrator cannot load balance if running VRRP. Answer C is only partially correct. The filters must be present on all interfaces for the concentrators to send and receive VCA.


Question 11 Your managers have approached you complaining that their connections have been slow when using the VPN Concentrator at peak times. You are currently running version 3.5 on the VPN 3000 Concentrator. What two solutions can you implement to appease management? (Choose two.) ❑ A. Downgrade the software version because the 3.5 version has a known bug. ❑ B. Upgrade the software version to at least 3.6 to support bandwidth policies. ❑ C. Assign a traffic reservation policy to the manager’s group. ❑ D. Assign a traffic policing policy to the manager’s group.

Answers B and C are correct. Bandwidth management policies were introduced in software version 3.6. These policies enable you to either police bandwidth or reserve bandwidth during high utilization periods. Answer A is incorrect because there is not such a bug in the software version and the code should be updgraded rather than downgraded. Answer D does not reserve bandwidth for the managers. In fact, this actually limits the amount of bandwidth the managers receive.

45

46

Chapter . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Need to Know More? For product literature on all the VPN 3000 Concentrator family, go to www.cisco.com/en/US/products/hw/vpndevc/ps2284/prod_models_home.html.

4 Cisco VPN 3000 Remote Access Preshared Key Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Quick Configuration ✓ VPN 3000 Concentrator Manager ✓ Extended Authentication (XAUTH) ✓ Dead Peer Detection (DPD) ✓ Split tunneling ✓ NAT transparency ✓ Perfect Forward Secrecy (PFS)

Techniques you’ll need to master: ✓ Identifying the components of an IPSec remote access tunnel ✓ Understanding the steps for the CLI initialization of the VPN 3000 Concentrator ✓ Recognizing the options presented in the Quick Configuration dialog ✓ Navigating through the screens of the Concentrator Manger ✓ Configuring users and groups for remote access sessions by using preshared keys for authentication ✓ Understanding the functions and configurations for split tunneling ✓ Creating in-depth configurations for IPSec associations, network lists, and access hours

48

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Now that all the fundamentals are out of the way, it is time to get started and configure the Cisco VPN 3000 Concentrator. This chapter serves as an introduction for the navigation and configuration of the VPN 3000 Concentrator. It looks first at how to initialize the concentrator via the menu-based CLI. This is followed by the intricate details of the GUI-based configuration for remote access, utilizing preshared keys as an authentication methodology.

Elements of IPSec Remote Access To have a successful remote access implementation, you need to make sure you have all the necessary ingredients. Namely, you are required to have the following: a remote client, VPN Concentrator, PPP or equivalent Layer 2 protocol, and IPSec, PPTP, or L2TP tunneling protocol. To illustrate these components, look at Figure 4.1, which displays a typical IPSec remote access scenario with Cisco components.

Internet

PPP Public IP: 192.168.1.101

ISP IP: 172.16.1.2

IPSec Internal SA: 10.1.1.100

ESP IP Header E SA: 172.16.1.2 S DA: 192.168.1.101 P

Private IP: 10.2.2.1 Internal IP Header SA: 10.1.1.100 DA: 10.2.2.2

Internal DA: 10.2.2.2

Figure 4.1 IPSec remote access scenario. The examples presented throughout this book use private IP addresses for all interfaces. Realistically, in the real world, the public IP addresses that are assigned to the workstation, and possibly the public interface of the concentrator, would not be private IP addresses.

In this hypothetical remote access example, Mr. Ed, located at the remote end of the IPSec tunnel, is using a workstation with Internet connectivity to connect to the central location. The workstation’s adapter that connects to

. . . . . . . . . . . . . . . Cisco . . . .VPN . . 3000 . . . Remote . . . . .Access . . . .Preshared . . . . . .Key . .Configuration . . . . . . .

the Internet utilizes PPP for a Layer 2 protocol and learns its public IP address of 172.16.1.2 dynamically from the ISP. To initiate the IPSec tunnel, as well as handle authentication and encryption services, Mr. Ed is required to install the Cisco VPN Unity Client on his workstation. The Unity Client initiates the IPSec tunnel to the VPN Concentrator’s public interface IP address of 192.168.1.101. Assuming a typical configuration, the VPN Concentrator issues an internal IP address of 10.1.1.100 for the IPSec tunnel to the client via a DHCP server, configured pool, or per user assignment. When Mr. Ed needs to send secure data that is destined for a device or station at the main office, the Unity Client encapsulates (using ESP protocol in tunnel mode) the internal IP header and payload. In addition, the client creates a new IP header with the workstation adapter as the source address and the public IP address of the VPN Concentrator as the destination address for routability. When the VPN Concentrator receives the data, it removes the header, authenticates and decrypts the original packet, and delivers the datagram to the internal destination address of the original internal IP header.

Initial Configuration of the VPN 3000 Concentrator The VPN 3000 Concentrator does not ship with a default plug-and-play configuration; thus, some preliminary configuration is in order to initialize the concentrator. The initial configuration is a menu-driven command line interface (CLI) that is accessible via the RS-232 cable and 9-pin console port on the concentrator. The terminal settings should be set at 9600 baud, eight data bits, no parity, and one stop bit. It is highly recommended that you become familiar with the options presented in the Quick Configuration screens. If possible, practice on an actual VPN 3000 Concentrator to get accustomed to the screens. If you do not have access to such equipment, pay special attention to this section’s screenshots and contents.

After you are connected, the concentrator prompts you for a login and password. The default administrator login and password for the VPN 3000 Concentrator is admin. The password is displayed as asterisk characters when you type in the field. Upon a successful login, the concentrator initiates its Quick Configuration setup dialog. The Quick Configuration is a utility that enables you to configure the minimal parameters necessary to initialize the VPN 3000 Concentrator.

49

50

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The preliminary configuration in this process is to input the time, date, and time zone settings for the VPN Concentrator. This may seem trivial, but it is an important step for accurate logging, as well as digital certificate validation (discussed in the next chapter). Figure 4.2 displays the opening dialog for the concentrator initialization and Quick Configuration.

---

: :

Set the time on your device. The correct time is very important. So that logging and accounting entries are accurate.

--

:

Enter the system time in the following format: HH:MM:SS. Example 21: 30:00 for 9:30 pm

__ __ >

: :

[ 17:30:50 ]

Enter the date in the following format. MM/DD/YYYY Example 06/12/1999 for

June 12th 1999.

Date

Quick ->

[ 04/27/2003 ]

Figure 4.2 VPN 3000 CLI Quick Configuration screen.

The next integral step in the setup dialog is the configuration of the private Ethernet interface. At this point, the setup utility requests the parameters for the IP address and subnet mask, as well as the speed and duplexing settings of the private interface. When you add a static IP address and subnet mask to the private interface, the remainder of the configuration can be managed by the GUI-based VPN 3000 Concentrator Manager. It is also possible to continue the Quick Configuration (as well as other configuration parameters) in the CLI by selecting Continue in the menu options. For time’s sake, this example chooses to save the active configuration to file in the CLI and continue the Quick Configuration via the HTML-based Concentrator Manager. To access the Web interface to configure the VPN 3000 Concentrator, you must have at least Internet Explorer 4.0 or Netscape Navigator 4.5 browsers with cookies and Java scripts enabled. Once you open the Web browser, type the private interface address in the URL. For example, if the private interface’s IP address is 192.168.1.1, then the URL in the browser should display http://192.168.1.1. When the Web page is loaded, the login display resembles Figure 4.3. It is possible to secure the communications to the concentrator by installing a self-signed SSL certificate for your browser. By clicking on the hyperlink and installing the certificate, you can now establish a secure encrypted SSL session to the browser simply by adding https:// to the beginning of the address.


Figure 4.3 3000 Concentrator Manager login screen. Please note that for security purposes, you can use only the private interface’s IP address for HTML-based configuration by default. Also, be sure that your management workstation is on the same subnet as the private interface. To test IP connectivity, try to ping the private interface from your workstation.

Following another login, you can resume Quick Configuration by setting static or DHCP-assigned IP addressing, speed, and duplex parameters for the public and outside (if applicable) Ethernet interface(s). After all interfaces are configured, click on the Continue button to display the next screen, which entails configuration options for the VPN 3000 Concentrator’s system information. Namely, it enables you to assign a hostname, DNS server IP address, domain name for the concentrator, and a default gateway address to route traffic destined for other networks not defined in the concentrator’s routing table. You can define the tunneling protocols that the concentrator is to utilize in the subsequent screen. By default, all tunneling protocols (PPTP, L2TP, and IPSec) are enabled. PPTP and L2TP do not require encryption by default and should be enabled for Microsoft Windows-based clients. IPSec must be enabled to support remote access sessions from the Cisco Unity client and other IPSec clients. In the next screen of the Quick Configuration, the Concentrator Manager enables you to decide which method(s) you want for IP assignment of

51

52

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

remote clients. This IP address is assigned to the virtual interface of the IPSec tunnel, in contrast to the ISP IP address that is bound to the physical adapter (refer back to Figure 4.1). The options are as follows: ➤ Client-specified—This option enables the end-user to specify an IP

address. This is rarely utilized because it diminishes the centralized control and security of IP addressing. ➤ Per user—Check this box if you want an external or the concentrator’s

internal authentication server to assign an IP address based upon the user credentials. ➤ DHCP—When a DHCP server is present, you can select this box to

have the DHCP server administer the IP addresses. The DHCP server must be identified by either the IP address or a hostname (requires DNS to be properly configured in the concentrator). ➤ Configured IP pool—This option enables you to specify a range of IP

addresses that the concentrator can distribute to incoming sessions. None of the options are enabled by default and at least one must be selected. During the initial stages of IKE negotiations, both IPSec devices must authenticate themselves to each other before establishing a tunnel. However, this is a device-level authentication and does not incorporate the individual user’s credentials. The Cisco VPN 3000 Concentrator supports an extension to IKE, known as Extended Authentication (XAUTH), which prompts the client for a username and password during IKE negotiations. This user authentication typically occurs following device-level authentication of IKE phase 1. If the user’s login and password are not authentic, the tunnel negotiations do not continue and unauthorized access to the private network is averted. The Quick Configuration addresses this feature by enabling you to choose a RADIUS server, NT domain controller, SDI (SecureID) server, and the concentrator’s internal user database as means of authenticating users to the private network. In software release 4.0, the VPN 3000 Concentrator also supports authentication to an external Microsoft 2000 Active Directory server or a Unix/Linux Kerberos server. If you select an external server, the Manager displays the corresponding screen to input specific parameters for that server, such as IP address and port number. It is important to memorize the five different authentication servers that the VPN 3000 Concentrator supports.


In instances where you decide to employ the concentrator’s internal user database server, you must define at least one user and a group to which that user belongs to complete Quick Configuration. The concentrator can support a limited number of internal users and groups, depending on the model selected. The 3005 and 3015 can support 100 combined users and groups, the 3030 can support 500 combined users and groups, and the 3060 and 3080 can manage 1,000 combined users and groups. The Quick Configuration User Database screen, represented in Figure 4.4, is brought up so you can input users into the internal server database. If the concentrator is set up to use per-user IP address assignment (see previous IP Assignment bullet points), an additional box is presented for the IP address and subnet mask for that specific user. In addition, Cisco enforces a default strong password policy in which the password must be at least eight characters long.

Figure 4.4 Quick Configuration internal user database.

After all remote access users have been added to the concentrator’s internal server, the Quick Configuration setup directs you to the next screen that entails adding an IPSec tunnel group. This screen is displayed as long as IPSec was chosen as one of the tunneling protocols. This screen displays three important fields that you must configure. Those fields are as follows: ➤ Group Name—This field identifies the name of an IPSec group whose

attributes will apply to users contained within it. ➤ Password—This password serves as the IKE preshared key for remote

access IPSec connections. It is case sensitive and must be at least four characters; however, it is recommended that the password be at least eight alphanumeric characters for security purposes.

53

54

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ Verify—The concentrator ensures that you have correctly entered the

password by verifying that this value matches the password field. The last screen of Quick Configuration entails the Admin Password configuration. Cisco recommends you change this password immediately to reduce unsolicited access to the concentrator. After you click the Continue button on this screen, the Quick Configuration is completed and will not be seen again unless you default the concentrator configuration. Table 4.1 summarizes the screens and parameters that are set during the Quick Configuration dialog. Table 4.1 Cisco Quick Configuration Dialog Summary Screen Name

Parameters

System Time

System time, date, and time zone*

Configuration | Quick | IP Interfaces

IP address, subnet mask, speed, and duplex of Ethernet Interface 1 (Private)*, Ethernet Interface 2 (Public), and Ethernet Interface 3 (External for models 3015 and up)

Configuration | Quick | System Info

System name, time, date, and time zone, DNS server address, DNS domain name, default gateway

Configuration | Quick | Protocols

PPTP, L2TP, and IPSec assignment

Configuration | Quick | Address Assignment

Client specified, per user, DHCP, or configured pool IP assignments and parameters

Configuration | Quick | Authentication

Internal, RADIUS, NT Domain, SDI, and Kerberos/Active Directory server assignment and parameters

Configuration | Quick | User Database**

User name, password, IP address, and subnet mask for individual users

Configuration | Quick | IPSec Group

Group name, password

Configuration | Quick | Admin Password

Concentrator admin password change

* Must be initially configured via the console port of the VPN Concentrator. ** Screen is displayed only if internal server is selected as an authentication server.

VPN 3000 Concentrator Series Manager Navigation By now you are certainly dying to immerse yourself in the fine interworkings of the configuration. But before you dive headlong into additional configuration


parameters, it is important to understand the method in which you maneuver through the HTML-based configuration screens. Figure 4.5 displays the Main menu of the Manager.

Figure 4.5 Concentrator Manager main menu.

The Manager Toolbar in the top right corner contains shortcuts of common options for help and support documentation, as well as for instantly returning to the main menu (Figure 4.5) or the login screen (Figure 4.3) by logging out of the concentrator. Directly below the Manger Toolbar is the Navigation Bar, which displays shortcuts for the three root divisions of the VPN 3000 Concentrator. These three major sections are Configuration, Administration, and Monitoring. ➤ The Configuration section is for setting parameters that pertain to the

VPN functionality of the Concentrator. ➤ Administration is utilized for high-level options that pertain to the con-

centrator’s global parameters, such as access security, as well as software and configuration management. ➤ The Monitoring portion of the concentrator enables you to view logs

and statistics for verifying functionality or troubleshooting. These three root divisions, as well as all their subfunctions, can also be found on the left frame of the Manager window in an expandable table of contents hierarchical tree.

55

56

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The 642-511 exam expects you to know the three divisions of the VPN 3000 Concentrator Manager. In addition, the exam is likely to ask you about specific screens contained within each of these divisions. Try to mentally map where each of these screens reside and what general information can be configured while you are reading through the next four chapters. Also, refer to Appendix A throughout your reading to see the organizational layout of the Concentrator Manager.

Directly below the Navigation Bar, icons may appear at certain screens or when you have made changes to the active configuration. These icons are means to refresh or reset statistics on the screens, as well as to provide a reminder (notice the Save Needed icon in Figure 4.5) to save your active configuration so it will be loaded if the concentrator loses power or is rebooted. Any changes performed during the actual configuration are immediately implemented.

Defining User and Group Parameters for Preshared Keys The Quick Configuration enables you to configure minimal aspects for remote access connectivity; however, many VPN connections require additional parameters to be defined to function correctly or optimally. Most of these properties can be set by defining users and groups within the Configuration | User Management screens. Before delving into the configuration parameters, though, it is important to understand the characteristics of users and groups. The VPN 3000 Concentrator simplifies configurations by defining a base group, individual groups, and users. These three entities support a trickledown approach for defining attributes to remote access connections. Users that are created are associated with either a particular group or the default base group. A user can belong to only one group and can inherit configuration parameters from the group in which it resides. Any user not explicitly assigned to a particular group is a member of the base group. Interestingly enough, created individual groups can also inherit attributes from the base group. It is recommended that you first define mutual parameters in the base group, which can trickle down to all individual groups and users. You should then create the individual groups and decide whether they should inherit those attributes of the base group or define unique parameters that apply to that group. Likewise is the case for users who are added to the individual groups or the base group. They, too, can define their own parameters or inherit them from the group in which they reside. Figure 4.6 illustrates this concept


by portraying the base group and the individual groups as funnels. Parameters from the base group can trickle down to either individual groups or users that are assigned to the base group. Additionally, users can also inherit configuration attributes from individual groups to which they are assigned.

Base Group

Inherit?

Individual Groups Inherit? Inherit?

Figure 4.6 Group and user configuration concept.

The following sections examine the configuration options for the base group because the parameters are practically identical to the individually created groups. Of course, this should be the first group you define because groups and users can inherit its attributes. To begin the base group configuration, click on the hyperlink for the Configuration | User Management | Base Group screen. At this point, you are presented with six tab divisions for base group configurations: General, IPSec, Mode/Client Config, Client Firewall, Hardware Client, and PPTP/L2TP. After you have completed the configurations for all tabs, click the Apply button to return to the Configuration | User Management Screen. Table 4.2 introduces the tabs and several of the parameters that you might encounter on each of them.

57

58

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Table 4.2 Cisco Group Configuration Tabs Tab

Parameters

Identity

Group name, password, username, IP address

General

Access hours, login and password restrictions, filters, DNS, WINS, tunneling protocols

IPSec

IPSec SA, IKE validation and keepalives (DPD), tunnel type, authentication and authorization, IP compression, default preshared key*

Client Config

Banner, client storage password, IPSec over UDP, IPSec backup servers, split tunneling policy, default domain name, split DNS

Client FW

Firewall setting, firewall type, custom firewall, firewall policy

HW Client

Interactive and individual user authentication, IP phone and LEAP bypass, Network Extension mode

PPTP/L2TP

PPTP authentication protocols, PPTP encryption, PPTP compression, L2TP authentication protocols, L2TP encryption, L2TP compression

*

Default preshared key option presented only in Base group IPSec tab.

Base Group General Tab Parameters The General tab is the initial tab displayed when you are modifying the base group attributes. Figure 4.7 exhibits the General tab for the base group configuration. The top portion of the screen is geared toward the group’s access rights and privileges that should be in accordance to your company’s security policy. Here you can define time restrictions and idle/connection timers that users in this group are allotted for remote access. Continuing the remote access example from the beginning of this chapter in conjunction with Figure 4.7, the administrator of the concentrator configures all users and individual groups that inherit the base group attributes to adhere to standard business hours for a login restrictions. Thus, Mr. Ed and any other user assigned to this group is required to initiate the VPN tunnel between the concentrator’s hours of 9:00 a.m. and 5:00 p.m., in whichever time zone the concentrator resides. In the General tab, you also enforce login restrictions, such as password character lengths, for the VPN 3000 Concentrator’s internal server. Additionally, a peculiar default concentrator option in regard to passwords is to enforce the passwords to be alphabetic. In practice, this should be unchecked to enforce strong passwords with alphanumeric characters. In the remote access example in Figure 4.7, this option has been unchecked to enforce stronger authentication. You may also apply an address or protocol filter for this group, which can be defined (along with other custom policies such as access hours) in the


Configuration | Policy Management section of the concentrator (discussed in Chapter 6, “Software Client Firewall Features”).

Figure 4.7 Base group General tab.

The middle portion of the General tab entails parameters for applicable primary and secondary DNS and WINS servers. These parameters are sent to the clients during IKE SA establishment and overwrite current values on the client’s PC. Figure 4.7’s example uses the same server of IP address 10.2.2.2 for both DNS and WINS for remote access users in this group. In addition, the General tab enables you to define SEP card assignments (not shown in Figure 4.7) if the concentrator has multiple SEP or SEP-E cards. It is recommended that you leave all SEPs assigned for redundancy purposes. The bottom of the page enables you to define the supported tunneling protocols for the base group. If users are going to use only a particular tunneling protocol, you can deselect the other tunneling protocols that will not be used. The General tab also allows the VPN Concentrator to forward only usernames rather than a username and a realm for services to an external AAA server, as well as to the concentrator’s internal database. For instance, if user Mr Ed was part of the group, Not-So-Human Resources, he may authenticate as Mr Ed@Not-So-Human Resources. With this “Strip Realm” feature, the

59

60

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

realm (Not-So-Human Resources) is stripped after the delimiter (@). Thus, only the username, Mr Ed, is passed to the authenticating servers. The final aspect of this configuration tab is to configure the DHCP Network scope that allows you to define the networks that will be leased via a DHCP server to remote access users in the group (if that functionality is provided).

Base Group IPSec Tab Parameters If you are using IPSec for a tunneling protocol, you must define the settings in this tab, which are displayed in Figure 4.8. This tab is divided into two sections: IPSec Parameters and Remote Access Parameters.

Figure 4.8 Base group IPSec tab.

The IPSec Parameters section of the IPSec tab determines the factors that are negotiated during the tunnel establishment. Particularly, the IPSec SA field enables you to choose the Security Associations that will be proposed during IKE negotiations for remote access users (site-to-site tunnels ignore this field). You can select from the predefined SAs that entail different types of encryption and authentication combinations, or you can apply your own Security Association created from the Configuration | Policy Management | Traffic Management | Security Associations screen (discussed later in the “IPSec Security Association Activation” section). The values defined in this SA have to match the remote access client’s SA to form a VPN tunnel. In the example, the concentrator’s administrator is enforcing a predefined SA that is using 128-bit AES for an encryption algorithm with SHA-1 as the data authentication algorithm. The next IPSec parameter defines whether IKE enforces identity validation in certificates. In other words, when remote access clients are utilizing digital


certificates for authentication, certain fields in the certificate are used to identify the device, such as IP addresses, distinguished names (DN), or fully qualified domain names (FQDN). This feature can obligate the concentrator to compare the identity data it receives during IKE Phase 1 with the certificate’s identity fields. If they do not match, the tunnel is not established. You can require this validation, turn off this feature altogether, or use the default, which allows the tunnel to be established regardless. In instances where the concentrator has an established tunnel with another Cisco device, it can make use of IKE keepalives to ensure the remote peer is still present. A variant of this keepalive feature is known as Dead Peer Detection, or DPD. With DPD, the Cisco devices maintain an idle timer. When there is no data being sent and the timer expires, the tunnel can be torn down to save resources. Cisco enables you to set this idle timer in the Confidence Interval for Easy VPN Clients field, which is defaulted to 5 minutes for remote access and 10 seconds for LAN-to-LAN tunnels. The last field in this section of the IPSec tab is where you define what type of tunnel this group is to use. Here you select whether this group uses a LAN-to-LAN tunnel to another IPSec gateway device, or remote access tunnels to hardware or software clients. Thus, if this group is being utilized for a site-to-site Intranet or business-to-business extranet, this selection should be set to LAN-to-LAN. If users in this group are remote access clients, then choose Remote Access in this field. Because these parameters are defined for our remote access user, Mr. Ed, the default value of remote access is sufficient. If you set this attribute to LAN-to-LAN, you can ignore the rest of the IPSec tab. The second portion of the IPSec tab is where you select specific remote access settings and is only necessary when IPSec is used for remote access. For instance, Group Lock enforces the client’s group names to coincide with the concentrator’s configuration. If they do not match, the concentrator can refuse the session. By default, this option is disabled. It is also possible to lock users into a group by using the Organization Unit (OU) attributes in digital certificates and RADIUS messages.

VPN Internal Server Group Authentication When a client is establishing a connection to the VPN concentrator, the Cisco VPN client defines a Group parameter to use during client authentication. This group is called a tunnel group and the password configured on the client acts as the preshared key, which must coincide with the group and password on the concentrator. If this tunnel group authentication is

61

62

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . successful, the user is the next to be authenticated to the internal database server of the concentrator by using Extended Authentication (XAUTH). Notably, it is possible for the user to belong to a different group other than the tunnel group. However, if the Group Lock parameter is enabled, the user must reside in the tunnel group. When the user and the groups are authenticated, the VPN concentrator processes attributes from the user and groups in the following order: user attributes, Individual Group attributes, tunnel group attributes, and finally Base Group attributes. For example, Mr. Ed belongs to the Not-So-Human Resources group. However, in his VPN client, he uses the Pigsty group name for the tunnel group and that group’s associated password for a preshared key. When Mr. Ed connects, the concentrator authenticates the Pigsty group and the preshared key. After the tunnel group is authenticated, the username and password are verified. After this step, the concentrator realizes that Mr. Ed belongs to the Not-SoHuman Resources group and authenticates that group as well. When all groups are authenticated, the concentrator looks at the user configuration for specific parameters. If any parameters are missing, the concentrator processes parameters from the Not-So-Human Resources group, followed by the Pigsty group, and finally the Base Group.

The VPN 3000 Concentrator is capable of offering all three AAA services. Those services are Authentication, Authorization, and Accounting. In the next few options of the IPSec tab, two of those functions can be applied to users contained in the base group. Authentication of users, as discussed before, can be handled by the internal server of the concentrator or delegated to external RADIUS, SDI, NT, and Active Directory/Kerberos servers. Authorization of resources, on the other hand, can only be off-loaded to RADIUS and LDAP servers. In cases where authorization is being implemented with digital certificates, the Distinguished Name field should reflect the attribute within a digital certificate that will act as the username for the LDAP and RADIUS servers. In this Remote Access section of the IPSec tab, you are given the option to enable compression of IP traffic for the group. The compression algorithm that is used by the concentrator is Lempel-Ziv. Compression should be utilized on groups that might connect at low speeds, such as modem users. When compression is used on higher-speed links, the processing impact on the concentrator is significant and can affect performance. The Default Preshared Key option is actually unique to base groups only. This field enables you to define a preshared key for clients that do not use or understand the concept of groups. The chosen default preshared key for the remote access example is ahorseisahorse. During an IPSec remote access session, the IKE SA might expire and a rekey will need to take place. The “Reauthentication on Rekey option” forces the concentrator to redo the IKE XAUTH function and prompt the client for a


username and password again. If the SA lifetime is brief, this may be an inconvenience to the end-user. Depending on the version of software you are running, the Reauthentication on Rekey field might be placed in the IPSec section of this tab.

The last parameter on the IPSec tab is enabled by default. Mode Configuration is an extremely useful option in which the concentrator can push several policies and configurations down to the connecting clients during SA establishment. Some examples of those particular pieces of information are IP addresses, DNS server addresses, WINS server addresses, split tunneling policies, and so on. The Client Config/Mode Config tab (discussed in the following section) further defines those parameters and can be bypassed if you de-select this option. It is important to know what pieces of information can be sent to the clients by utilizing IKE Mode Configuration.

Base Group Client Config or Mode Config Tab The next base group tab name reflects either Mode Config in older software versions or Client Config (Figure 4.9) in newer releases. For simplicity, it is addressed as the Client Config tab for the remainder of this book. This portion of the base group configuration enables you to define configuration and policies that can be pushed down to the clients during tunnel establishment, thus eliminating a great deal of configuration for the remote clients. This tab is also broken down in accordance to the type of clients supported in the group. The top of the Client Config tab pertains to Cisco client’s configurations, beginning with a login banner option to display a message up to 510 characters. Be sure to avoid any legal liabilities by abstaining from words such as “welcome,” which might inadvertently allow hackers to avoid legal prosecution if apprehended. The banner is followed by a check box in which the concentrator enables remote clients to store their usernames and passwords locally. This poses an obvious security hazard and typically should not be enabled. The example in Figure 4.9 illustrates a stern warning that will be displayed when Mr. Ed connects uses the Cisco Unity software client to connect to the concentrator. In addition, to keep Mr. Ed’s password from being compromised, the local client password storage is disabled.

63

64

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 4.9 Base group Client Config tab.

When clients are connecting to the concentrator through a router or firewall that is already performing NAT, connections are doomed to fail because NAT changes the source address of the IP header. Because significant bits are changed in the IP header, this violates any data integrity authentication, which results in the remote peer dropping the packets. Similarly, when the original IP header is encrypted via the ESP protocol, the NAT device cannot access those IP addresses in the original IP header, which disables any address translation functionality. Cisco has chosen several workarounds for this problem, one of which is to encapsulate IPSec and IKE traffic in UDP to a specific port number (default is 10,000). This process of encapsulating IPSec and IKE into another header is known as NAT transparency. It is possible to define a port number for each group to avoid conflicts, but IPSec over UDP has a possible limitation in which only one client may be able to initiate a tunnel behind the same firewall. In the example, Mr. Ed is not passing through an intermediary device performing NAT, so this function does not need to be enabled. One versatile function for Cisco hardware or software clients is to utilize backup servers, in which the clients can connect to up to ten backup concentrators if the primary becomes unavailable. This relatively new feature for the concentrator, if utilized, enables you to define those backup concentrators centrally and push them out to the clients. If the clients have hard-coded their own backup servers, the concentrator overrides the client’s list. For instance, the example in Figure 4.9 demonstrates that three backup concentrators have been defined for users in the group. If Mr. Ed contained any


configured backup servers on his software client, they would be overwritten by these pushed parameters defined on the central concentrator. Notably, the backup functionality can be disabled altogether from the concentrator, which forces the clients to clear any locally configured server lists and disallows them to input any entries in the software. Remember that existing backup concentrators configured on the hardware or software clients are overwritten when this parameter is pushed from the central concentrator.

The next section of the Client Config tab is especially reserved for Microsoft clients that belong to this group. These fields, which appear in more recent software versions, enable the concentrator to intercept DHCP messages and provide the clients with a subnet mask, domain name, and—unique to Windows XP—provide classless static routes for the tunnel IP address. This is useful in environments where you want to enable split tunneling for Windows XP clients and a DHCP server is not being used. The remaining section of the Client Config tab entails features that are common among all clients and may apply to members of this group. One prominent feature on the Client Config tab is the capability to perform traffic management via a split tunneling policy. Configured on the central concentrator, a split tunneling policy is pushed to clients to define specifically what traffic is to be sent over the encrypted tunnel, and which traffic is allowed to traverse out to the public Internet as clear text. This does expose a security threat because the client can be compromised while having a direct tunnel to the corporate network. For this very reason, the default parameter for split tunneling is to disable it (Tunneling Everything) so that all traffic (including traffic for the client’s local network and the Internet) will be sent over the encrypted tunnel. After the traffic traverses the tunnel, routing decisions at the central site can direct the traffic to the private network or out the main office’s Internet access. There are two different ways to configure these split tunneling policies if the company’s network security policy permits it. You can select pre-configured network lists (discussed later in the “Network Lists” section) consisting of networks that are excluded from the client’s encryption and, thus, receive data in clear text. If the traffic destination is not in the list, it is encrypted and sent over the tunnel. When this option (Allow the Networks in List to Bypass the Tunnel) is selected, you can choose a configured network list or a default network list named VPN Client Local LAN. This local LAN option enables the concentrator to push an access control list to the VPN

65

66

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

client, which specifies the local resources on the client’s LAN that will receive clear text data. Any traffic that is not destined for the local LAN is sent over the secure tunnel. The local LAN feature can be turned off on the Cisco VPN Unity client if the client is connected to an insecure network, such as a wireless or a hotel network. The Only Tunnel Networks in List option is similar to the first option; however, you explicitly define the network destinations that are to receive encrypted traffic through the tunnel. If traffic is destined for the networks in the list, it is encrypted. Traffic destined for any other network is sent in clear text to the client’s LAN. The CSVPN exam expects you to be able to navigate the configuration parameters involved in configuring a split tunnel policy, given a customer’s requirements.

Figure 4.10 depicts a common scenario in which Mr. Ed’s connecting client receives a split tunneling policy from the head-end concentrator. This example coincides with the configuration displayed back in Figure 4.9. This split tunneling policy mandates that all traffic destined for the concentrator’s network of 10.2.2.0 be encrypted and sent over the tunnel. The 10.2.2.0 network is actually specified in a network list called The Farm and is selected as the only network to which the client sends encrypted traffic. Traffic destined for the client’s local LAN, as well as the Internet (such as the www.examcram.com Web server), is sent in unencrypted clear text. www.examcram.com

y sk e e Th blu is

Internet

PPP ISP IP: 172.16.1.2

Public IP: 192.168.1.101

IPSec Internal SA: 10.1.1.100

Split Tunneling Policy: Network 10.2.2.0 - Tunnel Local LAN - Clear Text Internet - Clear Text

Figure 4.10 Split tunneling scenario.

Internal DA: 10.2.2.2

#W% R&K$ D@W

Private IP: 10.2.2.1


The final options on the Client Config tab entail DNS properties for members of this group. Specifically, you can define the default domain name that is applied to the virtual adapter in clients for packets that are sent over the tunnel. In addition, later releases support split DNS in which DNS resolution for the specified domains is sent over the tunnel and to the corporate DNS server. Remaining DNS queries are sent to your provider’s public DNS servers.

Base Group Client FW and HW Client Tabs In these two tabs, you can define parameters that apply to the enhanced firewall features and the configuration attributes for the Cisco 3002 Hardware Clients. These two tabs are discussed in later chapters in their respective context.

Base Group PPTP/L2TP Tab Figure 4.11 depicts the final tab of the base group in which you can configure PPTP/L2TP properties for users contained in this group. This configuration is necessary only if these tunneling protocols were checked in the General Tab.

Figure 4.11 Base group PPTP/L2TP tab.

The first option in this tab is to permit clients to assign their own IP addresses. Again, this diminishes the centralized control of IP addressing and security and should be used sparingly. If selected, the “Use Client Address IP” assignment method should also be enabled from the Quick Configuration or the Configuration | System | Address Management | Assignment screen.

67

68

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

In the options that follow, the PPTP tunneling protocol parameters are tuned in accordance to the company’s security policy. Namely, a number of different authentication protocols, such as PAP, CHAP, MSCHAP, and EAP, can be employed to authenticate peers during tunnel establishment. You can also set requirements for PPTP encryption and Microsoft’s MPPC compression. The last fields enable you to define similar services for L2TP tunneling protocol. Specifically, you can define the same peer authentication, encryption, and compression parameters that are available for PPTP.

Individual Group Configuration Parameters Recall that the second step after defining the base group’s parameters is to create individual groups whose attributes vary from the base group. The majority of the options are identical to the base group, so for time’s sake, this section demonstrates the specific differences between the two. The first noticeable difference between both groups is the fact that you have to create the individual groups into the internal server, whereas the base group is established by default. In addition, the creation of these groups enables you to customize different properties, such as authentication and authorization methods, IP addressing, and bandwidth allotment per each group. The configuration of the individual groups, as well as their distinct attributes, begins at the Configuration | User Management | Groups screen (Figure 4.12).

Figure 4.12 Group Definition screen.

At the Groups screen, you are given the options to add a new group or modify or delete an existing group. In addition, the Cisco VPN 3000


Concentrator enables you to define external AAA servers, assignable IP address pools, client update notifications, and bandwidth policies on a groupby-group basis. This gives you more freedom to define group-specific parameters, as opposed to defining them on a system-wide basis in the Configuration | System sub-menus.

AAA Server Definition and Prioritization When you define Authentication, Authorization, and Accounting servers for individual groups, the order in which you create the servers is important. The concentrator attempts the first server in the list. If it cannot be reached, it cycles through the remaining servers. If the backup AAA servers cannot be reached, it does not use the globally configured servers located in the Configuration | System | Servers menus. If you want the group to utilize the globally configured servers, do not add any servers in these screens. To prioritize a server, highlight the specific server by using the Move Up and Move Down buttons. You can also test authentication or authorization server connectivity by using the Test button on their respective screens.

Group Identity Tab As soon as you specify to add or modify a group, the concentrator displays the Identity tab (Figure 4.13). The purpose of this screen is to add or modify the group name, in addition to create a preshared key in the password fields. On the bottom of this tab you select whether this is an internally defined group or a group that will be handled by an external server. If Internal is selected, the Internal server option is automatically added to the global authentication server list, if not already present.

Figure 4.13 Group Identity screen.

In the example, the remote user, Mr. Ed, is going to belong to an individual group called Not-So-Human Resources. On this Identity tab, the group name is defined and the password that serves as the preshared key is configured. This preshared key must be configured on Mr. Ed’s client if he is to connect to the VPN 3000 Concentrator. When Mr. Ed attempts to connect

69

70

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

to the headquarters, the concentrator and the client authenticate each other during IKE negotiations by using the preshared keys. If they match, then both sides continue tunnel negotiations.

Inherit Column The remainder of the tabs are practically identical to the base groups. One key difference is the additional column of check boxes on every field. The Inherit check boxes are enabled by default, which specify whether you want to obtain the parameters for that specific field from the base group. If you want to change certain parameters (which is the point of the individual groups in the first place), be sure to uncheck the box because the Inherit check box overrides any values input into the fields.

User Account Creation and Modification Now that groups have been created and fine-tuned, you can create the individual users if you are utilizing the concentrator’s internal authentication server. Recall that users can belong to only one group and if they are not explicitly specified as belonging to an individual group, they are associated with the base group.

User Identity Tab Similar to the actions in the individual group screen, you can also add, modify, or delete individual users. After you choose to add or modify a user, the Identity tab is displayed. The example displayed in Figure 4.14 created the user Mr Ed and assigned a password to the user, which serves as the individual authentication. After the IPSec group has been authenticated, the individual is prompted for this username and password. The Group field enables you to select which group to associate with the user. The default is the base group; however, in this example, the Mr. Ed user was assigned to the Not-SoHuman Resources group. The bottom two fields are optional and are required only if you are using per-user assignment of IP addresses. Because the example uses per-user IP assignment, the VPN administrator decided to allocate the IP address of 10.1.1.100 for Mr. Ed. This internal IP is assigned to Mr. Ed’s client after his username is authenticated to the concentrator’s internal database.



The remaining tabs also contain the Inherit check boxes in which you can deselect and override some attributes of the group or base group, such as tunneling protocols, IPSec SAs, and PPTP/L2TP parameters.

In-depth Configuration Information Throughout the configuration of groups and users, selections were made from pre-defined lists contained in fields and drop-down boxes. Several of those lists can be modified or defined in the concentrator menus. The following sections look into how those particular list options are created or modified. In practice, it is most appropriate to configure these options before the actual configuration of users and groups.

IPSec Security Association Activation In the user and group configurations, you could define the type of IPSec and IKE security associations for remote access clients. The Cisco VPN 3000 Concentrator series has several common security associations active in the drop-down menu of the IPSec Parameters tab. If the attaching clients require different security associations, additional associations must be created. In some instances, it might also be necessary to define or activate IKE proposals to be assigned to these security associations. To avoid putting the cart before the horse, first consider an example in which the IKE proposal needs to be defined, followed by another in which that IKE proposal is applied to a security association.

71

72

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 4.15 depicts the IKE Proposal screen located at the Configuration | System | Tunneling Protocols | IPSec | IKE Proposals menu of the Concentrator Manager. Here you can either modify, create, or delete an IKE proposal. In addition, you can also prioritize the IKE proposals that are checked during IKE Phase 1 by moving a selected proposal up or down.


If you decide to modify or add an IKE proposal, a subsequent screen is displayed in which you have to define the following IKE parameters: ➤ Proposal Name—Identify the proposal with a unique name that will be

populated in the list. ➤ Authentication Mode—Here you can determine whether the IKE phase 1

authentication is to utilize preshared keys or RSA/DSA digital certificates. You can also choose a variant of these options that requires Extended Authentication (XAUTH) for user-based authentication. ➤ Authentication Algorithm—You can determine whether this proposal uti-

lizes MD5 or SHA-1 for a packet authentication algorithm. ➤ Encryption Algorithm—To secure the tunnel for subsequent IKE commu-

nications, you must select either DES, 3DES, or AES for an encryption algorithm. ➤ Diffie-Hellman Group—After an encryption algorithm is chosen, a

respective Diffe-Hellman group is automatically chosen. To change the


value, select from Diffe-Hellman groups 1, 2, 5, and 7, depending on your security requirements. ➤ Lifetime Measurement—The lifetime of this IKE SA is defined here by

data bits, seconds, or both. ➤ Data Lifetime—The amount of data in kilobytes until a new SA key

needs to be renegotiated. ➤ Time Lifetime—The amount of time in seconds until a new SA key needs

to be renegotiated. After the IKE proposal has been created and activated, the next step is to add it to a security association. At the Configuration | Policy Management | Traffic Management | Security Associations screen, you can add, modify, and delete security associations. Figure 4.16 displays the Add/Modify screen that enables you to define the parameters for an SA.


The security association process begins similarly to the IKE proposal in which a name has to be defined for the SA. The “Inheritance” attribute enables you to utilize a single tunnel with multiple hosts, versus multiple tunnels for each pair of addresses for this particular SA. Following these general parameters, the Security Association Add/Modify page lets you define the IPSec SA elements in phase 2 of IKE negotiation. Here you can determine the type of packet authentication and encryption strength, as well as whether ESP is going to operate in tunnel mode or

73

74

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

transparent mode. You can also enable something called Perfect Forward Secrecy (PFS), which disables an attacker’s ability to discover a new or prior session key if he happens to learn of a session key. This property, which is established during quick mode in IKE phase 2, entails both peers recalculating another Diffie-Hellman secret key in case the IKE phase 1 DH key was compromised. The Diffie-Hellman key exchange can be utilized with varying encryption strengths for the IKE phase 2 session key regeneration. The default is to have this disabled, which entails using a session key based upon the phase 1 keys. Also comparable to the IKE activation, you can also define the lifetime of the IPSec SA in seconds, kilobytes, or both. The bottom of the Security Association page is designated for IKE phase 1 parameters. The first field is used to specify the remote gateway address for LAN-to-LAN connections. If this SA is primarily used for remote access, then this field can be ignored. In the Negotiation field you can determine whether this security association uses Main Mode or Aggressive Mode for IKE Phase 1 establishment. Here you can also define the method in which peer authentication is managed. The default is to use preshared keys as opposed to digital certificates. In instances where digital certificates is the chosen attribute, you can further define whether the concentrator sends additional certificates to validate your identity certificate (discussed in the next chapter). The final parameter to define the security association is to select the IKE proposal that was created and activated in the previous steps.

Network Lists Recall that in the Client Config tab you can specify networks in which you either allow or disallow split tunneling. This section illustrates how to define those network lists. After you navigate to the Configuration | Policy Management | Traffic Management | Network Lists page, you are given the standard options of creating, modifying, or deleting the network list. After clicking on the Add button, you are presented with a screen that is depicted in Figure 4.17. Here you can define a name for the list (The Farm), followed by the actual definition of the networks. In the field provided for the network lists, add the network, followed by the wildcard subnet mask on each line. Recollect that the wildcard mask is the inverse of a subnet mask, in which 0s represent a match and 1s mean to ignore the corresponding bit in the IP address. For our example, to create a list for network 10.2.2.0 255.255.255.0, then the syntax to enter it in the list is 10.2.2.0/0.0.0.255. After this network list is defined, it can be applied in the split tunneling policy to define which network the Cisco Unity Client will encrypt and send over the tunnel.


The VPN Concentrator automates network list configuration by utilizing the “Generate Local List” button. This utility automatically adds the first 200 reachable private interface networks in the routing table to the network list.

Access Hours From the example, in the General tab, recall that Mr. Ed was restricted to remote access connectivity during business hours. These business hours, which are based on Monday–Friday from 9 a.m. to 5 p.m., are pre-configured access hour entries. If you need to create or modify the existing times, the Configuration | Policy Management | Access Hours | Add/Modify page enables you to customize access hours to match your company’s schedule.

Summary A typical IPSec tunnel entails four components: a remote client, VPN Concentrator, PPP or equivalent Layer 2 protocol, and the IPSec protocol. When the client initiates the IPSec connection to the VPN Concentrator, it typically uses a public IP assigned from the ISP and PPP for a Layer 2 WAN protocol. A new ESP header contains the public IP address of the workstation adapter as the source address, and the IP address of the public interface of the concentrator for the destination. When the concentrator receives the IPSec packet, it decrypts the payload and routes the IP packet to the inside destination address of the original IP header. To initialize the VPN 3000 Concentrator, a preliminary CLI configuration is necessary via the 9-pin console port. After you log in to the concentrator with the default login and password of admin, you begin the Quick Configuration sequence, which enables you to configure the minimal parameters necessary to initialize the concentrator. These parameters initially include time and date settings, followed by the configuration of the private Ethernet interface. After this interface has been configured, you can use the HTML-based Concentrator Manager for any further configurations. In the Concentrator Manager, you can configure the remainder of the Quick Configuration components, such as the Ethernet interfaces, system information, tunneling protocols, and client IP assignment. The Quick Configuration also implements user authentication by means of its internal server or by utilizing a RADIUS, SDI, Kerberos, Active Directory, and NT Domain server. The final task in the Quick Configuration setup routine is to change the default password for admin concentrator access.

75

76

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Most remote access configurations lie within the User Management Configuration screens. Here we can define base group attributes in which individually created groups and users can inherit various defined parameters in the configuration tabs. Cisco recommends that the base group be defined first, followed by any individual groups whose configurations differ from the base groups. Users are added to the individual or the base group (if a group is not specified), and they inherit properties from that specific group. The base group General tab is used to define access rights and privileges, including connection times and password restrictions. Furthermore, you can also define IKE and DNS servers, which are assigned during IKE SA establishment. This configuration page also enables you to choose the SEP card assignment and tunneling protocol to implement for users contained in this group. Lastly, the General tab contains options with which you can strip the realm for authenticating users, in addition to a DHCP scope definition parameter that indicates the IP range that will be leased from a DHCP server. In instances where IPSec was chosen as a tunneling protocol, the IPSec tab enables you to define IPSec parameters and remote access parameters. Particularly, you can choose the IPSec security association that will be negotiated during IKE, enforce IKE certificate validation, and enable IKE keepalives (Dead Peer Detection). Notably, this configuration tab is where you can specify whether the IPSec tunnel is a LAN-to-LAN or remote access tunnel. In instances where the group will be utilized for remote access, you can configure additional parameters, such as group lock, AAA services, compression, and re-authentication for IKE phase 1 rekeys. The Client config or Mode Config tab enables you to define the IKE mode configuration extensions for parameters, such as banners, IPSec over NAT via UDP, backup concentrator server lists, and password storage policies for clients. In this configuration tab, you can also allow split tunneling for IP and DNS traffic, in which the concentrator can define network lists that specify what traffic is allowed to be sent in the clear to the Internet and which traffic is to be encrypted and sent over the IPSec tunnel. The PPTP/L2TP tab is useful for altering any encryption and authentication policies for clients that are using PPTP or L2TP for remote access connectivity. After the base group is defined, you can create individual groups and users in which you can select the Inherit check box, which will, in turn, inherit the parent group’s parameters. The individual groups and users that you create have an additional tab that entails parameters for that group or user’s identity. Specifically, the Group Identity tab has a field designated for a password, which serves as the preshared key for connecting clients within that group.


The User Identity tab also has a password field that is utilized for individual user authentication in instances where you are using the internal user server of the concentrator. In certain instances, you may need to create custom parameters that entail more in-depth configuration. Some examples of these configurations are custom IKE proposals and security associations, network lists, and access hour policies.

77

78

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exam Prep Questions Question 1 What are some essential components for a common IPSec tunnel? (Choose three.) ❑ A. PPP ❑ B. IPSec ❑ C. Unity Client ❑ D. NAT

Answers A, B, and C are correct. The four components for a typical IPSec tunnel are the PPP and IPSec protocol, the Cisco Unity Client, and the VPN Concentrator. Answer D is incorrect because NAT is not a component for typical IPSec tunnels.

Question 2 What group configuration tab allows you to define IPSec parameters for IPSec over NAT? ❍ A. IPSec ❍ B. Mode Config/Client Config ❍ C. NAT ❍ D. PPTP/L2TP

Answer B is correct. The Client config or Mode Config tab enables you to define the mode config extensions for parameters such as split tunneling, IPSec over NAT, and backup servers for the clients. Answer A is incorrect because the IPSec tab is used to define parameters such as IPSec SA, IKE validation, tunnel type, authentication and authorization, IP compression, and default preshared keys. Answer C is incorrect because there is no User Management tab called NAT. Answer D is incorrect because the PPTP/L2TP tab contains parameters for setting authentication protocols, encryption, and compression for PPTP and L2TP.


Question 3 Which is the order in which Cisco recommends you define users and groups? ❍ A. Users, Base Group, Individual Groups ❍ B. Users, Individual Groups, Base Group ❍ C. Individual Groups, Base Group, Users ❍ D. Base Group, Individual Groups, Users

Answer D is correct. Cisco recommends you define common parameters in the base group. If you need to configure characteristics that differ from the base group, you can create individual groups to inherit characteristics from the base group. The users are created last and are placed in either the base group (default) or the individual group. Answers A, B, and C are incorrect because they are not identified in the correct order.

Question 4 What servers are available for authenticating users to the concentrator? (Choose four.) ❑ A. Concentrator’s internal server ❑ B. TACACS server ❑ C. RADIUS server ❑ D. SDI server ❑ E. NT Domain Server ❑ F. VTP Server

Answers A, C, D, and E are correct. The VPN concentrator can authenticate users via its internal database server or externally by a RADIUS, SDI, Active Directory/Kerberos, and NT Domain server. Answer B is incorrect because TACACS servers cannot be utilized for user authentication; however, they can be used to authenticate administrators to gain access to the VPN Concentrator. Answer F is incorrect because a VTP server is used in Cisco switches—not Cisco VPN Concentrators.

79

80

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 5 What is the name of the configuration dialog that enables you to define the minimum parameters necessary to initialize the concentrator? ❍ A. Concentrator Manager ❍ B. CLI ❍ C. Quick Configuration ❍ D. Fast Configuration

Answer C is correct. The Quick Configuration dialog is utilized to configure the minimum parameters necessary to initialize the concentrator. Answers B and D are incorrect because they are not names of configuration modes. Answer A is also incorrect because the Concentrator Manger is the HTMLbased configuration platform to configure all settings in the VPN Concentrator. Although Quick Configuration can be configured via the Concentrator Manager, the dialog itself is known as Quick Configuration.

Question 6 At which user management tab can you assign usage hour restrictions to users or groups? ❍ A. General tab ❍ B. Policy tab ❍ C. Identity tab ❍ D. Group tab

Answer A is correct. The General tab enables you to assign access hours in addition to password lengths, DNS and WINS parameters, supported tunneling protocols, SEP card assignment, and realm stripping. Answer C is incorrect because the Identity tab is used to define a username or individual group name, in addition to defining preshared keys and passwords. Answers B and D are incorrect because there are no such tabs.


Question 7 What is the technology called that enables the concentrator to define a list of networks in which the client is instructed to specifically tunnel versus send in clear text? ❍ A. Split Tunneling ❍ B. Extended Authentication (XAUTH) ❍ C. Perfect Forward Secrecy ❍ D. Tunnel Policy Designator

Answer A is correct. Split tunneling defines a centrally pushed policy that specifically indicates the network destinations that will receive clear text or encrypted traffic over the tunnel. Answer B is incorrect because Extended Authentication is an extension to the IKE exchanges in which the authenticating device prompts for user credentials for the private network access after IKE phase 1 device-level authentication. Answer C is incorrect because Perfect Forward Secrecy is an agreed property established during quick mode in IKE phase 2 in which both peers recalculate another DiffieHellman secret key in case the IKE phase 1 DH key was compromised. Answer D is incorrect because there is no such technology as Tunnel Policy Designator.

Question 8 Which is not a major division in the Web-based Concentrator Manager’s Navigation Bar? ❍ A. Configuration ❍ B. Administration ❍ C. Support ❍ D. Monitoring

Answer C is correct. The three major divisions in the Concentrator Manager are Configuration, Administration, and Monitoring. The support shortcut is in the Manager toolbar and is not one of the major divisions.

81

82

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 9 A user in California is complaining that he cannot connect to the VPN 3000 Concentrator located at the main office in New York. All remote access users are assigned login access time restrictions for business hours. It is only 3:00 p.m. in California. What would be the most likely cause of the problem? ❍ A. Incorrect IPSec group name on the VPN client. ❍ B. Incorrect username and password on the client. ❍ C. Wrong encryption algorithm selected for the VPN client. ❍ D. Access time restrictions are based upon the concentrator’s system time.

Answer D is correct. Because the concentrator is in a different time zone, the local time of the concentrator would be 7:00 p.m., which is not between the hours of 9:00 a.m., and 5:00 p.m. Answers A, B, and C could all be valid, but given the circumstances presented in the question, D is the most viable answer.

Question 10 You have just applied a backup server list on the VPN 3000 Concentrator. Which of the following are true? (Choose two.) ❑ A. If the client has an existing list, the list from the concentrator overwrites the client’s list. ❑ B. This feature is utilized to supply backup RADIUS servers in case the primary AAA server is not functioning. ❑ C. This list is to provide clients alternate concentrators to connect to if the primary is down. ❑ D. If a client has an existing list, he is merged with the concentrator list and is given priority.

Answers A and C are correct. A backup server list is to provide connecting clients with IP addresses of concentrators in case the primary concentrator is not functioning. Answer B is incorrect because the backup server list is for concentrators, not RADIUS servers. Answer D is incorrect because the pushed values to the client override the client’s existing list.


Question 11 A user informs you that her PC and her preshared key have been compromised. Where do you change the preshared key in the Concentrator Manager for this user? ❍ A. The password field in the Identity tab for users ❍ B. The preshared key field in the Identity tab for users ❍ C. The preshared key field in the Configuration | System menu ❍ D. The password field in the Identity tab for individual groups

Answer D is correct. Connecting clients use the password configured in the Identity tab of the Configuration | User Management | Groups | Modify or Add screen. Answer A is incorrect because the password field for the user identity is for user authentication to the concentrator’s internal database. Answers B and C are incorrect because the preshared key field does not exist.

83

84

Chapter . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Need to Know More? Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. For detailed information on the VPN concentrator initialization, go to the Cisco Web site at www.cisco.com/univercd/cc/td/doc/product/ vpn/vpn3000/ and look at the “Getting Started” and “Configuration” guides.

5 Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ X.509v3 digital certificates ✓ Certificate Authorities ✓ Public Key Infrastructure ✓ Central CA structure ✓ Hierarchical CA structure ✓ Root CA server ✓ Subordinate CA server ✓ Certificate Revocation List ✓ PKCS#10 ✓ SCEP

Techniques you’ll need to master: ✓ Knowing the advantages of digital certificates ✓ Describing the differences between flat and tiered PKI ✓ Understanding certificate revocation and validation ✓ Identifying the steps required for manual enrollment ✓ Identifying the steps required for automated enrollment ✓ Adjusting IKE negotiations to support certificates

86

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter 4 examined the steps involved in utilizing a preshared key as the authentication methodology when configuring remote access tunnels. As mentioned before, this implementation is not very scalable in larger networks, especially if the keys are somehow compromised. Specifically, additions to the existing network or key compromises result in reconfiguration of all devices utilizing preshared keys as a means of authentication. Because a preshared key can be distributed to any device you see fit, there are no means of validating the data’s true source. With digital certificates, you can verify remote peers by authenticating their identity credentials, as opposed to using a key. Digital certificates are created by a trusted third-party authority who binds these credentials to the device’s public key (and indirectly its private key because the public key is derived from the private key). By establishing a complete trust to this third-party authority, any identity credentials it validates are likewise to be considered valid by other devices that form a trust relationship with the key. In addition, digital certificates address preshared keys’ scalability problem: Added IPSec clients need to enroll for only their own certificate, as opposed to installing an additional key pair for every IPSec peer on the network. This chapter looks into the benefits that digital certificates provide for authentication. In addition, it looks at the additional steps required to configure the VPN 3000 Concentrator to enroll and implement the digital certificates.

Digital Certificate Advantages Digital certificates offer a significant advantage over preshared keys. Relevant to this discussion, digital certificates allow IPSec device and client identities to be bound to their own public/private key pair. This is the equivalent to providing a digital ID card for each IPSec device on the network. A digital certificate is a signed digital ID that contains identification information and the owner’s public key. Illustrated in Figure 5.1, the digital certificate contains identity information from the client requesting the certificate (located in the Subject field), as well as the identity of the certificate’s issuing authority. Furthermore, the issuing authority digitally signs the certificate (in the MD5 Fingerprint field) so that authenticating devices can substantiate that it came from a trusted authority. Notice that the certificate also contains validity dates and a serial number. Devices receiving this certificate use these fields to verify that the certificate has not expired or been revoked. Finally, a key (no pun intended) component of the digital certificate is the certificate owner’s public key. This key can be exchanged among peers for asymmetric encryption, as well as to validate digital signatures.

. . . . . . . . . Configuring . . . . . . .Cisco . . . VPN . . .3000 . . .for. Remote . . . . . Access . . . . Using . . . Digital . . . . Certificates . . . . . .

These certificates can be encoded in several formats, but the most prevalent of supported formats is the ITU-T Recommendation X.509 specification. The Cisco VPN 3000 Concentrator and clients support version 1, 2, and 3 of the X.509 certificate.

Digital Certificate Version Serial Number Issuer MD5 Fingerprint

v3 72 7b ff 6d 6c 83 56 a4 4f fb f0 c9 eb b4 ca a4 CN = FakeCA, OU = Fakers, O = Fake, Inc, L = Fakeville, S = Fakeland, C = US c3 ad fe 83 0c 68 f2 83 06 6c cb 80 e5 90 ad 60 18 cd c1 94

Subject

CN=Concentrator, OU=Not–So–Human Resources, O=Animal Farm, L=Hoggstown, SP=EU, C=US

Valid From Valid To

Wednesday, August 06, 2003 12:43:14 PM Sunday, August 06, 2023 12:46:15 PM

Public Key

30 48 02 41 00 a4 a5 15 09 a2 0a 55 e1 41 e7 d3 a0 cd 4e 17 9f d3 b5 d8 a1 cc 54 1e e4 2b 56 44 b7 27 f8 e1 bf f9 16 96 ee 4d e7 d9 08 24 82 5a 01 85 66 32 59 2c 0e 94aa e5 4a 32 83 6d 43 20 4c 68 d3 b3d4 5b 02 03 01 00

CRL Distribution URL=Idap:///CN=FakeCA,CN=dave,CN=CDP,CN=Public URL=http://dave.daminute.local/CertEnroll/FakeCA.cr

Figure 5.1 X.509v3 digital certificate.

Recall that digital signatures can be used during IKE negotiations as a means to authenticate a connecting device or client. This device-level negotiation occurs directly after IKE SA negotiations and the Diffie-Hellman key exchange as illustrated in Figure 5.2. As previously discussed, both sides of a tunnel endpoint must contain each other’s public key to verify received signed messages. When both sides send a hash of their identity information, they digitally sign the hash with their own private key. To validate the signed message, the tunnel endpoints send a digital certificate containing their public key along with the identity hash data. When the IPSec peer receives the certificate, it ensures that the certificate is valid and uses the contained public key to verify the digital signature of the identity data. Because the recipient of the signed data authenticates the sender by using the sender’s public key to decrypt the data, only the owner of the private key could have truly signed the data. However, because a public key has no intrinsic association to the source, you have to rely on a trusted third-party authority, known as a certificate authority (CA), to endorse the identity of the sender.

87

88

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

IKE SA: Encryption: 3DES Authentication: MD5 Diffie–Hellaman Group:2 Method: Digital Signatures

Diffie-Hellman Key Exchange


Diffie-Hellman Key Exchange

IKE Main Mode Phase 1

IKE Main Mode Phase 1 1010100 1010101 0100100 1000100 Mr. Ed

alsdjkflkajdkf

alsdjkflkajdkf



1010100 1010101 0100100 1000100 Wilbur

alsdjkflkajdkf

alsdjkflkajdkf



1010100 1010101 0100100 1000100 Mr. Ed 1010100 1010101 0100100 1000100 Wilbur

Figure 5.2 IKE negotiations entailing digital signatures and digital certificates.

Certificate Authorities Imagine you are friends with a famous rock band (like so many of us are). One day, at one of their concerts, you decide to go backstage and catch up on old times. Unfortunately, there is a bouncer there who will not allow anybody backstage who is not on his list. Lucky for you, the drummer of the band walks by and the bouncer asks the drummer whether he knows you. Because the drummer recognizes you as an old friend and the bouncer trusts the drummer, you are allowed to go backstage. Certificate authorities work in the same manner as the drummer of the band. When all IPSec devices are registered with this trusted third-party, they can look toward the certificate authority to be a trusted agency for verifying the identity of the user. As long as your digital certificate is valid from a trusted CA, authenticating devices that also trust that CA have to assume that the authenticating party is who it claims to be. The more reputable the CA, the more likely it is to have IPSec peers trust that same CA. Obviously, the trust relationship between the bouncer and the drummer diminishes the relevance of this point; however, it is important to note that the security measures, policies, and operations that a CA provides is the basis of the trust relationship with that CA. The CA is responsible for creating digital certificates, and thus, forms trust relationships with all other peers. When a device wants to enroll with a certificate authority, it provides identity credentials that the CA certifies as


authentic. The CA issues an identity certificate containing the requestor’s information, the requestor’s public key, and some of the CA’s information. When the certificates are created, the CA signs them with its own private key. All devices that wish to validate this certificate (including the requestor) must contain the CA’s certificate and use its enclosed public key to verify the CA signature. Identity certificates are used during the IKE negotiations to bind a public key to a device. As soon as two IPSec peers want to authenticate each other, they exchange their CA-signed digital certificates. Each device needs to validate the CA’s signature by using the trusted CA’s public key (derived from the CA’s digital certificate). After the certificate is validated with a known CA, the device can use the sender’s public key (contained in the identity certificate) to authenticate signed messages or to encrypt outgoing data destined for that peer. When new IPSec devices are added to the network, they only need to enroll with the trusted CA. This, in turn, enables them to authenticate with all other IPSec peers. Several third-party vendors exist for fulfilling this role as a CA for your network. Vendors such as Verisign, Baltimore Technologies, Thawte, and Entrust all provide public certificate authority services. It is also possible to provide your own internal CA by utilizing Windows 2000 as a certificate server.

Public Key Infrastructures A public key infrastructure (PKI) is a set of security services that entail the certificate authorities and all their client applications working in a unified framework. A small PKI infrastructure might use a single CA server to perform all certificate functions. This single CA server, known as the root CA server, is the point of common trust and is capable of signing its own certificates. In this flat design (known as a central or stand-alone CA structure), the root CA is responsible for issuing, signing, and revoking identity certificates. However, it is common within large infrastructures to contain a hierarchy of CA servers, which can help manage and control certificate distribution, as well as certificate revocation. These are often referred to as Enterprise or tiered hierarchy CAs. In this hierarchical design, the certificate authorities form what is called a certificate chain, in which subordinate CAs enroll with the root CA. The root CA maintains a hierarchy of trust by validating the subordinate CAs and signing and issuing their digital certificates. Requesting devices, in turn, request identity certificates that are signed and issued by their local subordinate CAs. To authenticate an IPSec peer’s identity certificate, they use the subordinate CA’s public key to verify the signed certificate.

89

90

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Likewise, the subordinate CA is validated with the public key of the root CA—thus the chain effect. Figure 5.3 provides an example of the two types of certificate authority designs. It is quite common for the root CA to be taken offline and physically secured, only to be brought back online when a subordinate CA certificate needs to issued, renewed, or revoked. In addition, CAs often delegate identification and authentication of subscribers to entities known as Registration Authorities (RAs). RAs act as a proxy to the CA and offload the tedious identity verification so the CA can concentrate on issuing, signing, and revoking certificates. Furthermore, RAs typically are not empowered to sign or issue certificates.

Central/Flat

Hierarchical/Tiered

Root CA

Root CA

alsdjkflkajdkf

alsdjkflkajdkf

Root

Root

IKE SA:

IKE SA:

Encryption: 3DES Authentication: MD5 DiffieÐHellaman Group:2 Method: Digital Signatures

alsdjkflkajdkf


alsdjkflkajdkf

Root

IKE SA:

Encryption: 3DES Authentication: MD5 DiffieÐHellaman Group:2 Method: Digital Signatures alsdjkflkajdkf

ID

IKE SA:


Root

IKE SA:


ID

IKE SA:


Subordinate CA Subordinate CA Subordinate CA alsdjkflkajdkf

alsdjkflkajdkf

Root

Root

IKE SA:

IKE SA:



alsdjkflkajdkf

alsdjkflkajdkf

SubID

SubID

IKE SA:

IKE SA:



alsdjkflkajdkf

alsdjkflkajdkf

Root

IKE SA:


SubID IKE SA:


alsdjkflkajdkf

Root

Root

IKE SA:

IKE SA:



alsdjkflkajdkf

alsdjkflkajdkf

SubID IKE SA:


alsdjkflkajdkf

ID

IKE SA:


SubID IKE SA:


alsdjkflkajdkf

ID

IKE SA:


Figure 5.3 Central and hierarchical CA designs.

Certificate Revocation and Validation Certificate authorities not only have to create and administer certificates, they also are responsible for revoking any invalid certificates. These certificates are revoked in instances such as an organization change, service removal, name change, or security compromise. When these occurrences take place, the CA


must generate a list known as a certificate revocation list (CRL), which contains a list of certificate serial numbers and their revocation dates. This list is digitally signed from the CA and enables the hosts to be notified of these revoked certificates. When a device receives a certificate, it must ensure that the certificate is valid. To guarantee the certificate is legitimate, the device must inspect the contents of the certificate and ensure that it has not expired. When a certificate is created from a CA, it sets a “valid from” and a “valid to” date. If the device’s localtime is not in between these times, the host does not allow the certificate for authentication. Recall that the Quick Configuration asks you to set the time and date in the opening dialogue. This step is imperative to ensure proper validation of digital certificates. Because the certificate validity ranges are compared to the system clock, you must ensure that the clock is always configured correctly.

The CA root (or subordinate) certificate must be installed on the device to validate the identity certificate. Root or subordinate certificates contain the CA’s public keys, which are used to verify installed or proposed identity certificates. The device uses the public key of the CA to validate the digitally signed identity certificate that was issued from that CA. The local concentrator who receives a certificate from the subordinate CA uses the subordinate CA’s public key to validate the identity certificate, but the root CA public key is used to validate the subordinate CA’s public key. When climbing this certificate chain, you eventually reach the root certificate, which is self-signed and is trusted solely on the fact that it is the root CA. A final validation step, if enabled, is when the device checks against a Certificate Revocation List (CRL) to ensure that an issued certificate has not been revoked by a certificate authority. When the device receives a digital certificate for authentication, it compares the serial number of the certificate to the CRL that was provided by the CA or subordinate CA. If the serial number appears on the list, the peer is not authenticated.

Cisco VPN 3000 Concentrator Digital Certificate Configuration For the VPN Concentrator to support digital certificates, certain additional configuration steps must take place in addition to the configurations that were discussed for preshared keys in Chapter 4. The following sections

91

92

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

explore the steps that are required to enroll the VPN Concentrator with a certificate authority. They also look at the changes that are essential to utilize digital certificates during the IKE phase 1 negotiation.

Certificate Enrollment In the enrollment process, you must configure the VPN 3000 Concentrator to request an identity certificate from the certificate authority. This request message is a special type of standard specification produced by RSA Laboratories, called Public-Key Cryptography Standard #10 (PKCS#10). After the PKCS#10 request is received by the CA and the information contained within the request is considered valid, the CA merges information from the request with information from the CA to generate an X.509 identity certificate. The certificate bears a “seal of approval” in the form of a digital signature comprising a hash of the certificate and the certificate authority’s private key. This signature is used to verify that the identity certificate was genuinely created by the trusted CA.

Certificate Encoding Formats When you download the certificates, the CA might give you an option of which format you want to use for the certificate. The two options available are DER or PEM Base 64 encoding. Distinguished Encoding Rules (DER) is a RAW binary format and Privacy Enhanced Mail (PEM) is a base 64 encoding of binary numbering. Either format is supported in the concentrator.

The following sections look at the configuration to initiate this enrollment process. As you will see, this enrollment can be a manual process in which you have to copy and paste the certificate information between the concentrator and the CA. On the other hand, if your CA supports it, the enrollment process can be automated over the network by a protocol called Simple Certificate Enrollment Protocol (SCEP).

Manual Enrollment Process To manually enroll the VPN Concentrator with the certificate authority, you must generate the PKCS#10 in the concentrator, which outputs the request to the computer that is consoled to the concentrator. The certificate request output must be copied and pasted in the certificate authority server screen so that it can be approved to generate the identity certificate. After the certificate is created, the connecting computer can download the identity certificate in addition to the CA’s root certificate. Recall from the certification validation process (see previous section, ”Certificate Revocation and


Validation”) that for a certificate to be considered legitimate, the concentrator must first validate the signed certificate with the root and/or subordinate certificate authority’s public key. Thus, before you can install the identity certificate on the concentrator, you must first import the root certificate to validate the identity certificate. The configuration screens to initiate this process are located in Administration | Certificate Management | Enrollment menu. Figure 5.4 displays the screen to set in motion the PKCS#10 enrollment process. Simply click on the Enroll via PKCS10 Request (Manual) hyperlink to bring up the PKCS#10 request page.

Figure 5.4 Identity certificate manual process initiation.

To initiate the request, you need to complete the user information fields in the PCKS#10 request form. These fields enable you to enter the certificate requestor’s company information (Common Name, Organization Unit, and Organization) and location information (Locality, State/Province, Country Code). The Organizational Unit (OU) field is used to identify a department within your organization. Connecting clients use this field to associate themselves with a group name. If you are using certificates to authenticate users during IKE, this field must coincide with a group name in the authenticating concentrator.

93

94

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Subject Alternative Name is an optional field that enables you to define a fully qualified domain name (FQDN) to identify the concentrator (for example, [email protected]) and the email address of the concentrator administrator. After the user information fields have been completed, the last step to complete the PKCS#10 enrollment request is to select the strength of the RSA or DSA private/public key pair. Recall that DSA is typically used in government installations. Figure 5.5 displays the PKCS#10 request screen.

Figure 5.5 PKCS#10 enrollment screen.

After completing the request, clicking on the “Enroll” button causes text file output to be displayed in a new browser window, as you can see in Figure 5.6. You can now cut and paste, email, or FTP the contents to the certificate authority to authenticate your information and generate the identity certificate. The certificate authority extracts information from your request so that it will contain the following fields in the identity certificate: ➤ Subject—This field contains all the user identification and location data

from the request. ➤ Public Key—The concentrator’s generated public key and strength in bits

are located in this field. The CA also adds its own specific information, including the following fields: ➤ Serial Number—This unique number is an important tracking mecha-

nism for this certificate. In addition to the number that is referenced in


CRLs from the CAs, it is the identifier for the certificate in the CA domain. ➤ Issuer—This field contains the identity information of the certificate

authority who originated the certificate. ➤ Valid From/Valid To—These fields define the range of the certificate’s

validity dates. ➤ Signature Algorithm—As the name states, it is the algorithm that is used

for the thumbprint (signature) of the CA.

Figure 5.6 PKCS#10 request output.

When the certificate authority generates the X.509 identity certificate, you must download the CA’s certificate, in addition to the identity certificate, to the connected computer. You may be given the option of downloading them individually or in an envelope format of multiple certificates known as PKCS#7 message syntax (not to be confused with PKCS#10 requests). Your CA might give you a password for your identity certificate, which you should keep in a secure location. This password may be necessary for a CA to authorize a revocation of the certificate.

To manually install the certificates, go to the Administration | Certificate Management | Install | CA Certificate screen, where you can choose between two of the manual processes. You can either open the certificate via a text editor and cut and paste the certificate’s contents, or you can upload the .cer file from the attached management station that downloaded the certificates from the CA. Remember that you must load the root CA and subordinate CA certificates before the identity certificate. If you receive an expiration error during this process, verify the certificate’s validity range, as well as the local system date and time settings.

95

96

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Automated Enrollment Process Automated enrollment is a network-based enrollment, which basically rules out the attached computer as a middle man. With the use of the SCEP protocol, the concentrator can upload the request directly to the CA, which, in turn, generates the certificates and delivers them to the concentrator. To begin the process, you must define the CA server that is participating in the SCEP enrollment on the Administration | Certificate Management | Install | CA Certificate | SCEP screen depicted in Figure 5.7. After you place the URL and description in the fields, the concentrator and CA server will communicate via the SCEP protocol and the concentrator downloads the root certificate from the CA. At this point, you can begin the enrollment process by clicking on the newly created hyperlink for the SCEP-supported CA server. The enrollment screen is almost identical to the manual request, with the exception of a challenge password field. This field can be used if your CA requires a password for the PKCS#10 request process; otherwise, you can assign a password to the request to identify yourself to the CA. After the CA issues the identity certificate, it is automatically loaded in the concentrator.

Figure 5.7 SCEP certificate enrollment screens.


Certificate Management At the Administration | Certificate Management screen, you can govern the parameters of all installed certificates on the concentrator. As portrayed in Figure 5.8, you can view, delete, and renew all certificates from this management screen. Also, in the Certificate Authorities section of the Manager, you can configure extra parameters. If you click on the “Configure” hyperlink, it allows you to enable CRL checking via HTTP and Lightweight Directory Access Protocol (LDAP). By default, CRL checking is disabled during certificate validation. Remember that the VPN 3000 Concentrator does not have CRL checking enabled by default. When enabled, the concentrator supports CRL checking via HTTP, as well as LDAP.

Figure 5.8 Certificate Manager screen.

Applying Certificates for Authentication Now that the certificates have been installed to the concentrator, you have to modify the IKE and IPSec SA parameters to include the certificate during IKE negotiations. Be sure to remember to install the root or subordinate certificates on the participating peer devices because they require the CA public key to validate your concentrator’s identity. In addition, if you are connecting to another concentrator, ensure that the remote concentrator has a group name that coincides with your OU field in the identity certificate.

97

98

Chapter . . . . .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The first change you need to apply is within the IKE proposal parameters. In the Configuration | System | Tunneling Protocols | IPSec | IKE Proposals screen, you need to activate or modify an IKE proposal that contains either RSA or DSA in the proposal. As illustrated in the example in Figure 5.9, the CiscoVPNClient-3DES-MD5-RSA proposal has been activated. The preconfigured CiscoVPNClient proposals are specifically created to support the capabilities of the Cisco Unity Client.

Figure 5.9 IKE Proposal Certificate Activation Screen.

After you select the option to modify the proposal, you should ensure that the Authentication Mode drop-down box contains an RSA or DSA digital certificate value. Continuing with the example, Figure 5.10 demonstrates that the authentication algorithm is set to RSA digital certificates. After the IKE proposal is defined to support digital certificates, you need to apply that proposal and identity certificate to an IPSec security association. In the Configuration | Policy Management | Traffic Management | Security Associations screen, choose which IPSec SA you want to utilize and click the Modify button. The screen should appear similar to Figure 5.11. In the IKE Parameters screen, be sure to use the pull-down menus to select the identity certificate you want to use, in addition to the IKE proposal that you modified in the previous section. Notice you are also given the choice to send only the identity certificate during IKE negotiations, or you have the option to send the entire certificate chain, which contains the root and subordinate certificates, as well.


Figure 5.10 IKE Proposal Certificate Configuration Screen.

Figure 5.11 IPSec SA Certificate screen.

99

100 Chapter 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Summary Digital certificates offer a significant advantage over preshared keys. Specifically, preshared keys do not have any intrinsic ties to the IPSec entity on which they are configured. With digital certificates, you validate your identity to a certificate authority (CA) which, in turn, issues an identity digital certificate containing your identification information, your public key, and information of the issuing CA. With this identity certificate, your identification is bound to your keys like a digital ID that you can use to authenticate to your IPSec peers. In addition, preshared keys involve significant configuration when adding additional IPSec peers or when the preshared key becomes compromised. With digital certificates, you can maintain a list of compromised certificates via CRLs, and the process of adding additional IPSec peers does not require a momentous configuration change on all devices. Certificate authorities are the heart of a PKI design. These designs may contain a central structure in which there is only a single root CA. However, in large-scale networks, it is possible to have a tiered or hierarchical CA structure in which CA responsibilities are offloaded to subordinate CAs and registration authorities. When a device receives a digital certificate, it must validate the certificate to ensure the identity of the connecting IPSec peer. To confirm the certificate, the IPSec peer must validate the CA’s signature on the certificate by using the server’s public key from an installed certificate on the machine. In addition, it examines the validity dates and compares them against its own system clock to make certain that the certificate has not expired. Finally, if enabled, the authenticating host might have the capability to check whether the digital certificate’s serial number matches the serial number on an issued certificate revocation list. To configure the Cisco VPN 3000 Concentrator to support X.509 digital certificates, you can generate a PKCS#10 request from the concentrator, which needs to be either manually uploaded and downloaded from the CA or automatically synchronized through the use of the SCEP protocol. It is imperative to load the root certificate before the identity certificate so the identity certificate can be validated by the root CA’s public key. After the certificates are loaded on the concentrator, you must change the IKE proposal to entail RSA or DSA certificates. In addition, you must apply that IKE proposal and identity certificate to a IPSec SA.


Exam Prep Questions Question 1 What are the two certificate encodings that are available when downloading an identity certificate? (Choose two.) ❑ A. PEM Base 64 ❑ B. PKCS#10 ❑ C. DER RAW Binary ❑ D. PKCS#7

A and C are correct. DER binary and PEM base 64 binary are two supported encodings that the concentrator supports for identity certificates. B is wrong because PKCS#10 is a certificate request message syntax, and D is wrong because PKCS#7 is a certificate envelope message syntax.

Question 2 Which is an emerging standard format for digital certificates? ❍ A. X.25 ❍ B. X.121 ❍ C. X.509 ❍ D. X.10

Answer C is correct. The most prevalent digital certificate format used today is the x.509 format. Cisco products support version 1, 2, and 3 of these formats. Answers A, C, and D are incorrect because they are not formats for digital certificates.

101

102 Chapter 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 3 What devices might you find in an hierarchical certificate authority PKI? (Choose all that apply.) ❑ A. Root CA ❑ B. Registration Authority (RA) ❑ C. Domain Authority ❑ D. Secondary CA ❑ E. Certificate Manager ❑ F. Subordinate CA

Answers A, B, and F are correct. A tiered or hierarchical PKI comprises the root CA server, subordinate CAs, and sometimes registration authorities. Answers C, D, and E are incorrect because these are not actual devices that you will encounter in a PKI.

Question 4 How many subordinate CAs are typically in a central or flat CA design? ❍ A. Zero ❍ B. One ❍ C. Two ❍ D. Three

Answer A is correct. A central or flat CA design has only a root server. There are not any subordinate CAs in a central design. Answers B, C, and D are incorrect because multiple CAs are characteristic of a tiered or hierarchical CA infrastructure.

Question 5 Which two concentrator parameters must be modified after certificates are loaded into the concentrator? (Choose two.) ❑ A. IKE negotiation ❑ B. Certificate keepalive timers ❑ C. Certificate strength ❑ D. IPSEC SA


Answers A and D are the correct answers. You must first change the IKE negotiation to involve RSA or DSA certificates, then apply that IKE proposal to the IPSec SA and choose which digital certificate is to be used for that proposal. Answer B is incorrect because certificates do not have keepalive timers. They contain validity dates, which are matched against the system’s internal clock. Answer C is incorrect because the certificate strength (bitlength) is chosen when you generate the request for an identity certificate to a CA. This is not changed after the certificates are loaded onto the concentrator.

Question 6 In what order should certificates be installed on the concentrator? ❍ A. Root, then preshared key ❍ B. Root, then identity certificates ❍ C. Identity certificate, then root ❍ D. It does not matter in which order they are installed

Answer B is correct. The root (and subordinate) certificate must be installed first so the public key of the root CA can validate the identity certificate. Answer A is incorrect because the preshared key is not installed when utilizing digital certificates for authentication. Answer C is incorrect because the concentrator would have no means to authenticate the digital signature of the identity certificate because the root’s public key is contained in the root certificate. Answer D is incorrect because the order in which they are installed is definitely important. The root certificate must be installed first so that its public key can be used to validate the identity certificate.

Question 7 Which field in a certificate must coincide with a group name on an authenticating concentrator? ❍ A. Organization (O) ❍ B. Group (G) ❍ C. Organization unit (OU) ❍ D. Common name (CN)

103

104 Chapter 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer C is correct. The organization unit is the field that concentrators utilize to associate an IPSec peer to a group. Answers A and D are actual fields in a digital certificate; however, the VPN 3000 Concentrator utilizes the Organization Unit (OU) field by default to associate authenticating devices to a group. Answer B is incorrect because the Group field does not exist.

Question 8 Which two protocols can the VPN 3000 Concentrator utilize to retrieve CRLs for certificate validation? (Choose two.) ❑ A. LDAP ❑ B. TFTP ❑ C. HTTP ❑ D. FTP

Answers A and C are correct. If enabled, the VPN 3000 Concentrator can utilize either LDAP or HTTP to retrieve a CRL to verify that a certificate has been revoked. Answers B and D are incorrect because TFTP and FTP are not used to retrieve CRL lists from distribution points.

Question 9 When using digital certificates, the majority of client connections are failing. What is the most likely cause of these failures? ❍ A. All clients are on the CRL list. ❍ B. Your system clock is not set properly. ❍ C. You accidentally turned of SCEP protocol. ❍ D. The client’s preshared keys do not match your preshared key.

Answer B is correct. If the concentrator’s clock is improperly configured, connecting clients’ certificates may appear invalid because the date of the concentrator falls outside of the validity dates of the certificates. Answer A is a viable answer; however, it is unlikely that all clients have been revoked. C is incorrect because the SCEP protocol is used only for enrolling with a CA, not validating certificates. D is incorrect because digital certificates do not use preshared keys.


Question 10 Which of the following are possible reasons to revoke a digital certificate? (Choose all that apply.) ❑ A. Organization change ❑ B. Name change ❑ C. Computer change ❑ D. Security compromise

Answers A, B, and D are correct. Organization changes, service removals, name changes, or security compromises are all valid reasons to revoke a digital certificate. Answer C is incorrect because a computer change does not have to entail a certificate revocation. A certificate can be exported and moved to different devices.

105

106 Chapter 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Need to Know More? Thawte offers a free digital signature service for email at www. This is a great and inexpensive way to secure email and to familiarize yourself with the PKI process directly.

thawte.com.

There is a plethora of digital certificate information at www. rsasecurity.com. They have great FAQs on digital certificates, as well as a listing of all of the PKCS syntax standards. contains a list of hyperlinks to information and standards regarding PKIs and digital certificates. www.pki-page.org/#DIGSIG

6 VPN 3000 Concentrator Advanced Features Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ ✓ ✓ ✓ ✓

Rules and filters DHCP relay VRRP VCA Reverse Route Injection (RRI)

✓ ✓ ✓ ✓

Bandwidth management NAT-T LAN-to-LAN Network Autodiscovery

Techniques you’ll need to master: ✓ Understanding the process to create rules and filters ✓ Identifying the routing functions contained in the concentrator ✓ Describing the functionality and configuration of concentrator redundancy ✓ Implementing reverse route injection ✓ Identifying the aspects and configuration of concentrator load balancing

✓ Determining the steps required to enable bandwidth management ✓ Understanding the purpose and utility of NAT and PAT ✓ Determining the steps required to enable NAT transparency ✓ Describing the details involved with implementing LAN-to-LAN tunnels

108 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Now that the easy stuff is out of the way, it’s time to explore more of the advanced features of the VPN 3000 Concentrator. Many of these features are enhancements to the concentrator that contribute to its versatility. This chapter explores the concentrator’s advanced features such as filters, routing options, redundancy, load balancing, DHCP Relay, and bandwidth management. In addition, it explores how to implement NAT or PAT on the concentrator, as well as enable NAT transparency when the concentrator or client is already behind a NAT or PAT device. Finally, it explores how to create LAN-to-LAN tunnels to enable a concentrator to connect its LAN to another IPSec gateways.

Rules and Filters In certain circumstances, you may want to implement some form of security by filtering specific protocols, hosts, or even entire networks. These functions are similar to access lists in Cisco routers and firewalls. To achieve this functionality, the VPN 3000 Concentrator requires you to define a rule or a set of rules to be applied to a filter. When multiple rules are applied to a filter, the concentrator tests the conditions of the first rule. If the criterion matches, the rest of the rules are not processed. If there is not a match, the next rule is tested. In cases where none of the rules match, the concentrator performs the default action that is defined in the filter. After the filter is created, you can apply it to interfaces, users/groups, and LAN-to-LAN tunnels. Out of the box, the VPN Concentrator has four preconfigured filters. Three of these filters are predefined for interfaces, and the fourth is created for a CPP firewall policy (discussed in Chapter 7, “Advanced VPN 3000 Feature Configuration”). The four filters are as follows: ➤ Private (Default)—This default filter is preconfigured for the Ethernet 1

interface (private interface). The default rules applied to this particular filter allow all inbound and outbound traffic to be forwarded. This filter is not enabled on any interface by default. ➤ Public (Default)—This filter is applied to the Ethernet 2 public interface

by default. The rules applied to this filter allow inbound and outbound traffic for GRE, IPSec-ESP, IKE, PPTP, L2TP, ICMP, VRRP, and NAT-T protocols. All other protocols are denied in accordance with the default rule for this filter when a match is not met. ➤ External (Default)—This preconfigured filter is designed to be used on

Ethernet interface 3 (external interface), which connects to the corporate DMZ. No rules are associated with this filter and it is not applied to any interface by default.

. . . . . . . . . . . . . . . . . .VPN . . 3000 . . . Concentrator . . . . . . . .Advanced . . . . . Features . . . . .Configuration . . . . . . . ➤ Firewall Filter for VPN Client (Default)—When utilizing CPP for a fire-

wall policy, this preconfigured rule can be pushed down to connecting clients. The only rule applied to this filter is to allow all outbound traffic. Filter configuration steps and concepts are likely to appear on the exam.

To begin, you must create or modify rules that define the parameters that you are trying to filter. In the Configuration | Policy Management | Traffic Management | Rules screen, Cisco has predefined a list of rules you can modify to your specific needs. You can also add your own filter rule, copy an existing rule, or delete a rule in the list. In Figure 6.1, a new rule called Mr. Ed is being created so Mr. Ed can administratively configure and monitor the VPN 3000 Concentrator across the Internet. To achieve this functionality, the concentrator must allow inbound and outbound HTTPS traffic on the public interface. The top section of the rule page states the name of the rule and the direction of packets that are being inspected. In the Action drop-down box, you can determine whether you want to forward or drop that packet, in addition to logging the occurrences of a match for the rule. You also can specify whether to apply an IPSec SA (authentication, encryption, and so on) to any packets that match the criteria in this rule. Because this rule is being configured to allow HTTPS traffic to be forwarded, we are creating an inbound rule that will be forwarding as its action. The next section enables you to specify the Layer 3 or Layer 4 protocol for which the rule is defined. You can specify the protocol in the drop-down box or indicate the protocol number that is derived from the protocol field inside an IP header. Here you can be more granular in your rule definition for such protocols such as TCP, UDP, ICMP, ESP, and AH. In addition, if the rule is being utilized for TCP, you can further define whether it applies to an established TCP session that was initiated from the source network. Using the example, this particular rule is to be applied to the TCP Transport layer protocol because HTTPS utilizes TCP at Layer 4 of the protocol stack. In addition, because the request is initiated from Mr. Ed who is outside of the concentrator’s internal network, the established rule is not turned on. Established TCP sessions are sessions that contain an ACK or RST in the TCP header. Because the initial TCP packet in a session connection does not contain an ACK in the header, this additional option forces the concentrator to drop all sessions that did not originate from its network.

109

110 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 6.1 Rule definition screen.

In the Source and Destination parameters, you can specify the source and destination host or network for which the rule applies. To determine the source and destination IP addresses, you have the option of using a predefined network list (see Chapter 4, “Cisco VPN 3000 Remote Access PreShared Key Configuration”) or using an IP address and inverse wildcard mask in the appropriate fields. Because it is wise to secure the administration of the concentrator, the rule is configured to accept HTTPS from Mr. Ed’s network of 172.16.2.0/24 and destined for the concentrator’s public interface of 192.168.1.101/32. In instances where the protocol defined is TCP or UDP, the remainder of the rule definition enables you to extend the criteria to specific TCP and UDP ports or port ranges. In addition, if the rule is defined for ICMP, you can define the ICMP packet type (echo request, echo reply, and so on) that this rule is testing. Because TCP sessions choose a random TCP port as the source, the example allows the full range of TCP ports above the well-known range (ports 1024 and up). The destination port for incoming packets is going to use port 443, which is the TCP port assigned for HTTPS.

. . . . . . . . . . . . . . . . . .VPN . . 3000 . . . Concentrator . . . . . . . .Advanced . . . . . Features . . . . .Configuration . . . . . . .

Additionally, an inverse rule needs to be created for outbound HTTPS that has a source address of the public interface of the concentrator and a destination of Mr. Ed’s 172.16.2.0 network. As soon as all the rules are defined, you can apply them to a filter or several filters. As depicted in Figure 6.2, the Configuration | Policy Management | Traffic Management | Filters screen enables you to add, delete, or modify filters, as well as assign rules to an existing filter. The example is going to add the created rules to the default public filter that is assigned to the public interface. Thus, the Public (Default) filter needs to be selected, and then the Modify Filter button needs to be pressed.

Figure 6.2 Filter definition screen.

At this point, you are presented with a screen similar to Figure 6.3. Here you can define the filter name as well as determine the default action if there is not a match for the rules assigned to this filter. The two check boxes on this screen allow additional security measures, which define whether the filter will allow source-routed packets or fragmented packets to pass. In addition, it is always good practice to assign a description for convenience so you or other administrators can easily determine the purpose of the filter.

Figure 6.3 Filter modification screen.

111

112 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Source-Routed and Fragmented Packets Source-routed packets explicitly state the route to follow to their destination, rather than following normal routing policies. These packets can pose a security threat; therefore, the check box is automatically unchecked so the concentrator does not forward them. In addition, IP packets may be fragmented by devices because of MTU size limitations to be reassembled on the receiving end. Because this is quite normal, the concentrator allows them to be passed by default. However, malicious code is sometimes sent in fragmented packets so security devices will allow them to pass. If security is a high concern and this option is checked (to allow the fragmented packets), be sure that the organization has an Intrusion Detection System (IDS) or firewall to detect these attacks.

After you have completed the parameters on this page, click on the Apply button to return to the filter menu. At this point, you are ready to add the Mr. Ed rules to the filter. Figure 6.4 represents the screen that is displayed to add rules to the filter. Recall that the filter performs top-down processing of the rules, so it is imperative to place rules that are more specific on the top, followed by general rules toward the bottom. In addition, all filters must have at least one forward statement in the assigned rules. Without a forward statement, all traffic for the filter will be dropped. You can prioritize the rules by moving them up or down in the filter’s active list.

Figure 6.4 Rule assignment to filters.

VPN Concentrator Routing The VPN 3000 Concentrator needs to be enabled to route packets to other networks. To perform this function, you can configure the VPN Concentrator to use static routes, as well as utilize the RIP and OSPF routing protocols. When configured, the routable networks populate the concentrators routing


table. The routing process in the VPN 3000 Concentrator first uses routes learned dynamically, then static routes, followed by the default route. You set the IP routing configurations at the Configuration | System | IP Routing screen, as depicted in Figure 6.5.

Figure 6.5 IP Routing screen.

Static Routes and Default Gateway With static routes, you manually specify the destination networks that the concentrator needs to reach. When you add the route, you need to specify the network identifier, subnet mask, and the metric (lower is preferred) for the destination network. You must also specify the next-hop address or interface that is to forward packets destined for the network. Similar to static routes, a default gateway route is a manual entry that specifies where to send data when there is not an exact match in the routing table. This gateway of last resort is a very common configuration because the concentrator sends VPN traffic to the Internet out its public interface. For this very reason, you predominantly assign the IP default gateway to be your Internet perimeter router located on your public network. In the configuration, you also can define a tunnel default gateway. This is utilized when you have a parallel firewall or router performing NAT between the public and private networks.

RIP and OSPF Dynamic Routing Protocols Dynamic routing protocols, in the forms of RIP and OSPF, can also be enabled for automatic network discovery. General OSPF parameters can be configured for the VPN 3000 Concentrator on the IP Routing screens; however, the majority of the parameters for RIP and OSPF are actually configured on the interface screens. On each interface, you can enable the routing protocol and configure the particulars in accordance to the concentrator’s routing function in the network. If necessary, you can filter OSPF and RIP

113

114 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

by assigning or modifying filters on the interface to forward or drop RIP and/or OSPF.

DHCP Relay When the VPN concentrator receives a broadcast DHCP request from a VPN client on its public or external interface, DHCP relay allows the concentrator to forward that request as a broadcast destined for UDP port 67 on its private interface or to a specified server IP address. When a DHCP server responds to the DHCP request, it uses UDP port 68 to forward the requested information to the concentrator, which, in turn, forwards the information to the requesting client. This function is similar to the Cisco IOS router’s IP helper-address command. If this function is enabled, it is important to apply the DHCP In and DHCP Out rules to the interface filters.

VPN Concentrator Redundancy In certain enterprise networks, it may be necessary to provide resiliency and fault tolerance for devices supporting VPN connectivity. These types of environments rely heavily on uninterrupted connectivity to the central office so that productivity is not affected. If any failures occur in the VPN infrastructure, the network has to recover quickly from these setbacks to minimize downtime. Recall from Chapter 3, “Cisco VPN 3000 Concentrator Hardware,” that the VPN Concentrator can provide redundancy when running in parallel with another concentrator or a group of concentrators. You can accomplish this redundancy by using a protocol called Virtual Router Redundancy Protocol (VRRP), which is similar to Cisco’s HSRP protocol for router redundancy. To function properly, all the concentrators must have their private interfaces in the same subnet, and their public interfaces must be in the same subnet (different from the private), as illustrated in Figure 6.6. One of the concentrators in the group is configured as a master concentrator whose purpose is to process all requests sent to the VRRP group virtual IP address and VRRP virtual MAC address(00:00:5e:00:01:XX where XX is the group ID in hex). If the master concentrator should fail, the backup concentrators would detect the lack of VRRP messages from the master on both interfaces. At that point, the first backup concentrator would take over the active role and process requests being sent to the group virtual IP address. For example, when Mr. Ed configures his client to connect to the VPN Concentrator configured in Figure 6.6 and Figure 6.7, he uses the public


virtual IP address (192.168.1.100) as the connection destination. If the master concentrator fails, a backup concentrator would resume any LAN-toLAN sessions that the master concentrator was maintaining. However, remote access sessions do not automatically switch over; thus, these sessions need to be reconnected. With that being said, if Mr. Ed is connected when the master concentrator fails, he needs to reconnect the client because he is using a remote access session. In these instances, there is a positive aspect: Because the backup concentrator will also use the same virtual IP address, there is no reconfiguration necessary on the client when reconnecting. When concentrator redundancy is enabled, you cannot additionally have load balancing enabled. In addition, when the master concentrator fails, LAN-to-LAN sessions are automatically recovered by the backup concentrator; however, client remote access tunnels need to reconnect.

Figure 6.6 Concentrator redundancy design.

To configure concentrator redundancy, the Configuration | System| IP Routing | Redundancy screen depicted in Figure 6.7 contains all the parameters you need. You must enable VRRP (disabled by default) and assign the concentrators to the same group ID. If you want to secure this functionality, you may also assign a password, which also must match on all concentrators in the redundant design. In the Role drop-down box, you can select whether the concentrator will be the master or one of the five possible backup concentrators. The default hello interval is 1 second for VRRP, but you can change that interval to any length up to 255 seconds (not recommended). If you are the master concentrator, the public and private (and external, if applicable) group addresses default to the IP addresses of those interfaces. With that being said, you cannot use DHCP for IP address assignment on the concentrator’s interfaces. On each backup concentrator, you must change the group IP address to coincide with the master’s group IP addresses.

115

116 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 6.7 Concentrator redundancy configuration screen.

Reverse Route Injection When the VPN Concentrator connects to other networks, downstream devices running RIP and OSPF on the concentrator’s private network do not know how to get to those newly connected networks or hosts. With reverse route injection (RRI), connecting devices can inject their internal addresses into the concentrator’s routing table so they can be distributed to other routing devices through the use of the RIP or OSPF routing protocols. In cases where the connection is a LAN-to-LAN tunnel or Cisco VPN 3002 Hardware Client operating in Network Extension mode, the internal networks are injected into the concentrator’s RIP or OSPF updates. Connecting VPN clients insert their assigned internal IP addresses to the concentrator’s routing table. Be sure to remember that RRI relies on RIP and OSPF to advertise the injected routes in the concentrator’s routing table.

Please note that the injected remote addresses and networks are not actually injected into the routing process by the remote devices. Only the VPN 3000 Concentrator with RRI enabled can perform this function. The remote devices determine which networks are capable of being injected.

As illustrated in Figure 6.8, Router A is learning via RIP about networks that have been injected into the concentrator. The LAN-to-LAN concentrator and VPN 3002 Hardware Client running in Network Extension mode injected their entire private network. The VPN 3002 Hardware Client running in Client mode and the Unity Client are injecting their assigned tunnel address from the concentrator’s address pool.


Unity VPN Client receiving internal IP address of 10.1.1.113 255.255.255.0

VPN 3002 running in Client Mode receiving internal IP address of 10.1.1.114 255.255.255.0

VPN 3002 running in Network Extension Mode Private Network: 10.1.2.0 255.255.255.0 VPN 3000 Concentrator LAN-to-LAN Private Network: 10.1.3.0 255.255.255.0

IP Pool Assignment fo Clients: 10.1.1.113-10.1.1.127 Private IP: 10.2.2.1

Router A

Router A's Routing Table: C 10.2.2.0/24 is directly connected, Ethernet() 10.1.1.0/32 is subnetted, 2 subnets R 10.1.1.113 [120/1] via 10.2.2.1, 00:00:21, Ethernet() R 10.1.1.114 [120/1] via 10.2.2.1, 00:00:21, Ethernet() R 10.1.2.0/24 [120/1] via 10.2.2.1, 00:00:21, Ethernet() R 10.1.3.0/24 [120/1] via 10.2.2.1, 00:00:21, Ethernet()

Figure 6.8 Reverse route injection scenario.

To configure RRI, all configurations take place on the VPN Concentrator at the Configuration | System | IP Routing | Reverse Route Injection page. Figure 6.9 displays the two configuration options presented on the RRI screen. These options are to enable RRI for software clients and/or enable RRI for Cisco VPN 3002 Hardware Clients connecting in Network Extension mode (LAN-to-LAN RRI is explained later). The Hold Down Routes section enables you to define the networks to be injected manually so they will always be inserted into the routing table. You can type the network and subnet mask in the N.N.N.N/S.S.S.S notation, as displayed in Figure 6.9. Furthermore, you can have the concentrator automatically assign networks in the address assignment pool by clicking on the Generate Hold Down Routes button. For example, the configuration in Figure 6.9 demonstrates that the hold down route 10.1.1.112/255.255.255.240 was automatically added when the Generate Hold Down Routes button was pressed. This particular range was added to the address table because the assignable address pool for clients is 10.1.1.113–10.1.1.127. Keep in mind for the exam that the VPN Concentrator can run Client RRI and Network Extension RRI. Client RRI entails adding assigned internal tunnel IP addresses into the concentrator’s routing table from connecting Cisco VPN software clients and VPN 3002 Hardware Clients running in Client mode. Network Extension RRI adds the private networks behind a VPN 3002 Hardware Client running in Network Extension mode to the concentrator’s routing table.

117

118 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 6.9 Reverse route injection configuration screen.

VPN Concentrator Load Balancing When presented with an enterprise network installation with VPN concentrators running in parallel, it does not make logical sense to have all remote clients connecting to the same concentrator. This is especially true if there is a particularly high session load that is due to a substantial number of remote users. In these particular networks, it would be practical to have the parallel concentrators share session loads (load balance) so that a single concentrator does not get overwhelmed. Concentrator load balancing is extremely similar to concentrator redundancy; however, redundancy and load balancing cannot run simultaneously. Load balancing is a way to offload connecting sessions to other underutilized concentrators in a cluster that are running in parallel to the master. All the concentrators agree on a virtual IP address and report their utilization to the master by using the Virtual Clustering Agent (VCA) protocol. At any given time, the master concentrator learns the session load of each concentrator in the cluster by calculating the percentage of current active sessions divided by the configured maximum allowed connections. When devices initiate their IPSec tunnels to the virtual IP address, the master concentrator processes the request. If there is another parallel concentrator that has a low session load, the master can send a redirect message in IKE phase 1 to tell the connecting client with which concentrator it is to initiate a connection. To configure load balancing, you have to define the virtual IP address and listening port, as shown in Figure 6.10. You can also implement security for these VCA advertisements by encrypting the contents and assigning a password that must match in all concentrators in the cluster. For the device parameters section of this page, you must enable the load balancing on the


concentrator (it is disabled by default) and specify a priority. The master of the cluster is typically the first concentrator to come online. If the concentrators come online at the same time, the highest priority becomes the master concentrator of the cluster. Table 6.1 shows the default priorities according to the concentrator model. Table 6.1 Default Load Balancing Priorities Concentrator

Priority

3005

1

3015

3

3030

5

3060

7

3080

9

The “NAT Assigned IP Address” field must be configured if an outside device is performing NAT on the virtual IP address. In this field, specify the public IP address to which the virtual address is translated by the NAT device. For the VCA protocol to be sent and received on interfaces, you must apply the VCA filters on the public and the private interfaces.

Figure 6.10 Reverse load balancing configuration screen.

119

120 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bandwidth Management Policies Starting with version 3.6.1, the VPN Concentrator enables you to define bandwidth management policies that can be applied for individual groups, LAN-to-LAN sessions, or an entire interface. These policies specify whether the concentrator is to perform traffic policing and traffic reservation. Traffic policing entails limiting members of a VPN session to a defined bandwidth range. Any traffic that exceeds this traffic envelope is dropped. In contrast, bandwidth reservation is used to guarantee a defined amount of bandwidth for a VPN session. By using this tactic, a VPN session can receive a defined amount of bandwidth when the Internet link’s bandwidth is being exhausted by multiple sessions. If there are only a few users connected to the concentrator, they share all the bandwidth of the Internet link. As such, bandwidth reservation is useful only when there are too many sessions and the Internet link’s bandwidth is consumed. Bandwidth management policies are a new topic for the 642-511 exam. It goes without saying that because this is a new testable topic, it will appear on the exam. Specifically, it is important to understand bandwidth reservation and bandwidth policing policies and what parameters can be configured for each.

As mentioned before, these policies can be applied to groups so that members of that group inherit that bandwidth policy. When the bandwidth policy is applied to an interface, all sessions that do not have an assigned policy inherit that particular interface’s policy. As you will see later in this chapter, LAN-to-LAN tunnels can also utilize this advanced feature when connecting to other concentrators or IPSec-compliant gateways. Be careful when configuring bandwidth reservation policies that are applied to an interface. If there are already multiple established sessions and the concentrator cannot deliver the reserved bandwidth for any additional sessions, those sessions will not be allowed to connect. One possible solution is to create a reservation policy with a low minimal bandwidth reservation value (for example, 8Kbps) and assign it to the interface. For users who require specific reserved amounts of bandwidth, create a separate reservation policy with a higher bandwidth reservation value and assign the policy to the user’s group. The group’s policy settings override the policy applied to the interface.

Configuring the concentrator for bandwidth management requires only a few simple steps. Initially, you have to define the policy to specify whether you want to enforce traffic policing, traffic reservation, or both. This policy definition occurs at the Configuration | Policy Management | Traffic


Management | Bandwidth Policies | Add or Modify screen, as shown in Figure 6.11. Here, you can define a name for your policy, followed by your bandwidth policy parameters. If you want to implement bandwidth reservation, you need to check the appropriate box and specify the amount of bandwidth you are reserving in this policy. Bandwidth policing, if checked, requires that you specify the bandwidth rate cap this policy is enforcing. Constant sustained traffic that exceeds this rate is dropped; however, the concentrator’s bandwidth management enables you to specify a burst limit in bytes for intermittent traffic that has a tendency to burst over the policed rate. Remember that the Bandwidth Reservation field enables you to define a minimum reserved bandwidth, and Policing fields enable you to specify a policing rate and a normal burst size.

For example, suppose Mr. Ed has a habit of consuming a good portion of the concentrator link’s bandwidth to transfer files from the central office to his laptop. To ensure that his transfers do not affect the throughput for the rest of the remote access sessions, the concentrator administrator decided to apply a policing bandwidth policy to Mr. Ed’s group, Not-So-Human Resources. As depicted in Figure 6.11, the policing rate configured for Mr. Ed is 64Kbps. Additionally, because file transfer traffic tends to be bursty at times, the transfer is allowed to burst over 64Kbps up to 10,500 bytes before packets begin to drop.

Figure 6.11 Bandwidth management policy definition.

After the policy is created, you must assign it to an interface (typically the public). Recall that any policy that is assigned to the interface is applied to all sessions that do not have a group or LAN-to-LAN policy associated with

121

122 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

them. As illustrated in Figure 6.12, you must enable the bandwidth management and define the link bandwidth (default speed assumes link is a T1 with a bandwidth of 1544 Kbps). It is important to note that this bandwidth represents the Internet link speed, and not the bandwidth of the Ethernet interface. After you have accurately defined your link speed, you can assign the defined policy to the interface by selecting it in the drop-down menu. Notice in the example that the Bandwidth Hog policy was not assigned to the interface. Because a policy must be assigned to the interface when you enable bandwidth management, another policy had to be created so that not all users would get associated with the 64Kbps policing policy. Thus, the Others bandwidth policy was created with a capped rate of 1544Kbps (the entire link speed) for users not belonging to Mr. Ed’s group. With this configuration in place, connecting users not associated with Mr. Ed’s group will be policed, but at the full link’s bandwidth, which is essentially not policing at all. However, when users in Mr. Ed’s Not-So-Human Resources group connect to the concentrator, the assigned bandwidth policy to that group will override the interface’s policy and those users will be policed at 64Kbps.

Figure 6.12 Bandwidth policy interface assignment.

To apply the policy to an individual group, select the group in the User Management screen and choose the Bandwidth Assignment button as shown in Figure 6.13. After you select the interface for this policy, once again, you need to assign a policy; however, this time it is assigned to the individual group. In the example shown in Figure 6.14, the Not-So-Human Resources group is assigned the Bandwidth Hog bandwidth policy. With this policy to the group, users in the Not-So-Human-Resources group will have their sessions policed to 64Kbps. However, users that are not in the group will inherit the Others policy, which caps users on that public interface to the full link speed of 1544Kbps.


Figure 6.13 Bandwidth management group selection.

Figure 6.14 Bandwidth policy group assignment.

Figure 6.14 also displays a field that enables you to define an aggregate bandwidth. This option is a concept similar to bandwidth reservation, except bandwidth aggregation is used to reserve from the total available bandwidth for a specific group. This is useful when you are applying a bandwidth reservation policy to an interface and you want to guarantee bandwidth to a group so its users will not be refused a session. In other words, if you define a value in this field, the bandwidth specified is allocated to that specific group and it cannot be utilized by any other group even if it is not used. Consider an example: If a group has been allotted 64Kbps out of the total link speed of 1544Kbps, its users are guaranteed that bandwidth when connecting. Thus, if the group contains two users and their bandwidth reservation policy is for 32Kbps, they will never be refused a connection. Users that are not members of this group share the remaining available bandwidth of 1480Kbps regardless of whether the users within that group are connected or not.

123

124 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Concentrator NAT and PAT When connecting the VPN 3000 Concentrator to other networks, it might be necessary to translate the IP addresses of packets that pass through the concentrator. This is especially true when the remote networks to which you connect share the same IP subnets that reside behind the concentrator and an overlap occurs. By utilizing NAT and PAT, you can translate internal IP addresses into multiple or a single outside address. In these instances, you can define NAT rules in the VPN Concentrator that specify the networks that are to be translated into the outside IP address(es). These created NAT rules can be applied to either interfaces or LAN-to-LAN tunnels (discussed in the “IPSec LAN-to-LAN NAT” section). In the Configuration | Policy Management | Traffic Management | NAT | Interface Rules | Add or Modify screen, you can define the parameters necessary to perform PAT on an interface. As represented in Figure 6.15, the NAT Interface Rules screen presents you with a choice of interfaces in which the NAT rule is going to be applied. The Private Address fields determine the IP address or IP network that is to be translated with PAT. In the check boxes that follow, specify whether you want portless protocols (non-TCP and non-UDP) to be translated. By default, the concentrator has the TCP and UDP port mappings checked so that outgoing TCP and UDP translation from the private network is mapped to the public interface’s corresponding ports. In addition, if utilizing TCP port mapping, the VPN Concentrator can perform FTP proxy functions to maintain mappings for FTP data connections that are being initiated from the private network. This is necessary because FTP clients request a specific port for data transfer when connecting to an FTP server. If a NATing device uses a different port to translate the request, the host listening on its requested port does not receive the data back on that port and will not process the data.

Figure 6.15 Concentrator Interface NAT rules.


A necessary final step to complete the NAT rule process is to enable the NAT rules. In the Configuration | Policy Management | Traffic Management | NAT | Enable screen, you are presented with two check boxes (Figure 6.16). Fill the check boxes accordingly to enable the defined NAT rules. It is recommended that you define the NAT rules before you enable them on this screen.

Figure 6.16 NAT rules enable screen.

NAT Transparency The previous section described how the VPN Concentrator performs NAT and PAT services for IP networks connecting to the concentrator. Performing NAT in the VPN Concentrator or IPSec gateway is not problematic because NAT can occur prior to any encryption or authentication services for the IP packet. It is common, however, to have an existing firewall or router on the concentrator or client’s network providing these NAT or PAT services. When this is the case, IKE and ESP may not work because the device’s NAT or PAT translations manipulate data payloads and offset any data authentication because significant bits are changed in the original IP header. Additionally, if the tunnel endpoints are using ESP in tunnel mode, the packet’s original IP header is encrypted and cannot be translated by a intermediary device because it cannot perform the necessary decryption to see the original IP header. What’s more, depending on the authentication method used, certain IKE authentication methods use the peer’s IP address for authentication identity data. Because this IP would be translated by a NAT-capable gateway, authentication fails for IKE negotiations and the tunnel is never established. A work-around for this predicament is to encapsulate IPSec and IKE messages in UDP or TCP packets that can be passed by those translating devices. Cisco supports IPSec over TCP and UDP NAT Transparency for remote access software and hardware clients. Starting with version 3.6, Cisco also supports the ratified UDP encapsulation standard of NAT Traversal (NAT-T), which uses the default UDP port of 4500. NAT-T can be applied to hardware and software clients’ remote

125

126 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

access sessions, as well as LAN-to-LAN tunnels between IPSec gateways. NAT Traversal enables the clients or concentrator to detect automatically a NAT- or PAT-capable device along the tunnel’s path by sending a hash of their IP addresses and ports during IKE phase 1. If a receiving device performs the same hash on the IKE peer’s IP address and they do not match, the devices assume that a translation has occurred in transit. When a connecting client supports a NAT Transparency feature, the VPN 3000 Concentrator prefers IPSec over TCP first, then NAT-T, followed by IPSec over UDP. NAT Transparency does not work behind proxy server devices performing NAT and PAT translations.

To configure IPSec over UDP for remote access hardware and software clients, enable IPSec over UDP and specify a UDP port number (default is 10,000) for individual groups or the base group in the Client Config tab of the User Management screen (see Chapter 4). IPSec over TCP and NAT-T configurations differ from IPSec over UDP because these configuration are applied system-wide to the concentrator, as opposed to a group-by-group basis. In the Configuration | System | Tunneling Protocols | IPSec | NAT Transparency screen in Figure 6.17, you are given the options to configure these two functions. Check the appropriate boxes for the desired functionality. Additionally, TCP encapsulation enables you to support up to 10 ports. Be careful not to use any common well-known application ports such as 20, 21, 23, 25, 80, 443, and so on. TCP over UDP and NAT-T is applied as a system-wide configuration, as opposed to IPSec over UDP’s group-by-group configuration.

Figure 6.17 NAT Transparency configuration screen.


IPSec LAN-to-LAN Tunnels The VPN 3000 Concentrator can establish a LAN-to-LAN (site-to-site) tunnel to another concentrator, firewall, router, or compliant IPSec gateway. With this configuration, you can create a secure VPN bridge between your LAN and an intranet remote branch office or an extranet partner’s LAN. By utilizing the Internet as the connectivity medium, you can provide a secure, scalable, and inexpensive connection to the remote sites, which you cannot do with legacy solutions such as leased lines or Frame-Relay. The CSVPN exam has a tendency to focus on LAN-to-LAN tunnel establishment. It is recommended that you understand the steps involved in initiating a LAN-to-LAN session, in addition to applying advanced features (RRI, bandwidth management, filters, NAT-T, and NAT rules) to these tunnels.

The configuration for LAN-to-LAN tunnels is straightforward. In the Configuration | System | Tunneling Protocols | IPSec | LAN-to-LAN screen, you are presented with a window to add, modify, copy, or delete a LAN-to-LAN session. Figure 6.18 illustrates the Add or Modify screen. The top section of the LAN-to-LAN screen deals with the parameters for the tunnel itself. Here, your LAN-to-LAN configuration process begins with naming the LAN-to-LAN session and deciding to which interface the LAN-to-LAN connection is being established (typically the public interface). Starting with software release 4.0, you can specify whether the concentrator can originate IKE tunnel connections, answer IKE tunnel connections, or both (bi-directional). These new options enable the concentrator to maintain backup LAN-to-LAN peers for site-to-site tunnel redundancy. This feature differs from concentrator redundancy with VRRP because the concentrators do not have to be running in parallel on the same LAN. In fact, VRRP must be disabled if you want to use this feature. What’s more, unlike VRRP, you can enable concentrator load balancing while maintaining redundancy for the LAN-to-LAN sessions. If the concentrator is configured for Originate-Only, it plays the initiating role in a backup LAN-to-LAN configuration in which it only establishes LAN-to-LAN sessions by cycling through the defined LAN-to-LAN peers until a connection is made. The central location with multiple concentrators will be configured as AnswerOnly, in which it only answers LAN-to-LAN session connections, rather than initiates them. The default Connection Type value is Bi-directional, which signifies a non-redundant network in which the concentrator can initiate or receive LAN-to-LAN tunnel requests.

127

128 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 6.18 LAN-to-LAN configuration screen.

The Peer List field should contain the public IP address of the device to which you are connecting. If your network is designed in such a fashion that there are several backup concentrators at the central site and you chose Originate-Only in the Connection Type pull-down menu, you can specify up to 10 LAN-to-LAN peers on the remote concentrator. You use the next sets of fields to define the IKE negotiation parameters for this site-to-site tunnel. Namely, you need to decide whether you are using preshared keys or digital certificates for authentication. If using preshared keys, be sure to select None (Use Preshared Keys) in the Digital Certificate drop-down box. Also, be sure to key in the matching preshared key in the designated field on this screen. When using digital certificates for authentication, choose the installed identity certificate you want to use, followed by whether you want to send the entire certificate chain or not. The remaining


IKE fields are used to determine the IPSec SA that you are proposing, as well as the IKE SA negotiation proposal. The following fields determine whether you want to enable many of the advanced features discussed in this chapter. Specifically, you can apply a defined filter simply by choosing it out of the drop-down list. Similarly, you can apply any LAN-to-LAN bandwidth policies that you have previously configured. In instances where the VPN Concentrator is behind a device that is performing some NAT or PAT functionality, you can enable NAT Traversal (NAT-T) to encapsulate IPSec protocols in UDP . LAN-to-LAN tunnels establish connectivity between the two locations, but how does each side know about the private networks behind the IPSec devices? You must implement some routing mechanism to tell each IPSec device about its peer’s private networks. These mechanisms can take the form of static routes or dynamically learned routes. In the VPN 3000 Concentrator, the configurations for a routing mechanism entails the following options: ➤ None—Do not enable any special routing mechanisms. This option

implies that a static route has been configured in the Configuration | System | IP Routing | Static Routes page in which routes to the peer’s private networks have been defined. ➤ Reverse Route Injection—This enables you to define a LAN-to-LAN RRI

in which the concentrator injects its private network addresses into the remote concentrator’s routing table. This option requires RIP or OSPF running on the concentrator’s interface(s). ➤ Network Autodiscovery—By utilizing RIP, both sides of the LAN-to-LAN

tunnel can discover their neighbor’s networks. You must enable RIP on both concentrators’ private interfaces for this function to work. If selected, you do not need to configure the remaining items on the screen. Network Autodiscovery requires RIP to be configured on each of the concentrator’s private interfaces.

The remainder of the LAN-to-LAN configuration page deals with specifying the source and destination IP networks that will use this LAN-to-LAN tunnel. In the remaining fields, you can define the local internal network and the remote’s internal network by using a predefined network list or by specifying the addresses and wildcard masks in their respective fields. It is imperative to note that the networks defined in these fields should be mirrored in

129

130 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the peer’s concentrator or other IPSec-compliant device, as demonstrated in Table 6.2. Table 6.2 LAN-to-LAN Network Example

Local IP Address

Concentrator A

Concentrator B

10.0.0.0

172.16.0.0

Local Wildcard Mask

0.255.255.255

0.0.255.255

Remote IP Address

172.16.0.0

10.0.0.0

Remote Wildcard Mask

0.0.255.255

0.255.255.255

At the completion of the LAN-to-LAN configuration page, the VPN 3000 Concentrator automatically adds a L2L rule to the concentrator’s public interface filter to apply IPSec to the specified source and destination networks. In addition, the concentrator automatically creates an internal group named after the IP address of the peer, as well as an IPSec Security Association for the LAN-to-LAN tunnel.

IPSec LAN-to-LAN NAT LAN-to-LAN NAT rules are required in instances where both private networks of the LAN-to-LAN endpoints contain overlapping networks as depicted in the diagram in Figure 6.19. In this scenario, devices on each private network do not know how to respond to communicating devices on the remote network because the address is the same as that of their private network. To correct this problem, both sides must translate the internal networks so that the devices can discern between both networks. The configuration for this feature can be found at the Configuration | Policy Management | Traffic Management | NAT | LAN-to-LAN Rules | Add screen. Here you can choose whether you want to perform static 1:1 mappings for internal IP addresses, dynamic translations from a pool of IP addresses, or PAT. After a NAT implementation is chosen, you must define the source network and associate it with the translated network by filling the fields with their respective networks and wildcard mask. Furthermore, you have to indicate the remote networks to which this translation is to be applied. All remote networks are specified by default as determined by the IP address of 0.0.0.0, with a wildcard mask of 255.255.255.255. In the example depicted and configured in Figure 6.19, to overcome the overlapping perplexity, both sides have created a static NAT rule for the internal networks. By translating the identical networks to 172.16.30.0/24 on this concentrator and translating the peer’s private network to 172.16.31.0/24 on the remote concentrator, devices can discern between their local private network and the communicating peers on the remote private network.

. . . . . . . . . . . . . . . . . .VPN . . 3000 . . . Concentrator . . . . . . . .Advanced . . . . . Features . . . . .Configuration . . . . . . . When presented with overlapping networks, it is necessary to perform translation on both sides of the VPN tunnel.

Figure 6.19 LAN-to-LAN NAT Rule configuration screen.

Similar to interface NAT rules, LAN-to-LAN NAT rules must also be enabled on the Configuration | Policy Management | Traffic Management | NAT | Enable screen as displayed back on Figure 6.16. Additionally, it is important to note that when creating the IPSec LAN-to-LAN tunnel, be sure to use the translated networks in the source and destination parameters as opposed to the actual matching private networks.

Summary The concentrator’s versatility is exemplified in all the advanced features that it supports. One such feature is the ability to filter protocols, hosts, and networks. To define filters on the concentrator, you first have to define a set of rules that can then be applied to a filter. The filter processes each rule until a match occurs. If there are no matching criteria in the rules, the concentrator either permits or denies the packet based on the setting in the filter. When connecting to other networks, the VPN 3000 Concentrator must have means to reach the remote networks. To enable this functionality, the VPN 3000 Concentrator can have static or dynamic routes populate its routing

131

132 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

table. Static routes are manual entries that specify the destination network and the interface that packets must exit to reach that network. For the concentrator to forward packets that are not on a network directly connected to its interfaces, you must specify a default gateway, which is usually the Internet router’s Ethernet interface. The VPN Concentrator supports OSPF and RIP for dynamic routing protocols. These parameters are primarily configured on the interfaces that will be participating in the routing protocol. When several concentrators are running in parallel, you can choose to enable either concentrator redundancy or load balancing. In both features, clients connect to a group IP address that is maintained by the master of the cluster. Concentrator redundancy uses the VRRP protocol to determine whether the master concentrator is no longer operational. Load balancing uses the VCA protocol to report the utilization of all the concentrators. When clients connect to the group IP address, the master can send a redirect message in the IKE establishment phase that redirects the client to connect to concentrators with less load capacity. Both concentrator redundancy and load balancing cannot be enabled on the same concentrator. Reverse route injection is a method to populate the concentrator’s routing table with connected networks to distribute that routing update to downstream routing devices on its interfaces. LAN-to-LAN peers and Cisco 3002 Hardware Clients in Network Extension mode can inject their entire internal network into the concentrator’s routing table. Cisco 3002 Hardware Clients in Client mode and Cisco Unity clients populate their internal IP address that was assigned by the concentrator into the concentrator’s routing table. You can also manually configure hold-down routes in the concentrator that will always be injected into the routing table. In VPN Concentrators running software version 3.6.1 and up, you can implement bandwidth management for groups, interfaces, and LAN-toLAN sessions. To use this advanced function, you must define a bandwidth policy that can reserve a determined amount of bandwidth or police the tunnel to have a maximum bandwidth cap. LAN-to-LAN tunnels are used to connect the concentrator’s LAN to another concentrator, firewall, router, or other IPSec-compliant device. With LAN-to-LAN tunnels, you can use preshared keys or certificates for peer authentication. In addition, these tunnels can contain filters, bandwidth policies, and NAT-T. LAN-to-LAN routing features support RRI, in addition to a versatile function known as Network Autodiscovery. This convenient feature automatically discovers the neighbor’s networks by using RIP. To configure LAN-to-LAN tunnels, you have to identify the peer’s public IP address (or IP addresses if using backup LAN-to-LAN). In addition, you


have to define the local and remote inside IP addresses for which this LANto-LAN session is utilized. The remote peer’s internal network configuration should be the inverse of your configuration. When IP addresses that traverse the concentrator need to be translated, the concentrator can perform PAT and translate those internal IP addresses to the public interface’s IP address. In addition, you can define NAT rules for the concentrator if you are connecting to a LAN-to-LAN network that is using overlapping IP networks. In instances where the concentrator and clients are behind a NAT- or PATcapable device, the VPN 3000 Concentrator is capable of encapsulating IPSec messages in UDP or TCP. In version 3.6, the concentrator also can support the ratified standard of UDP- encapsulated NAT—called NAT Traversal—which uses port 4500.

133

134 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exam Prep Questions Question 1 When using concentrator redundancy, which of the following are true? (Choose all that apply.) ❑ A. LAN-to-LAN tunnels are automatically reconnected when the master concentrator fails. ❑ B. Remote access client sessions are automatically reconnected when the master concentrator fails. ❑ C. It uses VRRP to determine whether the master is down. ❑ D. It uses VCA to determine a master concentrator failure.

A and C are correct. Using VRRP, the concentrator can determine whether the master concentrator fails. When a failure occurs, LAN-to-LAN sessions are automatically saved. Remote access clients need to reconnect. Answer B is incorrect because only LAN-to-LAN tunnels are reconnected. Answer D is incorrect because VCA is used for concentrator load balancing, not for concentrator redundancy.

Question 2 The CEO of the company is complaining that too many users are using too much bandwidth on the VPN Internet link. What can you do to remedy this? (Choose two.) ❑ A. Change the bandwidth on the concentrator to reflect the Ethernet link speed. ❑ B. Create a bandwidth policy that assigns the CEO’s group a reserved amount of bandwidth. ❑ C. Create a bandwidth policy that polices the rest of the users on the interface. ❑ D. Have the CEO connect to the external interface instead of the public interface.

Answers B and C are correct. If you define bandwidth policies to reserve traffic and limit others, the CEO receives a dedicated amount of bandwidth. Answer A is incorrect because the link speed should reflect the Internet link speed rather than the Ethernet’s bandwidth. Answer D is incorrect because the CEO would be connecting through the public interface, which is attached to the Internet.


Question 3 What routing options are available for the VPN Concentrator? (Choose three.) ❑ A. RIP ❑ B. OSPF ❑ C. EIGRP ❑ D. ISIS ❑ E. BGP ❑ F. Static routes

Answers A, B, and F are correct. The VPN Concentrator supports RIPv1 and RIPv2, OSPF, and static routes. Answers C, D, and E are incorrect because the VPN 3000 Concentrator does not support those particular routing protocols.

Question 4 What NAT transparency feature is a ratified implementation of encapsulating IPSec into UDP encapsulations? ❍ A. RRI ❍ B. TCP NAT Transparency ❍ C. NAT-T ❍ D. NAT-UDP

Answer C is correct. NAT Traversal is a ratified implementation of encapsulating IPSec in UDPusing port 4500. Answer A is incorrect because RRI is not a form of NAT transparency. Answers B and D are incorrect because they are not actual NAT transparency features.

Question 5 What is a requirement for LAN-to-LAN Autodiscovery to work? ❍ a. OSPF on both interfaces ❍ b. Static routes ❍ c. Concentrator version 2.5 ❍ d. RIP on both private interfaces

135

136 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer D is the correct answer. For LAN-to-LAN to work correctly, RIP must be enabled on both private interfaces of the VPN Concentrators. Answers A and B are incorrect because Network Autodiscovery relies on RIP, not OSPF or static routes. Answer C is incorrect because Network Autodiscovery was not available in VPN 3000 Concentrator release 2.5.

Question 6 Which are true regarding filters? (Choose two.) ❑ A. They can be applied to authentication servers. ❑ B. Filters are added to rules. ❑ C. Rules are added to filters. ❑ D. Filters can be applied to LAN-to-LAN tunnels.

Answers C and D are correct. Rules are created or modified and then applied to filters. These filters can be assigned to LAN-to-LAN tunnels, internal groups, and interfaces. Answer A is incorrect because filters cannot be applied to authentication servers. Answer B is incorrect because the reverse is true: rules are applied to filters.

Question 7 Which of the following are true regarding NAT Transparency? (Choose all that apply.) ❑ A. NAT-T encapsulates IPSec and IKE in UDP using port 4500. ❑ B. When a clients connects to the concentrator, the connection will use IPSec over TCP before using NAT-T. ❑ C. NAT-T is applied system-wide in the concentrator’s configuration. ❑ D. IPSec over UDP is applied on a group-by-group basis.

Answers A, B, C, and D are correct. NAT Transparency can take the form of one of the following: IPSec over TCP, IPSec over UDP, or the ratified implementation of IPSec over UDP known as NAT-T. NAT-T uses UDP port 4500 and is applied system-wide, along with IPSec over TCP. IPSec over UDP uses port 10,000 by default and is configured on a group-bygroup basis on the Client Config tab in the User Management configuration pages. When a client attempts to connect to the concentrator by using a form of NAT Transparency, the concentrator prefers IPSec over TCP first, followed by NAT-T, and lastly IPSec over UDP.


Question 8 When presented with an overlapping network across a LAN-to-LAN session, where must LAN-to-LAN NAT occur? ❍ A. On both concentrators on each side of the LAN-to-LAN tunnel. ❍ B. Only on the central concentrator. ❍ C. Only on the remote concentrator. ❍ D. LAN-to-LAN NAT will not solve this problem and one of the private networks needs to be renumbered.

Answer A is correct. LAN-to-LAN NAT is required on both endpoints on each side of the LAN-to-LAN tunnel. For example, if both networks contain the 10.2.2.0/24 private networks, when traffic is originated from one of the 10.2.2.0 networks, the recipient of that traffic assumes that the sending device is located on its private network and does not return the traffic to the concentrator to be encrypted. Answers B and C are incorrect because the recipient of the data cannot distinguish between the sender and the receiver’s network when translation occurs on only one of the endpoints. Answer D in incorrect because LAN-to-LAN NAT solves this problem, which does not mandate any renumbering of the actual workstations.

Question 9 If your current network design is already using concentrator load balancing, how can you achieve LAN-to-LAN session redundancy? ❍ A. Because concentrator load balancing is enabled, you cannot achieve any redundancy for any sessions. ❍ B. You can define backup LAN-to-LAN peers in the LAN-to-LAN configuration. ❍ C. Enabling VRRP allows automatic redundancy for LAN-to-LAN tunnels. ❍ D. You can define backup LAN-to-LAN peers in the group configuration.

Answer B is correct. LAN-to-LAN redundancy can occur in software release 4.0 and up when you configure backup LAN-to-LAN peers and you specify the Connection Type as Answer-Only if you are a redundant concentrator or Originate-Only if you are a remote concentrator initiating the LAN-toLAN tunnels in the LAN-to-LAN configuration page. Answer A is incorrect because you can achieve LAN-to-LAN redundancy with backup LAN-toLAN tunnels. Answer C is incorrect because VRRP cannot be running while VPN Concentrator load balancing is enabled. Answer D is incorrect because

137

138 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the configuration for backup LAN-to-LAN tunnels occurs in the LAN-toLAN configuration page, not the group configuration pages.

Question 10 Which three parameters are added after you create a LAN-to-LAN session? (Choose three.) ❑ A. IPSec SA ❑ B. IKE proposal ❑ C. Internal group ❑ D. L2L rules ❑ E. L2L filter

Answers A, C, and D are correct. After creating a LAN-to-LAN session, the VPN Concentrator automatically creates an internal group named after the IP address of the LAN-to-LAN peer. Additionally, an L3L IPSec SA is created to encompass the configuration for LAN-to-LAN connectivity. Finally, a set of L2L rules are added to the public interface filter to apply IPSec to the source and destination networks designated in the configuration of the LAN-to-LAN tunnel. Answer B is incorrect because an IKE proposal is not created. Answer E is incorrect because L2L rules are created and applied to the public interface filter. An actual L2L filter is not created.


Need to Know More? For product literature on all the configuration features of the VPN 3000 Concentrator family, go to http://www.cisco.com/univercd/cc/ td/doc/product/vpn/vpn3000/. Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003.

139

7 Software Client Firewall Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Are You There (AYT) ✓ Central Protection Policy (CPP) ✓ Cisco Integrated Client (CIC) ✓ Zone Labs Integrity Server (IS) ✓ Stateful inspection

Techniques you’ll need to master: ✓ Understanding the requirements for a firewall client ✓ Determining the difference between optional and required firewall policies ✓ Knowing the aspects of the Stateful Firewall (Always On) policy ✓ Identifying the policies that are supported by various firewall vendors ✓ Understanding the different policy features supported by the VPN 3000 Concentrator

142 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

With all this talk about VPN security, it is hard to imagine that any additional security is necessary. Well, the cliché goes that a chain is only as strong as its weakest link. Now imagine your company’s building is suspended from that chain, and it is the only thing that is keeping it from collapsing and crumbling. Would you want to ensure that every link in that chain is strong enough? Albeit a little drastic, the analogy rings true to security practices. When should you feel secure enough to let your guard down? The answer is never. Security is always an ongoing process and all aspects of security must be considered. To this point, we have been primarily discussing how to fortify the central location with the VPN concentrator. This also includes securing the remote access connections into that central location. One aspect we did not consider yet is securing the clients themselves. Any workstation employing a VPN client is susceptible to Trojan horses or other malicious services that can launch an attack or give access to secure data. If we cannot protect the clients that we trust, then they are a liability to become the weak links in our overall security chain. This chapter looks at the reasons clients can become a danger to your security implementation. After helping you identify the problem, it then provides a look at the solutions you can offer those clients in terms of firewall protection. In addition, it looks into the VPN Concentrator’s unique ability to enforce firewall policies and to interact with these firewall clients.

Split Tunneling Security Recall from Chapter 4, “Cisco VPN 3000 Remote Access Preshared Key Configuration,” that an administrator can enable connecting clients to perform split tunneling. This ability allows the client to send encrypted traffic destined for the remote end of the tunnel. In addition, data destined for the outside world or the local LAN can bypass the encrypted tunnel and be sent as clear text out to the LAN or the Internet. If the client were somehow to be compromised by an attacker while the tunnel was still connected, an attacker could possibly use the client as a transport to attack the central location. A likely deterrent for this type of situation would be to install a software firewall client on the client’s workstation. With the firewall in place, you add another layer of defense that attackers would need to break through to achieve their goals.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Software . . . . .Client . . . Firewall . . . . Features . . . . .

Four Firewall Features The Cisco VPN Concentrator can detect and interact with several popular firewall software vendors, such as Zone Labs, NetworkICE, Sygate (concentrator software release 4.0), and Cisco’s Unity client with the Cisco Integrated Client (CIC) firewall. With the Cisco VPN Concentrator working in conjunction with the firewall clients, you can fortify your VPN’s security. As the administrator, you can decide whether you want to implement this feature, and determine what level of firewall policy you wish to enforce from the concentrator. At the time of this writing, this feature is supported only on clients running on Microsoft Windows platforms.

By default, the VPN Concentrator does not enforce any firewall policies to connecting clients. If you decide to turn on this feature, you are given two different options. The first option is to require the presence of an active firewall for connecting clients. If this option is selected, the VPN Concentrator detects whether the assigned firewall is present when the client is establishing its tunnel to the concentrator. If the firewall client is not present or active when connecting to the concentrator, the VPN tunnel is terminated. An alternative selection is to enable the optional firewall setting. This option is similar to the first; however, the firewall is not mandatory for a connection. This allows the administrator to be slightly lax in firewall enforcement in instances when not all connecting clients support the chosen firewall implementation, or the company might be in a state of transition to a particular firewall software feature set. If the connecting client does not have the specified firewall client, the concentrator sends the client a warning notification, as depicted in Figure 7.1. After the client has established a connection, the concentrator can implement one of three policy features. The first policy constantly seeks out the connected client and reaffirms that the firewall is still active. This feature, called Are You There (AYT), performs this function by polling the client with AYT messages sent every thirty seconds. If the client’s firewall becomes inactive, the VPN Concentrator detects the firewall state as inactive and terminates the tunnel session.

143

144 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 7.1 Unity client firewall warning message.

In the AYT feature, the firewall client’s parameters can be configured and manipulated by the end-user. However, to maintain central control and administration of the client’s firewall parameters, Cisco offers another feature in which the policy is pushed down to the client from the VPN Concentrator at the central office. This pushed policy, known as Central Protection Policy (CPP), involves defining traffic rules and applying them to a filter (discussed in Chapter 6, “Advanced VPN 3000 Feature Configuration”). After this filter is created, you can apply it to the policy and enforce it when members of this policy’s group connect to the concentrator. As a result, when split tunneling is enabled, you, as the administrator, can determine what networks and protocols can communicate with the client. CPP is also known as “Cisco Pushed Policy.”

A third policy scenario that the Cisco VPN 3000 Concentrator supports is to utilize a Zone Labs Integrity Server (IS) to enforce and maintain the firewall policies. This feature offloads the firewall monitoring responsibility to the IS server. After you define the server in the Configuration | System | Servers | Firewall configuration page, the VPN 3000 Concentrator and the IS server can communicate with each other. If for any reason the IS server requires a tunnel termination, it can interact with the concentrator and instruct it to terminate the session.


There is another policy integrated with the Cisco Unity Client that is not controlled or pushed from the VPN 3000 Concentrator. The Stateful Firewall (Always On) policy can be enabled on the individual Cisco VPN Unity clients. With this policy, the Unity Client performs a stateful inspection of incoming and outgoing packets, which blocks all incoming packets that are not tunneled or a response to outgoing requests. Stateful inspection is a packet filtering technology in which session connection information (IP, ports, flags, and sequence numbers) is logged and maintained by a state table. All traffic session data is compared against the state table. If the connection information does not match the entries in the state table, the packets are dropped. If you enforce this policy on the clients themselves, attackers cannot initiate a connection to the client to compromise the device. The only exception to this rule is that incoming DHCP and ESP traffic is allowed to penetrate the stateful firewall to enable DHCP and IPSec functionality. In addition, this stateful firewall is always active and protects the client regardless of VPN tunnel connectivity. This option provides stringent security; however, it is not very flexible because you cannot configure additional incoming traffic to be permitted.

Firewall Parameters in VPN 3000 Concentrator The configuration for the Firewall client parameters resides in the Configuration | User Management | Group or Base Group Client FW tab. As illustrated in Figure 7.2, the Firewall Setting configuration at the top of the screen determines whether an active firewall is required when connecting. By default, the firewall policy feature is not enabled. If you want to ensure firewall security, choose the Firewall Required option. Recall that this option mandates the presence of the chosen firewall when users belonging to this group are initiating a session. If you want a more lenient approach, choose the Firewall Optional option. This option sends a notification to the connecting user reporting that the firewall is not detected on the client and should be installed and activated. After establishing the firewall settings, you must select the firewall vendor and product that the users in the group contain. The concentrator supports the following vendors and products:

145

146 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 7.2 Client FW Configuration tab.

➤ Cisco—The VPN Concentrator supports the Cisco Integrated Client

(CIC) Firewall that is incorporated in the Cisco Unity Client. ➤ NetworkICE—The BlackICE Defender/Agent interoperates with the

Cisco VPN 3000 Concentrator to support AYT policies. ➤ Zone Labs—Zone Labs’ ZoneAlarm and ZoneAlarm Pro support both

AYT and CPP policy. ➤ Sygate—Starting with Cisco VPN Concentrator software release 4.0, the

VPN Concentrator also supports AYT with the Sygate Personal Firewall and the Sygate Personal Firewall Pro. In addition, Sygate’s Enterprise Security Agent also supports the Cisco AYT policy feature. ➤ Custom—Designed for future use, the Cisco Concentrator lets you

define a custom firewall based upon the Vendor ID and the Product ID. This feature currently is not used because all supported firewall vendors and products are in the list. Sygate’s products are recent additions to the VPN 3000 Concentrator’s supported firewall products. At the time of this writing, the Seagate products are not considered a testable item and should not be considered. The mention of this product is for future exam revisions.


The final configuration step is to decide which firewall policy you want to enable. Certain vendors and products can support only specific policies. Table 7.1 outlines all the products and their supported firewall features. Table 7.1 Firewall Vendor Supported Policies Firewall Product

Are You There (AYT)Policy

Cisco CIC

Zone Labs Integrity Server (IS)Policy

X

NetworkICE BlackICE

X

Zone Labs ZoneAlarm/Pro

X

Zone Labs Integrity Seagate

Central Protection Policy (CPP)

X X

X

It is imperative to remember which policy feature each vendor supports.

With the exception of the CIC client and the Zone Labs Integrity client, most vendors support the AYT feature. With this feature, the VPN Concentrator can poll the client every 30 seconds to ensure that the firewall is installed and active. If it does not detect a client with the AYT messages, the tunnel will be terminated. If you want to use this policy, select the policy defined by the remote firewall (AYT) field. The Zone Labs ZoneAlarm products and the Cisco CIC client can inherit rules pushed from a defined filter in the concentrator. If you want to utilize the CPP policy, select the Policy Pushed (CPP) field, followed by the filter that you want to push down to the clients. The VPN 3000 Concentrator contains a built-in firewall filter called “Firewall Filter for VPN Client.” This filter states that all incoming traffic is blocked and all outgoing traffic is allowed (similar to the stateful firewall on the VPN Unity Client). The final available policy is the Policy from Server field. This field should be selected when integrating a VPN 3000 Concentrator with an enterprise Zone Labs Integrity Server. Be sure to define this firewall server in the Configuration | System | Servers | Firewall page and change the default port setting if you have done so on the IS server.

147

148 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Firewall Scenarios To reinforce the topics discussed in this chapter, it’s a good idea to look into some sample configurations. The following sections look into three scenarios in which the firewall policy is not enabled, the firewall is using the AYT policy, and the firewall is using the CPP policy.

No Firewall Enforcement In the scenario depicted in Figure 7.3, the central VPN Concentrator has not enabled any policies from the central location. It is imperative to install a personal firewall or utilize the Stateful Firewall (Always On) option in the Cisco VPN Client to ensure that this station does not become a liability in the overall security infrastructure. This type of administration enables the end-user to use better judgment in provisioning security. In the example, the stateful firewall is enabled and only ESP and DHCP traffic is allowed into the client. In addition, the client also receives traffic that is being transported over the secure tunnel. All other traffic is dropped. Thus, when the attacker from the Internet attempts to compromise the client, the stateful firewall inspects its state table. Because there is no match for the connection session initiated from the attacker, the packets are discarded. No other traffic parameters can be set in this example because the stateful firewall cannot be modified.

Internet

Figure 7.3 No Firewall policy scenario.


Firewall AYT Policy Scenario In a firewall AYT policy, a firewall is required for connectivity and the AYT policy feature is implemented as shown in Figure 7.4. Every 30 seconds, the VPN 3000 Concentrator polls the BlackICE client to ensure that the firewall is still active. If the client becomes inactive, the concentrator terminates the tunnel. All security traffic parameters are still defined by the end user because there is no central policy being sent to the client.

Internet

ISP IP: 172.16.1.2

AYT 30 Seconds

Public IP: 192.168.1.101

IPSec

BlackICE Firewall Client Internal Tunnel SA: 10.1.1.100

Internal Tunnel DA: 10.2.2.2

Figure 7.4 AYT firewall policy scenario.

Firewall CPP Policy Scenario Figure 7.5 entails the final scenario, in which the VPN 3000 Concentrator is pushing a policy to the ZoneAlarm or CIC client. In this scenario, a rule set has been defined and assigned to a created filter. The rules of this filter are as follows: ➤ All inbound and outbound traffic from 10.2.2.0/24 to the client’s net-

work of 10.1.1.0/24 is permitted because it is tunneled. ➤ Permit all inbound connections that use TCP port number 110 from

the POP3 email server. ➤ Any Out (forward/out) is added to the filter to allow outgoing connec-

tions from the client.

149

150 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ The default rule for this filter is to drop all other traffic when a match is

not made. When this firewall policy is pushed to the client, it creates an access list on the client similar to a router IOS access list. Packets flowing through the client are compared against the rules in the CPP filter. When a match occurs, the rest of the rules are not compared. If a match does not occur, the default action specified on the filter is applied to the end of the list. In this example, the client can send and receive tunneled traffic, as well as send outgoing clear text traffic to the Internet (with split tunneling enabled). The only allowed incoming protocol coming from the Internet is POP3 traffic. All other traffic is dropped.

$% &'

Internet

!

"

" #

Figure 7.5 CPP firewall policy scenario.

Summary When clients are connecting to the central site and split tunneling is enabled, it is possible for them to be compromised by attackers. When this occurs, the client’s session can become a transport for attackers. To prevent any of these occurrences, personal firewall clients should be installed and activated on the individual clients.


The VPN 3000 Concentrator can enforce a firewall policy with vendors such as Cisco, NetworkICE, Zone Labs, and Sygate. When this policy is enabled, you can either require that the firewall be present when connecting or make it optional. If the policy is required, the assigned policy checks for the existence of the assigned firewall vendor. If it does not detect the client, the tunnel is not established. When the Firewall Optional setting is chosen, the VPN Concentrator allows clients to connect if the firewall is not detected; however, it sends a notification message to the client. The Cisco VPN Unity Client supports its own stateful firewall that can be enabled from the client itself. This firewall allows DHCP and ESP, but all other incoming traffic is blocked unless it originates from the tunnel. This is a robust firewall, but it is not configurable. The VPN Concentrator can support three different types of firewall policies. The AYT policy entails the concentrator sending an AYT message every 30 seconds to ensure that the firewall is still present. When the firewall is not detected, the tunnel is torn down. The CPP policy lets you define rules and filters to be pushed down to individuals in the group. Finally, the Zone Labs Integrity Server can work in conjunction with the VPN Concentrator to ensure consistent policies and enforcement in the enterprise workplace.

151

152 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exam Prep Questions Question 1 Which of the following firewall policies can be enforced from the VPN 3000 Concentrator? (Choose three.) ❑ A. SEP ❑ B. CIC ❑ C. IS ❑ D. AYT ❑ E. CPP

C, D, and E are correct. IS server policies, AYT, and CPP are all definable from the concentrator. Answer A is incorrect because SEP is an encryption accelerator module. Answer B is incorrect because CIC is the client’s internal firewall and is not a policy that is implemented on the concentrator.

Question 2 Which of the following are steps in enforcing a CPP firewall policy? (Choose all that apply.) ❑ A. Create a rule and assign it to a filter. ❑ B. Change the AYT timer to something other than the default polling interval. ❑ C. Select the filter in the “Policy Pushed” field. ❑ D. Configure the client to accept CPP policies.

Answers A and C are correct. To configure a CPP firewall policy, you must first define the policy by creating rules and assigning them to a filter. After this step is finished, you must choose that filter in the Policy Pushed field. Answer B is incorrect because the AYT time is not utilized when using CPP as a firewall policy. Answer D is incorrect because no configurations are necessary on the client if it is to interact with the concentrator’s firewall policy.


Question 3 Which three incoming protocols are allowed through the Cisco Client’s Stateful Firewall (Always On) policy? (Choose three.) ❑ A. RIP ❑ B. DHCP ❑ C. ESP ❑ D. Tunneled IP traffic ❑ E. VRRP ❑ F. HTTP

Answers B, C, and D are correct. The Stateful Firewall (Always On) policy allows only DHCP, ESP, and tunneled traffic. Answers A, E, and F are incorrect because all other traffic is dropped because there is not a rule allowing other protocols through the stateful firewall.

Question 4 The Stateful Firewall is active only when the tunnel is connected. (True or False) ❍ A. True ❍ B. False

Answer B is correct. The Stateful Firewall (Always On) policy is just that— always on. This CIC firewall, if activated, remains on whether or not the VPN session is connected. Otherwise, it would be possible for attackers to compromise the client and launch an attack when the tunnel is connected.

Question 5 Which of the following firewall vendors do not support the CPP feature? ❍ A. Cisco CIC ❍ B. Zone Labs ZoneAlarm ❍ C. BlackICE Defender ❍ D. Zone Labs ZoneAlarm Pro

Answer C is the correct answer. The BlackICE Defender does not support CPP. It supports only the AYT firewall policy. Answers A, B, and D are correct

153

154 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

because Zone Labs ZoneAlarm and ZoneAlarm Pro, as well as the Cisco CIC firewall, support the Central Protection Policy.

Question 6 Users are complaining that they cannot access Web pages from their client when connected to the main headquarters. However, the users are able to download and send email. Which of the following could be viable causes of this problem? (Choose all that apply.) ❑ A. The stateful firewall is enabled on the CIC client. ❑ B. The CPP policy is not allowing inbound and outbound HTTP traffic. ❑ C. Split tunneling is not enabled for the client’s group on the VPN 3000 concentrator. ❑ D. The user’s session has been disconnected because the AYT timer has expired.

Answers B and C are correct. If a client cannot access certain services, most likely there is a configuration error in the Central Protection Policy’s filter. Additionally, if split tunneling is not enabled, the client is forced to send all traffic across the tunnel. The central location may not have a routing configuration in place to allow tunneled traffic out of the corporate internet link. Answer A is incorrect because the stateful firewall client does not prohibit the client from initiating a TCP session for HTTP. If a session were initiated, it would be logged in the state table and subsequent packets would be permitted as long as they were similar to the state table’s information. Answer D is incorrect because HTTP traffic would traverse out the Internet connection on the client’s workstation if the tunnel were not connected.

Question 7 Based upon the following CPP firewall policy: Action

Direction

Source Address

Dest Address

Source Protocol Port

Dest Port

Forward

Inbound

192.168.1.101 Local

Any

N/A

N/A

Forward

Outbound

Forward

Inbound

Local

192.168.1.101 Any

N/A

N/A

10.2.2.0

Local

Any

N/A

Forward

N/A

Outbound

Local

10.2.2.0

Any

N/A

N/A

Drop

Inbound

Any

Local

Any

N/A

N/A

Drop

Outbound

Local

Any

Any

N/A

N/A

Forward

Outbound

Local

Any

6

Any

80

Forward

Inbound

Any

Local

6

80

Any


What will happen to Internet HTTP traffic originating from this client? ❍ A. It will be tunneled across to the 10.2.2.0 network. ❍ B. It will be forwarded out to the Internet assuming that split tunneling is enabled. ❍ C. There is no rule specifying HTTP traffic, so it will be forwarded. ❍ D. Inbound and outbound HTTP traffic will be dropped.

Answer D is correct. CPP rules act like an IOS access list. As such, the rules are processed from the top down. When a match is made, the rest of the rules are not compared. The client’s CPP rule output states that traffic to and from 192.168.1.101 and the 10.2.2.0 network will be forwarded. If a match does not occur for those four rules, the next two rules state that any traffic with any source to any destination will be dropped. Because the HTTP traffic is destined for the Internet, it does not match the first four rules; however, it does match the next two rules because the rules specify traffic for any source and any destination. Because there was a match for these rules, any subsequent rules are not processed. Thus, HTTP traffic is dropped despite the last two rules that forward HTTP traffic (TCP port 80). Answer A is incorrect because the HTTP traffic is destined for the Internet, not the 10.2.2.0 network. Answer B is incorrect because the order of the rules does not forward HTTP. Answer C is incorrect because the rules to forward HTTP exist; they are just not prioritized correctly.

Question 8 Several users are complaining that their clients cannot connect to the concentrator. They were able to connect yesterday and you have not made any password changes. However, you recently applied a firewall policy to several groups. What is the most likely cause of the problem? ❍ A. The AYT timer is expiring and the session is being disconnected. ❍ B. You configured the policy to Firewall Optional and the users do not have an active firewall on the client. ❍ C. You configured the policy to Firewall Required and the users do not have an active firewall on the client. ❍ D. The stateful firewall is blocking IPSEC-ESP.

Answer C is correct. If a client attempts to connect to a concentrator and its group has a required firewall policy, the client must have that firewall active on the client to connect. Answer A is incorrect because the clients are having trouble with connecting, as opposed to being disconnected after a duration of time. AYT disconnects a session after a period of inactivity, not upon

155

156 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

initial connection. Answer B is incorrect because the Firewall Optional setting only sends a warning message to the connecting client; it does not disconnect the session. Answer D is incorrect because the stateful firewall allows IPSEC-ESP packets through the firewall.

Question 9 Based upon the following CPP firewall policy: Source Address

Dest Address

Source Protocol Port

Dest Port

Action

Direction

Forward

Inbound

192.168.1.101 Local

Any

N/A

N/A

Forward

Outbound

Local

192.168.1.101 Any

N/A

N/A

Forward

Inbound

10.2.2.0

Local

Any

N/A

N/A

Forward

Outbound

Local

10.2.2.0

Any

N/A

N/A

Forward

Outbound

Local

Any

6

Any

23

Drop

Outbound

Local

Any

Any

N/A

N/A

Drop

Inbound

Any

Local

Any

N/A

N/A

What happens to Telnet traffic originating from this client? (Choose all that apply.) ❑ A. Telnet traffic destined for 10.2.2.0 is forwarded. ❑ B. Telnet traffic destined for 192.168.1.101 is forwarded. ❑ C. Telnet sessions out to the Internet is connected. ❑ D. Telnet sessions out to the Internet do not connect.

Answers A, B, and D are correct. In accordance with the rules of the CPP filter, all traffic (including Telnet) destined for 192.168.1.101 and the 10.2.2.0 network is forwarded. Telnet traffic (TCP port 23) can also be forwarded out from the client’s workstation; however, there is no rule allowing the return traffic to be forwarded. Without this explicit rule, a Telnet session will never be able to connect.

Question 10 How often are AYT messages sent to the firewall clients? ❍ A. Every 10 seconds ❍ B. Every 30 seconds ❍ C. Every 300 seconds ❍ D. Every 100 seconds


Answer B is correct. AYT messages are sent every 30 seconds to detect whether an active firewall exists on the client. Answers A, C, and D are incorrect because AYT messages are sent only every 30 seconds.

157

158 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Need to Know More? For product literature on Zone Labs products, please visit www.zonelabs.com. For product literature on BlackICE Defender products, please visit http://blackice.iss.net/. For product literature on Cisco Unity Client and its firewall integration, please read the Cisco VPN Client Administration Guides, located at www.cisco.com/en/US/products/sw/secursw/ps2308/products_ administration_guides_list.html.

8 Monitoring and Administration of Cisco VPN 3000 Concentrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Auto update ✓ System reboot ✓ Ping ✓ Access Control List (ACL) ✓ TACACS+ ✓ Event ✓ Event classes ✓ MIB-II

Techniques you’ll need to master: ✓ Understanding the steps to update the concentrator and the client’s software ✓ Knowing the multiple methods in which you can perform system reboots of the concentrator ✓ Recognizing the methods to limit administrator access to the concentrator ✓ Comprehending the steps required to manage files on the concentrator and swap configuration files ✓ Mastering the methods to filter and view logging events ✓ Navigating through the convenient statistics of the System Status Page ✓ Identifying the location of general statistics for common troubleshooting

160 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Recall that there are three main divisions of the concentrator’s navigation. To this point, we have been exploring the configuration options and parameters for the VPN 3000 Concentrator. This chapter focuses on the remaining two divisions: Administration and Monitoring. Administration is utilized for administrative tasks that pertain to the concentrator’s global parameters, such as access security, as well as software and configuration management. The Monitoring portion of the concentrator entails the ability to view logs and statistics for verifying functionality or troubleshooting.

Administration Parameters In the Administration division of the VPN 3000 Concentrator Manager, you can perform management and maintenance tasks that affect the entire concentrator. Access management and rights, file management, software updates, and system reboots are just some of the administrative functions that can be performed in this division of the concentrator’s navigation menus. In addition, the Administration section contains the certificate management settings discussed in Chapter 5, “Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates.” The following sections look into the majority of these tasks and explore what each administrative function provides.

Administer Sessions In the Administration | Administer Sessions screen, you are presented with general statistics for any type of session that is connected to the VPN Concentrator. As shown in Figure 8.1, the top-right corner of this page presents you with the Reset icon to clear outdated statistics and the Refresh icon to update the screen so you can see the most current statistics. Keep in mind that this screen can also contain hundreds of sessions in the tables, and sorting through them can become a daunting task. For this very reason, this page contains a pull-down menu in which you can filter the statistics based on an individual group, the base group, or all groups. Throughout your configuration of the VPN Concentrator, you may find that you need to make tunneling protocol changes that will directly affect sessions using that protocol. In those instances, the changes do not affect users that are already connected to the concentrator. To enforce those changes, you need to log out those sessions for those particular protocols so the new changes take effect when users reconnect. To address this conundrum, there

. . . . . . . . . . . . . . Monitoring . . . . . . and . . .Administration . . . . . . . .of. Cisco . . . VPN . . . 3000 . . . Concentrator . . . . . . .

are several hyperlinks under the Group pull-down menu that enable you to log out all sessions for IPSec, L2TP, PPTP, and IPSec LAN-to-LAN. Be advised, however, that if you click on one of the selected hyperlinks, there is no warning message and no way to undo this action. As such, all connected sessions for that protocol will disconnect and require reconnecting. The Session Summary table displays overall summary totals for any session that has been established to the concentrator. These session statistics are further displayed by the three separate tables for LAN-to-LAN sessions, remote access sessions, and management sessions. Each of these tables contains a hyperlink to ping the connecting device to test network connectivity, as well as a hyperlink to log out individual sessions. The LAN-to-LAN Sessions table shows tunnel statistics for all active IPSec tunnels that the concentrator is currently sustaining. The sessions are presented alphabetically by the session name. Remote Access Sessions display similar statistics as the LAN-to-LAN tunnels. These sessions are for all connected IPSec, PPTP, and L2TP clients that are currently utilizing a VPN tunnel for remote access. Because there can be quite a few of these types of sessions, the Administer Sessions page enables you to click on the table’s column to sort according to username, IP, group name, tunnel protocol, tunnel duration, client type, or received/transmitted bytes. In the example in Figure 8.1, the user, Mr. Ed, from the Not-So-Human Resources group, is assigned an internal tunnel IP address of 10.1.1.100 and has a public IP address from his ISP of 172.16.1.2 for his remote access session. The IKE negotiations have chosen AES-128 as the bulk data encryption and NAT Transparency is enabled for Mr. Ed if IPSec over UDP is allowed. Furthermore, the Remote Access Sessions output even goes so far as to display the connection duration and the Unity client version. If Mr. Ed was complaining of slow connectivity, you could click on the Ping hyperlink to verify any latency on the remote access session. What’s more, you can log out and disconnect Mr. Ed’s session if his session becomes hung or you suspect inappropriate use of the network. The Management Sessions table displays any active session to the concentrator for administrative purposes. In instances where there are several sessions with the same user (as in the admin session in Figure 8.1), the concentrator places a configuration lock on any session that follows the original one. For instance, in Figure 8.1, the admin from IP address 10.1.1.1 was the initial admin to log in to the concentrator. That admin has full privileges to do as he or she pleases; however, any successive admin logins (up to 10 by default) are allowed only read-only permissions until the original admin’s sessions has timed out or is disconnected.

161

162 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . It is a good idea to remember that only one administrator is given full rights at one time. All successive admin logins are given read-only permissions.

Be careful when logging out management sessions. You can accidentally disconnect your own session and be forced to establish another tunnel.

Figure 8.1 Administer Sessions screen.

Software Updates One of the most important administrative tasks is to keep the VPN Concentrator, as well as the hardware and software clients, up to date to support the latest available features. To achieve this, you can download the latest software versions for clients and the concentrator from Cisco’s Web page. However, you need a valid CCO login with a service contract to download the software. After the software is downloaded, the Administrative section of the concentrator’s navigation pane enables you to upgrade the concentrator’s


software code to the newer version. In addition, you can use the Administration menus to send an update message to connected clients to upgrade their own client code. Because the concentrator and client update process is such an important concept, it likely that it will be thoroughly covered in the exam. Be sure to pay close attention to the steps and syntaxes used in upgrading procedures.

Concentrator Software Update To upgrade the concentrator’s software code, proceed to the Administration | Software Update | Concentrator page. As illustrated in Figure 8.2, the screen enables you to specify the directory and filename to upload to the concentrator. There is a convenient Browse button next to the field where you can locate the file on your local machine. After you specify the location, click on the Upload button to begin the process. After the file is uploaded, you need to reboot the concentrator. Be sure to note that the file directory and filename are case sensitive. It is easiest to use the Browse button and navigate to the file located on the local workstation. Also, be sure to not carry out any configuration functions while the concentrator is uploading. It may corrupt the imaging process.

Figure 8.2 Concentrator Software Update screen.

163

164 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Software Client Updates and Hardware Auto Updates To update the hardware and software clients, the process is slightly different. The update process is actually located within the Configuration menu screens. In addition, the update process differs slightly for hardware clients versus software clients. When client software updates are configured, the software client receives a notification that includes the revision number of the software update as depicted in Figure 8.3. If the software client is not running the specified revision(s), the client can launch the HTTP URL from the notification window and download the latest version at the client’s convenience. The VPN 3002 Hardware Client shares a similar process; however, the hardware client determines whether it needs the new revision and tries to download the image from a TFTP server automatically, as soon as the notification is received. The exam refers to the VPN 3002 Hardware Client updates as auto updates because the Hardware Client automatically installs the software from the specified TFTP URL and reboots after the download is complete.

Figure 8.3 Software update notification message.

. . . . . . . . . . . . . . Monitoring . . . . . . and . . .Administration . . . . . . . .of. Cisco . . . VPN . . . 3000 . . . Concentrator . . . . . . . In the following sections, several page references of the VPN Concentrator Manger end with “Add or Modify.” Just so you understand, the actual reference ends with either value. However, as a general rule for the VPN Concentrator Manager, most Add or Modify screens are identical except for the page title. “Add” simply means you are adding a new entry, as opposed to modifying an existing entry.

To create notifications to the hardware and software clients, navigate to the Configuration | System | Client Update | Enable screen and verify that the update notification is enabled (on by default). After this is verified, proceed to the Configuration |System | Client Update | Entries | Add or Modify screen depicted in Figure 8.4. At this screen, you must input a client type (case sensitive) in the appropriate field. The client types supported are the following: ➤ Windows—All Microsoft implementations of Windows, including

Windows 9x, Me, NT4.0, 2000, and XP. ➤ Win9x—Any client currently running on Windows 95, 98, or Me oper-

ating systems. ➤ WinNT—Includes Windows NT 4.0, 2000, and XP. ➤ vpn3002—Used for update notifications for the VPN 3002 Hardware

Client. The URL must be a TFTP address. In the URL, specify the HTTP URL (Cisco Unity software clients) or the TFTP URL (3002 Hardware Client). The URL must specify the protocol, the server address, and the directory link to the file (for example, http://10.2.2.2/vpnclient-win-msi-4.0.2.A-k9.exe). The Revision field is used in the notification update to tell the client what versions can be located at the URL. (The software image’s version is located in between the dashes at the end of the filename.) You must at least specify the revision specified in the URL that pertains to the filename. In the example’s URL, http://10.2.2.2/vpnclient10.2.2.2/vpnclient-win-msi-4.0.2.A-k9.exe, the version number is 4.0.2.A. If an update message URL contains a TFTP address, it is a VPN 3002 Hardware Client auto update. If the message contains an HTTP URL, the message is for the Cisco VPN Unity client.

After you specify all the update entries, you need to send an alert to the clients to receive the notification. As depicted in the Administration | Software Update | Clients screen in Figure 8.5, you can choose to update specific groups, the base group, or all groups. It is recommended that you do

165

166 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

this update a group at a time because the concentrator limits the number of updates to batches of 10. After you click on the Upgrade Clients Now button, the notifications are sent to connected clients.

Figure 8.4 Hardware and software clients notification creation.

Figure 8.5 Hardware and software clients immediate update notification.

An alternative method for this notification is to create the update notification for specific groups in the Configuration | User Management | Groups | Client Update screen (shown in Figure 8.6). This type of update notification is useful when you have VPN 3002 Hardware Clients and Cisco Unity Clients in separate groups that are not currently connected to the concentrator. By assigning different updates to the different groups, you can ensure


that the clients receive the appropriate HTTP or TFTP URL in the update message as they log in to the concentrator.

Figure 8.6 Hardware and software clients group update notification

System Reboot Throughout the course of your administration, it is possible that you may need to reboot the concentrator (for example, when you upgrade the software version). This task can be performed at the Administration | System Reboot screen, as illustrated in Figure 8.7. On this screen, you are presented with several actions. The default is to reboot the concentrator; however, you can also bring the system to a halt so you can power it off by choosing the Shutdown Without Automatic Reboot option. This option terminates all sessions except the management sessions and prevents new users from connecting. The last action you can choose is to cancel a scheduled reboot/shutdown if you scheduled the concentrator to reboot at a designated time other than that particular moment. When the concentrator performs the reboot, the configuration may have changed and might need to be saved. The first option in the Configuration section addresses this issue by saving the configuration at the time of the

167

168 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

reboot. The default setting is to reboot without saving the active configuration. This means that any changes that were performed from the last save will be lost. The final option is useful to return the concentrator back to the factory default configuration (except the password). The Reboot Ignoring the Configuration File option reboots the concentrator and requires that you connect a console session into the concentrator to perform the Quick Configuration parameters again. Mind you, this option is not erasing your current configuration file; nevertheless, it does bypass the configuration file during the startup process. If you save your configuration after this process, that configuration is active when you reboot the concentrator. What’s more, because this option bypasses your configuration, you will no longer have an IP address assigned to the Private interface; thus, you must be physically connected to the concentrator to reconfigure your settings. If you decide to use the default setting, Reboot Without Saving the Active Configuration, the system does not prompt the administrator with any alerts or warnings concerning the configuration. As such, be mindful about the state of your active configuration when rebooting.

The last section of the Reboot screen entails when to reboot or perform whatever action you specified on the top of the screen. The default value is “Now,” which implements the action automatically. You can delay the action by a number of minutes to give proper notice to all connected users. Additionally, if you want to perform the action after peak hours, you can program the time (in 24-hour time format) to reboot or shut down. Finally, the concentrator can shut down or reboot as soon as all the sessions have been terminated. This option does not allow new users to connect and lets the currently connected users finish their session. Be sure you comprehend the different options and actions you can implement when rebooting the concentrator. It is likely that you will encounter these options on the exam.

Ping and Monitor Refresh To ensure that you have IP connectivity to other devices, you can utilize the ping utility in the concentrator. In Figure 8.8, the screen displays the Administration | Ping screen. In the address field, specify an IP address or


hostname. To ping a hostname, you must have DNS servers specified in the Configuration | System | Servers | DNS screen. Recall that you can also ping tunnel endpoints in the Administer Sessions page by clicking on the Ping hyperlink for that specific session.

Figure 8.7 System Reboot screen.

Figure 8.8 Ping screen.

When monitoring the statistics of the concentrator in the Monitoring division, you have to click manually on the refresh icon under the navigation bar to update the statistics on the screen. In the Administration | Monitor Refresh screen (Figure 8.9), you can have the VPN Concentrator automatically refresh the screen statistics after the specified number of seconds. This feature is disabled by default.

169

170 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 8.9 Monitor refresh screen.

The Four A’s: Access Rights, Administrative Accounts, ACLs, and AAA Servers A very important aspect of configuring security parameters is to secure the concentrator itself. In the Access Rights configuration menus, you are able to enforce security measures to ensure that the correct administrators are connecting to the concentrator. Furthermore, you can determine what permissions they have when they log in. The next few sections explore how to define this limited access and how to modify privileges associated with those who are logging into the concentrator for administrative purposes.

Administrators Recall that in Chapter 4 you logged into the concentrator as admin who was given full access to all configuration, administration, and monitoring services. The admin account is one of the five default accounts of administrators who are allowed access to the VPN Concentrator Manager and the only account that is enabled by default. The five administrator accounts are as follows: ➤ admin—This account is enabled by default. The admin account is given

full access to all functions of the concentrator. This is true in all cases except when multiple users log in as admin. In these instances, the first admin logged in has full permissions until his or her session is disconnected or times out. The remaining admins have only read-only privileges. ➤ config—The config account is disabled by default and has full privileges

except SNMP permissions.

. . . . . . . . . . . . . . Monitoring . . . . . . and . . .Administration . . . . . . . .of. Cisco . . . VPN . . . 3000 . . . Concentrator . . . . . . . ➤ isp—The ISP administrative account has limited functionality in config-

uration. It cannot modify the authentication parameters, change SNMP configurations, or manipulate configuration files. This account is disabled by default. ➤ mis—The mis account is exactly like the isp except it can change authen-

tication parameters. ➤ user—This is a limited account that is permitted only to view statistics

and have read-only access to all parameters. It too is disabled by default. If you want to enable and manipulate the administrator settings, click to the Administration | Access Rights | Administrators screen depicted in Figure 8.10. Here you can enable the default accounts by checking the Enabled check boxes. In addition, you can rename the default accounts if you want to create a custom account. The Administrator column to the right of the usernames enables you to define which account is the administrator, and it is the administrator who can modify the configurations on this screen (default is admin).

Figure 8.10 Administrator accounts screen.

If you want to change a user’s permissions, click on the Modify button for that particular user and change the parameters as demonstrated in Figure 8.11. In this screen, you can set the password and access rights for that user. In addition, you can associate an AAA TACACS+ access level with this user in instances where you are using TACACS+ as an authentication protocol for administrator access.

171

172 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 8.11 Administrator permission screens.

Access Control Lists (ACLs) Anybody who has access to the administrator usernames and passwords can access the concentrator. With ACLs, you can specify management stations or networks that are allowed to access the device for administration. By default, the ACL list is empty, which allows all IP addresses to gain access. This access list applies to all the management protocols that can gain access to the concentrator, including HTTP, HTTPS, Telnet, SSH, SSL, SNMP, XML, TFTP, and FTP. In the Administration | Access Rights | Access Control List | Add or Modify screen (Figure 8.12), you can specify the management workstation or network in the IP Address and IP Mask fields. If you want to specify a single station, use the 255.255.255.255 IP mask. Furthermore, be sure to specify what level of access this network or station contains. In the example shown in Figure 8.12, only management station 192.168.1.254 is given admin access to the VPN 3000 Concentrator.

AAA Servers If your company has a TACACS+ server on location, you can utilize the server to authenticate admin access to the concentrator and even specify the administrator access rights associated with the user. This parameter can be set in the Administration | Access Rights | AAA Servers | Authentication | Add or Modify screen displayed in Figure 8.13. Make certain that you specify the TACACS+ server’s IP or hostname (requires DNS). If you need to modify the port, timeout, and retry parameters, set them to match the parameters on the server. Finally, be sure to specify the shared secret password that is used as a key to encrypt/decrypt traffic between the concentrator and the TACACS+ server. If these values do not match, the TACACS+ server and the VPN 3000 Concentrator cannot communicate.


Figure 8.12 Access Control List Screen.

Figure 8.13 AAA TACACS+ Server screen.

File Management The File Management section of the Administration navigation menus enables you to view, copy, delete, and manipulate files contained in the Flash memory of the VPN 3000 Concentrator. These files are all listed in the Administration | File Management screen as shown in Figure 8.14. This screen shows you the amount of Flash memory that is in use and the amount of Flash memory free. In the table, it lists all the files that are currently stored in Flash memory in 8.3 (eight-character filename with three-character extension) filename convention. Some common files you might see are the following:

173

174 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ CONFIG—This is your current active configuration. ➤ CONFIG.BAK—This is the previous configuration that was saved

before your active configuration was saved. Every time you save your configuration, the VPN 3000 Concentrator backs up the old configuration to a .BAK file. ➤ CRSHDUMP.TXT—In cases where the concentrator crashes, it dumps

the contents of NVRAM to this Flash file. This file is useful for Cisco engineers to assist in troubleshooting a crashing concentrator. ➤ SAVELOG.TXT—Also used for debugging crashing systems, the

SAVELOG.TXT file is automatically saved when the system crashes and is rebooted. ➤ Created files (for example, MYBACKUP)—You can create files in Flash

memory by using the copy hyperlink, uploading files via TFTP or HTTP, and exporting the CONFIG file as an XML file. ➤ PKCS0003.TXT—This file may have different revision numbers; how-

ever, this is the PKCS request file used for digital certificate PKCS#10 requests. You are able to view, delete, and copy the files located in the Flash memory. For example, you can view the config file that will open another browser window. In that window, you can save the file as a .TXT file to store locally in case you want to upload the file with TFTP or HTML in the future. Additionally, you can backup your configuration to a file via TFTP, as well as export the configuration to an XML file.

Figure 8.14 File Management screen.


Swap Config File Have you ever said something and wished you could take it back? That may not work in real life, but it works just fine in the VPN 3000 Concentrator. With this utility in the Administration | File Management | Swap Configuration Files screen, you can basically “undo” a configuration. Recall that every time you save the configuration, a backup copy called CONFIG.BAK is created. With this utility, you can copy the backup file to be the active configuration again. When you enable this function, you need to reboot the concentrator to make the backup file the active boot file. In fact, the VPN Concentrator Manager immediately takes you to the Reboot screen when you initiate the file swap. Figure 8.15 illustrates the concept of the Swap Config File feature.

New Configuration

Save Config

CONFIG backup CONFIG

CONFIG.BAK

SWAP Figure 8.15 Swap Config concept.

Monitoring Menus As durable and invincible as this Cisco product may sound, there are going to be instances where you may have to do some troubleshooting and monitoring to ensure the VPN Concentrator is functioning properly. In these rare instances, you can find a plethora of statistics at your disposal in the final division of the Concentrator Manager called Monitoring. In this section, you can look at current statistics by navigating to the multiple screens and clicking the Refresh icon under the Navigation Bar or by turning on the Monitor Refreshing option (refer back to “Ping and Monitor Refresh” section of this chapter). The following sections explore the common monitoring functions that you may encounter while managing the concentrator.

175

176 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Routing Table For the concentrator to forward traffic, it must know where to send those packets. The concentrator maintains a routing table so that it can know to which networks it has connectivity and to what interface packets should be sent to reach those networks. In the Monitoring | Routing Table screen, you can see all the networks that the concentrator has learned about. These routes are learned from directly connected interfaces, static routes, default gateways, and dynamic routes learned from RIP and OSPF. By monitoring the routing table, you can troubleshoot why devices do not have connectivity to other networks through the concentrator. In addition, this is a great starting point to troubleshoot or verify whether Reverse Route Injection (RRI) is properly injecting networks into the routing table and advertising them to neighbors via RIP or OSPF.

Interpreting the Event Logs By default, the VPN concentrator is monitoring events and sending them to the console, as well as to an internal log. Events can be classified as any noteworthy incident that the concentrator can log, such as alarms, errors, completed tasks, and status changes. In the Configuration | System | Events screen (Figure 8.16), you can define the level of monitoring that is being maintained by the concentrator, as well as define several outputs for these monitored events. The severity levels of events range from 1 to 13; whereas 1 is the highest level and the most critical, and 13 is the most detailed and the least critical. By default, general events are being logged if they are in the level ranges of 1–5. In addition, severity levels of 1–3 are events that are automatically sent to the console. You can change these default parameters for general events, in addition to specific hardware or software subsystems of the concentrator known as event classes. The VPN 3000 Concentrator regards severity levels 1–6 as normal; 7–9 are debugging events, and 10–13 are packet decoding hex dumps. You can configure the concentrator to send event alerts or logs to one of the following: internal log, console, FTP, SNMP, Syslog, and even email. Because of memory limitations, the VPN 3005 Concentrator’s internal log can only hold up to 256 events, and models 3015–3080 can contain up to 2048 events. When the internal log buffers have reached their maximum capacity, older events are overwritten by newer events.

. . . . . . . . . . . . . . Monitoring . . . . . . and . . .Administration . . . . . . . .of. Cisco . . . VPN . . . 3000 . . . Concentrator . . . . . . . It is important to remember the VPN Concentrator’s three general severity level ranges: 1–6 are normal, 7–9 are debugging, and 10–13 are hex dumps of packets to decode. Levels 7—13 are typically utilized by Cisco support and should not be normally logged because of memory and processing overhead.

Figure 8.16 System Event configuration.

In a fully productive network, the VPN Concentrator might be generating hundreds and thousands of logs depending on the severity level logging configured. To sort your way through this mess, there is a useful monitoring menu that enables you to filter the event log to specific entries. In Figure 8.17, the Monitoring | Filterable Event Log screen is displayed. This screen enables you to filter the event log by specific or several event classes, client IP addresses, group, or severity level, and sort the events in accordance to the age of the event and how many events per page. In this example, we just wanted to filter out events that were specific to authentication and SCEP enrollment of digital certificates. When you highlight the AUTH and the CERT event classes and press the arrow key, the log page presents only those items requested.

177

178 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 8.17 Filterable Event Log screen.

In addition, if you want to monitor the event log in real time, the Monitoring | Live Event Log screen allows you to see the current event logging being refreshed every five seconds. You can pause and resume the display by pushing the appropriate button on the bottom of the screen. Furthermore, you can clear the display (not the log itself) and restart the 5-second counter by selecting those buttons respectively.

System Status One of the most notable resources for monitoring is the System Status page. Demonstrated in Figure 8.18, the System Status page is an excellent starting point for troubleshooting and monitoring system-wide statistics. The output of this screen is similar to the show version command in a Cisco IOS. Particularly, it shows you the VPN Concentrator model, followed by the bootstrap and software version that is currently running on the device. Another useful set of statistics are the uptime statistics. When users are complaining of intermittent session disconnects/reconnects, this information displays the length of time the concentrator has been running so you can easily determine whether the concentrator is resetting. In addition, the System Status screen displays the status of the memory. If the status is green, the concentrator has memory resources free for functionality. However, if the status is red, the memory resources on the concentrator are critically low and sessions might not be able to connect.


At the bottom of the System Status page, there is a convenient graphical display of the concentrator’s front and back panel. You can click on certain areas of the display as shortcuts to statistics of those components, as illustrated in Figure 8.18. For instance, clicking on the front panel on higher-end concentrators displays the current front LED (Light Emitting Diode) statistics so you do not even need to be physically near the device to see the status LEDs. Furthermore, the bottom of the System Status screen displays the current operation of the fans, temperature of the processor, and utilization statuses for the CPU, sessions, and LAN packet throughput.

Figure 8.18 System Status screen.

Monitoring Sessions The Monitoring | Sessions screen is practically identical to the Administration | Administer Sessions screen, with the exception that you cannot log off sessions or ping the devices in this screen. In addition, you can select submenus (shown in Figure 8.19), which break down the session statistics by the protocols being transported or the encryption algorithms being used by administrator and user sessions. Additionally, the Monitoring | Sessions | Top Ten Lists subscreens list the top ten sessions, based upon the amount of data being received and transmitted, the duration, and the average throughput of the sessions. This is a useful monitoring tool to determine the users who are consuming the most resources on the concentrator. The

179

180 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

information from this top ten list can also be invaluable when deciding what type of bandwidth policies you want to implement.

Figure 8.19 Monitoring Session subscreens.

General Statistics In these pages of the Monitoring division, there is a mother lode of statistics for every aspect of the VPN Concentrator. This vast list of statistics includes all supported protocols, functions, and even MIB-II statistics that are utilized by SNMP management stations for management. Figure 8.20 displays the list of all the supported statistics that can be viewed in the Monitoring | Statistics menus. In addition, Figure 8.20 includes the MIB-II statistics submenus for those supported protocols and interfaces capable of supplying that information. For instance, if you want to view the ARP cache that the concentrator is maintaining to verify whether duplicate IPs exist on the network, you should select the Monitoring | Statistics | MIB-II | ARP Table.


Figure 8.20 Monitoring Statistics and MIB-II Statistics screens.

Summary The Administration and Monitoring divisions of the VPN Configuration Manager supply the administrator with the functionality required to maintain, manage, and troubleshoot the Cisco VPN 3000 Concentrator. The Administration division enables you to perform support functions that pertain to the overall housekeeping and maintenance of the VPN Concentrator. Specifically, you can view and log out remote access, LAN-toLAN, and management sessions. In addition, you can upgrade the concentrator’s software, as well as that of the hardware and software clients. The software clients receive a notification containing the link to the HTML URL address; whereas hardware clients attempt to perform an auto update by using the TFTP URL address specified in the concentrator’s notification. An additional administration function is to reboot the system. In this menu, you can reboot or shut down the system instantly or at a specific time, while also giving the option to save the configuration, not save it, or ignore it and return to factory defaults. To limit access to the concentrator, the Administration Access Rights menus enable you to change the five defined administrators and their access privileges. Also in the Access Rights menus, you can define ACLs to limit access

181

182 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

to the concentrator based upon an IP address or network. Finally, you can also offload the responsibilities of access rights to an AAA server by using the TACACS+ protocol. The VPN Concentrator maintains several files in its Flash memory. The active configuration is one of these files that is backed up as a CONFIG.BAK file every time you click on the save icon. In cases where you want to restore that previous configuration, you can swap the configuration file in the File Management section of the navigation pane. The Monitoring menus enable the user to view a multitude of statistics for all the function subcomponents of the VPN Concentrator. For instance, you can view the concentrator’s routing table, in addition to its filterable event log. You can also look at the live event log that is refreshed every 5 seconds. The Monitoring division supplies you with a convenient System Status screen, in which you can see general statistics, such as software versions, uptime, memory status, as well as a graphical representation of the front and back panel that can be used as hyperlinks to common troubleshooting statistics. Additionally, this division—similar to the Administration division—lets you view sessions, but this page allows you to view the particular protocols, encryption, and top 10 sessions. Finally, you are also provided with a Statistics section in which you can view statistics on every process and protocol running on the concentrator. In these menus, you can also explore the MIB-II statistics for those protocols and interfaces that can be managed by SNMP management stations.


Exam Prep Questions Question 1 Which of the following is not a default Administrator? ❍ A. admin ❍ B. mis ❍ C. itmngr ❍ D. isp ❍ E. user

Answer C is correct. The five default administrators are admin, config, mis, isp, and user.

Question 2 Which of the following is a proper client type and URL for a VPN 3002 Hardware Client? ❍ A. vpn3002, http://192.168.100.100 ❍ B. VPN3002, tftp://192.168.100.100 ❍ C. windows, tftp://192.168.100.100 ❍ D. vpn3002, tftp://192.168.100.100

Answer D is correct. The auto update for a hardware client is done using TFTP. In addition, the client type field should be vpn3002 and is case sensitive. Answer A is incorrect because the VPN 3002 Hardware Client uses TFTP addresses for auto updates, not HTTP. B is incorrect because the VPN3002 client type is case sensitive and should be in lowercase letters. Answer C is incorrect because the client type is set for the Unity Client as opposed to the VPN 3002 Hardware Client.

183

184 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 3 Which screen shows you general statistics concerning sessions connecting to the concentrator and allows you to log out those sessions? ❍ A. Administration | Tunnels ❍ B. Monitoring | Sessions ❍ C. Administration | Administer Sessions ❍ D. Configuration | Tunneling Protocols | Sessions

Answer C is correct. The Administration | Administer Sessions screen shows you statistics, as well as enables you to ping and log out sessions. Answer B is incorrect because the Monitoring | Sessions screen does not let you log out the sessions. Answers A and D are incorrect because they are not actual pages in the VPN Concentrator Manager.

Question 4 Which rebooting option in the concentrator enables you to set the system back to factory defaults? ❍ A. Erase Startup-Config ❍ B. Reboot Without Saving the Active Configuration ❍ C. Reboot Ignoring the Configuration File ❍ D. Reboot System to Factory Defaults

Answer C is correct. The Reboot Ignoring the Configuration File option reloads the concentrator and bypasses the configuration, giving you a clean configuration with which to start. Mind you, when any reboot option is chosen, there is no warning message to the administrator about the consequences of the reboot, so choose the options carefully. Answer A is incorrect because that is the command to return a Cisco router or switch to its factory defaults. Answer B is incorrect because that is the default option that reboots the router without saving the configuration to the CONFIG file. This option causes you to only lose any unsaved configurations, not set the concentrator back to factory defaults. Answer D is incorrect because that option does not exist.


Question 5 What protocol can be used to authenticate admin access to the VPN concentrator and even specify the administrator access rights? ❍ A. TACACS+ ❍ B. RADIUS ❍ C. Kerberos ❍ D. SSH

Answer A is the correct answer. TACACS+ is the only AAA protocol supported for administrator sessions to the concentrator. Answers B and C are incorrect because RADIUS and Kerberos are utilized by the concentrator only for device-level and user authentication for the network, not for administrator access to the concentrator. Answer D is incorrect because SSH is a management protocol used to gain access to the concentrator, not control administrator access.

Question 6 Which of the following is not a logging method for event logs? ❍ A. Email ❍ B. FTP ❍ C. TFTP ❍ D. Console ❍ E. Syslog

Answer C is the correct answer. The VPN 3000 Concentrator can log events to the following: internal log, console, FTP, SNMP, Syslog, and email. TFTP is not a viable logging method for event logs.

185

186 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 7 Which of the following are true concerning event logging? (Choose all that apply.) ❑ A. The VPN 3005 Concentrator’s internal log buffer can contain up to 256 events. ❑ B. The VPN Concentrator considers event severity levels 10–13 as debugging levels. ❑ C. New entries overwrite older entries when the internal log buffer is full. ❑ D. The VPN Concentrator considers event severity levels 1–6 as normal. ❑ E. The VPN 3015 Concentrator’s internal log buffer can contain up to 256 events. ❑ F. You can view the event logs in real time. ❑ G. Event severity levels 1–5 are sent to the console by default.

Answers A, C, D, and F are correct. The VPN 3005 Concentrator can log up to 256 events in its internal buffer. The VPN 3015–3080 can contain up to 2048 events because of their additional Flash memory. When the VPN 3000 Concentrator has reached the maximum event entries in its internal buffer, the older entries are overwritten by the newer event logs. You can view the event logs in real time at the Monitoring | Live Event Log screen. Here you can pause and clear the output on the screen because the entries might scroll quickly across the screen. By default, severity event levels 1–3 are sent to the console; severity levels 1–5 are logged into the internal buffer. Cisco considers severity levels 1–6 as normal, 7–9 as debugging events, and 10–13 as packet decoding hex dumps. Answer B is incorrect because levels 7–9 are debugging events and 10–13 are packet decoding hex dumps. Answer E is incorrect because the VPN 3015 Concentrator’s internal log buffer can contain up to 2048 events. Answer G is incorrect because event severity levels 1–3 are sent to the console by default; 1–5 are sent to the concentrator’s internal buffer.


Question 8 Which of the following is the correct Access Control List (ACL) syntax to allow only management workstation 10.2.2.20/24 access to the concentrator? ❍ A. IP address 10.2.2.20, IP Mask 255.255.255.255, Access Group 1 (admin) ❍ B. IP address 10.2.2.20, IP Mask 0.0.0.0, Access Group 10 (admin) ❍ C. IP address 10.2.2.20, IP Mask 255.255.255.0, Access Group 1 (admin) ❍ D. IP address 10.2.2.20, IP Mask 255.255.255.0, Access Group 0 (admin)

Answer A is correct. The syntax to apply an ACL to the concentrator is to specify the IP address of the workstation followed by an IP mask. You can also specify the access group level that the station contains. Answer B is incorrect because the IP mask is the not a wildcard mask and the Access Group for admin rights is Group 1. Answers C and D are incorrect because the IP Mask is for the entire network as opposed to that particular workstation.

Question 9 Which of the following are viable ways to back up the configuration file? (Choose all that apply.) ❑ A. Export the active configuration to a XML file. ❑ B. Upload the CONFIG fie via the TFTP protocol. ❑ C. Save the active configuration. ❑ D. View the configuration file and save the corresponding window as a text file. ❑ E. Click on the Copy hyperlink of the CONFIG file in the Administration | File Management screen.

Answers A, B, C, D, and E are correct. In the Administration | File Management screen, you can back up your configuration to a file via TFTP, as well as export the configuration to an XML file. In addition, you can view the current contents of the CONFIG and save the contents as a text file on your workstation. As opposed to viewing the configuration, you can also click on the Copy hyperlink and save a copy of the CONFIG file in the Flash memory of the VPN Concentrator. Finally, every time you save the configuration, it automatically backs up the previous CONFIG file as CONFIG.BAK.

187

188 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 10 Which of the following are ways in which you can send an update notification to a group? (Choose two.) ❑ A. Click on the Update Group button in the Configuration | User Management | Groups page. ❑ B. Click on the Upgrade Clients Now button in the Administration | Software Update | Clients page. ❑ C. Add an update entry after clicking on the Client Update button in the Configuration | User Management | Groups page. ❑ D. Select the update notification in the individual group configurations in the Update Notification field.

Answers B and C are correct. To send a notification to particular groups, you can click on the Upgrade Clients Now button in the Administration | Software Update | Clients page or add an update entry after clicking on the Client Update button in the Configuration | User Management | Groups page. Answers A and D are incorrect, because those options do not exist in the VPN Concentration Manager.


Need to Know More? Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. For a complete overview of the administration and monitoring functions of the VPN 3000 Concentrator, visit Cisco’s web documentation at http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/ and download the “VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring” for the requested software release.

189

9 Cisco VPN 3002 Hardware Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Client mode ✓ Network Extension mode ✓ Interactive authentication ✓ Individual authentication ✓ LEAP

Techniques you’ll need to master: ✓ Identifying the characteristics of Client mode ✓ Recognizing the aspects of Network Extension mode ✓ Performing the required steps to initialize hardware client ✓ Identifying the processes involved to implement interactive and individual authentication ✓ Understanding the configuration policies that are pushed from the VPN 3000 Concentrator

192 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

When presented with a remote office with multiple clients requiring connectivity to the central location’s concentrator, it would be an administrative nightmare to install the Cisco Unity software client on every PC. In this type of scenario, it would benefit the office to utilize the Cisco VPN 3002 Hardware Client. This small appliance can actually initiate a single tunnel on behalf of up to 253 clients behind it, thus eliminating the need to install a client on individual workstations. What’s more, it can be implemented in a remote office regardless how diverse the operating systems are on the workstations. Not to mention, the 3002 Hardware Client can also connect to other VPN-capable devices aside from VPN 3000 Concentrators, such as the Cisco PIX firewall and a Cisco router. This chapter explores the diverse functionality that the VPN 3002 Hardware Client can provide and how it interacts with the central location’s VPN 3000 Concentrator.

Cisco VPN 3002 Features As you recall from Chapter 3, “Cisco VPN 3000 Concentrator Hardware,” the VPN 3002 client comes in two flavors. The CVPN 3002 model contains a single autosensing 10/100Mbps private interface and an autosensing 10/100Mbps public interface. The CVPN 3002-8E model contains a similar public interface; however, the private interface comprises an 8-port 10/100Mbps switch for multiple Ethernet device connectivity. Both models can function in two different operating modes and support pushed configurations and policies from the central location, as the following sections discuss.

Client Mode The hardware client runs in one of two operating modes. The simplest and default mode is known as Client mode (also called PAT mode). In this operating mode, the hardware client utilizes Port Address Translation (PAT) for its communications with the central concentrator. The VPN 3002 in Client mode emulates a single remote access client by requesting an internal tunnel IP address from the central concentrator. All devices behind the hardware client are isolated and hidden from the central location’s network. This is possible because the IP addresses of traffic originating from the client’s private network are translated to the hardware client’s assigned internal IP address. Thus, devices on the central network see only traffic originating from the assigned tunnel IP address. With that being said, devices on the central network cannot initiate communications with stations behind the hardware client because they do not know the stations’ actual IP address.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Cisco . . .VPN . . .3002 . . .Hardware . . . . . Client . . .

PAT is also utilized when split tunneling is enabled from the central concentrator and devices behind the hardware client need to access resources on the Internet. In these instances, the private network behind the VPN 3002 Hardware Client is translated to the public IP address configured on the hardware client’s public interface. Whether the traffic is destined for the tunnel or the Internet, the VPN 3002 maintains all translations in its NAT table so it knows where to forward traffic returned to that device. An illustration of the Client mode operation is shown in Figure 9.1. In this example, the VPN 3002 is operating in Client mode and has received an internal IP address of 10.1.1.113/24 from an IP pool configured on the central VPN Concentrator. When stations on the VPN 3002’s private network (10.3.3.0/24) want to communicate with the VPN Concentrator’s private network (10.2.2.0/24), the VPN 3002 Hardware Client utilizes PAT to translate the inside source address from the station’s private IP address to the hardware client’s assigned IP (10.1.1.113). Therefore, all stations on the VPN Concentrator’s network receive packets from a single-source address and are unaware of the sending stations’ private IP addresses. Because the traffic is destined for the remote network across the tunnel, the packet is encrypted using the ESP protocol and an additional ESP header is added to the protected packet for routability. All receivers of this traffic on the 10.2.2.0 network appear to be receiving the packets from the same source of 10.1.1.113. Also illustrated in the example, when users behind the hardware client access the Internet (such as www.examcram.com) through the split tunnel, the VPN 3002 translates the original source IP address to reflect the hardware client’s IP address of the public interface (192.168.200.101). www.examcram.com

VPN 3002 Hardware Client Client Mode Public IP: 192.168.200.101/24 Assigned Tunnel IP: 10.1.1.113/24

der 0 1 Hea IP 8.200.1 m.com 6 ra .1 2 a mc 19 SA: ww.ex w DA:

ESP IP Header SA: 192.168.200.101 DA: 192.168.1.101

Private Network: 10.3.3.0/24

Figure 9.1 VPN 3002 Client mode operation.

VPN 3015 Concentrator Public IP: 192.188.1.101/24

E S P

Internal IP Header SA: 10.1.1.113 DA: 10.2.2.2

Private Network: 10.2.2.0/24

193

194 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Network Extension Mode Network Extension mode is a similar concept to LAN-to-LAN tunnels in the VPN 3000 Concentrator. In Network Extension mode (also called Tunnel mode), the VPN tunnel acts like a site-to-site bridge between the remote network and the central location’s network. Unlike Client mode, Network Extension mode does not employ PAT for communications between the two networks. Without this PAT functionality, users behind the hardware client are visible to the central office’s network. This end-to-end visibility is sometimes necessary for applications and services that are incompatible with PAT and require end-to-end IP traceability. In instances where split tunneling is enabled from the central concentrator, the VPN 3002 Hardware Client still utilizes PAT for traffic destined for the Internet. However, regardless of the enforced split tunneling policy, PAT is not utilized for inter-tunnel traffic in Network Extension mode. To utilize Network Extension mode, PAT must be disabled and the Private Interface’s IP address must be changed from its default value. Additionally, Network Extension mode does not receive any IP assignments from the central concentrator. The VPN 3002 supports H.323 in Client Mode for real-time audio and video applications, such as Microsoft Netmeeting. There is no configuration required to support this functionality.

Demonstrated in Figure 9.2, Network Extension mode looks very similar to the Client mode example in Figure 9.1. However, a key difference between the two examples is that the inside tunnel address is not translated in Network Extension mode. This is represented in Figure 9.2 by the fact that the packet traversing the tunnel has an internal source address of 10.3.3.3, which is the actual private address of the sending station. As previously mentioned, when split tunneling is enabled, the VPN 3002 Hardware Client still utilizes PAT for outgoing packets to the Internet. In the example, when stations need to send clear text data to the Internet with split tunneling, the VPN 3002 performs PAT on the IP packets and translates the source IP address to the IP address of the public interface.

Interactive Hardware Client Authentication Because the hardware client is a client within itself, it requires a group and user account on the central VPN 3000 Concentrator just like individual software clients. When you initially configure the hardware client, you can input these authentication attributes so that it will initiate and maintain a tunnel

196 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

VPN 3002 Hardware Client Configuration Because the 3002 is an actual client, it does not require as much configuration as the VPN 3000 Concentrator. This is especially true because the 3002 Hardware Client obtains several configuration policies pushed from the central concentrator. For instance, the hardware client obtains WINS, DNS, and default domain name information, in addition to split tunneling policies from the concentrator. However, certain parameters are still necessary to initialize the hardware client and establish connectivity to the head-end concentrator. Because the VPN 3002 is an actual client, it still receives several pushed parameters from the VPN 3000 Concentrator, such as WINS, DNS, default domain name, and split tunneling policies.

To begin the configuration process for the hardware client, you can access it via the RJ-45 console port or by utilizing several different management protocols. Specifically, Telnet, SSH, and HTTP all can be used to initially configure the hardware client. What’s more, any of these protocols can be used without requiring any preliminary configuration steps. This is possible because the hardware client comes preconfigured with an IP address of 192.168.10.1 on its private Ethernet interface. By using this IP address, you can use Internet Explorer or Netscape Navigator browsers, as well as a Telnet or SSH client to gain access and begin the initial configuration. The 642-511 expects you to remember the default IP address of the Private Interface.

Similar to the VPN 3000 Concentrator, the 3002 Hardware Client contains a Quick Configuration setup dialog to configure minimal parameters for initializing the hardware client. This configuration can be accomplished by either a command-line interface (CLI) or by the HTML-based VPN 3002 Hardware Client Manager. For simplicity, the following section looks into the GUI configuration parameters.


3002 Hardware Client Manager Quick Config The VPN 3002 Hardware Client Manager is a scaled down version of the VPN 3000 Concentrator Manager. It has a similar navigation screen, as well as navigation toolbars and icons to save the configuration, refresh, or reset current statistics. To gain access to the Client Manager you must first log in to the hardware client. Upon initial connection to the 3002 Hardware Client, you are presented with a login display screen similar to the one depicted in Figure 9.3.

Figure 9.3 3002 Hardware Client login screen.

At this screen, you can install the SSL certificate to your browser to support HTTPS management. Utilizing HTTPS as a management protocol provides encrypted transactions so configuration information (including passwords) cannot be easily intercepted. Additionally, there is an extra hyperlink in the top-right corner of the login page that is for users who need to initiate the authentication features discussed earlier in this chapter (more on this later). To begin the configuration process, log in to the hardware client, using the default username and password of admin. This brings up the next page, which prompts whether you want to initiate the Quick Configuration setup dialog or go directly to the main menu. Unlike the VPN 3000 Concentrator, you

197

198 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

can access the Quick Configuration at any given point. However, for this demonstration, we will continue with the Quick Configuration. The first Quick Configuration screen prompts you to set the time and date values for the hardware client system. This is followed by a screen option that asks whether you want to upload an existing configuration file. If you happen to have a saved configuration .txt file, you can click “Yes” and browse to the file and click the Upload button. Otherwise, you can click the No button to continue with the Quick Configuration setup. The Private Interface Quick Configuration screen is one of the most pivotal screens during this setup. This screen, shown in Figure 9.4, displays the default configurations for the Private Interface. As you can see, the default IP address is 192.168.10.1 with a subnet mask of 255.255.255.0. Furthermore, the 3002 Hardware Client acts as a DHCP server for devices hanging off the private Interface. If you wish to change either or both of these attributes, answer the questions accordingly. For instance, if you already have a DHCP server on the network, answer No to the question Do you want to use the DHCP server on Interface 1 to provide addresses for the local LAN? If you decide to manipulate both parameters, you are prompted to a screen similar to the one shown in Figure 9.5.

Figure 9.4 Quick Configuration Private Interface screen. If you are configuring the 3002-8E model, the 8-port switch is treated in the configuration as a single private interface. You cannot configure individual settings for each of the eight ports.


Figure 9.5 Quick Configuration Private Interface modification.

If you plan to use the VPN 3002 Hardware Client in Network Extension mode, you must change the default IP address of the private Ethernet interface to match the IP address schema of your private network. However, be aware that any change to the private interface’s IP address might disrupt your management connection to the hardware client.

After the Private Interface configuration is complete, the Quick Configuration displays the attributes for the public interface (Figure 9.6). Here you can assign a system name if required for your public DHCP server. The default IP setting for this interface is to obtain an IP address from a DHCP server; however, you can also set PPPoE parameters for DSL IP assignment or manually set the IP address. PPPoE is a layer 2 protocol based on PPP that is typically utilized for connectivity to Digital Subscriber Line providers. In Figure 9.6, the default setting of the DHCP client was changed to a static configuration of the IP address of 192.168.200.101 for the public interface. The IPSec Quick Configuration page enables you to define the parameters necessary to connect to the VPN Concentrator, PIX firewall, or Cisco router. As shown in Figure 9.7, this screen initially prompts you for the IP address or hostname (requires DNS) of the IPSec device to which you want to connect. In addition, you can specify whether you want to encapsulate IPSec in TCP headers to allow IPSec to work over intermediary devices that implement NAT or PAT on the public network. If you require this functionality, be sure the far-end concentrator is also set for TCP NAT transparency and that the TCP port numbers match.

199

200 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 9.6 Quick Configuration Public Interface screen. NAT Transparency can take form in one of three ways. If both tunnel endpoints are configured with IPSec over TCP, that method takes precedence over the other two. If IPSec over TCP is not configured, starting with version 3.6, both sides try to detect a NAT or PAT device and negotiate NAT Traversal (NAT-T) parameters if enabled. The last option is to use IPSec over UDP if enabled for that particular group.

The authentication parameters of this screen address whether you want to use digital certificates or preshared keys. If you want to use a certificate, fill in the appropriate check box and specify whether you want to send the entire CA chain with the identity certificate. When you enable authentication with digital certificates, the Group field becomes inactive and is grayed out. To correctly be associated with a group when authenticating to the head-end concentrator, be sure that the OU field in the digital certificate matches a group name on the VPN Concentrator. If you plan to utilize preshared keys, you must configure a group name and the group password that matches the configuration in the head-end concentrator. The group’s password serves as the preshared key between the hardware client and the central concentrator. Additionally, you can input the hardware client’s individual authentication parameters that will allow the hardware client to establish a tunnel automatically without any user intervention. These user authentication fields do not need to be completed if you plan to utilize the Interactive authentication feature. In Figure 9.7, the hardware client was configured to initiate the tunnel to the public IP of the central VPN concentrator (192.168.1.101). In addition, because the tunnel endpoints are using preshared keys for IKE device-level negotiations, the VPN3002 group and the preshared key was specified in the Group field to coincide with the central concentrator’s group name and password. The VPN 3002 Hardware Client also requires a


user account to authenticate itself to gain access to the network. In this example, the client was configured to use the Mr Ed user account that is configured on the VPN Concentrator and the central office.

Figure 9.7 Quick Configuration IPSec screen.

Quick Configuration continues to initialize the hardware client by asking whether you want to enable PAT for IPSec communications. If you leave the default value of Yes, the hardware client operates in Client mode. If you want to utilize Network Extension mode, answer No to this question to disable PAT for the IPSec tunnel. The remaining three Quick Configuration screens walk you through specifying a DNS server, defining default and static routes, and changing the administrative password, respectively. Table 9.1 summarizes the screens and parameters that are set during the Quick Configuration dialog. Table 9.1 Cisco Quick Configuration Dialog Summary Screen Name

Parameters

Configuration | Quick | Time and Date

System time, date, and time zone

Configuration | Quick | Upload Config

Upload existing configuration file

Configuration | Quick | Private Interface

Prompt to change private interface address, prompt to change DHCP provisioning defaults

Configuration | Quick | Private Interface | IP* and/or DHCP Server**

Private interface IP address assignment, DHCP address range for provisioning addresses on private interface

Configuration | Quick | Public Interface

System name, public interface IP address assignment via DHCP (default), PPPoE (DSL provider), or static configuration

201

202 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Table 9.1 Cisco Quick Configuration Dialog Summary (continued) Screen Name

Parameters

Configuration | Quick | IPSec

Central-site VPN Concentrator IP address or hostname, NAT transparency via IPSec/TCP, digital certificate authentication configuration, group preshared key and user parameters

Configuration | Quick | PAT

Utilize PAT (Client Mode) or disable PAT (Network Extension mode)

Configuration | Quick | DNS

DNS server and domain name assignment

Configuration | Quick | Static Routes

Static routes for destination networks

Configuration | Quick | Admin Password

Change the default admin password

*

Screen is displayed only if you answer yes to Do you want to configure the IP address of the Private Interface?

** Screen is displayed only if you answer yes to Do you want to use the DHCP server on Interface 1 to provide addresses for the local LAN?

Additional Configuration Parameters The majority of the configuration parameters are managed by the Quick Configuration Setup dialog. However, you can still navigate through the configuration pages of the Client Manager’s navigation frame (Figure 9.8) to make additional configurations or change Quick Configuration parameters. In fact, the top of the navigation frame contains a link to the Quick Configuration setup utility. Unlike the VPN 3000 Concentrator, the VPN 3002 Hardware Client enables you to jump back to the Quick configuration whenever you wish.

Figure 9.8 3002 Hardware Client Manager Configuration division.


One notable configuration screen is the Configuration | Tunneling Protocols | IPSec page. This configuration screen has similar fields to the Quick Configuration | IPSec screen; however, it additionally contains a backup server field. In this option, you can specify up to 10 backup concentrators for tunnel connectivity to the network. These devices can be defined on the VPN 3002 Hardware Client; however, it is also a policy that can be enforced or disabled from the central location’s concentrator. When a policy push occurs, the list pushed from the concentrator overwrites the hardware client’s list. Do not forget that the VPN 3000 Concentrator’s pushed backup server list overwrites the hardware client’s list.

Starting with version 3.6, the VPN 3002 Hardware Client labels the Backup Servers field as Backup VPN Easy Servers.

VPN 3000 Concentrator Hardware Client Parameters Remarkably enough, some of the most pertinent configurations are not done on the VPN 3002 Hardware Client. For several policies and parameters, the central VPN 3000 Concentrator is responsible for pushing configuration attributes down to hardware and software clients. What’s more, the HW Client tab in the concentrator’s Configuration | User Management page is devoted to parameters that are pushed to the VPN 3002 Hardware Client. Illustrated in Figure 9.9, the HW Client tab on the VPN 3000 Concentrator enables you to configure options that will be pushed down to the hardware client. The top of the tab pertains to the authentication features discussed in the beginning of this chapter. If you want to enforce interactive and/or individual authentication, check the appropriate boxes on this page. By default, both these options are disabled for all groups. It is probable that the 642-511 exam will ask you about the steps required to enable either interactive or individual authentication. In addition, you are expected to know where these configurations are established.

203

204 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Following the authentication features, the next field presented defines a peer idle timeout for the tunnel. This field enables you to define how many minutes of inactivity (default is 30) are allowed before the tunnel is terminated. In instances where you are operating in Network Extension mode and you want to use Cisco IP phones across the tunnel, you can enable the “Cisco IP Phone Bypass” option that allows Cisco phones to circumvent individual authentication because they lack the capability to perform this function. Similarly, when utilizing Cisco Aironet wireless devices that employ LEAP (Lightweight Extensible Authentication Protocol) for wireless network authentication to a RADIUS server, you can check the LEAP Bypass option so these LEAP packets can bypass the individual authentication. After the wireless user authenticates to the RADIUS server, the user is still required to perform the individual authentication. Finally, Network Extension mode must be enabled at the headend concentrator if the hardware client in this group is requesting it. If this option is not selected, no VPN 3002 Hardware Clients in the group can establish a site-to-site connection to the concentrator.

Figure 9.9 3002 Hardware Client Manager Configuration screen.

Interactive and Individual Login Because the interactive and individual authentication features are so prominent throughout this chapter, it’s important to look at the steps involved for the users to initiate the tunnel and authenticate to the head-end concentrator. Recall that these options are not enabled by default in the group configurations on the concentrator. Thus, as long as you have the IPSec attributes configured correctly in the Quick Config | IPSec or the Configuration | Tunneling Protocols | IPSec configuration pages, the tunnel will initiate and allow all users whenever the traffic warrants it.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Cisco . . .VPN . . .3002 . . .Hardware . . . . . Client . . . Remember that the VPN 3002 does not have the Interactive or Individual login feature enabled by default. As such, the tunnel is established automatically when traffic is destined out of the public interface.

Interactive Tunnel Connection Example When Interactive tunnel authentication is enabled from the central-site concentrator, any saved passwords on the hardware client are erased from the configuration. The tunnel must be manually established by a user on the private network. To perform this action, users navigate their browser to the client’s private interface. The 3002 Hardware Client Manager login page (refer to Figure 9.3) contains a Connection/Login Status hyperlink, which produces an output similar to that shown at the top of Figure 9.10. When the user clicks on the Connect Now button, a new page is presented with a screen comparable to that shown at the bottom of Figure 9.10. At this point, the user must input a valid username and password for the VPN 3002 Hardware Client that is to be sent to the head-end concentrator. If approved, the tunnel is established and remains up until the inactivity timer expires or an administrator disconnects it. Mind you, after this tunnel is established, all users on the private interface network can utilize it.

Figure 9.10 Interactive Login display screens.

Individual Login Example Regardless how the tunnel is initiated, you can enforce individual users to authenticate themselves to the concentrators before they can use the tunnel. After this policy is pushed from the concentrator, users need to authenticate themselves in one of two ways:

205

206 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ➤ The user can navigate to the VPN 3002 Hardware Client’s private inter-

face address with a Web browser. ➤ The user can navigate to a Web page on the central concentrator’s net-

work. The hardware client redirects the connecting user to the user login page. In either instance, you are presented with the screens depicted in Figure 9.11. The hardware client will recognize your IP and MAC address and determine that you need to log in. After clicking on the Log In Now button, enter the username and password values matching the concentrator’s user parameters. After you are authenticated, you are presented with a screen similar to the bottom of Figure 9.11, and you are able to use any service that you require across the tunnel.

Figure 9.11 Individual User Authentication Screens

VPN 3002 Administration The Administration division of the VPN 3002 Hardware Client Manager is remarkably similar to the VPN 3000 Concentrator Manager. As illustrated


in Figure 9.12, this section contains pages that enable you to perform system updates to upgrade the 3002 Hardware Client’s software code. Also, recall from Chapter 8 that the 3002 is capable of performing an auto-update of its software revision if so enabled on the head-end concentrator. When it receives an update message after connecting to the main office’s concentrator, it checks the revisions listed in the update message. If the revisions are newer than the current version of software running on the hardware client, it automatically downloads the image from a TFTP server and reboots itself after the download is complete. Also identical to the VPN 3000 Concentrator, the VPN 3002 Hardware Client contains administrative features, such as the reboot and ping utilities. To produce a result comparable to the VPN 3000 Concentrator’s reboot utility, you can choose to have the VPN 3002 reboot and ignore the config file when rebooting to return to factory defaults. What’s more, the chassis of the 3002 Hardware Client also contains a Reset button in which you use a small object (such as a paper clip) to push the button on boot up. This actually deletes the config file and the config.bak to set the hardware client back to factory defaults. Access management to the hardware client can also be achieved in the Administration | Access Rights pages. Here you can define access settings, such as administrator properties and passwords. The VPN 3002 has three default administrators: admin, config, and monitor. Additionally, the Administration | File Management pages allow you to view, delete, back up, and swap configuration files, as well as view and delete log files. Be sure to remember the three default administrators of the VPN 3002 Hardware client: admin, config, and monitor. These should be easy to remember because they closely resemble the three divisions of the VPN 3002 Hardware Client Manager and the VPN 3000 Concentrator Manager.

To manage digital certificates on the hardware client, you can utilize the Administration | Certificate Management pages. Here you can view, renew, and delete your installed certificates, as well as perform a manual PKCS#10 enrollment request or use SCEP for automatic enrollment.

207

208 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 9.12 VPN 3002 Hardware Client Manager Administration division.

VPN 3002 Monitoring Figure 9.13 displays the Monitoring section of the VPN 3002 Hardware Client Manager. As you can see, this section is practically identical to the VPN 3000 Concentrator’s Monitoring division. This division enables you to view the routing table of the hardware client, as well as view a filtered or live event log. In addition, the Statistics section can be used for viewing statistics for all components of the hardware client.

Figure 9.13 3002 Hardware Client Manager Monitoring screen.

Figure 9.14 demonstrates an example of a useful Statistics page that you can use to troubleshoot whether the VPN 3002 Hardware Client is operating correctly in Client mode. This particular Statistics output displays the hard-


ware client’s NAT table, which coincides with the example shown in the Figure 9.1 at the beginning of this chapter. As you can tell, there are two devices on the hardware client’s private network (10.3.3.1 and 10.3.3.3). Notice that both devices’ internal IP addresses are being translated to the concentrator-assigned IP of 10.1.1.113 for traffic that is destined for the 10.2.2.0 network. In addition, the last entry is destined for the Internet and split tunneling was enabled from the central concentrator. The source IP address is translated to the hardware client’s public interface IP of 192.168.200.101.

Figure 9.14 3002 Hardware Client NAT Statistics page.

One notable screen in the Monitoring division is the Monitoring | System Status page shown in Figure 9.15. This page looks similar to the concentrator System Status page; however, an additional section is dedicated to the status of the tunnel. This section contains buttons that enable the administrator to manually connect or disconnect the tunnel. Not to mention, this is an excellent resource to view the SA statistics that were negotiated for the hardware client’s single tunnel.

209

210 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 9.15 3002 Monitoring System Status screen.

Summary The VPN 3002 Hardware Client is an ideal appliance for remote offices that do not wish to install the software client on each PC. The hardware client comes in a single-port private interface model, as well as an 8-port switch private interface model. Both models can operate in two distinct operating modes and can receive pushed policies and configurations from the central concentrator. When the hardware client is running in Client mode, the client utilizes PAT to translate private IP addresses into its assigned inside IP for tunnel traffic. Because the remote network can see only the assigned tunnel IP, users behind the hardware client are hidden from the central location’s network. PAT is also used for outgoing Internet traffic when split tunneling policy is being pushed down from the concentrator. Network Extension operating mode is used for a site-to-site connection that does not utilize PAT for tunnel traffic. The central network has full


visibility to the IP addresses assigned to users on the hardware client’s private network. PAT, however, is still used for split tunnel Internet traffic if enforced. To initialize the VPN 3002 Hardware Client, you can use the CLI, which can be accessed by the console port, Telnet, or SSH. You can also utilize the VPN 3002 Hardware Client Manager GUI by using HTTP and HTTPS (if you install the SSL certificate). These management protocols can be used because the hardware client comes with a factory default configuration of 192.168.10.1 with a subnet mask of 255.255.255.0. The Quick Configuration steps to configure the minimal parameters of the VPN 3002 are as follows: 1. Setting system date and time settings 2. Uploading the existing configuration file 3. Configuring Private Interface and DHCP server settings 4. Configuring the Public Interface 5. Defining IPSec parameters 6. Enabling/Disabling PAT (Client Mode) 7. Defining a DNS server 8. Configuring static and default routes 9. Changing the administrator password

You can access the Quick Configuration at any point by clicking on its link in the 3002 Hardware Client Manager’s navigation frame. Another important configuration link is the Configuration | Tunneling Protocols | IPSec page, in which you can define up to 10 backup servers for redundant connectivity to the network. Many of the 3002’s configurations are inherited from the pushed parameters from the VPN 3000 Concentrator. On the HW Client tab of the VPN 3000 Concentrator, you can enable authentication features, set idle timers, enable Cisco IP Phone and wireless LEAP bypass for individual authentication, and enable Network Extension mode for any hardware clients in the group. For users behind the VPN 3002 Hardware Client to initiate a tunnel with interactive authentication, they must navigate their Web browser to the hardware client’s private interface and use the Connection/Login Status link

211

212 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

to input the login credentials. Individual authentication requires a similar process to allow each user to authenticate to the head-end concentrator. Additionally, you can bring up the individual login screen by browsing to a Web page on the central network. Individual authentication is enforced whether or not the tunnel is already connected. The Administration section of the VPN 3002 Hardware Client Manager has management screens to perform high-level housekeeping, similar to those of the VPN 3000 Concentrator Manager. In this section, you can upload a new software version or use the auto-update pushed feature of the VPN 3000 Concentrator. Additionally, you can reboot, ping, define access rights to the client, perform file management, and install a CA certificate dynamically with SCEP or manually. The Monitoring section is also similar to the VPN 3000 Concentrator. This section displays the routing table, event logs, system status, and general statistics. On the Monitoring | System Status screen, you have an additional feature that enables you to connect and disconnect the VPN tunnel for the hardware client and display the negotiated SA for the tunnel.


Exam Prep Questions Question 1 What is the default IP address of the Private Interface of a VPN 3002 Hardware Client? ❍ A. 192.168.1.10 ❍ B. 192.168.100.1 ❍ C. 192.168.10.1 ❍ D. 192.1.168.1

Answer C is correct. The private interface comes with the IP address of 192.168.10.1 with a subnet mask of 255.255.255.0. A, B, and D are all incorrect IP addresses.

Question 2 Which operating mode would be synonymous with PAT mode? ❍ A. Network Extension mode ❍ B. Network Extending mode ❍ C. Interactive authentication ❍ D. Client mode

Answer D is correct. Client mode utilizes PAT by translating users’ IP addresses into the assigned internal IP address. Network Extension mode does not utilize PAT for tunneled traffic. Answers B and D are not actual modes of the VPN 3002 Hardware Client.

Question 3 Which are valid in regards to Individual Authentication? (Choose two.) ❑ A. Configuration must be done on the VPN 3002 Hardware Client. ❑ B. Configuration must be done on the VPN 3000 Concentrator. ❑ C. Individual authentication is enabled by default. ❑ D. Individual authentication is disabled by default.

213

214 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer B and D are correct. To configure Individual authentication, you configure all parameters on the VPN 3000 Concentrator. Specifically, on the HW Client tab, fill in the Require Individual User Authentication check box. This feature is disabled by default. Answer A is incorrect because the configuration does not take place on the hardware client. Answer C is incorrect because Interactive and Individual authentication are disabled by default.

Question 4 Which two can bypass Individual logins? (Choose two.) ❑ A. Aironet Wireless Devices supporting LEAP ❑ B. Administrators with bypass privileges ❑ C. TACACS+ queries ❑ D. TFTP ❑ E. Cisco IP Phones

Answers A and E are correct. The only two devices that can bypass the Individual authentication feature are Cisco Aironet wireless devices using LEAP for wireless authentication and Cisco IP phones on tunnels running in Network Extension mode. Answers B, C, and D are incorrect because the only devices and protocols that can bypass the Individual login feature are Cisco IP phones and Cisco wireless devices utilizing LEAP.

Question 5 Which of the following is not a management protocol used to configure the hardware client? ❍ A. HTTP ❍ B. TFTP ❍ C. SSH ❍ D. Telnet

Answer B is correct. The hardware client supports HTTP and HTTPS (if a certificate is installed in browser) for the HTML-based VPN 3002 Hardware Client Manager. You can also access the CLI by using Telnet and SSH, as well as using the RJ-45 console port. Only TFTP is used by the concentrator to utilize the auto-update feature.


Question 6 In which two instances will the hardware client prompt you with the Individual login screen? (Choose two.) ❑ A. When you access any data service on the central site’s network ❑ B. When you browse to the VPN 3000 Concentrator’s Private Interface ❑ C. When you browse to the VPN 3002 Hardware Client’s Private Interface ❑ D. When the admin logs out of the hardware client

Answers B and C are correct. The hardware client prompts you to perform individual authentication when you browse to the hardware client’s Private Interface and use the Connection/Login Status hyperlink. In addition, you are prompted for a login when you browse to any Web page on the concentrator’s network (including the concentrator’s private interface). A is incorrect because it must be some form of Web browsing that prompts the login. D is incorrect because it does not matter who is logged in to the hardware client.

Question 7 How many tunnels does the VPN 3002 Hardware Client support? ❍ A. 253 ❍ B. 5 ❍ C. 1 ❍ D. 100

Answer C is correct. The hardware client supports a single tunnel to a destination. It also supports 253 users to traverse that tunnel. Answers A, B, and D are incorrect because the 3002 supports only a single tunnel.

Question 8 What are the default states of the private and public interfaces on the VPN 3002 Hardware Client? ❍ A. Public and private interfaces act as DHCP servers. ❍ B. Public interface is a DHCP client; private interface acts as a DHCP server. ❍ C. Public and private interfaces are DHCP clients. ❍ D. Private interface is a DHCP client; public interface acts as a DHCP server.

215

216 Chapter 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer B is correct. The private interface default configuration is to act as a DHCP server. The IP address of the interface is 192.168.10.1, and the DHCP server distributes IPs 192.168.10.2–192.168.10.128. The public interface is defaulted to a DHCP client, so it receives an IP from a DHCP server on the public network. Answer A is incorrect because the public interface does not act as a DHCP server. Answer C is incorrect because the private interface has a static IP address of 192.168.10.1. Answer D is incorrect because it is the exact opposite; the private interface acts as a DHCP server and the public interface acts as a DHCP client.

Question 9 How many LAN-to-LAN tunnels are supported on the VPN 3002 Hardware Client? ❍ A. 1 ❍ B. 2 ❍ C. 253 ❍ D. 0

Answer D is correct. The hardware client does not support LAN-to-LAN tunnels. Although Network Extension mode is similar to a LAN-to-LAN tunnel, the hardware client is still acting as a client and must be configured in the User Management section of the VPN 3000 Concentrator. Answers A, B, and C are incorrect because the VPN 3002 does not support LAN-to-LAN tunnels.

Question 10 Which policy is not pushed down to the VPN 3002 from the VPN 3000 Concentrator? ❍ A. Firewall policy ❍ B. Split tunneling policy ❍ C. Authentication feature policy ❍ D. Update policy

Answer A is correct. The hardware client obtains WINS, DNS, default domain name information, and split tunneling policies. In addition, the concentrator can push an auto-update policy to upgrade the software of the hardware client. Interactive and Individual Authentication policies are also pushed configurations sent from the central concentrator. The 3002 does not receive any firewall policies from the VPN 3000 Concentrator.


Need to Know More? Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. For a complete overview of the administration and monitoring functions of the VPN 3002 Hardware Client, visit Cisco’s web documentation at www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3002/ index.htm and download the “3002 Hardware Client Getting Started and Reference Guide” for releases 3.5 and up. Cisco’s web site contains a graphical presentation explaining the VPN 3002 Hardware Client’s Client Mode and Network Extension mode. The URL for this presentation is www.cisco.com/mm/techsnap/ VPN3002_techsnap.html.

217

10 VPN Windows Client Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms you’ll need to understand: ✓ Unity Client/Cisco Unified Client Framework ✓ oem.ini ✓ .pcf files ✓ Auto-initiate ✓ vpnclient.ini ✓ Forced Network Login ✓ Advanced View ✓ Simple View

Techniques you’ll need to master: ✓ Recognizing the software operating systems that the VPN client supports ✓ Understanding the manual and automatic process to install the Unity VPN Client for Windows ✓ Creating a connection entry and changing the properties of that entry ✓ Identifying the multitude of choices on the Options menu ✓ Understanding the steps required to initiate sessions manually and automatically ✓ Comprehending the Connection Status tabs ✓ Recognizing the different alterations made to the Cisco VPN Client for Windows version 4.x

220 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The preceding chapters have made mention of the Cisco Unity VPN Client in reference to the concentrator’s functions. It is now time to focus on this pivotal portion of the VPN infrastructure and to explore all the intricacies that this client can perform in conjunction with the Cisco VPN 3000 Concentrator. This chapter focuses on the Windows platform for the Unity Client because it supports the full range of utilities and is the most widely used (not to mention that the exam focuses on it).

The Many Flavors of Cisco VPN Clients The Cisco VPN Unity Client is loosely referred to as the Cisco VPN Client or the Cisco Unity Client in the real world, as well as in this book. Earlier implementations of the Cisco VPN Client used to be referred to as the Cisco VPN 3000 Client, but have since been changed because the newer versions adopted the Cisco’s Unified Framework (discussed in the next section) and can interoperate with more devices than just the VPN 3000 Concentrator. To make matters even more confusing, Cisco also supported another VPN client called Cisco Secure VPN Client. This VPN client was used to connect to Cisco PIX firewalls and Cisco routers running IPSec. As of June 2003, Cisco officially announced that the Cisco Secure VPN Client was to be discontinued and has since been replaced with the Cisco VPN Unity Client.

Client Installation The Cisco VPN Unity Client fits perfectly in Cisco’s Unified Client Framework. This framework entails a consistent specification that encompasses wireless and desktop clients interaction with VPN Concentrators version 3.0 and up, PIX Firewalls version 6.1 or later, and Cisco routers with IOS version 12.2.8(T) or later. In fact, the Unity Client can be used to initiate VPN sessions to any of these specified devices. This framework also adopts a central management focus by allowing these devices to push configuration parameters to the clients. To communicate with a VPN Concentrator running software version 3.0 and up, you must be running at least version 3.0 of the Cisco VPN Unity Client. Mind you, as features are added in later revisions of the concentrator’s software, Cisco typically mirrors those features in client revisions. If you cannot use certain services or features on the concentrator, ensure that you have a compatible version of the Unity client running.

The Unity Client can be installed on a multitude of operating system platforms. These platforms include the Windows suite of operating systems, including Windows 95 (OSR2), 98, Me, NT 4.0 (SP3), 2000, and XP. In addition, the client can be installed on Linux, Solaris UltraSparc, and Macintosh OSs.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .VPN . . Windows . . . . . Client . . . .Configuration . . . . . . . You should know the supported platforms on which the Cisco Unity Client could be installed. In addition, be aware that only the VPN Client for Windows and the VPN Client for Mac OSX (version 3.7 and up) support a graphical user interface (GUI) configuration.

To install the client on the Windows platform, the first step should be to ensure that you meet the minimum requirements as specified in the release notes. Furthermore, it is not a bad idea to uninstall any previous clients (Cisco and other OEM VPN software clients) to ensure you do not have residual icons or files that might cause the program to malfunction. The Cisco uninstallation process typically asks you whether you want to keep any created profiles so you do not have to re-create them. In addition, be sure to disable any virus detection software that is running in the background. After these steps are completed, run the setup executable and install the client in the directory of your choosing. If you are installing an older version of the Unity client on a Windows 2000 or XP station, you may be prompted with a warning that the client’s driver is not “signed” by Microsoft; however, it is safe to install the drivers even though they have not been officially certified by Microsoft. After the install is completed, the system requires rebooting to complete the installation.

Client Automatic Silent Installation It is possible to have the client perform an auto installation without interrupting the user for any input. This type of installation is called silent mode and can be performed if you add a file called oem.ini. A typical oem.ini file might look like Listing 10.1. Listing 10.1 Sample Output of oem.ini [Default] SilentMode = 1 InstallPath = C:\Program Files\Engineering\IPSec Connections DefGroup = IPSec remote users Reboot = 1

The first line of this file turns the silent mode on so that it will not prompt users when installing the Unity Client. The InstallPath line in the oem.ini file signifies where you want to install that client on the local workstation. After you have chosen the directory, you can also change the folder name in which the client is installed by using the DefGroup variable. The last significant line in this file tells the computer to reboot after the installation.

221

222 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Client Entry Configuration After the client is installed, you can open the client configuration by clicking on the VPN Dialer icon that is located in the installation directory. This brings up the Cisco VPN Client window depicted in Figure 10.1.

Figure 10.1 Cisco VPN Client opening window.

To begin the configuration process, you must click on the New button, which initiates the New Connection Entry Wizard. This wizard walks you through the necessary steps to create a VPN connection profile. Specifically, the wizard prompts you to name the new connection and associate it with a description. This is immediately followed by a prompt requesting the hostname or the IP address of the device to which the client will connect. This IP address is going to be a public IP that is assigned to an interface (such as the VPN 3000 Concentrator’s public interface) that is reachable from the Internet. The final input required entails the authentication parameters you want to utilize to authenticate to the remote device. You have the option of using preshared keys by specifying a group name and password that must match the concentrator’s group and password. An alternative to using preshared keys is to choose a digital certificate that is installed on the local workstation. As soon as your profile entry has been created, you can further manipulate specific parameters by clicking on the Options button and selecting Properties.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .VPN . . Windows . . . . . Client . . . .Configuration . . . . . . .

This brings up a screen with three tabs, labeled General, Authentication, and Connections. Some of the fields on these tabs will already be populated from the New Connection Entry Wizard. The exam expects you to recognize and identify the options listed on these three tabs. It is imperative that you know the three properties tabs (General, Authentication, and Connections) and the options each one presents to you.

The General Tab In this first tab illustrated in Figure 10.2, you can change the description that you specified in the New Connection Entry Wizard. The remainder of the fields closely coincide to the IPSec and Client Config tab’s options on the Configuration | User Management | Groups | Add or Modify menu. Namely, you can determine whether you want to use transparent tunneling if your client is behind a NAT- or PAT-capable device. You can choose to keep the default value of utilizing IPSec over UDP, or you can choose to use TCP instead, followed by the specification of a port number. IPSec over UDP NAT Transparency includes autodiscovery of the ratified NAT Traversal (NAT-T) using UDP port 4500. IPSec over TCP might be necessary when the intermediary NAT or PAT device is a stateful firewall. Whether you choose IPSec over UDP or IPSec over TCP, be sure these options are enabled in the IPSec gateway to which you are connecting. For example, if the gateway is a VPN 3000 Concentrator, be sure to enable IPSec over TCP or NAT-T at the Configuration | System | Tunneling Protocols | IPSec | NAT Transparency configuration page. Furthermore, if you are implementing IPSec over UDP, enable this feature in the Client Config tab located in the Configuration | User Management configuration pages for individual groups or the base group. Recall from Chapter 4, “Cisco VPN 3000 Remote Access Preshared Key Configuration,” when split tunneling is enabled on the concentrator, you have the option of letting the clients bypass the tunnel to send local traffic on their local LAN if you so specify in the network list. The Allow Local LAN Access check box lets the clients turn this feature on and off when they deem their local LAN to be secure (for example, work office versus hotel wireless). The last field in this property tab specifies the Dead Peer Detection time. Recall that DPD is a timer that is used to detect inactivity on the tunnel. After so many seconds of inactivity, the tunnel is torn down. The default value for the Unity Client is 90 seconds.

223

224 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 10.2 Unity Client connection properties General tab.

The Authentication Tab As the name states, the Authentication tab (Figure 10.3) is concerned with authentication parameters. These configurations are already defined with the wizard; however, you can change these parameters in instances where your group or preshared key password is changed. Furthermore, you can change your authentication to entail digital certificates. With this method, you have the option to have the client validate the chosen certificate, as well as to send the entire chain when authenticating. You might want to send the entire chain in instances where the remote peer that you are connecting to shares the same root CA, but different subordinate CAs. If you send the entire chain, the remote peer can still validate your identity to the root certificate included in the chain. By default, it sends only the issuing subordinate CA’s certificate.

The Connections Tab As shown in Figure 10.4, this tab deals with client connectivity to the Internet, as well as to backup concentrators. Specifically, you can define a list of up to ten backup servers (concentrators) that are running in parallel. This concept


is similar to popular dial-up ISPs. You typically have several phone numbers to connect to the ISP’s network in case one is busy or not working. Such is the case with backup servers. You also can prioritize certain concentrators by moving them up and down. This list can be pushed from the central concentrator. When this occurs, the pushed configuration overrides any manual settings in the client window.

Figure 10.3

Unity Client connection properties Authentication tab.

In the bottom two fields of this page, you can specify to dial out to the Internet before establishing the VPN. These are useful in instances where you are not connecting to the Internet over the LAN and you need to dial an ISP to gain connectivity to the Internet. The Unity Client interoperates efficiently with Windows Dial-Up Networking (DUN) or third-party dialing clients. In addition, using the Unity Client offers a considerable number of options and a great deal of control over the standard Windows VPN dialers that only support PPTP and L2TP.

225

226 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 10.4 Unity Client connection properties Connections tab.

Options Menu In Figure 10.5, the screenshot displays the many utilities and preferences that are available for you to tweak the Unity Client. The first four entries are for simplifying administration of VPN connection profile entries. Specifically, you can delete or rename the currently selected VPN entry. What’s more, you can clone an existing entry if you have similar requirements for another connection. All the entries that are being created are stored in the installation directory’s Profiles folder as .pcf files (more on this later). In this Options menu, you can also import a connection entry from any .pcf file. The next selection in the Options menu enables you to erase the user password that is locally stored on the PC. Notice that this option in Figure 10.5 is grayed out because this policy is determined by the central concentrator. If it is permitted on the Client Config tab in the User Management page, this option is enabled and you can delete the password. Allowing the users to save the password on the client can alleviate a multitude of support calls due to common misconfigured authentication credentials. However, for security reasons, this option is disabled by default on the concentrator and enabling it carries significant risks; the decision to enable it should be considered carefully. For convenience, you can select the Create Shortcut option, which automatically adds a desktop shortcut for the selected VPN entry. This selection is followed by the previously mentioned Properties option, which enables you


to configure specific parameters for the selected entry (refer back to the “Client Entry Configuration” section). Also previously mentioned, the next selection enables the Unity Client’s stateful CIC firewall to block incoming traffic, except for tunneled traffic, DHCP, and ESP (see Chapter 6, “Software Client Firewall Features”). The remaining selections deal with options that occur before you initiate a session with the VPN dialer. Namely, you can launch an application before each tunnel is established (for example, Log Viewer). The Automatic VPN Initiation option is displayed only when you have enabled Auto-initiation on the client by manipulating the global profile (discussed later in the “Client Auto-Initiation Feature” section). Lastly, in a Windows NT environment, you may also need to connect the VPN tunnel to the main network to have connectivity to a domain controller. After the tunnel is initiated, you can send your NT credentials to the controller and authenticate to the server. The Windows Logon Properties option allows you to enable this function, and also lets you automatically disconnect the tunnel when you log off the domain.

Figure 10.5 Options menu.

Connecting the VPN Tunnel After you have defined all parameters necessary on the client, in addition to the configurations on the concentrator, you can initiate the session by clicking on

227

228 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the Connect button. You are presented with the individual user login screen, similar to that in Figure 10.6. Notice in this particular example that the client was not able to communicate with the primary concentrator on this connection attempt, but it did connect with the first backup server in the supplied backup list. (In subsequent examples, the Unity Client will be connected to the primary concentrator.)

Figure 10.6 Individual user login.

After the concentrator authenticates the user, the user may be prompted with a banner message that can be centrally defined in the VPN Concentrator’s Client Config tab, as demonstrated in Figure 10.7. After the banner is displayed, the user is given the option to disconnect or to continue the session.

Figure 10.7 Login banner message.


After the connection is complete, the Unity Client alerts you of any notifications being received from the central concentrator. These notifications might consist of update messages or firewall warnings. After the notifications are closed, the VPN connection entry is signified as a closed lock in the workstation’s systray, as illustrated in Figure 10.8.

Figure 10.8 Notification with entry icon.

Client Auto-Initiation Feature In instances where the Unity Client resides on a network that consists of a wireless local area network (WLAN), you can manipulate the client to autoinitiate a VPN session to the concentrator when it receives an IP address on the wireless network card. This is quite useful because this address can change if you have multiple wireless access points throughout the building assigning different IP addresses from different networks. In addition, you can use this utility to force desktops or laptops to resume the VPN session when the station reboots or returns from a hibernate or suspended state. The CSVPN exam tends to ask questions concerning the ins and outs of the Auto-initiation feature. Please pay careful attention so you can be prepared if any questions are thrown your way.

229

230 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

You can achieve auto-initiation by manipulating the global profile that is represented as a file in the client’s installation directory. This global profile file is called vpnclient.ini and is shown in Listing 10.2. This vpnclient.ini contains settings that are global to all profiles and is created when you add functions from the Options menu. You can edit this file by simply using a text-editing program such as Notepad. Listing 10.2 Sample Output of vpnclient.ini [main] RunAtLogon=1 DialerDisconnect=1 AutoInitiationEnable=1 AutoInitiationRetryInterval=1 AutoInitiationList=techsupport StatefulFirewall=0 [techsupport] Network=192.168.100.0 Mask=255.255.255.0 ConnectionEntry=The Farm

The AutoInitiationEnable value in this file determines whether to turn on this function. A one signifies that the function is on, whereas a zero indicates the function is off. If for some reason the auto-initiate fails, the AutoInitiationRetryInterval code determines how many minutes (default is 1) should pass before the auto-initiate is retried. In addition, you can specify up to 64 networks in which you want to trigger the Auto-initiate session. Those networks are defined and named in the vpnclient.ini file and need to be referenced in the AutoInitiationList line, separated by commas. To complete the Auto-initiation procedure, you have to tell the Cisco Unity Client how to associate the IP address on its NIC to a .pcf profile. In Listing 10.2, the Auto-initiation entry is named techsupport. Following the entry’s name, you have to specify the network and mask that is to trigger the Autoinitiate process. After the network has been defined, you must associate the .pcf profile file in the ConnectionEntry line. In this example, when the client receives an IP address from the 192.168.100.0 network with a subnet mask of 255.255.255.0, it initiates a session with the parameters specified in the profile called “The Farm.” The Auto-initiation sequence is demonstrated in Figure 10.9.


Figure 10.9 Auto-initiation process.

Viewing the Connection Status Recall that after the VPN tunnel is established with the remote device, a closed lock icon appears at the bottom of the screen in the Windows systray. To view the connection status properties, you can either double-click on the icon or right-click on the icon and select the Status option. This brings up another window with two or three tabs (depending on whether firewall policies are activated). Furthermore, the bottom of these tabs include buttons to view concentrator notifications, reset statistics (does not reset actual sessions), and disconnect the connection. The next few sections look into these three tabs to explore what connection statistics they provide. Similar to the connection property tabs, these three tabs are also particularly important to recognize and comprehend. Be sure to form a thorough understanding of these three status tabs for the exam.

The General Tab The first tab that is displayed when you view a connection status is the General tab (Figure 10.10). This tab displays general statistics concerning the connection. Specifically, it displays the name of the connection and the assigned internal IP address. Additionally, it shows the IP address of the concentrator and the negotiated encryption settings for the session. Because this example is using concentrator and client software versions 3.6 or above, both tunnel endpoints support and are using AES symmetric encryption. In instances where transparent tunneling is active, the General tab displays the status of this feature and the UDP or TCP port that is being utilized by

231

232 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the client. Notice in this example that the UDP port specified is UDP port 4500. This output indicates that the client is passing through a NAT or PAT device to communicate with the concentrator, as well as that NAT-T was negotiated as the NAT transparency method. Directly below these statistics, you can see whether you have Lempel-Ziv compression enabled for this session as per the configuration on the central concentrator. The last few statistics entail the security features that might be enabled for this active connection. Namely, if local LAN access split tunneling is permitted on the concentrator and the client, the status reflects as enabled. Finally, the last two items reflect the current firewall in use on the client’s session and what firewall policy is in place for that firewall client. In this particular example, the Unity Clients internal CIC firewall is receiving parameters from the concentrator to utilize the networks CPP firewall policy.

Figure 10.10 Connection Status General tab.

The Statistics Tab The Statistics tab shown in Figure 10.11 provides information on the types of networks that are connected to the client and the packets that are being transported to and from those networks. These packet statistics include a total number of packets, packets encrypted over the secure tunnels, packets bypassed (ARP and DHCP requests, which do not need to be encrypted), and packets dropped that are not for any of the routes. Keep in mind that the Unity Client intercepts traffic to and from the networks listed in the table and encrypts or decrypts the packets accordingly. The networks listed in the table


are not recognized by the Windows operating system network properties such as the stations’ routing table or the IP statistics output of the ipconfig or winipcfg command. To verify these properties, you must use the Statistics tab of the Unity Client discussed in this section. The Secured Routes section displays traffic that has a secure IPSec tunnel associated with it. The key icon to the left of these tunnels means that the SA for this tunnel is active and a session key has been generated for it. If the key is not present, it appears as soon as data is sent to that specific network listed. The Local LAN Routes section is populated only if “Local LAN Access” is enabled and functioning. In these instances, the local networks show up in the table to illustrate the local networks that the client is allowed to access with clear text data. This is useful when you need to access resources on the local LAN, such as servers or printers.

Figure 10.11 Connection Status Statistics tab.

The Firewall Tab The Firewall tab is an optional tab that displays only if you have a personal firewall in place and an active firewall policy being pushed from the concentrator. The top of this tab informs you of the active firewall client and the type of policy that is implemented for this session. The remainder of the tab displays the active rules learned from the firewall and split tunneling policies, as demonstrated in Figure 10.12. This output illustrates the rules to which the client must adhere when forwarding packets to and from specific

233

234 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

networks. These rules are applied depending on the direction of the packets, as well as the type of protocol and the source and destination of the packets.

Figure 10.12 Connection Status Firewall tab.

This particular example shows the receipt of a set of firewall rules that are formed from the split tunneling policy as well as a CPP firewall policy, which have been expanded into Table 10.1. Table 10.1 Firewall Rules Output Source Address

Dest Address

Inbound

192.168.1.101

Local

Any

N/A

N/A

Outbound

Local

192.168.1.101

Any

N/A

N/A

Forward

Inbound

10.2.2.0

Local

Any

N/A

N/A

Forward

Outbound

Local

10.2.2.0

Any

N/A

N/A

Forward

Outbound

Local

Any

6

Any

80

Forward

Inbound

Any

Local

6

80

Any

Drop

Inbound

Any

Local

Any

N/A

N/A

Drop

Outbound

Local

Any

Any

N/A

N/A

Action

Direction

Forward Forward

Protocol

Source Port

Dest Port

The exam is likely to ask you about an output of firewall rules similar to the table above. You must be able to decipher the rules from the filter and determine what action is being taken for a specific rule set.


The first four rules are designated from the split tunneling policy that is in place. In these rules, all inbound and outbound traffic that is destined to and from the concentrator’s IP address and the private network is forwarded. The next two rules were pushed to the Unity Client via the CPP firewall policy. These rules enable Web traffic originating from the local client and returning from the Internet back to the client to be forwarded. In this fashion, when split tunneling is enabled, you can access Web pages from the client by bypassing the tunnel and sending traffic to the Internet in clear text. The final two rules are determined by the default filter rule if there is not a specific match. In the example, the default rule is to drop traffic when there is no match. By implementing this last rule, the only traffic that is allowed to get to the client is traffic permitted by the previous rules. Thus, if an attacker is trying to compromise the client, its packets are dropped because there is no rule granting it access.

Disconnecting the VPN Tunnel You can employ several methods to disconnect the tunnel. The manual method to disconnect the session entails either clicking on the Disconnect button in the Connection Status tabs or right-clicking on the lock icon in the systray and choosing Disconnect. To disconnect the tunnel automatically, simply allow the Dead Peer Detection timer to expire and disconnect the tunnel. Additionally, if the firewall policy consists of the AYT feature, disabling your firewall forces the concentrator to drop the connection.

Managing the VPN Client Aside from the VPN dialer, the Unity Client also contains several support utilities. Namely, the Set MTU utility enables you to manipulate the size of frames traversing the tunnel. In addition, the Unity Client contains a Log Viewer application in which you can enable logging on to the client; you can also use the log viewer to help you troubleshoot failing connections. The final utility provided by the Cisco Unity Client is called Certificate Manager. As the name implies, it enables you to manage digital certificates that are stored on your workstation. This utility can be used to view, verify, delete, export, and password protect any installed identity and CA certificates. As depicted in Figure 10.13, you can generate a file-based or SCEP network-based PKCS#10 request for an identity certificate. When this request is generated, you can monitor the progress of the request in the

235

236 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Utility window. After an identity certificate is installed on the local workstation, it can be used in IKE phase 1 authentication if you select it in the Authentication tab of the connection’s properties (see the “Authentication Tab” section in the beginning of this chapter). Recall that the OU field in an identity certificate is used by the VPN Concentrator to associate the authenticating device to a group. Notice that the field to input this OU value is called Department in the Certificate Manager. Be sure that this field contains a valid group on the VPN 3000 Concentrator or external authentication server.

Figure 10.13 Certificate Manager PKCS#10 enrollment form.

Cisco VPN Client Version 4.0 As of this writing, the exam focuses on the later 3.x releases of the Cisco Unity Client. However, it is worth mentioning that the new 4.x versions of the Cisco VPN Client for Windows contain a different user interface than its predecessor. This new graphical interface is comparable in appearance to the Cisco VPN Client for Mac OSx introduced in version 3.7. This section briefly explores some of the alterations that were made to the Unity Client’s interface for future revisions of the CSVPN exam.


Aside from the capability to coexist with other OEM VPN clients and the addition of a Cisco virtual adapter that appears in the station’s network properties, there are not too many functional enhancements to the earlier releases of the 4.x Unity Client. However, the display and location of the client’s utilities are considerably different from the 3.x versions of the Cisco VPN Client for Windows. To illustrate this point, Figure 10.14 displays the new graphical user interface of the 4.x client.

Figure 10.14 VPN Client configuration window.

The first noticeable difference is that the connection entry application is now simply called VPN Client, as opposed to the VPN Dialer application of old. Here you are presented with all your created connection profiles with the default profile (the one that will be used when you hit the Connect button, unless otherwise specified) displayed in bold text. Also, notice that the Certificate Manager and the Log Viewer applications are now incorporated into the VPN Client user interface application in the additional Certificates and Log tabs. When creating or modifying a new connection entry, the configuration screen displayed has the same functions as previous versions; however, the locations of the fields have been altered as illustrated in Figure 10.15. Note that there are now four connection entry tabs: Authentication, Transport, Backup Servers, and Dial-Up. The top of the Properties windows enables you to create the connection entry name and description (formerly located in the General tab), as well as the hostname or IP address of the IPSec gateway to which the client will connect. The Authentication tab is practically identical to the Authentication tab of the 3.x Unity Clients, in which you either specify a group name and password for preshared keys, or choose an existing identity certificate in the pull-down menu. The remaining parameters from the 3.x General tab reside on the new Transport tab.

237

238 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Here you can define the preferred NAT Transparency method, local LAN access, and DPD timer. Lastly, the Connection tab of old has been spilt into the Backup Servers tab and the Dial-up tab. As their names state, the Backup Servers tab contains the backup concentrator list that is manually configured or supplied by the concentrator, and the Dial-Up tab holds the fields to specify a DUN entry or a third-party dialing entry for connectivity to the Internet.

Figure 10.15 New or Modify connection entry configuration window.

After you are connected, you can still view statistics for that session by selecting the VPN Client’s Statistics option (as opposed to Status) in the systray icon or in the VPN Client window. Again, you are presented with a similar output, but the naming convention for the statistics tabs has changed, as shown in Figure 10.16. The three Connection Status tabs (General, Statistics, and Firewall) have been changed to Tunnel Details, Route Details, and Firewall, respectively. Recall that verion 4.x actually installs a virtual interface on the operating system. As such, these versions enable you to display VPN addresses and networks in the computer’s routing table and the output of the ipconfig or winipcfg utilities.

One of the most significant changes in the 4.x version of the Cisco VPN Client resides behind the scenes in the vpnclient.ini global profile. There are several residual entries in this file that are similar to the previous versions (auto-initiate, stateful firewall, and so on); however, you can configure several


new options in this file that cannot be manipulated in the GUI configuration windows. You can modify the settings in this file and make them part of a standard client installation (with the oem.ini file). To illustrate some of these additions, Listing 10.3 displays a modified output of a 4.x vpnclient.ini file.

Figure 10.16 VPN Client Statistics window.

Listing 10.3 Sample Output of 4.x vpnclient.ini [main] RunAtLogon=1 DialerDisconnect=1 AutoInitiationEnable=1 AutoInitiationRetryInterval=1 AutoInitiationList=techsupport StatefulFirewall=0 StatefulFirewallAllowICMP=1 [techsupport] Network=192.168.100.0 Mask=255.255.255.0 ConnectionEntry=The Farm [NetLogin] Force=1 Wait=15 DefaultMsg=You will be logged off in 15 seconds Separator=************************************** [GUI] WindowWidth=578 WindowHeight=367 WindowX=324

239

240 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Listing 10.3 Sample Output of 4.x vpnclient.ini (continued) WindowY=112 VisibleTab=0 ConnectionAttribute=0 AdvancedView=1 DefaultConnectionEntry=ACME MinimizeOnConnect=1 UseWindowSettings=1 ShowToolTips=1 ShowConnectHistory=1

In this example, the VPN client still auto-initiates a VPN tunnel by using the The Farm profile when it receives an IP address in the 192.168.100.0 network. Notice that the integrated CIC stateful firewall contains an additional entry (StatefulFirewallAllowICMP=1) that allows ICMP through the firewall. In addition, the [NetLogin] section of this file enables a feature called Force Network Login, which forces Windows NT, 2000, and XP users to log off the PC and log back in. After they log back into the PC, the VPN tunnel reestablishes itself automatically. This is a very useful utility that ensures that the user connecting the tunnel to the network has a valid account on the PC. This prevents “piggy backers” from initiating a tunnel connection if the station’s user is away and did not lock his or her PC. Finally, notice that the [GUI] division of this file contains attributes in which you can change the appearance setting of the GUI interface. Namely, the AdvancedView=1 line entry allows the default GUI to be the Advanced View interface (refer back to Figure 10.14), or a condensed interface called Simple View (Figure 10.17), which presents users with the minimum options necessary to get them to connect the tunnel. This handy feature enables administrators to make tunnel connections easier for non-technical users, as well as to keep them out of trouble by hiding options that could cause users to “accidentally” change or delete entries. This view can be toggled in the GUI; however, the vpnclient.ini global profile can make this the default when users open the VPN Client application.

Figure 10.17 VPN Client Simple View.


Summary The Cisco Unity VPN client is part of Cisco’s Unified Client Framework, which allows the client to interoperate with VPN Concentrators, PIX firewalls, and Cisco routers. The client can be installed on several platforms, including Microsoft Windows, Linux, Solaris UltraSparc, and Macintosh. The Cisco VPN Client for Windows and the Cisco VPN Client for Mac OSX are the only software clients that are GUI-based. You can install the client automatically in silent mode by creating an oem.ini file. When you create a connection entry, it is stored as a .pcf file in the profile directory. You can edit the connection entries by pressing the Options button and selecting Properties on the menu. This brings up a new window with three tabs on it labeled General, Authentication, and Connections. The General tab allows you to enable transparent tunneling, allow local LAN access, and set the Dead Peer Detection time. On the Authentication tab, you can specify the group and preshared key or digital certificate to utilize during IKE negotiations. Finally, the Connections tab allows you to define up to 10 backup servers and specify any dial-up parameters to connect to the Internet. If you want the client to auto-initiate a connection to the VPN concentrator, you must edit the vpnclient.ini file and enable this feature. In addition, you can create a list of up to 64 connection entries, which you must associate with a .pcf connection profile. The Options menu offers you several parameters that you can manipulate to tweak settings for the VPN client. Namely, you can clone, create, delete, and import profile entries. What’s more, you can delete locally stored user passwords, create a desktop shortcut, and enable the CIC stateful firewall (which is based on Zone Labs technologies). In the Options menu, you also can launch an application, turn off Auto-initiate, and instruct the VPN dialer to initiate a tunnel before logging into a Windows domain. When you press the Connect button to initiate the tunnel, a closed lock icon appears in the systray. You can click on this icon to display the Connection Status window, which contains a General, Statistics, and Firewall tab. The General tab displays connections statistics, such as IP addresses, encryption algorithms, compression, tunnel transparency, local LAN access, and firewall options. The Statistics tab displays packets being transmitted for all known secure and local LAN routes. The Firewall tab displays the firewall policy in place and any firewall rules that are assigned as a result of the firewall policy and split tunneling. If you want to disconnect, click on the Disconnect button at the bottom of this window or right-click on the icon and choose the Disconnect option.

241

242 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Cisco Unity Client also contains some additional applications to help manage the VPN Dialer. The Log Viewer is utilized to help troubleshoot connectivity problems when logging is enabled on the VPN Dialer. You also may manipulate the frame MTU size by using the Set MTU application. The last utility, called Certificate Manger, enables you to delete, view, verify, and request identity and CA certificates for the workstation. The Cisco VPN Client supports network-based enrollment with SCEP or file-based enrollment. Version 4.x of the Cisco Client for Windows has some significant changes to the graphical interface. Specifically, the Log Viewer and the Certificate Manager applications are integrated in the once-called VPN Dialer application now called VPN Client. In addition, the connection entry properties, as well as the connection status windows, have changed and added tabs from the 3.0 version of the Cisco VPN Client. Finally, the vpnclient.ini global profile has added support for additional entries that can force local PC account logins, as well as present users in either Advanced View or Simple View when they open the client.


Exam Prep Questions Question 1 Which file can be edited to provide an automatic silent installation of the Cisco Unity Client? ❍ A. silent.ini ❍ B. profile.pcf ❍ C. oem.ini ❍ D. vpnclient.ini ❍ E. global.ini

Answer C is correct. The oem.ini file can be edited to create an automatic installation of the Cisco Unity Client without interrupting the user. Answers A and E are incorrect because those files do not exist. Answer B is incorrect because .pcf files are files that are stored for each connection entry. Answer D is incorrect because the vpnclient.ini is the global profile file that enables you to configure environment settings for the client, such as auto-initiation.

Question 2 Which of the following are supported OS platforms for the Cisco Unity Client? (Choose all that apply.) ❑ A. Linux ❑ B. OS2 Warp ❑ C. Microsoft Windows ❑ D. Solaris UltraSparc ❑ E. Macintosh

Answers A, C, D, and E are correct. The supported platforms for the Cisco Unity Client are Sun UltraSparc, Linux, Macintosh, and Microsoft Windows. OS2 Warp is not a supported platform.

243

244 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 3 What file extension is used for connection profiles? ❍ A. .ini ❍ B. .pcf ❍ C. .prf ❍ D. .vpn

Answer B is correct. All created connection profiles are stored in the Profiles folder and have a .pcf file extension. Answer A is incorrect because files with an .ini extension are used for application controls in a Windows operating system. Answers C and D are incorrect because they are not actual file extensions used in the Cisco VPN Client.

Question 4 What are the three tabs that are displayed when viewing a connection entry’s properties? (Choose three.) ❑ A. Statistics ❑ B. Firewall ❑ C. General ❑ D. Connections ❑ E. Authentication ❑ F. Authorization

Answers C, D, and E are correct. The three connection property tabs are General, Authentication, and Connections. Answers A and B are incorrect because the Statistics and the Firewall tabs are located in the Connection Status window, as opposed to the Connection Properties window. Answer F is incorrect because this tab does not exist in the Unity Client.


Question 5 What are the three tabs that are displayed when viewing a connection status? (Choose three.) ❑ A. Statistics ❑ B. Firewall ❑ C. General ❑ D. Connections ❑ E. Authentication ❑ F. Authorization

Answers A, B, and C are correct. After clicking on the lock icon in the systray, you are presented with the General, Statistics, and Firewall tabs. Answer D is incorrect because the the Connections tab is part of the Connection Properties window. Answer F is incorrect because this tab does not exist in the Unity Client.

Question 6 Your company was running version 2.5 of the VPN Concentrator and has recently upgraded to version 3.6 to support AES encryption. You are currently using version 2.5 of the Cisco VPN Client. What version of Cisco Unity client should you recommend for the individual clients? ❍ A. 3.0 ❍ B. 3.5 ❍ C. 3.6 ❍ D. 2.5

Answer C is correct. When upgrading the software version on the VPN Concentrator, it is recommended that you upgrade to a comparable version of the VPN client to support any new features. If the VPN 3000 Concentrator is operating in version 3.x, you must at least be running version 3.0 of the Unity Client. In this example, because AES was added in version 3.6, you should upgrade your Cisco VPN clients to version 3.6. Answers A, B, and D are incorrect because those versions do not support the AES encryption.

245

246 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 7 You are using digital certificates for authentication to the central concentrator. You have created a group called Unity on the VPN Concentrator. When enrolling for the digital certificate in Certificate Manager, what field must you use to tell the authenticating concentrator to associate you with that particular group? ❍ A. Department ❍ B. Common Name ❍ C. Company ❍ D. IP Address

Answers A is correct. The Department field in the certificate enrollment form is the OU field in the certificate. This is the field that the central concentrator uses to associate authenticating devices with a group name. Answers B, C, and D are incorrect because these fields are not used by the authenticating concentrator for group identification.

Question 8 To configure the Cisco VPN Client with a graphical interface, you must be running which two client platforms? (Choose two.) ❑ A. Cisco VPN Client for Windows version 2.5 and above ❑ B. Cisco VPN Client for Mac OSx version 3.7 and above ❑ C. Cisco VPN Client for Mac OSx version 3.5 and above ❑ D. Cisco VPN Client for Linux version 3.7 and above

Answers A and B are correct. Both the Cisco VPN Client for Windows and, starting with version 3.7, the Cisco VPN Client for OSx support a graphical user interface. Answer C is incorrect because version 3.5 did not support GUI-based configurations. Answer D is incorrect because the Linux, Solaris UltraSparc, and pre-version 3.7 Macintosh clients all use a CLI for client configuration.


Question 9 Which line entry in a vpnclient.ini file allows auto-initiation of tunnel connections? ❍ A. AutoInitiationEnable=0 ❍ B. AutoInitiationRetryInterval=1 ❍ C. AutoInitiation=Enable ❍ D. AutoInitiationEnable=1

Answer D is correct. The correct line entry to enable Auto-initiate is AutoInitiationEnable=1. Answer A is incorrect because the =0 value actually makes the line entry false, thus disabling Auto-initiation. Answer B is incorrect because this entry allows Auto-initiate to retry only if a connection does not occur on the first attempt. Answer C is not a proper line entry for the vpnclient.ini file.

Question 10 In which two locations can you toggle the interface from Simple View to Advanced View in the 4.x versions of the Cisco VPN Client? (Choose two.) ❑ A. In the oem.ini file ❑ B. In the vpnclient.ini file ❑ C. In the VPN Client interface window ❑ D. In the VPN Dialer interface window

Answers B and C are correct. Simple View and Advanced View can be changed in the line entry, AdvancedView=1, in the vpnclient.ini file. In addition, this can be toggled in the VPN Client main window. Answer A is incorrect because the oem.ini file allows you to create silent installations, not change interface views. Answer D is incorrect because the VPN Dialer is the application for version 3.x of the Cisco VPN Client.

247

248 Chapter 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Need to Know More? Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. For a complete overview of the administration and monitoring functions of the VPN 3000 Concentrator, find Cisco’s Web documentation at www.cisco.com/en/US/products/sw/secursw/ps2308/products_ administration_guides_list.html and download the VPN Client Administrator Guide for the requested software release.

11 Practice Exam 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

In this chapter, I provide pointers to help you develop a successful test-taking strategy, including how to choose proper answers, how to decode ambiguity, how to work within the Cisco testing framework, how to decide what you need to memorize, and how to prepare for the test. At the end of the chapter, I include 75 questions on subject matter pertinent to Cisco Secure VPN Exam (CSVPN 640-511). In Chapter 12, you’ll find the answer key to this test. Good luck!

Questions, Questions, Questions There should be no doubt in your mind that you are facing a test full of specific and pointed questions. The exam includes 55 to 65 questions. You are allotted 90 minutes to complete the exam and you cannot mark or go back to a question. Also note that this test might contain a maximum of 2 simulations. Whichever type of test you take, exam questions belong to one of four basic types: ➤ Multiple choice with a single answer ➤ Multiple choice with multiple answers ➤ Drag-and-drop ➤ Simulations, whereby you configure the Cisco VPN Concentrator inter-

face via CLI or GUI You should always take the time to read a question at least twice before selecting an answer, and you should always look for an Exhibit button as you examine each question. Exhibits include graphics information related to a

250 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

question. An exhibit is usually a screen capture of program output or GUI information that you must examine to analyze the question’s contents and formulate an answer. The Exhibit button displays graphics and charts used to help explain a question, provide additional data, or illustrate page layout or program behavior. Not every question has only one answer; many questions require multiple answers. Therefore, you should read each question carefully, determine how many answers are necessary or possible, and look for additional hints or instructions when selecting answers. Such instructions (for example, Choose Two) often appear in brackets immediately following the question itself (for multiple-answer questions). In addition, the answers themselves should appear as radio buttons for single answers and check boxes for multiple answers.

Picking Proper Answers Obviously, the only way to pass any exam is to select enough of the correct answers to obtain a passing score. However, Cisco’s exams are not standardized like the SAT and GRE exams; they are far more diabolical and convoluted. In some cases, questions are strangely worded, and deciphering them can be a real challenge. In those cases, you may need to rely on answerelimination skills. Almost always, at least one answer out of the possible choices for a question can be eliminated immediately because it matches one of these conditions: ➤ The answer does not apply to the situation. ➤ The answer describes a nonexistent issue, an invalid option, or an imagi-

nary state. ➤ The answer may be eliminated because of information in the question

itself. After you eliminate all answers that are obviously wrong, you can apply your retained knowledge to eliminate further answers. Look for items that sound correct but refer to actions, commands, or features that are not present or not available in the situation that the question describes. If you’re still faced with a blind guess among two or more potentially correct answers, reread the question. Try to picture how each of the possible remaining answers would alter the situation. Be especially sensitive to terminology; sometimes the choice of words (“remove” instead of “disable”) can make the difference between a right answer and a wrong one.

251 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Only when you’ve exhausted your ability to eliminate answers but remain unclear about which of the remaining possibilities is correct should you guess at an answer. An unanswered or incorrectly answered question offers you no points, but guessing gives you at least some chance of getting a question right; just don’t be too hasty when making a blind guess.

Decoding Ambiguity Cisco exams have a reputation for including questions that can be ambiguous. In my experience with numerous exams, I consider this reputation to be completely justified. However, Cisco exams are tough, and they’re deliberately made that way. Questions often give away their answers, but you have to be Sherlock Holmes to see the clues. Often, subtle hints appear in the question text in such a way that they seem almost irrelevant to the situation. You must realize that each question is a test unto itself and that you need to inspect and successfully navigate each question to pass the exam. Look for small clues, such as the mention of times, group permissions and names, and configuration settings. Little things such as these can point to the right answer if they’re properly understood; if missed, they can leave you facing a blind guess. Another common difficulty with certification exams is vocabulary. Be sure to brush up on the key terms presented at the beginning of each chapter of this book. You may also want to read the glossary at the end of this book the day before you take the test.

Working Within the Framework The test questions appear in random order, and many elements or issues that are mentioned in one question may also crop up in other questions. Take the time to read every answer to each question, even if you recognize the correct answer to a question immediately. That extra reading may spark a memory, or remind you about a Cisco VPN Concentrator feature or function that helps you on another question elsewhere in the exam. When taking a test and you see something in a question or in one of the answers that jogs your memory on a topic, or that you feel you should record if the topic appears in another question, write it down on your piece of paper. Just because you can’t go back to a question in a test doesn’t mean you can’t take notes on what you see early in the test, in hopes that it might help you later in the test.

252 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Don’t be afraid to take notes on what you see in various questions during the test. Sometimes, what you record from one question can help you on other questions later on, especially if it’s not as familiar as it should be or it reminds you of the name or use of some utility or interface details.

Deciding What to Learn The amount of learning you must undertake for an exam depends on how well you remember what you’ve read and how well you know the technology by heart. If you’re a visual thinker and can see the drop-down menus and dialog boxes in your head, you don’t need to memorize as much as someone who’s less visually oriented. However, the exam will stretch your abilities to commit to memory product features and functions, interface details, and proper application design, development, and maintenance approaches, as well as how they all relate to Cisco VPN solution. At a minimum, you should comprehend the following kinds of information: ➤ VPN 3000 Concentrator Series models ➤ Using preshared keys for remote access ➤ Using digital certificates for remote access ➤ Firewall policy features of the VPN 3000 Concentrator ➤ Monitoring remote access networks ➤ Administering the VPN 3000 Concentrator ➤ Load balancing and backup ➤ VPN 3002 Hardware Client ➤ Cisco VPN Unity Software Client ➤ LAN-to-LAN VPN sessions with preshared keys and digital certificate ➤ LAN-to-LAN VPN sessions with NAT

Don’t forget that The Cram Sheet at the front of the book is designed to capture the material that’s most important to memorize; use this to guide your studies as well.

253 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Preparing for the Test The best way to prepare for the test—after you’ve studied—is to take at least one practice exam. I’ve included one here in this chapter for that reason; the test questions are located in the pages that follow. (Unlike the questions in the preceding chapters in this book, the answers don’t follow the questions immediately; you’ll have to flip to Chapter 12 to review the answers separately.) Give yourself 75 minutes to take the exam, and keep yourself on the honor system—don’t look at earlier text in the book or jump ahead to the answer key. When your time is up or you’ve finished the questions, you can check your work in Chapter 12. Pay special attention to the explanations for the incorrect answers; these can also help reinforce your knowledge of the material. Knowing how to recognize correct answers is good, but understanding why incorrect answers are wrong can be equally valuable.

Taking the Test Relax. After you’re sitting in front of the testing computer, there’s nothing more you can do to increase your knowledge or preparation. Take a deep breath, stretch, and start reading that first question. You don’t need to rush, either. You have plenty of time to complete each question. On a fixed-length test, if you read a question twice and you remain clueless, you have to guess and move on. Both easy and difficult questions are intermixed throughout the test in random order. If you’re taking a fixedlength test, don’t cheat yourself by spending too much time on a hard question early in the test, thereby depriving yourself of the time you need to answer the questions at the end of the test. When you’re taking a test, don’t spend more than one minute on any single multiple choice question and 10 minutes on a simulation question—if it takes you that long to get nowhere, it’s time to guess and move on. On the test, set a maximum time limit for questions, and watch your time on long or complex questions. If you hit your limit, it’s time to guess and move on. Don’t deprive yourself of the opportunity to see more questions by taking too long to puzzle over one, unless you think you can figure out the answer. Otherwise, you’re limiting your opportunities to pass.

254 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Practice Exam 1 Question 1 Which of the following are primary threats to network security? (Choose all that apply.) ❑ A. Unstructured threat ❑ B. Structured threat ❑ C. External threat ❑ D. Internal threat ❑ E. Non-filterable threat

Question 2 A _________ is classified as unauthorized discovery and mapping of systems, services, or vulnerabilities on a network. ❍ A. Reconnaissance attack ❍ B. Access attack ❍ C. Denial of Service attack ❍ D. Virus

Question 3 Which of the following VPN network types is targeted toward mobile users and home telecommuters? ❍ A. Remote Access VPN ❍ B. Site-to-Site VPN ❍ C. Firewall-based VPNs ❍ D. Stateful VPNs

255 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 4 Out of the box, which of the following VPN Concentrator models only support software encryption? (Choose all that apply.) ❑ A. 3005 ❑ B. 3015 ❑ C. 3030 ❑ D. 3060 ❑ E. 3080

Question 5 Which of the following models of VPN Concentrator support a maximum of 100 simultaneous sessions? (Choose all that apply.) ❑ A. 3005 ❑ B. 3015 ❑ C. 3030 ❑ D. 3060 ❑ E. 3080

Question 6 You have a 3005 VPN Concentrator running in an environment that supports both site-to-site VPNs as well as remote access VPNs. You have 36 branch offices that have site-to-site tunnels established to the Head Office 3005 Concentrator. What is the maximum number of remote access VPN tunnels that can now be established with this VPN 3005 Concentrator? ❍ A. 100 ❍ B. 73 ❍ C. 64 ❍ D. 93 ❍ E. 50

256 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 7 To establish a site-to-site VPN tunnel between a PIX firewall and the VPN Concentrator you are required to be running release ___ software on the VPN concentrator and release ____ software on the PIX firewall. ❍ A. 2.5(2), 5.2 ❍ B. 3.0, 5,2 ❍ C. 2.5(2), 12.1 ❍ D. 5.2, 2.5(2)

Question 8 Which of the following statements are true about IPSec? (Choose all that apply.) ❑ A. IPSec operates at the transport layer. ❑ B. It can be used to authenticates IP packets. ❑ C. Provides data confidentiality. ❑ D. Data integrity. ❑ E. Origin authentication.

Question 9 Which key encryption methodology has each peer utilize the same key to encrypt and decrypt the data? ❍ A. Analog ❍ B. Symmetric ❍ C. Asymmetric ❍ D. Digital

257 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 10 When utilizing RSA encryption, the remote tunnel endpoint decrypts data using its own _______ key. ❍ A. Public ❍ B. Private ❍ C. Authentication Header ❍ D. DES

Question 11 Which of the following Diffie-Hellman key exchange algorithms uses a key size of 1024 bits? ❍ A. Group 1 ❍ B. Group 2 ❍ C. Group 5 ❍ D. Group 7

Question 12 Which of the following Hashed Message Authentication Code (HMAC) algorithms use a 128-bit secret key? ❍ A. DES ❍ B. HMAC-MD5 ❍ C. 3DES ❍ D. HMAC-SHA-1

258 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 13 Authentication Header (AH) provides which of the following benefits? (Choose all that apply.) ❑ A. Guarantees data integrity ❑ B. Provides origin authentication ❑ C. Provides data encryption ❑ D. Uses hashing algorithm ❑ E. Provides anti-replay mechanism

Question 14 Which of the following statements about ESP in tunnel mode are true? (Choose all that apply.) ❑ A. Original packet is protected. ❑ B. Original packet is not protected. ❑ C. ESP header and trailers are added to the encrypted payload. ❑ D. New IP header is appended to the front of the authenticated payload. ❑ E. New IP header is appended to the end of the authenticated payload.

Question 15 The purpose of the IKE phase 1 process is to negotiate IKE policy sets and it can be done in two different modes. Which of the following are the two modes of IKE phase 1 negotiation? ❍ A. Passive mode ❍ B. Aggressive mode ❍ C. Quick mode ❍ D. Main mode ❍ E. Primary mode

259 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 16 Which of the following modes negotiate a shared IPSec transform set, establishes security associations, and derives shared secret keying material that is used for the IPSec security algorithms? ❍ A. Aggressive mode ❍ B. Main mode ❍ C. Quick mode ❍ D. Passive mode

Question 17 Which of the following parameters constitute the IPSec Security Association (SA)? (Choose all that apply.) ❑ A. Encryption algorithm ❑ B. Authentication algorithm ❑ C. IPSec tunneling mode ❑ D. Key lifetime ❑ E. Diffie-Hellman group number

Question 18 On a Cisco VPN Concentrator, VRRP (Virtual Router Redundancy Protocol) and load balancing can be performed at the same time. ❍ A. True ❍ B. False

260 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 19 How does a Cisco VPN Concentrator calculate load when load balancing is implemented? ❍ A. As an average of current active and inactive sessions divided by the maximum allowed connections ❍ B. As a percentage of current active sessions divided by the minimum allowed connections ❍ C. As a total of current inactive sessions divided by the maximum allowed connections ❍ D. As a percentage of current active sessions divided by the configured maximum allowed connections ❍ E. As a total of current active and inactive sessions divided by the maximum allowed connections

Question 20 The Cisco VPN Windows client offers support for firewall features that can be used to enhance security for Windows-based PCs running Cisco IPSec client release 3.5. What are the different modes that can be configured to provide firewall capability for a Cisco IPSec Client for Windows? (Choose all that apply.) ❑ A. Are You There ❑ B. Stateful Firewall (always on) ❑ C. Cisco Pushed Policy ❑ D. Cisco VRRP Client

Question 21 Which of the following features verify the presence of a firewall and report that information back to the Concentrator? ❍ A. Cisco Smartcards ❍ B. Stateful Firewall (always on) ❍ C. Cisco Pushed Policy ❍ D. Are You There

261 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 22

The Cisco VPN Concentrator can be configured via a CLI and a GUI. When you use the CLI to configure the VPN Concentrator, the terminal emulation software should be configured for which of the following settings? (Choose all that apply.) ❑ A. Data bits = 8 ❑ B. Speed = 11250 ❑ C. Stop Bits = 1 ❑ D. Parity = N ❑ E. Speed = 9600

Question 23 Which statement about Quick Configuration on a Cisco VPN Concentrator is not true? (Choose all that apply.) ❑ A. Quick configuration enables you to configure minimal parameters. ❑ B. Quick configuration can be run only once. ❑ C. Quick configuration can be run anytime by clicking on the Configuration | Quick Configuration submenu. ❑ D. You must reboot the VPN Concentrator to the factory default configuration to run Quick configuration again.

262 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 24

When in Quick Configuration mode, which of the following parameters enable you to obtain the virtual IP address under the Configuration | Quick | Address Management window? (Choose all that apply.) ❑ A. Client Specified ❑ B. Per User ❑ C. DHCP ❑ D. Configured Pool

Question 25 When configuring external authentication using an NT domain, what required NT parameter has to be configured in the Domain Controller Name field under the Configuration | Quick | Authentication window? ❍ A. Fully qualified domain name ❍ B. IP Address of the domain controller ❍ C. Computer name ❍ D. Administrator password

263 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 26 Which of the following attributes can be configured under the General tab in the Configuration | User Management | Groups | Modify Group window? ❍ A. Max connect time ❍ B. Filter ❍ C. Maximum password length ❍ D. Idle timeouts ❍ E. Firewall policy

Question 27

A Group Name password can range from a minimum of ___ characters to a maximum of ___ characters. ❍ A. 4, 32 ❍ B. 2, 24 ❍ C. 3, 16 ❍ D. 5, 8

264 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 28 Which of the following fields under the General tab in the Configuration | User Management | Groups | Modify Group window determines the termination of a VPN connection if there is a configured period of connect time for the link? ❍ A. Access Hours ❍ B. Maximum Connect Time ❍ C. Maximum Login Field ❍ D. Idle Timeout

Question 29

Which of the following tabs under the Configuration | User Management | Groups | Modify Group | window enables you to configure specific Cisco clients and Microsoft clients, as well as the Common Client parameters? ❍ A. Identity ❍ B. General ❍ C. IPSec ❍ D. Client Config ❍ E. Client FW

265 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 30 What are the various split tunneling parameters that can be configured under the Client Config tab of the Configuration | User Management | Groups | Modify Group window? (Choose all that apply.) ❑ A. Tunnel Everything ❑ B. Allow Networks in the List to Bypass the Network ❑ C. Do Not Tunnel Anything ❑ D. Only Tunnel Networks in List

Question 31

The Concentrator has been configured to tunnel everything except local LAN traffic, and the default VPN Client Local LAN network list has been applied to the SALES group. Which of the following statements hold true when members of the SALES group residing on the 172.31.100.x/24 connect to the VPN Concentrator residing on a 30.10.0.x/24 network by using the Software Client? (Choose all that apply.) ❑ A. The concentrator pushes down the network list to the Software Client. ❑ B. The network list that is pushed down is 0.0.0.0/0.0.0.0. ❑ C. The network list that is pushed down is 0.0.0.0/255.255.255.0. ❑ D. Local traffic is routed in clear text. ❑ E. Local traffic is encrypted and then routed through the concentrator.

266 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 32 Which of the following features governs how a VPN software client resolves whether a DNS query packet has to be sent in clear text or encrypted and sent over the tunnel? ❍ A. Dynamic DNS ❍ B. Tunneled DNS ❍ C. Virtual DNS ❍ D. Split DNS

Question 33 Which of the following statements are true regarding Dynamic DNS? (Choose all that apply.) ❑ A. DDNS was supported prior to Release 3.6 software version. ❑ B. DDNS is supported from Release 3.6 software version. ❑ C. DDNS applies to software client connections when a DHCP server assigns an IP address to the software client. ❑ D. DDNS applies to software client connections when a local pool is used to assign IP addresses to the software client.

Question 34 Which of the following options under the Configuration | Interfaces | Ethernet2 | Public Interface IPSec Fragmentation Policy allows the Concentrator to encapsulate and then fragment packets that exceed the MTU setting before pushing them through the public interface? ❍ A. Do Not Fragment Prior to IPSec Encapsulation; Fragment Prior to Interface Transmission ❍ B. Fragment Prior to IPSec Encapsulation with Path MTU Discovery ❍ C. Fragment Prior to IPSec Encapsulation Without Path MTU Discovery ❍ D. Fragment Prior to IPSec Encapsulation; Fragment Prior to Interface Transmission

267 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 35

Which of the statements are true regarding the Group Access Information found on the Authentication tab of the Software VPN Client? (Choose all that apply.) ❑ A. The group name should be the same as the group name configured on the Concentrator. ❑ B. The group name and password are case-sensitive. ❑ C. The group name is not case-sensitive but the password is casesensitive. ❑ D. The password is the preshared key used in IKE Phase 1 negotiation.

Question 36 Which of the following files is used to create connection entries within the Cisco VPN Client VPN Dialer application? ❍ A. oem.ini ❍ B. vpnclient.ini ❍ C. vpnbuild.ini ❍ D. .pcf ❍ E. profile.ini

268 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 37 Which of the following sections under the Monitor |Sessions window displays statistics on all users connecting to the VPN Concentrator using Cisco VPN Software Client? ❍ A. Session Summary ❍ B. LAN-to-LAN Sessions ❍ C. Remote Access Sessions ❍ D. Management Sessions

Question 38 Which of the following statements are true regarding digital signatures? (Choose all that apply.) ❑ A. They tie a message to sender’s public key. ❑ B. They tie a message to sender’s private key. ❑ C. The hash can be decrypted by sender’s private key. ❑ D. The hash can be decrypted by sender’s public key.

Question 39 Which of the following certificates is installed first on the VPN Concentrator? ❍ A. Identity certificate ❍ B. PKCS#7 ❍ C. PKCS#10 ❍ D. Root certificate

Question 40 Which of the following is not true about a hierarchical PKI model? ❍ A. Single root CA signs all certificates. ❍ B. Works well in large enterprise networks. ❍ C. Uses a tiered approach. ❍ D. Uses subordinate CA. ❍ E. Root CA is at the top of the hierarchy.

269 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 41

Which of the following fields does the concentrator use as the group name when it uses PKCS#10 to create a certificate request message? ❍ A. Organization (O) ❍ B. Subject Alternative Name ❍ C. Organizational Unit (OU) ❍ D. Key Size ❍ E. Common Name (CN)

Question 42 After the certificate is revoked or breached, which of the following fields on the X.509 certificate specifies the certificate number that is listed on the CRL? ❍ A. Issuer ❍ B. Public key ❍ C. CA Signature ❍ D. Certificate serial number ❍ E. Validity period

270 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 43 Which of the following is not true about digital certificate validation? (Choose all that apply.) ❑ A. Based upon trust relationship. ❑ B. If A trusts B and B trusts C, then A should trust C. ❑ C. If A trusts B and B trusts C, then A should not trust C. ❑ D. Not based upon trust relationship.

Question 44 For the concentrator to participate in certificate exchange, a certificate needs to be loaded on the concentrator. Which of the following processes enable you to enroll with a CA by manually creating a PKCS#10 request file? ❍ A. File-based enrollment ❍ B. Network-based enrollment ❍ C. Concentrator-based enrollment ❍ D. VPN-based enrollment

Question 45 After CRL checking is enabled, in which phase of tunnel establishment does the concentrator verify the revocation status of the peer certificate? ❍ A. During IKE phase 1 ❍ B. During IKE phase 2 ❍ C. After IKE phase 2 ❍ D. Before IKE phase 1

271 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 46 Which of the following protocols can be configured on the concentrator to retrieve the CRL if the primary CRL-DP is unavailable? (Choose all that apply.) ❑ A. HTTP ❑ B. LAPB ❑ C. LDAP ❑ D. LABPD ❑ E. FTP

Question 47

When configuring the Cisco VPN Unity Client for digital certificates in Certificate Manager, which of the following fields in the Enrollment–Form must match the group name configured on the concentrator? ❍ A. Common Name ❍ B. Department ❍ C. Company ❍ D. IP Address ❍ E. Domain

272 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 48 When configuring the network-based enrollment process on the Cisco VPN Client, which of the following steps should be followed when configuring the CA’s network address? (Choose all that apply.) ❑ A. Configure the URL or network address of the CA server. ❑ B. Choose from pre-existing CA Server. ❑ C. Configure FQDN of the CA server. ❑ D. Configure IKE proposal on the CA server. ❑ E. Configure password if required.

Question 49 On a Cisco VPN Concentrator, which of the following firewall features can be used to enhance security on a Windows-based PC running the Cisco VPN Software Client? (Choose all that apply.) ❑ A. Are You There ❑ B. Stateful Firewall ❑ C. Centralized Policy Protection ❑ D. Cisco Integrated Client Firewall

Question 50 Which firewall feature verifies whether a specific firewall is operational on the client PC after tunnel establishment? ❍ A. AYT ❍ B. Stateful Firewall ❍ C. CPP ❍ D. CIC

273 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 51 After you have navigated to the Configuration | User Management | Groups | Modify window, under which tab do you configure the AYT, CIC, and CPP features? ❍ A. General ❍ B. HW Client ❍ C. Client FW ❍ D. PPTP/L2TP ❍ E. Client Config

Question 52 Which of the following statements are true when the default stateful firewall policy is loaded on CIC firewall? (Choose all that apply.) ❑ A. All outbound traffic that is not related to the inbound session is blocked. ❑ B. Allows DHCP traffic to pass through where inbound packets are allowed through specific holes in the stateful firewall. ❑ C. Allows ARP traffic to pass through where outbound packets are allowed through specific holes in the stateful firewall. ❑ D. Allows ARP traffic to pass through where inbound packets are allowed through specific holes in the stateful firewall. ❑ E. All inbound traffic that is not related to the outbound session is blocked.

Question 53 Which of the following are the steps required to build a custom CPP policy on a Cisco VPN Concentrator? (Choose all that apply.) ❑ A. Create rules to restrict traffic ❑ B. Define a new policy ❑ C. Assign the new rule to the new policy ❑ D. Assign the new policy to CPP ❑ E. Assign the new policy to the CIC

274 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 54 In vpnclient.ini file, which of the following parameters is used to enable Autoinitiation? ❍ A. AutoInitiationList ❍ B. AutoInitiationEnableNow ❍ C. AutoInitiationRetryInterval ❍ D. AutoInitiationEnable

Question 55 Which of the following is true about the Management Sessions section in the Monitoring | Sessions window? ❍ A. Shows parameters and statistics for all active, remote access sessions. ❍ B. Shows parameters and statistics for all active, IPSec LAN-to-LAN sessions. ❍ C. Shows parameters and statistics for all active, administrator management sessions. ❍ D. Shows summary total for LAN-to-LAN, remote access, and management sessions.

Question 56 Which parameter under Configuration | System | Events | General window enables you to select the range of severity value to enter on the log? ❍ A. Severity to Console option ❍ B. Severity to Syslog option ❍ C. Severity to Log option ❍ D. Severity to Email option

Question 57 Which Concentrator window enables you to view the event log in real time? ❍ A. Monitoring | Statistics | NAT ❍ B. Monitoring | Statistics | Live Log ❍ C. Monitoring | Live Event Log ❍ D. Monitoring | Filterable Event Log

275 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 58 Which of the following options can be used in the Monitoring | Filterable Event Log to filter and display the event log? (Choose all that apply.) ❑ A. Event Class option ❑ B. Severity option ❑ C. Client IP option ❑ D. Events/Page option

Question 59 Which administrator account on the VPN concentrator has view and read privileges only? ❍ A. admin ❍ B. config ❍ C. isp ❍ D. mis ❍ E. user

Question 60 When configuring a TACACS+ server for AAA authentication, what value would you put in the server port field if you want to use the default port number? ❍ A. 0 ❍ B. 1 ❍ C. 2 ❍ D. 3 ❍ E. 4

Question 61 Which option would you choose if you want to reset a production VPN Concentrator back to the factory default? ❍ A. Reboot ❍ B. Save Active Configuration at the Time of Reboot ❍ C. Reboot Without Saving Active Configuration ❍ D. Reboot Ignoring the Configuration File

276 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 62 To set up the client update feature on the Cisco VPN Concentrator, which of the following parameters need to be configured? (Choose all that apply.) ❍ A. Enable Client update ❍ B. Client Type ❍ C. Feature Set ❍ D. URL ❍ E. Version ❍ F. Revisions

Question 63 You have a speed of 1.544Mbps configured on your public interface of the Concentrator. The reserved bandwidth has been set to 64Kbps per connection. Which statements are true regarding bandwidth management? (Choose all that apply.) ❑ A. The first 24 connections are allocated a bandwidth of 64Kbps per connection. ❑ B. The 25th connection is allocated bandwidth from the remaining available bandwidth. ❑ C. The concentrator denies the 25th connection. ❑ D. The first connection reserves the 64Kbps bandwidth, plus the remainder of the bandwidth.

Question 64 Which of the following statements is true about configuring network extension mode on a Cisco 3002 HW Client? (Choose three.) ❑ A. Enable network extension mode on the concentrator ❑ B. Enable network extension mode on the HW Client ❑ C. Change IP address on the private interface of the HW Client to any address other than 192.168.10.1 ❑ D. Change IP address on the private interface of the HW Client to 192.168.10.1 ❑ E. By default, network extension mode is enabled on the HW Client

277 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 65

Which of the following statements are true regarding Interactive unit authentication? (Choose all that apply.) ❑ A. Select or deselect Require Interactive Hardware Client Authentication to enable or disable interactive unit authentication. ❑ B. If selected, the HW Client does not save user password. ❑ C. If deselected, the HW Client supplies the username and password from memory. ❑ D. If deselected, the HW Client does not save the user password. ❑ E. If selected, the HW Client supplies the username and password from memory.

Question 66 Which tab enables you to configure Individual user authentication on the concentrator? ❍ A. Configuration | User Management | Groups | General tab ❍ B. Configuration | User Management |Groups | PPTP/L2TP tab ❍ C. Configuration | User Management |Groups | HW Client tab ❍ D. Configuration | User Management | Groups | Client Config tab

278 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 67 Which of the following backup server options are offered to the HW and Unity Clients from the VPN 3000 Concentrator? (Choose all that apply.) ❑ A. Use Client Configured List ❑ B. Use List Below ❑ C. Disable and Clear Configured List ❑ D. Use Concentrator List

Question 68 Which of the following steps are needed to configure load balancing on the VPN Concentrator? (Choose all that apply.) ❑ A. Add Virtual Cluster Agent capability on public interface ❑ B. Add Virtual Cluster Agent capability on private interface ❑ C. Configure concentrators in the cluster for load balancing ❑ D. Configure clients with virtual IP address of the cluster

Question 69 Which feature enables the concentrator to advertise the IP address of the VPN Client out to its private interface? ❍ A. Reverse Path Tunneling ❍ B. Interactive Unit Authentication ❍ C. Individual User Authentication ❍ D. Reverse Route Injection

Question 70 In which mode are the network routes advertised through the private interface, provided OSPF or outbound RIP is enabled on the private interface? ❍ A. Client Network Extension ❍ B. Network Extension RRI ❍ C. Client PAT Extension ❍ D. Client RRI

279 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 1.

Question 71 If you want to view update-specific information in the Monitoring | Filterable Event Log window on the Cisco HW Client, which event class would you choose? ❍ A. AUTH ❍ B. AUTHDBG ❍ C. AUTOUPDATE ❍ D. AUTHDECODE ❍ E. UPDATECLIENT

Question 72 Which of the following are true about configuring IPSec over UDP on a VPN Concentrator? (Choose all that apply.) ❑ A. IPSec over UDP is enabled by default. ❑ B. Enable IPSec over UDP by navigating to a specific group under Configuration | User Management | Groups window. ❑ C. Within the Client Config tab, select the IPSec over UDP check box. ❑ D. Choose default port number of 12000 for IPSec over UDP. ❑ E. Define a specific port number between 4001 to 49151.

Question 73 Which of the following are not true about an IPSec over TCP application? (Choose two.) ❑ A. IPSec over TCP must be enabled on both client and the concentrator. ❑ B. IPSec over TCP is a group parameter. ❑ C. IPSec over TCP is a global parameter. ❑ D. You can supply up to 10 comma-delimited port addresses in IPSec over TCP. ❑ E. You can supply up to 20 comma-delimited port addresses in IPSec over TCP.

280 Chapter 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 74 Which of the following ESP encryption options does the concentrator support? (Choose all that apply.) ❑ A. None ❑ B. HMAC-MD5-128 bit ❑ C. HMAC-SHA-160 bit ❑ D. DES-56 bit ❑ E. 3DES-168 bit ❑ F. AES-128, 196, and 256 bit

Question 75 Which of the following features dynamically discovers and continuously updates the private network addresses on each side of a LAN-to-LAN connection? ❍ A. Network auto-discovery ❍ B. IPSec LAN-to-LAN ❍ C. LAN auto-discovery ❍ D. Group auto-discovery

12 Practice Exam 1 Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1. A, B, C, D

20. A, B, C

39. D

58. A, B, C, D

2. A

21. D

40. A

59. E

3. A

22. A, C, D, E

41. C

60. A

4. A, B

23. C

42. D

61. D

5. A, B

24. A, B, C, D

43. C, D

62. A, B, D, F

6. C

25. C

44. A

63. A, C, D

7. A

26. A, B, D

45. A

64. A, B, C

8. B, C, D, E

27. A

46. A, C

65. A, B, C

9. B

28. B

47. B

66. C

10. B

29. D

48. A, B, C, E

67. A, B, C

11. B

30. A, B, D

49. A, B, C, D

68. A, B, C, D

12. B

31. A, B, D

50. A

69. D

13. A, B, D, E

32. D

51. C

70. B

14. A, C, D

33. B, C

52. B, D, E

71. C

15. B, D

34. A

53. A, B, C, D

72. B, C

16. C

35. A, B, D

54. D

73. B, E

17. A, B, C, D, E

36. D

55. C

74. D, E, F

18. B

37. C

56. C

75. A

19. D

38. B, D

57. C

282 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer Key Explanations Question 1 The correct answers are A, B, C, and D. Unstructured threat consists of inexperienced individuals who are motivated by an intellectual challenge rather than a malicious intent. B is correct because structured threat consists of hackers who are highly motivated and technically competent. C is correct because external threats are individuals and organizations that work outside your organization and do not have authorized access to your network. D is correct because internal threats occur when someone has authorized access to the network with either a user account or physical access. E is incorrect because there is no such thing as non-filterable threat.

Question 2 The correct answer is A. A reconnaissance attack is classified as an attack where the intruder attempts to discover and map systems, services, and vulnerabilities. B is incorrect because access attack refers to data manipulation, system access, or privilege escalation. C is incorrect because a denial of service attack disables or corrupts networks, systems, and services with a malicious intent to deny service to authorized and intended users. D is incorrect because a virus is a program or piece of code intended to initiate other malicious programs or corrupt programs and file systems.

Question 3 The correct answer is A. Remote access VPN is classified as a VPN that supports the needs of telecommuters, mobile users, and extranet consumer-tobusiness environments. B is incorrect because site-to-site VPNs are used to connect corporate sites and are classified as an extension of WANs. C is incorrect because firewall-based VPNs are inherently site-to-site VPNs that use a firewall as the tunnel termination point. D is incorrect because it is not a type of VPN.

283 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Practice . . . . Exam . . . .1 .Answer . . . . Key . .

Question 4 The correct answers are A and B. Only the 3005 and 3015 support software encryption. C, D, and E are incorrect because 3030, 3060, and 3080 all support HW encryption. Hardware encryption is done using the Scalable Encryption Processor (SEP2) modules and the Programmable Digital Security Processor (DSP)—based security accelerator.

Question 5 The correct answers are A and B. Cisco 3005 and 3015 both support up to 100 simultaneous sessions. C is incorrect because the 3030 supports 1500 simultaneous sessions. D is incorrect because the 3060 is more robust and it supports 5000 simultaneous sessions. E is incorrect as well because the 3080 is the top of the line and it supports 10000 simultaneous sessions.

Question 6 The correct answer is C. The Cisco 3005 Concentrator supports up to 100 VPN tunnels. They could be 100 remote access tunnels or 100 site-to-site tunnels. In an environment that caters to remote-access as well as the site-tosite VPN tunnels, you will have to subtract the total number of site-to-site VPN tunnels from the total tunneling capability of the VPN Concentrator to derive the number of remote access tunnels that can be established. In this case, the answer would be 100–36=64. In the given scenario, you will be able to establish 64 remote access VPN tunnels.

Question 7 The correct answer is A. As a minimum, you need release 2.5(2) software on the VPN concentrator and release 5.2 software on the PIX firewall to establish a VPN tunnel between a PIX and a VPN concentrator. B is incorrect because the minimum requirement is release 2.5(2) on the concentrator. C is incorrect because it defines the requirements for setting up a site-to-site tunnel between a VPN Concentrator and a Cisco IOS Router. D is incorrect because it is a distracter.

284 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 8 The correct answers are B, C, D, and E. IPSec provides a secure path between a pair of gateways, pair of hosts, or gateways and hosts. A is incorrect because IPSec operates on the Network layer of the OSI model.

Question 9 The correct answer is B. Symmetric keys are manually configured on both source and destination tunnel endpoints and have to be identical. A is incorrect because there is no such thing as an analog key. C is incorrect because asymmetric keys use one key to encrypt the traffic and the remote end uses another key to decrypt it. An example of asymmetric keys would be RSA Digital Signatures. D is a fictitious answer.

Question 10 The correct answer is B. With RSA encryption, the receiver decrypts data using its own private key. The sender can then encrypt the message using the sender’s public key. Note that the private key does not leave the sender’s machine. A is incorrect because a public key is used to encrypt data. C is incorrect because AH is a protocol that is used when data confidentiality is not required. D is not correct because DES is a symmetric key cryptosystem algorithm and is used for data confidentiality.

Question 11 The correct answer is B. DH group 2 uses a key size of 1024 bits. A is incorrect because DH group 1 uses a key size of 768 bits. C is incorrect because DH group 5 uses a key size of 1536 bits. D is incorrect because DH group 7 uses elliptic curve cryptography.


Question 12 The correct answer is B. HMAC-MD5 uses a 128-bit hashing algorithm. A is incorrect because DES is an encryption algorithm that uses 56 bits. C is also incorrect because 3DES is another encryption algorithm that used 168 bits. D is incorrect because HMAC-SHA-1 uses a 160-bit hash algorithm. HMAC-SHA-1 is the recommended hashing algorithm and is considered more secure than HMAC-MD5 because it is cryptographically stronger.

Question 13 The correct answers are A, B, D, and E. AH provides data integrity and origin authentication for IP packets that pass between source and destination tunnel endpoints. AH also uses a hashing algorithm and provides anti-replay protection. AH does not provide data encryption and all data is sent in clear text only.

Question 14 The correct answers are A, C, and D. A is correct because ESP encrypts the entire IP datagram. B is incorrect because the original datagram is protected by ESP encryption. C is correct because ESP adds a new header and trailer to the original datagram. D is correct because an IP header is always appended to the front of the authenticated payload and a new IP address is used to route packets through the Internet. E is incorrect because the ESP header is placed in front of the encrypted original payload, whereas the ESP trailer is placed at the end of the encrypted data payload.

Question 15 The correct answers are B and D. Main mode has three two-way exchanges between the initiator and receiver. Aggressive mode, on the other hand, has fewer exchanges that are done with fewer packets. A and E are incorrect because they are not valid names for IKE modes. B is incorrect because Quick mode is used in IKE phase 2 negotiations.

286 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 16 The correct answer is C. IKE phase 2 has only one mode called Quick Mode (QM). QM occurs after IKE phase 1 is complete and a secure IKE phase 1 tunnel has been established. QM is used to renegotiate a new IPSec SA when the IPSec SA lifetime expires and is also used to refresh the Diffie-Hellman shared secret keys that were derived in IKE phase 1. Answers A and B are incorrect because Main Mode and Aggressive Mode are used for establishing IKE SAs, for performing device-level authentication, and for secret key calculation via Diffie-Hellman. Answer D is incorrect because Passive Mode is not an actual mode of IKE negotitations.

Question 17 The correct answers are A, B, C, D, and E. IPSec SA constitutes a Security Policy database and a Security Association database. The information included in these parameters IPSEC protocols (AH and ESP), encryption algorithms, authorization algorithm , hash algorithm, encapsulation mode (tunnel or transport), DH group number, SA lifetime (in seconds and/or in KBs).

Question 18 The correct answer is B. VRRP manages automatic switchover from one Concentrator to another in a redundant installation. Load balancing, on the other hand, is performed on active sessions at connection time. The VPN Concentrator can perform either VRRP or load balancing, not both.

Question 19 The correct answer is D. The non-master sends load information to the master in a form of “keepalive” messages. Load is calculated as a percentage of current active sessions divided by the configured maximum allowed connections. A, C, and E are incorrect because the calculation is based upon the percentage of the maximum as opposed to the total or average. B is incorrect because it uses the maximum allowed connections as opposed to minimum connections.


Question 20 The correct answers are A, B, and C. A is correct because the AYT feature verifies the presence of a firewall and reports that information back to the concentrator. B is correct because when you implement a stateful firewall module, a default firewall policy is loaded on the firewall and the default filter blocks all traffic inbound that is not related to the outbound session. C is correct because the Cisco Pushed Policy (CPP) feature enables the administrator to create a set of rules that allow or disallow traffic on connected VPN clients. Remember, the CPP policies are pushed from the concentrator down to the clients. D is incorrect because there is no firewall mode.

Question 21 The correct answer is D. The Are You There feature verifies the presence of a firewall and reports that information back to the concentrator. This feature works very well if the network administrator may require the remote client to be running a specific firewall before establishing the tunnel. Depending on the response sent by the remote client, the concentrator can permit or deny the IPSec connection. Answer A is wrong because smartcards are not a firewall feature. Answers B and C are incorrect because the Stateful Firewall and the CPP firewall policy do not report back to the concentrator if a firewall is active.

Question 22 The correct answers are A, C, D, and E. To access the VPN concentrator using CLI, the terminal emulation program must be set to a speed of 9600bps. The concentrator can also be configured through a Web-based GUI interface. When connecting via the Web interface you can establish a session via an HTTP or HTTPS (HTTP over SSL) connection. To configure the concentrator via HTML, you must at least assign an IP address to the private interface. Answer B is incorrect because the speed setting should be 9600bps.

288 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 23 The correct answer is C. The Configuration | Quick Configuration submenu exists only in the VPN 3002 Hardware Client. Answers A, B, and C are wrong because Quick Configuration can be run only once. To run it again, you have to reboot the VPN Concentrator to factory default configuration. Quick Configuration is a setup process that enables the minimal parameters necessary to initialize and utilize the VPN Concentrator.

Question 24 The correct answers are A, B, C, and D. All the four methods that have been specified can be used to obtain the virtual IP address. Remember, on the remote access PC, there are two IP addresses: the IP address assigned to the NIC and the inside virtual IP address. You use the Configuration | Quick | Address Management window to define how all remote access PCs would receives the virtual IP address.

Question 25 The correct answer is C. Configuring NT Domain authentication requires the use of the computer name only. Answers A, B, and D are wrong because any other option, such as FQDN, IP address of the domain controller, and administrative password, does not work.

Question 26 The correct answers are A, B, and D. In addition to max connect time, filter, and idle timeout, you can also configure access hours, simultaneous logins, minimum password length, inheritance parameters, and use of non-alphabetic passwords. C is incorrect because the General tab in the Configuration | User Management | Groups | Modify Group window does not define maximum password length.


Question 27 The correct answer is A. The minimum password length is 4, and the maximum is 32 characters. The password for the group name is the shared secret key that is used to authenticate the peer during IKE phase 1. Answers B, C, and D are incorrect because the password lengths stated are not the correct lengths of 4 and 32.

Question 28 The correct answer is B. Maximum Connect Time defines the time after which the system will terminate the connection. Remember, you can set the Maximum Connect Time value to 0 to allow unlimited connection time. However, this is not good practice. A is incorrect because Access Hours defines when users can access the Concentrator. C is incorrect because it is a distracter. Answer D is wrong because the Idle Timeout field is configured with the group idle timeout period in minutes. The VPN Concentrator terminates the connection in case of inactivity on this connection for the configured period of time.

Question 29 The correct answer is D. The Client Config tab is used to configure IPSec client parameters on a group basis. The Client Config tab has three sections: one section for parameters specific to Cisco clients, a second one for Microsoft clients, and a third for common client parameters. Answers A, B, and C are incorrect because these parameter sections do not exist on those tabs.

Question 30 The correct answers are A, B, and D. Split tunneling can be configured in three ways. The three split tunneling parameters are Tunnel Everything (which is the default), Allow Networks in the List to Bypass the Network, and Only Tunnel Networks in List. C is incorrect because that option does not exist.

290 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 31 The correct answers are A, B, and D. After the software or hardware client receives the 0.0.0.0/0.0.0.0 network list, it then routes all 172.31.100.0 traffic in clear text. All other traffic is encrypted and sent over the tunnel. C is incorrect because the network list is configured as a wildcard (reverse of subnet mask), where 0s in the bit positions to match the corresponding IP bit positions and 1s in the bit position to ignore the corresponding IP bit positions. E is incorrect because local traffic is sent in clear text rather than encrypted.

Question 32 The correct answer is D. Split DNS configuration governs how software clients resolve a DNS query packet to be sent in clear text to the ISPassigned DNS server or encrypted and sent over the tunnel to the corporate DNS server. A is incorrect because DDNS is used in networks to coordinate hostname information between DHCP and DNS servers. B and C are incorrect because they are distracters.

Question 33 The correct answers are B and C. DDNS was supported from Release 3.6. The DDNS feature applies only to the software client connections that are being assigned IP address through a DHCP server. A is incorrect because DDNS was supported starting with Release 3.6. Answer D is incorrect because DDNS applies only to DHCP assigned IP addresses.

Question 34 The correct answer is A. This option works very well in situations where packets are allowed through the tunnel without obstacles. A typical example would be when a client wants to initiate a GET request from an FTP server behind a concentrator for a large file. These large packets would be encapsulated and then fragmented at the IP layer for a successful transmission. B is incorrect because in this option the concentrator will drop large packets that don’t have the Don’t Fragment (DF) bit set. C is incorrect because in this option the concentrator will fragment tunnel packets that exceed the MTU before encapsulating them. D is incorrect because it does not exist.


Question 35 The correct answers are A, B, and D. The Authentication tab enables you to set your authentication parameters. The Group Access Information is casesensitive and must match the parameters configured in the Identity tab in the Configuration| User Management| Group Management| Groups page. Answer C is incorrect because the password and group name are case sensitive.

Question 36 The correct answer is D. The purpose of the .pcf file is to create connection entries within the dialer application. Remember that each user profile has a .pcf file associated with it. A is incorrect because the oem.ini file is used to install the software client without user intervention. B is incorrect because the vpnclient.ini file can be used to automatically configure the software client global parameters. C and E are incorrect because they are not actual files in the Cisco Unity Client.

Question 37 The correct answer is C. Remote Access Sessions displays statistics on all remote access sessions. All users connecting to the VPN Concentrator via a VPN client are classified as remote access sessions. A is incorrect because the Session Summary section gives you an overview of all the sessions, as well as the total active, peak concurrent, and total concurrent sessions. B is incorrect because LAN-to-LAN Sessions displays individual LAN-to-LAN sessions. D is incorrect because Management Sessions displays information on all the current management users.

Question 38 The correct answers are B and D. Digital signatures tie a message to the sender’s private key, and the sender’s public key is used to decrypt the received hash. A is incorrect because the message is always signed by the sender’s private key and not the public key. C is incorrect because the sender’s public key is used to decrypt the message that was originally signed by the sender’s private key.

292 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 39 The correct answer is D. The root certificate is installed first on the concentrator because the concentrator uses the public key of the root certificate to authenticate the identity certificate. A is incorrect because the root certificate is required to authenticate the identity certificate. B and C are incorrect because PKCS#7 and PKCS#10 are a set of standard protocols used by different vendors to ensure secure information exchange on the Internet using a public key infrastructure. PKCS stands for public key cryptography standards.

Question 40 The correct answer is A. In a tiered approach, a single root CA signs all certificates. In a hierarchical model, subordinate CAs sign certificates for lowerlevel CAs. Subordinate CA can act as a Registration Authority or RA. B, C, D, and E are all true about the hierarchical public key infrastructure.

Question 41 The correct answer is C. The Organization Unit (OU) field must match the group attribute data configured on the concentrator. The group name is case-sensitive and acute caution must be used when configuring the OU field as well as the group name field. To establish the VPN tunnel, both the OU and the group name have to be identical. A is incorrect because the Organization field depicts the company name. B is incorrect because Subject Alternative Name defines the FQDN for the concentrator. D is incorrect because Key Size is used to define the key size of the RSA key pair. E is incorrect because Common Name is the unique name of the concentrator.

Question 42 The correct answer is D. Certificate serial number is a unique numerical identifier in the CA domain, and when the certificate is revoked, this certificate number is listed on the Certificate Revocation List. A is incorrect because Issuer specifies the distinguished name of the CA. B is incorrect because Public Key defines the public key and hashing algorithm. C is incorrect because CA Signature is used to sign the CA private key to ensure authenticity. E is incorrect because Validity Period defines the start and expiration period for the certificate.


Question 43 The correct answers are C and D. Digital certificate validation is dependant upon a trust model. For example, if you trust B and B trusts C, then you should trust C as well. This is the underlying principle when validating certificates. C is incorrect because A should trust C in a digital certificate trust model. D is incorrect because digital certificate validation is based on a trust model.

Question 44 The correct answer is A. File-based enrollment is a manual process. After this request file has been created with PKCS#10, you can either mail the file to the CA and receive a certificate back, or simply access the CA’s Web site and cut and paste the enrollment request in the area that the CA provides. B is incorrect because network-based enrollment is an automated process that connects to the CA directly via Simple Certificate Enrollment Protocol (SCEP). C and D are incorrect because they are not certificate enrollment types.

Question 45 The correct answer is A. During IKE phase 1 negotiation, if CRL checking is enabled, the Concentrator verifies the revocation status of the certificate of the IKE peer before IPSec tunnel establishment. B, C, and D are incorrect because the CRL checking is done during IKE phase 1.

Question 46 The correct answers are A and C. When choosing HTTP, make sure that you assign HTTP rules to the public interface of the concentrator. However, if you are using LDAP, you have to configure LDAP DP default values. An example of a valid HTTP URL would be http://172.31.100.100/CertEnroll/ THECA.cri. B, D, and E are incorrect because they are not utilized to retrieve a CRL from a distribution point.

294 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 47 The correct answer is B. The Department Name field must match the group name configured on the concentrator. Remember, the Department Name and group names are case-sensitive. A is incorrect because Common Name refers to the unique name of this certificate. C is incorrect because the Company field identifies the company name. D is incorrect because IP Address is the IP address of your machine. E is incorrect because the Domain field refers to the FQDN of your machine. Only the Common Name and Department are required fields.

Question 48 The correct answers are A, B, C, and E. SCEP is an automated process and for SCEP to work, the CA must be able to communicate with the Certificate Manager on the Cisco VPN Client. If the CA is new, you will be required to add the URL or network address of the CA server, the domain to which it belong, and a password (if required). If you have used that CA before, you can use the pre-existing CA information as well. D is incorrect because you cannot configure the IKE proposal on the Cisco VPN Unity Client.

Question 49 The correct answers are A, B, C, and D. Cisco VPN Concentrator contains four firewall features that can be used to enhance system security on a Windows-based PC running Cisco Software Client.

Question 50 The correct answer is A. Are You There (AYT) verifies whether a specific firewall is operational on the client PC after tunnel establishment. B is incorrect because Stateful Firewall, if turned on, blocks all inbound traffic that is not related to an outbound session, with the exception of DHCP and ARP traffic. C is incorrect because Centralized Policy Protection (CPP) allows network administrators to centrally define firewall policies for the connected VPN clients. The CPP is always pushed down from the Concentrator to the software clients at connection time. D is incorrect because CIC is a firewall module integrated into the Cisco software client.


Question 51 The correct answer is C. AYT, CIC, and CPP can be configured under the Client FW tab. A is incorrect because the General tab lets you configure general security, access, performance, and tunneling protocol parameters that apply to an internally configured group. B is incorrect because the HW Client tab lets you configure interactive hardware client authentication and individual user authentication for a specific group. D is incorrect because the PPTP/L2TP tab lets you configure PPTP and L2TP parameters that apply to an internally configured group. E is incorrect because these parameters apply to a group’s IPSec clients.

Question 52 The correct answers are B, D, and E. The default stateful firewall blocks all inbound traffic that is not related to the outbound session, with the exception of DHCP and ARP. A is incorrect because inbound traffic is blocked unless associated with an existing outbound session. Answer C is incorrect because ARP is allowed to pass through the stateful firewall. When the stateful firewall is enabled, it is always on. The firewall is active for both tunneled and non-tunneled traffic.

Question 53 The correct answers are A, B, C, and D. Building Custom CPP is a four-step process. In most cases, the default policy works just fine. If you want to control the outbound clear text traffic to a few protocols or to a handful of remote locations, you have to create a new policy. E is incorrect because the policy is not applied directly to the CIC client, but is pushed from the central concentrator.

Question 54 The correct answer is D. The AutoInitiationEnable parameter enables Autoinitiation. Auto-initiation is an automated process for establishing wireless VPN connections in a LAN environment. A is incorrect because the AutoInitiationList parameter is a list of Auto-initiation–related sections in the vpnclient.ini. B is incorrect because AutoInitiationEnableNow is not a valid parameter. C is incorrect because AutoInitiationRetryInterval specifies the time to wait in minutes before retrying auto-initiation after a connection failure.

296 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 55 The correct answer is C. The Management Sessions table under the Monitoring | Sessions window shows parameters and statistics for all active administrator management sessions. A is incorrect because to view the active remote access sessions, you have to view the Remote Access Sessions table. B is incorrect because to view the active IPSec LAN-to-LAN sessions, you have to view the LAN-to-LAN session table. D is incorrect because the Session Summary table shows the summary total for LAN-to-LAN, remote access, and management sessions.

Question 56 The correct answer is C. The Severity to Log option can be used to select the range of severity values to enter on the log. A is incorrect because the Severity to Console option can be used to select the range of severity values to display on the console. B is incorrect because the Severity to Syslog option can be used to select the range of severity levels to be sent to a syslog server. D is incorrect because the Severity to Email option can be used to select the range of severity levels for emails to the recipient.

Question 57 The correct answer is C. The Monitoring | Live Event Log window displays events in the current event log and automatically refreshes every 5 seconds. Remember, if the Live Event Log window is active, the administrator session to the concentrator would never time out because each automatic window update would reset the inactivity timer. A is incorrect because the Monitoring | Statistics| NAT window shows statistics for NAT (Network Address Translation) activity on the VPN Concentrator since it was last booted or reset. B is incorrect because it is a distracter. D is incorrect because the Monitoring | Filterable Event Log window shows the events in the current event log and lets you filter, display, and manage events by various criteria.


Question 58 The correct answers are A, B, C, and D. The Monitoring | Filterable Event Log window enables GUI access to the current event log. The event log can hold up to 2048 events in the 3015 models and up and 256 in the 2005 model. When the event log is full, older events are overwritten by newer event entries.

Question 59 The correct answer is E. The User account has very limited rights. In this account you have view and read privileges only. A is incorrect because the admin account has full access to the system and is the only account that is enabled by default. B is incorrect because the config account has all rights of the admin account except SNMP access. C is incorrect because the isp account has very limited general configuration rights. D is incorrect because the mis account has the same rights as a config account.

Question 60 The correct answer is A. To use the default port number for TACACS+ authentication, you use 0. The default port number that TACACS+ uses is TCP port 49. Answers B, C, and D are incorrect because those numbers would be interpreted by the concentrator as the actual port number.

Question 61 The correct answer is D. Reboot, if you ignore the configuration file option, ignores the active configuration and reboots the system to factory defaults. A is incorrect because the Reboot option simply reboots the system. B is incorrect because this option saves the active configuration file and then reboots the system. C is incorrect because this option does not save the active configuration file and then reboot the system with the last saved configuration.

298 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 62 The correct answers are A, B, D, and F. Client update information is entered in the Configuration | User Management | Groups | Client Update | Add window. The Client Type field identifies the type of client that needs to be updated. For example, windows can be used for all Windows clients. The URL field contains the location of the software. Revision number is used to ensure that if the client is not running the software version on the list, the update will not be carried out. Answers C and E are incorrect because those fields do not exist in the Client Update menus.

Question 63 The correct answers are A, C, and D. If the reserved bandwidth is 64Kbps on a 1.544Mbps link, you can have a total of 24 (1.544Mbps÷64K) concurrent connections. It is true that the first connection will have a reserved bandwidth of 64Kbps and it will also have access to the remainder of the bandwidth. As more connections are established to the concentrator, less bandwidth remains that can be used by these connections. B is incorrect because after 24 connections are established, the concentrator does not allow any more connections.

Question 64 The correct answers are A, B, and C. By default, network extension mode is not enabled on the HW Client. The IP address of the HW Client must be changed from 192.168.10.1 to any other IP address to use the network extension functionality. Network Extension mode must also be allowed on the group HW Client parameters on the VPN 3000 Concentrator for each group that contains the 3002 Hardware Clients. D is incorrect because the private interface already has an IP address of 192.168.10.1. Answer E is incorrect because the default mode is Client or PAT mode.

Question 65 The correct answers are A, B, and C. In Interactive unit authentication, if the Require Interactive Hardware Client Authentication box is selected, the HW Client does not save the user password and the user must supply username


and password parameters. If the Require Interactive Hardware Client Authentication box is deselected, the HW Client saves the username and password information in the memory and this is the default setting. D is incorrect because the HW Client does not save the user password if selected. Answer E is incorrect because if deselected, the HW Client supplies the username and password from memory.

Question 66 The correct answer is C. When configuring Individual user authentication, navigate to the Configuration | User Management | Groups | HW Client tab and select Require Individual User Authentication. Answers A, B, and D are incorrect because the individual authentication is enabled only on the HW Client tab.

Question 67 The correct answers are A, B, and C. The Use Client Configured List option instructs the clients to use its own backup server list. The Disable and Clear Configured List option instructs the clients to clear its backup server list and disable the feature. The User List Below option (default) instructs the clients to use the backup server list supplied by the concentrator and overwrite its current entries. Answer D is incorrect because that option does not exist for the backup server options.

Question 68 The correct answers are A, B, C, and D. To configure load balancing, VCA capability must be configured on both private and public interfaces. VCA filter enables VCA messages to flow between cluster concentrators.

Question 69 The correct answer is D. Reverse Route Injection allows a concentrator to add static or host routes to its routing table and announce these routes to its internal network by using OSPF or outbound RIP. Answer A is not an actual feature. Answers B and C are incorrect because they are authentication modes for the VPN 3002 Hardware Client.

300 Chapter 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 70 The correct answer is B. The Network Extension RRI feature applies to only the HW Clients using network extension mode. You can enable Network Extension RRI by going to Configuration | System | IP Routing | Reverse Route Injection window and selecting the Network Extension Reverse Route Injection check box. Remember, the routes are deleted when the client disconnects from the VPN Concentrator. Answers A and C are incorrect because they are not actual RRI modes. Answer D is incorrect because Client RRI does not add network routes to the routing table. Client RRI adds the individual assigned private virtual addresses assigned by the Concentrator.

Question 71 The correct answer is C. The AUTOUPDATE event class enables you to view update-specific information in the Monitoring | Filterable Event Log window on the Cisco HW Client. If the HW Client release version in the notification message does not match the HW Clients current version, the HW Client automatically upgrades the software from the TFTP URL. Answers A, B, and D are incorrect because those event classes are used to troubleshoot authentication. Answer E is incorrect because that is not a valid event class.

Question 72 The correct answers are B and C. IPSec over UDP must be enabled on the concentrator. You can do that by selecting a specific group under Configuration | User Management | Groups and then navigate to the Client Config tab. UDP port 4500 is used for NAT-T and should not be chosen as a port number for IPSec over UDP. By default, IPSec over UDP uses UDP port 10000. Answer A is incorrect because IPSec over UDP is not enabled by default. Answer D is incorrect because the default UDP port is 10000. Answer E is incorrect because you should not use UDP port 4500 because it is used by NAT-T if it is globally enabled on the Concentrator.


Question 73 The correct answers are B and E. IPSec over TCP is a global parameter. After it is enabled, all frames are encapsulated in IPSec over TCP regardless of which group software clients belong to. You can supply up to 10 commadelimited port addresses in IPSec over TCP so that different software clients can use different TCP port numbers. Answers A, C, and D are incorrect because these attributes of IPSec over TCP are true.

Question 74 The correct answers are D, E, and F. DES, 3DES, and AES are encryption options. Advanced Encryption Standard (AES) encryption (AES) provides greater security than DES and is more efficient than Triple DES. Support for AES has been incorporated on the concentrator from release 3.6. Answers A, B, and C are incorrect because None, HMAC-MD5-128, and HMAC-SHA-160 bit are authentication options.

Question 75 The correct answer is A. The Network Auto-Discovery (NAD) feature dynamically discovers and continuously updates the private network addresses on each side of the LAN-to-LAN connection. For NAD to work, inbound RIP has to be enabled on the private interface of both Concentrators. OSPF NAD is not supported. Answers B, C, and D are not features that automatically discover network for LAN-to-LAN connections.

13 Practice Exam 2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The same rules apply for this practice exam as they do on the test itself: Read the questions carefully, consider every answer, eliminate “distracter” answers, and choose the best answer. Also, while taking the practice exam, take note of which general topics stump you. After you finish the test, review those topics again to strengthen your knowledge and cover all your bases for the exam.

304 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Practice Exam 2 Question 1 James downloads sophisticated hacking software from the Internet. He is a disgruntled employee and tries to hack into his company’s Web server. John is a highly motivated and technically competent individual. What type of network threat is James? (Choose all that apply.) ❑ A. Unstructured threat ❑ B. Structured threat ❑ C. External threat ❑ D. Internal threat

Question 2 A hacker attacks your network in such a way that damages and corrupts your computer systems and denies intended users’ access to a Web server. The attack also denies all authorized users access to the network and services. How would you classify this network attack? ❍ A. Reconnaissance attack ❍ B. Access attack ❍ C. Denial of Service attack

Question 3 Which of the following products is the best choice if the primary role of the equipment is to perform site-to-site VPN with a few remote access connections? ❍ A. VPN-enabled router ❍ B. VPN 3000 Concentrator ❍ C. PIX Firewall

305 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 4 Out of the box, which of the following models of VPN Concentrator support hardware encryption? (Choose all that apply.) ❑ A. 3005 ❑ B. 3015 ❑ C. 3030 ❑ D. 3060 ❑ E. 3080

Question 5 You are designing a VPN solution for your enterprise network. The requirement is for 180 site-to-site tunnels. Money is an important factor that needs to be considered when implementing this solution. Which of the following models of VPN Concentrator fits the requirement? ❍ A. 3005 ❍ B. 3015 ❍ C. 3030 ❍ D. 3060

Question 6 You have a 3080 VPN Concentrator running in an environment that supports both site-to-site VPN tunnels as well as remote access VPN tunnels. You have 728 branch offices that have site-to-site tunnels established to the Head Office 3080 Concentrator. What are the maximum number of remote access VPN tunnels that can now be established to this VPN 3080 Concentrator? ❍ A. 10000 ❍ B. 9271 ❍ C. 9722 ❍ D. 5000 ❍ E. 9272

306 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 7 To establish a site-to-site VPN tunnel between a VPN Concentrator and an IOS router you are required to be running release ___ software on the VPN concentrator and release ____ software on the IOS router. ❍ A. 2.5(2), 5.2 ❍ B. 3.0, 5.2 ❍ C. 2.5(2), 12.1 ❍ D. 5.2, 2.5(2)

Question 8 Which feature of IPSec ensures that each packet is unique and not duplicated? ❍ A. Confidentiality ❍ B. Data integrity ❍ C. Origin authentication ❍ D. Anti-replay

Question 9 In which key encryption methodology do source and destination tunnel endpoints use one key to encrypt and another key to decrypt the traffic? ❍ A. Analog ❍ B. Symmetric ❍ C. Asymmetric ❍ D. Auto-configurable

Question 10 When utilizing RSA encryption, the remote tunnel endpoint decrypts data using sender’s _______ key. ❍ A. Public ❍ B. Private ❍ C. Preshared ❍ D. Diffie-Hellman

307 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 11 Which of the following Diffie-Hellman key exchange algorithms use a key size of 1536 bits? ❍ A. Group 1 ❍ B. Group 2 ❍ C. Group 5 ❍ D. Group 7

Question 12 In which of the following methods can you perform peer authentication? (Choose all that apply.) ❑ A. Preshared key ❑ B. RSA encrypted nonces ❑ C. RSA signatures ❑ D. DES ❑ E. 3DES

Question 13 IPSec is a framework of open standards. Which of the following protocols falls under the IPSec framework? ❍ A. Authentication Header ❍ B. Encryption Header ❍ C. Encrypting Security Payload ❍ D. Encapsulating Security Payload

308 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 14 In which steps of IPSec are the basic set of security services negotiated and agreed upon? (Choose two.) ❑ A. Step 1: Interesting traffic ❑ B. Step 2: IKE phase 1 ❑ C. Step 3: IKE phase 2 ❑ D. Step 4: Data Transfer ❑ E. Step 5: IPSec tunnel termination

Question 15 When peers agree upon security services, each VPN peer device enters information in a security policy database. The information in the security policy database is known as an ____. ❍ A. SPI ❍ B. SA ❍ C. SAD ❍ D. IKE phase 2 database

Question 16 A cluster is defined as a group of concentrators working together as a single entity. To the outside client space, this cluster is known by what IP address? ❍ A. IP address of the public interface ❍ B. IP address of the private interface ❍ C. Virtual IP address ❍ D. IP address of the external interface

309 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 17 When implementing load balancing, load is calculated as a percentage of current active sessions divided by the configured maximum allowed connections. A virtual cluster master maintains load information from which of the following VPN Concentrators? ❍ A. All other cluster masters ❍ B. All active sessions ❍ C. All other non-masters ❍ D. All inbound connections

Question 18 Which of the following VPN clients and tunneling protocols does a Cisco VPN Concentrator support? (Choose all that apply.) ❑ A. L2TP ❑ B. Linux ❑ C. Mac ❑ D. Certicom ❑ E. IPsec

Question 19 When enabled, in which mode does the default firewall filter block all traffic inbound that is not related to the outbound session? ❍ A. Stateful Firewall (always on) ❍ B. Are You There ❍ C. Cisco Pushed Policy ❍ D. Cisco VRRP Firewall

310 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 20 By default, which of the following ports can be used to configure the Cisco VPN 3002 Hardware client? (Choose all that apply.) ❑ A. 1 Private port ❑ B. 1 Public port ❑ C. 1 Console port ❑ D. 1 VTY port

Question 21 A Cisco VPN Concentrator can be configured via a CLI and a GUI interface. In what ways can you configure the VPN Concentrator via the GUI interface? (Choose all that apply.) ❑ A. Setup mode ❑ B. Quick Configuration ❑ C. Concentrator Manager ❑ D. Privilege mode

311 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 22 Which of the following parameters can be configured under the Configuration | Quick | Protocols window? (Choose all that apply.) ❑ A. L2TP ❑ B. RIP ❑ C. PPTP ❑ D. OSPF ❑ E. IPSec

Question 23

You have an internal authentication server that assigns IP addresses to the remote VPN sessions based upon their credentials. Which parameter would you select under the Configuration | Quick | Address Management window to assign IP addresses retrieved from an authentication server on a per-user basis? ❍ A. Client Specified ❍ B. Per User ❍ C. DHCP ❍ D. Configured Pool

312 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 24 Which of the following options are available under the Server Type field in the Configuration | Quick | Authentication window? (Choose all that apply.) ❑ A. RADIUS ❑ B. SOLARIS ❑ C. NT Domain ❑ D. Security Dynamics (SDI) ❑ E. Internal Server

Question 25 Which of the following are valid group categories defined under the User Management configuration tree? (Choose all that apply.) ❑ A. Default Group ❑ B. Groups ❑ C. Authenticated Users ❑ D. Users

Question 26 Which of the following fields under the Configuration | User Management | Groups | Modify Group | General window determines the termination of a VPN connection if there is a configured period of inactivity on the link? ❍ A. Access Hours ❍ B. Maximum Connect Time ❍ C. Inactivity Timeout ❍ D. Idle Timeout

Question 27 Which of the following types of VPN authentication is also referred to as XAUTH? ❍ A. Concentrator authentication ❍ B. Network authentication ❍ C. Local authentication ❍ D. Database authentication

313 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 28

To configure split tunneling on the Cisco 3005 VPN Concentrator, which tab under the Configuration | User Management | Groups | Modify Group window would you select to accomplish this task? ❍ A. IPSec ❍ B. HW Client ❍ C. Client FW ❍ D. Client Config

Question 29 Which of the following options allows a remote user to send clear text messages to a printer, download images from a Web site, and send encrypted messages to the head office, all at the same time? ❍ A. Split tunneling ❍ B. Tunnel everything except local LAN traffic ❍ C. Tunnel everything ❍ D. One-way tunneling

314 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 30 Which of the following are mandatory steps in implementing split tunneling on a Cisco VPN Concentrator? (Choose all that apply.) ❑ A. Select Only Tunnel Networks in the list option ❑ B. Select the Tunnel Everything option ❑ C. Choose appropriate list from the Split Tunneling Network list ❑ D. Select Allow the Networks in List to Bypass the Tunnel option

Question 31 Which of the following steps are required to set up Split DNS? (Choose all that apply.) ❑ A. Identify list of secure networks ❑ B. Configure split tunneling ❑ C. Assign network list to split tunneling parameters ❑ D. Define names of all DNS servers, both corporate and ISP ❑ E. Define names of only corporate DNS servers ❑ F. Define primary and secondary DNS servers to resolve encrypted DNS queries

Question 32 Which of the following parameters on a Cisco VPN Concentrator specifies how to handle a packet that exceeds the MTU setting when tunneling through the public interface? ❍ A. TCP fragmentation ❍ B. IPSec fragmentation ❍ C. IP fragmentation ❍ D. UDP fragmentation

315 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 33 When configuring a Cisco VPN Client, which of the following options on the General tab enables a user to disable local LAN access when using an insecure local LAN? ❍ A. Allow IPSec over UDP (NAT/PAT) ❍ B. Use IPSec over TCP (NAT/PAT/Firewall) ❍ C. Allow Local LAN access ❍ D. Peer Response Timeout

Question 34 You have been assigned the task of preconfiguring 150 Cisco VPN Clients. Which of the following files can be used as a global profile to set standards for all Cisco VPN Client profiles? ❍ A. oem.ini ❍ B. vpnclient.ini ❍ C. vpnbuild.ini ❍ D. .pcf ❍ E. profile.ini ❍ F. Global.ini

Question 35 Which of the following sections under the Monitor |Sessions window gives you an overview of all the sessions, as well as the total active, peak concurrent, and total concurrent sessions? ❍ A. Session Summary ❍ B. LAN-to-LAN Sessions ❍ C. Remote Access Sessions ❍ D. Management Sessions

316 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 36 Which of the following windows displays more in-depth statistics about the remote access sessions? ❍ A. Monitoring | Remote Access | Detail ❍ B. Monitoring | Remote Access ❍ C. Monitoring | Detail | Remote Access ❍ D. Monitoring | Sessions ❍ E. Monitoring | Sessions | Details

Question 37 Digital signatures are used to link data with the owner of a specific private key. Which of the following holds true about digital signatures? (Choose all that apply.) ❑ A. Senders private key is used to encrypt the hash. ❑ B. The original message is run through a hashing algorithm. ❑ C. Hash that was appended to the original message is decrypted using the sender’s public key at the remote end. ❑ D. Hash values are matched. ❑ E. Matching hash values indicate that the message was signed by the sender’s private key.

Question 38 Which of the following defines a set of procedures needed to create, manage, store, revoke, and distribute digital certificates? ❍ A. Private key infrastructure ❍ B. Public key infrastructure ❍ C. Digital key infrastructure ❍ D. Analog key infrastructure

317 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 39 Which of the following steps are required for the end-user to obtain a digital certificate? (Choose all that apply.) ❑ A. User generates private and public key pair. ❑ B. User generates certificate request. ❑ C. User sends the request to the CA. ❑ D. User installs root certificate after installing identity certificate. ❑ E. User installs root certificate before installing identity certificate.

Question 40 When creating a certificate request message, which of the following fields must match the attribute data based on the concentrator to establish a secure VPN tunnel successfully? ❍ A. Organization (O) ❍ B. Subject Alternative Name ❍ C. Organizational Unit (OU) ❍ D. Key Size ❍ E. Common Name (CN)

Question 41 Which of the following parameters does the concentrator check before installing the identity certificate? (Choose all that apply.) ❑ A. Is the identity certificate verified with the CA’s public key? ❑ B. Has the identity certificate been revoked? ❑ C. Has the CA server used the PKCS#10 request? ❑ D. Has the identity certificate expired?

318 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 42 Which of the following is NOT true about the Certificate Revocation List (CRL)? ❍ A. CRL checking is the last validation step. ❍ B. The CRL is issued by the CA. ❍ C. The CRL contains a list of certificates that have been newly issued. ❍ D. The CRL contains a list of certificates that are invalid. ❍ E. The CRL is signed by the CA and released periodically.

Question 43 Which of the following protocols enable you to connect directly to the CA and use the network-based enrollment? ❍ A. DES ❍ B. SCEP ❍ C. Diffie-Hellman ❍ D. MD5

Question 44 When configuring the CRL Retrieval Policy, which option enables the concentrator to retrieve up to 5 CRL-DPs from the CRL-DP extension of the certificate being verified? ❍ A. Use CRL-DPs from the Certificate being checked ❍ B. Use Static CRL-DPs ❍ C. Use CRL-DPs from the Certificate being checked, or else use Static DPs ❍ D. No CRL checking

319 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 45

Which of the following statements are true about the IKE proposal? (Choose all that apply.) ❑ A. IKE proposal uses preshared key with extended authentication. ❑ B. IKE proposal uses digital certificates with extended authentication. ❑ C. IKE proposal uses MD5 as the encryption algorithm. ❑ D. IKE proposal uses MD5 as the authentication algorithm. ❑ E. DH group 2 is used to derive the shared secret. ❑ F. Lifetime is based upon the data flow.

Question 46 You want to download an identity certificate from a Microsoft CA by using the file enrollment process. Which of the following actions must be considered on the Cisco VPN Client when you want to implement the cut-and-paste transfer? (Choose all that apply.) ❑ A. Use binary encoded PKCS#10 (.p10). ❑ B. Use base 64 encoded PKCS#10 (.req). ❑ C. Department and group name must be identical. ❑ D. Department and group name don’t have to be identical.

320 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 47 Which of the following are the correct steps involved in the SCEP process? ❍ A. CA returns a CA or RA certificate; user sends the CA or RA certificate request to the CA; Certificate Manager verifies the CA or RA, generates keys and certificate request, and sends certificate request to CA; CA generates identity certificate and returns it to Certificate Manager. ❍ B. CA generates identity certificate and returns it to Certificate Manager; user sends the CA or RA certificate request to the CA; CA returns a CA or RA certificate; Certificate Manager verifies the CA or RA, generates keys and certificate request, and sends certificate request to CA. ❍ C. User sends the CA or RA certificate request to the CA; Certificate Manager verifies the CA or RA, generates keys and certificate request, and sends certificate request to CA; CA returns a CA or RA certificate; CA generates identity certificate and returns it to Certificate Manager. ❍ D. User sends the CA or RA certificate request to the CA; CA returns a CA or RA certificate; Certificate Manager verifies the CA or RA, generates keys and certificate request, and sends certificate request to CA; CA generates identity certificate and returns it to Certificate Manager

Question 48 Which firewall feature allows network administrators to centrally define firewall policies for the connected VPN clients? ❍ A. AYT ❍ B. Stateful Firewall ❍ C. CPP ❍ D. CIC

Question 49 When configuring the AYT feature on the concentrator, in what different ways can you configure the firewall settings under the Client FW tab of the Configuration | User Management | Groups | Modify page? (Choose all that apply.) ❑ A. Firewall Optional/Required ❑ B. No Firewall ❑ C. Firewall Required ❑ D. Firewall Optional

321 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 50 Which firewall is not supported by the CPP? ❍ A. CIC ❍ B. Network ICE BlackICE Defender ❍ C. ZoneAlarm ❍ D. ZoneAlarm Pro

Question 51 Which of the following steps are needed to configure Cisco Pushed Policy (CPP)? (Choose all that apply.) ❑ A. Under the Firewall Policy section, select Policy from Server. ❑ B. Select the Firewall Required or Firewall Optional parameter. ❑ C. Select NetworkICE as the firewall. ❑ D. Under the Firewall Policy section, select Policy Pushed. ❑ E. Select CIC or Zone Labs as the firewall.

Question 52 Which feature provides a secure connection within an on-site wireless LAN environment though a VPN Concentrator? ❍ A. Tunnel establishment ❍ B. Automatic VPN initiation ❍ C. IPSec VPN initiation ❍ D. Administrative VPN initiation

322 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 53 Which of the following are the predefined administrators on a VPN Concentrator? (Choose all that apply.) ❑ A. admin ❑ B. config ❑ C. isp ❑ D. mis ❑ E. user

Question 54 Which of the following is true about the Session Summary table in the Monitoring | Sessions window? ❍ A. Shows parameters and statistics for all active remote access sessions ❍ B. Shows summary total for LAN-to-LAN, remote access, and management sessions ❍ C. Shows parameters and statistics for all active administrator management sessions ❍ D. Shows summary total for only LAN-to-LAN sessions

Question 55 Which window displays the statistics for all IPSec activity and the active tunnels currently established to the concentrator? ❍ A. Monitoring | Statistics | NAT ❍ B. Monitoring | Statistics | Protocols | IPSec ❍ C. Monitoring | Sessions ❍ D. Monitoring | Statistics | L2TP ❍ E. Monitoring | Statistics | IPSec

323 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 56 Which concentrator window enables you to display the events in the current event log and lets you filter, display, and manage events by various criteria? ❍ A. Monitoring | Statistics | NAT ❍ B. Monitoring | Statistics | Live Log ❍ C. Monitoring | Live Event Log ❍ D. Monitoring | Filterable Event Log

Question 57 Which of the following tasks need to be completed when configuring a new event class under the Configuration | System | Events | Classes | Add window? (Choose all that apply.) ❍ A. Select the type of event class. ❍ B. Enable or disable special handling of this event. ❍ C. Select the range of severity level. ❍ D. Select the IKE parameters. ❍ E. Select the level of administrator privileges.

Question 58 Which administrator accounts on the VPN concentrator has all rights of the admin account except SNMP access? (Choose two.) ❑ A. admin ❑ B. config ❑ C. isp ❑ D. mis ❑ E. user

324 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 59 What must be done to make the boot configuration file the active configuration file? ❍ A. Copy current configuration to an FTP server ❍ B. Delete the config.bak file ❍ C. Swap the load file from TFTP server ❍ D. Reboot the Concentrator

Question 60 Which window enables you to implement a software update on the Cisco VPN Concentrator? ❍ A. Administration | Software Update | Client ❍ B. Administration | Software Update | Concentrator ❍ C. Configuration | Software Update | Concentrator ❍ D. Configuration | Software Update | Client

Question 61 What would be the normal burst size if you want to limit remote access users to 200Kbps of bandwidth on the concentrator by using bandwidth management policies? ❍ A. 35000 bytes ❍ B. 37500 bytes ❍ C. 40000 bytes ❍ C. 42750 bytes

Question 62 Which of the following modes should be used if there is no need to see the devices behind the VPN 3002 Hardware Client? ❍ A. Network PAT mode ❍ B. Client Extension mode ❍ C. Client mode ❍ D. Network Extension mode

325 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 63 Which of the following is the default authentication option on the Cisco 3002 HW Client? ❍ A. Per-connection authentication ❍ B. Interactive unit authentication ❍ C. User authentication ❍ D. Unit authentication

Question 64 In which of the following ways can the end user gain access to the username password prompt when individual user authentication is enabled? (Choose all that apply.) ❑ A. Via the Hardware Client Manager ❑ B. Via the Connection Status window ❑ C. Via the System Status window ❑ D. Via a redirect message when trying to access a Web page on the VPN Concentrator’s network

Question 65 You have configured backup servers on the Cisco HW Client. Which of the following is true about accessing backup servers on the HW Client? (Choose all that apply.) ❑ A. HW Client attempts to contact both primary and backup peers instantaneously. ❑ B. HW Client attempts to contact primary peers. ❑ C. If the primary peer is down, the HW Client declares the packet lost. ❑ D. HW Client attempts connection with the backup server.

326 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 66 Which of the following VPN Client versions support load balancing? (Choose all that apply.) ❑ A. Cisco VPN Software Client release 2 ❑ B. HW Client release 2.0 ❑ C. Cisco VPN Software Client release 3 and above ❑ D. HW Client release 3.5 and above

Question 67 Which of the following is the default port used by the VPN Virtual Cluster? (Choose all that apply.) ❑ A. UDP 9000 ❑ B. UDP 9023 ❑ C. TCP 9023 ❑ D. TCP 9000

Question 68 When enabled, which of the following features applies to all VPN Software and HW Clients using PAT mode? ❍ A. Client Network Extension ❍ B. Network Extension RRI ❍ C. Client PAT Extension ❍ D. Client RRI

Question 69 Which of the following statements are true about the Cisco VPN HW Client software update feature? (Choose all that apply.) ❑ A. Client update feature has to be enabled. ❑ B. Client update feature is enabled by default. ❑ C. Client Type parameter is case- and space-sensitive. ❑ D. Client Type parameter is not case- and space-sensitive. ❑ E. Revision Group Update parameter is not case-sensitive.

327 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice . . . . . Exam . . . 2.

Question 70 Which of the following are IPSec through NAT applications? (Choose all that apply.) ❑ A. IPSec over UDP (proprietary) ❑ B. NAT-T ❑ C. IPSec over TCP (proprietary) ❑ D. ISAKMP over UDP

Question 71 Which window allows you to enable NAT-T on a concentrator? ❍ A. Configuration | System | Tunneling Protocols ❍ B. Configuration | System | Tunneling Protocols | IPSec |NAT Transparency ❍ C. Configuration | System | Tunneling Protocols | NAT Transparency ❍ D. Configuration | System | Tunneling Protocols | IPSec | IPSec LANto-LAN

Question 72 When configuring IPSec LAN-to-LAN tunnels, which of the following ESP options are supported by the concentrator? (Choose all that apply.) ❑ A. HMAC-MD5-128-bit ❑ B. HMAC-SHA-1-160-bit ❑ C. DES-56-bit ❑ D. 3DES-168-bit ❑ E. AES-128-, 196-, and 256-bit

328 Chapter 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 73 Which of the following tables does the LAN-to-LAN wizard automatically configure? (Choose all that apply.) ❑ A. Group Name ❑ B. Connection Name ❑ C. SA Name ❑ D. Filter Name

Question 74 Which of the following statements are true regarding creation of static LAN-toLAN NAT translation rules? (Choose all that apply.) ❑ A. Specified local network address must be the same class as the mapped address. ❑ B. Packets are translated based on static rules. ❑ C. Port mapping is never performed. ❑ D. Static rules are bi-directional.

Question 75 Which of the following statements are true about installing an identity certificate via SCEP? (Choose all that apply.) ❑ A. Concentrator generates a RSA key pair. ❑ B. Concentrator creates a PKCS#10 request and sends it to CA. ❑ C. CA approves the request and sends the certificate back. ❑ D. CA approval process can be either automatic or manual.

14 Practice Exam 2 Answer Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1. B, D

20. A, C

39. A, B, C, E

58. B, D

2. C

21. B, C

40. C

59. D

3. A

22. A, C, E

41. A, B, D

60. B

4. C, D, E

23. B

42. C

61. B

5. C

24. A, C, D, E

43. B

62. C

6. E

25. A, B, D

44. A

63. D

7. C

26. D

45. B, D, E

64. A, C, D

8. D

27. B

46. B, C

65. B, C, D

9. C

28. D

47. D

66. C, D

10. A

29. A

48. C

67. B

11. C

30. A, C, D

49. B, C, D

68. D

12. A, B, C

31. A, B, C, E, F

50. B

69. A, C

13. A, D

32. B

51. B, D, E

70. A, B, C

14. B, C

33. C

52. B

71. B

15. B

34. B

53. A, B, C, D, E

72. A, B, C, D, E

16. C

35. A

54. B

73. A, C, D

17. C

36. E

55. E

74. A, B, C, D

18. A, B, C, D, E

37. A, B, C, D, E

56. D

75. A, B, C, D

19. A

38. B

57. A, B, C

330 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Answer Key Explanations Question 1 The correct answers are B and D. A person who has motivation and possesses the technical expertise to hack into a network system is classified as a structured threat. D is also correct because James, being an employee of the company, puts him in the internal threat category as well. Remember, unstructured threats consist of inexperienced people who are intellectually challenged rather than having malicious intent. External threats occur when someone outside your network tries to hack into your network.

Question 2 The correct answer is C. Denial of Service is classified as an attack that disables or corrupts networks, systems, and services with a malicious intent to deny service to authorized and intended users. DoS can also be as simple as wiping out or corrupting information necessary for business. A is incorrect because a reconnaissance attack is classified as an attack where the intruder attempts to discover and map systems, services, and vulnerabilities. B is incorrect because an access attack involves data manipulation, system access, or privilege escalation.

Question 3 The correct answer is A. To implement dedicated VPN with site-to-site tunnels and a few remote access VPNs, a VPN-enabled router, such as a Cisco 7100, would be the best choice. B is incorrect because VPN 3000 Concentrators can be implemented if the primary role is to perform remote access VPN with a few site-to-site VPNs. C is incorrect because a firewall would be classified as a firewall-based VPN solution. The primary role of the firewall would be to protect the internal network.

Question 4 The correct answers are C, D, and E. Cisco 3030, 3060, and 3080 Concentrators all support HW encryption. Hardware encryption is done using the


Scalable Encryption Processor (SEP2) modules that contain Programmable Digital Security Processor (DSP)-based security accelerator. A and B are incorrect because Cisco 3005 and 3015 Concentrators support software encryption.

Question 5 The correct answer is C. Cisco 3030 VPN Concentrator supports up to 500 simultaneous site-to-site tunnels and would be the best bet. A and B are incorrect because the 3005 and 3015 VPN Concentrators support up to 100 site-to-site tunnels. D is incorrect because although the Cisco 3060 Concentrator supports up to 1000 site-to-site tunnels, Cisco 3030 would be the best choice because cost is the driving force.

Question 6 The correct answer is E. The Cisco 3080 Concentrator supports up to a maximum of 10,000 remote access tunnels or 1,000 site-to-site tunnels. In an environment that caters to remote access as well as the site-to-site VPN tunnels, you have to subtract the total number of site-to-site VPN tunnels from the total tunneling capability of the VPN Concentrator to derive the number of remote access tunnels that can be established. In this case, the answer would be 10000–728=9272. In the given scenario, you can establish 9272 remote access VPN tunnels.

Question 7 The correct answer is C. C is correct because you need minimum release 2.5(2) software on the VPN concentrator and release 12.1 software on the router to establish a site-to-site VPN tunnel between a router and a VPN concentrator. Answer A is incorrect because those would be the requirements for the concentrator connecting to the PIX firewall. B is incorrect because the minimal release for the concentrator is 2.5(2). E is incorrect because there is no release 5.2 for the concentrator.

332 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 8 The correct answer is D. Anti-replay verifies that each packet is unique and not duplicated. The packets are protected by comparing the sequence numbers of the received packets and the sliding window on the destination device. A is incorrect because confidentiality is associated with encryption of data packets that involves some kind of encryption algorithm. B is incorrect because data integrity is associated with the fact that the data that was transmitted was not changed or altered and is achieved by some kind of hashing mechanism. C is incorrect because origin authentication is linked with authentication of the source of the packet guaranteeing and certifying the source of the information, and it can be achieved by using authentication methods.

Question 9 The correct answer is C. With asymmetric key encryption, the local end uses one key to encrypt, and the remote end uses another key to decrypt the traffic. A is incorrect because there is no such thing as an analog key. B is incorrect because symmetric keys are manually configured on both source and destination tunnel endpoints and have to be identical. With symmetric key encryption, each peer uses the same key to encrypt and decrypt the data. D is incorrect because there is no encryption method called auto-configurable.

Question 10 The correct answer is A. With RSA encryption, the remote tunnel endpoint uses its own private key to encrypt data, and uses sender’s public key to decrypt it. This technique is used in implementing digital certificates. B is incorrect because a private key is used only to encrypt data. C is incorrect because preshared keys are used in symmetrical encryption. D is incorrect because DiffieHellman is used to formulate a shared secret key to protect IKE exchanges and provide keying material for bulk encryption keys.


Question 11 The correct answer is C. DH group 5 uses a key size of 1536 bits. A is incorrect because DH group 1 uses a key size of 768 bits. B is incorrect because DH group 2 uses a key size of 1024 bits. D is incorrect because DH group 7 uses elliptic curve cryptography for hand-held mobile devices.

Question 12 The correct answers are A, B, and C. A is correct because a preshared key is a secret value that is manually entered on each peer to facilitate authentication. B is correct because RSA encrypted nonces use pseudo-random numbers that are generated at each peer. After these nonces are established, they are then used for authentication purposes. C is correct because RSA signatures rely on digital certificates to authenticate peers. D and E are incorrect because DES and 3DES are encryption algorithms.

Question 13 The correct answers are A and D. A is correct because Authentication Header (AH) provides authentication and integrity. B and C are incorrect because these protocols do not exist. D is correct because Encapsulating Security Payload (ESP) can be used to provide both encryption and authentication.

Question 14 The correct answers are B and C. In IKE Phase 1, a basic set of security services are negotiated and agreed upon to form an IKE SA. This basic set of security is used to protect all subsequent communications between peers. In IKE Phase 2, IPSec security parameters are exchanged and negotiated for bulk data encryption. A is incorrect because in this step you define interesting traffic. D is incorrect because data transfer happens based on the keys stored in the Security Association (SA) database. E is incorrect because SA is terminated in this step through deletion or timeout.

334 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 15 The correct answer is B. A security association (SA) is a one-way logical connection that provides security to all traffic passing through the connection. A is incorrect because Security Parameter Index (SPI) is what the VPN device uses to SA by associating it to a number. C is incorrect because Security Association Database (SAD) is a database that contains destination IP address, IPSec protocol, and SPI. D is incorrect because it does not exist.

Question 16 The correct answer is C. In a cluster, this virtual IP address is not tied to a specific physical device in the VPN cluster but is serviced by the virtual cluster. Note that IP address is a valid routable IP address. A, B, and D are incorrect because a cluster is always known by a virtual IP address assigned to it.

Question 17 The correct answer is C. Virtual cluster master maintains load information from all other non-masters. The non-master sends load information to the master in a form of a keepalive messages. As an administrator, you can limit the number of connections in a concentrator. A, B, and D are incorrect because the master maintains load information only from other non-master concentrators in the cluster.

Question 18 The correct answers are A, B, C, D, and E. In addition to all the mentioned clients and protocols, Cisco VPN Concentrator also supports Windows and Solaris clients. The Cisco VPN Concentrator also supports PPTP clients in Windows dial-up networking 1.3 and L2TP over IPSec in Windows 2000 as the tunneling protocols.

Question 19 The correct answer is A. When the stateful firewall module is enabled, a default firewall policy is loaded on the firewall and the default filter blocks all


traffic inbound that is not related to the outbound session. B is incorrect because the AYT feature verifies the presence of a firewall and reports that information back to the concentrator. C is incorrect because the CPP feature enables the admin to create a set of rules that allow or disallow traffic on connected VPN Clients. D is incorrect because VRRP firewalls do not exist.

Question 20 The correct answers are A and C. The Cisco 3002 VPN Hardware Client comes with one private interface, one public interface, and one console port. On the other hand, Cisco 3002-8E VPN Hardware Client comes with one public interface, one console port, and the private interface has a built-in 8-port 10/100BaseT Ethernet switch or a single private Ethernet interface. The private interface can be used to configure the HW client via HTTP, HTTPS, SSH, and Telnet. The console port can be used to access the CLI of the HW Client. B is incorrect because you cannot use the public interface to configure the device by default. You can change the configurations to allow this support, but doing so allows users on the Internet to gain access to the concentrator’s operating system. D is incorrect because you can Telnet to the CLI interface of the Cisco 3002 Hardware Client though the private interface.

Question 21 The correct answers are B and C. Quick Configuration enables you to configure the minimal parameters for operations. However, Quick Configuration installs only the minimal parameters to initialize the concentrator. You may require additional configurations in which you must use the VPN 3000 Concentrator Manager. A and D are both incorrect because there is nothing such as a Setup mode or Privilege mode on the concentrator.

Question 22 The correct answers are A, C, and E. The Configuration | Quick | Protocols submenu can be used in configuring L2TP, PPTP, and IPSec remote access protocols. The VPN concentrator can support all the three protocols, but it is recommended that you turn on only those protocols that you will be using. B and D are incorrect because RIP and OSPF are routing protocols and not tunneling protocols.

336 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 23 The correct answer is B. It is highly recommended that you use this method if you are authenticating against an external or internal authentication server. A is incorrect because the Client Specified option is used to enable VPN Clients to specify their own IP addresses. C is incorrect because you would choose this option if you were using DHCP to assign IP addresses. D is incorrect because you would use this option if the concentrator would assign IP addresses from an internal pool.

Question 24 The correct answers are A, C, D, and E. The Server Type field enables you to configure the RADIUS authentication server, NT domain authentication, SecurID server, and internal concentrator authentication server. The internal concentrator server is limited to a maximum of 100 groups and users. Answer B is not a valid option for a concentrator authentication server.

Question 25 The correct answers are A, B, and D. A is correct because the Default Group is a default template and majority of access rights and privileges are defined in this group. B is correct because the Groups category allows you to define different rights and privileges to individual groups. D is correct because you can use the Users group to assign special privileges to certain users. C is incorrect because it does not exist in the User Management tree.

Question 26 The correct answer is D. The Idle Timeout field is configured for the group idle timeout period in minutes. The VPN Concentrator terminates the connection in case of inactivity on this connection for the configured period of time. Remember, you can set the Idle Timeout value to 0 to allow unlimited connection time regardless of activity on the link. However, this is not a good practice. A is incorrect because Access Hours define when users can access the Concentrator. B is incorrect because Maximum Connect Time defines the time after which the system will terminate the connection. C is incorrect because it is a not an actual field in the Concentrator Manager.


Question 27 The correct answer is B. Network Authentication is also known as extended authentication or XAUTH, and is used in corporate networks to provide a secondary level of authentication. A is incorrect because concentrator authentication is used to set up users’ rights and privileges in conjunction with the concentrator. C and D are incorrect because they are not related to XAUTH.

Question 28 The correct answer is D. Split tunneling parameters are configured under the Client Config tab. Split tunneling can be configured in three ways. The three split tunneling parameters are Tunnel Everything (which is the default), Allow Networks in the List to Bypass the Network, and Only Tunnel Networks in List. Answers A, B, and C are incorrect because the split tunneling parameters are configured only on the Client Config tab.

Question 29 The correct answer is A. Split tunneling can be configured in three ways. To implement split tunneling, the concentrator pushes specific IP addresses to the Software Client. If the traffic is bound to one of these addresses, it is encrypted and sent back to the concentrator. All other IP addresses are sent in clear text and routed normally by the ISP. B is incorrect because the Tunnel Everything Except Local LAN Traffic option encrypts all traffic except the traffic destined for local LAN. C is incorrect because Tunnel Everything tunnels all traffic. D is incorrect because One-way tunneling does not exits.

Question 30 The correct answers are A, C, and D. To configure split tunneling, you enable split tunneling by selecting the Only Tunnel Networks in the List option or Allow the Networks in List to Bypass the Tunnel option. After the option is selected, you can then choose the appropriate network list from the Split Tunneling Network List drop-down menu. Answer B is incorrect because Tunnel Everything is the default value, in which all traffic is encrypted and sent over the VPN tunnel. Split tunneling entails allowing other traffic to be sent in clear text to different destinations aside from the tunnel.

338 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 31 The correct answers are A, B, C, E, and F. Split DNS configuration governs how Software Clients resolve a DNS query packet to be sent in clear text to the ISP-assigned DNS server or encrypted and sent over the tunnel to the corporate DNS server. D is incorrect because Split DNS requires you to define the corporate DNS servers only.

Question 32 The correct answer is B. IPSec fragmentation provides a way to handle issues where a router or NAT device between the client and the concentrator drops the packet because the packet size is greater than the configured MTU. A, C, and D are incorrect because they are not valid fragmentation techniques that are configured in the VPN Concentrator.

Question 33 The correct answer is C. Checking the Allow Local LAN Access check box enables a user to access resources on his local LAN. The user can disable local LAN access when using an insecure local LAN. This would be a viable option for people who travel for work. A is incorrect because the Allow IPSec Over UDP (NAT/PAT) option enables the Unity Client to connect to the Concentrator using UDP through a firewall or a router that is running NAT. B is incorrect because the Use IPSec Over TCP (NAT/PAT/Firewall) option enables the Unity Client to connect to the Concentrator by using TCP through a firewall or a router that is running NAT. D is incorrect because Peer Response Timeout defines the number of seconds a Unity Client waits before deeming the peer as inactive.

Question 34 The correct answer is B. The vpnclient.ini file can also be bundled with the Unity Client and when it is first installed. The vpnclient.ini file automatically configures the Cisco VPN Client’s global parameters. A is incorrect because the oem.ini file is used to install the Cisco VPN Client without user intervention. C, E, and F are incorrect because these files do not exist in the


VPN Client. D is incorrect because the purpose of the connection entries within the dialer application.

.pcf

file is to create

Question 35 The correct answer is A. The Session Summary section gives you an overview of all the sessions, as well as the total active, peak concurrent, and total concurrent sessions. B is incorrect because LAN-to-LAN Sessions displays individual LAN-to-LAN sessions. C is incorrect because Remote Access Sessions displays statistics on all remote access sessions. D is incorrect because Management Sessions displays information on all the current management users.

Question 36 The correct answer is E. To access detailed information on individual sessions, click on the Username hyperlink in the windows to bring up the Monitoring | Sessions | Detail screen. Session Details provides specific information about hashing algorithms, authentication modes, encapsulation modes, encryption algorithms, and more. A, B, and C are incorrect because they are not actual menus in the VPN Concentrator Manager. D is incorrect because the Monitoring | Sessions window displays basic information about individual sessions.

Question 37 The correct answers are A, B, C, D, and E. Remember, only a specific private key will produce a matching digital signature. The private key never leaves the machine.

Question 38 The correct answer is B. Public Key Infrastructure (PKI) makes it possible to generate and distribute keys within secure domains and enables a CA to issue keys, certificates, and certificate revocation lists in a secure manner. A, C, and D are incorrect because they are not valid infrastructures.

340 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 39 The correct answers are A, B, C, and E. The end-user must obtain a digital certificate from the CA to participate in certificate exchange. D is incorrect because a root certificate is always installed first. While installing the identity certificate, the user uses the public key of the root certificate to validate the signature of the identity certificate. This is also known as the enrollment process.

Question 40 The correct answer is C. The Organization Unit (OU) field must match the group attribute data configured on the concentrator. The group name is case sensitive and acute caution must be used when configuring the OU field as well as the group name field. To establish the VPN tunnel, both the OU and the group name have to be identical. A is incorrect because the Organization field depicts the company name. B is incorrect because Subject Alternative Name defines the FQDN for the concentrator. D is incorrect because Key Size is used to define the key size of the RSA key pair. E is incorrect because Common Name is the unique name of the concentrator.

Question 41 The correct answers are A, B, and D. Before installing the identity certificate, the concentrator must validate it by checking the expiration, revocation, and CA authentication parameters. After it is validated, the certificate is installed on the concentrator and the identity certificate can now be exchanged with a peer during the IPSec tunnel establishment. C is incorrect because PKCS#10 is a set of standard protocols used by different vendors to ensure secure information exchange on the Internet.

Question 42 The correct answer is C because a CRL does not contain a list of newly issued certificates. Answers A, B, D, and E are incorrect because the CRL is the last validation check and the CRL is valid for a specific length of time.


The CRL contains serial numbers of certificates that are not valid. This could be because of changes in user data, compromise of the private key, or voluntary or involuntary termination of employment. The CA periodically signs and sends these CAs to distribution points where they can be accessed via HTTP or LDAP.

Question 43 The correct answer is B. Network-based enrollment is an automated process that connects to the CA directly via Simple Certificate Enrollment Protocol (SCEP). A is incorrect because DES is an encryption algorithm. C is incorrect because Diffie-Hellman is used to derive the shared secret during IKE phase 1 negotiations. D is incorrect because MD5 is a one-way hashing algorithm that is also used in tunnel establishment.

Question 44 The correct answer is A. The concentrator retrieves up to 5 CRL-DPs from the CRL-DP extension of the certificate being verified. If the primary CRLDP fails, the concentrator tries using the next available CRL-DP on the list until the CRL is retrieved or the list is exhausted. B is incorrect because when using static CRL-DP option, you must enter at least 1, with a maximum of 5, static CRL-DPs. C is incorrect because if the concentrator cannot find 5 CRL-DPs in the certificate, it adds static CRL-DPs, with a maximum of 5. D is incorrect because No CRL Checking disables CRL checking.

Question 45 The correct answers are B, D, and E. The IKE proposal is configured to use digital certificates with extended authentication (XAUTH), MD5 as the authentication algorithm, 3DES as the encryption algorithm, and DH Group 2 to derive shared secret. The tunnel lifetime is based on time rather than data. A is incorrect because the proposal uses RSA digital certificates with XAUTH. C is incorrect because MD5 is an authentication algorithm and not an encryption algorithm. F is incorrect because lifetime parameter is configured to use time rather than data flow.

342 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 46 The correct answers are B and C. Microsoft CA supports Base 64–encoded PKCS#10 certificate requests only. Remember, the department name on the enrollment form must be identical to the group field on the concentrator. The department name and group names are case sensitive. A is incorrect because Microsoft CA does not support binary encoded PKCS#10. D is incorrect because the department name and group names are case sensitive and must be identical.

Question 47 The correct answer is D. SCEP operates between the client and the CA server. The certificate process is the same, but the approval process could be different. Depending on the behavior, the CA could process the request and generate an identity certificate, or wait until the request is approved by the CA administrator. A and B are incorrect because the PKCS#10 request must be issued from the requesting device before the certificate is created. C is incorrect because the CA or RA certificate request must be followed by the CA or RA returning the requested RA or CA certificate before any other identity certificate steps can transpire.

Question 48 The correct answer is C. The Centralized Policy Protection (CPP) allows network administrators to centrally define firewall policies for the connected VPN clients. The CPP is always pushed down from the concentrator to the Cisco VPN Clients at connection time. A is incorrect because Are You There (AYT) verifies whether a specific firewall is operational on the client PC. B is incorrect because Stateful Firewall, if turned on, blocks all inbound traffic that is not related to an outbound session, with the exception of DHCP and ARP traffic. D is incorrect because CIC is a firewall module integrated into the Cisco VPN Client.


Question 49 The correct answers are B, C, and D. B is correct because No Firewall is the default setting and the remote user is not required to run a firewall on the PC that is being used to establish connection. C is correct because Firewall Required option requires all remote users in that particular group to have a designated firewall installed on their machines. Non-Windows VPN clients and users without the designated firewall cannot connect to the concentrator if the Firewall Required option has been selected. D is correct because all users in this group can establish the tunnel whether a firewall is running on the PC or not. A is incorrect because there is no option called Firewall Optional/Required.

Question 50 The correct answer is B. Network ICE BlackICE Defender is not supported by Cisco Pushed Policy feature. CIC, ZoneAlarm, and ZoneAlarm Pro are supported by CPP. Answers A, C, and D are incorrect because ZoneAlarm, ZoneAlarm Pro, and the CIC client all support CPP.

Question 51 The correct answers are B, D, and E. Configuring CPP is a two-step process where you first select the supported firewall and then choose the policy you want to push out to the Cisco Software Clients. A is incorrect because users in a group use a Zone Labs Integrity Server to configure and manage firewall parameters on the remote PCs. C is incorrect because NetworkICE is not a supported firewall.

Question 52 The correct answer is B. The Automatic VPN Initiation feature provides secure connection within an on-site wireless LAN environment though a VPN Concentrator. A, C, and D are incorrect because they are not actual features of the Cisco Unity Client or the VPN Concentrator.

344 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 53 The correct answers are A, B, C, D, and E. Admin, config, isp, mis, and user are predefined administrators on the VPN concentrator. The user account has limited rights and with read and view privileges only. The config account and the mis account have all rights that an admin account has except SNMP access. The isp account has limited general configuration rights.

Question 54 The correct answer is B. The Session Summary table under the Monitoring | Sessions window shows the summary total for LAN-to-LAN, remote access, and management sessions. A is incorrect because to view the active, remote access sessions, you have to view the Remote Access Sessions table. C is incorrect because the Management Sessions table shows parameters and statistics for all active administrator management sessions. D is incorrect because the Summary Session table shows not only LAN-to-LAN sessions but also remote access and management sessions.

Question 55 The correct answer is E. The Monitoring | Statistics | IPSec window displays the statistics for IPSec activity, including the tunnels currently established to the concentrator. A is incorrect because the Monitoring | Statistics | NAT window shows statistics for NAT (Network Address Translation) activity on the VPN Concentrator since it was last booted or reset. B is incorrect because it is not a valid menu in the Cisco VPN Concentrator Manager. C is incorrect because the Monitoring | Sessions window shows comprehensive data for all active user and administrator sessions on the VPN Concentrator. D is incorrect because the Monitoring | Statistics | L2TP window shows statistics for current L2TP sessions and L2TP activity on the VPN Concentrator since it was last booted or reset.

Question 56 The correct answer is D. The Monitoring | Filterable Event Log window shows the events in the current event log and lets you filter, display, and man-


age events by various criteria. A is incorrect because the Monitoring | Statistics | NAT window shows statistics for NAT (Network Address Translation) activity on the VPN Concentrator since it was last booted or reset. B is incorrect because it is not a valid menu in the Cisco VPN Concentrator Manager. C is incorrect because the Monitoring | Live Event Log window displays events in the current event log and automatically refreshes every 5 seconds. Remember, if the Live Event Log window is active, the administrator session to the concentrator will never time out because each automatic window update would reset the inactivity timer.

Question 57 The correct answers are A, B, and C. Event classes can be configured to handle specific events on the concentrator. Event classes are good for debugging special parameters at a more granular level. D and E are incorrect because selecting IKE parameters and setting administrative rights are not related to creating event classes.

Question 58 The correct answers are B and D. The config and the mis accounts have all rights of the admin account except SNMP access. A is incorrect because the admin account has full access to the system and is the only account that is enabled by default. C is incorrect because the isp account has very limited general configuration rights. E is incorrect because the user account has very limited rights. In this account you have view and read privileges only.

Question 59 The correct answer is D. To make the boot configuration the active configuration, you have to reload the VPN concentrator. This file (CONFIG) is loaded every time you boot the concentrator and the configuration contained in that file becomes the active configuration. A, B, and C are incorrect because they will not make the boot configuration file the active configuration.

346 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 60 The correct answer is B. The Administration | Software Update | Concentrator window enables you to update the software image on the Cisco VPN Concentrator. You must reboot the concentrator for the new image to be initiated. A is incorrect because the Administration | Software Update | Client window is used to update software and hardware clients only. C and D are incorrect because they are not valid menus in the Cisco VPN Concentrator Manager.

Question 61 The correct answer is B. The formula to set the burst size is (policing rate in bits per second÷8)×1.5. If you use this formula, then (200000÷8)×1.5=37500 bytes. Any traffic below this 200Kbps is transmitted; traffic above this rate is dropped. 37500 bytes is the amount of data allowed in a burst before excess packets are dropped.

Question 62 The correct answer is C. Client mode is also known as PAT mode and is used to deploy VPN quickly and easily in very small remote offices. The hardware client uses PAT to isolate its private network from the public network. A and B are incorrect because they are not actual modes for the VPN 3002 HW Client. D is incorrect because in Network Extension mode, all SOHO PCs on the hardware client network are uniquely addressable via the tunnel.

Question 63 The correct answer is D. Unit authentication stores the username and password and forwards them automatically to the concentrator when the tunnel is established. A is incorrect because it is not a valid form of authentication. B is incorrect because interactive unit authentication does not store user password in the memory. When a tunnel is initiated the user behind the HW Client must supply username and password credentials. C is incorrect because user authentication is used when a first-time user tries to access the network over the tunnel. Both interactive and individual authentication are disabled by default and have to be enabled on the central VPN Concentrator.


Question 64 The correct answers are A, C, and D. When the individual user authentication feature is enabled on the concentrator, a username and password must be supplied to the HW Client before a user can access the tunnel. HTTP access to the Hardware Client Manager will prompt the user for a login. Specifically, when you click on the System Status hyperlink at the Hardware Client Manager login screen, you can perform individual logins. In addition, if you try to open an HTTP session across the tunnel, it redirects you to a login page. B is incorrect because the Connection Status window is the statistics window for the Cisco Unity Client.

Question 65 The correct answers are B, C, and D. If the HW Client does not receive an IKE reply from the concentrator within 8 seconds, it declares the packet lost and logs the entry. After four seconds, the HW Client then initiates a connection to the first configured backup server and traverses the list until the tunnel is established. After it reaches the end of the list, it terminates the process. The HW Client does not begin from the top of the list again. Answer A is incorrect because the HW Client tries to connect to the primary first, then the backup servers if the primary fails.

Question 66 The correct answers are C and D. When a VPN Client makes a connection request, the master concentrator checks the load list for the least-loaded concentrator. Cisco VPN Software Client release 3 and above and VPN 3002 release 3.5 and above support load balancing. Answers A and B are incorrect because the Cisco VPN Client must be running release 3 and the VPN 3002 HW Client must be running 3.5 to receive redirect IKE messages from the VPN Concentrator.

Question 67 The correct answer is B. VPN Virtual Cluster uses UDP port 9023 for load balancing. Answers A, C, and D are incorrect because they are using the wrong Layer 4 protocol or port.

348 Chapter 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question 68 The correct answer is D. After it is enabled, the Client RRI feature applies to all VPN software and HW Clients that are using the PAT mode. You can enable Client RRI by going to Configuration | System | IP Routing | Reverse Route Injection window and selecting the Client Reverse Route Injection check box. Remember, the routes are deleted when the client disconnects from the VPN Concentrator. Answers A and B are incorrect because those features are only for Cisco VPN 3002 Hardware Clients. Answer C is not an actual feature.

Question 69 The correct answers are A and C. The Client Update feature can be enabled by going to Configuration | System | Client Update | Enable window and making sure that the Enable box is checked. The Revision field and the Client Type group update parameter are case and space sensitive as well. Answer B is incorrect because the client update is not enabled by default. Answers D and E are incorrect because the Revision field and the Client Type group update parameter are case and space sensitive.

Question 70 The correct answers are A, B, and C. NAT-T is a global attribute and IPSec over UDP (proprietary) is a group attribute. On the other hand, IPSec over TCP is a system-wide feature and groups do not negotiate it. When enabled, it is on from the beginning of IKE negotiations. Answer D is incorrect because ISAKMP over UDP is not a valid NAT implementation.

Question 71 The correct answer is B. The Configuration | System | Tunneling Protocols | IPSec | NAT Transparency window allows you to enable NAT-T on the concentrator. The NAT Transparency link allows you to configure IPSec over TCP and IPSec over NAT Traversal (NAT-T) parameters. This parameter is applied globally for the concentrator. Answer A in incorrect because


the Configuration | System | Tunneling Protocols menu does not directly contain configuration parameters for NAT-T. You must click on the IPSec hyperlink to specifically enable NAT-T. Answers C and D are incorrect because they are not valid configuration pages in the VPN Concentrator Manager.

Question 72 The correct answers are A, B, C, D, and E. In addition to the HMAC-MD5 and HMAC-SHA1 authentication options, the concentrator also supports no data authentication as well. Advanced Encryption Standard (AES) encryption (AES) provides greater security than DES and is more efficient than triple DES. Support for AES has been incorporated on the concentrator from Release 3.6.

Question 73 The correct answers are A, C, and D. If the connection is successfully configured, the IPSec LAN-to-LAN wizard automatically configures the Group Name, SA Name, and Filter Name parameters. You can view or edit any parameters in these tables. Answer B is not correct because the Connection Name is not automatically supplied.

Question 74 The correct answers are A, B, C, and D. Static translation rules define oneon-one mapping between networks. When configuring static LAN-to-LAN NAT translation rules, the specified local network address must be of the same class as the mapped address.

Question 75 The correct answers are A, B, C, and D. The concentrator generates an RSA key pair and then creates a PKCS#10 request and sends it to the CA. The CA approves the request and sends the certificate back to the concentrator. Remember, the CA approval process can be either automatic or manual.

A VPN 3000 Concentrator Configuration Manager Navigation Menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The CSVPN 642-511 test can be quite scrupulous in its questions concerning the locations of certain menus and the items that reside on those menus. Throughout this book, I have pointed out the majority of the parameters that reside on these pages. However, it is always useful to be able to visualize the menu options that are spread throughout the VPN 3000 Concentrator Manager. If you have a general feel for the locations of the options, you can make an educated guess based upon the answers given to you. For that very reason, I have included this appendix to serve as a guide to help these menus make an impression in your memory. Pay attention to each figure listed in this Appendix to help yourself get a general feel for the menus that the VPN 3000 Concentrator supports. Then look at the tables after each figure in which I provide general parameters that you might encounter on that menu. In addition, I have added footnotes that signify chapters in which the parameters were discussed. Footnote numbers in the Screen Name column signify that the corresponding parameters listed in the Parameters column are mentioned within that chapter. If footnotes appear in the Parameters column, those specific items are mentioned in that chapter.

352 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Configuration Menus

Figure A.1 VPN Concentrator Manager Configuration Options 1.

Table A.1 VPN Concentrator Manager Configuration Options 1 Summary Screen Name

Parameters

Configuration | Interfaces

6

IP address, subnet mask, speed, and duplex of Ethernet interfaces , interface filters, OSPF, RIP, and bandwidth management assignment 4

Configuration | System | Servers

Communication parameters for connectivity to external AAA , DNS, DHCP, and NTP servers 4

Configuration | System | Address Assignment 4

Client specified, per user, DHCP, or configured pool tunnel IP assignments and parameters

Configuration | System | Tunneling PPTP, L2TP, and IPSec tunneling protocol Protocols parameters 4

Configuration | System | Tunneling LAN-to-LAN tunnel establishment, IKE proposal Protocols | IPSec creation and activation , IPSec over TCP and NAT-T NAT Transparency, and disconnect alerts to connected sessions 6

4

. . . . . . . . . . . . . VPN . . .3000 . . .Concentrator . . . . . . . Configuration . . . . . . . Manager . . . . . Navigation . . . . . . Menus . . . .


Table A.2 VPN Concentrator Manager Configuration Options 2 Summary Screen Name Configuration | System | IP Routing

Parameters 6

Configuration | System | Management Protocols

Static and default route entries, system-wide OSPF parameters, DHCP Proxy and DHCP Relay, VRRP establishment and role identification for concentrator redundancy, and Client/Network Extension Reverse Route Injection FTP, HTTP/HTTPS, TFTP, Telnet, SNMP, SSL, SSH and XML protocols for VPN 3000 Concentrator system management services

353

354 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure A.3

VPN Concentrator Manager Configuration Options 3.

Table A.3 VPN Concentrator Manager Configuration Options 3 Summary Screen Name Configuration | System | Events

Parameters 8

Configuration | System | General

Event record definition and handling parameters, event severity notification parameters for FTP, SNMP, Syslog, and email 4

Configuration | System | Client Updates

System time, date, and name, simultaneous session limit, and general system-wide authentication options 6

Configuration | System | Load Balancing

Cisco Unity Client and VPN 3002 Hardware Client software update notification message creation 6

Virtual cluster creation and role assignment for concentrator load balancing utilizing VCA protocol



Table A.4 VPN Concentrator Manager Configuration Options 4 Summary Screen Name

Parameters

Configuration | User Management | Base Groups

Common default group parameters for access security policies, DNS and WINS assignment, IPSec SAs, authentication methods, Split Tunneling, Split DNS, firewall policy enforcement , Hardware Client authentication modes and features , and PPTP/L2TP tunnel parameters

4

7

9

Configuration | User Management | Groups 4

Inherited base group attributes and custom usage parameters, group name and preshared key, group authentication, authorization, accounting server definition, group-specific address pool assignment, automatic groupwide client update notifications , group bandwidth policy assignment 6

6

Configuration | User Management | Users 4

Inherited base or individual group attributes and custom usage parameters, internal username and password, user-assigned IP address 4

355

356 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Table A.4 VPN Concentrator Manager Configuration Options 4 Summary (continued) Screen Name

Parameters

Configuration | Policy Management | Access Hours

Custom or default access times to limit connectivity to the network

Configuration | Policy Management | Traffic Management

Defined network lists for ease of configuration, rule definition and assignment to filters, IPSec SA negotiation parameters , NAT and PAT rules for LAN-to-LAN and interfaces, and bandwidth policy creation for rate policing and bandwidth reservation

4

6

4

Configuration | Policy Management | Certificate Group Matching

Custom rules for associating certain fields of digital certificates to groups

Administration Menus

Figure A.5 VPN Concentrator Manager Administration Options.

. . . . . . . . . . . . . VPN . . .3000 . . .Concentrator . . . . . . . Configuration . . . . . . . Manager . . . . . Navigation . . . . . . Menus . . . . Table A.5 VPN Concentrator Manager Administration Options Summary Screen Name

Parameters

Administration | Administer Sessions

Statistics for all management, remote access, and LAN-to-LAN sessions, session logout, and ping

8

8

Administration | Software Updates

Administration | Reboot

8

Administration | RebootStatus

VPN 3000 Client software update and manual client update notification for groups or all groups System reboot with configuration options, scheduled reboots, and reboot ignoring configuration to set concentrator to boot to factory defaults

8

Status of a scheduled reboot

8

Test IP connectivity using ICMP echo and echo reply

Administration | Ping

8

Administration | Monitor Refresh

Automatic statistics refresh interval

8

Concentrator administrators modification and activation, administrator passwords, administrator privileges, IP ACL access restrictions, and TACACS+ AAA access configuration

Administration | Access Rights

8

Administration | File Management

View, copy, delete file contents of flash memory, swap configuration file, TFTP file transfer download or upload, HTTP upload of configuration file, and export of configuration to XML

Administration | Certificate Management

Install, view, delete, and renew SSL, CA, and identity digital certificates, PKCS#10 certificate request, network-based SCEP identity requests, LDAP or HTTP CRL distribution point address, and CRL checking activation

5

357

358 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Monitoring Menus

Figure A.6 VPN Concentrator Manager Monitoring Options 1.

Table A.6 VPN Concentrator Manager Monitoring Options 1 Summary Screen Name

Parameters

Monitoring| Routing Table

8

Static routes, and dynamically-learned routes via OSPF or RIP

Monitoring| Dynamic Filters Monitoring | Filterable Event Log

8

Monitoring | System Status Monitoring | Sessions

8

Dynamic filters learned from an external RADIUS server that exist duration of session 8

Internal log for event classes based on specified severity level, live event log with five-second update intervals Software version, serial number, uptime, status of power supplies, interfaces, and SEP modules Statistics for all management, remote access, and LAN-to-LAN sessions, detailed protocol statistics per session, details encryption statistics per session, top ten sessions based upon data, duration, and throughput


Monitoring cont.

Statistics

Accounting Address Pools Administrative AAA Authentication Authorization Bandwidth Mgmt Compression DHCP DNS Events Filtering HTTP IPSec L2TP Load Balancing NAT PPTP SSH SSL Telnet VRRP MIB-II Stats Interfaces TCP/UDP IP RIP OSPF ICMP ARP Table Ethernet SNMP

Figure A.7 VPN Concentrator Manager Monitoring Options 2.

359

360 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Table A.7 VPN Concentrator Manager Monitoring Options 2 Summary Screen Name Monitoring | Statistics

Parameters 8

Monitoring | Statistics | MIB-II

Current statistics for all subsystems and functions of the VPN 3000 Concentrator 8

Current statistics for all supported MIB-II objects capable of being gathered via SNMP

B Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mel, H. X. and Baker, Doris. Cryptography Decrypted. Reading, MA: Addison-Wesley, 2000. Roland, John F. and Newcomb, Mark J. CCSP Cisco Secure VPN. Indianapolis, IN: Cisco Press, 2003. Cisco’s Web site contains a graphical presentation explaining the VPN 3002 Hardware Client’s Client Mode and Network Extension mode. The URL for this presentation is http://www.cisco.com/ mm/techsnap/VPN3002_techsnap.html. contains a list of hyperlinks containing information and standards regarding PKIs and digital certificates.

http://www.pki-page.org/#DIGSIG

For a complete overview of the initialization, configuration, administration and monitoring functions of the VPN 3000 Concentrator, visit Cisco’s Web documentation at http://www.cisco.com/univercd/ cc/td/doc/product/vpn/vpn3000/ and download the “VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring” for the requested software release. For product literature on all the VPN 3000 Concentrator family, go to http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/prod_ models_home.html. For product literature on BlackICE Defender products, please visit http://blackice.iss.net/. For product literature on Cisco Unity Client and its firewall integration, please read the “Cisco VPN Client Administration Guides” located at http://www.cisco.com/en/US/products/sw/secursw/ps2308/ products_administration_guides_list.html.

362 Appendix B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

For product literature on ZoneLabs products, please visit www.zonelabs.com.

http://

Thawte offers a free digital signature service for email at http:// www.thawte.com. This is a great and inexpensive way to enroll in the certificate process. There is a plethora of digital certificate information at http:// They have great FAQ on digital certificates, as well as a listing of all of the PKCS syntax standards.

www.rsasecurity.com/.

For information on Cisco security and VPN devices, see

http://www.

cisco.com/pcgi-bin/Support/browse/index.pl?i=Hardware%20Products&f=595.

For definitions and articles concerning security, visit searchSecurity. com at http://searchsecurity.techtarget.com/.

C What’s on the CD-ROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This appendix provides a brief summary of what you’ll find on the CD-ROM that accompanies this book. For a more detailed description of the PrepLogic Practice Exams, Preview Edition exam simulation software, see Appendix D, “Using the PrepLogic Practice Exams, Preview Edition Software.” In addition to the PrepLogic Practice Exams, Preview Edition, the CD-ROM includes an electronic version of the book, in Portable Document Format (PDF), and the source code used in the book.

The PrepLogic Practice Exams, Preview Edition Software PrepLogic is a leading provider of certification training tools. Trusted by certification students worldwide, PrepLogic is the best practice exam software available. In addition to providing a means of evaluating your knowledge of this book’s material, PrepLogic Practice Exams, Preview Edition features several innovations that help you improve your mastery of the subject matter. For example, the practice exams allow you to check your score by exam area or domain, to determine which topics you need to study further. Another feature allows you to obtain immediate feedback on your responses, in the form of explanations for the correct and incorrect answers. PrepLogic Practice Exams, Preview Edition exhibits all the full-test simulation functionality of the Premium Edition but offers only a fraction of the total questions. To get the complete set of practice questions, visit www.preplogic.com and order the Premium Edition for this and other challenging exam crams.

364 Appendix C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

For a more detailed description of the features of the PrepLogic Practice Exams, Preview Edition software, see Appendix D.

An Exclusive Electronic Version of the Text As mentioned previously, the CD-ROM that accompanies this book also contains an electronic PDF version of this book. This electronic version comes complete with all figures as they appear in the book. You can use Acrobat’s handy search capability for study and review purposes.

D Using the PrepLogic Practice Exams, Preview Edition Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This book includes a special version of the PrepLogic Practice Exams software, a revolutionary test engine designed to give you the best in certification exam preparation. PrepLogic offers sample and practice exams for many of today’s most in-demand and challenging technical certifications. A special Preview Edition of the PrepLogic Practice Exams software is included with this book as a tool to use in assessing your knowledge of the training guide material while also providing you the experience of taking an electronic exam. This appendix describes in detail what PrepLogic Practice Exams, Preview Edition is, how it works, and what it can do to help you prepare for the exam. Note that although the Preview Edition includes all the test simulation functions of the complete retail version, it contains only a single practice test. The Premium Edition, available at www.preplogic.com, contains a complete set of challenging practice exams designed to optimize your learning experience.

The Exam Simulation One of the main functions of PrepLogic Practice Exams, Preview Edition is exam simulation. To prepare you to take the actual vendor certification exam, PrepLogic is designed to offer the most effective exam simulation available.

366 Appendix D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Question Quality The questions provided in PrepLogic Practice Exams, Preview Edition are written to the highest standards of technical accuracy. The questions tap the content of this book’s chapters and help you review and assess your knowledge before you take the actual exam.

The Interface Design The PrepLogic Practice Exams, Preview Edition exam simulation interface provides you with the experience of taking an electronic exam. This enables you to effectively prepare to take the actual exam by making the test experience familiar. Using this test simulation can help eliminate the sense of surprise or anxiety you might experience in the testing center because you will already be acquainted with computerized testing.

The Effective Learning Environment The PrepLogic Practice Exams, Preview Edition interface provides a learning environment that not only tests you through the computer but also teaches the material you need to know to pass the certification exam. Each question includes a detailed explanation of the correct answer, and most of these explanations provide reasons as to why the other answers are incorrect. This information helps reinforce the knowledge you already have and also provides practical information you can use on the job.

Software Requirements PrepLogic Practice Exams, Preview Edition requires a computer with the following: ➤ Microsoft Windows 98, Windows Me, Windows NT 4.0, Windows

2000, or Windows XP ➤ A 166MHz or faster processor ➤ A minimum of 32MB of RAM ➤ 10MB of hard drive space

. . . . . . . . . . . . . . .Using . . . the . . PrepLogic . . . . . . Practice . . . . .Exams, . . . .Preview . . . . Edition . . . . Software . . . . . Performance As with any Windows application, the more memory, the better the performance.

Installing PrepLogic Practice Exams, Preview Edition You install PrepLogic Practice Exams, Preview Edition by following these steps: 1. Insert the CD-ROM that accompanies this book into your CD-ROM

drive. The Autorun feature of Windows should launch the software. If you have Autorun disabled, select Start, Run. Go to the root directory of the CD-ROM and select setup.exe. Click Open, and then click OK. 2. The Installation Wizard copies the PrepLogic Practice Exams, Preview

Edition files to your hard drive. It then adds PrepLogic Practice Exams, Preview Edition to your Desktop and the Program menu. Finally, it installs test engine components to the appropriate system folders.

Removing PrepLogic Practice Exams, Preview Edition from Your Computer If you elect to remove the PrepLogic Practice Exams, Preview Edition, you can use the included uninstallation process to ensure that it is removed from your system safely and completely. Follow these instructions to remove PrepLogic Practice Exams, Preview Edition from your computer: 1. Select Start, Settings, Control Panel. 2. Double-click the Add/Remove Programs icon. You are presented with

a list of software installed on your computer. 3. Select the PrepLogic Practice Exams, Preview Edition title you want

to remove. Click the Add/Remove button. The software is removed from you computer.

367

368 Appendix D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

How to Use the Software PrepLogic is designed to be user friendly and intuitive. Because the software has a smooth learning curve, your time is maximized because you start practicing with it almost immediately. PrepLogic Practice Exams, Preview Edition has two major modes of study: Practice Exam and Flash Review. Using Practice Exam mode, you can develop your test-taking abilities as well as your knowledge through the use of the Show Answer option. While you are taking the test, you can expose the answers along with detailed explanations of why answers are right or wrong. This helps you better understand the material presented. Flash Review mode is designed to reinforce exam topics rather than quiz you. In this mode, you are shown a series of questions but no answer choices. You can click a button that reveals the correct answer to each question and a full explanation for that answer.

Starting a Practice Exam Mode Session Practice Exam mode enables you to control the exam experience in ways that actual certification exams do not. To begin studying in Practice Exam mode, click the Practice Exam radio button from the main exam customization screen. This enables the following options: ➤ The Enable Show Answer button—Clicking this button activates the Show

Answer button, which allows you to view the correct answer(s) and full explanation for each question during the exam. When this option is not enabled, you must wait until after your exam has been graded to view the correct answer(s) and explanation for each question. ➤ The Enable Item Review button—Clicking this button activates the Item

Review button, which allows you to view your answer choices. This option also facilitates navigation between questions. ➤ The Randomize Choices option—You can randomize answer choices from

one exam session to the next. This makes memorizing question choices more difficult, thereby keeping questions fresh and challenging longer. On the left side of the main exam customization screen, you are presented with the option of selecting the preconfigured practice test or creating your own custom test. The preconfigured test has a fixed time limit and number of questions. Custom tests allow you to configure the time limit and the number of questions in your exam.

. . . . . . . . . . . . . . .Using . . . the . . PrepLogic . . . . . . Practice . . . . .Exams, . . . .Preview . . . . Edition . . . . Software . . . . .

The Preview Edition on this book’s CD-ROM includes a single preconfigured practice test. You can get the compete set of challenging PrepLogic Practice Exams at www.preplogic.com to make certain you’re ready for the big exam. You click the Begin Exam button to begin your exam.

Starting a Flash Review Mode Session Flash Review mode provides an easy way to reinforce topics covered in the practice questions. To begin studying in Flash Review mode, click the Flash Review radio button from the main exam customization screen. Then you select either the preconfigured practice test or create your own custom test. You click the Best Exam button to begin a Flash Review mode session.

Standard PrepLogic Practice Exams, Preview Edition Options The following list describes the function of each of the buttons you see across the bottom of the screen: Button Status Depending on the options, some of the buttons will be grayed out and inaccessible—or they might be missing completely. Buttons that are appropriate are active.

➤ Exhibit—This button is visible if an exhibit is provided to support the

question. An exhibit is an image that provides supplemental information that is necessary to answer a question. ➤ Item Review—This button leaves the question window and opens the

Item Review screen, from which you can see all questions, your answers, and your marked items. You can also see correct answers listed here, when appropriate. ➤ Show Answer—This option displays the correct answer, with an explana-

tion for why it is correct. If you select this option, the current question is not scored. ➤ Mark Item—You can check this box to flag a question that you need to

review further. You can view and navigate your marked items by clicking

369

370 Appendix D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the Item Review button (if it is enabled). When your exam is being graded, you are notified if you have any marked items remaining. ➤ Previous Item—You can use this option to view the previous question. ➤ Next Item—You can use this option to view the next question. ➤ Grade Exam—When you have completed your exam, you can click

Grade Exam to end your exam and view your detailed score report. If you have unanswered or marked items remaining, you are asked if you would like to continue taking your exam or view the exam report.

Seeing Time Remaining If your practice test is timed, the time remaining is displayed on the upperright corner of the application screen. It counts down the minutes and seconds remaining to complete the test. If you run out of time, you are asked if you want to continue taking the test or if you want to end your exam.

Getting Your Examination Score Report The Examination Score Report screen appears when the Practice Exam mode ends—as a result of time expiration, completion of all questions, or your decision to terminate early. This screen provides a graphical display of your test score, with a breakdown of scores by topic domain. The graphical display at the top of the screen compares your overall score with the PrepLogic Exam Competency Score. The PrepLogic Exam Competency Score reflects the level of subject competency required to pass the particular vendor’s exam. Although this score does not directly translate to a passing score, consistently matching or exceeding this score does suggest that you possess the knowledge needed to pass the actual vendor exam.

Reviewing Your Exam From the Your Score Report screen, you can review the exam that you just completed by clicking the View Items button. You can navigate through the items, viewing the questions, your answers, the correct answers, and the explanations for those questions. You can return to your score report by clicking the View Items button.

. . . . . . . . . . . . . . .Using . . . the . . PrepLogic . . . . . . Practice . . . . .Exams, . . . .Preview . . . . Edition . . . . Software . . . . .

Contacting PrepLogic If you would like to contact PrepLogic for any reason, including to get information about its extensive line of certification practice tests, you can do so online at www.preplogic.com.

Customer Service If you have a damaged product and need to contact customer service, please call 800-858-7674.

Product Suggestions and Comments PrepLogic values your input! Please email your suggestions and comments to [email protected].

License Agreement YOU MUST AGREE TO THE TERMS AND CONDITIONS OUTLINED IN THE END USER LICENSE AGREEMENT (“EULA”) PRESENTED TO YOU DURING THE INSTALLATION PROCESS. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT INSTALL THE SOFTWARE.

371

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3DES A symmetric encryption algorithm based on DES that encrypts, decrypts, and then encrypts once again with three independent 56bit keys, which aggregate to 168 bits.

.pcf files The Cisco Unity VPN Software Client’s connection entries are stored as files in the Profiles folder of the client’s installation directory.

AAA Stands for authentication, authorization, and accounting (AAA). Cisco appliances can offload these services to dedicated servers that support RADIUS and TACACS+.

Access Control Lists (ACL) A filter list mechanism used to control the access of a host’s or a network’s traffic to a device. ACLs are utilized by Cisco Concentrators to distinguish which hosts or networks are permitted to administer the appliance.

Advanced Encryption Standard (AES) A new Federal Information Processing Standard symmetric encryption method that was created to replace DES. It uses symmetric key lengths of 128, 192, and 256 bits.

Advanced View An interface view for version 4.x of the Cisco Unity Client. Advanced View displays all functions and menu options on the user interface.

aggressive mode The IKE Phase 1 option that establishes a security association that uses less time and fewer packets than the main mode option. Aggressive mode is susceptible to eavesdropping because the key is advertised before a secure channel is established.

374 anti-replay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

anti-replay An IPSec function that provides protection against replay attacks by utilizing AH and ESP. Anti-replay protects the receiver against replay attacks by rejecting old or duplicate packet sequence numbers.

appliance A dedicated device used to perform a specialized function. An example of this is the VPN 3000 Concentrator, which is dedicated for VPN capabilities.

Are You There (AYT) A firewall policy that reaffirms a specific firewall client is still present and active on the connecting client’s workstation. It achieves this by sending AYT messages every thirty seconds. If it does not detect the firewall client, it disconnects the tunnel.

modified during transit. AH does not provide any data confidentiality or encryption.

authorization The process of determining what service or services a user is permitted to use.

Auto-initiate A process defined in the vpnclient.ini file of the Cisco Unity VPN Software Client. When the network interface detects a certain network, it automatically triggers a VPN tunnel to the associated concentrator.

auto-update

A pair of keys consisting of a public and a private key. Only the public key is given out to others, whereas the private key is kept secret. Data encrypted with the public key can be decrypted only by its corresponding private key.

A feature that is enabled on the VPN 3000 Concentrator and pushed to connecting 3002 Hardware Clients. When the Hardware Client connects to the central site, the concentrator sends an update message containing available software revisions and the TFTP address to retrieve the software. If the 3002 Hardware Client does not have the latest software, it automatically updates its software by using the notified TFTP address.

authentication

bandwidth management

The process of determining whether an entity is who it claims to be.

The VPN 3000 Concentrator’s capability to police or reserve bandwidth for individual groups, LAN-to-LAN sessions, or an entire interface.

asymmetric keys

Authentication Header (AH) Part of the IPSec framework, AH performs an integrity checksum to ensure that the payload was not

375 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . clear . . . text . .

business-to-business extranet VPN A type of VPN strategy in which VPN tunnels are established over a shared or public infrastructure to connect a company to extranet business partners or other networks that are not part of the corporation.

is trusted without a certificate from any other certifying authority.

Certificate Revocation List (CRL)

A PKI design in which a single root CA signs and revokes all certificates. Also known as a flat CA structure.

A document that originates from a certificate authority that lists certificate serial numbers that have been issued but are no longer valid. Authenticating devices can check this list to determine whether an authenticating certificate has been revoked because of organization change, service removal, name change, or security compromise.

Central Protection Policy (CPP)

cipher text

A security policy for firewall clients that is set and automatically pushed down to the connecting clients from the central location. Configurable rules are centrally associated with a filter, and the resulting pushed policy informs participating firewall clients what protocols and networks are allowed.

An encrypted message that requires decryption before anyone can see the contents of the message.

Central CA structure

Certificate Authority (CA) A system that can issue and revoke digital certificates. Clients request certificates from a CA, which validates the credentials in the enrollment request, and in return, issues an identity certificate that can be distributed to requesting clients.

certificate chain A chain of authority wherein one certificate testifies to the authenticity of the previous certificate. A CA must have its certificate signed by a more reliable CA, which in turn may need its certificate signed by a higher-level CA. The root CA is at the end of a certificate hierarchy, which

Cisco Integrated Client (CIC) A firewall software add-on that is integrated with the Cisco VPN Software Client. With this feature, you can receive CPP pushed firewall policies, as well as turn on a stateful firewall that remains on despite VPN connectivity.

Cisco Unified Client Framework This framework entails a consistent specification that encompasses wireless and desktop clients’ interaction with VPN Concentrators version 3.0 and up, PIX Firewalls version 6.1 or later, and Routers with IOS version 12.8(T) or later.

clear text Traffic that is sent across an infrastructure without any form of encryption applied to it. If intercepted, clear text can be effortlessly seen and manipulated.

376 client mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

client mode A VPN 3002 Hardware Client operating mode in which devices’ IP addresses behind the client are translated to its internal tunnel address before traversing the tunnel. Because all private IPs are translated to the assigned tunnel IP, users behind the hardware client are not visible to the central concentrator’s network. Sometimes referred to as PAT mode.

Data Encryption Standard (DES) A symmetric algorithm developed by the United States Department of Defense that requires the sender and receiver to use the same 56-bit key for encryption.

Dead Peer Detection (DPD) A feature that uses IKE keepalives to ensure the remote peer is still present. When no data is being sent over the tunnel, IKE keepalives are sent and an idle timer is initiated. If the timer expires, the tunnel is torn down to save resources.

Demilitarized Zone (DMZ) A small network inside a corporation, located between the Internet network and a secured internal network, and that comprises commonly accessed devices such as FTP and HTTP servers.

DHCP relay The capability to forward DHCP broadcast requests from clients to a DHCP server located on a separate segment. This functionality, defined in RFC 1542, is useful so

you do not have to place a DHCP server on every segment requiring DHCP assigned parameters.

Diffie-Hellman (DH) A key exchange methodology in which two IKE negotiating devices calculate an identical secret key to be utilized for protecting subsequent IKE communication and providing keying materials for bulk data encryption keys.

digital certificates Entities used by public key infrastructure to provide universally standardized secure authentication. Binds an entity to a public/private key pair. CA systems and subordinate CA servers issue these to establish user identity and credentials during IKE negotiations.

Digital Signature Algorithm (DSA) An asymmetric algorithm that is used solely for digital certificates. It is less common than RSA and is typically used by the U.S. government.

digital signatures Intended to verify to a recipient the data sender’s identity. This is achieved by having the sender perform a hash of the message and encrypt it with its private key. When the recipient receives the message, it decrypts the hash with the sender’s public key and performs a similar hash on the message. If the values match, the message must have come from the sender because it is the only owner of that private key.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . File . . .Transfer . . . . Protocol . . . . . (FTP) . . .

Elliptical Curve Cryptography (ECC)

Enhanced Scalable Encryption Processors (SEP-E)

An asymmetric algorithm created by Certicom that is used in handheld devices with low processing power. ECC is capable of speeding up asymmetric operations because of its remarkable mathematical algorithm that uses elliptical curve equations.

A VPN hardware accelerator card that contains digital signaling processing to enhance encryption performance in the VPN 3000 Concentrator models 3015-3080. SEP-E modules specifically enhance DES, 3DES, and also AES encryption.

Encapsulating Security Payload (ESP)

event

Part of the IPSec framework, ESP ensures data confidentiality with encryption as well as data integrity and authentication. ESP protects the original IP data payload by encrypting it and encapsulating it within an additional ESP header and trailer.

encrypted nonces A randomly generated number that is exchanged during IKE negotiations. Using encrypted nonces for authentication is unique to Cisco and entails both parties encrypting the nonce with their peer’s public key. After the recipient decrypts the nonce, a hash is performed and sent back to the peer to be validated.

encryption A process of employing several different algorithms of different length-sized keys. Clear text data is input into the algorithm and combined with the key to produce an encrypted text called cipher text. Unless you have the appropriate decrypting key, you cannot effortlessly compromise the message’s substance.

Any noteworthy incident that the VPN 3000 Concentrator and the VPN 3002 Hardware Client can log, such as alarms, errors, completed tasks, and status changes.

event classes When the VPN Concentrator records events regarding its hardware and software subsystems in nonvolatile memory, it is associated with a class that can be used to filter event logs based on the subsystem you want to troubleshoot.

Extended Authentication (XAUTH) An extension to IKE that prompts the client for a username and password after device-level authentication occurs in IKE phase 1. This additional step ensures that users have proper credentials to log in to an authentication server before the tunnel is completely initiated.

File Transfer Protocol (FTP) A protocol residing in the Application layer of the TCP/IP protocol suite that is responsible for transferring data. FTP utilizes TCP for a transport protocol and utilizes ports 20 and 21 for data transfer and authentication.

377

378 filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

filters A filter, which comprises rules, can be applied to interfaces, users/groups, and LAN-to-LAN tunnels. The filter processes each individual rule until a match is made. After a match occurs, the rest of the rules are not processed. If there is no match, the filter performs the default action configured.

Hypertext Transfer Protocol (HTTP) The set of rules for exchanging text, graphic images, sound, video, and other multimedia files for Web interfaces and applications. HTTP resides on the Application layer of the TCP/IP protocol suite and utilizes TCP port 80 at the Transport layer.

Force Network Login

identity certificate

A Cisco Unity Client security feature that forces Windows NT, 2000, and XP users to log off the PC and log back in when establishing a tunnel. Upon a successful login, the VPN tunnel reestablishes itself automatically.

A type of digital certificate that is utilized to identify the authenticating system. CA servers and subordinate CA servers issue these to establish user identity and credentials during IKE negotiations. Identity certificates typically adhere to the X.509 standard and contain a serial number, validity dates, identity information of the CA and the requestor, the requestor’s public key, and the issuing CA’s digital signature.

Hashed Message Authentication Code (HMAC) Provides message authentication and integrity through the use of cryptographic hash functions. HMACs use a shared secret key to calculate a message digest, which is transmitted along with the message itself. When the recipient performs that same hash value, the hash should be identical. If the values do not match, the message was manipulated in transit and is discarded.

individual authentication An authentication feature in the VPN 3002 Hardware Client that requires each individual user to authenticate to the central concentrator before he or she is permitted across the tunnel.

hierarchical CA structure

Integrity Server (IS)

A PKI design subordinate in which the Root CA signs certificates for lower-level subordinate CAs. Subordinate CAs help control certificate distribution as well as certificate revocation. Also known as a tiered CA structure.

A Zone Labs Enterprise server that allows an administrator to manage, enforce, and monitor security policies. The VPN 3000 Concentrator can interact with this server when configured to utilize its corresponding firewall feature.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . main . . . mode . . .

interactive authentication

LAN-to-LAN

An authentication feature in the VPN 3002 Hardware Client that protects the central site by requiring a user to provide the Hardware Client’s credentials for tunnel establishment.

A site-to-site VPN tunnel that connects the concentrator’s LAN to another concentrator, firewall, router, or other IPSec-compliant device.

Internet Control Messaging Protocol (ICMP)

A Layer 2 tunneling protocol that contains features of PPTP from Microsoft and Layer 2 Forwarding protocol from Cisco. L2TP is slowly replacing PPTP as a popular remote access tunneling protocol.

An error reporting and diagnostic protocol between a host and a gateway. This protocol is utilized by popular utilities such as ping and traceroute.

Internet Key Exchange (IKE)

Layer 2 Tunneling Protocol (L2TP)

Lightweight Directory Access Protocol (LDAP)

A hybrid protocol derived from the Internet Security Association and Key Management Protocol (ISAKMP) and the Oakley protocol. IKE automatically handles the preliminary negotiation and authentication between IPSec peers.

A protocol to locate organizations, individuals, and files in a directory server database such as Novell Directory Services (NDS) or Windows Active Directory (AD).

Internet Protocol Security (IPSec)

LEAP is a Cisco proprietary enhancement to the EAP protocol that allows additional security features such as mutual authentication and dynamic WEP keys. LEAP is used to authenticate users to the wireless network by authenticating them to a RADIUS server before distributing a key to encrypt the wireless session.

IPSec is a framework of protocols that comprises a combination of standards and technologies. IPSec uses Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols for authentication of the sender and encryption of data services.

Intrusion Detection System (IDS) A dedicated appliance or software that monitors networks or devices for attack signatures to prevent the attack before it has an opportunity to cause substantial damage.

Lightweight Extensible Authentication Protocol (LEAP)

main mode Consists of three 2-way exchanges during IKE phase 1 to establish IKE SAs, authenticate peers, and perform key exchanges.

379

380 Management Information Base-II (MIB-II) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Management Information Base-II (MIB-II)

Network Address Translation Traversal (NAT-T)

A class of statistic parameters that can be monitored by utilizing a network management server (NMS) and the SNMP protocol.

A ratified UDP encapsulation standard of NAT transparency that encapsulates IPSec into UDP using port 4500.

man-in-the-middle attack

network autodiscovery

An attack in which the attacker intercepts data between two communicating peers and manipulates or hijacks the session by inserting or changing data.

A LAN-to-LAN feature that enables a VPN Concentrator to automatically discover a peer’s network through the use of RIP.

message digest

A VPN 3002 Hardware Client operating mode in which a single site-to-site connection is established that does not utilize PAT for tunnel traffic. The central network has full visibility to the IP addresses assigned to users on the Hardware Client’s private network.

A small fixed-length representation of data used to verify the authenticity of data. If any bit of the data or digest has been changed, the resulting message digest does not match and the packet is dropped.

Message Digest 5 (MD5) An algorithm used for message integrity that utilizes a 128-bit key in the hashing algorithm and produces a 128-bit message digest.

NAT transparency The capability to encapsulate IKE and IPSec packets in UDP or TCP to work in conjunction with intermediary NAT- or PAT-capable devices.

Network Address Translation (NAT) A technology utilized to translate an inside or internal IP address into an outside or public IP address.

Network Extension mode

oem.ini A file in the Cisco Unity VPN Software Client that installs the client on a workstation without user intervention.

Perfect Forward Secrecy (PFS) DH rekeying utilizes portions of the previous key when creating the new key, which could jeopardize subsequent keys if compromised. PFS mitigates this problem by performing a completely new DH exchange.

perimeter router In a secured network, the perimeter router is the device connecting to the Internet. This device typically implements a packet filter to limit access to the DMZ and the internal network.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Public . . . Key . . .Infrastructure . . . . . . . (PKI) . . .

ping

preshared keys

A utility that uses ICMP to determine whether there is IP connectivity to an IP device.

A form of IKE authentication characterized by having identical keys at each end of the tunnel. This key has to be manually configured in both devices that terminate the tunnel, which makes preshared keys not very scalable in large networks.

PKCS#7 A standard specification produced by RSA Laboratories for certificate envelope message syntax.

Point-to-Point Protocol (PPP) A standard Layer 2 encapsulation mechanism for transporting multiprotocol packets across point-topoint links. PPP is used to perform functions such as dynamic IP address assignment, compression, and authentication, and can handle synchronous as well as asynchronous communication over different media types.

Point-to-Point Protocol over Ethernet (PPPoE) A Layer 2 protocol that allows PPP frames to be encapsulated in an Ethernet frame for use over multiaccess networks, such as Ethernet, DSL, and cable modem.

Point-to-Point Tunneling Protocol (PPTP) An extension of the PPP protocol, PPTP is a remote access Layer 2 tunneling protocol developed by Microsoft and other companies.

Port Address Translation (PAT) A form of NAT that overloads an IP address or several IP addresses and forms a NAT association down to the port level.

private addresses A range of IP addresses set aside by the Internet Authority Numbers Association that is never routed out on the public Internet. To route devices containing private addresses, either NAT or PAT must be implemented to translate the IPs into publicly recognized addresses.

private key A key that is generated for asymmetric encryption and that is never transmitted over the medium. A private key is used to decrypt traffic that was encrypted with its associated public key. The private key is also used to encrypt a message hash to digitally sign data.

public key A key that is generated for asymmetric encryption and that is openly distributed to peers from whom you want to receive encrypted data. Data that is encrypted with a public key can be decrypted only by its associated private key.

Public Key Infrastructure (PKI) A set of security services that entail the certificate authorities and all their client applications working in a unified framework.

381

382 Public-Key Cryptography Standard #10 (PKCS#10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Public-Key Cryptography Standard #10 (PKCS#10) A standard specification produced by RSA Laboratories for identity certificate request message syntax.

Quick Configuration A CLI or HTML-based utility that enables you to configure the minimal parameters necessary to initialize the VPN 3000 Concentrator and the VPN 3002 Hardware Client.

quick mode IKE phase 2 negotiations operate only in this mode. During quick mode, an IPSec SA is negotiated for the encryption and authentication services that will be provided by IPSec.

remote access VPN A VPN tunnel in which telecommuters and mobile users connect to a network via tunneling protocols such as Layer 2 Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP), and IPSec.

Remote Authentication Dial-In User Service (RADIUS) A communication protocol used between a network access server (NAS) and an access control server (ACS) to authenticate, authorize, and audit users. RADIUS utilizes UDP as a layer 4 transport.

Remote Office Branch Office (ROBO) A relatively small office that has connectivity back to the central headquarters or enterprise location.

Reverse Route Injection (RRI) Connecting devices can inject their internal addresses into the concentrator’s routing table so that they can be distributed to any other routing device.

root certificate A digital certificate that is used to validate an identity certificate. The root certificate is issued from a root CA and contains the public key that is utilized to verify CA-signed identity certificates.

root certificate authority Whether in a flat or tiered PKI hierarchy, the root certificate authority issues digital identity certificates for devices as well as for subordinate CAs. When issuing an identity certificate, it uses its private key to sign it.

Routing Information Protocol (RIP) A distance vector routing protocol that utilizes hop count as its only metric. RIP can support up to 15 hops.

RSA Encryption An asymmetric encryption algorithm that was named after its creators Ron Rivest, Adi Shamir, and Leonard Adleman. RSA’s key length varies in size depending on the level of encryption security you want to use. RSA is a public key algorithm used to perform encryption and peer authentication.

. . . . . . . . . . . . . . . . . . . . . . . . . . . .Simple . . . .Mail . . Transfer . . . . . Protocol . . . . .(SMTP) . . . .

Rules

Secure Sockets Layer (SSL)

Rules are defined on a VPN 3000 Concentrator and are applied to filters. These rules can specify protocols and the networks that are allowed to travel across the VPN tunnel and through interfaces.

A Session layer protocol used by Application layer protocols, such as FTP, HTTP, and LDAP, to create secure message transactions over a public medium.

Scalable Encryption Processor (SEP)

A negotiated matching policy agreement between two IPSec peers that is established during both stages of IKE. Both peers must have matching supported parameters, such as hash and encryption algorithms, for IKE to continue.

A VPN hardware accelerator card that contains digital signaling processing to enhance encryption performance in the VPN 3000 Concentrator models 3015-3080. SEP modules drastically improve throughput for DES and 3DES encryption.

secret key A matching key negotiated during the Diffie-Hellman key exchange. A secret key is calculated by exchanging public keys and mathematically combining that material with the local private key. This key is further used for securing subsequent IKE messages and keying material for bulk encryption keys.

Secure Hash Algorithm-1 (SHA-1) An algorithm used for message integrity that utilizes a 160-bit key in the hashing algorithm and produces a 160-bit message digest.

Secure Shell (SSH) A standard for remote logins and file transfer that provides strong authentication and secure communications over insecure channels. Secure shell uses TCP Port 22.

Security Association (SA)

silent mode An installation of the Cisco Unity VPN software client in which an edited oem.ini file automatically installs the client without user intervention.

Simple Certificate Enrollment Protocol (SCEP) Developed jointly by Verisign and Cisco, this protocol performs automatic enrollment of digital identity certificates by generating certificate requests and downloading the resulting identity certificate from an issuing CA.

Simple Mail Transfer Protocol (SMTP) An Application Layer protocol of the TCP/IP protocol suite that is utilized for outgoing mail transfer. It uses TCP port 25 for a layer 4 transport.

383

384 Simple Network Management Protocol (SNMP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Simple Network Management Protocol (SNMP) An Application Layer protocol of the TCP/IP protocol suite that is utilized for proactively managing and monitoring supported devices. It uses UDP port 161 for a layer 4 transport.

Simple View A condensed interface view for version 4.0 of the Cisco Unity Client. Simple View displays limited controls and menus on the user interface for basic VPN connectivity.

site-to-site intranet VPN A VPN solution that entails a tunnel connecting two separate office networks that are within the same company. Site-to-site intranet VPNs offer a great deal more scalability and are relatively cheaper than traditional networking options such as leased lines.

Small Office/Home Office (SOHO) A small office environment in which there are few users connecting back to the central headquarters.

split tunneling The capability to send encrypted traffic destined for the tunnel network, while sending traffic destined for the Internet and local LAN in clear text.

stateful inspection A packet filtering technology in which session connection information (IP, ports, flags, and sequence numbers) is logged and maintained by a state table. All traffic session

data is compared against the state table. If the connection information does not match the entries in the state table, the packets are dropped.

subordinate certificate authority A digital certificate issuing server in a PKI hierarchy. A subordinate certificate authority’s identity certificate is signed by another subordinate CA or by the root CA, forming a certificate chain.

symmetric key Symmetric keys utilize an identical key pair. Data is encrypted and decrypted with the same key.

system reboot A reboot feature in the VPN 3000 Concentrator and VPN 3002 Hardware Client in which you can reboot the appliance at a scheduled time and perform requested configuration saves.

telnet An Application Layer protocol of the TCP/IP protocol suite that is utilized to initiate and maintain a virtual console session into a supported device. It can also be used to transmit raw protocol commands. It uses TCP port 23 as a layer 4 transport.

Terminal Access Control Access Control System+ (TACACS+) An authentication protocol used by remote-access servers to forward user logon credentials to an external authentication server. TACACS+ utilizes TCP as a Layer 4 transport.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . VPN . . .Accelerator . . . . . . Card . . .(VAC) . . .

transform set A set of security parameters and rules that are negotiated during IKE phase 2.

Transmission Control Protocol (TCP) A connection-oriented protocol that operates at Layer 4 of the TCP/IP protocol stack. TCP offers reliable end-to-end transport in addition to error correction and flow control.

transport mode

protocol stack. Although it lacks reliability, UDP has less overhead than TCP and is relatively faster.

Virtual Cluster Agent (VCA) A protocol to maintain a virtual group of parallel concentrators for performing load balancing. VCA is used by non-master concentrators to report their current load value to the master, who, in turn, can redirect connecting clients to underutilized concentrators.

An IPSec mode that is negotiated in IKE phase 2 and that maintains the original IP header and protects only the upper-layer payload.

Virtual Private Networks (VPN)

Trivial File Transfer Protocol (TFTP)

Virtual Router Redundancy Protocol (VRRP)

An Application layer connectionless protocol of the TCP/IP protocol suite that is utilized to transfer files without any initial password or authentication requirements. It uses UDP port 69 as a Layer 4 transport.

A protocol used to maintain a virtual group of parallel concentrators to perform concentrator redundancy. VRRP entails other concentrators acting as backups in case of the failure of a master concentrator.

tunnel mode

The HTML-based configuration interface for the VPN 3000 Concentrator.

An IPSec mode that is negotiated in IKE Phase 2 and that consists of encrypting and authenticating the entire original payload.

Unity Client Another name for the Cisco VPN client that is part of the Cisco Unified Client Framework.

User Datagram Protocol (UDP) A connectionless protocol that operates at Layer 4 of the TCP/IP

A secure point-to-point connection between two or more networks across a public infrastructure.

VPN 3000 Concentrator Manager

VPN 3002 Hardware Client Manager The HTML-based configuration interface for the VPN 3002 Hardware Client.

VPN Accelerator Card (VAC) A hardware encryption module that enables a Cisco PIX firewall to increase encryption performance.

385

386 vpnclient.ini . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

vpnclient.ini A global profile file that the Cisco Unity Software Client uses to perform Auto-initiation of VPN tunnels.

Wireless Local Area Networks A type of local area network in which wireless (radiated) transmissions are utilized for network connectivity, as opposed to traditional cabling methodologies.

X.509 A recommended ITU standard for defining digital certificates.

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Numbers 3DES (3X data encryption standard) encryption algorithm, 16

Administer Sessions screen (VPN 3000 Concentrator), 162 Group pull-down menu, 161 LAN-to-LAN Sessions table, 161

A AAA servers, prioritizing, 69 AAA TACACS+ Server screen (VPN 3000 Concentrator), 172 Access Control List screen (VPN 3000 Concentrator), 172

Management Sessions table, 161 Refresh icon, 160 Remote Access Sessions table, 161 Reset icon, 160 Session Summary table, 161 tables, switching between, 161

Access Rights screens (VPN 3002 Hardware Client Manager), 207

Administration menus (VPN 3000 Concentrator Manager), 357

accessing

Administration section (VPN 3000 Concentrator Manager), 55

VPN 3002 Hardware Client, 196, 207 VPN 3002 Hardware Client Manager, 197 ACL (Access Control Lists), 172 Action drop-down box (Rules Definition screen), 109 Add or Modify screen (VPN 3000 Concentrator), 165 admin accounts, 170

administrator accounts admin accounts, 170 config accounts, 170 defining, 171 ISP accounts, 171 mis accounts, 171 user accounts, 171

388 administrator settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . administrator settings, changing, 171

validating digital certificates, 91

Administrators screen (VPN 3000 Concentrator), 171

VPN 3000 Concentrator enrollment, 92-96

Advanced View feature (VPN Unity Client 4.0), 240 AES (Advanced Encryption Standard) encryption algorithm, 16 aggregate bandwidth, defining, 123 AH (Authentication Header) protocol, 19-20 Allow Local LAN Access check box, 223

digital certificates, 86, 98 CA, 87-91 encoding formats, 92 managing, 97 PKI, 89 public keys, 86 validating, 91 X.509v3, 87

answer strategies (exams), 4-5

identity certificates, 89

anti-replay protection, IPSec, 19

IPSec, 17

assessing exam readiness, 2

DSA, 18

assigning bandwidth management policies, 121-123

preshared keys, 18

asymmetric encryption keys, 14 authentication CA, 88

preshared keys, group preshared keys, 18 preshared keys, unique preshared keys, 18

automated enrollment process, 96

preshared keys, wildcard preshared keys, 18

central CA structures, 89

RSA Digital Signatures, 18

CRL, 91, 97

RSA encrypted nonces, 19

manual enrollment process, 92-95 PKCS#10 requests, 92-94 private keys, 89 RA, 90 root CA servers, 89-91

PKI, 89 RA, 90 Authentication Algorithm parameter (IKE Proposal screen), 72 Authentication Header protocol. See AH protocol

subordinate CA servers, 89-91

Authentication Mode parameter (IKE Proposal screen), 72

tiered hierarchy CA structures, 89

Authentication tab Properties screen, 224-225 VPN Unity Client 4.0, 237

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . business-to-business . . . . . . . . . . . . extranet . . . . .VPN . . authorization. See authentication auto updates, 164 automated enrollment process (CA), 96 automatic silent mode installation (VPN Unity Client), 221 Automatic VPN Initiation option (Options menu), 227 AYT (Are You There) messages, 143, 149

B Backup Servers tab (VPN Unity Client 4.0), 238 Backup VPN Easy Servers field (VPN 3002 Hardware Client), 203 backups, CONFIG.BAK files, 175 bandwidth aggregate bandwidth, defining, 123 link speed, defining, 122 management assigning, 121-123

Bandwidth Reservation field (Bandwidth Policies Add or Modify screen), 121 base groups configuring Client Config tab (Configuration Base Group screen) parameters, 63-67 General tab (Configuration Base Group screen) parameters, 58-60 Group Client FW tab (Configuration Base Group screen) parameters, 67 HW Client tab (Configuration Base Group screen) parameters, 67 IPSec tab (Configuration Base Group screen) parameters, 60-63 PPTP/L2TP tab (Configuration Base Group screen) parameters, 67-68

bandwidth reservation, 120, 123

parameters, defining via VPN 3000 Concentrator, 56-57

configuring, 120

tunneling protocols, defining, 59

defining, 120-121

basic groups

group selection, 122

IP address compression, 62

traffic policing, 120

preshared keys, defining, 62

VPN 3000 Concentrators, 37

versus individual groups, 68

policies, implementing, 180 Bandwidth Policies Add or Modify screen (VPN 3000 Concentrator), 121 bandwidth reservation (bandwidth management policies), 120, 123

BlackICE Defender/Agent (NetworkICE), 146 business-to-business extranet VPN, 9 IOS VPN routers, 10-11 PIX firewalls, 11

How can we make this index more useful? Email us at [email protected]

389

390 buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . buttons. See also individual button entries Generate Hold Down Routes button (Hold Down Routes section), 117 radio buttons (exams), 3 Upgrade Clients Now button (Clients screen), 165

C CA (certificate authorities), 87-88 automated enrollment process, 96 central CA structures, 89 CRL, 91, 97 digital certificates, validating, 91 Issuer field, 95 manual enrollment process, 92-95

Certicom Movian Client, 12 Certificate Manager (VPN Unity Client), 235 Certificate Manager screen (VPN 3000 Concentrator), 97 changing administrator settings, 171 tunneling protocols, logging in/out after changes, 160 user account permissions, 171 check boxes. See also individual check box entries Allow Local LAN Access check box, 223 Inherit check boxes (Configuration User Management screen), 70 check boxes (exams), 4

PKCS#10 requests, 92-94

CIC (Cisco Integrated Client) firewall, 143, 146, 227

private keys, 89

Cisco Concentrator, 146

RA, 90

Cisco Pushed Policy. See CPP

root CA servers, 89-91

Cisco Unified Client Framework, VPN Unity Client, 220

Serial Number field, 94 Signature Algorithm field, 95 subordinate CA servers, 89-91 tiered hierarchy CA structures, 89 Valid From/Valid To field, 95 VPN 3000 Concentrator enrollment automated enrollment process, 96 manual enrollment process, 92-95 central CA structures, 89 Certicom IPSec Client, 12

Cisco Unity Client. See VPN Unity Client Cisco VPN 3000 Concentrators. See VPN 3000 Concentrators Cisco VPN Client. See VPN Unity Client Cisco VPN Software Client. See VPN Software Client Client Auto-Initiation feature (VPN Unity Client), 229-230 Client Config tab Configuration Base Group screen, 63-67 VPN 3000 Concentrator, 228

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . configuring . . . . . . Client FW Configuration tab, 145 Client mode (VPN 3002 Hardware Client), 192-193 Client RRI, 117

Reauthentication on Rekey option, 62-63 Remote Access option, 62 PPTP/L2TP tab, 67-68

Client Update screen (VPN 3000 Concentrator), 166

Configuration menus (VPN 3000 Concentrator Manager), 351-356

clients, updating

Configuration section (VPN 3000 Concentrator Manager), 55

notifications, 165 software update notification messages, 164 Clients screen (VPN 3000 Concentrator), 165 comparing VPN 3000 Concentrators, 35-37 compression, basic group IP addresses, 62

configuration simulation questions (exams), 4 Configuration User Management Group screen (VPN 3000 Concentrator) Group Identity tab, 69 Inherit check boxes, 70 configuring

concentrator redundancy versus siteto-site redundancy, 127

bandwidth management policies, 120

config accounts, 170

base group parameters

CONFIG files, 174 CONFIG.BAK files, 174-175 Configuration Base Group screen (VPN 3000 Concentrator), 57 Client Config tab, 63-67 General tab, 58-60 Group Client FW tab, 67 HW Client tab, 67 IPSec tab, 60-61 activating IPSec security associations, 71-74 Default Preshared Key option, 62 Mode Configuration option, 63

Client Config tab (Configuration Base Group screen) parameters, 63-67 General tab (Configuration Base Group screen) parameters, 58-60 Group Client FW tab (Configuration Base Group screen) parameters, 67 HW Client tab (Configuration Base Group screen) parameters, 67 IPSec tab (Configuration Base Group screen) parameters, 60-63 PPTP/L2TP tab (Configuration Base Group screen) parameters, 67-68 concentrator redundancy, 115


391

392 configuring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . individual group parameters, 68

VPN 3002 Hardware Client, 196

Group Identity tab (Configuration User Management Group screen) parameters, 69

digital certificates, 200

Inherit check boxes (Configuration User Management Group screen), 70

IPSec over TCP, 200

HTTPS management, 197 IPSec connections, 199

IPSec over UDP, 200 modifying private interfaces, 198

IPSec over UDP NAT Transparency, 126

modifying public interfaces, 199

LAN-to-LAN tunnels, 127, 130

PAT for IPSec, 201

NAT Transparencies, 200


peer idle timeouts, 204

filters, 129

preshared keys, 200

Network Autodiscovery, 129

quick configuring, 197-202

preshared keys, 128

time/date values, 198

RRI, 129 load balancing, 118-119

uploading saved configurations, 198

NAT-T Transparency, 126

user accounts, 201

RRI, 117

VPN 3000 Concentrator hardware Client parameters, 203

TCP over UDP NAT Transparency, 126 VPN 3000 Concentrator

VPN Unity Client, 225-227 dead peer detection, 223

IKE negotiations, 52

IP addresses, 222

IP addresses, 52

IPSec over TCP, 223

private Ethernet interfaces, 50-51

IPSec over UDP, 223


preshared keys, 222

SSL certificates, 50 tunneling protocols, 51 user authentication, 52-53 VPN 3000 Concentrator Manager, 50-51 Web interface, 50


connecting VPN tunnels, VPN Unity Client, 227-229 connection notifications (VPN Unity Clients), 229 Connections tab (Properties screen), 224-226 CPP (Central Protection Policy), 109, 144, 149-150

393 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .digital . . . certificates . . . . . . Create Shortcut option (Options menu), 226 CRL (certificate revocation lists), 91, 97

link speeds, 122 network lists, 74

CRSHDUMP.TXT files, 174

peer idle timeouts, VPN 3002 Hardware Client configurations, 204

customizing

preshared keys, 62 rules, 108, 111

firewalls, 146 IKE proposals, 72-73

IP addresses, 110 port ranges, 110

D data encryption, IPSec, 13 encryption algorithms, 16-17 encryption keys, 14 data encryption standard encryption algorithm. See DES encryption algorithm

protocols, 109 TCP ports, 110 UDP ports, 110 SEP card assignments, 59 VPN, 8 deleting user passwords, 226

data integrity, IPSec, 17

DES (data encryption standard) encryption algorithm, 16

Data Lifetime parameter (IKE Proposal screen), 73

DHCP

Dead Peer Detection. See DPD debugging events, 176 default gateway routes, 113 Default Preshared Key option (IPSec tab), 62 defining AAA servers, 69 administrator accounts, 171 aggregate bandwidth, 123 bandwidth management policies, 120-121 base group parameters via VPN 3000 Concentrator, 56-57 base group tunneling protocols, 59

relays, 114 servers, 114 Dial-Up tab (VPN Unity Client 4.0), 238 dialog boxes. See also individual dialog box entries Diffie-Hellman Group parameter (IKE Proposal screen), 72 Diffie-Hellman key exchanges (symmetric encryption keys), 14-15 Digital Certificate drop-down box (IKE Negotiation fields), 128 digital certificates, 86 authentication, applying for, 98 CA, 87-88

filters, 111

central CA structures, 89

IPSec, 13

CRL, 91, 97


394 digital certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . private keys, 89 RA, 90 root CA servers, 89-91 subordinate CA servers, 89-91 tiered hierarchy CA structures, 89 Certificate Manager (VPN Unity Client), 235

Protocol drop-down box (Rules Definition screen), 109 Role drop-down box (Redundancy Configuration screen), 115 DSA (digital signature algorithm), 18 DUN (Dial-Up Networking), 225 dynamic routing protocols, 113-114

E

encoding formats, 92 LAN-to-LAN tunnel configurations, 128

ECC (Elliptical Curve Cryptography) encryption algorithm, 17

managing, 97

Enable screen (VPN 3000 Concentrator), 165

MD5 Fingerprint field, 86 PKI, 89 public keys, 86 Subject field, 86 validating, 91 VPN 3002 Hardware Client configurations, 200 managing in, 207

enabling NAT rules, 125 Encapsulating Security Payload protocol. See ESP protocol encrypted traffic (IPSec), 22 Encryption Algorithm parameter (IKE Proposal screen), 72 encryption algorithms 3DES, 16

VPN Unity Client, 224

AES, 16

X.509v3, 87

DES, 16

digital signature algorithm. See DSA

ECC, 17

disconnecting VPN tunnels, VPN Unity Client, 235

RSA, 17

downloading identity certificates, 95 DPD (Dead Peer Detection), 61, 223 drag-and-drop questions (exams), 4 drop-down boxes. See also individual drop-down box entries Action drop-down box (Rules Definition screen), 109 Digital Certificate drop-down box (IKE Negotiation fields), 128

encryption keys, 14 asymmetric encryption keys, 14 symmetric encryption keys, 14-15 Enhanced SEP (SEP-E), VPN 3000 Concentrators, 33-34 enterprise CA structures. See tiered hierarchy CA structures ESP (Encapsulating Security Payload) protocol, 19-20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . fields . . . ESP Cisco CVPN 3002-8E Hardware Client, 33

external filters, 108 EzVPN (Easy VPN), 11

ESP Cisco VPN 3005 Concentrator, 33

F

established TCP sessions, 109 Ethernet interfaces, VPN 3000 Concentrator configuration, 50-51 event classes, 176-177 event logs, 176, 208 events debugging events, 176 packet decoding hex dumps, 176 severity levels, 176 sorting, 177 Events screen (VPN 3000 Concentrator), 176

fault tolerance, 36 fields. See also individual field entries Backup VPN Easy Servers field (VPN 3002 Hardware Client), 203 Group Name field (Quick Configuration User Database screen), 53 Issuer field (certificate authorities), 95 MD5 Fingerprint field (digital certificates), 86 NAT Assigned IP Address field, 119 OU field (PKCS#10 requests), 93

exams

authorized materials, 3

Password field (Quick Configuration User Database screen), 53

check boxes, 4

Policy from Server, 147

layout of

Public Key field (identity certificates), 94

answer strategies, 4-5

configuration simulation questions, 4 drag-and-drop questions, 4 multiple-choice questions, 3 preparation for, 2, 5-6

Serial Number field (certificate authorities), 94 Signature Algorithm field (certificate authorities), 95

radio buttons, 3

Subject Alternative Name field (PKCS#10 requests), 94

readiness, assessing, 2

Subject field

requirements, 2-3


testing center, 2-3

identity certificates, 94

time limits, 3 time management, 3 Extended Authentication (XAUTH), 52, 62

Valid From/Valid To field (certificate authorities), 95 Verify field (Quick Configuration User Database screen), 54


395

396 File Management screens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . File Management screens (VPN 3002 Hardware Client Manager), 207 files

rules defining, 108-111 processing, 112

CONFIG files, 174 CONFIG.BAK files, 174-175

Firewall Filter for VPN Client, 109, 147

CRSHDUMP.TXT files, 174

Firewall tab

managing, 173

Status screen, 233-235

oem.ini files, VPN Unity Client automatic silent mode installation, 221

VPN Unity Client 4.0, 238

pcf files, 226, 230 PKCS0003 files, 174 SAVELOG.TXT files, 174 swaps, 175 vpnclient.ini file Client auto-initiation, 230 VPN Unity Client 4.0 features, 238-240 Filter Definition screen (VPN 3000 Concentrator), 111 Filter Modification screen (VPN 3000 Concentrator), 111 Filterable Event Log screen (VPN 3000 Concentrator), 177 filters

firewalls, 232 AYT messages, 143, 149 BlackICE Defender/Agent, 146 CIC, 143, 146 CIC firewalls, 227 Cisco Concentrator, 146 CPP, 144, 149-150 CPP firewalls, 109 Firewall Filter for VPN Client, 147 IS, 144 optional firewall option (Client connections), 143-145 parameters, 145 PIX firewalls, 11 required firewall option (Client connections), 143-145

defining, 111

rules, 234-235

event filters, 177

scenarios

external filters, 108

AYT policy scenario, 149

Firewall Filter for VPN Client, 109, 147

CPP firewall scenario, 149-150

forward statements, 112 LAN-to-LAN tunnels, 129 private filters, 108 public filters, 108

no firewall policy scenario, 148 split tunneling, 142 stateful inspections, 145 Sygate Personal Firewall, 146 Sygate Personal Firewall Pro, 146

397 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Hardware . . . . . Client . . . unity Client firewall warning messages, 143 vendor support, 145-147 VPN tunnels, disconnecting, 235 ZoneAlarm, 146 ZoneAlarm Pro, 146 Flash memory, 173-174 Force Network Login feature (VPN Unity Client 4.0), 240 forward statements (filters), 112 fragmented packets, 112 FTP proxy functions, 124

H H.323 support, 194 Hardware Client accessing, 196, 207 Backup VPN Easy Servers field, 203 Client mode, 192-193 configuring, 196, 203 digital certificates, 200 HTTPS management, 197 IPSec connections, 199 IPSec over TCP, 200

G General tab Configuration Base Group screen, 58-60

IPSec over UDP, 200 modifying private interfaces, 198 modifying public interfaces, 199 NAT Transparencies, 200

Properties screen, 223

PAT for IPSec, 201

Status screen, 231-232


Generate Hold Down Routes button (Hold Down Routes section), 117 Group Client FW tab (Configuration Base Group screen), 67 Group Definition screen (VPN 3000 Concentrator), 70-71 Group Identity tab (Configuration User Management Group screen), 69

preshared keys, 200 quick configuring, 197-202 time/date values, 198 uploading saved configurations, 198 user accounts, 201 VPN 3000 Concentrator hardware Client parameters, 203

Group Name field (Quick Configuration User Database screen), 53

digital certificates, managing, 207

group preshared keys, 18

Hardware Client Screen, 204

Group pull-down menu (Administer Sessions screen), 161

Individual User Authentication, 195, 206

event logs, displaying, 208

Interactive Hardware Client Authentication, 195


398 Hardware Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Interactive Login display screen, 205 interactive tunnel authentication, 205

Help, online resources, 6 HMAC (hashed message authentication code), 17

IPSec screen, 203

Hold Down Routes section (Reverse Route Injection screen), 117

monitoring, 208-209

hostnames, ping utility, 169

Network Extension mode, 194, 199-201

HW Client tab

Quick Configuration setup dialog box, 196-197, 201-202

Configuration Base Group screen, 67 VPN 3000 Concentrator, 203

rebooting, 207

I

resetting, 207 routing tables, displaying, 208 updating, 164-165, 208 Hardware Client login screen (VPN 3002 Hardware Client Manager), 197 Hardware Client Manager Access Rights screens, 207 accessing, 197 administration, 206-208 File Management screens, 207 Hardware Client login screen, 197 IPSec Quick Configuration screen, 199-200 Monitoring screen, 208 NAT Statistics screen, 208 Private Interface Quick Configuration screen, 198 Public Interface Quick Configuration screen, 199 System Status screen, 209 Hardware Client Manager screen (VPN 3002 Hardware Client), 204

icons Refresh icon (Administer Sessions screen), 160 Reset icon (Administer Sessions screen), 160 VPN Dialer icon (VPN Unity Client), 222 identity certificates, 89, 92 downloading, 95 passwords, 95 Public Key field, 94 Subject field, 94 IKE (Internet Key Exchange) protocol, 20 Phase 1 operation, 21 Phase 2 operation, 22 SA, 21-22 VPN 3000 Concentrator configuration, 52 IKE Negotiation fields LAN-to-LAN Configuration screen, 128 VPN 3000 Concentrator, 128

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .IPSec . . . IKE Proposal Certificate screen (VPN 3000 Concentrator), 98 IKE Proposal screen (VPN 3000 Concentrator), 72-73 IKE security associations, activating, 71-74 implementing bandwidth policies, 180 individual groups configuring, 68 Group Identity tab (Configuration User Management Group screen) parameters, 69 Inherit check boxes (Configuration User Management Group screen), 70 versus basic groups, 68 Individual User Authentication (VPN 3002 Hardware Client), 195, 206 Individual User Authentication screens (VPN 3002 Hardware Client Manager), 206 Individual User Login screen (VPN Unity Client), 228 Inherit check boxes (Configuration User Management Group screen), 70 installing VPN Unity Client, 220-221 Interactive Hardware Client Authentication (VPN 3002 Hardware Client), 195 Interactive Login display screens (VPN 3002 Hardware Client Manager), 205 interactive tunnel authentication (VPN 3002 Hardware Client), 205 interesting traffic (IPSec), 21

interfaces Ethernet interfaces, 50-51 Web interface, 50 Internet Key Exchange (IKE) protocol, 20 Phase 1 operation, 21 Phase 2 operation, 22 SA, 21-22 IOS VPN routers, 10-11 IP addresses basic group compression, 62 rules, defining, 110 translating, NAT rules, 124 VPN 3000 Concentrator configuration, 52 VPN Unity Client configuration, 222 IP Routing screen (VPN 3000 Concentrator), 113 IPSec, 12, 20 anti-replay protection, 19 authentication, 17-19 data encryption, 13 encryption algorithms, 16-17 encryption keys, 14 data integrity, 17 defining, 13 encrypted traffic, 22 interesting traffic, 21 protocol framework AH protocol, 19-20 ESP protocol, 19-20 IKE protocol, 20-22 SA, 21-22


399

400 IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . remote access, 48-49, 61 security associations, activating, 71-74 tunnel termination, 22 VPN 3002 Hardware Client connections, configuring, 199 IPSec over TCP VPN 3002 Hardware Client configurations, 200 VPN Unity Client configurations, 223 IPSec over UDP VPN 3002 Hardware Client configurations, 200 VPN Unity Client configurations, 223 NAT Transparency, 126 IPSec Quick Configuration screen (VPN 3002 Hardware Client Manager), 199-200 IPSec SA Certificate screen (VPN 3000 Concentrator), 98 IPSec screen (VPN 3002 Hardware Client), 203 IPSec tab (Configuration Base Group screen), 60-61

K-L keys asymmetric encryption keys, 14 encryption keys asymmetric encryption keys, 14 symmetric encryption keys, 14-15 preshared keys defining, 62 group preshared keys, 18 unique preshared keys, 18 VPN 3002 Hardware Client configurations, 200 VPN Unity Client configuration, 222 wildcard preshared keys, 18 secret keys, symmetric key bulk data encryption, 15 symmetric encryption keys key exchanges, Diffie-Hellman key exchanges, 14-15 key exchanges, manual key exchanges, 14 key exchanges, secret keys, 15

Default Preshared Key option, 62 IPSec security associations, activating, 71-74 Mode Configuration option, 63

LAN-to-LAN Configuration screen (VPN 3000 Concentrator)

Reauthentication on Rekey option, 62-63

IKE Negotiation fields, 128

Remote Access option, 62

site-to-site redundancy feature, 127

Peer List field, 128

IS (Integrity Servers), 144

LAN-to-LAN NAT rules, 130

ISP accounts, 171

LAN-to-LAN Rules Add screen (VPN 3000 Concentrator), 130

Issuer field (certificate authorities), 95

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . menus . . . . LAN-to-LAN session redundancy, 115 LAN-to-LAN Sessions table (Administer Sessions screen), 161 LAN-to-LAN tunnels, configuring. 127, 130 digital certificates, 128 filters, 129 Network Autodiscovery, 129 preshared keys, 128 RRI, 129 LEAP (Lightweight Extensible Authentication Protocol), 204 LED statistics, monitoring, 179 Lempel-Ziv, 62, 232 level 3 protocols, specifying, 109 level 4 protocols, specifying, 109 Lifetime Measurement parameter (IKE Proposal screen), 73

M Management Sessions table (Administer Sessions screen), 161 Manager toolbar (VPN 3000 Concentrator Manager), 55 managing bandwidth, 37, 120-121 digital certificates, 97 files, 173 firewalls AYT messages, 143, 149 CPP, 144, 149-150 IS, 144 stateful inspections, 145 time (exams), 3 VPN 3000 Concentrator, 172 VPN 3002 Hardware Client

link speeds, defining, 122

access, 207

Live Event Log screen (VPN 3000 Concentrator), 178


load balancing

manual enrollment process (CA), 92-95

configuring, 118-119

manual key exchanges (symmetric encryption keys), 14

redundancy, 115

MD5 (Message Digest 5), 17

VCA protocol, 118-119

MD5 Fingerprint field (digital certificates), 86

versus redundancy, 118 VPN 3000 Concentrators, 37 Local LAN Routes section (Statistics tab), 233 Log Viewer utility (VPN Unity Client), 235 login banner messages (VPN Unity Clients), 228 logins, passwords, 58

Medium ROBO VPN 3000 Concentrators, 34 Memory, monitoring, 178 menus Administration menus (VPN 3000 Concentrator Manager), 357 Configuration menus (VPN 3000 Concentrator Manager), 351-356


401

402 menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Group pull-down menu (Administer Sessions screen), 161 Monitoring menus (VPN 3000 Concentrator Manager), 358 Options menu (VPN Unity Client), 226-227 Message Digest 5 (MD5), 17 MIB-II Statistics screen (VPN 3000 Concentrator), 180-181 mis accounts, 171

N NAT Assigned IP Address field, 119 NAT Enable screen (VPN 3000 Concentrator), 125, 131 NAT Interface Rules screen (VPN 3000 Concentrator), 124 NAT rules, 124 enabling, 125 LAN-to-LAN NAT rules, 130

Mode Config tab. See Client Config tab

NAT Statistics screen (VPN 3002 Hardware Client Manager), 208

Mode Configuration option (IPSec tab), 63

NAT Transparencies, 64, 125, 232

modifying VPN 3002 Hardware Client private interfaces, 198 public interfaces, 199 Monitor Refresh screen (VPN 3000 Concentrator), 169 monitoring LED statistics, 179 Memory, System Status screen, 178 sessions, 179-180 VPN 3000 Concentrator, 179-180 VPN 3002 Hardware Client, 208-209 Monitoring menus (VPN 3000 Concentrator Manager), 358 Monitoring screen (VPN 3002 Hardware Client Manager), 208 Monitoring section (VPN 3000 Concentrator Manager), 55 Monitoring Statistics screen (VPN 3000 Concentrator), 180-181 Movian Client, 12 multiple-choice questions (exams), 3

IPSec over UDP configuration, 126 NAT-T configuration, 126 TCP over UDP configuration, 126 VPN 3002 Hardware Client configurations, 200 VPN Unity Client configurations, 223 NAT Transparency screen (VPN 3000 Concentrator), 126 NAT-T (NAT Traversal), 125-126 navigating VPN 3000 Concentrator Manager, 55-56 Navigation toolbar (VPN 3000 Concentrator Manager), 55 Network Autodiscovery, 129 Network Extension mode (VPN 3002 Hardware Client), 194, 199-201 Network Extension RRI, 117 network lists, defining, 74 New Connection Entry Wizard, 222 New or Modify connection entry configuration window (VPN Unity Client 4.0), 237

403 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Peer . . List . . .field . .

O-P oem.ini files (VPN Unity Client), 221 Only Tunnel Networks in List option (Client Config tab), 66 optional firewalls, Client connections, 143-145 Options menu (VPN Unity Client) Automatic VPN Initiation option, 227

Data Lifetime parameter (IKE Proposal screen), 73 Diffie-Hellman Group parameter (IKE Proposal screen), 72 Encryption Algorithm parameter (IKE Proposal screen), 72 firewall parameters, 145 individual group parameters, configuring, 68-69

Create Shortcut option, 226

Lifetime Measurement parameter (IKE Proposal screen), 73

Windows Logon Properties option, 227

Proposal Name parameter (IKE Proposal screen), 72

Originate-Only in the Connection Type pull-down menu (Peer List field), 128 OSPF dynamic routing protocol, 113-114 OU (Organizational Unit) field (PKCS#10 requests), 93

Time Lifetime parameter (IKE Proposal screen), 73 VPN 3000 Concentrator parameters, 203 Password field (Quick Configuration User Database screen), 53 passwords, 58 identity certificates, 95

packets

user passwords, deleting, 226

decoding hex dumps, 176 duplication, IPSec anti-replay protection, 19 fragmented packets, 112 routing, 112-113 source-routed packets, 112 parameters Authentication Algorithm parameter (IKE Proposal screen), 72 Authentication Mode parameter (IKE Proposal screen), 72 base group parameters configuring, 58-68 defining via VPN 3000 Concentrator, 56-57

VPN 3000 Concentrator, 49 PAT for IPSec, VPN 3002 Hardware Client configurations, 201 PAT mode. See Client mode pcf files, 226, 230 peer authentication (IPSec), 17 DSA, 18 preshared keys, 18 RSA Digital Signatures, 18 RSA encrypted nonces, 19 peer idle timeouts, VPN 3002 Hardware Client configurations, 204 Peer List field (LAN-to-LAN Configuration screen), 128


404 Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Perfect Forward Secrecy (PFS), 74

prioritizing AAA servers, 69

Permissions (user accounts), changing, 171

Private Address fields (NAT Interface Rules screen), 124

PFS (Perfect Forward Secrecy), 74

private filters, 108

Ping screen (VPN 3000 Concentrator), 168

Private Interface Quick Configuration screen (VPN 3002 Hardware Client Manager), 198

ping utility, 169 PIX firewalls, 11 PKCS#10 enrollment screen (VPN 3000 Concentrator), 94 PKCS#10 requests, 92 Certificate Manager (VPN unity Client), 235 OU field, 93 Subject Alternative Name field, 94 PKCS#7 message syntax, 95 PKCS0003.TXT files, 174 PKI (public key infrastructures), 89 Policy from Server field, 147 port ranges, defining, 110 PPTP/L2TP tab (Configuration Base Group screen), 67-68

private keys, CA, 89 processing rules, 112 Properties screen (VPN Unity Client) Authentication tab, 224-225 Connections tab, 224-226 General tab, 223 Proposal Name parameter (IKE Proposal screen), 72 Protocol drop-down box (Rules Definition screen), 109 protocols AH protocol, 19-20 ESP protocol, 19-20 IKE protocol, 20 phase 1 operation, 21

practice exams, 254-280

phase 2 operation, 22

preparing for exams, 2, 5-6

SA, 21-22

preshared keys

LEAP, 204

defining, 62

level 3 protocols, specifying, 109

group preshared keys, 18

level 4 protocols, specifying, 109

LAN-to-LAN tunnel configurations, 128

OSPF dynamic routing protocol, 113-114

unique preshared keys, 18

RIP dynamic routing protocol, 113-114

VPN 3002 Hardware Client configurations, 200 VPN Unity Client configuration, 222 wildcard preshared keys, 18

rules, defining, 109 SCEP, automated CA enrollment, 96

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .redundancy . . . . . . tunneling protocols changing, 160 defining in base groups, 59 IPSec, 13, 19-22 IPSec, anti-replay protection, 19

Q-R questions (exams) answer strategies, 4-5 formats

IPSec, authentication, 17-19

configuration simulation questions, 4

IPSec, data encryption, 13-17

drag-and-drop questions, 4

IPSec, data integrity, 17

multiple-choice questions, 3

L2TP tunneling protocol parameters, 68

Quick Configuration setup dialog box, 49-50, 54, 196-197, 201-202

pinging endpoints, 169

Quick Configuration User Database screen, 53-54

PPTP tunneling protocol parameters, 68 VPN 3000 Concentrator configuration, 51 VCA protocol, 37, 118-119

quick configuring VPN 3000 Concentrator, 49-54 VPN 3002 Hardware Client, 197-202

VRRP, 114-115, 127 public filters, 108

RA (Registration Authorities), 90

Public Interface Quick Configuration screen (VPN 3002 Hardware Client Manager), 199

radio buttons (exams), 3

Public Key field (identity certificates), 94 public keys digital certificates, 86 identity certificates, 89 pull-down menus Group pull-down menu (Administer Sessions Screen), 161 Originate-Only in the Connection Type pull-down menu (Peer List field), 128

Reauthentication on Rekey option (IPSec tab), 62-63 Reboot Ignoring the Configuration File option (System Reboot screen), 168 Reboot Without Saving the Active Configuration option (System Reboot screen), 168 rebooting scheduling, 167-168 VPN 3002 Hardware Client, 207 redundancy configuring, 115 LAN-to-LAN sessions, 115 load balancing, 115


405

406 redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SEP redundancy, 36 site-to-site redundancy, 127 versus load balancing, 118 VPN 3000 Concentrator redundancy, 36 VRRP, 114-115 Redundancy Configuration screen (VPN 3000 Concentrator), 115

Role drop-down box (Redundancy Configuration screen), 115 root CA servers, 89-91 Route Details tab (VPN Unity Client 4.0), 238 routing dynamic routing protocols, 113-114 packets default gateway routes, 113

Refresh icon (Administer Sessions screen), 160

source-routed packets, 112

refreshing VPN 3000 Concentrator, 169 remote access IPSec, 48-49, 61 restricting, 75 VPN, 9 Remote Access option (IPSec tab), 62 Remote Access Sessions table (Administer Sessions screen), 161 required firewalls, Client connections, 143-145 Reset icon (Administer Sessions screen), 160 resetting VPN 3002 Hardware Client, 207 restricting remote access, 75 Reverse Load Balancing Configuration screen (VPN 3000 Concentrator), 118-119 Reverse Route Injection screen (VPN 3000 Concentrator), 117 revoking certificates, 91, 97

static routes, 113 RRI, 116-117, 129 Routing table screen (VPN 3000 Concentrator), 176 routing tables, 176, 208 RRI (reverse route injection), 116-117, 129 RSA Digital Signatures, 18 RSA encrypted nonces, 19 RSA encryption algorithm, 17 rules defining, 108-111 NAT rules, 124 enabling, 125 LAN-to-LAN NAT rules, 130 processing, 112 Rules Definition screen (VPN 3000 Concentrator), 109-111

S

RIP dynamic routing protocol, 113-114, 129

SA (security associations), 21-22

ROBO VPN 3000 Concentrators, 33-34

SCEP (Simple Certificate Enrollment Protocol), 96

SAVELOG.TXT files, 174

407 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .security . . . . certificates . . . . . . SCEP certificate enrollment screen (VPN 3000 Concentrator), 96 scheduling system reboots, 168 secret keys, symmetric key bulk data encryption, 15 Secure VPN Client. See VPN Unity Client

vendor support, 145-147 ZoneAlarm, 146 ZoneAlarm Pro, 146 identity certificates, 95 passwords, 58, 226 remote access, restricting, 75

Secured Routes section (Statistics tab), 233

split tunneling, 142

security

VPN

firewalls, 145, 232

VCA protocol, 118

AYT messages, 143, 149

business-to-business extranet VPN, 9-11

AYT policy scenario, 149

defining, 8

BlackICE Defender/Agent, 146

IOS VPN routers, 10-11

CIC, 143, 146

IPSec Client, 12

CIC firewalls, 227

IPSec tunneling protocol, 13, 19-22

Cisco Concentrator, 146 CPP, 144, 149-150 CPP firewall scenario, 149-150

IPSec tunneling protocol, antireplay protection, 19

disconnecting VPN tunnels, 235

IPSec tunneling protocol, authentication, 17-19

Firewall Filter for VPN Client, 147

IPSec tunneling protocol, data encryption, 13-17

IS, 144

IPSec tunneling protocol, data integrity, 17

no firewall policy scenario, 148 optional firewall option, 143-145 required firewall option, 143-145 rules, 234-235 split tunneling, 142 stateful inspections, 145

PIX firewalls, 11 remote access VPN, 9 site-to-site intranet VPN, 9-11 VPN 3000 Concentrators, 11-12, 33-37, 49

Sygate Personal Firewall, 146

VPN Hardware Client, 12, 32-33

Sygate Personal Firewall Pro, 146

VPN Software Client, 12

unity Client firewall warning messages, 143

security certificates, VPN 3000 Concentrator configuration, 50


408 SEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SEP (Scalable Encryption Processing), 33-35 card assignments, defining, 59 redundancy, 36 SEP-E (Enhanced SEP), 33-34 Serial Number field (certificate authorities), 94 servers AAA servers, 69 DHCP servers, 114 root CA servers, 89-91 subordinate CA servers, 89-91 TACACS+ server, 172 Session Summary table (Administer Sessions screen), 161 sessions, monitoring, 179-180

site-to-site tunnel redundancy, 127 Small ROBO VPN 3000 Concentrators Cisco VPN 3015 Concentrator, 34 ESP Cisco VPN 3005 Concentrator, 33 software Clients, updating, 165 update notification messages, 164 SOHO Cisco VPN 3002 Hardware Client, 32 sorting events, 177 source-routed packets, 112 split tunneling, 65-66, 232 firewall rules, 235 security, 142

Sessions screen (VPN 3000 Concentrator), 179

SSL certificates, VPN 3000 Concentrator configuration, 50

Set MTU utility (VPN Unity Client), 235

stand-alone CA structures. See central CA structures

SHA-1 (Secure Hash Algorithm-1), 17

stateful inspections, 145

Shutdown Without Automatic Reboot option (System Reboot screen), 167

static routes, 113

Signature Algorithm field (certificate authorities), 95 silent mode installation (VPN Unity Client), 221 Simple View feature (VPN Unity Client 4.0), 240 simulations, configuration simulation questions (exams), 4 site-to-site intranet VPN, 9 IOS VPN routers, 10-11 PIX firewalls, 11 site-to-site redundancy feature (LANto-LAN Configuration screen), 127

Statistics screen (VPN Unity Client 4.0), 238 Statistics tab (Status screen), 232-233 Status screen (VPN Unity Client) Firewall tab, 233-235 General tab, 231-232 Statistics tab, 232-233 Subject Alternative Name field (PKCS#10 requests), 94 Subject field digital certificates, 86 identity certificates, 94

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .tabs . . subordinate CA servers, 89-91 Swap Configuration Files screen (VPN 3000 Concentrator), 175 swapping files, 175 switching between Administer Sessions screen tables, 161 Sygate Personal Firewall, 146 Sygate Personal Firewall Pro, 146 symmetric encryption keys (key exchanges)

tabs Authentication tab Properties screen, 224-225 VPN Unity Client 4.0, 237 Backup Servers tab (VPN Unity Client 4.0), 238 Client Config tab Configuration Base Group screen, 63-67 VPN 3000 Concentrator, 228

Diffie-Hellman key exchanges, 14-15

Client FW Configuration tab, 145

manual key exchanges, 14

Connections tab (Properties screen), 224-226

secret keys, 15 System Reboot screen (VPN 3000 Concentrator), 167-168 system reboots, 167-168 System Status screen VPN 3000 Concentrator, 178 VPN 3002 Hardware Client Manager, 209

T tables

Dial-Up tab (VPN Unity Client 4.0), 238 Firewall tab Status screen, 233-235 VPN Unity Client 4.0, 238 General tab Configuration Base Group screen, 58-60 Properties screen, 223 Status screen, 231-232

Administer Sessions screen tables, switching between, 161

Group Client FW tab (Configuration Base Group screen), 67

LAN-to-LAN Sessions table (Administer Sessions screen), 161

Group Identity tab (Configuration User Management screen), 69

Management Sessions table (Administer Sessions screen), 161

HW Client tab

Remote Access Sessions table (Administer Sessions screen), 161

Configuration Base Group screen, 67 VPN 3000 Concentrator, 203

routing tables, 176, 208 Session Summary table (Administer Sessions screen), 161


409

410 tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IPSec tab (Configuration Base Group screen), 60-61 activating IPSec security associations, 71-74 Default Preshared Key option, 62 Mode Configuration option, 63 Reauthentication on Rekey option, 62-63 Remote Access option, 62 PPTP/L2TP tab (Configuration Base Group screen), 67-68 Route Details tab (VPN Unity Client 4.0), 238 Statistics tab (Status screen), 232-233 Transport tab (VPN Unity Client 4.0), 238 Tunnel Details tab (VPN Unity Client 4.0), 238 User Identity tab (Group Definition screen), 70-71 VPN Unity Client 4.0 tabs, 237 TACACS+, 171-172 TCP established TCP sessions, 109 port mapping, FTP proxy functions, 124 rules, defining, 110 TCP over UDP NAT Transparency, 126 testing center, 2-3 tests. See exams tiered hierarchy CA structures, 89 Time Lifetime parameter (IKE Proposal screen), 73

time management (exams), 3 toolbars Manager toolbar (VPN 3000 Concentrator Manager), 55 Navigation toolbar (VPN 3000 Concentrator Manager), 55 Top Ten Lists subscreens (Sessions Screen), 179 traffic policing (bandwidth management policies), 120 transform sets, 22 translating IP addresses, NAT rules, 124 transparent tunneling, 223, 231 Transport tab (VPN Unity Client 4.0), 238 troubleshooting VPN 3000 Concentrator, 175-178 Tunnel Details tab (VPN Unity Client 4.0), 238 Tunnel mode. See Network Extension mode tunnel termination (IPSec), 22 tunneling LAN-to-LAN tunnels, configuring, 127-130 split tunneling, 232, 235 transparent tunneling, 231 tunneling protocols base group tunneling protocols, defining, 59 endpoints, ping utility, 169 IPSec AH protocol, 19-20 anti-replay protection, 19 authentication, 17-19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Unity . . . Client . . . 4.0 . . data encryption, 13-17


data integrity, 17

DUN, 225

defining, 13

Individual User Login screen, 228

encrypted traffic, 22

installing, 220-221

ESP protocol, 19-20

Log Viewer utility, 235

IKE protocol, 20-22

login banner messages, 228

interesting traffic, 21

Options menu, 226-227

logging in/out after changes, 160

Properties screen

SA, 21-22

Authentication tab, 224-225

tunnel termination, 22

Connections tab, 224-226

L2TP tunneling protocol parameters, 68 PPTP tunneling protocol parameters, 68 VPN 3000 Concentrator configuration, 51

General tab, 223 Set MTU utility, 235 Status screen Firewall tab, 233-235 General tab, 231-232 Statistics tab, 232-233

U

transparent tunneling, 223

UDP rules, defining, 110

VPN Dialer icon, 222

unique preshared keys, 18

VPN tunnels

Unity Client Auto-Initiation feature, 229-230 automatic silent mode installation, 221 Certificate Manager, PKCS#10 requests, 235 CIC firewalls, 227 configuring, 224-227 IP addresses, 222 IPSec over TCP, 223 IPSec over UDP, 223 NAT Transparencies, 223 preshared keys, 222

connecting, 227-229 disconnecting, 235 Windows platform installation, 221 Unity Client 4.0, 236 Advanced View feature, 240 Authentication tab, 237 Backup Servers tab, 238 Dial-Up tab, 238 Firewall tab, 238 Force Network Login feature, 240 graphical user interface, 237 New or Modify connection entry configuration window, 237

connection notifications, 229 How can we make this index more useful? Email us at [email protected]

411

412 Unity Client 4.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Route Details tab, 238 Simple View feature, 240 Statistics screen, 238 Transport tab, 238

VCA (Virtual Clustering Agent) protocol, 37, 118-119 Verify field (Quick Configuration User Database screen), 54

Tunnel Details tab, 238

Virtual Router Redundancy Protocol (VRRP), 36

VPN Client, 237

VPN (Virtual Private Networks)

vpnclient.ini file, 238-240 unity Client firewall warning messages, 143 Unity Client. See VPN Software Client updating

business-to-business extranet VPN, 9 IOS VPN routers, 10-11 PIX firewalls, 11 connectivity

Clients, 164-165

IOS VPN routers, 10-11

VPN 3000 Concentrator, 162-165

IPSec Client, 12

VPN 3000 Concentrator Clients, 164

PIX firewalls, 11

VPN 3002 Hardware Client, 208

VPN 3000 Concentrator, 11-12, 33-37

Upgrade Clients Now button (Clients screen), 165

VPN Hardware Client, 12, 32-33

uploading saved VPN 3002 Hardware Client configurations, 198

VPN Software Client, 12

user accounts

defining, 8 EzVPN, 11

creating, User Identity tab (Group Definition screen), 70-71 permissions, changing, 171 VPN 3002 Hardware Client configurations, 201 User Identity tab (Group Definition screen), 70-71 user interfaces, VPN Unity Client 4.0 graphical user interface, 237 user passwords, deleting, 226

V Valid From/Valid To field (certificate authorities), 95 validating, digital certificates, 91

remote access VPN, 9 site-to-site intranet VPN, 9 IOS VPN routers, 10-11 PIX firewalls, 11 tunneling protocols, IPSec, 13, 20-22 anti-replay protection, 19 authentication, 17-19 data encryption, 13-17 data integrity, 17 VPN 3000 Concentrator, 11-12 AAA TACACS+ Server screen, 172 Access Control List screen, 172

413 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . VPN . . . 3000 . . . Concentrator . . . . . . . Add or Modify screen, 165

Certificate Manager screen, 97

Administer Sessions screen, 160-162

Client Config tab, 228

Administrators screen, 171

Clients, updating, 164

bandwidth management policies

Clients screen, 165

assigning, 121-123 bandwidth reservation, 120, 123 configuring, 120 defining, 120-121 group selection, 122 traffic policing, 120 Bandwidth Policies Add or Modify screen, 121 base groups configuring, Client Config tab (Configuration Base Group screen) parameters, 63-67 configuring, General tab (Configuration Base Group screen) parameters, 58-60

Configuration Base Group screen, 57 Client Config tab, 63-67 General tab, 58-60 Group Client FW tab, 67 HW Client tab, 67 IPSec tab, 60-63 PPTP/L2TP tab, 67-68 Configuration User Management Group screen Group Identity tab, 69 Inherit check boxes, 70 configuring, 49 IKE negotiations, 52

configuring, Group Client FW tab (Configuration Base Group screen) parameters, 67

IP addresses, 52

configuring, HW Client tab (Configuration Base Group screen) parameters, 67

SSL certificates, 50

configuring, IPSec tab (Configuration Base Group screen) parameters, 60-63

user authentication, 52-53

configuring, PPTP/L2TP tab (Configuration Base Group screen) parameters, 67-68

Web interface, 50

defining parameters, 56-57 CA enrollment automated enrollment process, 96 manual enrollment process, 92-95

private Ethernet interfaces, 50-51

tunneling protocols, 51

VPN 3000 Concentrator Manager, 50-51

DHCP relays, 114 Enable screen, 165 Events screen, 176 Filter Definition Screen, 111 Filter Modification Screen, 111 Filterable Event Log screen, 177


414 VPN 3000 Concentrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . filters external filters, 108 Firewall Filter for VPN Client, 109

Monitoring Statistics screen, 180-181 NAT Enable screen, 125, 131 NAT Interface (Rules screen), 124

private filters, 108

NAT Transparency screen, 126

public filters, 108

packets, routing, 112-113

Group Definition screen, 70-71

passwords, 49

HW Client tab, 203

Ping screen, 168

IKE Proposal Certificate screen, 98

PKCS#10 enrollment screen, 94

IKE Proposal screen, 72-73


individual groups, configuring

rebooting, 167-168

Group Identity tab (Configuration User Management Group screen) parameters, 69 Inherit check boxes (Configuration User Management Group screen) parameters, 70 IP Routing screen, 113

redundancy configuring, 115 versus load balancing, 118 VRRP, 114-115 Redundancy Configuration screen, 115 refreshing, 169

IPSec SA Certificate screen, 98

Reverse Load Balancing Configuration screen, 118-119

LAN-to-LAN Configuration screen

Reverse Route Injection screen, 117

IKE Negotiation fields, 128 Peer List field, 128 site-to-site redundancy feature, 127 LAN-to-LAN Rules Add screen, 130 LAN-to-LAN tunnels, configuring, 127-130 Live Event Log screen, 178 load balancing, 118-119 managing, ACL, 172 Monitor Refresh screen, 169 monitoring, 179-180

routing dynamic routing protocols, 113-114 RRI, 116-117 Routing table screen, 176 Rules Definition Screen, 109-111 SCEP certificate enrollment screen, 96 Sessions screen, 179 Swap Configuration Files screen, 175

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .VPN . . .3002 . . .Hardware . . . . . Client . . . System Reboot screen Reboot Ignoring the Configuration File option, 168 Reboot Without Saving the Active Configuration option, 168 Shutdown Without Automatic Reboot option, 167

redundancy, 36 SEP, 33-36 SEP-E, 33-34 Small ROBO VPN 3000 Concentrators, 33-34 VPN 3015 Concentrator, 34 VPN 3030 Concentrator, 34

System Status screen, 178

VPN 3060 Concentrator, 35

troubleshooting, 175-176

VPN 3080 Concentrator, 35-36

updating, 162-165

VPN 3002 Hardware Client

user accounts, creating, 70-71

accessing, 196, 207

VPN 3002 Hardware Client, configuring, 203

Backup VPN Easy Servers field, 203

VPN 3000 Concentrator Manager, 50-51

Client mode, 192-193 configuring, 196

Administration menus, 357


Administration section, 55

HTTPS management, 197

Configuration menus, 351-356

IPSec connections, 199

Configuration section, 55

IPSec over TCP, 200

Manager toolbar, 55

IPSec over UDP, 200

Monitoring menus, 358

modifying private interfaces, 198

Monitoring section, 55

modifying public interfaces, 199

navigating, 55-56


Navigation bar, 55

PAT for IPSec, 201

VPN 3000 Concentrators


bandwidth management, 37

preshared keys, 200

comparing, 35


ESP Cisco VPN 3005 Concentrator, 33

time/date values, 198

fault tolerance, 36

uploading saved configurations, 198

load balancing, VCA protocol, 37

user accounts, 201

Medium ROBO VPN 3000 Concentrators, 34

VPN 3000 Concentrator hardware Client parameters, 203


415

416 VPN 3002 Hardware Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . digital certificates, managing, 207 event logs, displaying, 208 Hardware Client Manager screen, 204 Individual User Authentication, 195, 206 Interactive Hardware Client Authentication, 195 interactive tunnel authentication, 205 monitoring, 208-209 Network Extension mode, 194, 199-201 Quick Configuration setup dialog box, 196-197, 201-202 rebooting, 207 resetting, 207 routing tables, displaying, 208 updating, 208 VPN 3002 Hardware Client Manager Access Rights screens, 207 accessing, 197 administration, 206-208 File Management screens, 207 Hardware Client login screen, 197 Individual User Authentication screens, 206 Interactive Login display screen, 205 IPSec Quick Configuration screen, 199-200

Public Interface Quick Configuration screen, 199 System Status screen, 209 VPN Client, DHCP relays, 114 VPN Concentrator Client Update Screen, 166 MIB-II Statistics screen, 180-181 VPN Dialer, 237. See also VPN Client VPN Dialer icon (VPN Unity Client), 222 VPN Hardware Client, 12 ESP Cisco CVPN 3002-8E Hardware Client, 33 IPSec screen, 203 SOHO Cisco VPN 3002 Hardware Client, 32 VPN internal server group authentication, 61-62 VPN routers, 10-11 VPN Software Client, 12 VPN tunnels, connecting/disconnecting (VPN Unity Client), 227-229, 235 VPN Unity Client, 220 Certificate Manager, PKCS#10 requests, 235 Client Auto-Initiation feature, 229-230 CIC firewalls, 227 configuring, 222-227 connection notifications, 229

Monitoring screen, 208


NAT Statistics screen, 208

DUN, 225

Private Interface Quick Configuration screen, 198

Individual User Login screen, 228

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ZoneAlarm . . . . . . Pro . . installing, 220-221

Transport tab, 238

Log Viewer utility, 235

Tunnel Details tab, 238

login banner messages, 228

vpnclient.ini file, 238-240

Options menu, 226-227 Properties screen Authentication tab, 224-225 Connections tab, 224-226 General tab, 223 Set MTU utility, 235 Status screen Firewall tab, 233-235

vpnclient.ini file Client auto-initiation, 230 VPN Unity Client 4.0 features, 238-240 VRRP (Virtual Router Redundancy Protocol), 114-115 versus site-to-site redundancy, 127 VPN 3000 Concentrator redundancy, 36

General tab, 231-232

W-X-Y-Z

Statistics tab, 232-233 transparent tunneling, 223 VPN Dialer icon, 222

Web interface, VPN 3000 Concentrator configuration, 50

VPN tunnels

Windows

connecting, 227-229

DUN, VPN Unity Client, 225

disconnecting, 235

VPN Unity Client installation, 221

VPN Unity Client 4.0 Advanced View feature, 240

Windows Logon Properties option (Options menu), 227

Authentication tab, 237 Backup Servers tab, 238 Dial-Up tab, 238 Firewall tab, 238

X.509v3 digital certificates, 87 XAUTH (Extended Authentication), 52, 62

Force Network Login feature, 240 graphical user interface, 237

Zone Labs Integrity Servers (IS), 144

New or Modify connection entry configuration window, 237

ZoneAlarm (Zone Labs), 146

Route Details tab, 238

ZoneAlarm Pro (Zone Labs), 146

Simple View feature, 240 Statistics screen, 238


417

CCSP CSVPN Exam Cram 2 (Exam Cram 642-511)

CCSP CSVPN Exam Cram 2 (Exam Cram 642-511)

CSVPN Exam Cram 2 (Exam 642-511)

CSIDS Exam Cram 2

SECUR Exam Cram 2

RFID+ Exam Cram 2

PMP Exam Cram 2

ICDL Exam Cram 2

CISSP Exam Cram 2

Network+ Exam Cram 2

Exam Cram 2: CISA

Cisco BSCI Exam Cram 2 (Exam Cram 642-801)

Network+ Exam Cram 2 (Exam Cram N10-002)

CCNP BCRAN Exam Cram 2 (Exam Cram 642-821)

A+ Exam Cram 2 (Exam Cram 220-221, Exam Cram 220-222)

CSPFA Exam Cram 2 (Exam 642-521)

CSI Exam Cram 2 (Exam 642-541)

CCNP BCMSN Exam Cram 2

CISA Exam Cram

CISSP Exam Cram

MCSE Windows 2000 Active Directory Services Infrastructure Exam Cram 2 (Exam 70-217) (Exam Cram)

CCNA Exam Cram (Exam 640-802)

CCENT Exam Cram. Exam 640-822

Java 2 Programmer Exam Cram 2 (Exam CX-310-035)

A+ Certification Practice Questions Exam Cram 2 (Exams : 220-301, 220-302) (Exam Cram 2)

Network+ Certification Practice Questions Exam Cram 2 (Exam N10-003)

Oracle 9i Fundamentals I Exam Cram 2

CCNP CIT Exam Cram 2 (642-831)

Security+ Exam Cram 2 Lab Manual

PMP Exam Cram 2: Project Management Professional

Java 2 Enterprise Edition (J2EE) Web Component Developer Exam Cram 2 (Exam Cram 310-080)

CCSP CSVPN Exam Cram 2 (Exam Cram 642-511)