Cisco Press 201 West 103rd Street Indianapolis, IN 46290 USA Cisco Press CCSP Self-Study CCSP Cisco Secure VPN Exam Certification Guide John F. Roland Mark J. Newcomb CCSP.book Page i Friday, February 28, 2003 3:43 PM ii CCSP Self-Study CCSP Cisco Secure VPN Exam Certification Guide John F. Roland and Mark J. Newcomb Copyright © 2003 Cisco Systems, Inc. Published by: Cisco Press 201 West 103rd Street Indianapolis, IN 46290 USA All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 First Printing April 2003 Library of Congress Cataloging-in-Publication Number: 2002108141 ISBN: 1-58720-070-8 Warning and Disclaimer This book is designed to provide information about selected topics for the CCSP Cisco Secure VPN exam. Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc., shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it. The opinions expressed in this book belong to the authors and are not necessarily those of Cisco Systems, Inc. Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of members from the professional technical community. Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through e-mail at feedback@ciscopress.com. Please make sure to include the book title and ISBN in your message. We greatly appreciate your assistance. CCSP.book Page ii Friday, February 28, 2003 3:43 PM iii Publisher John Wait Editor-In-Chief John Kane Cisco Representative Anthony Wolfenden Cisco Press Program Manager Sonia Torres Chavez Manager, Marketing Communications, Cisco Systems Scott Miller Cisco Marketing Program Manager Edie Quiroz Executive Editor Brett Bartow Acquisitions Editor Michelle Grandin Production Manager Patrick Kanouse Development Editor Dayna Isley Senior Editor Sheri Cain Copy Editor PIT, John Edwards Technical Editors Scott Chen, Gert Schauwers, Thomas Scire Team Coordinator Tammi Ross Book Designer Gina Rexrode Cover Designer Louisa Adair Composition Octal Publishing, Inc. Indexer Tim Wright Media Developer Jay Payne Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 European Headquarters Cisco Systems Europe 11 Rue Camille Desmoulins 92782 Issy-les-Moulineaux Cedex 9 France http://www-europe.cisco.com Tel: 33 1 58 04 60 00 Fax: 33 1 58 04 61 00 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-7660 Fax: 408 527-0883 Asia Pacific Headquarters Cisco Systems Australia, Pty., Ltd Level 17, 99 Walker Street North Sydney NSW 2059 Australia http://www.cisco.com Tel: +61 2 8448 7100 Fax: +61 2 9957 4350 Cisco Systems has more than 200 offices in the following countries. Addresses, phone numbers, and fax numbers are listed on the Cisco Web site at www.cisco.com/go/offices Argentina • Australia • Austria • Belgium • Brazil • Bulgaria • Canada • Chile • China • Colombia • Costa Rica • Croatia • Czech Republic • Denmark • Dubai, UAE • Finland • France • Germany • Greece • Hong Kong Hungary • India • Indonesia • Ireland • Israel • Italy • Japan • Korea • Luxembourg • Malaysia • Mexico The Netherlands • New Zealand • Norway • Peru • Philippines • Poland • Portugal • Puerto Rico • Romania Russia • Saudi Arabia • Scotland • Singapore • Slovakia • Slovenia • South Africa • Spain • Swede n Switzerland • Taiwan • Thailand • Turkey • Ukraine • United Kingdom • United States • Venezuela • Vietnam Zimbabwe Copyright © 2000, Cisco Systems, Inc. All rights reserved. Access Registrar, AccessPath, Are You Ready, ATM Director, Browse with Me, CCDA, CCDE, CCDP, CCIE, CCNA, CCNP, CCSI, CD-PAC, CiscoLink, the Cisco NetWorks logo, the Cisco Powered Network logo, Cisco Systems Networking Academy, Fast Step, FireRunner, Follow Me Browsing, FormShare, GigaStack, IGX, Intelligence in the Optical Core, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, iQuick Study, iQ Readiness Scorecard, The iQ Logo, Kernel Proxy, MGX, Natural Network Viewer, Network Registrar, the Networkers logo, Packet, PIX, Point and Click Internetworking, Policy Builder, RateMUX, ReyMaster, ReyView, ScriptShare, Secure Script, Shop with Me, SlideCast, SMARTnet, SVX, TrafficDirector, TransPath, VlanDirector, Voice LAN, Wavelength Router, Workgroup Director, and Workgroup Stack are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Empowering the Internet Generation, are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, Cisco, the Cisco Certified Internetwork Expert Logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Collision Free, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastLink, FastPAD, IOS, IP/TV, IPX, LightStream, LightSwitch, MICA, NetRanger, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, are registered trademarks of Cisco Systems, Inc. or its affiliates in the U.S. and certain other countries. All other brands, names, or trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0010R) CCSP.book Page iii Friday, February 28, 2003 3:43 PM iv About the Authors John F. Roland, CCNA, CCDA, CCNP, CCDP, CSS-1, MCSE, is a security specialist who works for Ajilon Consulting. John has worked in the IT field for more than 22 years, from COBOL programming on IBM mainframes to LAN/WAN design and implementation on United States military networks and, more recently, to the development of Cisco and Microsoft certification training materials. John’s current assignment has him designing and implementing enterprise network certification testing at one of the largest banks in America. John holds a bachelor’s degree in accounting from Tiffin University, Tiffin, Ohio, with minors in math and electrical engineering from General Motors Institute, Flint, Michigan. Mark J. Newcomb is the owner and lead security engineer for Secure Networks in Spokane, Washington. Mark has over 20 years of experience in the networking industry, focusing on the financial and medical industries. The last six years have been devoted to designing security solutions for a wide variety of clients throughout the Pacific Northwest. Mark was one of the first people to obtain the CCNA certification from Cisco and has since obtained CCDA, CCNP, and CCDP certifications. He is the co-author of Cisco Secure Internet Security Solutions , published by Cisco Press, and two other networking books. He has been a technical reviewer on over 20 texts regarding networking for a variety of pub- lishers. He can be reached by e-mail at mnewcomb@wanlansecurity.com. About the Technical Reviewers Scott Chen has worked in the IT field for the past seven years holding various positions, including senior NT engineer, senior network engineer, and lead network engineer/network manager. Scott is currently a lead network engineer/net- work manager at Triad Financial Corporation, which is a wholly owned subsidiary of Ford Motor. He has implemented VPN solutions for remote access and LAN-to-LAN for several enterprises. Scott has extensive experience designing, implementing, and supporting enterprise networks and working with various technologies that Cisco offers, including routing, switching, security, content switching, wireless, BGP, EIGRP, and NAT. Scott graduated from the University of California, Irvine, with a bachelor’s degree. He also holds several certifications, including MCSE, CCNA, CCNP, and CCIE Written/Qualification. Scott can be reached through e-mail at scottchen@cox.net. Gert Schauwers is a triple Cisco Certified Internet Expert (CCIE No. 6942)—Routing and Switching, Security, and Communication and Services. He has more than four years experience in internetworking and holds an Engineering degree in Electronics/Communication. Gert is currently working in the Brussels CCIE lab where he’s a proctor and content engineer for the Routing and Switching, Security, and Communication and Services exams. Thomas Scire has been working in the network infrastructure industry since 1996. Thomas specializes in LAN, WAN, security, and multiservice infrastructure from Cisco Systems, Checkpoint, and Nokia. Thomas works for Accudata Sys- tems, Inc., an independent IT professional services and solutions firm that specializes in enterprise network and security infrastructure. Some of his more notable projects include enterprise VPN and IP telephony deployments and an interna- tional Voice over Frame Relay network deployment. Thomas holds a bachelor’s degree in Computer Engineering from Polytechnic University and holds several certifications, including Cisco CCNA/CCDA, Cisco IP Telephony Design Specialist, Checkpoint Certified Security Engineer, Checkpoint Certified Security Instructor, and Nokia Security Administrator. CCSP.book Page iv Friday, February 28, 2003 3:43 PM v Dedications From John Roland: This book is dedicated to my wife of 28 years, Mariko, and to our son, Michael, for their understanding and support. Their steady love and encouragement has kept me on target through some trying times during the development of this book. You’re the greatest! I further dedicate this book to my late parents, Hazel and Forrest Roland, for nurturing me, teaching me right from wrong, setting a shining example of a loving partnership, and showing me the benefits of a good day’s work. I like to believe that they will be kicking up their heels together throughout eternity. From Mark Newcomb: This book is dedicated to my wife, Jacqueline, and my daughter, Isabella Rumiana. Jacqueline’s patience and under- standing while I am in the process of writing never fails to amaze me. CCSP.book Page v Friday, February 28, 2003 3:43 PM vi Acknowledgments From John Roland: Writing this book has provided me with an opportunity to work with some very fine individuals. I want to thank Brett Bartow from Cisco Press for believing in the project and for getting the ball rolling. I would also like to thank him for turning this project over to Michelle Grandin, Cisco Press, for editorial support. Michelle helped me in many ways dur- ing this project and was always there to lend an encouraging word or a guiding hand. Dayna Isley, Cisco Press, provided developmental guidance and feedback and was way too easy on my less-than-perfect submissions, and I want to thank her for turning the work into a professional document. It has been a real pleasure to work with you three over these several months. Next, I would like to thank my co-author, Mark Newcomb, for stepping in to author half of this book when personal problems brought me to a standstill. Thank you, Mark, for your professionalism and expertise and for helping to bring this project to fruition. I would also like to thank the technical reviewers, Gert Schauwers, Scott Chen, and Thomas Scire for their comments, suggestions, and careful attention to detail. Without their help, this book would not be the valuable resource that it has become. Thank you all. From Mark Newcomb: I heartily acknowledge John Roland’s contribution to this effort and thank him for inviting me to assist in this endeavor. No text of any size is ever truly a work of just the authors. After nearly five years of writing, technical editing, and work- ing with a variety of publishers, I commend every employee of Cisco Press. Michelle Grandin, Dayna Isley, John Kane, and Brett Bartow are people at Cisco Press I have come to know and respect for their professional efforts. I also want to give special thanks to Tammi Ross. Within any organization, there is one individual that seems to be able to solve any unsolvable problem. Tammi has proven herself to be that person at Cisco Press. The technical reviewers working with Cisco Press are world class. Technical reviewers are the most valuable assets a good publisher can have. They do not receive the recognition or compensation that they so richly deserve. I thank Gert Schauwers, Scott Chen, and Thomas Scire for their efforts to make this work what it is today. CCSP.book Page vi Friday, February 28, 2003 3:43 PM vii Contents at a Glance Introduction xvii Chapter 1 All About the Cisco Certified Security Professional 3 Chapter 2 Overview of VPN and IPSec Technologies 15 Chapter 3 Cisco VPN 3000 Concentrator Series Hardware Overview 79 Chapter 4 Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys 125 Chapter 5 Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates 215 Chapter 6 Configuring the Cisco VPN Client Firewall Feature 259 Chapter 7 Monitoring and Administering the VPN 3000 Series Concentrator 303 Chapter 8 Configuring Cisco 3002 Hardware Client for Remote Access 359 Chapter 9 Configuring Scalability Features of the VPN 3002 Hardware Client 399 Chapter 10 Cisco VPN 3000 LAN-to-LAN with Preshared Keys 443 Chapter 11 Scenarios 473 Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Sections 489 Index 551 CCSP.book Page vii Friday, February 28, 2003 3:43 PM viii Table of Contents Introduction xvii Chapter 1 All About the Cisco Certified Security Professional 3 How This Book Can Help You Pass the CCSP Cisco Secure VPN Exam 5 Overview of CCSP Certification and Required Exams 5 The Cisco Secure VPN Exam 6 Topics on the Cisco Secure VPN Exam 8 Recommended Training Path for the CCSP Certification 10 Using This Book to Pass the Exam 11 Final Exam Preparation Tips 11 Chapter 2 Overview of VPN and IPSec Technologies 15 How to Best Use This Chapter 15 “Do I Know This Already?” Quiz 16 Cisco VPN Product Line 21 Enabling VPN Applications Through Cisco Products 21 Typical VPN Applications 21 Using Cisco VPN Products 26 An Overview of IPSec Protocols 36 The IPSec Protocols 39 Security Associations 46 Existing Protocols Used in the IPSec Process 47 Authenticating IPSec Peers and Forming Security Associations 54 Combining Protocols into Transform Sets 54 Establishing VPNs with IPSec 57 Step 1: Interesting Traffic Triggers IPSec Process 59 Step 2: Authenticate Peers and Establish IKE SAs 61 Step 3: Establish IPSec SAs 61 Step 4: Allow Secured Communications 61 Step 5: Terminate VPN 62 Table of Protocols Used with IPSec 63 IPSec Preconfiguration Processes 65 Creating VPNs with IPSec 65 CCSP.book Page viii Friday, February 28, 2003 3:43 PM ix Chapter 3 Cisco VPN 3000 Concentrator Series Hardware Overview 79 How to Best Use This Chapter 79 “Do I Know This Already?” Quiz 80 Major Advantages of Cisco VPN 3000 Series Concentrators 85 Ease of Deployment and Use 87 Performance and Scalability 87 Security 90 Fault Tolerance 94 Management Interface 94 Ease of Upgrades 99 Cisco Secure VPN Concentrators: Comparison and Features 100 Cisco VPN 3005 Concentrator 101 Cisco VPN 3015 Concentrator 102 Cisco VPN 3030 Concentrator 103 Cisco VPN 3060 Concentrator 104 Cisco VPN 3080 Concentrator 104 Cisco VPN 3000 Concentrator Series LED Indicators 105 Cisco Secure VPN Client Features 108 Cisco VPN 3002 Hardware Client 108 Cisco VPN Client 109 Table of Cisco VPN 3000 Concentrators 111 Table of Cisco VPN 3000 Concentrator Capabilities 112 Chapter 4 Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys 125 How to Best Use This Chapter 125 “Do I Know This Already?” Quiz 126 Using VPNs for Remote Access with Preshared Keys 132 Unique Preshared Keys 132 Group Preshared Keys 133 Wildcard Preshared Keys 133 VPN Concentrator Configuration 134 Cisco VPN 3000 Concentrator Configuration Requirements 135 Cisco VPN 3000 Concentrator Initial Configuration 136 Configuring IPSec with Preshared Keys Through the VPN 3000 Concentrator Series Manager 152 Advanced Configuration of the VPN Concentrator 169 CCSP.book Page ix Friday, February 28, 2003 3:43 PM [...]... shows the topics for the Cisco Secure VPN exam Table 1-2 CSVPN Exam Topics Chapter and Chapter Title Exam Topics Chapter 2 1 Cisco products enable a secure VPN Overview of VPN and IPSec Technologies 2 IPSec overview 3 IPSec protocol framework 4 How IPSec works Chapter 3 Cisco VPN 3000 Concentrator Series Hardware Overview 5 Overview of the Cisco VPN 3000 Concentrator Series 6 Cisco VPN 3000 Concentrator... use the Cisco Intrusion Detection System to detect and respond to network attacks Additionally, you learn how to manage, administer, and monitor your intrusion detection systems • Cisco Secure VPN (CSVPN)—This four-day course teaches you how to describe, configure, verify, and manage the Cisco VPN 3000 Concentrator, the Cisco VPN 3.1 Software Client, and the Cisco VPN 3002 Hardware Client • Cisco SAFE... the Cisco VPN 3000 Series Concentrator 14 Configure the IPSec Windows Client Chapter 5 15 CA support overview Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates 16 Certificate generation 17 Validating certificates 18 Configuring the Cisco VPN 3000 Concentrator Series for CA support CCSP. book Page 9 Friday, February 28, 2003 3:43 PM Topics on the Cisco Secure VPN Exam Table 1-2 9 CSVPN... designed as an aid to help you pass the CCSP Cisco Secure VPN exam Because that is the primary goal of this book, it stands to reason that the CCSP candidate will derive the most benefit from this book Everyone who attempts to obtain the CCSP certification must take the Cisco Secure VPN exam, making every CCSP candidate a potential beneficiary of the material in this book CCSP. book Page xviii Friday, February.. .CCSP. book Page x Friday, February 28, 2003 3:43 PM x Installing and Configuring the VPN Client Overview of the VPN Client 174 VPN Client Features 175 VPN Client Installation 177 VPN Client Configuration 181 Types of Preshared Keys 174 186 VPN 3000 Concentrator CLI Quick Configuration Steps 186 VPN 3000 Concentrator Browser-Based Manager Quick Configuration Steps VPN Client Installation Steps 187 VPN. .. models 7 Benefits and features of the Cisco VPN 3000 Concentrator Series 8 Cisco VPN 3000 Concentrator Series Client support Chapter 4 9 Overview of remote access using preshared keys Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys 10 Initial configuration of the Cisco VPN 3000 Concentrator Series for remote access 11 Browser configuration of the Cisco VPN 3000 Concentrator Series 12 Configure... following: — 1 Cisco products enable a secure VPN — 2 IPSec overview — 3 IPSec protocol framework — 4 How IPSec works • Chapter 3, Cisco VPN 3000 Concentrator Series Hardware Overview”—This chapter looks at the Cisco VPN 3000 Concentrator Series and describes the capabilities of each VPN concentrator model Exam objectives covered in this chapter include the following: — 5 Overview of the Cisco VPN 3000... 9E0-131 CSI 1.0, Cisco SAFE Implementation There are no anticipated changes to this exam as of the time that this book was printed Be sure to refer to the Cisco Systems website for current information regarding exam numbers and content The Cisco Secure VPN Exam The Cisco Secure VPN exam was designed to test your knowledge of configuring, monitoring, and administering Cisco s purpose-built VPN 3000 Series... Access 25 Monitoring the Cisco VPN 3000 Series Concentrator 26 Administering the Cisco VPN 3000 Series Concentrator 27 Cisco VPN 3002 Hardware Client remote access with preshared keys 28 Overview of VPN 3002 interactive unit and user authentication feature 29 Configuring VPN 3002 integrated unit authentication feature 30 Configuring VPN 3002 user authentication 31 Monitoring VPN 3002 user statistics Chapter... Overview of the Cisco VPN 3000 Concentrator Series — 6 Cisco VPN 3000 Concentrator Series models — 7 Benefits and features of the Cisco VPN 3000 Concentrator Series — 8 Cisco VPN 3000 Concentrator Series Client support • Chapter 4, “Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys”—This chapter describes the process of configuring VPN concentrators for remote access with preshared keys . Pass the CCSP Cisco Secure VPN Exam 5 Overview of CCSP Certification and Required Exams 5 The Cisco Secure VPN Exam 6 Topics on the Cisco Secure VPN Exam. Upgrades 99 Cisco Secure VPN Concentrators: Comparison and Features 100 Cisco VPN 3005 Concentrator 101 Cisco VPN 3015 Concentrator 102 Cisco VPN 3030 Concentrator