CCIE Security v4.0 Practice Lab
- Section 1: Perimeter Security and Services
- Section 2: Intrusion Prevention and Content Security
This chapter is from the book
This chapter is from the book
This chapter is from the book
Section 1: Perimeter Security and Services
Securing the perimeter around important networks and devices is a fundamental part of network protection. In this section, you are asked to implement firewall services that include not only traditional features, such as Network Address Translation (NAT) and traffic inspection, but also secured routing features. This section focuses on initializing and configuring the Cisco Adaptive Security Appliance (ASA) in both single- and multi-context modes. Connectivity through perimeter devices must be verified before moving on to other exercises in this guide.
Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode
ASA1 must be configured as a multi-context firewall using a shared outside interface. In addition, context c1 and the admin context will be using VLANs for logical segregation on a physical interface. The logical placement of ASA1 is shown in the network topology presented in Diagram 2 in Part I.
Table 1-1 through Table 1-6 outline the initialization requirements.
Table 1-1 Administration
|
Hostname |
ASA1 |
|
Enable Password |
cisco |
Table 1-2 Context Admin
|
Physical Interface |
Logical Name |
VLAN |
config-url |
|
GigabitEthernet0/2.2 |
mgmt (management traffic only) |
102 |
disk0:/admin.cfg |
Table 1-3 Context c1
|
Physical Interface |
Logical Name |
VLAN |
config-url |
|
GigabitEthernet0/0 |
outside |
80 |
disk0:/c1.cfg |
|
GigabitEthernet0/2.1 |
inside |
101 |
Table 1-4 Context c2
|
Physical Interface |
Logical Name |
VLAN |
config-url |
|
GigabitEthernet0/0 |
outside |
80 |
disk0:/c2.cfg |
|
GigabitEthernet0/1 |
dmz |
90 |
|
|
GigabitEthernet0/3 |
inside |
100 |
Table 1-5 Context Initialization Details
|
Context |
Interface |
IP Address/Mask |
Nameif |
Security Level |
|
admin |
GigabitEthernet0/2.2 |
192.168.1.20/24 |
mgmt |
100 |
|
c1 |
GigabitEthernet0/0 |
10.50.80.20/24 |
outside |
0 |
|
GigabitEthernet0/2.1 |
192.168.2.20/24 |
inside |
100 |
|
|
c2 |
GigabitEthernet0/0 |
10.50.80.30/24 |
outside |
0 |
|
GigabitEthernet0/1 |
10.50.90.20/24 |
dmz |
50 |
|
|
GigabitEthernet0/3 |
10.50.100.20/24 |
inside |
100 |
Table 1-6 Routing Details
|
Context |
Type |
Network Prefix |
Next Hop |
|
c1 |
Default |
0.0.0.0/0 |
10.50.80.6 |
|
c2 |
Default |
0.0.0.0/0 |
10.50.80.6 |
|
admin |
Default |
0.0.0.0/0 |
192.168.1.5 |
|
c2 |
Static |
10.10.0.0/16 |
10.50.100.2 |
Use names and addresses exactly as outlined. Remember that names are case sensitive.
Notes
- To validate your configuration, ensure that all interfaces in all contexts are up. You should ensure that Internet Control Message Protocol (ICMP) is permitted through each context to test connectivity and routing to the major subnets in the topology. You may use permit icmp any any for this purpose. Refer to Part I of this guide for information on the network addressing used in the topology.
- You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
- Some subnets might not be accessible until the configuration of ASA2 (see Exercise 1.2) and the Cisco IPS sensor (Exercise 2.1) is complete.
- The subinterface used for management traffic (admin context) must connect to inside secure hosts for management purposes only.
For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode.”
Exercise 1.2: Configure Routing and Basic Access on ASA2
In this exercise, ASA2 should be configured in single-context routed mode with support for Open Shortest Path First (OSPF). Table 1-7 through Table 1-10 provide the necessary configuration details. Use names exactly as they are shown; remember that they are case sensitive. You will not need to change any of the OSPF parameters on neighboring routers. Refer to Diagram 2 and Diagram 3 in Part I for device placement, addressing, and routing details.
Table 1-7 Administration
|
Hostname |
ASA2 |
|
Enable Password |
cisco |
Table 1-8 Interface Initialization Details
|
Interface |
IP Address/Mask |
Nameif |
Security Level |
|
GigabitEthernet0/0 |
10.50.50.20/24 |
outside |
0 |
|
GigabitEthernet0/2 |
10.50.40.20/24 |
inside |
100 |
|
GigabitEthernet0/3 |
10.50.30.20/24 |
dmz |
50 |
Table 1-9 Static Routing Details
|
Interface |
Type |
Network Prefix |
Next Hop |
|
dmz |
Static |
10.3.3.0/24 |
10.50.30.3 |
|
dmz |
Static |
10.4.4.0/24 |
10.50.30.4 |
Table 1-10 OSPF Routing Details
|
Interface |
Area |
Network Prefix |
Network Mask |
|
outside |
0 |
10.50.50.0 |
255.255.255.0 |
|
dmz |
1 |
10.50.30.0 |
255.255.255.0 |
|
inside |
2 |
10.50.40.0 |
255.255.255.0 |
Notes
- To validate your configuration, ensure that all interfaces are up. You should ensure that ICMP is permitted through the firewall to test connectivity and routing to the major subnets in the topology. Refer to Part I of this guide for information on the network addressing used in the topology.
- You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
- Some subnets might not be accessible until the configuration of ASA1 (in Exercise 1.1) and the Cisco IPS sensor (in Exercise 2.1) is completed.
For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.2: Configure Routing and Basic Access on ASA2.”
Exercise 1.3: Configure IP Services on ASA1
This exercise has four tasks that build on the initial configuration of ASA1 Exercise 1.1. You may use any names for configuration elements such as access lists or objects, unless otherwise specified. Note that because the version of software currently running on ASA1 is post 8.3, the NAT configuration tasks will require the use of objects. Refer to Diagram 2 and Diagram 3 in Part I for device placement and addressing details.
- Task 1: Configure Network Object NAT
- Task 2: Configure Twice NAT
- Task 3: Configure and Troubleshoot NTP Services Using Authentication
- Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1
Task 1: Configure Network Object NAT
Use network object NAT to translate 10.50.90.5/32 on R5 to 10.50.80.50/32 in the appropriate context. This translation must allow bidirectional communication.
Task 2: Configure Twice NAT
Using Twice NAT, create a policy that will translate network 10.50.100.0/24 to the range 10.50.80.100–10.50.80.150 if the destination is 10.50.50.0/24. Translation for this task is unidirectional.
Task 3: Configure and Troubleshoot NTP Services Using Authentication
Network Time Protocol (NTP) on ASA1 using authentication is required with the NTP master service, which is partially configured on SW1 as follows:
SW1# show run | begin ntp ntp authentication-key 1 md5 cisco ntp source Vlan102 ntp access-group peer 1 ntp master 2
Complete the configuration and troubleshoot any issues using the following outputs to verify your solution:
ASA1# show ntp associations detail 192.168.1.5 configured, authenticated, our_master, sane, valid, stratum 2 ASA1# show ntp status Clock is synchronized, stratum 3, reference is 192.168.1.5
Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1
Enable support for the ipv6ip tunnel configured between the tunnel endpoints 10.50.80.6 (R6) and 10.50.90.5 (R5). This configuration will be important for the completion of Exercise 5.1.
For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.3: Configure IP Services on ASA1.”
Exercise 1.4: Configure IP Routing Security on ASA2
There are two tasks in this exercise that will focus on configuring the ASA2 to support dynamic routing protocols. Refer to Diagram 3 for routing protocol and addressing details.
Task 1: BGP Connectivity Through the ASA2
External Border Gateway Protocol (eBGP) has been preconfigured on R7 and R6 in Autonomous Systems 107 and 106, respectively. The BGP peering function cannot establish a session between these two routers through ASA2. Configure a solution that will enable the BGP peers to establish a connection. The following outputs can be used to verify your solution:
R6# show ip bgp BGP table version is 3, local router ID is 172.18.106.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 172.18.106.0/24 0.0.0.0 0 32768 ? *> 172.18.107.0/24 10.50.40.7 0 0 107 ? R7# show ip bgp BGP table version is 5, local router ID is 172.18.107.7 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 172.18.106.0/24 10.50.70.6 0 0 106 ? *> 172.18.107.0/24 0.0.0.0 0 32768 ?
Task 2: OSPF Authentication for Routing Update Security
MD5 authentication is required in OSPF area 2. Configure a solution for this area only, and ensure that OSPF routing information is still correctly exchanged between neighbors.
Use the key cisco123.
The following outputs will verify your solution:
R7# show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
10.50.50.20 1 FULL/BDR 00:00:32 10.50.40.20 GigabitEthernet0/1
ASA2# show ospf neighbor inside
Neighbor ID Pri State Dead Time Address Interface
172.18.107.7 1 FULL/DR 0:00:38 10.50.40.7 inside
ASA2# show ospf
Area 2
Number of interfaces in this area is 1
Area has message digest authentication
R7# show ip ospf
Area 2
Number of interfaces in this area is 2 (1 loopback)
Area has message digest authentication
For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.4: Configure IP Routing Security on ASA2.”