CCNP ISCW Portable Command Guide (Self-Study Guide)

__CCNP ISCW Portable Command Guide__ All the ISCW 642-825 commands in one compact, portable resource Scott Empson Hans Roth Preparing for the CCNP certification? Working as a network professional? Here are all the CCNP-level commands for the ISCW exam you need in one condensed, portable resource. The CCNP ISCW Portable Command Guide is filled with valuable, easy-to-access information and is portable enough for use whether you’re in the server room or the equipment closet. This book can help you memorize commands and concepts as you work to pass the CCNP ISCW exam (642-825). The guide summarizes all CCNP certification-level Cisco IOS Software commands, keywords, command arguments, and associated prompts, providing you with tips and examples of how to apply the commands to real-world scenarios. Sample configurations throughout the book provide you with a better understanding of how these commands are used in simple network designs. The topics in this portable command guide cover how to do the following: * Implement basic teleworker services * Implement Frame-Mode MPLS * Implement a site-to-site IPsec VPN * Describe network security strategies * Implement Cisco Device Hardening * Implement Cisco IOS Firewall * Describe and configure Cisco IOS IPS Scott Empson is currently the assistant program chair of the bachelor of applied information systems technology degree program at the Northern Alberta Institute of Technology in Edmonton, Alberta, Canada, teaching Cisco routing, switching, and network design courses in certificate, diploma, and applied degree programs at the post-secondary level. Hans Roth is an instructor in the electrical/electronic engineering technology department at Red River College in Winnipeg, Canada. * Access all CCNP ISCW commands–use as a quick, offline resource for research and solutions * Logical “how-to” topic groupings provide one-stop research * Great for review before taking the CCNP ISCW certification exam * Compact size makes it easy to carry with you, wherever you go * “Create your own journal” section with blank, lined pages allows you to personalize the book for your needs This book is part of the Cisco Press Certification Self-Study Product Family, which offers readers a self-paced study routine for Cisco certification exams. Titles in the Cisco Press Certification Self-Study Product Family are part of a recommended learning program from Cisco that includes simulation and hands-on training from authorized Cisco Learning Partners and self-study products from Cisco Press. Category: Cisco Press–Cisco Certification Covers: CCNP ISCW Certification 642-825 Cover......Page 1 Contents......Page 10 Introduction......Page 16 Cisco Service-Oriented Network Architecture......Page 18 Cisco Enterprise Composite Network Model......Page 19 Configuration Example: DSL Using PPPoE......Page 20 Virtual Private Dial-Up Network (VPDN) Programming......Page 22 Step 2: Configure the Dialer Interface......Page 23 Step 3: Define Interesting Traffic and Specify Default Routing......Page 24 Step 4a: Configure NAT Using an ACL......Page 25 Step 4b: Configure NAT Using a Route Map......Page 26 Step 6: Apply NAT Programming......Page 27 Configuring PPPoA......Page 28 Step 1: Configure PPPoA on the WAN Interface (Using Subinterfaces)......Page 29 For Challenge Handshake Authentication Protocol (CHAP)......Page 30 Step 3: Verify a PPPoA Connection......Page 31 Configuring a Cable Modem Connection......Page 32 Step 1: Configure WAN Connectivity......Page 33 Step 2: Configure Local DHCP Service......Page 34 Step 4: Configure Default Routing......Page 35 Step 1: Configure Global Bridging Parameters......Page 36 Configuring L3 Routing Using a Cisco Cable Modem HWIC......Page 37 Step 3: Configure WAN Connectivity......Page 38 Configuring Cisco Express Forwarding......Page 40 Troubleshooting CEF......Page 41 Configuring MPLS on a Frame Mode Interface......Page 42 Configuring MTU Size in Label Switching......Page 43 R1 Router......Page 44 R2 Router......Page 45 R3 Router......Page 47 Chapter 4 IPsec VPNs......Page 50 Configuring a Teleworker to Branch Office VPN Using CLI......Page 51 Step 2: Configure Policies for the Client Group(s)......Page 52 Step 4: Configure Router AAA and Add VPN Client Users......Page 53 Step 6: Configure the Crypto Map (IKE Phase 2)......Page 54 Step 8: Verify the VPN Service......Page 55 Step 1: Configure the ISAKMP Policy (IKE Phase 1)......Page 56 Step 3: Configure the Crypto ACL (Interesting Traffic, Secure Data Transfer)......Page 57 Step 4: Configure the Crypto Map (IKE Phase 2)......Page 58 Step 7: Verify the VPN Service......Page 59 Configuring IPsec Site-to-Site VPNs Using SDM......Page 60 Step 1: Create the GRE Tunnel......Page 63 Step 3: Specify the IPsec VPN IKE Proposals......Page 64 Step 4: Specify the IPsec VPN Transform Sets......Page 65 Step 5b: Specify Routing with OSPF for the GRE over IPsec Tunnel......Page 66 Configuring a Static IPsec Virtual Tunnel Interface......Page 67 Step 2: Configure Static Routing......Page 68 Step 3: Create IKE Policies and Peers......Page 69 Step 5: Create an IPsec Profile......Page 71 Step 6: Create the IPsec Virtual Tunnel Interface......Page 72 Configuring High Availability VPNs......Page 74 Step 1: Configure Hot Standby Routing Protocol Configuration on HSRP1......Page 75 Tunnel Traffic Filter......Page 76 IPsec Tunnel......Page 77 IPsec Tunnel......Page 78 Step 3: Add Programming for Crypto Redundancy Configuration......Page 79 Step 4: Define the Interdevice Communication Protocol (HSRP1 and HSRP)......Page 80 Configuring Easy VPN Server Using Cisco SDM......Page 82 Implementing the Cisco VPN Client......Page 86 Chapter 5 Cisco Device Hardening......Page 88 Disabling Unneeded Services and Interfaces......Page 89 Disabling Path Integrity Mechanisms......Page 91 Terminal Access Security......Page 92 Locking Down Routers with AutoSecure......Page 93 Optional AutoSecure Parameters......Page 99 SDM Security Audit Wizard......Page 100 One-Step Lockdown......Page 105 Setting Cisco Passwords and Password Security......Page 107 Securing ROMMON......Page 111 Setting a Login Failure Rate......Page 112 Setting Multiple Privilege Levels......Page 114 Configuring Banner Messages......Page 115 Role-Based CLI......Page 117 Secure Configuration Files......Page 119 Tips for Using Access Control Lists......Page 120 IP Address Spoofing: Inbound......Page 121 IP Address Spoofing: Outbound......Page 123 DoS TCP SYN Attacks: Blocking External Attacks......Page 124 DoS TCP SYN Attacks: Using TCP Intercept......Page 125 DoS Smurf Attacks......Page 126 Filtering ICMP Messages: Inbound......Page 127 Filtering ICMP Messages: Outbound......Page 128 Filtering UDP Traceroute Messages......Page 129 Mitigating Dedicated DoS Attacks with ACLs......Page 130 Mitigating TRIN00......Page 131 Mitigating Stacheldraht......Page 132 Mitigating Trinity v3......Page 134 Mitigating SubSeven......Page 135 Configuring an SSH Server for Secure Management and Reporting......Page 138 Configuring Syslog Logging......Page 139 Configuring an SNMP Managed Node......Page 140 Configuring NTP Clients and Servers......Page 142 Winnipeg Router (NTP Source)......Page 144 Dauphin Router (Client Router)......Page 145 TACACS+......Page 146 Authentication......Page 147 Accounting......Page 148 Configuring AAA on Cisco Routers Using SDM......Page 149 Configuring an IOS Firewall from the CLI......Page 156 Step 2: Configure an IP ACL for the Interface......Page 157 Step 3: Set Audit Trails and Alerts......Page 158 Step 4: Define the Inspection Rules......Page 159 Step 5: Apply the Inspection Rules and the ACL to the Outside Interface......Page 160 Step 6: Verify the Configuration......Page 161 Configuring a Basic Firewall Using SDM......Page 162 Configuring an Advanced Firewall Using SDM......Page 166 Verifying Firewall Activity Using SDM......Page 175 Configuring Cisco IOS Intrusion Prevention System from the CLI......Page 177 Step 2: Configure the Failure Parameter......Page 178 Step 4: Apply the IPS Rule to an Interface......Page 179 IPS Enhancements......Page 180 Configuring Cisco IOS IPS from the SDM......Page 182 Viewing Security Device Event Exchange Messages Through SDM......Page 187 Tuning Signatures Through SDM......Page 188 Appendix: Create Your Own Journal Here......Page 192 All the CCNP ISCW 642-825 commands in one compact and portable resource All CCNP ISCW commands in an easily referenced resource, no need to be near the Internet for searching online resources Compact size makes it easy to carry with you as a reference in the workplace. No need to carry around big thick books ONLY book published with all CCNP ISCW commands from the only official Cisco certification self study publisher With hundreds of Cisco IOS® Software commands, options, and command arguments to remember, a CCNP ISCW candidate has a lot to commit to memory. Having an easy-to-use, portable reference filled with handy tips and examples on how to apply the commands to real-world scenarios will help increase your familiarity with Cisco IOS Software when working on routers and switches. The CCNP ISCW Portable Command Guide is a supplementary guide to assist network administrators in the proper use of the Cisco IOS and of the commands needed to pass the CCNP ISCW exam. The guide summarizes all ISCW commands, keywords, command arguments, and associated prompts. Configuration examples are provided throughout the book to give a better understanding of how these commands are used in network designs. This guide is not meant to replace any existing learning materials but rather serve as a supplementary guide to assist networkers in the proper use of the many different commands that are required to successfully pass the CCNP ISCW exam. The CCNP ISCW (Implementing Secure Converged WANs) is one of four exams required for the CCNP certification from Cisco, and it focuses on network security and integration technologies For anyone preparing for the CCNP certification, this condensed, portable resource is filled with valuable, easy-to-access information on CCNP-level commands for the ISCW exam (642-825).