ASACAMP - ASA Lab Camp (5316)

Transcription

1 ASACAMP - ASA Lab Camp (5316) Price: $4,595 Cisco Course v1.0 Cisco Security Appliance Software v8.0 Based on our enhanced FIREWALL and VPN courses, this exclusive, lab-based course is designed to provide you with the most Adaptive Security Appliance (ASA) 8.2-based lab experience possible in just five days. A typical day will begin with an informal white board lecture by the instructor, covering topics associated with the day's labs. Afterwards, you will be free to work on the labs at your own pace and to experiment in the lab environment. Of course, the instructor will remain available to assist as needed. Labs can be run in any order, any number of times. With the exception of three labs that require two pods to work together, no coordination with other students is necessary. You can experiment with your own scenarios or try our cutting-edge labs including tasks such as: Updating the ASA to version 8.3 or 8.4 Reviewing new NAT or ACL syntax used in 8.3 Exploring new features in 8.3 or 8.4 Upgrading any lab to 8.3 or 8.4 and see the differences from 8.2 Executing general maintenance commands Configuring VPN on the Security Appliance Managing digital certificates for IPSec and SSL VPNs Deep packet inspection Using the 5505 in the SOHO environment Your ASA Lab Camp includes: Round-the-clock access to a dedicated Flexible Security Architecture (FSA) pod consisting of the most up-to-date security hardware Enhanced lab topology unlike that of any other training provider FIREWALL and VPN Workbook and Lab Guide, including exclusive additional labs Limited, concise lectures summarizing key points demonstrated in labs Ten extra security e-lab credits, good for 30 days, so you can practice and refine your skills, including in our exclusive ASA 8.3 labs World-class Certified Cisco Systems instructors What You'll Learn Bootstrap the security appliance, prepare the security appliance for configuration via the ASDM, and launch and navigate ASDM Perform essential security appliance configuration using ASDM and the CLI Configure dynamic and static address translations in the security appliance using ASDM Configure switching and routing on the security appliance using ASDM Configure access control lists, filter malicious active codes, and filter URLs to meet the requirements of the security policy using ASDM Troubleshooting using the packet tracer Configure object groups and AAA using ASDM

2 Configure a modular policy using ASDM Configure the security appliance to support a site-to-site VPN using ASDM Use ASDM to configure the security appliance to provide secure connectivity using remote access VPNs Configure the security appliance to run in transparent firewall mode Enable, configure, and manage multiple contexts to meet security policy requirements Use advanced NAT features such as policy-based NAT Use advanced modular policy framework for deep packet inspection of application protocols such as HTTP and FTP Configure the security appliance to segment traffic with VLANs Configure the IPSec VPN Client using digital certificates Configure the advanced Easy VPN Server features of the ASA Determine the necessary configuration for the ASA 5505 to be a VPN hardware client Configure QoS for VPN traffic Enable clientless SSL VPNs with the security appliance Enable AnyConnect SSL VPN client with the security appliance Enable the Cisco Secure Desktop with the security appliance to increase the security posture of SSL VPN connections Enable Dynamic Access Policy with the Cisco Secure Desktop Configure, inspect, and filter traffic with the Content Security and Control SSM Configure the AIP-SSM to identify and alert for common attacks Who Needs to Attend Security professionals looking for the most hands-on experience possible in five days Network security engineers who prefer to learn by doing Motivated self-starters looking to get all the materials required to prepare for the FIREWALL and VPN CCNP Security certification exams Prerequisites ICND2 - Interconnecting Cisco Network Devices 2 IINS - Implementing Cisco IOS Network Security Follow-On Courses IPS - Implementing Cisco Intrusion Prevention System v7.0 MARS - Cisco Security Monitoring, Analysis, and Response System v3.0 Certification Programs and Certificate Tracks This course is part of the following programs or tracks: CCIE Security Course Outline FIREWALL 1. Cisco Adaptive Security Appliance (ASA) Technology and Features ASA Family 2. Basic Connectivity and Device Management Cisco ASA and Cisco ASDM Interfaces and Static Routing

3 Basic Device Management Features Management Access 3. Access Control Features Basic Access Control Modular Policy Framework Basic Stateful Inspection Features Application-Layer Policies Advanced Access Controls Resource Limits and Guarantees User-Based Policies 4. Network Integration Features Network Address Translation Transparent Firewall Operations 5. Virtualization and High Availability Features Virtualization Features Redundant Interfaces Active/Standby High Availability Failover Active/Active High Availability Failover 6. Security Service Modules AIP-SSM and AIP-AIP-SSC Module Integration CSC-SSM Module Integration VPN 1. Evaluating the Cisco ASA VPN Subsystem ASA Software Architecture Common Cisco ASA Remote Access VPN Concepts 2. ASA IPSec VPN Solutions Basic Site-to-Site IPSec VPNs Certificate Authentication in Site-to-Site IPSec VPNs Cisco IPSec VPN Client Basic Easy VPN Solutions Advanced Authentication Cisco ASA AnyConnect Remote Access VPN Solutions Basic AnyConnect Full Tunnel SSL VPN Solution Advanced Deployment Advanced Authentication in AnyConnect Full Tunnel SSL VPNs 4. Clientless SSL Remote Access VPN Solutions Basic Clientless SSL VPN Solution Advanced Application Access for Clientless SSL VPN Advanced Authentication Single Sign-On in a Clientless SSL VPN Customize the Clientless SSL VPN User Interface and Portal 5. Advanced Cisco ASA VPN Solutions VPN Authorization and Accounting Cisco Secure Desktop in SSL VPNs Dynamic Access Policies High Availability and High Performance in SSL and IPSec VPNs Labs Remember, you can repeat labs, test scenarios of your own creation, and experiment with ASA 8.3 and 8.4 operating systems. Besides having access from within the classroom with the support of your instructor during normal class hours, you will also have 24-hour Internet access to your pod during the week of class. FIREWALL: Lab 1: Enhanced - Preparing the ASA for Administration Access the ASA Console Port Clear the Existing Configuration Take Inventory of the ASA The Setup Dialog Set the Environment Variables Enable SSH Setup ASDM Exclusive - Persistent Self-Signed Certificate Lab 2: Enhanced - Fundamental ASA Configuration Configure Interfaces Configure Static Routes Test Connectivity Configure NTP Configure Syslog Configure SNMP Configure DHCP Server Lab 3: Enhanced - AAA for Administrative Access

4 Exclusive - Privilege Level Authorization Configure ACS and ASA Communication Configure ACS Integration with Active Directory User Authentication using TACACS+ Exclusive - User Authorization using TACACS+ Exclusive - Command Authorization using TACACS+ Command Accounting using TACACS+ Lab 4: Enhanced - Network Address Translation Configure PAT Exclusive - Understand NAT Control Exclusive - Configure Dynamic NAT and NAT Exemption Configure Static NAT Configure Policy NAT Lab 5: Enhanced - Basic Access Control Understand the Policy Objectives Configure Object Groups Configure Outside Policy Configure ICMP Policy Configure DMZ Policy Configure Inside Policy Unicast Reverse Path Forwarding Enforcement Lab 6: Enhanced - Troubleshooting Tools Syslog Show Commands Debug Commands Packet Tracer Packet Capture Lab 7: Enhanced - Basic Protocol Inspection Basic FTP Inspection Exclusive - Basic HTTP Inspection TTL Manipulation Exclusive - Troubleshoot Traceroute TCP Maps Exclusive - Legacy Application Support Lab 8: Enhanced - Advanced Protocol Inspection Enforcing HTTP RFC Compliance Exclusive - Block an Undesirable HTTP Application Filter Content within HTTP Lab 9: Enhanced - Advanced Access Control Basic Threat Detection Threat Detection Statistics Enable TCP Intercept Exclusive - TCP Intercept in Action Lab 10: Enhanced - User-Based Policies Configure ACS and ASA Communication Exclusive - Configure ACS Integration with Active Directory Cut-Through Authentication Exclusive - User Authentication Timeouts Virtual Telnet Server Downloadable ACLs Exclusive - Per User Override AAA Accounting Lab 11: Enhanced - Transparent Firewall and Security Contexts The Scenario Access the Security Appliance Console Configure Transparent Firewall Mode Configure Interfaces and the Management IP Address Exclusive - Configure the Switching Fabric Test Connectivity through the Security Appliance Prepare the ASA and Launch ASDM Define and Test Inbound Policy with ASDM Exclusive - The Updated Scenario Exclusive - Enable Multiple Context Mode Exclusive - Multiple Context Mode from ASDM Exclusive - Create and Configure a New Context Exclusive - Update the Switching Fabric

5 Exclusive - Verify Functionality of the New Context Exclusive - The Admin Context Doesn't Need to be Named Admin Exclusive - Save all Context Configurations at Once Lab 12: Enhanced - Active/Standby Failover Prepare the Primary ASA for Failover via ASDM Configure the Failover Prompt Exclusive - Prepare the Secondary ASA for Failover via the CLI Turn Failover On and Verify Status Test Failover Operation Return to a Normal State Exclusive - Demonstrate Configuration Replication Lab 13: Enhanced - Active/Active Failover Prepare the Primary ASA for Failover via ASDM Exclusive - Prepare the Secondary ASA for Failover via the CLI Turn Failover On and Verify Status Exclusive - Demonstrate Command Replication and Failover Exec Exclusive - Enable Preemption Test Failover Operation Return to a Normal State VPN: Lab 1: Enhanced - Basic Site-to-Site VPN Configure ISAKMP Policy Build the Site-to-Site Connection Profile Adjusting NAT Policies for VPN Verifying Tunnel Status Monitor Session Establishment with Debug Control Site-to-Site Traffic with a Filter Lab 2: Enhanced - Site-to-Site IPSec VPN with PKI Obtain an Identity Certificate via SCEP Update the VPN Configuration for PKI Support Verify the Tunnel Debug Scenarios Lab 3: Enhanced - Basic Cisco Easy VPN Enable Remote Access VPN on the ASA DfltGrpPolicy Prepare the Cisco VPN Client Adjust NAT Policy for Remote Access VPN Monitor the VPN Status from both Sides Allow Internet Access via Split Tunneling Allow Internet Access via Hairpin Enable Hub and Spoke VPN Lab 4: Enhanced - AAA for Remote Access VPN: RADIUS Configure ACS and ASA Communication Configure ACS Integration with Active Directory RADIUS Authorization with a Local Group Policy RADIUS Authorization with a Centralized Policy Lab 5: Cisco Easy VPN with PKI Exclusive - Configure the VPN Client for Mutual Group Authentication Exclusive - Enroll the ASA with the External PKI Exclusive - Configure the ASA for Mutual Group Authentication and Test Prepare the VPN Client for Certificate-Based Authentication Configure the ASA for Remote Access VPN with PKI Verify Connectivity Lab 6: Enhanced - Cisco Easy VPN: Hardware Client (5505) Initial Configuration of Easy VPN Server Easy VPN Remote on the 5505 Easy VPN Client Mode Policy Inheritance Easy VPN Network Extension Mode Easy VPN Extended Authentication Options

6 Lab 7: Enhanced - Full Tunnel SSL VPN Manually Obtain SSL Certificate from a Public CA Prepare the ASA to Accept SSL VPN Connections Install the AnyConnect Client and Test Connectivity Configure a New Local Group Policy Configure a Centralized Group Policy Lab 8: Enhanced - Local CA Prepare the Local CA on the ASA Configure AnyConnect Certificate Policies Enroll the Outside PC Test AnyConnect Connectivity with Digital Certificates Revoke a Client Certificate Lab 9: Enhanced - Centralized AnyConnect Management Upgrade the AnyConnect Client Customize AnyConnect Icons AnyConnect XML Profiles AnyConnect Web Launch DTLS and TLS Fallback Lab 10: Enhanced - Basic Clientless SSL VPN Test Clientless SSL VPN Exclusive - Define Browsing Policy in Group Policies Exclusive - Enable DNS Lookups to Facilitate the Portal Define Bookmark Lists for Group Policies Exclusive - Navigating without Using the URL Entry Field Exclusive - WebType ACLs Lab 11: Enhanced - Clientless SSL VPN: Advanced Access Implement and Test Port Forwarding Implement and Test Smart Tunnels Implement and Test SSL VPN Plug-Ins Lab 12: Enhanced - Customizations and Auto Sign- On Update the Customization used by DfltGrpPolicy Update the Customization used by PartnerAccess Exclusive - Auto Sign-On Exclusive - Variable Substitution in URLS OWA with Single Sign-On Lab 13: Enhanced - Cisco Secure Desktop and Dynamic Access Policies Enable the Cisco Secure Desktop Configure CSD Prelogin Policy Test Prelogin Policy Operation Test the Secure Desktop Operation Extended Configuration of CSD Host Scan and Dynamic Access Policy AAA Attributes and DAP Priority of Dynamic Access Policies Lab 14: Enhanced - VPN Server Load Balancing The Topology Exclusive - Configure Dynamic Routing and RRI Configure the Load Balancing Cluster Verify Load Balancing with Clientless SSL VPN Exclusive - Verify Load Balancing with AnyConnect Exclusive - Verify Load Balancing with Easy VPN IPSec Remote Access Explore High Availability Behavior Exclusive - Default Route for Tunneled Traffic Exclusive ASA e-labs: E-Lab 1: Exclusive - The AIP-SSM Recover the AIP-SSM Image Initial Setup of the AIP-SSM AIP-SSM Management Connection Options Configure the ASA's MPF to use the AIP-SSM Inline Verify IPS Operation Tune a Signature and Verify the Result Verify the ASA and AIP-SSM Configurations

7 E-Lab 2: Exclusive - Dynamic Routing: EIGRP and OSPF The Scenario Configure Non-ASA Devices for EIGRP and OSPF Modify the ASA in preparation for Dynamic Routing Configure OSPF on The ASA Configure EIGRP on The ASA Verify Routing Operations Enable Route Redistribution and Verify the Results E-Lab 3: Exclusive - ASA 8.2 to 8.3 Migration Save the 8.2 Configurations Perform the 8.2 to 8.3 Upgrade Test Functionality After the Upgrade Compare the 8.2 and 8.3 Configurations Clean Up the Network Object Names Explore New Features in ASDM 6.3 E-Lab 4: Exclusive - Network Address Translation (ASA 8.3(2)/ASDM 6.3(4)) Configure PAT Configure Dynamic NAT Configure Static NAT Configure Twice NAT Emulate NAT Control E-Lab 5: Exclusive - Basic Access Control (ASA 8.3(2)/ASDM 6.3(4)) Policy Objectives Configure Object Groups Configure Outside Policy Configure ICMP Policy Configure DMZ Policy Configure Inside Policy Unicast Reverse Path Forwarding Enforcement