CCSP: Secure Intrusion Detection and SAFE Implementation. Study Guide

Transcription

1

2 CCSP: Secure Intrusion Detection and SAFE Implementation Study Guide

3 This page intentionally left blank

4 CCSP : Secure Intrusion Detection and SAFE Implementation Study Guide Justin Menga Carl Timm San Francisco London

5 Associate Publisher: Neil Edde Acquisitions Editor: Maureen Adams Developmental Editor: Jeff Kellum Production Editor: Elizabeth Campbell Technical Editor: Jason Rohm Copyeditor: Suzanne Goraj Composition and Graphic Illustration: Happenstance Type-O-Rama CD Coordinator: Dan Mummert CD Technician: Kevin Ly Proofreaders: Laurie O Connell, Amy Rasmussen, Nancy Riddiough Indexer: Nancy Guenther Book Designer: Bill Gibson, Judy Fung Cover Designer: Archer Design Cover Illustrator/Photographer: Photodisc and Victor Arre Copyright 2004 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA World rights reserved. The author(s) created reusable code in this publication expressly for reuse by readers. Sybex grants readers limited permission to reuse the code found in this publication or its accompanying CD-ROM so long as the author(s) are attributed in any application containing the reusable code and the code itself is never distributed, posted online by electronic transmission, sold, or commercially exploited as a stand-alone product. Aside from this specific exception concerning reusable code, no part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher. Library of Congress Card Number: ISBN: SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries. Screen reproductions produced with FullShot 99. FullShot Inbit Incorporated. All rights reserved. FullShot is a trademark of Inbit Incorporated. The CD interface was created using Macromedia Director, COPYRIGHT 1994, Macromedia Inc. For more information on Macromedia and Macromedia Director, visit This study guide and/or material is not sponsored by, endorsed by or affiliated with Cisco Systems, Inc. Cisco, Cisco Systems, CCDA, CCNA, CCDP, CCSP, CCIP, BSCI, CCNP, CCIE, CCSI, the Cisco Systems logo and the CCIE logo are trademarks or registered trademarks of Cisco Systems, Inc. in the United States and certain other countries. All other trademarks are trademarks of their respective owners. TRADEMARKS: SYBEX has attempted throughout this book to distinguish proprietary trademarks from descriptive terms by following the capitalization style used by the manufacturer. The author and publisher have made their best efforts to prepare this book, and the content is based upon final release software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied by software manufacturer(s). The author and the publisher make no representation or warranties of any kind with regard to the completeness or accuracy of the contents herein and accept no liability of any kind including but not limited to performance, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged to be caused directly or indirectly from this book. Manufactured in the United States of America

6 To Our Valued Readers: Thank you for looking to Sybex for your Cisco Certified Security Professional exam prep needs. Cisco developed the CCSP certification to validate expertise in designing and implementing secure Cisco internetworking solutions, and it promises to be one of the most highly valued IT certifications available. We at Sybex are proud of the reputation we ve established for providing certification candidates with the practical knowledge and skills needed to succeed in the highly competitive IT marketplace. It has always been Sybex s mission to teach individuals how to utilize technologies in the real world, not to simply feed them answers to test questions. Just as Cisco is committed to establishing measurable standards for certifying those professionals who work in the cutting-edge field of internetworking, Sybex is committed to providing those professionals with the means of acquiring the skills and knowledge they need to meet those standards. The authors, editors, and technical reviewers have worked hard to ensure that this Study Guide is comprehensive, in-depth, and pedagogically sound. We re confident that this book, along with the collection of cutting-edge software study tools included on the CD, will meet and exceed the demanding standards of the certification marketplace and help you, the CCSP certification exam candidate, succeed in your endeavors. Good luck in pursuit of your CCSP certification! Neil Edde Associate Publisher Certification Sybex, Inc.

7 Software License Agreement: Terms and Conditions The media and/or any online materials accompanying this book that are available now or in the future contain programs and/or text files (the "Software") to be used in connection with the book. SYBEX hereby grants to you a license to use the Software, subject to the terms that follow. Your purchase, acceptance, or use of the Software will constitute your acceptance of such terms. The Software compilation is the property of SYBEX unless otherwise indicated and is protected by copyright to SYBEX or other copyright owner(s) as indicated in the media files (the "Owner(s)"). You are hereby granted a single-user license to use the Software for your personal, noncommercial use only. You may not reproduce, sell, distribute, publish, circulate, or commercially exploit the Software, or any portion thereof, without the written consent of SYBEX and the specific copyright owner(s) of any component software included on this media. In the event that the Software or components include specific license requirements or end-user agreements, statements of condition, disclaimers, limitations or warranties ("End-User License"), those End-User Licenses supersede the terms and conditions herein as to that particular Software component. Your purchase, acceptance, or use of the Software will constitute your acceptance of such End-User Licenses. By purchase, use or acceptance of the Software you further agree to comply with all export laws and regulations of the United States as such laws and regulations may exist from time to time. Reusable Code in This Book The author(s) created reusable code in this publication expressly for reuse by readers. Sybex grants readers limited permission to reuse the code found in this publication, its accompanying CD-ROM or available for download from our website so long as the author(s) are attributed in any application containing the reusable code and the code itself is never distributed, posted online by electronic transmission, sold, or commercially exploited as a stand-alone product. Software Support Components of the supplemental Software and any offers associated with them may be supported by the specific Owner(s) of that material, but they are not supported by SYBEX. Information regarding any available support may be obtained from the Owner(s) using the information provided in the appropriate read.me files or listed elsewhere on the media. Should the manufacturer(s) or other Owner(s) cease to offer support or decline to honor any offer, SYBEX bears no responsibility. This notice concerning support for the Software is provided for your information only. SYBEX is not the agent or principal of the Owner(s), and SYBEX is in no way responsible for providing any support for the Software, nor is it liable or responsible for any support provided, or not provided, by the Owner(s). Warranty SYBEX warrants the enclosed media to be free of physical defects for a period of ninety (90) days after purchase. The Software is not available from SYBEX in any other form or media than that enclosed herein or posted to If you discover a defect in the media during this warranty period, you may obtain a replacement of identical format at no charge by sending the defective media, postage prepaid, with proof of purchase to: SYBEX Inc. Product Support Department 1151 Marina Village Parkway Alameda, CA Web: After the 90-day period, you can obtain replacement media of identical format by sending us the defective disk, proof of purchase, and a check or money order for $10, payable to SYBEX. Disclaimer SYBEX makes no warranty or representation, either expressed or implied, with respect to the Software or its contents, quality, performance, merchantability, or fitness for a particular purpose. In no event will SYBEX, its distributors, or dealers be liable to you or any other party for direct, indirect, special, incidental, consequential, or other damages arising out of the use of or inability to use the Software or its contents even if advised of the possibility of such damage. In the event that the Software includes an online update feature, SYBEX further disclaims any obligation to provide this feature for any specific duration other than the initial posting. The exclusion of implied warranties is not permitted by some states. Therefore, the above exclusion may not apply to you. This warranty provides you with specific legal rights; there may be other rights that you may have that vary from state to state. The pricing of the book with the Software by SYBEX reflects the allocation of risk and limitations on liability contained in this agreement of Terms and Conditions. Shareware Distribution This Software may contain various programs that are distributed as shareware. Copyright laws apply to both shareware and ordinary commercial software, and the copyright Owner(s) retains all rights. If you try a shareware program and continue using it, you are expected to register it. Individual programs differ on details of trial periods, registration, and payment. Please observe the requirements stated in appropriate files. Copy Protection The Software in whole or in part may or may not be copy-protected or encrypted. However, in all cases, reselling or redistributing these files without authorization is expressly forbidden except as specifically provided for by the Owner(s) therein.

8 Acknowledgments We would like to thank Maureen Adams and Jeff Kellum for giving us the opportunity to write this Study Guide. We would also like to take a moment to thank everyone else involved in the creation of this book, including Production Editor Elizabeth Campbell, Technical Editor Jason Rohm, Copyeditor Suzanne Goraj, Proofreaders Laurie O Connell, Amy Rasmussen, and Nancy Riddiough, and the CD Team of Dan Mummert and Kevin Ly. Without the help of this wonderful team this book would have never made it to a bookshelf.

9 This page intentionally left blank

10 Contents at a Glance Introduction Assessment Test xix xxxii Part I Cisco Secure Intrusion Detection System Chapter 1 Introduction to Intrusion Detection and Protection 3 Chapter 2 Installing Cisco Secure IDS Sensors and IDSMs 63 Chapter 3 Chapter 4 Configuring the Network to Support Cisco Secure IDS Sensors Configuring Cisco Secure IDS Sensors Using the IDS Device Manager Chapter 5 Configuring Signatures and Using the IDS Event Viewer 299 Chapter 6 Enterprise Cisco Secure IDS Management 393 Chapter 7 Enterprise Cisco Secure IDS Monitoring 493 Part II Cisco SAFE Implementation Chapter 8 Security Fundamentals 555 Chapter 9 The Cisco Security Portfolio 587 Chapter 10 SAFE Small and Medium Network Designs 611 Chapter 11 SAFE Remote Access Network Design 657 Glossary Index 697

11 Contents Introduction Assessment Test xix xxxii Part I Cisco Secure Intrusion Detection System Chapter 1 Introduction to Intrusion Detection and Protection 3 Understanding Security Threats Hacker Characteristics Attack Types Implementing Network Security Securing the Network Monitoring Network Security Testing Network Security Improving Network Security Understanding Intrusion Detection Basics Triggers IDS System Location IDS Evasive Techniques Cisco Secure Intrusion Protection Introduction to Cisco Secure IDS Cisco Secure IDS Features Cisco Secure Sensor Platforms Cisco Secure Director Platforms Cisco Host IDS Platforms Summary Exam Essentials Key Terms Written Lab Review Questions Answers to Written Lab Answers to Review Questions Chapter 2 Installing Cisco Secure IDS Sensors and IDSMs 63 Deploying Cisco Secure IDS Sensor Selection Considerations Sensor Deployment Considerations Installing and Configuring Cisco Secure IDS Sensors Planning the Installation Physically Installing the Sensor

12 Contents xi Gaining Initial Management Access Logging in to the Sensor Configuring the Sensor for the First Time Administering the Sensor Cisco Secure IDS Architecture Summary Exam Essentials Key Terms Commands Used in This Chapter Written Lab Hands-On Lab Lab 2.1: Using the setup Utility Lab 2.2: Configuring the IDS Sensor Using the CLI Lab 2.3: Administering the IDS Sensor Review Questions Answers to Written Lab Answers to Hands-On Labs Answer to Lab 2.1 Answer to Lab 2.2 Answer to Lab 2.3 Answers to Review Questions Chapter 3 Configuring the Network to Support Cisco Secure IDS Sensors129 Capturing Traffic Configuring Traffic Capture for the 4200 Series Sensors Configuring Traffic Capture Using SPAN Configuring Traffic Capture Using RSPAN Configuring Traffic Capture for the IDSM Configuring SPAN for the IDSM-2 Configuring Traffic Capture Using VACLs Configuring Traffic Capture using the mls ip ids Command Configuring the Sensing Interface to Control Trunk Traffic Restricting VLANs on CatOS Restricting VLANs on Cisco IOS Assigning the Command-and-Control Port VLAN Configuring the Command-and-Control VLAN on CatOS Configuring the Command-and-Control VLAN on Cisco IOS Configuring Traffic Capture for the NM-CIDS Summary Exam Essentials Key Terms Written Lab

13 xii Contents Hands-On Labs Lab 3.1: Configuring VSPAN Lab 3.2: Configuring RSPAN Lab 3.3: Configuring VACL Capture on Cisco IOS Lab 3.4: Configuring VACL Capture for Routed Interfaces on Cisco IOS Lab 3.5: Configuring VACL Capture on CatOS Lab 3.6: Configuring SPAN on CatOS Lab 3.7: Assigning the Command-and-Control Interface to a VLAN Review Questions Answer to Written Lab Answer to Lab 3.1 Answer to Lab 3.2 Answer to Lab 3.3 Answer to Lab 3.4 Answer to Lab 3.5 Answer to Lab 3.6 Answer to Lab 3.7 Answers to Review Questions Chapter 4 Configuring Cisco Secure IDS Sensors Using the IDS Device Manager IDS Device Manager Introduction IDM Components and System Requirements Accessing the IDM for the First Time Navigating the IDM Configuring Cisco Secure IDS Sensors Using the IDM Performing Sensor Setup Using the IDM Configuring Intrusion Detection Using the IDM Configuring Blocking Using the IDM Configuring Auto Update Using the IDM Administering and Monitoring Cisco Secure IDS Sensors Using the IDM IDM Administration IDM Monitoring Summary Exam Essentials Key Terms Commands Used in This Chapter Hands-On Labs Lab 4.1: Prepare the Network Lab 4.2: Performing Sensor Setup

14 Contents xiii Lab 4.3: Configuring System Variables Lab 4.4: Configuring Perimeter Devices Lab 4.5: Configuring and Verifying Blocking Lab 4.6: Configuring and Verifying Logging Lab 4.7: Configuring the Sensor Using the Sensor CLI Review Questions Answers to Hands-On Labs Answer to Lab 4.1 Answer to Lab 4.2 Answer to Lab 4.3 Answer to Lab 4.4 Answer to Lab 4.5 Answer to Lab 4.6 Answer to Lab 4.7 Answers to Review Questions Chapter 5 Configuring Signatures and Using the IDS Event Viewer Cisco Secure IDS Signatures Cisco Secure IDS Signature Engines Signature Engine Parameters Configuring Cisco Secure IDS Signatures Configuring Signatures Using the IDM Configuring Signatures Using the CLI Introduction to the IDS Event Viewer Installing the IEV Accessing the IEV for the First Time Configuring the IEV Adding Sensors to the IEV Configuring Filters and Views Creating a View Configuring Application Settings and Preferences Administering the IEV Database Summary Exam Essentials Key Terms Commands Used in This Chapter Written Lab Hands-On Labs Lab 5.1: Configuring Signatures on a Sensor Lab 5.2: Installing the IEV And Adding a Device to the IEV Lab 5.3: Using the Realtime Dashboard Lab 5.4: Creating a Filter Lab 5.5: Creating a View

15 xiv Contents Lab 5.6: Viewing Alarm Information Lab 5.7: Exporting Alarm Information Lab 5.8: Configuring IEV Preferences Review Questions Answers to Written Lab Answers to Hands-On Labs Answer to Lab 5.1 Answer to Lab 5.2 Answer to Lab 5.3 Answer to Lab 5.4 Answer to Lab 5.5 Answer to Lab 5.6 Answer to Lab 5.7 Answer to Lab 5.8 Answers to Review Questions Chapter 6 Enterprise Cisco Secure IDS Management 393 Introduction to CiscoWorks VMS 394 CiscoWorks VMS Components 394 CiscoWorks VMS System Requirements 396 Installing CiscoWorks VMS 400 Installing CiscoWorks Common Services 400 Installing the IDS Management Center and Security Monitoring Center 404 Starting the CiscoWorks Desktop 408 Adding Users 411 Licensing CiscoWorks VMS Components 412 Configuring IDS Sensors Using the IDS MC 414 IDS Management Center Architecture 415 Starting the IDS Management Center 416 Configuring Sensor Groups 418 Adding Sensors to the IDS MC 420 Configuring Sensors Using the IDS MC 423 Saving, Generating, Approving, and Deploying Sensor Configurations 448 Updating Cisco Secure IDS Sensors 455 Administering the IDS MC 457 Configuring System Configuration Settings 457 Configuring Database Rules 459 Configuring Report Settings 463 Summary 465 Exam Essentials 466 Key Terms 467 Written Lab 468