Objectives

The goal of the training is for Pre-Sale Engineers to obtain the knowledge and experience to feel confident in interfacing with their customers with the identified products (IPS, CSA, ASA, ISR) and solutions from Cisco Systems. Ascolta will demonstrate how IPS, CSA, ASA, and ISR can help protect networks and data traffic from security threats that help balance technologies and processes to generate a comprehensive security defense.

Upon completing the course, the learner will be able to meet these overall objectives:

Implementing Cisco Intrusion Prevention Systems v6.0 (IPS)

• Explain how Cisco IPS protects network devices from attacks
• Install and configure the basic settings on a Cisco IPS 4200 Series Sensor
• Configure some of the more advanced features of the Cisco IPS product line
• Initialize and install into your environment the rest of the Cisco IPS family of products

Cisco Security Agent (CSA) v5.2

• CSA overview - functionality, components and architecture
• CSAMC install - overview, system requirements for management console
• CSAMC quick start configuration - configure a group, build an agent kit, view registered hosts, configure a policy, attach a policy to a group and generate rule programs
• CSAMC administration - accessing and using the management console
• Configure groups and manage hosts.
• Build agent kits and distributing software updates

Cisco Adaptive Security Appliances (ASA) v5.0

• Describe firewall technology and security appliance features
• Describe security appliance models, option cards, and licenses
• Configure security appliance management
• Install the Cisco Adaptive Security Device Manager and use it to configure and monitor a security appliance

Cisco Integrated Service Router

• Understand and describe ISR and NAC
• Identify and describe the advanced capabilities of the IOS-IPS feature
• Introduction to IOS Firewall Authentication Proxy

Course Recommendation and Outlines

Ascolta has identified with Cisco Systems a tailored curriculum to best meet the training needs of Pre-sales Engineers.

Traditionally set as three (4) separate curriculums (IPS, CSA, ASA, ISR), Ascolta presents a modified single course to meet the (2.5) day delivery time frame specified.

Course: Cisco Security Solutions – IPS, CSA, ASA, ISR
Recommended Audience: Pre-Sales Engineers
Duration: 2.5 days

The following course outline presents a fundamental foundation of IPS, CSA, ASA, and ISR so that Sales Engineers can properly understand, leverage, and demonstrate the interoperability of these technologies.

Lab Exercises

• Lab Exercise: Bringing Up an ASA
• Lab Exercise: Initializing the Cisco IPS
• Lab Exercise: Demonstrating a Vulnerable Network
• Lab Exercise: Using the ASA to Prevent Automated Attacks
• Lab Exercise: Using the IPS to Prevent Automated Attacks
• Lab Exercise: Installing CSA Management Console and Agent
• Lab Exercise: Configuring Groups, Policies, and Rules

CSA Content

• Explain the concept of network defense in depth
• Describe Cisco Security Agent architecture
• Describe the life cycle of an attack
• Explain how Cisco Security Agent protects against attacks
• Identify the CSA MC and CSA system requirements
• Identify the administration workstation requirements
• Install the CSA MC
• Configure basic settings on the CSA MC
• Install the CSA using a default group
• Describe various components of the menu bar and its function in the CSA MC interface
• Create, save, and delete data on the CSA MC
• Create groups to ease host management and security policy deployment
• Build Agent kits for the newly created groups
• View host status and modify host configuration
• Discuss components of a policy
• Configure policies and rule modules

IPS Content

• List sensor requirements for inline operations
• Explain the difference between inline and promiscuous mode sensor operations
• Explain how Cisco IPS protects network devices from attacks (Describe signatures, alerts, and actions)
• Explain the evasive techniques used by hackers and how Cisco IPS defeats those techniques
• Describe the considerations necessary for selection, placement, and deployment of a network intrusion prevention system
• Explain the Cisco IPS signature features
• Explain AIP-SSM functionalities
• Use the CLI to initialize the sensor
• Configure user accounts and explain the different user roles
• Configure management access to the sensor appliance
• Explain how allowed hosts are used and how they are configured
• Describe sensor interfaces, interface pairs, VLAN-pairs, and VLAN-groups
• Use the Cisco IDM to configure sensor interfaces (enable, create pairs, assign to virtual sensors)
• Describe and configure software bypass
• Describe sensor communications with external management and monitoring systems
• Launch, navigate, and use the Cisco IDM to manage and monitor the sensor
• List the tasks for installing and configuring the IDSM-2 and AIP-SSM
• Plan the mitigation of specific network vulnerabilities and exploits
• Describe sensor tuning
• Explain IP fragment and TCP stream reassembly options
• Explain how IP logging should be used and how it is configured
• Explain the use of Event Variables
• Describe signature engines and their functionality
• Determine which response actions need to be configured for a given scenario
• Describe the purpose of the Meta Event Generator
• Explain Target Value Ratings and how they are used
• Determine the need for Event Action Rules in a given scenario
• Explain event Risk Ratings and how they are used

ASA Content

• Describe the Security Appliance hardware and software architecture
• Determine the Security Appliance hardware and software configuration and verify if it is correct
• Use setup or the CLI to configure basic network settings, including interface configurations
• Use appropriate show commands to verify initial configurations
• Configure NAT and global addressing to meet user requirements
• Configure logging options
• Describe the firewall technology
• Explain the information contained in syslog files
• Configure static address translations
• Configure Network Address Translations: PAT
• Verify network address translation operation
• Configure access-lists to filter traffic based on address, time, and protocols
• Configure object-groups to optimize access-list processing
• Configure Network Address Translations: Nat0
• Configure Network Address Translations: Policy NAT
• Configure java/activeX filtering
• Configure URL filtering
• Verify inbound traffic restrictions
• Configure static port redirection
• Configure a net static
• Set embryonic and connection limits on the Security Appliance

ISR Content

• Describe Cisco Network Admission Control
• Why Network Admission Control?
• What is Network Admission Control?
• Benefits of NAC.
• Cisco NAC Components
• NAC System Architecture
• Posture Validation Flow
• Explain on which routers NAC is supported.
• Define the Cisco IOS Firewall
• Describe the operational strengths and weaknesses of the different firewall technologies
• Explain stateful firewall operations and the function of the state table
• Explain the types of NAT that can be implemented in a firewall
• Configure and verify basic and advanced firewall features on a Cisco router
• Introduction to IOS Firewall Authentication Proxy
• AAA Server Configuration
• AAA Configuration
• Authentication Proxy Configuration
• Test and Verify Authentication Proxy
• Identify and describe the advanced capabilities of the IOS-IPS feature
• Configure the IPS features to identify threats and dynamically block them from entering the network