150x01x.book Page i Monday, June 18, 2007 8:52 AM CCNP ISCW Official Exam Certification Guide Brian Morgan, CCIE No. 4865 Neil Lovering, CCIE No. 1772 Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA 150x01x.book Page ii Monday, June 18, 2007 8:52 AM ii CCNP ISCW Official Exam Certification Guide Brian Morgan, Neil Lovering Copyright © 2008 Cisco Systems, Inc. Cisco Press logo is a trademark of Cisco Systems, Inc. Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the pub- lisher, except for the inclusion of brief quotations in a review. Printed in the United States of America First Printing July 2007 Library of Congress Catalog Card Number 2004117845 ISBN-13: 978-1-58720-150-9 ISBN-10: 1-58720-150-x Warning and Disclaimer This book is designed to provide information about the CCNP 642-825 Implementing Secure Converged Wide Area Networks (ISCW) exam. Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc. shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it. The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc. Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affect- ing the validity of any trademark or service mark. Corporate and Government Sales The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales, which may include electronic versions and/or custom covers and content particular to your business, training goals, marketing focus, and brand- ing interests. For more information, please contact: U.S. Corporate and Government Sales 1-800-382-3419 [email protected] For sales outside the United States, please contact: International Sales [email protected] 150x01x.book Page iii Monday, June 18, 2007 8:52 AM iii Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted with care and pre- cision, undergoing rigorous development that involves the unique expertise of members from the professional technical community. Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through e-mail at [email protected]. Please make sure to include the book title and ISBN in your message. We greatly appreciate your assistance. Publisher: Paul Boger Cisco Representative: Anthony Wolfenden Associate Publisher: Dave Dusthimer Cisco Press Program Manager: Jeff Brady Executive Editor: Mary Beth Ray Technical Editors: Mark Newcomb and Sean Walberg Managing Editor: Patrick Kanouse Copy Editor: Bill McManus Senior Development Editor: Christopher Cleveland Proofreader: Water Crest Publishing Senior Project Editor: Tonya Simpson Editorial Assistant: Vanessa Evans Cover and Book Designer: Louisa Adair Composition: Mark Shirar Indexer: Ken Johnson 150x01x.book Page iv Monday, June 18, 2007 8:52 AM iv About the Authors Brian Morgan, CCIE No. 4865, is a consulting systems engineer for Cisco, specializing in Unified Communications technologies. He services a number of Fortune 500 companies in architectural, design, and support roles. With more than 15 years in the networking industry, he has served as director of engineering for a large telecommunications company, is a certified Cisco instructor teaching at all levels, from basic routing and switching to CCIE lab preparation, and spent a number of years with IBM Network Services serving many of IBM’s largest clients. He is a former member of the ATM Forum and a long-time member of the IEEE. Neil Lovering, CCIE No. 1772, works as a design consultant for Cisco. Neil has been with Cisco for more than three years and works on large-scale government networking solutions projects. Prior to Cisco, Neil was a network consultant and instructor for more than eight years and worked on various routing, switching, remote connectivity, and security projects for many customers all over North America. Contributing Author Mark Newcomb, CCNP, CCDP, is a retired network security engineer. Mark has more than 20 years of experience in the networking industry, focusing on the financial and medical industries. Mark is a frequent contributor and reviewer for Cisco Press books. Mark also served as a technical reviewer for this book. About the Technical Reviewer Sean Walberg is a network engineer from Winnipeg, Canada. He has worked in ISP, healthcare, and corporate environments, designing and supporting LANs, WANs, and Internet hosting. Sean is the author of CCSA Exam Cram 2 and many articles about UNIX, Linux, and VoIP. He holds a bachelor’s degree in computer engineering and is a registered Professional Engineer. 150x01x.book Page v Monday, June 18, 2007 8:52 AM v Dedications To Beth, Amanda, and Emma: Thank you for your love and support. You make life worth living. —Brian Morgan This book is dedicated to my wife, Jody, and my children, Kevin and Michelle, who together give me the inspiration to learn more and dream bigger. —Neil Lovering 150x01x.book Page vi Monday, June 18, 2007 8:52 AM vi Acknowledgments First and foremost, we would like to acknowledge the sacrifices made by our families in allowing us to make the time to write this book. Without their support, it would not have been possible. Thanks to our friends who were not shy about stepping in for a bit of motivational correction when timelines were slipping. As always, a huge thank you goes to the production team. Mary Beth, Chris, and Tonya suffered no end of frustration throughout this writing. They never fully gave up on it, and for that, we are in their debt. 150x01x.book Page vii Monday, June 18, 2007 8:52 AM vii This Book Is Safari Enabled The Safari® Enabled icon on the cover of your favorite technology book means the book is available through Safari Bookshelf. When you buy this book, you get free access to the online edition for 45 days. Safari Bookshelf is an electronic reference library that lets you easily search thousands of technical books, find code samples, download chapters, and access technical information whenever and wherever you need it. To gain 45-day Safari Enabled access to this book: • Go to http://www.ciscopress.com/safarienabled. • Complete the brief registration form. • Enter the coupon code 3ZR2-AU1P-8FRQ-NAPZ-ZZVJ. If you have difficulty registering on Safari Bookshelf or accessing the online edition, please e-mail [email protected]. 150x01x.book Page viii Monday, June 18, 2007 8:52 AM viii Contents at a Glance Foreword xxi Introduction xxii Part I Part I: Remote Connectivity Best Practices 3 Chapter 1 Describing Network Requirements 5 Chapter 2 Topologies for Teleworker Connectivity 33 Chapter 3 Using Cable to Connect to a Central Site 49 Chapter 4 Using DSL to Connect to a Central Site 75 Chapter 5 Configuring DSL Access with PPPoE 109 Chapter 6 Configuring DSL Access with PPPoA 127 Chapter 7 Verifying and Troubleshooting ADSL Configurations 145 Part II Implementing Frame Mode MPLS 165 Chapter 8 The MPLS Conceptual Model 167 Chapter 9 MPLS Architecture 185 Chapter 10 Configuring Frame Mode MPLS 207 Chapter 11 MPLS VPN Technologies 225 Part III IPsec VPNs 249 Chapter 12 IPsec Overview 251 Chapter 13 Site-to-Site VPN Operations 275 Chapter 14 GRE Tunneling over IPsec 327 Chapter 15 IPsec High Availability Options 353 Chapter 16 Configuring Cisco Easy VPN 375 Chapter 17 Implementing the Cisco VPN Client 411 Part IV Device Hardening 429 Chapter 18 Cisco Device Hardening 431 Chapter 19 Securing Administrative Access 459 Chapter 20 Using AAA to Scale Access Control 491 Chapter 21 Cisco IOS Threat Defense Features 519 Chapter 22 Implementing Cisco IOS Firewalls 536 Chapter 23 Implementing Cisco IDS and IPS 563 Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Sections 589 Index 630 150x01x.book Page ix Monday, June 18, 2007 8:52 AM ix Contents Foreword xxi Introduction xxii Part I Remote Connectivity Best Practices 3 Chapter 1 Describing Network Requirements 5 “Do I Know This Already?” Quiz 5 Foundation Topics 9 Describing Network Requirements 9 Intelligent Information Network 9 SONA 11 Networked Infrastructure Layer 13 Interactive Services Layer 13 Application Layer 15 Cisco Network Models 15 Cisco Hierarchical Network Model 16 Campus Network Architecture 17 Branch Network Architecture 19 Data Center Architecture 21 Enterprise Edge Architecture 23 Teleworker Architecture 24 WAN/MAN Architecture 25 Remote Connection Requirements in a Converged Network 27 Central Site 27 Branch Office 27 SOHO Site 28 Integrated Services for Secure Remote Access 28 Foundation Summary 30 Q&A 31 Chapter 2 Topologies for Teleworker Connectivity 33 “Do I Know This Already?” Quiz 33 Foundation Topics 36 Facilitating Remote Connections 36 IIN and the Teleworker 36 Enterprise Architecture Framework 37 Remote Connection Options 38 Traditional Layer 2 Connections 38 Service Provider MPLS VPN 39 Site-to-Site VPN over Public Internet 39 Challenges of Connecting Teleworkers 40 Infrastructure Options 41 Infrastructure Services 42 150x01x.book Page x Monday, June 18, 2007 8:52 AM x Teleworker Components 43 Traditional Teleworker versus Business-Ready Teleworker 45 Foundation Summary 46 Q&A 47 Chapter 3 Using Cable to Connect to a Central Site 49 “Do I Know This Already?” Quiz 49 Foundation Topics 54 Cable Access Technologies 54 Cable Technology Terminology 54 Cable System Standards 56 Cable System Components 56 Cable Features 58 Cable System Benefits 59 Radio Frequency Signals 59 Digital Signals over RF Channels 61 Data over Cable 62 Hybrid Fiber-Coaxial Networks 63 Data Transmission 64 Cable Technology Issues 66 Provisioning Cable Modems 67 Foundation Summary 70 Q&A 72 Chapter 4 Using DSL to Connect to a Central Site 75 “Do I Know This Already?” Quiz 75 Foundation Topics 81 DSL Features 81 POTS Coexistence 83 DSL Limitations 85 DSL Variants 87 Asymmetric DSL Types 87 Symmetric DSL Types 88 ADSL Basics 89 ADSL Modulation 89 CAP 90 DMT 91 Data Transmission over ADSL 93 RFC 1483/2684 Bridging 94 PPP Background 95 PPP over Ethernet 96 Discovery Phase 97 PPP Session Phase 99 PPPoE Session Variables 99 Optimizing PPPoE MTU 100