About This E-Book EPUB is an open, industry-standard format for e-books. However, support for EPUB and its many features varies across reading devices and applications. Use your device or app settings to customize the presentation to your liking. Settings that you can customize often include font, font size, single or double column, landscape or portrait mode, and figures that you can click or tap to enlarge. For additional information about the settings and features on your reading device or app, visit the device manufacturer’s Web site. Many titles include programming code or configuration examples. To optimize the presentation of these elements, view the e-book in single-column, landscape mode and adjust the font size to the smallest setting. In addition to presenting code and configurations in the reflowable text format, we have included images of the code that mimic the presentation found in the print book; therefore, where the reflowable format may compromise the presentation of the code listing, you will see a “Click here to view code image” link. Click the link to view the print-fidelity code image. To return to the previous page viewed, click the Back button on your device or app. Cisco Next-Generation Security Solutions All-in-one Cisco ASA FirePOWER Services, NGIPS, and AMP Omar Santos, CISSP No. 463598 Panos Kampanakis, CCIE No. 28561, CISSP No. 367831 Aaron Woland, CCIE No. 20113 800 East 96th Street Indianapolis, IN 46240 Cisco Next-Generation Security Solutions: All-in-one Cisco ASA FirePOWER Services, NGIPS, and AMP Omar Santos, CISSP No. 463598 Panos Kampanakis, CCIE No. 28561, CISSP No. 367831 Aaron Woland, CCIE No. 20113 Copyright © 2017 Cisco Systems, Inc. Cisco Press logo is a trademark of Cisco Systems, Inc. Published by: Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review. Printed in the United States of America First Printing: June, 2016 Library of Congress Control Number: 2016939800 ISBN-13: 978-1-58714-446-2 ISBN-10: 1-58714-446-8 Warning and Disclaimer This book is designed to provide information about Cisco Next-Generation Security Solutions. Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc. shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the discs or programs that may accompany it. The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc. Feedback Information At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of members from the professional technical community. Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through email at [email protected]. Please make sure to include the book title and ISBN in your message. We greatly appreciate your assistance. Trademark Acknowledgments All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc. cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Editor-in-Chief: Mark Taub Product Line Manager: Brett Bartow Executive Editor: Mary Beth Ray Development Editor: Christopher Cleveland Copy Editor: Kitty Wilson Cover Designer: Chuti Prasertsith Indexer: James Minkin Business Operation Manager, Cisco Press: Jan Cornelssen Managing Editor: Sandra Schroeder Senior Project Editor: Tracey Croom Technical Editors: Mason Harris, Foster Lipkey Composition: Bumpy Design Proofreader: Kim Wimpsett Americas Headquarters Cisco Systems. Inc. San Jose, CA Asia Pacific Headquarters Cisco Systems (USA) Pte. Ltd. Singapore Europe Headquarters Cisco Systems International BV Amsterdam, The Netherlands Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices. CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Stadium Vision, Cisco Telepresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work. Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS. Bringing the Meeting To You. Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, Phone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy. Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert. StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R) About the Authors Omar Santos, CISSP No. 463598, is a principal engineer of Cisco’s Product Security Incident Response Team (PSIRT), where he mentors and leads engineers and incident managers during the investigation and resolution of security vulnerabilities in all Cisco products. Omar has held information technology and cybersecurity positions since the mid-1990s. Omar has designed, implemented, and supported numerous secure networks for Fortune 500 companies and the U.S. government. Prior to his current role, he was a technical leader within the World Wide Security Practice and Cisco’s Technical Assistance Center (TAC), where he taught, led, and mentored many engineers. Omar is an active member of the security community, where he leads several industry-wide initiatives and standards bodies. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants that are dedicated to increasing the security of critical infrastructure. Omar has delivered numerous technical presentations at conferences worldwide and to Cisco customers and partners, and he has given C-level executive presentations to many organizations. Omar is the author of the following books and video courses: Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance, 2nd edition Cisco: All-in-One ASA Next-Generation Firewall, IPS, and VPN Services, 3rd edition Cisco Network Admission Control, Volume: Deployment and Management End-to-End Network Security: Defense-in-Depth Network Security with NetFlow and IPFIX: Big Data Analytics for Information Security CCNA Security 210-260 Complete Video Course CCNA Security 210-260 Official Cert Guide Deploying Next-Generation Firewalls LiveLessons The Current Security Threat Landscape Networking Talks LiveLessons Cisco Advanced Malware Protection (AMP) LiveLessons Panos Kampanakis, CCIE No. 28561, CISSP No. 367831, is a technical marketing engineer in Cisco’s Security and Trust Organization (S&TO). He was born in Athens, Greece, and received a five-year degree in electrical and computer engineering from National Technical University of Athens and an MSc from North Carolina State University. His MS thesis was on efficient elliptic curve cryptography and bilinear pairing on sensor networks. Panos has extensive experience with cryptography, security automation, vulnerability management, and cybersecurity. In his professional career, he has supported and provided security advice to multiple Cisco customers. He has trained and presented on various security topics at Cisco Live for numerous years. He has participated in various security standards bodies, providing common interoperable protocols and languages for security information sharing, cryptography, and PKI. Panos has also worked extensively with Cisco’s PSIRT to provide vulnerability mitigations. His current interests include next-generation cryptography, post-quantum cryptography, standards efforts that enable cryptographic implementation interoperability, and IoT security and cryptography. The following are some of his recent publications: Postquantum Preshared Keys for IKEv2 IETF draft https://tools.ietf.org/html/draft-fluhrer-qr-ikev2 BAFi: A Practical Cryptographic Secure Audit Logging Scheme for Digital Forensics. Security Comm. Networks, doi: 10.1002/sec.1242 Eric W. Burger, Michael D. Goodman, Panos Kampanakis, and Kevin A. Zhu. 2014. “Taxonomy Model for Cyber Threat Intelligence Information Exchange Technologies,” in Proceedings of the 2014 ACM Workshop on Information Sharing & Collaborative Security(WISCS ‘14). ACM, New York, NY, USA, 51-60 “Security Automation and Threat Information-Sharing Options, Security & Privacy,” in IEEE, vol.12, no.5, pp.42,51, Sept.-Oct. 2014 Kampanakis, P.; Perros, H.; Beyene, T., SDN-Based Solutions for Moving Target Defense Network Protection, A World of Wireless, Mobile and Multimedia Networks (WoWMoM), 2014 IEEE 15th International Symposium, vol., no., pp.1,6, 19-19 June 2014 IODEF Usage Guidance IETF draft https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance Next Generation Encryption on cisco.com Cisco Firewall Best Practices Guide on cisco.com In his free time, Panos has a passion for basketball, and he never likes to lose. Aaron Woland, CCIE No. 20113, is a principal engineer in Cisco’s Security Business Group and works with Cisco’s largest customers all over the world. His primary job responsibilities include secure access and identity deployments with ISE, solution enhancements, standards development, and futures. Aaron joined Cisco in 2005 and is currently a member of numerous security advisory boards and standards body working groups. Prior to joining Cisco, Aaron spent 12 years as a consultant and technical trainer. His areas of expertise include network and host security architecture and implementation, regulatory compliance, and route switch and wireless. Aaron is one of six inaugural members of the Hall of Fame for Distinguished Speakers at Cisco Live and is a security columnist for Network World, where he blogs on all things related to identity. His other certifications include GHIC, GSEC, Certified Ethical Hacker, MCSE, VCP, CCSP, CCNP, and CCDP. You can follow Aaron on Twitter @aaronwoland. Aaron is the author of the following books and courses, as well as many published white papers and design guides: CCNP Security SISAS 300-208 Official Cert Guide Cisco ISE for BYOD and Secure Unified Access CCNA Security 210-260 Complete Video Course About the Technical Reviewers Foster Lipkey, SFCE, is a senior member of the Cisco Firepower TAC team supporting Firepower, FireSIGHT, AMP for Endpoints, and Threat Grid, as well as third-party integrations. He has been a leader in developing tools and procedures for supporting the Cisco Firepower and AMP security software platforms. Prior to working for Sourcefire/Cisco, he was an applications solutions specialist as a contractor for the National Cancer Institute (NCI), supporting Java enterprise applications for the NCI’s Center for Biomedical Informatics and Information Technology. Foster’s primary areas of interest are enterprise security and security automation. Mason Harris, CCIE No. 5916, is the chief solutions architect at vArmour, a cloud security startup based in Mountain View, California. He is responsible for all enterprise and platform architecture in both private and public cloud deployments. Previously he was a technical solutions architect for Cisco, focusing primarily on security architectures in the data center with Cisco’s 27 largest customers. Mason has more than 24 years of experience in systems architecture and is one the few individuals in the world to have attained five CCIE certifications. He also holds the CISSP, GPEN, and GCIH certifications. When not thinking about security topics, Mason can be found backpacking on long trails or at home with his family. A lifelong UNC Tarheels fan, he holds an undergraduate degree from UNC-Chapel Hill and a master’s degree from NC State University, with a minor in Arabic.