The complete guide to the most popular Cisco PIX®, ASA, FWSM, and IOS® firewall security features

• Learn about the various firewall models, user interfaces, feature sets, and configuration methods
• Understand how a Cisco firewall inspects traffic
• Configure firewall interfaces, routing, IP addressing services, and IP multicast support
• Maintain security contexts and Flash and configuration files, manage users, and monitor firewalls with SNMP
• Authenticate, authorize, and maintain accounting records for firewall users
• Control access through the firewall by implementing transparent and routed firewall modes, address translation, traffic filtering, user authentication, content filtering, application inspection, and traffic shunning
• Increase firewall availability with firewall failover operation
• Understand how firewall load balancing works
• Generate firewall activity logs and learn how to analyze the contents of the log
• Verify firewall operation and connectivity and observe data passing through a firewall
• Control access and manage activity on the Cisco IOS firewall
• Configure a Cisco firewall to act as an IDS sensor

Every organization has data, facilities, and workflow processes that are critical to their success. As more organizations make greater use of the Internet, defending against network attacks becomes crucial for businesses. Productivity gains and returns on company investments are at risk if the network is not properly defended. Firewalls have emerged as the essential foundation component in any network security architecture.

Cisco ASA and PIX Firewall Handbook is a guide for the most commonly implemented features of the popular Cisco Systems® firewall security solutions. This is the first book to cover the revolutionary Cisco ASA and PIX® version 7 security appliances. This book will help you quickly and easily configure, integrate, and manage the entire suite of Cisco® firewall products, including Cisco ASA, PIX version 7 and 6.3, the Cisco IOS router firewall, and the Catalyst Firewall Services Module (FWSM). Organized by families of features, this book helps you get up to speed quickly and efficiently on topics such as file management, building connectivity, controlling access, firewall management, increasing availability with failover, load balancing, logging, and verifying operation. Shaded thumbtabs mark each section for quick reference and each section provides information in a concise format, with background, configuration, and example components. Each section also has a quick reference table of commands that you can use to troubleshoot or display information about the features presented. Appendixes present lists of well-known IP protocol numbers, ICMP message types, and IP port numbers that are supported in firewall configuration commands and provide a quick reference to the many logging messages that can be generated from a Cisco PIX, ASA, FWSM, or IOS firewall.

Whether you are looking for an introduction to the firewall features of the new ASA security appliance, a guide to configuring firewalls with the new Cisco PIX version 7 operating system, or a complete reference for making the most out of your Cisco ASA, PIX, IOS, and FWSM firewall deployments, Cisco ASA and PIX Firewall Handbook helps you achieve maximum protection of your network resources.

“Many books on network security and firewalls settle for a discussion focused primarily on concepts and theory. This book, however, goes well beyond these topics. It covers in tremendous detail the information every network and security administrator needs to know when configuring and managing market-leading firewall products from Cisco.”

—Jason Nolet, Sr. Director of Engineering, Security Technology Group, Cisco Systems 

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

A guide to successful deployment of the Cisco IP Telephony solution

• Real-world case studies from the Cisco design consulting engineers who developed the PDIOO process provide practical advice on all stages of successful IPT deployment

• Concise understanding of the PDIOO phases enables architects and engineers to successfully deploy the Cisco IPT solution

• Division of the process into PDIOO phases provides a logical and defined guide for network engineers and architects as they proceed through each of the phases in deploying the Cisco IPT solution

• Includes detailed questionnaires for each phase of deployment in the PDIOO cycle—a great aid in understanding customer networks and requirements

• Network infrastructure design, call processing infrastructure design and applications, and voice-mail system design are covered in depth

Cisco® IP Telephony (IPT) solutions are being deployed at an accelerated rate, and network architects and engineers need to understand the various phases involved in successful deployment: planning, design, implementation, operation, and optimization (PDIOO). On the road to that understanding, those involved need to collect information for each phase of deployment, and then follow through with the best architecture, deployment model, and implementation based on the data collected.

Cisco IP Telephony: Planning, Design, Implementation, Operation, and Optimization is a guide for network architects and engineers as they deploy the Cisco IPT solution. With this book, you will master the PDIOO phases of the IPT solution, beginning with the requirements necessary for effective planning of a large-scale IPT network. From there, you’ll follow a step-by-step approach to choose the right architecture and deployment model. Real-world examples and explanations with technical details, design tips, network illustrations, and sample configurations illustrate each step in the process of planning, designing, implementing, operating, and optimizing a chosen architecture based on information you have collected.

In-depth instruction on each PDIOO phase provides specific details about the tasks involved and best practices for successful implementation of the IPT solution. This book also contains predesigned questionnaires and PDIOO assistance tools that help you determine the requirements of each phase of the PDIOO cycle.

Authors Ramesh Kaza and Salman Asadullah have been involved with Cisco IPT solutions from the beginning and have planned, designed, and implemented major IPT networks using the guidelines found here. Cisco IP Telephony: Planning, Design, Implementation, Operation, and Optimization provides the step-by-step explanations, details, and best practices acquired by the authors while working with the top Cisco IPT customers.

This book is part of the Networking Technology Series from Cisco Press®, which offers networking professionals valuable information for constructing efficient networks, understanding new technologies, and building successful careers.

A practical guide to hardening MPLS networks 

• Define "zones of trust" for your MPLS VPN environment
• Understand fundamental security principles and how MPLS VPNs work
• Build an MPLS VPN threat model that defines attack points, such as VPN separation, VPN spoofing, DoS against the network’s backbone, misconfigurations, sniffing, and inside attack forms
• Identify VPN security requirements, including robustness against attacks, hiding of the core infrastructure, protection against spoofing, and ATM/Frame Relay security comparisons
• Interpret complex architectures such as extranet access with recommendations of Inter-AS, carrier-supporting carriers, Layer 2 security considerations, and multiple provider trust model issues
• Operate and maintain a secure MPLS core with industry best practices
• Integrate IPsec into your MPLS VPN for extra security in encryption and data origin verification
• Build VPNs by interconnecting Layer 2 networks with new available architectures such as virtual private wire service (VPWS) and virtual private LAN service (VPLS)
• Protect your core network from attack by considering Operations, Administration, and Management (OAM) and MPLS backbone security incidents 

Multiprotocol Label Switching (MPLS) is becoming a widely deployed technology, specifically for providing virtual private network (VPN) services. Security is a major concern for companies migrating to MPLS VPNs from existing VPN technologies such as ATM. Organizations deploying MPLS VPNs need security best practices for protecting their networks, specifically for the more complex deployment models such as inter-provider networks and Internet provisioning on the network.

MPLS VPN Security is the first book to address the security features of MPLS VPN networks and to show you how to harden and securely operate an MPLS network. Divided into four parts, the book begins with an overview of security and VPN technology. A chapter on threats and attack points provides a foundation for the discussion in later chapters. Part II addresses overall security from various perspectives, including architectural, design, and operation components. Part III provides practical guidelines for implementing MPLS VPN security. Part IV presents real-world case studies that encompass details from all the previous chapters to provide examples of overall secure solutions.

Drawing upon the authors’ considerable experience in attack mitigation and infrastructure security, MPLS VPN Security is your practical guide to understanding how to effectively secure communications in an MPLS environment.

"The authors of this book, Michael Behringer and Monique Morrow, have a deep and rich understanding of security issues, such as denial-of-service attack prevention and infrastructure protection from network vulnerabilities. They offer a very practical perspective on the deployment scenarios, thereby demystifying a complex topic. I hope you enjoy their insights into the design of self-defending networks."

—Jayshree V. Ullal, Senior VP/GM Security Technology Group, Cisco Systems®

Exposes the inner workings of Cisco CallManager to help you maximize your Cisco IP Communications solution

• Read new content on QSIG, SIP trunks, video support, hunt lists and line groups, time-of-day routing, and new features added in CallManager releases 3.2, 3.3, 3.4, 4.0, and 4.1
• Review content from the first edition that has been fully revised and updated to CallManager release 4.1
• Learn how to deploy and manage a CallManager solution
• Understand the components that make up CallManager call routing through the use of basic to advanced examples that solve enterprise call routing problems
• Gain a full understanding of how CallManager manages media resources and processes information for conferencing, transcoding, annunciation, and more
• Learn detailed information about North American and international dial plans, trunk and station devices, media resources, and much more 

Cisco CallManager Fundamentals, Second Edition, provides examples and reference information about Cisco® CallManager, the call-processing component of the Cisco IP Communications solution. Cisco CallManager Fundamentals uses examples and architectural descriptions to explain how CallManager processes calls. This book details the inner workings of CallManager so that those responsible for designing and maintaining a Voice over IP (VoIP) solution from Cisco Systems® can understand the role each component plays and how they interrelate.

This book is the perfect resource to supplement your understanding of CallManager. You’ll learn detailed information about dial plan management and call routing, hardware and software components, media processing, call detail records, system management and monitoring, and the history of CallManager. The authors, all members of the original team that developed and implemented the CallManager software and documentation from its early stages, also provide a list of features and Cisco solutions that integrate with CallManager.

This second edition of Cisco CallManager Fundamentals covers software releases through release 4.1. With this book, you will gain a deeper understanding of the system and find answers to questions not available in any other source.

This book is part of the Cisco Press® Fundamentals Series. Books in this series introduce networking professionals to new networking technologies, covering network topologies, example deployment concepts, protocols, and management techniques.

Telephony solutions for the small and medium business, enterprise branch office, and small office

• Detailed information not available in any other resource enables you to deploy IP telephony solutions with maximum efficiency
• Building blocks of the product features provide solutions that enhance the operations and productivity of your organization
• Numerous examples show you how to configure the comprehensive suite of features available with Cisco IPC Express
• Insights from the experts demonstrate how you can enhance your IP telephony system with applications such as automated attendant and voice mail
• Management and troubleshooting tips will help you keep your network up and running smoothly

Enterprise branches and small and medium businesses require IP telephony solutions particular to their size. Cisco® IP Communications (IPC) Express is the answer: a one-box solution that provides turnkey operation with an easy-to-use web-based interface for combined voice and data needs. Cisco IPC Express delivers a comprehensive suite of telephony features, security, and applications–but how will you use them to your best advantage?

This book, Cisco IP Communications Express, provides the detailed information you need to maximize the use of this powerful product suite. By reading this book, you will learn how Cisco IPC Express and its applications can become a business solution for your office or enterprise. The experts from Cisco Systems® give you in-depth design guidance, full configurations, and valuable examples to serve as blueprints for your network. The feature operation and deployment discussions demonstrate how to configure and customize the system and how to use different product features to achieve your specific business goals. Once you deploy your solutions, you will be able to maintain your network through the troubleshooting guidance and examples of resolutions to common problems provided in this book.

Cisco IP Communications Express is a must-have for any organization using Cisco CallManager Express or Cisco Unity® Express. Technology decision makers and network administrators will be armed with relevant information on how to deploy IP communications for their particular business needs. IT managers in larger enterprises will benefit from the plans for distributed call processing design for their networks. Service providers and resellers will be prepared to sell, install, configure, and troubleshoot Cisco IPC Express based on customer needs.  Beyond its application in the workspace, Cisco IP Communications Express will also prove helpful to those studying for Cisco voice-related certifications.

This IP communications book is part of the Cisco Press® Networking Technology Series. IP communications titles from Cisco Press help networking professionals understand voice and IP telephony technologies, plan and design converged networks, and implement network solutions for increased productivity.

Prevent security breaches by protecting endpoint systems with Cisco Security Agent, the Cisco host Intrusion Prevention System

• Secure your endpoint systems with host IPS
• Build and manipulate policies for the systems you wish to protect
• Learn how to use groups and hosts in the Cisco Security Agent architecture and how the components are related
• Install local agent components on various operating systems
• Explore the event database on the management system to view and filter information
• Examine Cisco Security Agent reporting mechanisms for monitoring system activity
• Apply Application Deployment Investigation to report on installed applications, hotfixes, and service packs
• Collect detailed information on processes and see how they use and are used by system resources
• Create and tune policies to control your environment without impacting usability
• Learn how to maintain the Cisco Security Agent architecture, including administrative access roles and backups

Cisco Security Agent presents a detailed explanation of Cisco Security Agent, illustrating the use of host Intrusion Prevention Systems (IPS) in modern self-defending network protection schemes. At the endpoint, the deployment of a host IPS provides protection against both worms and viruses. Rather than focusing exclusively on reconnaissance phases of network attacks a host IPS approaches the problem from the other direction, preventing malicious activity on the host by focusing on behavior. By changing the focus to behavior, damaging activity can be detected and blocked–regardless of the attack.

Cisco Security Agent is an innovative product in that it secures the portion of corporate networks that are in the greatest need of protection–the end systems. It also has the ability to prevent a day-zero attack, which is a worm that spreads from system to system, taking advantage of vulnerabilities in networks where either the latest patches have not been installed or for which patches are not yet available. Cisco Security Agent utilizes a unique architecture that correlates behavior occurring on the end systems by monitoring clues such as file and memory access, process behavior, COM object access, and access to shared libraries as well as other important indicators.

Cisco Security Agent is the first book to explore the features and benefits of this powerful host IPS product. Divided into seven parts, the book provides a detailed overview of Cisco Security Agent features and deployment scenarios. Part I covers the importance of endpoint security. Part II examines the basic components of the Cisco Security Agent architecture. Part III addresses agent installation and local use. Part IV discusses the Cisco Security Agent management console’s reporting and monitoring capabilities. Part V covers advanced Cisco Security Agent analysis features. Part VI covers Cisco Security Agent policy, implementation, and management. Part VII presents additional installation and management information.

Whether you are evaluating host IPS in general or looking for a detailed deployment guide for Cisco Security Agent, this book will help you lock down your endpoint systems and prevent future attacks.

“While there are still a lot of ways that security can go wrong, Cisco Security Agent provides a defense even when something is wrong. I remember the email that came around from our system administrator that said, ‘There’s something attacking our web server. We’re not sure what it is, but Stormwatch is blocking it.’ That was the Nimda worm–the first of a long line of attacks stopped by Cisco Security Agent.”

–Ted Doty, Product Manager, Security Technology Group, Cisco Systems®

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

An indispensable step-by-step configuration guide for IP Telephony professionals 

• Includes step-by-step configuration instructions for CallManager features and Unity administration tasks
• Demonstrates how to deploy devices and implement your dial plan
• Covers Call Admission Control features and class of service
• Examines different subscriber types and how subscribers are added, imported, and managed
• Includes step-by-step instructions for call handling and auto attendant configuration
• Describes how to use Unity and CallManager together to deliver unique features

To properly deploy any type of technology, networking professionals must understand not only the technology but also how to configure and integrate it with other solutions. That’s the key to Configuring CallManager and Unity–it focuses on the configuration issues associated with CallManager and Unity® deployments while ensuring that you understand the technologies behind your deployment.

Configuring CallManager and Unity includes step-by-step guides that system administrators and other networking professionals can use in the field. These step-by-step instructions have been worked out by an author who has both taught and implemented Cisco® solutions in real-world situations, so coverage is comprehensive for both basic and complex implementations. You will find information that will assist in the configuration of CallManager-related tasks, such as device configuration, gateway implementation, and dial-plan creation to name a few. You will also find Unity-related configuration tasks, ranging from the basics, such as holiday and schedule configuration, to more involved tasks, such as Simple Mail Transfer Protocol (SMTP) networking implementation. In addition to covering Unity and CallManager tasks, this book includes a chapter on leveraging the capabilities of both systems to create integrated solutions, such as a MeetMe conference manager.

Tasks in Configuring CallManager and Unity are organized in the same order you would naturally perform them, and some tasks are cross-referenced with other required tasks for easy reference. You learn not only how to configure CallManager and Unity but also how to create a more feature-rich environment by leveraging CallManager and Unity features. Regardless of your specific needs, you’ll find Configuring CallManager and Unity to be a timesaving tool when performing common or complicated configuration tasks.

This IP communications book is part of the Cisco Press® Networking Technology Series. IP communications titles from Cisco Press help networking professionals understand voice and IP telephony technologies, plan and design converged networks, and implement network solutions for increased productivity.

The definitive design and deployment guide for secure virtual private networks

• Learn about IPSec protocols and Cisco IOS IPSec packet processing
• Understand the differences between IPSec tunnel mode and transport mode
• Evaluate the IPSec features that improve VPN scalability and fault tolerance, such as dead peer detection and control plane keepalives
• Overcome the challenges of working with NAT and PMTUD
• Explore IPSec remote-access features, including extended authentication, mode-configuration, and digital certificates
• Examine the pros and cons of various IPSec connection models such as native IPSec, GRE, and remote access
• Apply fault tolerance methods to IPSec VPN designs
• Employ mechanisms to alleviate the configuration complexity of a large- scale IPSec VPN, including Tunnel End-Point Discovery (TED) and Dynamic Multipoint VPNs (DMVPN)
• Add services to IPSec VPNs, including voice and multicast
• Understand how network-based VPNs operate and how to integrate IPSec VPNs with MPLS VPNs

Among the many functions that networking technologies permit is the ability for organizations to easily and securely communicate with branch offices, mobile users, telecommuters, and business partners. Such connectivity is now vital to maintaining a competitive level of business productivity. Although several technologies exist that can enable interconnectivity among business sites, Internet-based virtual private networks (VPNs) have evolved as the most effective means to link corporate network resources to remote employees, offices, and mobile workers. VPNs provide productivity enhancements, efficient and convenient remote access to network resources, site-to-site connectivity, a high level of security, and tremendous cost savings.

IPSec VPN Design is the first book to present a detailed examination of the design aspects of IPSec protocols that enable secure VPN communication. Divided into three parts, the book provides a solid understanding of design and architectural issues of large-scale, secure VPN solutions. Part I includes a comprehensive introduction to the general architecture of IPSec, including its protocols and Cisco IOS® IPSec implementation details. Part II examines IPSec VPN design principles covering hub-and-spoke, full-mesh, and fault-tolerant designs. This part of the book also covers dynamic configuration models used to simplify IPSec VPN designs. Part III addresses design issues in adding services to an IPSec VPN such as voice and multicast. This part of the book also shows you how to effectively integrate IPSec VPNs with MPLS VPNs.

IPSec VPN Design provides you with the field-tested design and configuration advice to help you deploy an effective and secure VPN solution in any environment.

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Real-world solutions for Cisco IOS® Mobile IP configuration, troubleshooting, and management

• Understand the concept of mobility and the requirements of mobility protocols
• Learn necessary components of a Mobile IP network, including features, functions, and message flows
• Examine security concepts related to Mobile IP, including protocol authentication and dynamic keying
• Evaluate high availability solutions and integration with AAA servers in campus networks
• Explore the features of metro mobility, including reverse tunneling, firewall, NAT traversal, and integration with VPN technologies
• Configure IOS Mobile IP networks, including integration topics such as redundancy, QoS, and VPN
• Manage the Mobile IP infrastructure, including Home Address management, scalability considerations, and network management
• Take a look at the future of Mobile IP, including Layer 2 integration challenges, Mobile IPv6, unstructured mobility, and mobile ad-hoc networking

Two of the world’s most powerful technology trends, the Internet and mobile communications, are redefining how and when people access information. With the majority of information and new services being deployed over IP, the use of devices such as cellular phones, PDAs, and laptops for accessing data networks is pushing the need for “always on” IP connectivity. The evolution of mobile computing points to a coming together of the best of desktop computing and cellular communications—the predictability and "always connected" experience of the desktop combined with the ease of use and mobility of the cell phone.

One challenge to mobile data communication is moving data across different networks. The solution to this problem is a standards-based protocol: Mobile IP. Mobile IP is an open standard that allows users to keep the same IP address, stay connected, and maintain ongoing applications while roaming between IP networks.

Mobile IP Technology and Applications is the first book to address the practical application of Mobile IP in real-world environments. Cisco IOS® Mobile IP configuration, troubleshooting, and management are covered in depth and supported by real-world examples. Mobility solutions addressed in this book include enterprise campus wireless LANs and metropolitan mobility for both individual devices and whole networks. Each example is designed to teach configuration, management, and troubleshooting in a manner that is directly applicable to common mobility needs.

Whether you are looking for an introduction to IP mobility or detailed examples of Mobile IP technology in action, Mobile IP Technology and Applications is your complete resource for reaping the benefits that secure, reliable mobile communications have to offer.

"IP Mobility provides the capability not only for me to connect to the world at large, but for it to find and connect to me."

—Fred Baker, Cisco Fellow, Cisco Systems, Inc.

This book is part of the Cisco Press® Networking Technology Series, which offers networking professionals valuable information for constructing efficient networks, understanding emerging technologies, and building successful networking careers.

Understand the total cost of ownership and return on investment for network security solutions

• Understand what motivates hackers and how to classify threats
• Learn how to recognize common vulnerabilities and common types of attacks
• Examine modern day security systems, devices, and mitigation techniques
• Integrate policies and personnel with security equipment to effectively lessen security risks
• Analyze the greater implications of security breaches facing corporations and executives today
• Understand the governance aspects of network security to help implement a climate of change throughout your organization
• Learn how to qualify your organization’s aversion to risk
• Quantify the hard costs of attacks versus the cost of security technology investment to determine ROI
• Learn the essential elements of security policy development and how to continually assess security needs and vulnerabilities

The Business Case for Network Security: Advocacy, Governance, and ROI addresses the needs of networking professionals and business executives who seek to assess their organization’s risks and objectively quantify both costs and cost savings related to network security technology investments. This book covers the latest topics in network attacks and security. It includes a detailed security-minded examination of return on investment (ROI) and associated financial methodologies that yield both objective and subjective data. The book also introduces and explores the concept of return on prevention (ROP) and discusses the greater implications currently facing corporations, including governance and the fundamental importance of security, for senior executives and the board.

Making technical issues accessible, this book presents an overview of security technologies that uses a holistic and objective model to quantify issues such as ROI, total cost of ownership (TCO), and risk tolerance. This book explores capital expenditures and fixed and variable costs, such as maintenance and upgrades, to determine a realistic TCO figure, which in turn is used as the foundation in calculating ROI. The importance of security policies addressing such issues as Internet usage, remote-access usage, and incident reporting is also discussed, acknowledging that the most comprehensive security equipment will not protect an organization if it is poorly configured, implemented, or used. Quick reference sheets and worksheets, included in the appendixes, provide technology reviews and allow financial modeling exercises to be performed easily.

An essential IT security-investing tool written from a business management perspective, The Business Case for Network Security: Advocacy, Governance, and ROI helps you determine the effective ROP for your business.

This volume is in the Network Business Series offered by Cisco Press®. Books in this series provide IT executives, decision makers, and networking professionals with pertinent information about today’s most important technologies and business strategies.