Techniques for optimizing large-scale IP routing operation and managing network growth 

• Understand the goals of scalable network design, including tradeoffs between network scaling, convergence speed, and resiliency
• Learn basic techniques applicable to any network design, including hierarchy, addressing, summarization, and information hiding
• Examine the deployment and operation of EIGRP, OSPF, and IS-IS protocols on large-scale networks
• Understand when and how to use a BGP core in a large-scale network and how to use BGP to connect to external networks
• Apply high availability and fast convergence to achieve 99.999 percent, or “five 9s” network uptime
• Secure routing systems with the latest routing protocol security best practices
• Understand the various techniques used for carrying routing information through a VPN

Optimal Routing Design provides the tools and techniques, learned through years of experience with network design and deployment, to build a large-scale or scalable IP-routed network. The book takes an easy-to-read approach that is accessible to novice network designers while presenting invaluable, hard-to-find insight that appeals to more advanced-level professionals as well.

Written by experts in the design and deployment of routing protocols, Optimal Routing Design leverages the authors’ extensive experience with thousands of customer cases and network designs. Boiling down years of experience into best practices for building scalable networks, this book presents valuable information on the most common problems network operators face when seeking to turn best effort IP networks into networks that can support Public Switched Telephone Network (PSTN)-type availability and reliability.

Beginning with an overview of design fundamentals, the authors discuss the tradeoffs between various competing points of network design, the concepts of hierarchical network design, redistribution, and addressing and summarization. This first part provides specific techniques, usable in all routing protocols, to work around real-world problems. The next part of the book details specific information on deploying each interior gateway protocol (IGP)–including EIGRP, OSPF, and IS-IS–in real-world network environments. Part III covers advanced topics in network design, including border gateway protocol (BGP), high-availability, routing protocol security, and virtual private networks (VPN). Appendixes cover the fundamentals of each routing protocol discussed in the book; include a checklist of questions and design goals that provides network engineers with a useful tool when evaluating a network design; and compare routing protocols strengths and weaknesses to help you decide when to choose one protocol over another or when to switch between protocols.

“The complexity associated with overlaying voice and video onto an IP network involves thinking through latency, jitter, availability, and recovery issues. This text offers keen insights into the fundamentals of network architecture for these converged environments.”

–John Cavanaugh, Distinguished Services Engineer, Cisco Systems®

This book is part of the Networking Technology Series from Cisco Press‚ which offers networking professionals valuable information for constructing efficient networks, understanding new technologies, and building successful careers.

The definitive design and deployment guide for secure virtual private networks

• Learn about IPSec protocols and Cisco IOS IPSec packet processing
• Understand the differences between IPSec tunnel mode and transport mode
• Evaluate the IPSec features that improve VPN scalability and fault tolerance, such as dead peer detection and control plane keepalives
• Overcome the challenges of working with NAT and PMTUD
• Explore IPSec remote-access features, including extended authentication, mode-configuration, and digital certificates
• Examine the pros and cons of various IPSec connection models such as native IPSec, GRE, and remote access
• Apply fault tolerance methods to IPSec VPN designs
• Employ mechanisms to alleviate the configuration complexity of a large- scale IPSec VPN, including Tunnel End-Point Discovery (TED) and Dynamic Multipoint VPNs (DMVPN)
• Add services to IPSec VPNs, including voice and multicast
• Understand how network-based VPNs operate and how to integrate IPSec VPNs with MPLS VPNs

Among the many functions that networking technologies permit is the ability for organizations to easily and securely communicate with branch offices, mobile users, telecommuters, and business partners. Such connectivity is now vital to maintaining a competitive level of business productivity. Although several technologies exist that can enable interconnectivity among business sites, Internet-based virtual private networks (VPNs) have evolved as the most effective means to link corporate network resources to remote employees, offices, and mobile workers. VPNs provide productivity enhancements, efficient and convenient remote access to network resources, site-to-site connectivity, a high level of security, and tremendous cost savings.

IPSec VPN Design is the first book to present a detailed examination of the design aspects of IPSec protocols that enable secure VPN communication. Divided into three parts, the book provides a solid understanding of design and architectural issues of large-scale, secure VPN solutions. Part I includes a comprehensive introduction to the general architecture of IPSec, including its protocols and Cisco IOS® IPSec implementation details. Part II examines IPSec VPN design principles covering hub-and-spoke, full-mesh, and fault-tolerant designs. This part of the book also covers dynamic configuration models used to simplify IPSec VPN designs. Part III addresses design issues in adding services to an IPSec VPN such as voice and multicast. This part of the book also shows you how to effectively integrate IPSec VPNs with MPLS VPNs.

IPSec VPN Design provides you with the field-tested design and configuration advice to help you deploy an effective and secure VPN solution in any environment.

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

A guide to successful deployment of the Cisco IP Telephony solution

• Real-world case studies from the Cisco design consulting engineers who developed the PDIOO process provide practical advice on all stages of successful IPT deployment

• Concise understanding of the PDIOO phases enables architects and engineers to successfully deploy the Cisco IPT solution

• Division of the process into PDIOO phases provides a logical and defined guide for network engineers and architects as they proceed through each of the phases in deploying the Cisco IPT solution

• Includes detailed questionnaires for each phase of deployment in the PDIOO cycle—a great aid in understanding customer networks and requirements

• Network infrastructure design, call processing infrastructure design and applications, and voice-mail system design are covered in depth

Cisco® IP Telephony (IPT) solutions are being deployed at an accelerated rate, and network architects and engineers need to understand the various phases involved in successful deployment: planning, design, implementation, operation, and optimization (PDIOO). On the road to that understanding, those involved need to collect information for each phase of deployment, and then follow through with the best architecture, deployment model, and implementation based on the data collected.

Cisco IP Telephony: Planning, Design, Implementation, Operation, and Optimization is a guide for network architects and engineers as they deploy the Cisco IPT solution. With this book, you will master the PDIOO phases of the IPT solution, beginning with the requirements necessary for effective planning of a large-scale IPT network. From there, you’ll follow a step-by-step approach to choose the right architecture and deployment model. Real-world examples and explanations with technical details, design tips, network illustrations, and sample configurations illustrate each step in the process of planning, designing, implementing, operating, and optimizing a chosen architecture based on information you have collected.

In-depth instruction on each PDIOO phase provides specific details about the tasks involved and best practices for successful implementation of the IPT solution. This book also contains predesigned questionnaires and PDIOO assistance tools that help you determine the requirements of each phase of the PDIOO cycle.

Authors Ramesh Kaza and Salman Asadullah have been involved with Cisco IPT solutions from the beginning and have planned, designed, and implemented major IPT networks using the guidelines found here. Cisco IP Telephony: Planning, Design, Implementation, Operation, and Optimization provides the step-by-step explanations, details, and best practices acquired by the authors while working with the top Cisco IPT customers.

This book is part of the Networking Technology Series from Cisco Press®, which offers networking professionals valuable information for constructing efficient networks, understanding new technologies, and building successful careers.

The complete guide to the most popular Cisco PIX®, ASA, FWSM, and IOS® firewall security features

• Learn about the various firewall models, user interfaces, feature sets, and configuration methods
• Understand how a Cisco firewall inspects traffic
• Configure firewall interfaces, routing, IP addressing services, and IP multicast support
• Maintain security contexts and Flash and configuration files, manage users, and monitor firewalls with SNMP
• Authenticate, authorize, and maintain accounting records for firewall users
• Control access through the firewall by implementing transparent and routed firewall modes, address translation, traffic filtering, user authentication, content filtering, application inspection, and traffic shunning
• Increase firewall availability with firewall failover operation
• Understand how firewall load balancing works
• Generate firewall activity logs and learn how to analyze the contents of the log
• Verify firewall operation and connectivity and observe data passing through a firewall
• Control access and manage activity on the Cisco IOS firewall
• Configure a Cisco firewall to act as an IDS sensor

Every organization has data, facilities, and workflow processes that are critical to their success. As more organizations make greater use of the Internet, defending against network attacks becomes crucial for businesses. Productivity gains and returns on company investments are at risk if the network is not properly defended. Firewalls have emerged as the essential foundation component in any network security architecture.

Cisco ASA and PIX Firewall Handbook is a guide for the most commonly implemented features of the popular Cisco Systems® firewall security solutions. This is the first book to cover the revolutionary Cisco ASA and PIX® version 7 security appliances. This book will help you quickly and easily configure, integrate, and manage the entire suite of Cisco® firewall products, including Cisco ASA, PIX version 7 and 6.3, the Cisco IOS router firewall, and the Catalyst Firewall Services Module (FWSM). Organized by families of features, this book helps you get up to speed quickly and efficiently on topics such as file management, building connectivity, controlling access, firewall management, increasing availability with failover, load balancing, logging, and verifying operation. Shaded thumbtabs mark each section for quick reference and each section provides information in a concise format, with background, configuration, and example components. Each section also has a quick reference table of commands that you can use to troubleshoot or display information about the features presented. Appendixes present lists of well-known IP protocol numbers, ICMP message types, and IP port numbers that are supported in firewall configuration commands and provide a quick reference to the many logging messages that can be generated from a Cisco PIX, ASA, FWSM, or IOS firewall.

Whether you are looking for an introduction to the firewall features of the new ASA security appliance, a guide to configuring firewalls with the new Cisco PIX version 7 operating system, or a complete reference for making the most out of your Cisco ASA, PIX, IOS, and FWSM firewall deployments, Cisco ASA and PIX Firewall Handbook helps you achieve maximum protection of your network resources.

“Many books on network security and firewalls settle for a discussion focused primarily on concepts and theory. This book, however, goes well beyond these topics. It covers in tremendous detail the information every network and security administrator needs to know when configuring and managing market-leading firewall products from Cisco.”

—Jason Nolet, Sr. Director of Engineering, Security Technology Group, Cisco Systems 

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Cisco authorized self-study book for CCNP switching foundation learning

Prepare for the CCNP BCMSN exam 642-811 with a Cisco authorized self-study guide. This book teaches you how to:

• Configure basic parameters for Catalyst switches, including SSH, system host name, and IP address management in both Cisco IOS and Cisco CatOS
• Employ private VLANs, VTP, and 802.1Q trunking in Cisco multilayer switched networks
• Deploy 802.1D, 802.1D-2004, 802.1s, and 802.1w STP and utilize advanced spanning-tree features such as UplinkFast and root guard
• Enable Layer 2 features such as including aggressive-mode UDLD, CDP, and Jumbo Ethernet Frames
• Deploy Inter-VLAN routing
• Implement QoS on Catalyst switches at Layers 2 and 3
• Enable Layer 2 and Layer 3 multicasting features such as IGMP snooping
• Employ VRRP, HSRP, and Supervisor Engine redundancy for high availability
• Describe the requirements for IP telephony in multilayer switched networks
• Implement control plane and data plane security features such as 802.1X and DHCP snooping
• Deploy Ethernet over long distances with Metro Ethernet solutions such as DWDM and CDWM

CCNP Self-Study: Building Cisco Multilayer Switched Networks (BCMSN), Third Edition, is a Cisco® authorized, self-paced learning tool for CCNP® switching foundation learning. This book provides you with the knowledge needed to build scalable multilayer switched networks, to create and deploy a global intranet, and to implement basic troubleshooting techniques in environments that use Cisco multilayer switches for client hosts and services. By reading this book, you will learn how to improve traffic flow, reliability, redundancy, performance, and security for Layer 2 and Layer 3 switched networks.

This comprehensive book provides detailed information and easy-to-grasp tutorials on design, configuration, operation, and troubleshooting of modern multilayer switched networks. This book introduces Cisco Catalyst® switching architectures, including Cisco Express Fowarding, ternary content addressable memory (TCAM), and the Cisco 6500, 4500, 3750, 3550, and 2950 series of switches. The book places an emphasis on configuring Cisco Catalyst switches with Cisco IOS® Software, with many chapters covering both Cisco IOS and Cisco CatOS. You will also learn about emerging technologies such as multicasting, security, IP telephony, storage area networking, and quality of service (QoS) as additions to the campus network design. The book concludes with a discussion of troubleshooting methodologies and tools. Each chapter opens with a list of objectives to help focus your study. Lab exercises are offered throughout to help illuminate theoretical concepts. Each chapter concludes with a summary of key concepts as well as review questions to reinforce your understanding.

This revision to the popular second edition is fully updated to include designs using new Catalyst products, references to the Catalyst 6500 Sup720, security updates throughout the entire book as well as added coverage of Dynamic Host Configuration Protocol (DHCP) snooping, Address Resolution Protocol (ARP) inspection, ARP throttling, revised metro coverage, and new discussions on voice virtual LANs (VLAN) and Rapid Spanning Tree Protocol (RSTP).

CCNP Self-Study: Building Cisco Multilayer Switched Networks (BCMSN), Third Edition, is part of a recommended learning path from Cisco Systems® that includes simulation and hands-on training from authorized Cisco Learning Partners and self-study products from Cisco Press. To find out more about instructor-led training, e-learning, and hands-on instruction offered by authorized Cisco Learning Partners worldwide, please visit www.cisco.com/go/authorizedtraining.

Protect critical data and maintain uptime with Cisco ASDM and Cisco Security Agent 

• Understand how attacks can impact your business and the different ways attacks can occur
• Learn about the defense-in-depth model for deploying firewall and host protection
• Examine navigation methods and features of Cisco ASDM
• Set up Cisco ASA, PIX Firewall, and ASDM hardware and software
• Use the Cisco ASDM startup wizard to safely connect your network to the Internet and securely add public devices such as mail and web servers to your network
• Authenticate firewall users and users of public web servers
• Filter traffic and protect your network from perimeter attacks
• Deploy Cisco Intrusion Prevention System (IPS) to provide more granular traffic inspection and proactive threat response
• Stop attacks launched at the desktop by deploying Cisco Security Agent
• Extend the defense-in-depth model to remote users through IPSec virtual private networks (VPN)
• Enhance your security posture through proper security management
• Understand the advanced features available in the Cisco PIX version 7 operating system
• Recover from software failure with Cisco PIX version 7

Many people view security as a “black-box-voodoo” technology that is very sophisticated and intimidating. While that might have been true a few years ago, vendors have been successful in reducing the complexity and bringing security to a point where almost anyone with a good understanding of technology can deploy network security.

Securing Your Business with Cisco ASA and PIX Firewalls is an extension of the work to simplify security deployment. This easy-to-use guide helps you craft and deploy a defense-in-depth solution featuring the newly released Cisco® ASA and PIX® version 7 as well as Cisco Security Agent host intrusion prevention software. The book simplifies configuration and management of these powerful security devices by discussing how to use Cisco Adaptive Security Device Manager (ASDM), which provides security management and monitoring services through an intuitive GUI with integrated online help and intelligent wizards to simplify setup and ongoing management. In addition, informative, real-time, and historical reports provide critical insight into usage trends, performance baselines, and security events. Complete with real-world security design and implementation advice, this book contains everything you need to know to deploy the latest security technology in your network.

Securing Your Business with Cisco ASA and PIX Firewalls provides you with complete step-by-step processes for using Cisco ASDM in conjunction with Cisco Security Agent to ensure that your security posture is strong enough to stand up against any network or host attack whether sourced from the Internet or from inside your own network.

"Firewalls are a critical part of any integrated network security strategy, and books such as this will help raise awareness of both the threats inherent in today’s open, heterogeneous internetworking environments and the solutions that can be applied to make the Internet a safer place."

—Martin E. Hellman, professor emeritus of Electrical Engineering,

Stanford University and co-inventor of public key cryptography

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks. 

The all-in-one practical guide to supporting your Cisco network

• Provides detailed tips for using freeware and open-source tools readily available from the Internet, including the reasons behind choosing a particular tool
• Refer to a single source for common Cisco network administration issues
• Dedicated section for network security aids administrators in effectively dealing with security issues
• Deploy fully functional RADIUS and TACACS+ for servers for controlling access to Cisco devices
• Deploy Linux- and Windows-based syslog servers to centrally collect syslog information generated by Cisco devices
• Deploy Linux- and Windows-based network monitoring systems to monitor interface traffic through Cisco devices including routers, switches, VPN concentrators, and Cisco PIX® firewalls
• Use the trending feature of network monitoring systems for long-term network analysis and capacity planning
• Automatically detect and report configuration changes on Cisco IOS® Software-based devices and Cisco PIX firewalls
• Deploy Cisco-based VPNs in mixed environments using Linux- and Windows-based VPN servers

 Network Administrators Survival Guide solves many common network administration problems by providing administrators with an all-in-one practical guide to supporting Cisco® networks using freeware tools. It is a single reference source that explains particular issues, their significance for administrators, and the installation and configuration process for the tools. The solutions are Cisco centric and provide detail not available in generic online information. Network Administrators Survival Guide emphasizes solutions for network managers and administrators of small to medium-sized businesses and enterprises.

Each chapter is broadly based on a network administration function, starting with an overview of the topic, followed by the methodology involved to accomplish that function. This includes the tools available, why they are the right choice, and their installation, configuration, and usage methods. For any given function, Network Administrators Survival Guide covers both Windows- and Linux-based tools as appropriate. Most of the Windows-based tools offer the advantage of GUI for ease of use, whereas the Linux-based tools are command-line based and can be used in automated scripts. Both are significant for network administrators.

Based on author Anand Deveriya’s extensive field experience, this practical guide to maintaining Cisco networks will save you significant time and money. Any network administrator—beginner or advanced—will find this book useful. The solutions to practical aspects of network administration make Network Administrators Survival Guide a must-have reference for supporting your Cisco network.

Prevent security breaches by protecting endpoint systems with Cisco Security Agent, the Cisco host Intrusion Prevention System

• Secure your endpoint systems with host IPS
• Build and manipulate policies for the systems you wish to protect
• Learn how to use groups and hosts in the Cisco Security Agent architecture and how the components are related
• Install local agent components on various operating systems
• Explore the event database on the management system to view and filter information
• Examine Cisco Security Agent reporting mechanisms for monitoring system activity
• Apply Application Deployment Investigation to report on installed applications, hotfixes, and service packs
• Collect detailed information on processes and see how they use and are used by system resources
• Create and tune policies to control your environment without impacting usability
• Learn how to maintain the Cisco Security Agent architecture, including administrative access roles and backups

Cisco Security Agent presents a detailed explanation of Cisco Security Agent, illustrating the use of host Intrusion Prevention Systems (IPS) in modern self-defending network protection schemes. At the endpoint, the deployment of a host IPS provides protection against both worms and viruses. Rather than focusing exclusively on reconnaissance phases of network attacks a host IPS approaches the problem from the other direction, preventing malicious activity on the host by focusing on behavior. By changing the focus to behavior, damaging activity can be detected and blocked–regardless of the attack.

Cisco Security Agent is an innovative product in that it secures the portion of corporate networks that are in the greatest need of protection–the end systems. It also has the ability to prevent a day-zero attack, which is a worm that spreads from system to system, taking advantage of vulnerabilities in networks where either the latest patches have not been installed or for which patches are not yet available. Cisco Security Agent utilizes a unique architecture that correlates behavior occurring on the end systems by monitoring clues such as file and memory access, process behavior, COM object access, and access to shared libraries as well as other important indicators.

Cisco Security Agent is the first book to explore the features and benefits of this powerful host IPS product. Divided into seven parts, the book provides a detailed overview of Cisco Security Agent features and deployment scenarios. Part I covers the importance of endpoint security. Part II examines the basic components of the Cisco Security Agent architecture. Part III addresses agent installation and local use. Part IV discusses the Cisco Security Agent management console’s reporting and monitoring capabilities. Part V covers advanced Cisco Security Agent analysis features. Part VI covers Cisco Security Agent policy, implementation, and management. Part VII presents additional installation and management information.

Whether you are evaluating host IPS in general or looking for a detailed deployment guide for Cisco Security Agent, this book will help you lock down your endpoint systems and prevent future attacks.

“While there are still a lot of ways that security can go wrong, Cisco Security Agent provides a defense even when something is wrong. I remember the email that came around from our system administrator that said, ‘There’s something attacking our web server. We’re not sure what it is, but Stormwatch is blocking it.’ That was the Nimda worm–the first of a long line of attacks stopped by Cisco Security Agent.”

–Ted Doty, Product Manager, Security Technology Group, Cisco Systems®

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

An indispensable step-by-step configuration guide for IP Telephony professionals 

• Includes step-by-step configuration instructions for CallManager features and Unity administration tasks
• Demonstrates how to deploy devices and implement your dial plan
• Covers Call Admission Control features and class of service
• Examines different subscriber types and how subscribers are added, imported, and managed
• Includes step-by-step instructions for call handling and auto attendant configuration
• Describes how to use Unity and CallManager together to deliver unique features

To properly deploy any type of technology, networking professionals must understand not only the technology but also how to configure and integrate it with other solutions. That’s the key to Configuring CallManager and Unity–it focuses on the configuration issues associated with CallManager and Unity® deployments while ensuring that you understand the technologies behind your deployment.

Configuring CallManager and Unity includes step-by-step guides that system administrators and other networking professionals can use in the field. These step-by-step instructions have been worked out by an author who has both taught and implemented Cisco® solutions in real-world situations, so coverage is comprehensive for both basic and complex implementations. You will find information that will assist in the configuration of CallManager-related tasks, such as device configuration, gateway implementation, and dial-plan creation to name a few. You will also find Unity-related configuration tasks, ranging from the basics, such as holiday and schedule configuration, to more involved tasks, such as Simple Mail Transfer Protocol (SMTP) networking implementation. In addition to covering Unity and CallManager tasks, this book includes a chapter on leveraging the capabilities of both systems to create integrated solutions, such as a MeetMe conference manager.

Tasks in Configuring CallManager and Unity are organized in the same order you would naturally perform them, and some tasks are cross-referenced with other required tasks for easy reference. You learn not only how to configure CallManager and Unity but also how to create a more feature-rich environment by leveraging CallManager and Unity features. Regardless of your specific needs, you’ll find Configuring CallManager and Unity to be a timesaving tool when performing common or complicated configuration tasks.

This IP communications book is part of the Cisco Press® Networking Technology Series. IP communications titles from Cisco Press help networking professionals understand voice and IP telephony technologies, plan and design converged networks, and implement network solutions for increased productivity.