Table Of ContentIntroduction Chapter 1 Firewall Overview 1-1: Overview of Firewall Operation Initial Checking Xlate Lookup Conn Lookup ACL Lookup Uauth Lookup Inspection Engine 1-2: Inspection Engines for ICMP, UDP, and TCP ICMP Inspection UDP Inspection TCP Inspection TCP Normalization Other Firewall Operations 1-3: Hardware and Performance 1-4: Basic Security Policy Guidelines Further Reading Chapter 2 Configuration Fundamentals 2-1: User Interface User Interface Modes User Interface Features 2-2: Firewall Features and Licenses Upgrading a License Activation Key 2-3: Initial Firewall Configuration Chapter 3 Building Connectivity 3-1: Configuring Interfaces Basic Interface Configuration Configuring IPv6 on an Interface Configuring the ARP Cache Configuring Interface MTU and Fragmentation Configuring an Interface Priority Queue Firewall Topology Considerations 3-2: Configuring Routing Using Routing Information to Prevent IP Address Spoofing Configuring Static Routes Configuring RIP to Exchange Routing Information Configuring OSPF to Exchange Routing Information 3-3: DHCP Server Functions Using the Firewall as a DHCP Server Relaying DHCP Requests to a DHCP Server 3-4: Multicast Support Multicast Overview Multicast Addressing Forwarding Multicast Traffic IGMP: Finding Multicast Group Recipients PIM: Building a Multicast Distribution Tree Configuring PIM Configuring Stub Multicast Routing (SMR) Configuring IGMP Operation Stub Multicast Routing Example PIM Multicast Routing Example Verifying IGMP Multicast Operation Verifying PIM Multicast Routing Operation Chapter 4 Firewall Management 4-1: Using Security Contexts to Make Virtual Firewalls Security Context Organization Sharing Context Interfaces Issues with Sharing Context Interfaces Configuration Files and Security Contexts Guidelines for Multiple-Context Configuration Initiating Multiple-Context Mode Navigating Multiple Security Contexts Configuring a New Context Allocating Firewall Resources to Contexts Verifying Multiple-Context Operation 4-2: Managing the Flash File System Using the PIX6.x Flash File System Navigating a PIX 7.x or FWSM Flash File System Administering a PIX 7.x or FWSM Flash File System Identifying the Operating System Image Upgrading an Image from the Monitor Prompt Upgrading an Image from an Administrative Session 4-3: Managing Configuration Files Managing the Startup Configuration Saving a Running Configuration Importing a Configuration 4-4: Managing Administrative Sessions Console Connection Telnet Sessions SSH Sessions PDM/ASDM Sessions User Session Banners Monitoring Administrative Sessions 4-5: Firewall Reloads and Crashes Reloading a Firewall Obtaining Crash Information 4-6: Monitoring a Firewall with SNMP Overview of Firewall SNMP Support SNMP Configuration Chapter 5 Managing Firewall Users 5-1: Managing Generic Users Authenticating and Authorizing Generic Users Accounting of Generic Users 5-2: Managing Users with a Local Database Authenticating with Local Usernames Authorizing Users to Access Firewall Commands Accounting of Local User Activity 5-3: Defining AAA Servers for User Management 5-4: Configuring AAA to Manage Administrative Users Enabling AAA User Authentication <
SynopsisMaster PIX and IOS security features with the ultimate workplace reference Understand, install, and support the most common features of Cisco's best selling PIX and IOS firewall products Save time with a concise reference organized by feature families Learn from configuration examples that graphically illustrate complex procedures Scan important reference information quickly with a standardized organizational structure Cisco PIX Firewall Handbook is a guide to the most commonly implemented features of the top selling Cisco Systems firewall security solutions. Whether a novice or experienced network security engineer, a reader will be able to quickly and easily configure a wide range of Cisco PIX and IOS firewalls. Many features of these devices are complex and require many configuration steps for proper operation. The required commands are difficult to remember or require lengthy reading through the Cisco Documentation CD, and the Cisco PIX firewall has very limited context-based help, and the documentation is formatted quite differently from other products. quickly and correctly configure PIX Firewall features. As features and commands are presented, Cisco IOS Software and PIX commands appear side-by-side for quick reference. An engineer will be able to carry this book on-site and refer to it during hands-on installation or troubleshooting sessions. The book is organized by families of features, and information on each feature is presented in a concise format, with background, configuration, and example components. Each section also has a quick reference table of commands that can be used to troubleshoot or display information about the features presented. David Hucaby, CCIE No. 4594, is a Lead Network Engineer for the University of Kentucky, where he works with healthcare networks based on the Cisco Catalyst, IP telephony, PIX, and VPN product lines. David has a B.S. and M.S. in Electrical Engineering from the University of Kentucky. He is the author of three previous books for Cisco Press, including CCNP Switching Exam Certification Guide, Cisco Field Manual: Router Configuration, and Cisco Field Manual: Catalyst Switch Configuration.