Cisco CCNP Security Cert Guide: Implementing and Configuring Cisco IOS Routed Data Plane Security

This chapter covers the following subjects:

• Routed data plane attack types: Reviews the types of attack that are focused on the routed data plane.
• Access control lists (ACL): Covers the fundamentals of using ACLs and the configuration and verification commands to use.
• Flexible Packet Matching (FPM): Covers the steps involved in developing a traffic class and policy and assigning it to an interface. It also goes over the verification commands that can be used in configuration and troubleshooting.
• Flexible NetFlow: Reviews the fundamentals of Flexible NetFlow and describes the configuration and verification commands to use it.
• Unicast Reverse Path Forwarding (Unicast RPF): Covers the basics of how Unicast RPF functions and discusses the commands required to configure and verify it.

Several different parts of a network need to be secured from internal and external attack. The three planes as defined by Cisco include the data plane, management plane, and control plane, and these are split between those focused on the switched parts of the network and those focused on the routed parts of the network. This chapter addresses the routed data plane, including the Cisco IOS Software features that can be used to secure the network user data that traverses the network and discusses how to configure these features on the network devices within the network.

"Do I Know This Already?" Quiz

The "Do I Know This Already?" quiz helps you decide whether you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now.

The ten-question quiz, derived from the major sections in the "Foundation Topics" section of this chapter, helps you determine how to spend your limited study time.

Table 8-1 outlines the major topics discussed in this chapter and the "Do I Know This Already?" quiz questions that correspond to those topics.

Table 8-1. "Do I Know This Already?" Foundation Topics Section-to-Question Mapping

1. Which of the following are some of the most common types of routed data plane attacks?

   1. Routing protocol spoofing
   2. Slow-path denial of service
   3. STP spoofing
   4. Traffic flooding

2. Which of the following ACL ranges are used for standard access lists?

   1. 100–199
   2. 2000–2699
   3. 1–99
   4. 1300–1999

3. When using a reflexive access list, which of the following ACL types must be used?

   1. Standard IP ACL
   2. Extended IP ACL
   3. Extended IP named ACL
   4. Reflexive ACL
   5. Standard IP named ACL

4. Which of the following are valid steps required for the creation of an FPM filtering policy?

   1. Defining a service policy
   2. Loading of a PCFD
   3. Defining an access list
   4. Loading of a PHDF

5. Which command are used to load a traffic classification file (TCDF)?

   1. load protocol
   2. load classification
   3. load tcdf
   4. load class-file

6. Which commands are used to configure matching for a traffic class?

   1. match field
   2. match start
   3. match beginning
   4. match l2-layer
   5. match packet

7. Which of the following are restrictions when using FPM?

   1. Stateful inspection only
   2. IPv4/IPv6 unicast packets only
   3. IPv4 unicast packets only
   4. Cannot be used with IP options packets

8. Which of the following are benefits that are gained by using Flexible NetFlow?

   1. Flexible key and nonkey fields
   2. Version 5 export format
   3. Standardized key and nonkey fields
   4. Version 9 export format

9. Which of the following are Flexible NetFlow components?

   1. Flow sequencers
   2. Flow policers
   3. Flow monitors
   4. Flow samplers

10. Unicast RPF utilizes which of the following to compare source packet information?

    1. IP routing table
    2. CEF FIB
    3. Topology tables
    4. NetFlow records

The answers to the "Do I Know This Already?" quiz are found in Appendix A. The suggested choices for your next step are as follows:

• 8 or less overall score: Read the entire chapter. This includes the "Foundation Topics" section.
• 9 or 10 overall score: If you want more review on these topics, skip to the "Exam Preparation" section. Otherwise, move on to Chapter 9, "Implementing and Configuring Cisco IOS Control Plane Security."