CCIE Security v4.0 Practice Lab

Section 1: Perimeter Security and Services

Securing the perimeter around important networks and devices is a fundamental part of network protection. In this section, you are asked to implement firewall services that include not only traditional features, such as Network Address Translation (NAT) and traffic inspection, but also secured routing features. This section focuses on initializing and configuring the Cisco Adaptive Security Appliance (ASA) in both single- and multi-context modes. Connectivity through perimeter devices must be verified before moving on to other exercises in this guide.

Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode

ASA1 must be configured as a multi-context firewall using a shared outside interface. In addition, context c1 and the admin context will be using VLANs for logical segregation on a physical interface. The logical placement of ASA1 is shown in the network topology presented in Diagram 2 in Part I.

Table 1-1 through Table 1-6 outline the initialization requirements.

Table 1-1 Administration

Table 1-2 Context Admin

Table 1-3 Context c1

Table 1-4 Context c2

Table 1-5 Context Initialization Details

Table 1-6 Routing Details

Use names and addresses exactly as outlined. Remember that names are case sensitive.

Notes

• To validate your configuration, ensure that all interfaces in all contexts are up. You should ensure that Internet Control Message Protocol (ICMP) is permitted through each context to test connectivity and routing to the major subnets in the topology. You may use permit icmp any any for this purpose. Refer to Part I of this guide for information on the network addressing used in the topology.
• You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
• Some subnets might not be accessible until the configuration of ASA2 (see Exercise 1.2) and the Cisco IPS sensor (Exercise 2.1) is complete.
• The subinterface used for management traffic (admin context) must connect to inside secure hosts for management purposes only.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.1: Initialize the Cisco ASA in Multi-Context Routed Mode.”

Exercise 1.2: Configure Routing and Basic Access on ASA2

In this exercise, ASA2 should be configured in single-context routed mode with support for Open Shortest Path First (OSPF). Table 1-7 through Table 1-10 provide the necessary configuration details. Use names exactly as they are shown; remember that they are case sensitive. You will not need to change any of the OSPF parameters on neighboring routers. Refer to Diagram 2 and Diagram 3 in Part I for device placement, addressing, and routing details.

Table 1-7 Administration

Table 1-8 Interface Initialization Details

Table 1-9 Static Routing Details

Table 1-10 OSPF Routing Details

Notes

• To validate your configuration, ensure that all interfaces are up. You should ensure that ICMP is permitted through the firewall to test connectivity and routing to the major subnets in the topology. Refer to Part I of this guide for information on the network addressing used in the topology.
• You might need to add or modify the configuration of switches and routers to ensure you have full connectivity.
• Some subnets might not be accessible until the configuration of ASA1 (in Exercise 1.1) and the Cisco IPS sensor (in Exercise 2.1) is completed.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.2: Configure Routing and Basic Access on ASA2.”

Exercise 1.3: Configure IP Services on ASA1

This exercise has four tasks that build on the initial configuration of ASA1 Exercise 1.1. You may use any names for configuration elements such as access lists or objects, unless otherwise specified. Note that because the version of software currently running on ASA1 is post 8.3, the NAT configuration tasks will require the use of objects. Refer to Diagram 2 and Diagram 3 in Part I for device placement and addressing details.

• Task 1: Configure Network Object NAT
• Task 2: Configure Twice NAT
• Task 3: Configure and Troubleshoot NTP Services Using Authentication
• Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1

Task 1: Configure Network Object NAT

Use network object NAT to translate 10.50.90.5/32 on R5 to 10.50.80.50/32 in the appropriate context. This translation must allow bidirectional communication.

Task 2: Configure Twice NAT

Using Twice NAT, create a policy that will translate network 10.50.100.0/24 to the range 10.50.80.100–10.50.80.150 if the destination is 10.50.50.0/24. Translation for this task is unidirectional.

Task 3: Configure and Troubleshoot NTP Services Using Authentication

Network Time Protocol (NTP) on ASA1 using authentication is required with the NTP master service, which is partially configured on SW1 as follows:

SW1# show run | begin ntp
ntp authentication-key 1 md5 cisco
ntp source Vlan102
ntp access-group peer 1
ntp master 2

Complete the configuration and troubleshoot any issues using the following outputs to verify your solution:

ASA1# show ntp associations detail
192.168.1.5 configured, authenticated, our_master, sane, valid, stratum 2

ASA1# show ntp status
Clock is synchronized, stratum 3, reference is 192.168.1.5

Task 4: Configure Support for IPv6 in IPv4 Tunneling Through ASA1

Enable support for the ipv6ip tunnel configured between the tunnel endpoints 10.50.80.6 (R6) and 10.50.90.5 (R5). This configuration will be important for the completion of Exercise 5.1.

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.3: Configure IP Services on ASA1.”

Exercise 1.4: Configure IP Routing Security on ASA2

There are two tasks in this exercise that will focus on configuring the ASA2 to support dynamic routing protocols. Refer to Diagram 3 for routing protocol and addressing details.

Task 1: BGP Connectivity Through the ASA2

External Border Gateway Protocol (eBGP) has been preconfigured on R7 and R6 in Autonomous Systems 107 and 106, respectively. The BGP peering function cannot establish a session between these two routers through ASA2. Configure a solution that will enable the BGP peers to establish a connection. The following outputs can be used to verify your solution:

R6# show ip bgp
BGP table version is 3, local router ID is 172.18.106.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
  r RIB-failure, S
Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.18.106.0/24  0.0.0.0                  0         32768 ?
*> 172.18.107.0/24  10.50.40.7               0             0 107 ?

R7# show ip bgp
BGP table version is 5, local router ID is 172.18.107.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
  r RIB-failure, S
Stale, m multipath, b backup-path, x best-external, f RT-Filter, a additional-path
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.18.106.0/24  10.50.70.6               0             0 106 ?
*> 172.18.107.0/24  0.0.0.0                  0         32768 ?

Task 2: OSPF Authentication for Routing Update Security

MD5 authentication is required in OSPF area 2. Configure a solution for this area only, and ensure that OSPF routing information is still correctly exchanged between neighbors.

Use the key cisco123.

The following outputs will verify your solution:

R7# show ip ospf neighbor

Neighbor ID     Pri   State         Dead Time   Address       Interface
10.50.50.20       1   FULL/BDR      00:00:32    10.50.40.20   GigabitEthernet0/1

ASA2# show ospf neighbor inside

Neighbor ID     Pri   State         Dead Time   Address       Interface
172.18.107.7      1   FULL/DR       0:00:38     10.50.40.7    inside


ASA2# show ospf
Area 2
        Number of interfaces in this area is 1
        Area has message digest authentication

R7# show ip ospf
    Area 2
        Number of interfaces in this area is 2 (1 loopback)
        Area has message digest authentication

For the solution and verification information of this lab exercise, see “Solution and Verification for Exercise 1.4: Configure IP Routing Security on ASA2.”