Internet Learning Solutions Group Product Informat on Busine s Unit Name of course or offering: Cisco Secure PIX Firewall Advanced Course acronym must be unique, up to 5 letters, no #s:
Trang 1Internet Learning Solutions Group
Product Informat on (Busine s Unit
Name of course or offering: Cisco Secure PIX Firewall Advanced
Course acronym (must be unique, up to 5 letters, no #s): CSPFA
Version: 2.1
FCS Date (PLM-PM): January 7, 2002
LOB: Enterprise BU: VPN & SECURITY SERVICES
Estimated product life:
Revisions required during product life:
Offering type: course If other, please specify:
Delivery method: ILT WBT/e-learning Other:
Duration if WBT in hours:
Duration if ILT in days 4 and hours: 32 End Of Li e (Busine s Unit Does course replace existing one?: Yes No If yes, provide course name and acronym: CSPFA 2.0 and EOL date: February 28, 2002 If this is a new version, what are the differences? The CSPFA 2.1 course is a revision to the existing Cisco Secure PIX Firewall Advanced 2.0 course It includes coverage of new features of PIX Firewall Releases 6.0 and 6.1 and corrections to errata in the CSPFA 2.0 course New features include the following: PIX Firewall 501 PAT port redirection Converting conduits to ACLs CPU utilization monitoring Cisco VPN Client 3.1 support Copy tftp flash command Skinny fixup command SIP fixup enhancements Target Audienc (Busine s Unit System Engineers Account Managers Channel Partners/Resellers Customers Who should attend this course? The target audience for this course is as follows: Cisco customers who implement and maintain Cisco Secure PIX Firewalls Cisco Channel Partners who sell, implement and maintain Cisco Secure PIX Firewalls Cisco System engineers who support sales of Cisco Secure PIX Firewall and security product solutions Train he Trainer (Busine s Unit – L G RP) Train the Trainer Required? Yes No If yes, TTT date:
TTT registration information:
Instructor prerequisites (including certifications and background knowledge) to attend TTT:
To become certified to teach this course, the instructor must
- be a Certified Cisco Systems Instructors (CCSI) in good standing, and
a) have been previously certified to teach CSPFF or CSPFA, or
b) attend a CSPFA course and pass the CSPFA certification Exam 9E0-571
Trang 2Student Prerequisi e (Busine s Unit
(Note: This field has a limit of 2000 characters.)
A CSPFA student should
possess Cisco Certified Network Associate (CCNA) certification or the equivalent knowledge (working knowledge of basic network security and a solid grasp of TCP/IP and fundamental networking concepts),
be familiar with encryption technologies: DES, 3DES, RSA, hashing algorithms (MD5/SHA), and IPSec, and
have a basic knowledge of the Windows operating system
Cours Obje t v s (Busine s Unit
After completing this course, the student should be able to:
Students will be able to perform the following tasks upon completion of this course:
Identify PIX Firewall features, models, components and benefits
Describe PIX Firewall installation procedures
Upgrade software images
Configure inbound and outbound access through the PIX Firewall
Configure multiple interfaces on the PIX Firewall
Configure the PIX Firewall as a DHCP server
Configure the PIX Firewall as a DHCP client
Configure the PIX Firewall to send messages to a syslog server
Perform password recovery
Configure access control and content filtering on the PIX Firewall
Configure special protocol handling on the PIX Firewall
Configure attack guards and SSH
Configure AAA on the PIX Firewall
Configure and test failover using the PIX Firewall
Configure the IDS feature set
Configure a site-to-site VPN utilizing the PIX Firewall
Configure a VPN Client-to-PIX Firewall VPN
Install PIX Device Manager and use it to configure the PIX Firewall
Test and verify PIX Firewall operations
Configure Cisco IOS Firewall Context-based Access Control
Cours De cript on (Busine s Unit
(Note: This field has a limit of 2000 characters.)
The CSPFA course is a four-day, leader-led, lab-intensive course The CSPFA course is designed for delivery by Cisco Learning Partners This task-oriented course teaches the knowledge and skill needed to describe, configure, verify and manage the PIX Firewall product family and the Cisco IOS Firewall feature set
Cours Out ine (Busine s Unit
The following is an outline of the course chapters:
Chapter 1: Course Introduction
Chapter 2: Network Security and the Cisco PIX Firewall
Reasons for securing network
The four primary types of threats
The three primary methods of attack
The Security Wheel
Cisco AVVID and SAFE overview
Chapter 3: Cisco PIX Firewall Technology
Firewalls and firewall technologies
The PIX Firewall family
The finesse OS
Trang 3ASA and ASA Security Levels
Cut-through proxy
Chapter 4: Identifying the Cisco PIX Firewall
PIX Firewall 501, 506, 515, 520, 525, and 535 controls, connectors, and LED’s
Proper location for the various perimeter network cables
Chapter 5: Basic Configuration of the PIX Firewall
General maintenance commands
ASA security levels
The six primary commands (nameif, interface, ip address, route, nat, global)
Lab exercise: Configure the PIX Firewall and execute general maintenance commands
Chapter 6: PIX Firewall Translations
Transport protocols
PIX Firewall translations
Access through the PIX Firewall
Lab exercise: Configuring access through the PIX Firewall
Chapter 7: Configuring Multiple Interfaces
Configuring additional interfaces
Lab exercise: Configuring multiple interfaces
Chapter 8: DHCP Support
Dynamic Host Configuration Protocol
PIX Firewall as DHCP Server
PIX Firewall as DHCP Client
Lab exercise: Configure the PIX Firewall's DHCP server and client features
Chapter 9: Configuring Syslog
Syslog messages
Lab exercise: Configuring syslog
Chapter 10: Access Control Configuration and Content Filtering
Access control lists
Converting conduits to access control lists
Configuring access control
Malicious active code filtering
Url filtering
Lab Exercise: Configure ACLs in the PIX Firewall
Chapter 11: Advanced Protocol Handling
Advanced protocols
Multimedia support
Lab exercise: Configure and test advanced protocol handling
Chapter 12: Attack Guards and Intrusion Detection
Attack guards
Intrusion Detection
Lab exercise: Configure the PIX Firewall to use IDS signatures
Chapter 13: AAA Configuration on the Cisco PIX Firewall
Introduction to AAA
Installation of Cisco Secure ACS for Windows NT
Authentication configuration
Authorization configuration
Accounting configuration
Troubleshooting the AAA configuration
Lab Exercise: Configure AAA on the PIX Firewall using CSACS for Windows NT
Chapter 14: Failover
Understanding failover
Configuring failover
Trang 4Lab exercise: Configure failover
Chapter 15: VPN Configuration
Explanation of IPSec
Configure PIX Firewall IPSec
Scale PIX Firewall VPNs
Create a VPN with the Cisco VPN Client 3.1
Lab exercise: Configure a PIX Firewall VPN
Chapter 16: System Maintenance
Password recovery
Image upgrade
Lab exercise: Upgrade the PIX Firewall image
Chapter 17: Cisco PIX Device Manager
PDM overview
PDM operating requirements
Prepare for PDM
Using PDM
Lab exercise: Install and configure PDM
Chapter 18: The Cisco IOS Firewall Context-Based Access Control Configuration
Introduction to Cisco IOS Firewall
How CBAC works
Alerts and audit trails
Global timeouts and thresholds
Port-to-application mapping
Defining inspection rules
Applying inspection rules and ACLs to router interfaces
Testing and verifying CBAC
Lab exercise: Configure IOS Firewall on a Cisco router
Chapter 19: The Cisco IOS Firewall Authentication Proxy Configuration
Introduction to the Cisco IOS Firewall Authentication proxy
AAA server configuration
AAA configuration
Authentication proxy configuration
Testing and verification of the configuration
Lab exercise: Configure authentication proxy on a Cisco router
Ke words (Busine s Unit
(Maximum of 7):
PIX
Equipment Requirements
Resources needed / Quantities / Comments:
(Note: If the equipment list is already formatted, you may include it in a separate document Please list the name of the file here.)
The following lab equipment is required for delivery of this course:
Common equipment shared by all pods:
– Cisco 2621 router: Dual 10/100 Ethernet Router with 2 WIC slots, 1 NM slot, and the
following:
IP SW 2600 SF26C - IP SOFTWARE
S26C-12106 Cisco 2600 Series IOS IP
32- to 48-MB DRAM Factory Upgrade for the Cisco 2600 Series
8 to 16 MB Flash Factory Upgrade for the Cisco 2600
32 port Asynchronous Module
8 Lead Octal Cable (68 pin to 8 Male RJ-45's)
– Multi-VLAN Server with the following:
Trang 5Windows 2000 Server software
Intel Pentium III 800 MHz processor
256 MB RAM
8 GB HD
CD-ROM/Floppy Drive
Intel PRO/100 S Server Adapter (part number PILA8470C3)
– Five Cisco 2924 XL 10/100 switches for VLANs
(WS-C2924-XL-EN)
– Cisco Secure Access Control Server 2.6
– Kiwi’s Syslog Daemon Freeware Rel
– VPN Client Software for Win9x-XP 3.1
Equipment required for each pod:
– Cisco 2611 router: Dual Ethernet Modular Router with Cisco IOS IP software and the following:
IP SW 2600 SF26C - IP SOFTWARE
S26C-12103T Cisco 2600 Series IOS IP
32- to 48-MB DRAM Factory Upgrade for the Cisco 2600 Series
8 to 16 MB Flash Factory Upgrade for the Cisco 2600 Series
– Primary PIX Firewall: PIX 515FO Bundle (Chassis, failover SW, 2 FE ports) with the
following:
56-bit DES IPSec software license
PIX v6.1 software
PIX four-port 10/100 Ethernet interface
– Secondary PIX Firewall: PIX 515FO Bundle (Chassis, failover SW, 2 FE ports) with the following:
56-bit DES IPSec software license
PIX v6.1 software
PIX four-port 10/100 Ethernet interface
– Dell latitude laptop with the following:
Windows 2000 Server software
Internet Explorer 5.5
Internet Information Services 5.0
Pentium III 800 MHz
256 MB RAM
8 GB HD (or better) NTFS partitioned –
CD-ROM/Floppy Drive
10/100 Ethernet NIC
SKU Numbers or Cours Materials Busine s Uni Che k ne ded b x s, P M Deployment Provide
SK s)
ILT Student Kit includes: Student Guide (SG), Other: SK SKU:
ILT Instructor Kit includes: SG, Course Management Guide, Slides, Other: IK SKU:
ILT Employee Brown Bag SKU:
WBT/e-learning SKU:
Self Study: CD: Book: Tape: Video: Other:
Self Study CD Packaging: Jewel Case or Sleeve? If Jewel Case: Front Tray Card Booklet Back Tray Card