Cisco IOS Network Security

Creating and maintaining secure network environments continues to be of utmost importance for administrators and engineering today. Cisco IOS Network Security is the definitive resource for both dial-in and local users. Through the use of real-world examples, you will discover the most current security technologies available and learn how to implement and support these technologies on a network.

With this book, you will learn how to configure Authentication, Authorization, and Accounting (AAA), make the most of traffic filtering, understand network data encryption, and discover a host of other security features. Understanding Cisco network security solutions, protocols, and services, will help you make more intelligent, cost-effective, and quantifiable decisions for your network.

1. Security Overview
• About this Network Security Book
• Creating Effective Security Policies
• Identifying Security Risks and Cisco IOS Solutions
• Creaating a Firewall with Cisco IOS Software
• Part I: Authentication, Authorization and Accounting (AAA)
2. AAA Overview
• AAA Security Services
• Where to Begin
• What to Do Next
3. Configuring Authentication
• AAA Authentication Method Lists
• AAA Authentication Methods
• Non-AAA Authentication Methods
• Authentication Examples
4. Authentication Commands
• aaa authentication arap
• aaa authentication enable default
• aaa authentication local-override
• aaa authentication login
• aaa authentication nasi
• aaa authentication password-prompt
• aaa authentication ppp
• aaa authentication username-prompt
• aaa new-model
• access-profile
• arap authentication
• login authentication
• login tacacs
• nasi authentication
• ppp authentication
• ppp chap hostname
• ppp chap password
• ppp chap refuse
• ppp chap wait
• ppp pap sent-username
• ppp use-tacacs
5. Configuration Authorization
• AAA Authorization Types
• AAA Authorization Methods
• AAA Authorization Prerequisites
• AAA Authorization Configuration Task List
• Configuration Authorization
• Disabling Authorization for Global Configuration Commands
• Authorization Attribute-Value Pair
• Authorization Configuration Examples
6. Authorization Accounting
• aaa authorization
• aaa authorization config-commands
• aaa new-model
7. Configuring Accounting
• AAA Accounting Types
• AAA Accounting Prerequisites
• AAA Accounting Configuration Task List
• Enabling Accounting
• Monitoring Accounting
• Accounting Attribute-Value Pairs
• Accounting Configuration Example
8. Accounting Commands
• aaa accounting
• aaa accounting suppress null-username
• aaa accounting update
• Show accounting
• Part II: Security Server Protocols
9. Configuring RADIUS
• RADIUS Overview
• RADIUS Operation
• RADIUS Configuration Task List
• Configuring Router to RADIUS Server Communication
• Configuring Router for Vendor-Proprietary RADIUS Server Communication
• Configuring Router to Query RADIUS Server for Static Routes and IP Addresses
• Specifying RADIUS Authentication
• Specifying RADIUS Authorization
• Specifying RADIUS Accounting
• RADIUS Attributes
• Vendor-Proprietary RADIUS Attributes
• RADIUS Configuration Examples
• RADIUS Authenticaation and Authorizaation Example
10. RADIUS Commands
• ip radius source-interface
• radius-server configure-nas
• radius-server dead-time
• radius-server host
• radius-server host non-standard
• radius-server key
• radius-server retransmit
• radius-server timeout
11. Configuring TACACS+
• TACACS+ Overview
• TACACS+ Operation
• TACACS+ Configuration Task List
• Identifying the TACACS+ Server Host
• Setting the TACACS+ Authentication Key
• Specifying TACACS+ Authentication
• Specifying TACACS+ Authorization
• Specifying TACACS+ Accounting
• TACACS+ AV Pairs
• TACACS+ Configuration Examples
12. Configuring TACACS and Extended TACACS
• TACACS Protocol Description
• TACACS and Extended TACACS Confihuration Task List
• Setting TACACS Password Protection at the User Level
• Disabling Password Checking at the User Level
• Setting Optional Password Verification
• Setting TACACS Password Protection at the Privileged Level
• Disabling Password Checking at the Privileged Level
• Setting Notification of User Accounts
• Setting Authentication of User Actions
• Establishing the TACACS Server Host
• Setting Limits on Login Attempts
• Specifying the Amount of Time for Login Input
• Enabling the Extended TACACS Mode
• Enabling TACACS for PPP Authentication
• Enabling Standard TACACS for ARA Authentication
• Enabling Extended TACACS for ARA Authentication
• Enabling TACACS to Use a Specific IP Address
• TACACS Configuration Examples
13. TACACS, Extended TACACS, and TACACS+ Commands
• arap use-tacacs
• enable last-resort
• enable use-tacacs
• ip tacacs source-interface
• tacacs-server attempts
• tacacs-server authenticate
• tacacs-server directed-request
• tacacs-server extended
• tacacs-server host
• tacacs-server key
• tacacs-server last-resort
• tacacs-server login-timeout
• tacacs-server notify
• tacacs-server optional-passwords
• tacacs-server retransmit
• tacacs-server timeout
14. Configuring Kerberos
• Kerberos Overview
• Kerberos Client Support Operation
• Kerberos Configuration Task List
• Configuring the KDC Using Kerberos Commands
• Configuring the Router to Use Kerberos Protocol
• Monitoring and Maintaining Kerberos
• Kerberos Configuration Examples
15. Kerberos Commands
• clear kerberos creds
• connect
• kerberos clients mandatory
• kerberos credentials forward
• kerberos instance map
• kerberos local-realm
• kerberos preauth
• kerberos realm
• kerberos server
• kerberos srvtab remote
• key config-key
• show kerberos creds
• telnet
• Part III: Traffic Filtering
16. Access Control Lists: Overview and Guidelines
• In this Chapter
• About Access Control Lists
• Overview of Access List Configuration
• Find Complete Configuration and Command Information for Access Lists
17. Configuration Lock-and-Key Security (Dynamic Access Lists)
• In this Chapter
• About Lock-and-Key
• Compatibility with Releases Prior to Cisco IOS Release 11.1
• Risk of Spoofing with Lock-and-Key
• Router Performance Impacts with Lock-and-Key
• Prerequisites to Configuring Lock-and-Key
• Configuring Lock-and-Key
• Verifying Lock-and-Key Configuration
• Lock-and-Key Maintenance
• Lock-and-Key Configuration Examples
18. Lock-and-Key Commands
• access-enable
• access-template
• clear access-tamplate
• show ip accounting
19. Configuring IP Session Filtering (Reflexive Access Lists)
• In This Cgapter
• About Reflexive Access Lists
• Prework: Before You Configure Reflexive Access Lists
• Configuring Reflexive Access Lists
• Reflexive Access Lists Configuration Examples
20. Reflexive Access List Commands
• evaluate
• ip reflexive-list timeout
• permit (reflexive)
21. Configuring TCP Intercept (Prevent Denial-of-Service Attacks)
• In This Chapter
• About TCP Intercept
• TCP Intercept Configuration Task List
• Enabling TCP Intercept
• Setting the TCP Intercept Mode
• Setting the TCP Intercept Drop-Mode
• Changing the TCP Intercept Timers
• Changing the TCP Intercept Aggressive Thresholds
• Monitoring and Maintaining TCP Intercept
• TCP Intercept Configuration Example
22. TCP Intercept Commands
• ip tcp intercept connection-timeout
• ip tcp intercept drop-mode
• ip tcp intercept finrst-timeout
• ip tcp intercept list
• ip tcp intercept max-incomplete high
• ip tcp intercept max-incomplete low
• ip tcp intercept mode
• ip tcp intercept one-minute high
• ip tcp intercept one-minute low
• ip tcp intercept watch-timeout
• show tcp intercept connections
• show tcp intercept statistics
• Part IV: Network Data Encryption
23. Configuring Network Data Encryption
• Why Encryption?
• Cisco's Implementation of Encryption
• Prework: Before You Configure Encryption
• Configuring Encryption
• Configuring Encyption with GRE Tunnels
• Configuring Encyption with an ESA in a VIP2
• Configuring Encyption with an ESA in a Cisco 7200 Series Router
• Customizing Encyption (Configure Options)
• Turning of ENcryption
• Testing and Troubleshooting Encryption
• Encryption Configuration Examples
24. Network Data Encryption Commands
• access-list (encryption)
• clear crypto connection
• crypto algorithm 40-bit-des
• crypto algorithm des
• crypto clear-latch
• crypto esa
• crypto gen-signature-keys
• crypto key-exchange
• crypto key-exchange passive
• crypto key-timeout
• crypto map (global configuration)
• crypto map (interface configuration)
• crypto pregen-dh-pairs
• crypto public-key
• crypto sdu connections
• crypto sdu entities
• crypto zeroize
• deny
• ip access-list extended (encryption)
• match address
• permit
• set algorithm 40-bit-des
• set algorithm des
• set peer
• show crypto algorithms
• show crypto card
• show crypto connections
• show crypto enginge brief
• show crypto engine configurations
• show crypto engine connections active
• show crypto engine connections dropped-packets
• show crypto key-timeout
• show crypto map
• show crypto map interface
• show crypto map tag
• show crypto mypubkey
• show crypto pregen-dh-pairs
• show crypto pubkey
• show crypto pubkey name
• show crypto pubkey serial
• test crypto initiate-session
• Part V: Other Security Features
25. Configuring Passwords and Privileges
• Protecting Access to Privilege EXEC Commands
• Encryption Passwords
• Configuring Multiple Privilege Levels
• Recovering a Lost Enable Password
• Recovering a Lost Line Password
• Configuring Identification Support
• Passwords and Privileges Configuration Examples
26. Passwords and Privileges Commands
• enable
• enable password
• enable secret
• ip identd
• password
• privilege level (global)
• privilege level (line)
• service password-encryption
• show privilege
• username
27. Neighbor Router Authentication: Overview and Guidelines
• In This Chapter
• Benefits of Neighbor AUthentication
• Protocols That Use Neighbor Authentication
• When to Configure Neighbor Authentication
• How Neighbor Authentication Works
• Key Management (Key Chains)
28. Configuring IP Security Options
• In This Chapter
• Configuring Basic IP Security Options
• Configuring Extended IP Security Options
• Configuring the DNSIX Audit Trail Facility
• IPSO Configuration Examples
29. IP Security Options Commands
• dnsix-dmdp retries
• dnsix-nat authorized-redirection
• dnsix-nat primary
• dnsix-nat secondary
• dnsix-nat source
• dnsix-nat transmit-count
• ip security add
• ip security aeso
• ip security dedicated
• ip security eso-info
• ip security eso-max
• ip securityeso-min
• ip security extended-allow
• ip security first
• ip security ignore-authorities
• ip security implicit labelling
• ip security multilevel
• ip security reserved-allowed
• ip security strip
• show dnsix
• Appendixes
1. RADIUS Attributes
• RADIUS IETF Attributes
• RADIUS Accounting Attributes
• RADIUS Vendor-Proprietary Attributes
2. TACACS+ Attribute-Value Pairs
• TACACS+ AV Pairs
• TACACS+ Accounting AV Pairs

Extremely boring. Avoid at all costs, unless you need an IOS reference.