Look at 6 7 8 for dual monitor!!!!
Policy NAT on Cisco ASA Firewall
As we know, the conventional NAT functionality on Cisco devices (routers, ASA firewalls etc) translates the SOURCE IP address to something else. There is also the so called “Destination based NAT” (or you may see it referred as “Reverse NAT”) which changes the destination IP address. Here we will deal with conventional source based NAT with a policy.
Sometimes we need to change the source IP address to another source address (lets call it “translated-A”) when we are communicating with “destination-A”, and also change the source IP to “translated-B” when we are communicating with “destination-B”.
So, to be clearer, the scenario is the following:
•When internal host 192.168.1.1 wants to communicate with external host 100.100.100.1, then the internal host must be translated to 50.50.50.1
•When the internal host 192.168.1.1 wants to communicate with external host 200.200.200.1, then the internal host must be translated to 50.50.50.2
We can achieve the functionality above with Policy-Based NAT.
Configuration Example:
Assume that the internal host 192.168.1.1 is connected to the inside interface of ASA. We have also in our possession the public IP range 50.50.50.0/24. We will use the public IP range to translate our internal host according to the destination.
! First create the access lists for the policy NAT
ASA(config)# access-list POLICYNAT-A extended permit ip host 192.168.1.1 host 100.100.100.1
ASA(config)# access-list POLICYNAT-B extended permit ip host 192.168.1.1 host 200.200.200.1
! Now create the static NAT translation for Destination-A
ASA(config)# static(inside,outside) 50.50.50.1 access-list POLICYNAT-A
! Now create the static NAT translation for Destination-B
ASA(config)# static(inside,outside) 50.50.50.2 access-list POLICYNAT-B
The above commands will do the following: When source address is 192.168.1.1 and destination address is 100.100.100.1, then change the source address to 50.50.50.1.
Similarly, when source address is 192.168.1.1 and destination is 200.200.200.1, then change the source address to 50.50.50.2.
The above static nat commands will only take effect if and only if the traffic is between the hosts referenced in the access-lists (either inbound or outbound traffic).
Sometimes we need to change the source IP address to another source address (lets call it “translated-A”) when we are communicating with “destination-A”, and also change the source IP to “translated-B” when we are communicating with “destination-B”.
So, to be clearer, the scenario is the following:
•When internal host 192.168.1.1 wants to communicate with external host 100.100.100.1, then the internal host must be translated to 50.50.50.1
•When the internal host 192.168.1.1 wants to communicate with external host 200.200.200.1, then the internal host must be translated to 50.50.50.2
We can achieve the functionality above with Policy-Based NAT.
Configuration Example:
Assume that the internal host 192.168.1.1 is connected to the inside interface of ASA. We have also in our possession the public IP range 50.50.50.0/24. We will use the public IP range to translate our internal host according to the destination.
! First create the access lists for the policy NAT
ASA(config)# access-list POLICYNAT-A extended permit ip host 192.168.1.1 host 100.100.100.1
ASA(config)# access-list POLICYNAT-B extended permit ip host 192.168.1.1 host 200.200.200.1
! Now create the static NAT translation for Destination-A
ASA(config)# static(inside,outside) 50.50.50.1 access-list POLICYNAT-A
! Now create the static NAT translation for Destination-B
ASA(config)# static(inside,outside) 50.50.50.2 access-list POLICYNAT-B
The above commands will do the following: When source address is 192.168.1.1 and destination address is 100.100.100.1, then change the source address to 50.50.50.1.
Similarly, when source address is 192.168.1.1 and destination is 200.200.200.1, then change the source address to 50.50.50.2.
The above static nat commands will only take effect if and only if the traffic is between the hosts referenced in the access-lists (either inbound or outbound traffic).
NAT Overview
In this table, when NAT performs the global to local, or local to global, translation is different in each flow.
|
Inside-to-Outside |
Outside-to-Inside |
|---|---|
|
|
PIX/ASA: Monitor and Troubleshoot
show interface—Shows interface statistics.
show traffic—Shows how much traffic passes through the PIX.
show xlate—Shows the current translations built through the PIX.
show conn—Shows the current connections through the PIX.
show traffic—Shows how much traffic passes through the PIX.
show xlate—Shows the current translations built through the PIX.
show conn—Shows the current connections through the PIX.
642-7627 IPS v7.0 Exam Topics (Blueprint)
Exam Description
Implementing Cisco Intrusion Prevention System v7.0 (IPS v7.0) exam is associated with the Cisco Certified Security Professional certification. This exam tests a candidate's knowledge and skills needed to deploy Cisco IPS-based security solutions. Successful graduates will be able to reduce risk to the IT infrastructure and applications using Cisco IPS features, and provide detailed operations support for the Cisco IPS. Candidates can prepare for this exam by taking the Implementing Cisco Intrusion Prevention System course.
Exam Topics
The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.
Pre-Production Design
Choose Cisco IPS technologies to implement HLD
Choose Cisco products to implement HLD
Choose Cisco IPS features to implement HLD
Integrate Cisco network security solutions with other security technologies
Create and test initial Cisco IPS configurations for new devices/services
Complex Support Operations
Optimize Cisco IPS security infrastructure device performance
Create complex network security rules, to meet the security policy requirements
Configure and verify the IPS features to identify threats and dynamically block them from entering the network
Maintain, update and tune IPS signatures
Use CSM and MARS for IPS management, deployment, and advanced event correlation.
Optimize security functions, rules, and configuration
Advanced Troubleshooting
Advanced Cisco IPS security software configuraiton fault finding and repairing
Advanced Cisco IPS sensor and module hardware fault finding and repairing
Implementing Cisco Intrusion Prevention System v7.0 (IPS v7.0) exam is associated with the Cisco Certified Security Professional certification. This exam tests a candidate's knowledge and skills needed to deploy Cisco IPS-based security solutions. Successful graduates will be able to reduce risk to the IT infrastructure and applications using Cisco IPS features, and provide detailed operations support for the Cisco IPS. Candidates can prepare for this exam by taking the Implementing Cisco Intrusion Prevention System course.
Exam Topics
The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.
Pre-Production Design
Choose Cisco IPS technologies to implement HLD
Choose Cisco products to implement HLD
Choose Cisco IPS features to implement HLD
Integrate Cisco network security solutions with other security technologies
Create and test initial Cisco IPS configurations for new devices/services
Complex Support Operations
Optimize Cisco IPS security infrastructure device performance
Create complex network security rules, to meet the security policy requirements
Configure and verify the IPS features to identify threats and dynamically block them from entering the network
Maintain, update and tune IPS signatures
Use CSM and MARS for IPS management, deployment, and advanced event correlation.
Optimize security functions, rules, and configuration
Advanced Troubleshooting
Advanced Cisco IPS security software configuraiton fault finding and repairing
Advanced Cisco IPS sensor and module hardware fault finding and repairing
642-647 VPN v1.0 Exam Topics (Blueprint)
Exam Description
Deploying Cisco ASA VPN Solutions (VPN v1.0) exam is associated with the CCSP, CCNP Security and Cisco VPN Specialist certifications. This exam tests a candidate's knowledge and skills needed to deploy Cisco ASA-based VPN solutions. Successful graduates will be able to reduce risk to the IT infrastructure and applications using Cisco ASA VPN features, and provide detailed operations support for the Cisco ASA. Candidates can prepare for this exam by taking the Deploying Cisco ASA VPN Solutions course.
Exam Topics
The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.
Pre-Production Design
Choose ASA VPN technologies to implement HLD based on given requirements
Choose the correct ASA model and license to implement HLD based on given performance requirements
Choose the correct ASA VPN features to implement HLD based on given corporate security policy and network requirements
Integrate ASA VPN solutions with other security technology domains (CSD, ACS, Device managers, Cert servers, etc.)
Complex Operations Support
Optimize ASA VPN performance, functions, and configurations
Configure and verify complex ASA VPN networks using features such as DAP, CSD, Smart tunnels, Anyconnect SSLVPN, Clientless SSLVPN, Site-to-Site VPN, RA VPN, certificates, QOS, etc. to meet security policy requirements.
Create complex ASA network security rules using such features as ACLs, DAP, VPN profiles, certificates, MPF, etc, to meet the corporate security policy
Advanced Troubleshooting
Perform advanced ASA VPN configuration and troubleshooting
Deploying Cisco ASA VPN Solutions (VPN v1.0) exam is associated with the CCSP, CCNP Security and Cisco VPN Specialist certifications. This exam tests a candidate's knowledge and skills needed to deploy Cisco ASA-based VPN solutions. Successful graduates will be able to reduce risk to the IT infrastructure and applications using Cisco ASA VPN features, and provide detailed operations support for the Cisco ASA. Candidates can prepare for this exam by taking the Deploying Cisco ASA VPN Solutions course.
Exam Topics
The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.
Pre-Production Design
Choose ASA VPN technologies to implement HLD based on given requirements
Choose the correct ASA model and license to implement HLD based on given performance requirements
Choose the correct ASA VPN features to implement HLD based on given corporate security policy and network requirements
Integrate ASA VPN solutions with other security technology domains (CSD, ACS, Device managers, Cert servers, etc.)
Complex Operations Support
Optimize ASA VPN performance, functions, and configurations
Configure and verify complex ASA VPN networks using features such as DAP, CSD, Smart tunnels, Anyconnect SSLVPN, Clientless SSLVPN, Site-to-Site VPN, RA VPN, certificates, QOS, etc. to meet security policy requirements.
Create complex ASA network security rules using such features as ACLs, DAP, VPN profiles, certificates, MPF, etc, to meet the corporate security policy
Advanced Troubleshooting
Perform advanced ASA VPN configuration and troubleshooting
Subscribe to:
Posts (Atom)