CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide, 1st edition

Introduction xxxi
Part I Virtual Private Networks (VPN)
Chapter 1 Understanding the Implementing Secure Solutions with Virtual Private Networks SVPN 300-730 Exam 2
Why Learn VPN Technology 2
The Cisco Certification Program 6
The SVPN 300-730 Exam 8
Exam Preparation 13
Summary 13
Chapter 2 Introduction to Virtual Private Networks (VPN) 14
"Do I Know This Already?" Quiz 15
Foundation Topics 17
VPN Offerings 17
    VPN Technologies vs. Services 17
    Remote Access VPNs 18
        Remote Access VPN Use Cases 19
    Site-to-Site VPNs 20
        Hub-and-Spoke Design 20
        Spoke-to-Spoke Design 20
        Full Mesh Design 21
        Hybrid Design 21
        Tiered Hub-and-Spoke Design 22
VPN Technology Components 23
    Hardware VPN Support 23
        Routers 23
        Security Appliances 26
        VPN Clients 28
        Other VPN Clients 29
VPN Protocols 29
    Point-to-Point Tunneling Protocol (PPTP) 30
        PPTP Pitfalls 30
    Secure Socket Tunneling Protocol (SSTP) 31
    SSL/TLS 31
    IPsec with IKE 31
    IPsec with IKEv2 32
    Easy VPN 32
    L2TP 32
    VPN Protocol Comparison 33
Cisco VPN Portfolio 33
    DMVPN 33
        DMVPN Use Cases 33
    Group Encrypted Transport VPN (GETVPN) 33
    FlexVPN 34
    SSL VPN 34
        SSL VPN Use Cases 34
    Site-to-Site VPN Comparison 34
    Cisco ASA Licensing 37
        Time-Based License 37
        Licensing Options 38
    Cisco Secure Firewall Series for Site-to-Site VPNs 39
        Cisco Secure Firewall Limitations 39
    Cisco Meraki Licensing 40
        Cisco Meraki VPN Options 40
Cisco Security Appliance Management 41
    Cisco Security Management Options 41
VPN Logging 42
    Logging Collection Points 42
    ASA Logging 42
    SIEM 43
    VPN Client Logging 44
    DART 44
    Logging Challenges 45
Summary 47
References 47
Exam Preparation Tasks 48
Part II Site-to-Site VPN
Chapter 3 Site-to-Site VPNs 50
"Do I Know This Already?" Quiz 51
Foundation Topics 53
Site-to-Site VPN Architecture 54
    Site-to-Site Design Considerations 54
    Scoping a Project 54
Site-to-Site Components 55
    Routers vs. Security Appliances 55
    Cisco Security Appliances for Site-to-Site VPNs 56
    IPsec 56
        Authentication Header 56
        Encapsulating Security Payload 57
        Comparing AH and ESP 57
    ISAKMP 58
        IKE Security Association 58
        IKE Version 1 and 2 58
        Key IKE Concepts 60
        IKE Authentication 61
VPN Tunnel Concepts 62
    IPsec Tunnel Mode 63
    IPsec Transport Mode 63
    Certificate Authorities 64
    Crypto Map Concepts 64
    GETVPN/DMVPN/FlexVPN 64
        GETVPN 65
        DMVPN 65
        FlexVPN 65
Router Configuration with IKEv1 66
    Planning the VPN 67
    Configuring the Tunnel 68
        Why Use GRE with IPsec? 68
        Configuring a GRE Tunnel 68
    Configuring Network Address Translation 70
        NAT Example 71
    Configuring Encryption and IPsec 72
        IKE Policy Example 73
    Authentication Options 73
        Pre-shared Key Example 74
        Digital Certificate Example 74
    Configuring a Crypto Map 75
        Crypto Map Example 76
        Applying Crypto Maps 77
    Configuring QoS 78
Router Configuration with IKEv2 78
    Primary Router Configuration Example 78
        Defining the IKEv2 Keyring 78
        Defining the IKEv2 Proposal 79
        Defining IKEv2 Policies 79
        Defining a Crypto ACL for IPsec Secured Traffic 79
        Defining a Transform Set 80
    Defining an IKEv2 Profile 80
        Defining Crypto Maps 80
        Activating Crypto Maps 81
    Repeating Similar Steps for the Other Router 81
Appliance Configuration 83
    ASDM Example 83
    ASA Command-Line Example 87
    Cisco Secure Firewall Example 93
    Cisco Meraki Example 97
High Availability 99
    High Availability Options 100
    High Availability Considerations 101
    High Availability Costs 102
    High Availability Technology Considerations 102
    Bidirectional Forwarding Detection 103
    IOS Failover Example 103
Summary 104
References 104
Exam Preparation Tasks 105
Chapter 4 Group Encrypted Transport VPN (GETVPN) 106
"Do I Know This Already?" Quiz 107
Foundation Topics 109
MPLS Security Challenges 109
GETVPN Overview 111
GDOI Protocol 111
GETVPN Benefit Summary 113
GETVPN Components 113
    GETVPN Key Server 113
    GETVPN Group Member 115
    GETVPN GDOI Protocol 115
    GETVPN Security Controls 115
        Rekeying 115
        TBAR 115
        IP-D3P 116
GETVPN Design Considerations 116
    GETVPN Fault Tolerance Considerations 116
    Key GETVPN Considerations 117
GETVPN Implementation and Configuration 117
    Configuring a Key Server 119
        IKE Phase 1 Policy 119
        Key Server PSK Authentication 120
        IKE Phase 2 Policy 120
        Key Server RSA Key 120
        Key Server GDOI 120
        Unicast Rekeying Parameters 120
        Key Server Policy Access List 121
    Configuring Group Members 121
        Group Member IKE Phase 1 Policy 121
        Group Member PSK Authentication 122
        Group Member GDOI Information 122
        Crypto Maps 123
GETVPN Status Commands 123
    Group Member Show Commands 126
    GETVPN Status Commands Summary 128
Summary 128
References 129
Exam Preparation Tasks 129
Chapter 5 Dynamic Multipoint Virtual Private Network (DMVPN) 130
"Do I Know This Already?" Quiz 131
Foundation Topics 134
DMVPN Overview 134
    Legacy Crypto Map VPN Solutions 135
    Modern VPN Needs 135
    DMVPN Risks 136
    DMVPN Core Concepts 136
    DMVPN Example 136
DVMPN Network Components 137
    mGRE 137
        GRE and mGRE Advantages 138
    NHRP 138
        NHRP Example 139
    Remaining DMVPN Components 139
    Solution Breakdown 139
DMVPN Design Considerations 140
    DMVPN Planning 140
    DMVPN Fault Tolerance Considerations 141
    Key DMVPN Considerations 141
    DMVPN Phases 141
        DMVPN Phase 1 141
        DMVPN Phase 2 142
        DMVPN Phase 3 143
DMVPN Phase 1 Hub-and-Spoke Implementation 144
    Crypto IPsec Policy Configuration 145
        Creating an IKE Policy 145
        Creating Pre-shared Key Authentication Credentials 146
        Creating a Profile 147
        Creating a Transform Set 148
    GRE Tunnel Configuration 148
        Creating a Multipoint GRE Tunnel on the Hub 148
        Creating a GRE Tunnel on the Spoke 149
    NHRP Hub-and-Spoke Configuration 150
        Configure NHRP on the Hub 150
        Configure NHRP on the Spoke 150
        Configure Tunnel Protection 151
        Configure Tunnel Optional Parameters 152
    Routing Protocol Configuration 152
        Configure Routing on the Hub 152
        Configure Routing on the Spoke Using IPV4 153
        Configure Routing on the Spoke Using IPV6 153
DMVPN Phase 2 Spoke-to-Spoke Implementation 154
    IPsec for Spoke-to-Spoke 154
    Spoke-to-Spoke Routing 154
    IPv6 Spoke-to-Spoke Routing Configuration 155
DMVPN Phase 3 Spoke-to-Spoke Implementation 155
    Enable NHRP Redirects on the Hub 155
    Enable NHRP Shortcuts on the Spoke 156
DMVPN Troubleshooting 156
    Troubleshooting the Crypto IPsec Policy Configuration 156
        Troubleshooting IKE Phase 2 157
    Troubleshooting the GRE Tunnel Configuration 157
        Validating the Tunnel 158
    Troubleshooting the NHRP Hub-and-Spoke Configuration 158
        NHRP Registration 158
        Tunnel Configuration 158
        Debugging 159
    Troubleshoot the Routing Configuration 159
    DMVPN Troubleshooting Summary 160
Summary 160
References 161
Exam Preparation Tasks 161
Chapter 6 FlexVPN Configuration and Troubleshooting 164
"Do I Know This Already?" Quiz 165
Foundation Topics 168
FlexVPN Overview 168
    FlexVPN Advantages 169
        Modular Framework 169
        Configuring Service Parameters 169
        IKEv2 Benefits Summarized 169
    FlexVPN Versus Other Options 170
        Benefits of IKEv2 171
        FlexVPN Requirements 171
FlexVPN Components 172
    FlexVPN Component Roles 173
        FlexVPN Smart Defaults 173
        Router Smart Defaults 174
FlexVPN Design Considerations 174
    FlexVPN Planning 174
    Key FlexVPN Consideration 175
FlexVPN Implementation: Hub-and-Spoke (IPv4/IPv6) 175
    Hub-and-Spoke Configuration Summary 176
    Step 1: IKEv2 Proposal and IKEv2 Policy Configuration 177
        FlexVPN IKEv2 Proposal 177
        FlexVPN Transform Set 178
    Step 2: IKEv2 Authorization Policy Configuration 178
        AAA 178
        Hub Pool 179
        ACL Permitting Traffic 179
        Attach to Authorization Policy 180
    Step 3: Keyring and IKEv2 Profile Configuration 180
        Keyring 180
        IKEv2 Profile 181
    Step 4: IPsec Profile Configuration 182
        Create Loopback Address 182
        Virtual Template 183
        Pre-shared IKEv2 Keyring 183
    FlexVPN Spoke Configuration 183
        Spoke AAA Configuration 183
        Spoke Access List 184
        Spoke Keyring 184
        Spoke Authorization Policy 184
        Spoke IKEv2 Profile 185
        Spoke IPsec Profile 185
        Spoke Tunnel Interface 186
FlexVPN Implementation: Spoke-to-Spoke (IPv4/IPv6) 186
    FlexVPN NHRP 187
    FlexVPN Spoke-to-Spoke Spoke Router 188
        Spoke-to-Spoke Keyring 188
        Spoke-to-Spoke Route Injection 188
        Spoke-to-Spoke IKEv2 Profile 189
        Spoke-to-Spoke Add NHRP 189
        Spoke-to-Spoke Virtual Template 190
FlexVPN Troubleshooting 191
    Connectivity Troubleshooting 192
    Step 1: IKEv2 Proposal and IKEv2 Policy Troubleshooting 192
        IKEv2 Debugging 193
    Step 2: IKEv2 Authorization Policy Troubleshooting 193
    Step 3: Keyring and IKEv2 Profile Troubleshooting 194
    Step 4: IPsec Profile Troubleshooting 194
        NHRP Troubleshooting 195
Summary 197
References 197
Exam Preparation Tasks 198
Part III Remote Access Virtual Private Network
Chapter 7 Remote Access VPNs 200
"Do I Know This Already?" Quiz 202
Foundation Topics 204
Remote VPN Architecture 205
    NAS and Client-Side Software 205
    Remote Access Technology Considerations 206
Remote Access Components 207
    Remote Access Capable Routers 207
    Remote Access Capable Security Appliances 208
    AnyConnect Secure Mobility Client 209
        User Experience 209
        AnyConnect Protocol Support 209
        AnyConnect Security Capabilities 210
        AnyConnect Platform Support 210
        AnyConnect Profile Editor 211
        AnyConnect VPN Profile Example 212
    VPN Connection Profiles, Group Policies, and Users 214
        Group Policies 214
        Connection Profiles 214
    Split Tunneling 215
        Split Tunneling Configuration 216
    SSL VPN/WebVPN 219
        WebVPN Example 220
        SSL VPN Options 221
        SSL VPN Licensing 222
Encryption Algorithms 223
    Encryption Trends 223
    Encryption Algorithm Categories 223
        Comparing Encryption Options 224
    Elliptic Curve Cryptography Algorithms 225
        ECC Threats 225
        Encryption Algorithm Math 225
        ECC Math 226
        Combining ECC with Other Algorithms 227
    Applying Elliptic Curve Cryptography to a VPN 227
        Diffie Hellman Groups 228
High Availability 228
    Load Balancing 229
    Failover Design 229
    Load Balancing Considerations 229
Cisco ASDM Remote Access Configuration 230
Cisco ASA CLI Remote Access Configuration 237
    Default Tunnel Groups 239
Cisco Secure Firewall Remote Access VPN 241
    Cisco Secure Firewall Features 241
Cisco Meraki Remote Access VPN 248
    Meraki Remote Access Configuration Example 249
Router Configuration 250
    Key Concepts for Remote Access on Routers 251
        Remote Access on Router Configuration Example 251
Summary 255
References 256
Exam Preparation Tasks 257
Chapter 8 Clientless Remote Access SSL VPNs on the ASA 258
"Do I Know This Already?" Quiz 259
Foundation Topics 260
Clientless SSL VPN Overview 261
    ASA as a Proxy 262
    Cisco VPN Options 262
Clientless SSL VPN Prerequisites 263
    Software Licenses 263
    License Options 264
        AnyConnect Plus Subscription and Perpetual 264
        AnyConnect Apex Subscription 264
        AnyConnect VPN Only Perpetual License 264
    License Option Summary 265
    Software Support Requirements 266
    Clientless SSL VPN Prerequisites Summary 267
Basic Clientless SSL VPN Configuration 267
    Step 1: Installing an Identity Certificate 268
        Generating a New RSA Key Pair Using ASDM 268
        Generating a New RSA Key Pair Using CLI 269
        Creating an Identity Certificate Request Using ASDM 269
        Creating an Identity Certificate Request Using CLI 270
        Installing a Signed Identity Certificate Using ASDM 271
        Installing a Signed Identity Certificate Using CLI 272
    Step 2: Applying an Identity Certificate to the Interface(s) 273
        Applying the Identity Certificate Using ASDM 273
        Applying the Identity Certificate Using CLI 274
    Step 3: Enabling Clientless SSL VPN on an Interface 274
        Enable Clientless SSL VPN Interface Using ASDM 274
        Enable Clientless SSL VPN Interface Using CLI 275
    Step 4: Configuring Group Policies 276
        Group Policy Selection 276
        Creating Group Policies Using ASDM 277
        Creating Group Policies Using CLI 277
        Group Policy Attributes for Clientless SSL VPNs 278
        WebVPN Group Policy Attributes 279
        WebVPN Group Policy vs. Group Policy Attributes 280
    Step 5: Configuring Connection Profiles 280
        Default Connect Profiles 281
        Creating a Connection Profile Using ASDM 281
        Creating a Connection Profile Using CLI 282
        Connection Profile General Attributes 283
        Connection Profile WebVPN Attributes 283
    Step 6: Configuring User Authentication 284
        Authentication Servers 285
        Configuring Authentication Using ASDM 286
        Configuring Local Authentication Using CLI 287
Extended Clientless SSL VPN Configuration Options 287
    Configuring Bookmarks 287
        Bookmark Support 288
        Creating a Bookmark List 289
        Applying the Bookmark List to a Group Policy Using ASDM 290
        Applying the Bookmark List to a Group Policy Using CLI 291
    Configuring Web ACLs 291
        Web ACL Support 291
        Creating a Web ACL Using ASDM 292
        Creating a Web ACL Using CLI 293
        Applying a Web ACL to a Group Policy Using ASDM 293
        Applying a Web ACL to a Group Policy Using CLI 294
    Configuring Application Access via Port Forwarding 294
        Creating a Port Forwarding List Using ASDM 295
        Creating a Port Forwarding List Using CLI 295
        Applying a Port Forwarding List to a Group Policy Using ASDM 296
        Applying a Port Forwarding List to a Group Policy Using ASDM 296
    Configuring Application Access via Smart Tunnels 297
        Smart Tunnel Requirements 297
        Smart Tunnel Benefits 298
        Creating a Smart Tunnel List Using ASDM 298
        Creating a Smart Tunnel List Using ASDM 299
        Applying the Smart Tunnel List to a Group Policy Using ASDM 300
        Applying the Smart Tunnel List to a Group Policy Using CLI 300
    Configuring Client/Server Plug-ins 301
        Obtaining Plug-ins 301
Summary 302
References 302
Exam Preparation Tasks 303
Chapter 9 AnyConnect VPNs on the ASA and IOS 306
"Do I Know This Already?" Quiz 307
Foundation Topics 309
AnyConnect VPN Review 310
    SSL VPN Versus IKEv2 310
AnyConnect SSL VPN Prerequisites on ASA 310
    AnyConnect Licenses 311
    Supported Operating Systems 311
        Compatible Browsers 311
        Administrative Privileges 311
Basic AnyConnect SSL VPN Configuration on ASA 312
    Step 1: Installing an Identity Certificate 312
    Step 2: Loading an AnyConnect Package 312
        Loading an AnyConnect Package Using ASDM 313
        Loading an AnyConnect Package Using CLI 314
    Step 3: Enabling AnyConnect VPN Client SSL Access 315
        Enabling AnyConnect VPN Using ASDM 315
        Enabling AnyConnect VPN Using CLI 315
    Step 4: Configuring a Group Policy 316
        Configure Group Policy Using ASDM 317
        Configure Group Policy Using CLI 318
    Step 5: Configuring an AnyConnect Connection Profile 319
        Configuring an AnyConnect Connection Profile Using ASDM 319
        Configuring an AnyConnect Connection Profile Using CLI 320
        Configuring a Group URL for an AnyConnect Connection Profile Using ASDM 322
        Configuring a Group URL for an AnyConnect Connection Profile Using CLI 323
    Step 6: Configuring User Authentication 324
        Creating a AAA Server Group Using ASDM 324
        Creating a AAA Server Group Using CLI 325
        Adding RADIUS Servers to a AAA Server Group Using ASDM 325
        Adding RADIUS Servers to a AAA Server Group Using CLI 326
        Configuring a Connection Profile to Use the RADIUS Server Group Using ASDM 326
        Configuring a Connection Profile to Use the RADIUS Server Group Using CLI 327
    Step 7: Defining an Address Pool 328
        Creating an Address Pool Using ASDM 328
        Creating an Address Pool Using CLI 328
        Applying the Address Pool to a Group Policy Using ASDM 329
        Applying the Address Pool to a Group Policy Using CLI 330
        AnyConnect Installation 330
        Connecting from the AnyConnect Client 331
Extended AnyConnect SSL VPN Configuration on ASA 331
    Configuring DNS and WINS Using ASDM 332
        Configuring DNS and WINS Using CLI 332
        Configuring Split Tunneling Using ASDM 333
        Configuring Split Tunneling Using CLI 335
        Configuring a Traffic Filter Using ASDM 335
        Configuring a Traffic Filter Using CLI 336
AnyConnect IKEv2 VPN on ASA 337
    Step 1: Enabling IPsec (IKEv2) 337
        Configuring IPsec (IKEv2) Using ASDM 337
        Configuring IPsec (IKEv2) Using CLI 338
    Step 2: Configuring an AnyConnect Client Profile for IKEv2 340
        Profile Storage 340
        Creating AnyConnect Client Profile for IKEv2 Using ASDM 341
AnyConnect IKEv2 VPN on Routers 342
    Step 1: Configuring PKI 343
        Generating a Key Pair 343
        Creating a Trustpoint 344
        Trust Point Policy 344
        Configuring a Trustpoint 345
        Define Trust Policy 345
        Disable FQDN 345
        Importing the Root CA Certificate 345
        Generating a Certificate Signing Request (CSR) 346
        Importing the Signed Server Certificate 347
    Step 2: Disabling the HTTP and HTTPS Servers on the Router 349
    Step 3: Configuring AAA 349
    Step 4: Creating an IKEv2 Authorization Policy 349
    Step 5: Creating an IKEv2 Profile 350
        Create New IKEv2 Profile 350
        Identifying Match Criteria 350
        RSA Certificate Authentication 351
        Authenticating Remote Users 351
        Authentication List 351
        Virtual Template 351
        AnyConnect Client Profile 351
        Configuration Summary 351
    Step 6: Creating a Virtual Template 352
        Creating the AnyConnect Client Profile 353
        AnyConnect Profile Editor 354
        Copying to the Router 355
        Reboot 356
        Configuring Split Tunneling 357
Summary 357
References 358
Exam Preparation Tasks 358
Chapter 10 Troubleshooting Remote Access VPNs 362
"Do I Know This Already?" Quiz 363
Foundation Topics 365
Troubleshooting Clientless SSL VPNs on the ASA 366
    Troubleshooting Categories 366
    Step 0: SSL VPN Components 367
    Step 1: Connectivity Troubleshooting 368
        Troubleshooting Questions 368
        Exam-Focused Connectivity Troubleshooting 368
        ASA WebVPN Service 370
        Troubleshooting Certificates 370
        Applied Certificates 371
        Full Certificate Chain 371
        Correct Certificate 371
        Certificate Debug Commands 371
        The capture Command 372
        Connectivity Troubleshooting Summary 372
    Step 2: Login Troubleshooting 372
        Connection Profile Group URL 373
        Viewing Group URLs 373
        Profile Selection 373
        Authentication 374
        ASA Authentication Testing 375
        Debug ASA to Authentication System 375
        Authorization 375
        Authorization Debugging 376
        Group Policy 377
        Group Policy Validation Using CLI 378
        Login Troubleshooting Summary 378
    Step 3: Clientless WebVPN Service Issues 379
        Validating WebVPN Service Details 380
        WebVPN Debugging 380
        Validating DNS Configuration 381
        ASA Plug-ins 381
        Bookmarks 382
        DAP and Bookmarks 383
        DNS and Bookmarks 383
        WebVPN Services Troubleshooting Summary 383
    Step 4: Application Access 383
        ASA-to-Application Connectivity 384
        Application-to-ASA Connectivity with Port Forwarding 384
        Application Troubleshooting Summary 384
Troubleshooting AnyConnect SSL VPNs on the ASA 385
    Step 1: Connectivity Troubleshooting 386
    Step 2: Login Troubleshooting 387
    Step 3: Network Access Troubleshooting 387
        AnyConnect Enabled 387
        Group Policy Configuration 388
        Address Pool 389
        Validating the Address Pool 389
        Routing Problems 390
        DNS Troubleshooting 391
        DNS Split Tunnel Range 392
        Browser Proxy 392
        NAT Problem 393
        capture Command 394
        capture Command Options 394
        Traffic Filters 395
        Troubleshooting Traffic Filters 395
        Network Access Troubleshooting Summary 396
    Step 4: Diagnostics and Reporting Tool (DART) 396
    Step 5: Diagnostic Commands 396
    Step 6: Application 399
Troubleshooting AnyConnect IKEv2 VPNs on the ASA 400
    Step 0: Prepare 400
    Steps 1 and 2: Connectivity and Login to the VPN Concentrator 402
    Step 3: VPN Status Validation 402
        Command 1: show vpn-sessiondb detail anyconnect 403
        Command 2: show crypto ikev2 sa 405
        Command 3: show crypto ikev2 sa detail 405
        Command 4: show crypto ipsec sa 406
        Command 5: debug crypto ikev2 255 408
    Step 4: Host Troubleshooting 408
        Invalid Host Entry 409
Troubleshooting AnyConnect IKEv2 VPNs on Routers 410
    Steps 1 and 2: Connectivity and Login to the Router 411
    Step 3: VPN Status Validation 411
        Command 1: show crypto ipsec sa detail 411
        Command 2: show crypto session detail 412
        Command 3: debug aaa 413
Summary 414
Reference 415
Exam Preparation Tasks 415
Part IV SVPN Preparation
Chapter 11 Final Preparation 418
Getting Ready 418
Tools for Final Preparation 420
    Pearson Cert Practice Test Engine and Questions on the Website 420
        Accessing the Pearson Test Prep Software Online 420
        Accessing the Pearson Test Prep Software Offline 420
    Customizing Your Exams 421
    Updating Your Exams 422
        Premium Edition 422
    Chapter-Ending Review Tools 423
Suggested Plan for Final Review/Study 423
Summary 423
Appendix A Answers to the "Do I Know This Already?" Quizzes 424
Appendix B Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730) Exam Updates 430
Glossary of Key Terms 433
Appendix C Memory Tables
Appendix D Memory Tables Answer Key
Appendix E Study Planner
Glossary of Key Terms


9780136660606    TOC    10/29/2021