Title:
Cisco secure firewall services module (FWSM)
Personal Author:
Series:
Cisco Press networking technology series
Publication Information:
Indianapolis, IN : Cisco Press, 2009
Physical Description:
xxii, 496 p. : ill. ; 23 cm.
ISBN:
9781587053535
Added Author:
Available:*
Library | Item Barcode | Call Number | Material Type | Item Category 1 | Status |
|---|---|---|---|---|---|
Searching... | 30000010202482 | TK5105.59 B52 2009 | Open Access Book | Book | Searching... |
On Order
Summary
Summary
Cisco Secure Firewall Services Module (FWSM)
nbsp; Best practices for securing networks with FWSM nbsp; Ray Blair, CCIE® No. 7050 Arvind Durai, CCIE No. 7016 nbsp; The Firewall Services Module (FWSM) is a high-performance stateful-inspection firewall that integrates into the Cisco® 6500 switch and 7600 router chassis. The FWSM monitors traffic flows using application inspection engines to provide a strong level of network security. The FWSM defines the security parameter and enables the enforcement of security policies through authentication, access control lists, and protocol inspection. The FWSM is a key component to anyone deploying network security. nbsp; Cisco Secure Firewall Services Module (FWSM) covers all aspects of the FWSM. The book provides a detailed look at how the FWSM processes information, as well as installation advice, configuration details, recommendations for network integration, and reviews of operation and management. This book provides you with a single source that comprehensively answers how and why the FWSM functions as it does. This information enables you to successfully deploy the FWSM and gain the greatest functional benefit from your deployment. Practical examples throughout show you how other customers have successfully deployed the FWSM. nbsp; By reading this book, you will learn how the FWSM functions, the differences between the FWSM and the ASA Security Appliance, how to implement and maintain the FWSM, the latest features of the FWSM, and how to configure common installations. nbsp; Ray Blair, CCIE® No. 7050, is a consulting systems architect who has been with Cisco for more than 8 years, working primarily on security and large network designs. He has 20 years of experience in designing, implementing, and maintaining networks that have included nearly all networking technologies. Mr. Blair maintains three CCIE certifications in Routing and Switching, Security, and Service Provider. He is also a CNE and a CISSP. nbsp; Arvind Durai, CCIE No. 7016, is an advanced services technical leader for Cisco. His primary responsibility has been in supporting major Cisco customers in the enterprise sector. One of his focuses has been on security, and he has authored several white papers and design guides in various technologies. Mr. Durai maintains two CCIE certifications, in Routing and Switching and Security. nbsp; Understand modes of operation, security levels, and contexts for the FWSM Configure routing protocols and the host-chassis to support the FWSM Deploy ACLs and Authentication, Authorization, and Accounting (AAA) Apply class and policy maps Configure multiple FWSMs for failover support Configure application and protocol inspection Filter traffic using filter servers, ActiveX, and Java filtering functions Learn how IP multicast and the FWSM interact Increase performance with firewall load balancing Configure IPv6 and asymmetric routing Mitigate network attacks using shunning, anti-spoofing, connection limits, and timeouts Examine network design, management, and troubleshooting best practices nbsp; This security book is part of the Cisco Press® Networking Technology series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks. nbsp; Category: Networking: Security Covers: Firewall security nbsp;Author Notes
Ray Blair is a consulting systems architect and has been with Cisco Systems for more than eight years, working primarily on security and large network designs. He has 20 years of experience with designing, implementing, and maintaining networks that have included nearly all networking technologies. His first four years in the high-technology industry started with designing industrial computer systems for process monitoring. Mr. Blair maintains three Cisco Certified Internetwork Expert (CCIE) certifications in Routing and Switching, Security, and Service Provider. He also is a Certified Novell Engineer (CNE) and a Certified Information Systems Security Professional (CISSP).
nbsp; Arvind Durai is an advanced services technical leader for Cisco Systems. His primary responsibility has been in supporting major Cisco customers in the Enterprise sector, some of which includes Financial, Manufacturing, E-commerce, State Government, and Health Care sectors. One of his focuses has been on security, and he has authored several white papers and design guides in various technologies. Mr. Durai maintains two Cisco Certified Internetwork Expert (CCIE) certifications in Routing and Switching and Security. Mr. Durai holds a Bachelor of Science degree in Electronics and Communication, a Master's degree in Electrical Engineering (MS), and Master's degree in Business Administration (MBA). nbsp;Excerpts
Excerpts
Cisco Secure Firewall Services Module (FWSM) Introduction Firewalls are one of the main components used in securing a network infrastructure, and having an in-depth understanding of how these devices function is paramount to maintaining a secure network. This book was written to provide an understanding of the functionality of the Firewall Services Module (FWSM), from both a hardware and software perspective and to be a practical design guide with configuration examples for the design, implementation, operation, and management of FWSM in various deployment scenarios. Who Should Read This Book? This book is targeted at individuals who would like an in-depth understanding of the FWSM. It is focused primarily for those who design, implement, or maintain the FWSM, such as security/network administrators. To get the most value from the material, the reader should have at least an intermediate knowledge of networking and security. How This Book Is Organized This book is organized into five sections that cover the basic introduction of firewalls, initial and advanced configurations, design guides and configuration examples, and features and functionality introduced in FWSM version 4.x code: Chapter 1, "Types of Firewalls": This chapter explains the functionality of the different types of firewalls. Chapter 2, "Overview of the Firewall Services Module": This chapter covers specifications, installation information, performance, and virtualization; shows a comparison of IOS FW, ASA, and FWSM; and also explains the hardware and software architecture. Chapter 3, "Examining Modes of Operation": This chapter examines the modes of operation (transparent/routed) and explains the advantages of each. Chapter 4, "Understanding Security Levels": This chapter explains how traffic flows between interfaces, using both NAT and PAT and routed and transparent modes. Chapter 5, "Understanding Contexts": This chapter provides an overview of the benefits of contexts and how to manage them. Chapter 6, "Configuring and Securing the 6500/7600 Chassis": This chapter explains how to configure the host chassis to support the FWSM. Chapter 7, "Configuring the FWSM": This chapter covers the initial configuration of the FWSM. Chapter 8, "Access Control Lists": This chapter examines the use of ACLs. Chapter 9, "Configuring Routing Protocols": This chapter explains the use of routing protocols on the FWSM. Chapter 10, "AAA Overview": This chapter covers the principles of using authentication, authorization, and accounting. Chapter 11, "Modular Policy": This chapter covers the use of class and policy maps. Chapter 12, "Understanding Failover in FWSM": This chapter explains the use and configuration of using multiple FWSMs for high availability. Chapter 13, "Understanding Application Protocol Inspection": This chapter covers the use and configuration of application and protocol inspection. Chapter 14, "Filtering": This chapter examines how traffic can be filtered using filter servers and how Active X and Java filtering function. Chapter 15, "Managing and Monitoring the FWSM": This chapter covers the different options of managing and monitoring the FWSM. Chapter 16, "Multicast": This chapter explains the interaction of multicast with the FWSM and provides some practical examples. Chapter 17, "Asymmetric Routing": This chapter provides an explanation of asymmetric routing and how it can be configured. Chapter 18, "Firewall Load Balancing": This chapter covers the options of how to increase performance using multiple FWSMs. Chapter 19, "IP Version 6": This chapter explains IPv6 and how it is configured on the FWSM. Chapter 20, "Preventing Network Attacks": This chapter examines how to mitigate network attacks, using shunning, antispoofing, connection limits, and timeouts. Chapter 21, "Troubleshooting the FWSM": This chapter explains how to leverage the appropriate tools to solve problems. Chapter 22, "Designing a Network Infrastructure": This chapter covers an overview on placement of the FWSM in the network. Chapter 23, "Design Scenarios": This chapter provides many practical examples of how the FWSM can be configured. Chapter 24, "FWSM 4.x Performance and Scalability Improvements" : This chapter covers the performance improvements in 4.x code. Chapter 25, "Understanding FWSM 4.x Routing and Feature Enhancements": This chapter explains the use of commands introduced in 4.x code. (c) Copyright Pearson Education. All rights reserved. Excerpted from Cisco Secure Firewall Services Module (FWSM) by Arvind Durai, Raymond Blair All rights reserved by the original copyright owners. Excerpts are provided for display purposes only and may not be reproduced, reprinted or distributed without the written permission of the publisher.Table of Contents
| Introduction | |
| Part I Introduction | |
| Chapter 1 Types of Firewalls | |
| Understanding Packet-Filtering Firewalls | p. 5 |
| Advantages | p. 5 |
| Caveats | p. 6 |
| Understanding Application/Proxy Firewalls | p. 7 |
| Advantages | p. 8 |
| Caveats | p. 8 |
| Understanding Reverse-Proxy Firewalls | |
| Advantages | |
| CaveatsUtilizing Packet Inspection | |
| Reusing IP Addresses | |
| NATPAT | |
| Summary | |
| Chapter 2 Overview of the Firewall Services Module | |
| Specifications | |
| Installation | |
| Performance | |
| Virtualization | |
| Comparing the FWSM to Other Security DevicesIOS FWPIXASA | |
| Hardware Architecture | |
| Software Architecture | |
| Summary | |
| Chapter 3 Examining Modes of Operation | |
| Working with Transparent Mode | |
| Advantages | |
| Disadvantages | |
| Traffic Flow | |
| Multiple Bridge Groups | |
| Working with Routed Mode | |
| Advantages | |
| Disadvantages | |
| Traffic Flow | |
| Summary | |
| References | |
| Chapter 4 Understanding Security Levels | |
| Traffic Flow Between Interfaces | |
| Network Address Translation/Port Address Translation | |
| Static NAT | |
| Number of Simultaneous TCP Connections | |
| Number of Embryonic Connections | |
| DNS | |
| Norandomseq | |
| TCPUDP | |
| Static PAT | |
| Dynamic NAT | |
| Dynamic PATNAT Control | |
| NAT Bypass | |
| NAT 0 or Identity NAT | |
| Static Identity NAT | |
| Summary | |
| References | |
| Chapter 5 Understanding Contexts | |
| Benefits of Multiple Contexts | |
| Separating Security Policies | |
| Leveraging the Hardware Investment | |
| Disadvantages of Multiple Contexts | |
| Adding and Removing Contexts | |
| Adding a Context | |
| Removing a Context | |
| Storing Configuration Files | |
| Changing Between Contexts | |
| Understanding Resource Management | |
| Memory Partitions | |
| Summary | |
| Part II Initial Configuration | |
| Chapter 6 Configuring and Securing the 6500/7600 Chassis | |
| Understanding the Interaction Between the Host-Chassis and the FWSM | |
| Assigning Interfaces | |
| Securing the 6500/7600 (Host-Chassis)Controlling Physical Access | |
| Being Mindful of Environmental Considerations | |
| Controlling Management Access | |
| Disabling Unnecessary Services | |
| Controlling Access Using Port-Based Security | |
| Controlling Spanning Tree | |
| Leveraging Access Control Lists | |
| Securing Layer 3 | |
| Leveraging Control Plane Policing | |
| Protecting a Network Using Quality of Service | |
| Employing Additional Security Features | |
| Summary | |
| References | |
| Chapter 7 Configuring the FWSM | |
| Configuring FWSM in the Switch | |
| Exploring Routed Mode | |
| Exploring Transparent Mode | |
| Using Multiple Context Mode for FWSM | |
| Context Configurations | |
| System Context Configurations | |
| Admin Context Configurations | |
| Packet Classifier in FWSM Context Mode | |
| Understanding Resource Management in Contexts | |
| Configuration Steps for Firewall Services Module | |
| Type 1: Configuring Single Context Routed Mode | |
| Type 2: Configuring Single Context Transparent Mode | |
| Type 3: Configuring Multiple Context Mixed Mode | |
| Summary | |
| Chapter 8 Access Control Lists | |
| Introducing Types of Access Lists | |
| Understanding Access Control Entry | |
| Understanding Access List Commit | |
| Understanding Object Groups | |
| Monitoring Access List Resources | |
| Configuring Object Groups and Access Lists | |
| Working with Protocol Type | |
| Working with Network Type | |
| Working with Service Type | |
| Working with Nesting Type | |
| Working with Ether | |
| Type | |
| Summary | |
| Chapter 9 Configuring Routing Protocols | |
| Supporting Routing Methods | |
| Static Routes |
