Cisco.Press.CCIE.Security.Exam.Certification.Guide.pdf

CCIE Self-Study

CCIE Security Exam Certiﬁcation

Guide

Henry Benjamin

Cisco Press

201 West 103rd Street

Indianapolis, IN 46290 USA

CCIE Self-Study

CCIE Security Exam Certiﬁcation Guide

Henry Benjamin

Published by:

Cisco Press

201 West 103rd Street

Indianapolis, IN 46290 USA

mechanical, including photocopying, recording, or by any information storage and retrieval system, without written

permission from the publisher, except for the inclusion of brief quotations in a review.

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing April 2003

Library of Congress Cataloging-in-Publication Number: 2002104850

ISBN: 1-58720-065-1

Warning and Disclaimer

This book is designed to provide information about the

CCIE Security written exam. Every effort has been made to

make this book as complete and as accurate as possible, but no warranty or ﬁtness is implied.

The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc., shall have neither

liability nor responsibility to any person or entity with respect to any loss or damages arising from the information

contained in this book or from the use of the discs or programs that may accompany it.

The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc.

Trademark Acknowledgments

All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized.

Cisco Press or Cisco Systems, Inc. cannot attest to the accuracy of this information. Use of a term in this book should

not be regarded as affecting the validity of any trademark or service mark.

Feedback Information

At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted

with care and precision, undergoing rigorous development that involves the unique expertise of members from the

professional technical community.

Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could

improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through e-mail at

feedback@ciscopress.com. Please make sure to include the book title and ISBN in your message.

We greatly appreciate your assistance.

iii

Publisher John Wait

Editor-in-Chief John Kane

Executive Editor Brett Bartow

Cisco Representative Anthony Wolfenden

Cisco Press Program Manager Sonia Torres Chavez

Cisco Marketing Communications Manager Tom Geitner

Cisco Marketing Program Manager

Edie Quiroz

Managing Editor

Patrick Kanouse

Development Editor

Andrew Cupp

Project Editor

San Dee Phillips

Copy Editor

Marcia Ellett

Technical Editors

Gert De Laet, Anand Deveriya,

Charles Resch, Gert Schauwers

Team Coordinator

Tammi Ross

Book Designer

Gina Rexrode

Cover Designer

Louisa Adair

Compositor

Octal Publishing, Inc.

Indexer

Brad Herriman

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

European Headquarters

Cisco Systems Europe

11 Rue Camille Desmoulins

92782 Issy-les-Moulineaux

Cedex 9

France

http://www-europe.cisco.com

Tel: 33 1 58 04 60 00

Fax: 33 1 58 04 61 00

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-7660

Fax: 408 527-0883

Asia Paciﬁc Headquarters

Cisco Systems Australia,

Pty., Ltd

Level 17, 99 Walker Street

North Sydney

NSW 2059 Australia

http://www.cisco.com

Tel: +61 2 8448 7100

Fax: +61 2 9957 4350

Cisco Systems has more than 200 ofﬁces in the following countries. Addresses, phone numbers, and fax numbers are listed on

the Cisco Web site at www.cisco.com/go/ofﬁces

Argentina • Australia • Austria • Belgium • Brazil • Bulgaria • Canada • Chile • China • Colombia • Costa

Rica • Croatia • Czech Republic • Denmark • Dubai, UAE • Finland • France • Germany • Greece • Hong Kong

Hungary • India • Indonesia • Ireland • Israel • Italy • Japan • Korea • Luxembourg • Malaysia • Mexico

The Netherlands • New Zealand • Norway • Peru • Philippines • Poland • Portugal • Puerto Rico • Romania

Russia • Saudi Arabia • Scotland • Singapore • Slovakia • Slovenia • South Africa • Spain • Sweden

Switzerland • Taiwan • Thailand • Turkey • Ukraine • United Kingdom • United States • Venezuela • Vietnam

Zimbabwe

CCNP, CCSI, CD-PAC, CiscoLink , the Cisco Net Works logo, the Cisco Powered Network logo, Cisco Systems Networking Academy, Fast Step, FireRunner, Follow Me Browsing,

FormShare, GigaStack, IGX, Intelligence in the Optical Core, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, iQuick Study, iQ Readiness Scorecard, The

iQ Logo, Kernel Proxy, MGX, Natural Network Viewer, Network Registrar, the Networkers logo, Packet , PIX, Point and Click Internetworking, Policy Builder, RateMUX,

ReyMaster, ReyView, ScriptShare, Secure Script, Shop with Me, SlideCast, SMARTnet, SVX, TrafficDirector, TransPath, VlanDirector, Voice LAN, Wavelength Router,

Workgroup Director, and Workgroup Stack are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Empowering the Internet Generation, are

service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, Cisco, the Cisco Certified Internetwork Expert Logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco

Systems, Cisco Systems Capital, the Cisco Systems logo, Collision Free, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastLink, FastPAD, IOS, IP/TV, IPX,

LightStream, LightSwitch, MICA, NetRanger, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, are registered trademarks of Cisco Systems,

Inc. or its affiliates in the U.S. and certain other countries.

All other brands, names, or trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (0010R)

About the Author

, CCIE No.4695, holds three CCIE certiﬁcations, having attained

Routing and Switching in May 1999, ISP Dial in June 2001, and Communications

and Services in May 2002. He has more than 10 years experience with Cisco net-

works, including planning, designing, and implementing large IP networks running

IGRP, EIGRP, BGP, and OSPF. Recently, Henry has worked for a large IT organi-

zation based in Sydney, Australia as a key Network Designer, designing and

implementing networks all over Australia and Asia.

In the past two years, Henry has been a key member of the CCIE global team

based in Sydney, Australia. As a senior and core member of the team, his tasks

include writing new laboratory examinations and questions for the coveted CCIE

R/S, CCIE Security, and CCIE C/S tracks, as well as the CCIE written Recertiﬁca-

tion Examinations. Henry has authored two other titles, “CCNP Practical Studies:

Routing” (Cisco Press) and “CCIE R&S Exam Cram.”

Henry holds a Bachelor of Aeronautical Engineering degree from Sydney

University (1991).

About the Contributing Author

, CCIE No. 2657, has both CCIE Security and Routing and Switching certiﬁcations. He has more than

nine years of experience in internetworking. Gert currently works for the CCIE team at Cisco in Brussels, Belgium, as

CCIE Proctor/Content Engineer and Program Manager for EMEA. He also holds an Engineering degree in Electronics.

Gert helped write Chapter 9 of this book and acted as a lead technical reviewer for the entire book.

About the Technical Reviewers

, CCIE No.10401, in Security and MCSE, has ﬁve years of LAN/WAN and network security

experience with Cisco products. Currently, he is the Network Manager at Summerville Senior Living, where he

designed and deployed their nationwide Frame Relay-based WAN network with VoIP. Additionally, he monitors the

LAN/WAN security, penetration testing, and OS hardening. Prior to that, he was a network engineer with NEC, where

he deployed scalable, secure, and redundant network backbone for dotcom and campus environments using Cisco rout-

ers, switches, PIX, and VPN products.

, CCIE No. 6582, currently works at Nuclio as a Senior Network Engineer, where he installs and conﬁg-

ures management equipment to monitor customer networks. Among his projects are e-commerce sites with dual Cisco

PIX Firewalls, Cisco Content Switch (CSS) load balancers, Intel and SonicWall SSL off-loaders, Cisco switches

(HSRP-VLANs), and Cisco Secure Intrusion Detection Systems (CSIDS). Among other jobs, he has worked as a Senior

Instructor at Information Technology Institute—Northwestern Business College, and as a Senior Internet Engineer at

Globalcom Inc. He has extensive experience with Cisco hardware, Cisco IOS Software, numerous routed and routing

protocols, and operating systems.

, CCIE No. 6924, has CCIE certiﬁcations in Security, Routing and Switching, and Communications

and Services. He has more than four years of experience in internetworking. He is currently working for the CCIE team

at Cisco in Brussels, Belgium, as CCIE Content Engineer. He has an Engineering degree in Electronics.

Henry Benjamin

Gert De Laet

Anand Deveriya

Charles Resch

Gert Schauwers

Dedication

This book is solely dedicated to two wonderful individuals whom I’ve had the pleasure of meeting on two occasions in

my life. Without their inspiration and love for all humanity, I would not be here writing this book. I dedicate this book to

His Excellency Monsignor, Claudio Gatti, and Marisa Rossi. I thank God for you.

“I am the Mother of the Eucharist. Know Jesus’ word. Love Jesus, the Eucharist.”

—Our Lady, Mary, Mother of the Eucharist

Questo libro è dedicato esclusivamente a due persone meravigliose che ho avuto il piacere di conoscere e incontrare in

due occasioni nella mia vita. Senza la loro ispirazione e il loro amore per tutta l’umanità io non sarei qui a scrivere

questo libro. Dedico questo libro a Sua Eccellenza Mons. Claudio Gatti e a Marisa Rossi.

“Io sono la madre dell’Eucaristia. Conoscete Gesù parola. Amate Gesù Eucaristia.”

—Madonna, Maria, Madre dell’Eucaristia

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: