CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-1
Chapter 14
Network Security
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
• Class Discussion Topics
• Additional Projects
• Additional Resources
• Key Terms
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-2
Lecture Notes
Overview
This chapter focuses on keeping data secure in a network. It covers general network
security and explains how to protect against common threats. In this chapter, your students
learn how to configure routers and switches with SSH to allow for secure connections, and
how to use the Security Audit Wizard. Finally, they learn how to configure virtual private
networks (VPN) with Cisco’s Security Device Manager utility.
Chapter Objectives
• Distinguish between the different types of network security threats
• Explain how to mitigate network security threats
• Implement SSH on Cisco routers and switches
• Configure VPNs with the Cisco Security Device Manager
Teaching Tips
General Network Security
2. Mention that a security policy should include the following:
a. Physical security
3. Mention that an effective security policy implements multiple layers of security.
4. Explain that a security policy should have three goals:
5. Mention that when designing a security policy, take care to specify exactly what you are
trying to protect.
Protecting the Hardware
2. Explain that critical nodes of an organization should be separated from the general
3. Explain that if office space is limited and nodes must be located near employees, the
servers should at least be stored in a locked cabinet. Use Figure 14-1 to illustrate your
explanation.
Protecting Software
1. Explain that the primary threats against software are malware and hackers.
3. Explain that hackers are usually driven by greed, ego, and/or vengeance. They look to
make personal gains through system vulnerabilities.
Teaching
Tip
Protecting against hackers requires thinking on two levels. First, it is important to
protect against the hacker intrusion; you need to do everything you can to keep a
hacker out of your network. Second, you must take action to protect the network
in case the hacker does in fact succeed in gaining access.
Malware Prevention
1. Describe the most important elements of a prevention plan, including the following:
2. Describe the following types of malware:
a. Virus
b. Worm
3. Explain that virus prevention software is available for installation on entire networks,
4. Describe the following aspects of user training:
a. Users must be trained to update their antivirus software daily or, at a bare
minimum, weekly.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-4
b. Users also must learn how viruses are transmitted between computers.
c. Teach users to scan removable devices with the virus scanning software before
using them.
Teaching
Tip
Your security policy should state that if users receive e-mails from unknown
sources users should delete them. Also, the security policy should instruct users
to never open an attachment on an e-mail if they are unaware of the attachment’s
contents.
Firewalls
1. Define a firewall as the primary method of keeping hackers out of a network. It is
2. Mention that a firewall can be a hardware device or it can be software. Types of firewall
3. Explain that all data packets entering or exiting the network have to pass through an
4. Use Figures 14-2 through 14-5 to describe the following four firewall topologies:
a. Packet-filtering router
5. Define an Intrusion Detection Systems (IDS) as a security device that can detect a
6. Explain that an Intrusion Prevention Systems (IPS) is similar to an IDS except that it is
Permissions, Encryption, and Authentication
2. Explain that encryption often consists of using security algorithms to scramble and
3. Use Figures 14-6 and 14-7 to describe the following types of encryption algorithms:
5. Define authentication as the process by which users verify to a server that they are who
6. Describe the following types of authentication:
7. Describe the following additional authentication services supported by Cisco:
8. Mention that these two common security protocols are based on the Authentication,
Authorization, and Accounting (AAA) model.
Teaching
Tip
RADIUS and TACACS+ are services that apply these principles by maintaining
a user database that users authenticate against when logging in. The RADIUS
protocol is governed by RFC 2865 and can be used with cross-platform
integration, meaning that not all devices in a RADIUS authentication stream
have to be Cisco devices.
Mitigating Security Threats
1. The three basic strategies for mitigating security threats are as follows:
a. Using the SSH protocol to connect to your routers and switches rather than
telnet
Secure Shell (SSH) Connections
1. Explain that the Secure Shell (SSH) protocol sends all data encrypted. The two versions
3. Explain that you must also generate an RSA key pair (asymmetric key encryption),
which enables SSH. The preferred method is to implement SSH on all VTY lines,
4. The command sequence for enabling SSH is:
a. Router(config)#hostname SshRouter
Teaching
Tip
After you enter the preceding commands, you are prompted to enter the size of
the key generated. The options range from 360 to 2048 bits—the greater the
number, the more complex the key.
Disabling Unnecessary Services
1. Mention that you should disable the services unless your organization uses them, using
any of the following methods:
2. The following services are unnecessary on most networks:
a. Finger Service
b. PAD Service
Patch Management
1. Explain that your organization’s patch management program should account for all
2. Mention that a patch management program should take into account the major software
3. Emphasize the point that not all patches released by vendors are flawless.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-7
Virtual Private Networks (VPNs)
1. Define Virtual Private Networks (VPNs) as a popular technology for creating a
2. Define a client-to-site VPN (also known as remote user VPN) as a VPN that allows
3. Define a site-to-site VPN as a VPN that allows multiple corporate sites to be connected
4. You can choose from several tunneling protocols to create secure, end–to-end tunnels:
Quick Quiz 1
1. A(n) ____ is a server running a single application, such as a proxy server or specialized
firewall software.
2. In network security, a(n) ____ is an official approval that allows a user to access a
specific network resource.
3. ____ is the process by which users verify to a server that they are who they say they are.
4. ____ are a popular technology for creating a connection between an external computer
and a corporate site over the Internet.
IPSec
1. Define IPSec as a suite of protocols, accepted as an industry standard, which provides
3. Explain that the transport mode is primarily geared toward encrypting data that is being
4. Explain that the tunnel mode encrypts all data in the tunnel and is the mode supported
by Cisco components.
IPSec Protocols
1. Explain that two IPSec protocols have been developed to provide packet-level security.
They include the following characteristics:
a. Authentication Header (AH)
b. Encapsulating Security Payload (ESP)
IPSec Authentication Algorithms
1. Explain that IPSec authentication algorithms use one of two Hashed Message
Authentication Codes (HMAC):
a. MD5 (message-digest algorithm 5)
b. SHA-1 (secure hash algorithm)
2. Define an HMAC as a secret key authentication algorithm that ensures data integrity
and originality based on the distribution of the secret key.
3. Mention that cryptographic software keys are exchanged between hosts using an
HMAC.
Teaching
Tip
When a transfer of data between the two hosts occurs, the value of the keys is
checked; if the value is correct, then the origin and integrity of the data are intact.
IPSec Encryption Algorithms
1. Explain that for encryption, the two most popular algorithms on IPSec networks are
IPSec Key Management
1. Explain that you need to pay attention to how keys are handed from node to node during
IPSec authentication. Two options are available:
2. Mention that key management is defined by the Internet Security Association and Key
Management Protocol (ISAKMP), and governed by RFC 2407 and 2408.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-9
Teaching
Tip
Although ISAKMP provides the framework for key exchange, the actual Internet
Key Exchange (IKE) protocols are governed by RFC 4306.
IPSec Transform Sets
1. Define a transform set as a configuration value (or simply stated, a command) that
allows you to establish an IPSEC VPN on a Cisco firewall.
3. Explain that when creating an IPSec VPN you must specify a protocol, the algorithm,
and the method of key management.
Creating VPNs with the Security Device Manager (SDM)
1. Explain that Cisco supports VPNs with several different devices. VPNs can be created
2. Use Figures 14-10 through 14-18 to describe how to create a VPN with SDM.
Cisco Security Audit Wizard
2. Explain that the SDM’s Security Audit Wizard can be used to verify your router’s
14-25 to illustrate your explanation.
Quick Quiz 2
1. ____ is a suite of protocols, accepted as an industry standard, which provides secure
data transmission over layer 3 of the OSI model.
2. IPSec ____ mode is primarily geared toward encrypting data that is being sent host-to–
host.
3. Although ISAKMP provides the framework for key exchange, the actual Internet Key
Exchange (IKE) protocols are governed by RFC ____.
4. A(n) ____ is a configuration value (or simply stated, a command) that allows you to
establish an IPSEC VPN on a Cisco firewall.
Class Discussion Topics
1. What are the advantages and disadvantages of using VPNs?
2. What are the advantages of providing secure data transmission over layer 3 of the OSI
model?
Additional Projects
1. The advanced encryption standard (AES) is the encryption algorithm supported by
IPSEC. Ask your students to read more about AES and write a report explaining how it
works. Use the following links as a starting point:
2. Ask your students to read the following article about how VPN works at
Additional Resources
1. Advanced Encryption Standard
2. An Illustrated Guide to IPsec
4. Virtual Private Network
5. OpenVPN
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-11
Key Terms
➢ 3DES Encryption algorithm supported by IPSEC.
➢ boot-sector virus A virus that infects the master boot record of a computer.
➢ client-to-site VPN A VPN that allows designated users to have access to the corporate
network from remote locations (also known as remote user VPN).
➢ DDoS Distributed Denial-of-Service attack. A denial-of-service attack launched by
multiple affected computers. The attack is specifically aimed at flooding the
➢ generic routing encapsulation (GRE) An unencrypted, Cisco proprietary tunneling
protocol.
➢ hacker An individual interested in stealing data or breaking into a network for
malicious intent.
➢ hashed message authentication code (HMAC) Secret key authentication algorithm
➢ IPsec A suite of protocols that has been accepted as an industry standard and provides
secure data transmission over layer 3 of the OSI model.
➢ layer 2 tunneling protocol (L2TP) An extension of the point-to-point protocol used to
create a secure tunnel for data to go through when remotely connecting to a network.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 14-12
➢ physical security Physically securing your organization’s computer equipment and
network devices.
➢ point-to-point tunneling protocols (PPTP) A tunneling protocol that creates a secure
tunnel for data to go through when remotely connecting to a network.
➢ polymorphic virus A virus that changes its appearance (or signature) each time it
network card installed in it and forwards all data to a firewall after inspecting it.
➢ site-to-site VPN A VPN that allows multiple corporate sites to be connected together
over low-cost Internet connections.
➢ stealth virus A virus that attempts to hide itself from detection.
➢ symmetric key Symmetric key encryption is a single-key encryption method enabling
it.
➢ virus Malware that is used to steal or damage data. Requires user intervention to
propagate.
➢ virtual private network (VPN). VPNs provide for low-cost secure data connections
between multiple sites. VPNs can be built as a site-to-site connection, remote user
connections, and even between two separate companies’ networks (that have a common