CCIE Security簡介:
CCIE Security 針對的是負責(zé)設(shè)計和實施思科安全網(wǎng)絡(luò)的網(wǎng)絡(luò)人士。安全領(lǐng)域的 CCIE 認證表示網(wǎng)絡(luò)人士擁有專家級網(wǎng)絡(luò)安全知識,可以從事大型企業(yè)或跨國企業(yè)網(wǎng)絡(luò)的安全維護與設(shè)計工作。
1.可以解決復(fù)雜的連接問題。
2.利用技術(shù)解決方案提高帶寬、縮短響應(yīng)時間、限度地提高性能、加強安全性和支持全球性應(yīng)用。
安全CCIE適合人群:
已經(jīng)通過CCNP或者具備相應(yīng)水平者,從事網(wǎng)絡(luò)相關(guān)工作人員。同時也建議學(xué)員對CCIE R&S比較熟悉
安全CCIE課程內(nèi)容:
IGP 深入講述OSPF/EIGRP/RIP協(xié)議的原理,以及路由重分布的原理、各路由控制的方法和工具的使用,講解大型IGP應(yīng)用的案例
交換 深入講述多層交換的原理、VLAN和私有VLAN、MST、RSTP,SPAN/RSPAN、交換機安全、Ethernet channel、802.1X、DHCP/ARP欺騙的防護、交換機QOS-WRR/SRR等等。
ASA PIX/ASA的地址轉(zhuǎn)換和連接、訪問控制列表和內(nèi)容過濾、對象分組、AAA的控制、高級協(xié)議防護、VPN虛擬專用網(wǎng)絡(luò)配置,理解pix/ASA使用Cisco的EASY VPN實現(xiàn)遠程接入、webvpn、透明/虛擬防火墻、PIX/ASA的雙A的配置
AAA 講解路由器、交換機、PIX、ASA、VPN3000各種網(wǎng)絡(luò)設(shè)備的AAA配置
網(wǎng)絡(luò)攻擊 各種常見的網(wǎng)絡(luò)攻擊手段以及防護手段
安全 Feature CISCO 各種不同類型的網(wǎng)絡(luò)設(shè)備的安全特征集
IPS 講解IPS的特征集修改、IPS的攔截、IPS的管理、IPS的事件過濾、IPS的告警控制、IPS的響應(yīng)行為控制等等
IOS Firewall 講解CBAC以及如何利用IOS來抵御攻擊
BGP 深入 講述BGP的原理和注意事項,以及實施的考慮等等
VPN 各種類型的VPN講解,DMVPN、IPSEC VPN、EZVPN、GRE、MPLS VPN等等知識點
安全CCIE課時介紹:
學(xué)習(xí)周期為5-9個月,理論課120小時,可以免費重聽,實驗機時不限
實驗內(nèi)容:
注: 以下所列之技術(shù)是CCIE Security
LAB考試所涉及的范圍,一些與之相關(guān)的但未列出知識點也可能涉及。另外,作為一項重要的技能,隨機性的排錯也是考試的一部分。新的產(chǎn)品特性在其發(fā)布六個月后可能被列入考綱。
Implement secure networks using Cisco ASA Firewalls
Perform basic firewall Initialization
Configure device management
Configure address translation (nat, global, static)
Configure ACLs
Configure IP routing
Configure object groups
Configure VLANs
Configure filtering
Configure failover
Configure Layer 2 Transparent Firewall
Configure security contexts (virtual firewall)
Configure Modular Policy Framework
Configure Application-Aware Inspection
Configure high availability solutions
Configure QoS policies
Implement secure networks using Cisco IOS Firewalls
Configure CBAC
Configure Zone-Based Firewall
Configure Audit
Configure Auth Proxy
Configure PAM
Configure access control
Configure performance tuning
Configure advanced IOS Firewall features
Implement secure networks using Cisco VPN solutions
Configure IPsec LAN-to-LAN (IOS/ASA)
Configure SSL VPN (IOS/ASA)
Configure Dynamic Multipoint VPN (DMVPN)
Configure Group Encrypted Transport (GET) VPN
Configure Easy VPN (IOS/ASA)
Configure CA (PKI)
Configure Remote Access VPN
Configure Cisco Unity Client
Configure Clientless WebVPN
Configure AnyConnect VPN
Configure XAuth, Split-Tunnel, RRI, NAT-T
Configure High Availability
Configure QoS for VPN
Configure GRE, mGRE
Configure L2TP
Configure advanced Cisco VPN features
Configure Cisco IPS to mitigate network threats
Configure IPS 4200 Series Sensor Appliance
Initialize the Sensor Appliance
Configure Sensor Appliance management
Configure virtual Sensors on the Sensor Appliance
Configure security policies
Configure promiscuous and inline monitoring on the Sensor Appliance
Configure and tune signatures on the Sensor Appliance
Configure custom signatures on the Sensor Appliance
Configure blocking on the Sensor Appliance
Configure TCP resets on the Sensor Appliance
Configure rate limiting on the Sensor Appliance
Configure signature engines on the Sensor Appliance
Use IDM to configure the Sensor Appliance
Configure event action on the Sensor Appliance
Configure event monitoring on the Sensor Appliance
Configure advanced features on the Sensor Appliance Configure and tune Cisco IOS IPS
Configure SPAN & RSPAN on Cisco switches
Implement Identity Management
Configure RADIUS and TACACS security protocols
Configure LDAP
Configure Cisco Secure ACS
Configure certificate-based authentication
Configure proxy authentication
Configure 802.1x
Configure advanced identity management features
Configure Cisco NAC Framework
Implement Control Plane and Management Plane Security
Implement routing plane security features (protocol authentication, route filtering)
Configure Control Plane Policing
Configure CP protection and management protection
Configure broadcast control and switchport security
Configure additional CPU protection mechanisms (options drop, logging interval)
Disable unnecessary services
Control device access (Telnet, HTTP, SSH, Privilege levels)
Configure SNMP, Syslog, AAA, NTP
Configure service authentication (FTP, Telnet, HTTP, other)
Configure RADIUS and TACACS security protocols
Configure device management and security
Configure Advanced Security
Configure mitigation techniques to respond to network attacks
Configure packet marking techniques
Implement security RFCs (RFC1918/3330, RFC2827/3704)
Configure Black Hole and Sink Hole solutions
Configure RTBH filtering (Remote Triggered Black Hole)
Configure Traffic Filtering using Access-Lists
Configure IOS NAT
Configure TCP Intercept
Configure uRPF
Configure CAR
Configure NBAR
Configure NetFlow
Configure Anti-Spoofing solutions
Configure Policing
Capture and utilize packet captures
Configure Transit Traffic Control and Congestion Management
Configure Cisco Catalyst advanced security features
Identify and Mitigate Network Attacks
Identify and protect against fragmentation attacks
Identify and protect against malicious IP option usage
Identify and protect against network reconnaissance attacks
Identify and protect against IP spoofing attacks
Identify and protect against MAC spoofing attacks
Identify and protect against ARP spoofing attacks
Identify and protect against Denial of Service (DoS) attacks
Identify and protect against Distributed Denial of Service (DDoS) attacks
Identify and protect against Man-in-the-Middle (MiM) attacks
Identify and protect against port redirection attacks
Identify and protect against DHCP attacks
Identify and protect against DNS attacks
Identify and protect against Smurf attacks
Identify and protect against SYN attacks
Identify and protect against MAC Flooding attacks
Identify and protect against VLAN hopping attacks
Identify and protect against various Layer2 and Layer3 attacks
主要的參考書目:
中文書:
CCIE安全認證考試指南
管理cisco網(wǎng)絡(luò)安全
CSVPN認證考試指南
CSPFA認證考試指南
Cisco入侵檢測系統(tǒng)
網(wǎng)絡(luò)安全原理與實踐
英文書:(原版及影印)
Ciscopress CCIE practical labs :security
Ciscopress CCIE Security Exam Certification Guide
Ciscopress CCIE Practical Studies Security
Ciscopress Cisco Designing Perimeter Security
Ciscopress Cisco Designing VPN Security
CiscoPress Network Security Principles and Practices
CiscoPress Web Security Field Guide
CiscoPress Cisco Router Firewall Security
ciscopress ccsp SECUR study guide
CiscoPress SECUR exam certification guide
ciscopress ccsp CSVPN study guide
CiscoPress CSVPN Exam Certification Guide
ciscopress ccsp CSPFA study guide
CiscoPress CSPFA Exam Certification Guide
ciscopress ccsp CSIDS study guide
ciscopress ccsp CSI study guide
ciscopress CSI exam certification guide