Cisco CCIE LAB Security Demo
V8
Update September, 2011
Cisco CCIE LAB Security
Cisco CCIE LAB Security
1.1
ASA1 initialzation
• Configure ASA 1 initialization , Use the exact names
Detail to Be Used
Interface name
interface
Security Level
IP Address
outside
Ethernet0/0
0
2YY.YY.4.10/24
inside
inside Ethernet0/1
100
2YY.YY.1.10/24
DMZ2
Ethernet0/2.2
20
2YY.YY.2.10/24
DMZ3
Ethernet0/2.3
30
2YY.YY.3.10/24
• Configure a default route pointing to the R4 IP address 2YY.YY.4.4
• Configure IP routing on ASA1
Interface
Protocol
Details
Redistribution
outside
OSPF
Area0
n/a
inside
RIPv2
--
RIP into OSPF only
DMZ2
OSPF
Area2
n/a
DMZ3
n/a
n/a
n/a
• You may allow any ICMP traffic in your ACL.
• Do NOT enable NAT control, importnat Note:
• You must finish the configuration of Q3.1,Sensor Initialization, in the IPS section, configuring an inline
VLAN
pair
between
ASA1
outside(vlan
100)
and
R4
Ethernet0/0(vlan 4).
• When inline VLAN pair is configured correctly , traffic can pass between the ASA outside interface and R4
• Modify the switch parameters as appropriate to achieve this task
Cisco CCIE LAB Security
1.2
Cisco ASA Failover
• Configure LAN-based active/standby failover on ASA1 and ASA2
• ASA1 is the primary, and ASA2 is the secondary.
• Use Etheraet0/3 for the failover LAN interface as 'failover' with the IP address
2YY.YY.5.10 for active and 2YY.YY.5.20 for standby.
• Use the failover password cisco
• Use standby IP address as shown in the output below
1.3
PIX Initialzation
Configure the admin, cl, and c2 contexts on the PIX as shown use the information given in the tables here. The context names are case-sensitive Admin Context Name ' admin'
Interface nameif
Allocate
Security Level
IP address
None
None
n/a
n/a