Global Knowledge Training Blog » VPN

CCNP Security Exam Prep Question of the Week

Dawn Hopper — Thu, 03 May 2012 17:25:02 +0000

Which of the following provide high availability and performance enhancements for VPN sessions?

Stateful active/standby failover
Global Access Control Lists
Cluster load balancing
Server load balancing

The correct answers are 1, 3, and 4.

With Stateful Active/Standby failover, VPN users do not have to reconnect or reauthenticate should the Active ASA fail. With Cluster Load balancing a group of ASAs will work cooperatively to share the VPN load. With Server Based Load Balancing a Cisco Application Control Engine (ACE) is installed in a Cisco 7600/6500 series device and is used as an SSL VPN front end to multiple ASA servers running in parallel.

CCNP Security Question of the Week Series

CCNP Security Question of the Week

Dawn Hopper — Thu, 08 Mar 2012 18:52:53 +0000

Which of the following uses a polling method for revocation checking in a PKI environment?

AAA
CRL
OCSP
Not available

The correct answer is 2.

A Certificate Authority (CA) will publish its Certificate Revocation List (CRL) to identify the serial numbers of certificates that are no longer valid. The Fully Qualified Domain Name (FQDN) with the location of the CRL is placed into the CA root certificate. A host that chooses to trust the CA can use that information to periodically poll the CRL to determine which certificates have been revoked and should no longer be used.

CCNP Security Question of the Week Series

CCNP Security Question of the Week

Dawn Hopper — Thu, 23 Feb 2012 18:08:40 +0000

A user has called the helpdesk for a VPN-related issue. While at a coffee shop, the user attempted to connect to the VPN using the IPsec client and failed. In other locations, the user can successfully connect. Which of the following settings would more than likely allow the user to access the VPN while at this coffee shop?

Enable IPsec over TCP
Disable group authentication
Enable DTLS
Change the port number that the IPsec tunnel listens on at the head end ASA

The correct answer is 1.

In many environments, Port Address Translation (PAT) is used to connect users to the internet. IPSec and PAT are not compatible without using either NAT-T (NAT Traversal) on UDP port 4500, or the Cisco proprietary solution of IPSec over TCP (usually to port 10,000).

CCNP Security Question of the Week Series

CCNP Security Question of the Week

Dawn Hopper — Thu, 09 Feb 2012 18:03:36 +0000

When configuring a site-to-site IPsec tunnel, which of the following is a valid command?

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 2.2.2.2 type s2s
tunnel-group SiteB type ipsec l2l
tunnel-group SiteB type s2s

The correct answer is 1.

LAN to LAN VPNs will use a connection profile with the IP address of the peer being connected to. Hence options C and D are not valid because they use a name instead of an ip address as the identifier for the connection profile. Option B is also incorrect because although it uses an ip address to identify the connection profile, the syntax of s2s is not valid.

CCNP Security Question of the Week Series

CCNP Security Question of the Week

Dawn Hopper — Thu, 26 Jan 2012 18:08:57 +0000

In which of the following methods can a VPN user be automatically associated with a connection profile?

Certificate mapping
Group alias
Group URL
Cannot be done

The correct answers are 1 and 2.

Every VPN user needs to be associated with a connection profile in order for the ASA to determine which set of policies to apply to the connection. If certificate based authentication is in use, the a certificate to connection profile mapping can be used. Otherwise and alias can be displayed to the user at logon to allow for selection of the appropriate profile.

CCNP Security Question of the Week Series

The Cure for an Aging Hospital Campus Network

Guest Authors — Mon, 16 Jan 2012 13:00:41 +0000

This is a story about how a hospital in Illinois used Juniper to build a more robust and efficient network. The town of Ottawa in north-central Illinois has a long history of providing quality healthcare. The Ottawa Regional Hospital & Healthcare Center was founded in 1895, and more than a century later, its 1,000 employees provide comprehensive inpatient and outpatient health services and emergency care through the hospital’s 120-bed facility.

Challenges

Ottawa Regional’s campus spans eight buildings, which are interconnected with a private fiber network. A physician office is connected to the main campus through T-1 circuits.

The hospital wanted to upgrade its 100 Mbps campus network to 10GbE. It also wanted to enhance network reliability and availability to meet the rigorous demands of healthcare IT, while minimizing complexity and reducing operating expenses. It was time for a new approach and “the new network.”

Ottawa Regional’s new campus network had to meet several requirements. First and foremost, it needed a high-performance infrastructure to support voice over IP (VoIP) and new healthcare information management software. Higher WAN speeds were also essential to support its enterprise virtual private network (VPN), remote access, and a quality voice experience.

The hospital also wanted to improve network resiliency. Its Ethernet switches were daisychained on the fiber, which meant that if one switch failed, the entire network could go down. Plus, the incumbent switches didn’t support Power over Ethernet (PoE), which the hospital needed to support IP telephony. Furthermore, the campus WAN architecture had a single point of failure that could negatively impact the hospital’s enterprise VPN, firewall, and WAN services.

Solution

The hospital deployed Juniper Networks routing, switching, and security solutions to build its new network and also installed new single-mode fiber between campus buildings to support high-performance networking. The campus network consists of Juniper Networks® EX Series Ethernet Switches. The EX4200 line of Ethernet switches with Virtual Chassis technology provides carrier-class performance in a single rack unit form factor that is easy to deploy and manage. The EX4200 switches are also powered by Juniper Networks Junos® operating system.

Virtual Chassis technology enables up to 10 interconnected EX4200 switches to behave and operate like a single logical device, reducing management overhead and operational expenses. Switches can be added to a Virtual Chassis configuration incrementally, as needed, delivering a scalable and energy efficient solution that doesn’t demand a large up-front investment.

Ottawa Hospital deployed Juniper Networks J Series Services Routers at the network edge. The J6350 Services Router is a modular router that’s ideal for enterprises running desktops, servers, VoIP, and enterprise applications. The Juniper routers connect the hospital to the high-speed Illinois Century Network (ICN) as well as AT&T for redundant WAN connectivity.

Juniper Networks SRX Series Services Gateways provide firewall, VPN, and intrusion prevention system (IPS) as well as antispam, antivirus, and Web filtering, protecting the hospital against known and emerging threats. Physicians and administrative staff at Ottawa Regional have secure remote access to key applications via any standard Web browser, thanks to Juniper Networks SA4500 SSL VPN Appliance. The use of SSL eliminates the need for preinstalled client software, changes to internal servers, and costly ongoing maintenance and desktop support. The SA Series provides Ottawa’s IT staff with extranet features that allow controlled access to differentiated users and groups without requiring infrastructure changes, demilitarized zone (DMZ) deployments, or software agents.

Results

One of Ottawa Regional Hospital’s biggest benefits from its new network is the ability to do more with less. With the new network the hospital increased network capacity more than 20 times from its previous infrastructure. The hospital has 10GbE links per fiber strand, which is enabled by a full 20GbE fiber ring to improve network resiliency. With J Series routers, the hospital has successfully migrated from a static routed environment to OSPF, which has improved network resiliency.

The EX Series switches gave the hospital the port density it needed to support core and edge access. It has 48 1GbE PoE ports in a compact platform on the EX Series switches. The routing infrastructure has sufficient room to grow as well, moving from supporting just one T1 to three T1s for redundancy.

Junos OS, a single network operating system that runs across Juniper Networks routing, switching, and security platforms, reduces cost and complexity, minimizes operator error, and increases reliability. Because Junos OS automates network operations in a streamlined system, Ottawa’s IT staff has more time to focus on strategic, proactive efforts.

The hospital has also been able to improve security to better comply with regulatory requirements such as the Health Information Portability and Accountability Act (HIPAA). The hospital now enjoys best-in-class enterprise network compliance security while protecting against emerging security threats. Plus, physicians and staff have secure and easy access to essential applications from anywhere, anytime, which allows the hospital to deliver better patient care.

Excerpted and reposted with permission from Juniper.net (pdf).

CCNP Security Question of the Week

Dawn Hopper — Thu, 12 Jan 2012 18:19:24 +0000

When setting the name of an interface from the command line, what is the default security level on any interface with a name other than inside?

0
50
100
none

The correct answer is 1.

When working from the command line (CLI) all interfaces other than the inside interface get a default security level of 0 (Most untrusted).

CCNP Security Question of the Week Series

Five Must-Have Technologies for 2012

Guest Authors — Mon, 02 Jan 2012 13:23:00 +0000

Is your network ready for the New Year? In order to be fully prepared, your business may need these technologies to move forward:

Reliable and secure Wi-Fi access. Smartphones, tablets, and wireless IP phones need the speed and stability of Wireless-N (802.11n) network access, as well as quality of service (QoS) support. Some wireless routers integrate security — such as VLANs, firewall, VPN, and security services — to increase and simplify your control.
Power over Ethernet (PoE). PoE juices up a network in two ways: It gives you more flexibility locating wireless access points and other wired devices, and it adds more power per port to support higher-draw technologies such as Wireless-N.
Stronger network security. Mobility, social networking, cloud services, and international hacking are growing. Is your security technology keeping pace? Essential technologies include content security, firewall, VPN, and VLANs. Integrated security solutions can increase application performance and give you better control.
Collaborative communications. Businesses can reduce operating costs and raise productivity by through unified communications and video and audio conferencing applications. Collaboration technologies demand high-performance, high-availability connections and reliable, intuitive user devices, ranging from basic IP phones to unified IP phones.
High-performance, high-availability connections. Businesses that use mobile devices, cloud applications, or IP voice or video require a fast and efficient traffic flow. If you want to optimize your traffic flow by investing in a new router or switch (or DNS server), it should include support for IPv6.

Recreated with permission from Cisco.com.

CCNP Security Question of the Week

Dawn Hopper — Fri, 30 Dec 2011 18:52:14 +0000

True or False — The AIP-SSM supports hot swap capabilities.

The answer is False.

The Cisco ASA AIP-SSM does not support hot swap capabilities. To install the module, you must first shut down the Cisco ASA adaptive security appliance. You then power on the appliance after the module has been installed.

CCNP Security Question of the Week Series

CCNP Security Question of the Week

Dawn Hopper — Thu, 15 Dec 2011 18:41:19 +0000

The command that can be used on the standby firewall to force control back, making that firewall become active is?

failover preempt
reset failover
failover primary
failover active

The correct answer is 4.

Use the failover active command when you need to force the current unit into the active state. This need can occur in a situation such as when you want to switch control back from a unit after you have fixed a problem and want to restore service to the current standby unit.