CISCO IOS FIREWALL FEATURE SET

11. CBAC provides secure, per-application access control for all traffic across perimeters .

12. CBAC intelligently filters TCP and UDP packets based on application layer protocol information.

13. CBAC creates dynamic access control entries (ACEs) from information in the state table.

14. CBAC inspects and monitors the control channels of sessions.

15. CBAC only monitors the data channels of sessions.

16. To re-enable alert messages to the router's console, use the command Router(config)# no ip inspect alert-off .

17. CBAC audit trail messages are disabled by default. Use the ip inspect audit-trail command to enable them.

18. By default, the TCP SYN wait time is 30 seconds.

19. By default, the TCP FIN wait time is 5 seconds.

20. By default, the DNS idle timeout is 5 seconds.

21. By default, the TCP idle timeout is 3,600 seconds.

22. By default, the UDP idle timeout is 30 seconds.

23. The router takes measurements once per minute for the max-incomplete high and the max-incomplete low thresholds.

24. The default ip inspect max-incomplete high threshold is 500 half- open sessions.

25. The default ip inspect max-incomplete low threshold is 400 half-open sessions.

26. CBAC goes into aggressive mode when the number of half-open sessions exceeds the ip inspect max-incomplete high threshold.

27. The router measures the ip inspect one-minute threshold more frequently than once per minute, contrary to the command's name .

28. ip inspect max-incomplete uses a one-minute sampling period.

29. The default ip inspect tcp max-incomplete host number threshold is 50 half-open sessions.

30. The default block-time value is 0 (zero) seconds.

31. If the CBAC router receives noninitial packet fragments before the router receives the initial packet fragment, the router drops the noninitial fragment packets.

32. CBAC Java inspection cannot detect, and therefore inspect or block, Java applets if the applet is encapsulated. An encapsulated Java applet might be contained in a Zip file, for example.

33. CBAC does not inspect application traffic running on nonstandard application ports unless you use port-to-application mapping (PAM).

34. Authentication is proving your identity.

35. Authorization decides what resources you can access.

36. Network-access sessions terminate at the corporate resource being accessed; the session does not terminate at a networking device.

37. Remember, you can run either the TACACS+ protocol or the RADIUS protocol, or you can run both protocols simultaneously to provide AAA services.

38. TACACS+ encrypts the entire packet for confidentiality when communicating between the TACACS+ server and the router.

39. RADIUS is based on the client/server mode.

40. AppleTalk Remote Access (ARA) and NetBEUI are not supported by RADIUS.

41. The AAA daemon is disabled by default.

42. The TACACS+ server can return three possible status messages: Pass, Fail, and Error. Pass means authentication was successful. Fail means authentication was not successful. Error means that there was some problem and authentication could not be determined.

43. The aaa authentication login default method applies to all lines and interfaces by default unless overridden by a more specific method.

44. service=shell means the user is attempting to access the router's EXEC shell. The command and keyword that were used to specify that authorization must be obtained for attempts to access the shell was aaa authorization exec .

45. You can access Access Control Server (ACS) via a Web browser. You must specify the port number 2002 when connecting to the ACS. If you do not, you will not get to the ACS login screen.

46. Cisco's premier identity product is Cisco Secure Access Control Server (CSACS). You use CSACS to ensure that users are who they say they are.

47. CSACS v3.0.1 added the following major features:

    • 802.1x support

    • MS CHAPv2 support

    • MS CHAP password aging support

    • Command authorization sets

    • EAP-TLS and EAP-MD5 support

48. The protocol used to communicate between the CSACS server and the token-card server is usually a proprietary protocol.

49. CSACS also supports additional databases:

    • Generic LDAP

    • Novell NDS

    • ODBC “compliant relational databases

50. CSUtil.exe is a command-line application that performs CSACS database backups and database restores .

51. The ACS appliance does not support a Windows GUI login.

52. If the ACS appliance crashes, it automatically reboots.

53. The appliance monitors ACS services, and any failed service is restarted automatically.

54. The first place to check is the Failed Attempts report when troubleshooting.

55. You can only configure proxyacls that use the permit keyword. All users must be configured with a privileged level equal to 15.

56. The Key Distribution Center (KDC) acts like a CA, and the KDC is a trusted third party.

57. For the certification purposes only, Kerberos can use either a 40-bit or 56-bit DES key.

58. The numbers of signatures that are predefined with the IOS Firewall are either 59 or 100. How many signatures you get depends upon the version of IOS Firewall that you are running.

59. IDS on a router can be CPU intensive , can affect router performance, and may require memory for limited persistent storage.

60. Cisco recommends that the drop and reset actions be used in conjunction to terminate an attack.

61. The log keyword is enabled by default and sends events to a syslog server or the router's console.

62. The default event queue size is 100 events.

63. Events are overwritten on a FIFO (first-in, first-out) basis. If you configure a queue size of 200 events, and there are presently 200 events waiting to be transmitted, the very next new event will overwrite the first queued event, event number 1.

64. The default global IDS action for both informational signatures and attack signatures is alarm.

65. The default number of recipients is 250 if you do not change the threshold.

66. Authentication proxy uses HTTP to authenticate users. Authentication proxy is HTTP-based authentication.

67. The key concept of authentication proxy is that it is dynamic, per-user authentication and authorization using either a TACACS+ server or a RADIUS server.

68. Only permit statements are allowed when configuring proxyacls.

69. You must use the keyword any for the source IP address.

70. It is important to configure the authentication proxy idle timeout to a higher value than the CBAC idle timeout value, if you are using CBAC. If you set the authentication proxy idle timeout to a value that is less than the CBAC idle timeout value, idle connections might hang.

71. The permit entries in the IP ACL indicate that those hosts or networks that are specified with the permit keyword must authenticate using authentication proxy.

72. Newer versions of the IOS allow for the use of both standard named or number and extended named or numbered IP access lists with authentication proxy. However, Cisco course curriculum for authentication proxy indicates that only standard numbered IP access lists can be used. If given a single answer selection question, go with standard numbered IP access lists.

73. If the output of the show ip auth-proxy cache command displays HTTP_ESTAB , then that specific user has authenticated successfully.