Index

index

A

address hiding rules

: definition of 7-23, 7-25
: port mapping 7-26
: tasks 7-27
: using 7-24

authentication server 4-67

: certificate authority 4-68
: definition of 4-67
: RADIUS server 4-68
: TACACS+ server 4-69

Authentication Server panel 4-67

certificate authority 4-68

RADIUS server 4-68

TACACS+ server 4-69

tasks

: adding to a host 4-70

B

bus topology 2-5

: modeling 2-5

C

Certificate Authority panel 4-68

checklist

: define network topology 3-6

Cisco Secure Policy Manager 4-56

: host 3-9

Cisco Secure Policy Manager node 4-56

tasks 4-58

: creating a new primary or secondary server 4-58

cloud 4-20

: Internet 4-2

cloud network 4-21

: definition of 4-21

Cloud node 4-19

cloud network 4-21

definition of 4-21

example uses 2-2, 4-20

interfaces 4-22

non-cloud network 4-22

tasks 4-23

: configuring interfaces for 4-25
: creating a new 4-23
: defining cloud network within 4-27

command generation 1-3

support limitation 1-3

: IOS interface commands 1-3

D

device-centric settings 1-5

: global service settings 1-6
: network interface settings 1-6
: policy enablement settings 1-7
: policy-specific settings 1-7
: system maintenance settings 1-7
: traffic flow settings 1-6

documentation

: feedback xvii

downstream 2-7

: definition of 2-7

F

flow restriction 7-35

definition of 7-35

example uses 7-44

symmetry 7-42

types of 7-38

: inter-gateway 7-40
: intra-gateway 7-38
: regional 7-42

unexpected behavior in

: route generation 7-38
: security policy enforcement 7-37

H

Host node 4-62

definition of 4-62

example uses 4-62

tasks 4-63

: adding a client/server product type 4-66
: creating a new 4-64

I

initial setup 2-1

interface

definition of 1-18

type

: downstream 1-18
: real 1-18
: upstream 1-19
: virtual 1-18

types 4-41

: cloud interface 4-22
: generic router 4-52
: Internet interfaces 4-3
: IOS Router interfaces 4-43
: PIX Firewall interfaces 4-29
: real 4-41
: unnumbered 4-41
: virtual 4-41

Internet node 4-2

definition of 4-2

interfaces 4-3

Internet perimeter 4-3

tasks 4-5

: defining cloud networks under 4-11
: defining networks under 4-9
: specifying interface settings for 4-5

IOS Router node 4-40

definition of 4-41

device-specific settings 5-9

: Settings 1 panel 5-10
: Settings 2 panel 5-10
: Settings 3 panel 5-10

interfaces 4-43

Settings 1 panel 5-10

Settings 2 panel 5-10

Settings 3 panel 5-10

tasks 4-44

: creating a new 4-45
: enabling address translation overload 5-11
: enabling ICMP echo-reply traffic 5-13
: for device-specific setting panels 5-10
: specifying global CBAC settings 5-15
: specifying global inspection command settings 5-18

: specifying interface settings for 4-48
: specifying syslog generation settings 5-13

IP Range node 4-59

definition of 4-59

dependency 4-60

example uses 4-60

tasks

: creating an IP range 4-61

IPSec panel 6-27

certificate authority support 6-30

DES cipher 6-29

discovery of certificate information 6-31

IKE secret type 6-30

setting options 6-29

support on network objects 6-28

tasks 6-32

: discovering certificate information 6-36
: specifying DES cipher support 6-33
: specifying pre-shared secrets for IKE 6-34
: specifying which certificate authority to use 6-35

K

key components 1-1

: definition of 1-1

key concepts

: downstream 2-7
: interface 1-16, 1-18
: network interface 1-18
: network shortcuts 2-7
: perimeter 1-16, 1-17
: upstream 2-7

L

LAN topologies 2-4

: bus 2-5
: modeling 2-4
: ring 2-6
: star 2-6
: tree 2-5
: using shortcuts to overcome limitations 2-7

M

Mapping panel

tasks

: changing an address hiding rule 7-31
: changing a path restriction rule 7-49
: changing a static translation rule 7-20
: creating an address hiding rule 7-28
: creating a path restriction rule 7-47
: creating a static translation rule 7-17
: viewing active address hiding rules 7-33
: viewing active path restriction rules 7-51
: viewing active static translation rules 7-23

mapping rules 7-13

types 7-13

: address hiding 7-13
: path restriction 7-14
: static translation 7-13

N

network address translation 7-23

network interface 1-18

Network node 4-11

definition of 4-12

task

: creating a network 4-12

Network Shortcut node 4-14

definition of 4-15

example uses 4-15

tasks 4-16

: creating manually 4-18
: creating with Topology Wizard 4-17

network shortcuts 2-7

: definition of 2-7

Network Topology tree 1-1

abstract physical topology 1-8

checklist 3-6

cloud example 2-2

dependencies 1-10

: creation 1-10
: policy enablement 1-10

guidelines 2-1

how much to define 1-8

key components 1-2

: certificate authority servers 1-4
: Cisco Secure Policy Manager servers 1-4
: IOS Router/Firewall 1-3
: ISP connections 1-3
: PIX Firewall 1-3
: Policy Enforcement Points 1-3
: syslog servers 1-5

limitations of the tree 2-1

logical structures 1-9

modeling

: LAN topologies 2-4
: map common objects 2-8

modeling the tree 2-1

network objects 1-10

: dependencies 1-10
: Host node 1-11
: Internet node 1-13
: uses 1-10

planning

: worksheet 3-11

relationship to policy 1-8

role in system 1-1

: device-centric settings 1-5
: overview 1-2

role of tree 1-8

top-down design 2-1

P

path restriction 7-34

: definition of 7-34

path restriction rules

: tasks 7-47

perimeter 1-17

: definition of 1-17
: restrictions 1-17

PIX Firewall node 4-28

definition of 4-29

device-specific settings 5-2

interfaces 4-29

Settings 1 dialog box 5-8

Settings 1 panel 5-1

tasks 4-31

: creating a new 4-32
: enabling Flood Guard on 5-8
: inverting trust relationships for interfaces 4-39
: on Settings 1 panel 5-2
: specifying global policy overrides for ICMP 5-3
: specifying global timeout settings for 5-4
: specifying interface route settings for 5-9
: specifying interface settings for 4-34
: specifying log settings for 5-6

Policy Distribution panel 6-1

definition of 6-2

deployment guidelines 6-3

selecting control for a Policy Enforcement Point 6-4

tasks

: toggling availability 6-12

troubleshooting 6-5, 6-10

: avoid loss of connectivity 6-8
: crossover traffic examples 6-5
: distribution ordering 6-10

Policy Enforcement Point 1-1

: definition of 1-1

Policy Enforcement Point panel 6-13

definition of 6-13

tasks 6-19

: selecting Policy Distribution Point for 6-22
: selecting Policy Monitor Point for 6-24
: selecting target syslog servers for 6-25
: specifying enable password for 6-26
: specifying IPSec Tunnel Template for 6-23
: specifying Telnet password for 6-26
: viewing network service definition for 6-27
: viewing TCP port used for administrative purposes of 6-27

troubleshooting 6-14

: early PIX Firewall versions 6-14
: modifying the IPSec Tunnel Group 6-15

port address translation 7-14

R

RADIUS Server panel 4-68

ring topology 2-6

: modeling 2-6

Router node 4-51

definition of 4-51

interfaces 4-52

tasks 4-52

: creating a new 4-53
: specifying interface settings for 4-54

Routes panel 7-1

example uses 7-4

: identify networks not defined in Network Topology 7-4
: override generated routes 7-4

tasks 7-7

: changing an existing rule 7-10
: creating a new rule 7-8
: disabling generation of derived routes 7-12
: viewing active rules 7-13

routing rules 7-2

definition of 7-2

types of 7-4

: Derived 7-4
: Implicit 7-4
: MANUAL 7-4

S

service and support xv

star topology 2-6

: modeling 2-6

static translation rules 7-14

: tasks 7-16

Syslog Server panel 4-72

definition of 4-72

tasks 4-72

: modifying IP address for 4-73
: modifying port setting for 4-74
: specifying network service definition for 4-75

T

TACACS+ Server panel 4-69

Technical Assistance Center

: warranty or maintenance contract xvi

traffic flow 1-1

: definition of 1-1
: types of restrictions on 7-38

traffic flow settings 1-6

tree topology 2-5

: modeling 2-5

trusted network 4-2

: definition of 4-2

U

unknown network 4-3

: definition of 4-3

untrusted network 4-3

: definition of 4-3

upstream 2-7

: definition of 2-7

W

: warranty xvi

Table of Contents

index