For Sales Kathy Hall

Transcription

1 IT4E Schedule Gold Circle Omaha NE Course Number Course Name Course Description For Sales Chris Reynolds v2.0 SKY Deploying Cisco ASA Solutions For Sales Kathy Hall The Deploying Cisco ASA Solutions () v2.0 course is part of the curriculum path that leads to the Cisco CCNP Security certification. This five-day instructor-led course is aimed at providing network security engineers with the knowledge and skills that they need to implement and maintain Cisco ASA adaptive security appliance-based perimeter solutions. Successful graduates will be able to use Cisco ASA features to reduce the risk to the IT infrastructure and applications and to provide detailed operations support for the Cisco ASA security appliance. To participate in the hands-on labs in this class, you need to bring a laptop computer with the following: We recommend using at least a Pentium 4 or better and 1 GB of RAM or more. We recommend running Windows XP Professional SP3 or greater (Vista & Windows 7/8). Mac & Linux machines are also supported. All PCs require Internet Explorer 7 or greater, Mozilla FireFox, or Google Chrome. Note: When testing connectivity, Mozilla & Chrome may not be able to fully complete the tests as intended. All students should have administrator rights to their PCs. If you do not have administrator rights to your PC, you at least need permissions to download, install, and run Active-X controls in Internet Explorer or Cisco Any Connect Client. If you are participating in a WebEx event, you should have internet access served by at least a 512K link, a full T1 Connection is recommended. All PCs require the latest Java Runtime Environment, which can be downloaded from If you have any questions or issues with meeting the recommended requirements, please contact us at rlt@skyline-ats.com to discuss. Course Objective Upon completing this course, the learner will be able to meet these overall objectives: Describe the general properties of the Cisco ASA security appliance subsystem Implement and maintain Cisco clientless remote access Secure Sockets Layer (SSL) s on the Cisco ASA security appliance gateway Thursday, October 16, 2014 Page 1 of 6

2 Implement and maintain Cisco AnyConnect client-based remote access SSL s on the Cisco ASA security appliance gateway, according to policies and environmental requirements Implement and maintain Cisco remote access IP Security (IPsec) s on the Cisco ASA gateway, according to policies and environmental requirements Implement and maintain site-to-site solutions on the Cisco ASA security appliance gateway, according to policies and environmental requirements Deploy endpoint security with Cisco Secure Desktop and dynamic access policy (DAP), and deploy and manage high-availability and high-performance features of the Cisco ASA security appliance Course Audience The primary audience for this course is as follows: Network security engineers Course Prerequisite The knowledge and skills that a learner must have before attending this course are as follows: Cisco CCNA certification Cisco CCNA Security certification Completion of the course Deploying Cisco ASA Firewall Solutions (FIREWALL) Working knowledge of the Microsoft Windows operating system Course Length Days 5 Associated Exam Number Module Details Price $3, Module 1: Cisco ASA Adaptive Security Appliance Architecture and Common Components Lesson 1: Evaluating the Cisco ASA Adaptive Security Appliance Subsystem Architecture Identify the various topologies and identify the correct topology to use for a given scenario Identify the Cisco ASA security appliance IPv6 capabilities Identify the components of the Cisco AnyConnect Secure Mobility Client 3.0 Identify the available licensing options and choose the appropriate licensing option for your network Lesson 2: Evaluating the Cisco ASA Adaptive Security Appliance Software Architecture Describe the principles of the Cisco ASA security appliance access control model Evaluate Cisco ASA security appliance -related routing features Evaluate Cisco ASA security appliance -related NAT features Evaluate Cisco ASA security appliance -related AAA features Lesson 3: Implementing Profiles, Group Policies, and User Policies Describe the components of Cisco ASA security appliance policy configuration Configure Cisco ASA security appliance connection profiles Configure Cisco ASA security appliance group policies Describe AAA functions that are available in remote access s Configure Cisco ASA security appliance user attributes Identify access control methods for users Implement accounting to external RADIUS and TACACS+ servers Thursday, October 16, 2014 Page 2 of 6

3 Identify Cisco Secure Desktop and DAP features Lesson 4: Implementing PKI Services Evaluate PKI services for IPsec and SSL configurations Evaluate methods of deploying server-side certificates on the Cisco ASA security appliance Choose the appropriate CA server for your design Describe methods for deploying a client certificate to use with Cisco deployments Configure and verify the local CA on the Cisco ASA security appliance and the Cisco AnyConnect client using client certificates that are provisioned by a Cisco ASA security appliance Configure and verify certificate-to-connection-profile mapping on the Cisco ASA security appliance Describe SCEP proxy operations Module 2: Cisco ASA Adaptive Security Appliance Clientless Remote Access SSL Solutions Lesson 1: Deploying Basic Clientless Solutions Describe the building blocks of, and use cases for, the Cisco ASA clientless SSL solution Plan the configuration of a clientless SSL solution Configure and verify basic Cisco ASA security appliance gateway features and gateway authentication for a clientless SSL Configure and verify password-based local user authentication in a clientless SSL Configure and verify basic access control in a clientless SSL Tune and verify the gateway content-rewriting features Troubleshoot session establishment between a browser client and a Cisco ASA security appliance gateway Lesson 2: Deploying Advanced Application Access for Clientless SSL s Plan the deployment of clientless SSL application-access features Configure and verify application plug-ins Configure and verify smart tunnels in clientless SSL s Troubleshoot advanced application access in clientless SSL s Lesson 3: Deploying Advanced Authentication and SSO for Clientless SSL s Design clientless SSL authentication Deploy client-side certificate-based authentication Configure and verify multiple client authentications Troubleshoot the integration of a clientless SSL with PKI Configure and verify clientless SSO methods Troubleshoot clientless SSO methods Lesson 4: Customizing the Clientless SSL User Interface and Portal Configure and verify basic customization of the portal navigation pages Configure and verify complete portal HTML customization Configure and verify portal localization Configure and verify portal help customization Configure and verify application-integration customization Module 3: Cisco AnyConnect Remote Access SSL Solutions Lesson 1: Deploying a Basic Cisco AnyConnect Full-Tunnel SSL Solution Describe the operation of full-tunnel SSL technology Plan, configure, and verify the gateway features of the Cisco ASA security appliance for a Thursday, October 16, 2014 Page 3 of 6

4 Cisco AnyConnect full-tunnel SSL solution Configure and verify password-based local user authentication and client IP address assignment for a full-tunnel SSL Configure basic access control and split tunneling for a full-tunnel SSL Install, configure, and verify Cisco AnyConnect 3.0 using the predeployment method Troubleshoot session establishment between a Cisco AnyConnect client and a Cisco ASA security appliance gateway Lesson 2: Deploying an Advanced Cisco AnyConnect Full-Tunnel SSL Solution Describe the tasks that you use to configure centrally controlled client functions in for Cisco AnyConnect clients Deploy DTLS on the Cisco ASA security appliance Deploy and upgrade Cisco AnyConnect from a Cisco ASA gateway Configure and verify Cisco AnyConnect XML profiles Configure and verify the Cisco AnyConnect Trusted Network Detection, scripting, and SBL feature Customize and verify the Cisco AnyConnect user interface Lesson 3: Deploying Advanced Authentication, Authorization, and Accounting in Cisco Full-Tunnel s Choose a gateway and user authentication method in Cisco AnyConnect full-tunnel SSL s Plan the deployment of advanced client authentication Configure and verify the local CA on the Cisco ASA security appliance and the Cisco AnyConnect client with client certificates that are provisioned by the Cisco ASA security appliance Configure and verify the Cisco ASA security appliance and Cisco AnyConnect client to use an external CA and provision client certificates Configure SCEP proxy for Cisco AnyConnect Configure and verify integration with supporting PKI entities Configure multiple client authentication Troubleshoot advanced client authentication in full-tunnel SSL s Configure and verify local and remote group policy authorization in a Cisco full-tunnel SSL Configure and verify local and remote group policy accounting in a Cisco full-tunnel SSL Module 4: Cisco ASA Adaptive Security Appliance Remote Access IPsec s Lesson 1: Deploying Cisco Remote Access Clients Describe the operation of IPsec technology Choose the appropriate Cisco Client product Install, configure, and verify the installation of the legacy Cisco IPsec Client Configure and verify the legacy Cisco IPsec Client profiles Configure and verify advanced the legacy Cisco IPsec Client profile settings Install, configure, and verify the installation of Cisco AnyConnect 3.0 Configure and verify the auto-initiation feature of Cisco AnyConnect 3.0 Troubleshoot Cisco remote access session establishment Lesson 2: Deploying Basic Cisco Remote Access IPsec Solutions Plan the configuration of a Cisco remote access IPsec gateway Configure and verify basic Cisco ASA gateway features and gateway authentication in a Cisco for remote access IPsec s Thursday, October 16, 2014 Page 4 of 6

5 Configure and verify Cisco remote access PSK-based peer authentication Configure and verify Cisco remote access extended authentication Configure and verify Cisco remote access hybrid authentication Configure and verify Cisco remote access local IP address management Configure and verify Cisco remote access basic access control and split tunneling Configure IKEv2 support for remote access IPsec solutions Troubleshoot Cisco remote access session establishment between a Cisco client and a Cisco ASA gateway Module 5: Cisco ASA Adaptive Security Appliance Site-to-Site IPsec Solutions Lesson 1: Deploying Basic Site-to-Site IPsec s Plan a Cisco ASA security appliance site-to-site Configure and verify basic peer authentication in a Cisco ASA security appliance site-to-site Configure and verify transmission protection in a Cisco ASA security appliance site-to-site Troubleshoot the operation of a Cisco ASA security appliance site-to-site Lesson 2: Deploying Advanced Site-to-Site IPsec s Plan a Cisco ASA security appliance site-to-site using PKI- based authentication Configure and verify PKI-based peer authentication in a Cisco ASA security appliance site-tosite Troubleshoot the operation of a PKI-based Cisco ASA security appliance site-to-site Module 6: Endpoint Security and High Availability for Cisco ASA s Lesson 1: Implementing Cisco Secure Desktop and DAP for SSL s Choose network admission features for Cisco AnyConnect full-tunnel SSL s Install, enable, and verify Cisco Secure Desktop on a Cisco ASA security appliance SSL gateway Configure and verify Cisco Secure Desktop prelogin criteria on a Cisco ASA security appliance SSL gateway Configure and verify Cisco Secure Desktop prelogin policies on a Cisco ASA security appliance SSL gateway Configure and verify basic Cisco Secure Desktop Advanced Endpoint Assessment features on a Cisco ASA security appliance SSL gateway Configure and verify DAPs that are enabled for Cisco Secure Desktop on a Cisco ASA security appliance SSL gateway Troubleshoot Cisco Secure Desktop operations on a Cisco ASA security appliance SSL gateway Lesson 2: Deploying High-Availability Features in Cisco ASA Adaptive Security Appliance s Choose high-availability and high-performance features Configure and verify redundant peering with Cisco AnyConnect and IPsec client Deploy active/standby failover for SSL and IPsec s Implement dynamic routing to achieve IPsec site-to-site high availability Describe the deployment of load-balancing clusters Provide high availability and high performance using an external SLB appliance Troubleshoot Cisco ASA security appliance failover and clustering functions Lab Outline Lab 2-1: Configuring Basic Clientless Access on the Cisco ASA Security Appliance Thursday, October 16, 2014 Page 5 of 6

6 Lab 2-2: Configuring Advanced Application Access for Clientless SSL s Lab 2-3: Customizing the SSL Portal on the Cisco ASA Security Appliance Lab 3-1: Configuring Basic Cisco AnyConnect Client Full-Tunnel SSL s Using Local Password Authentication Lab 3-2: Deploying the Cisco AnyConnect Client with Centralized Management Lab 3-3: Configuring Basic Cisco AnyConnect Full-Tunnel SSL s Using Local CA and SCEP Proxy Lab 4-1: Deploying Basic Remote Access IPsec with IKEv2 Lab 5-1: Deploying a Basic Cisco ASA Security Appliance IPsec IKEv1 Site-to-Site Lab 6-1: Deploying Cisco Secure Desktop in Cisco SSL s Lab 6-2: Configuring a Load-Balancing SSL Cluster Thursday, October 16, 2014 Page 6 of 6