CCNA Security v2.0 Skills Assessment – A (Answer Key)

CCNA Security v2.0 Skills Assessment – Type A

Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only.

Topology

Assessment Objectives

• Part 1: Configure PCs and Verify Network Connectivity (5 points, 5 minutes)
• Part 2: Configure Secure Router Administrative Access (17 points, 15 minutes)
• Part 3: Configure a Zone-Based Policy Firewall (14 points, 10 minutes)
• Part 4: Configure an Intrusion Prevention System (15 points, 10 minutes)
• Part 5: Secure Layer 2 Switches (22 points, 20 minutes)
• Part 6: Configure ASA Basic Management and Firewall Settings (18 points, 15 minutes)
• Part 7: Configure the ASA for SSL VPN Remote Access Using ASDM (14 points, 15 minutes)

Scenario

This Skills Assessment (SA) is the final practical exam of student training for the CCNA Security course. The exam is divided into seven parts. The parts should be completed sequentially and signed off by your instructor before moving on to the next part. In Part 1, you will verify that the basic device settings have been preconfigured by the instructor. In Part 2, you will secure a network router using the command line interface (CLI) to configure various IOS features including AAA and SSH. In Part 3 and 4, you will configure a zone- based policy firewall (ZPF) and intrusion prevention using the Cisco IOS intrusion prevention system (IPS) on an integrated service router (ISR) using the CLI. In Part 5, you will configure and secure layer 2 switches using the CLI. In Parts 6 and 7, you will configure the ASA management and firewall settings using the CLI and implement an SSL Remote Access VPN using ASDM.

Instructor Note: The routers used in this SA are Cisco 1941 ISRs with Cisco IOS Release 15.4(3)M2 (universalk9 image). Other routers and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in this SA. Refer to the Router Interface Summary table at the end of this SA for the correct interface identifiers.

Instructor Note: Sample scoring and estimated times for each exam are provided. These can be adjusted by the instructor as necessary to suit the testing environment. Total points for the exam are 100 and the total time is estimated at 90 minutes. The instructor may choose to deduct points if excessive time is taken for a part of the assessment.

Required Resources

• 3 Routers (Cisco 1941 with Cisco IOS Release 15.4(3)M2 image with a Security Technology package license or comparable)
• 3 Switches (Cisco 2960 with Cisco IOS Release 15.0(2) lanbasek9 image or comparable)
• 1 ASA 5506 (OS version 9.8(1) and ASDM version 7.8(1) and Base license or comparable)
• 3 PCs (Windows 7 or Windows 8.1, with SSH Client software installed)
• Console cable to configure the Cisco IOS devices via the console ports
• Ethernet and Serial cables as shown in the topology

Instructor Notes:

Router Resource Requirements:

Note: The following requirements are critical to successful completion of this SA.

• The router that runs IPS (R3) requires a minimum of 192 MB of DRAM and at least 2 MB of free flash memory. It must also be running T-Train Cisco IOS Release 12.4(11)T1 or later (preferably 12.4(24)T8 or later) to support the version 5.x format signature package.

• This SA uses the newer Version 5.x signature files, which are independent of the Cisco IOS software. Prior to Cisco IOS release 12.4(11)T, Cisco IOS IPS had 132 built-in signatures available in the Cisco IOS software image. The built-in signatures are hard-coded into the Cisco IOS software image for backward compatibility. Starting with Cisco IOS release 12.4(11)T, there are no built-in (hard-coded) signatures within Cisco IOS software. Support for signatures and signature definition files (SDFs) in Cisco IPS version 4.x is discontinued in 12.4(11)T1 and subsequent Cisco IOS T-Train software releases.

• To configure IOS IPS for 12.4(11)T and later, a signature package in Cisco IPS version 5.x format is required to load signatures on an ISR. Cisco provides a version 5.x format signature package for CLI users.

• To download the latest IPS signature package and public crypto key files, you need a valid CCO (Cisco.com) account.

• Download the signature package (IOS-Sxxx-CLI.pkg) from: http://www.cisco.com/cisco/software/type.html?mdfid=281442967&catid=268438162

Note: It is recommended that you use the latest signature file available. However, if the amount of router flash memory is an issue, consider downloading an older version 5.x signature file, which requires less memory.
The S854 file is used with this SA, although newer versions are available. Consult CCO to determine the latest version for use in a production environment.

• Create the following public crypto key text file and name it realm-cisco.pub.key.txt, for use with IOS IPS:

crypto key pubkey-chain rsa 
 named-key realm-cisco.pub
  key-string
   30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
   00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
   17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
   B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E
   5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
   FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
   50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36
   006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
   2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
   F3020301 0001 
  quit

Note: The signature package file should be in the TFTP default directory for PC-C. The public key file should be available on the desktop or other known location.

Refer to the Chapter 5 Lab titled “Configuring an IPS Using the CLI” for additional details on IPS requirements.

Router and Switch Preparation

Erase the router and switch startup configurations. Before interconnecting the switches, delete the vlan.dat file from each switch. If the file is not deleted, VLAN information from one switch may be transferred to the other via VTP.

The IPS signature (.xml) file for R3 is in the flash:/ipsdir/ directory. If the file is in the flash directory, delete the file and the directory before starting the SA. Use the following procedure.

R3# show flash
-#- --length-- -----date/time	path

1	0	Jan	30	2015	00:24:58	+00:00	IPSDIR
2	1628152	Jan	30	2015	00:42:10	+00:00	IPSDIR/iosips-sig-default.xmz
3	835	Jan	30	2015	00:39:42	+00:00	IPSDIR/iosips-seap-typedef.xmz
4	304	Jan	30	2015	00:39:40	+00:00	IPSDIR/iosips-seap-delta.xmz
5	143447	Jan	30	2015	00:40:56	+00:00	IPSDIR/iosips-sig-category.xmz
6	16625	Jan	30	2015	00:40:52	+00:00	IPSDIR/iosips-sig-typedef.xmz
7	255	Jan	30	2015	00:39:40	+00:00	IPSDIR/iosips-sig-delta.xmz
9	2903	Aug	9 2012 16:07:28 +00:00 cpconfig-19xx.cfg
10	3000320	Aug	9 2012 16:07:42 +00:00 cpexpress.tar
11	1038	Aug	9	2012	16:07:50	+00:00	home.shtml
12	122880	Aug	9	2012	16:07:58	+00:00	home.tar
13	1697952	Aug	9	2012	16:08:12	+00:00	securedesktop-ios-3.1.1.45-k9.pkg
14	415956	Aug	9	2012	16:08:26	+00:00	sslclient-win-1.1.4.176.pkg
15	75551300 Feb 17 2015 00:52:42 +00:00 c1900-universalk9-mz.SPA.154-3.M2.bin

173850624 bytes available (82636800 bytes used) 
R3# delete /force /recursive flash:IPSDIR 
Remove directory filename [IPSDIR]?
Delete flash:IPSDIR? [confirm]

Instructor Note: In the interest of time, the instructor should pre-configure the basic device settings. Basic configurations are provided below for R1 and R3.

R1 Startup Configuration

hostname R1
no ip domain lookup interface GigabitEthernet0/0
ip address 209.165.200.225 255.255.255.248
no shutdown interface Serial0/0/1
ip address 209.165.200.233 255.255.255.252
no shutdown
ip route 192.168.10.0 255.255.255.0 209.165.200.226
ip route 172.30.3.0 255.255.255.0 209.165.200.234
ntp authentication-key 1 md5 NTPpassword ntp trusted-key 1
ntp authenticate ntp master 3
end

R3 Startup Configuration

hostname R3
no ip domain lookup interface G0/1
ip address 172.30.3.1 255.255.255.0
no shut int S0/0/0
ip address 209.165.200.234 255.255.255.252
no shutdown
ip route 0.0.0.0 0.0.0.0 209.165.200.233
end

S1 Startup Configuration

hostname S1
no ip domain lookup
spanning-tree vlan 1 root primary 
interface range f0/3-5, f0/7-24, g0/1-2
shutdown 
end

S2 Startup Configuration

hostname S2
no ip domain lookup
spanning-tree vlan 1 root secondary 
end

S3 Startup Configuration

hostname S3
no ip domain lookup
interface range f0/1-4, f0/6-17, f0/19-24, g0/1-2 shutdown
end

PC-A

IP Address: 192.168.10.10
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.10.1

PC-B

IP Address: 192.168.10.11
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.10.1

PC-C

IP Address: 172.30.3.3
Subnet Mask: 255.255.255.0
Default Gateway: 172.30.3.1

Intructions

Part 1: Configure PCs and Verify Network Connectivity

Total points: 5

Time: 5 minutes

In the interest of time, R1 and R3 are pre-configured for basic connectivity. You must configure the static IP address information for the PC hosts using the addressing in the topology. You will then verify connectivity.

Instructor Sign-Off Part 1: __________

Points: _______ of 5

Note: Do not proceed to Part 2 until your instructor has signed off on Part 1.

Part 2: Configure Secure Router Administrative Access

Total points: 17

Time: 15 minutes

In Part 2, you will secure administrative access on R3 using the CLI. Configuration tasks include the following:

Note: Before proceeding to Part 3, ask your instructor to verify R3’s configuration and functionality.

Instructor Sign-Off Part 2: _________

Points: __________ of 17

Part 3: Configure a Zone-Based Policy Firewall

Total points: 14

Time: 10 minutes

In Part 3, you will configure a ZPF on R3 using the CLI. Configuration tasks include the following:

Troubleshoot as necessary to correct any issues.

Note: Before proceeding to Part 4, ask your instructor to verify your ZPF configuration and functionality.

Instructor Sign-Off Part 2: ____________

Points: _______ of 14

Part 4: Configure an Intrusion Prevention System

Total points: 15

Time: 10 minutes

In Part 4, you will configure an IPS on R3 using the CLI. Configuration tasks include the following:

Note: Before attempting the TFTP copy, the Tftpd32 software on PC-C needs to be running with the directory set to the location of the file: IOS-S854-CLI.pkg.

Troubleshoot as necessary to correct any issues.

Note: Before proceeding to Part 5, ask your instructor to verify your IPS configuration and functionality.

Instructor Sign-Off Part 4: ____________

Points: __________ of 15

Part 5: Secure Layer 2 Switches

Total points: 22

Time: 20 minutes

Note: Not all security features in this part of the exam will be configured on all switches. However, in a production network, all security features will be configured on all switches. In the interest of time, the security features are configured on only S2, except where noted.

In Part 5, you will configure security settings on S2 using the CLI. Configuration tasks include the following:

NETLAB+ Note: Use a Maximum limit of 2 when configuring basic port security. Otherwise, the hidden Control Switch will cause a violation to occur and the port will be shutdown.

Troubleshoot as necessary to correct any issues.

Note: Before proceeding to Part 6, ask your instructor to verify your switch configuration and functionality.

Instructor Sign-Off Part 5: __________

Points: _________ of 22

Part 6: Configure ASA Basic Management and Firewall Settings

Total points: 18

Time: 15 minutes

Note: By default, the privileged EXEC password is blank. Press Enter at the password prompt.

In Part 6, you will configure the ASA’s basic setting and firewall using the CLI. Configuration tasks include the following:

Troubleshoot as necessary to correct any issues.

Note: Before proceeding to Part 7, ask your instructor to verify your ASA configuration and functionality.

Instructor Sign-Off Part 6: _____________

Points: ________ of 18

Part 7: Configure the ASA for SSL VPN Remote Access Using ASDM

Total points: 14

Time: 15 minutes

In Part 7, you will configure an AnyConnect SSL remote access VPN on the ASA using ASDM. You will then use a browser on PC-C to connect and download the Cisco AnyConnect Secure Mobility Client software located on the ASA. After the software has downloaded, you will manually install the AnyConnect software to PC-C and use it to establish a remote SSL VPN connection to the ASA.

Step 1: Configure SSL VPN settings on the ASA using the ASDM from PC-B.

Use a browser on PC-B to establish an ASDM session to the ASA. After the session is established, use the AnyConnect VPN Wizard to configure the ASA to allow SSL VPN client connections. Configuration parameters include the following:

Step 2: Establish an SSL VPN connection to the ASA from PC-C

To establish an SSL VPN connection to the ASA, you will need to use a browser on PC-C to download the Cisco AnyConnect Secure Mobility Client software from the ASA. After the software is downloaded, you will install the AnyConnect software to PC-C and then establish an SSL VPN connection to the ASA. The steps required are as follows:

Troubleshoot as necessary to correct any issues.

Note: If the AnyConnect client fails authentication, reset the password.

Configuration > Remote Access VPN > Local Users > REMOTEuser > Edit > Identity > Change user password (retype in the correct username and password combo). Click OK followed by clicking Apply.

Instructor Sign-Off Part 7: _______________

Points: _________ of 14

Instructor Note: Have student demonstrate that PC-C has established an SSL VPN connection to the ASA by pinging PC-B. The student should also be able to display the established VPN session using the ASDM on PC-B.

Router Interface Summary

Note: To find out how the router is configured, look at the interfaces, identify the type of router, and how many interfaces the router has. There is no way to effectively list all of the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. This table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.