Cisco Secure VPN Exam Certification Guide - Cisco press

118 Chapter 3: Cisco VPN 3000 Concentrator Series Hardware Overview

12In addition to RIP and OSPF, what other routing capabilities do Cisco VPN Concentrators have?

13What encryption and authentication protocols do Cisco VPN 3000 Concentrators support?

14What protocol permits multichassis redundancy and failover?

15What hardware items can be made redundant on Cisco VPN 3000 Concentrators?

16What are some of the methods that can be used to interface with the embedded Cisco VPN Manager software on VPN concentrators?

17What are the most secure forms of authentication that can be used with Cisco VPN 3000 Series Concentrators?

Q&A 119

18What mechanism is used by Cisco VPN Clients to monitor firewall activity between the client and the concentrator?

19What is the rated mean time between failure (MTBF) for Cisco VPN 3000 Concentrators?

20You have installed two Cisco VPN 3000 Concentrators in parallel on your network. Both devices have redundant power supplies, fans, and SEPs. You need to ensure 99.9% uptime. How can you achieve this rate of fault tolerance?

21During the initial configuration of the VPN concentrators, what management interface must you use?

22What do you need to do to activate configuration changes to Cisco VPN Concentrators that are made through the Cisco VPN Manager?

23What four options are available under the Configuration menu of the VPN Manager?

120 Chapter 3: Cisco VPN 3000 Concentrator Series Hardware Overview

24What is the hierarchical order of property inheritance on Cisco VPN Concentrators?

25What options are available on the Administration menu of the Cisco VPN Manager?

26What options are available on the Monitoring menu of the Cisco VPN Manager?

27Where in the Cisco VPN Manager could you go to view the current IP address for the private interface on a Cisco VPN 3000 Concentrator?

28What models are available in the Cisco VPN 3000 Concentrator Series?

29Which of the Cisco VPN 3000 Series Concentrators is a fixed configuration that is not upgradeable?

Q&A 121

30How can purchasers of a Cisco VPN 3000 Series Concentrator obtain a license for the Cisco VPN Client?

31What is the maximum number of simultaneous sessions that can be supported on the Cisco VPN 3005 Concentrator?

32What is the maximum number of simultaneous sessions that can be supported on the Cisco VPN 3015 Concentrator?

33What is the maximum number of simultaneous sessions that can be supported on the Cisco VPN 3030 Concentrator?

34What is the maximum number of simultaneous sessions that can be supported on the Cisco VPN 3060 Concentrator?

35What is the maximum number of simultaneous sessions that can be supported on the Cisco VPN 3080 Concentrator?

122 Chapter 3: Cisco VPN 3000 Concentrator Series Hardware Overview

36Which of the Cisco VPN 3000 Series Concentrators is only available in a fully redundant configuration?

37On a Cisco VPN 3005 Concentrator, what does a blinking green system LED indicate?

38On a Cisco VPN 3000 Concentrator, what does a blinking amber system LED indicate?

39What does a blinking green Ethernet link status LED indicate on a Cisco VPN Concentrator?

40What does an amber SEP status LED indicate?

41Which of Cisco’s client offerings has no limitations with regard to the types of client operating systems it can support?

Q&A 123

42What optional feature on the Cisco VPN 3002 Hardware Client allows you to connect Ethernet devices to the client?

43What two operating modes can a Cisco VPN 3002 Hardware Client be configured to support?

44What operating systems does the Cisco VPN Client support?

Exam Topics Discussed in This Chapter

This chapter covers the following topics, which you need to master in your pursuit of certification as a Cisco Certified Security Professional:

9Overview of remote access using preshared keys

10Initial configuration of the Cisco VPN 3000 Concentrator Series for remote access

11Browser configuration of the Cisco VPN 3000 Concentrator Series

12Configuring users and groups

13Advanced configuration of the Cisco VPN 3000 Concentrator Series

14Configuring the IPSec Windows Client

C H A P T E R 4

Configuring Cisco VPN 3000 for Remote Access Using Preshared Keys

From a procedural perspective, it is easier to configure the Cisco VPN 3000 Concentrator Series for remote access using preshared keys. While the alternative method is to use

the services of a Certificate Authority (CA), that method entails additional steps. Using preshared keys, the client only needs to know the address of the VPN concentrator and the shared secret key.

While VPN configuration is relatively easy with preshared keys, this manual process does not scale well for large implementations. The VPN administrator must provide the password and implementation instructions to prospective users. This could be accomplished by preconfiguring client software on a floppy disk or CD-ROM, but even that process can be labor intensive in large implementations.

Once all of your users have successfully configured their remote systems with the current shared key, the process of changing passwords periodically, as every good security plan requires, would require notifying all users of the new password and providing modification instructions. You can imagine how it would be easy to forget about this important security consideration.

While scaling VPN implementations can be better handled by using CA support and digital certificates, preshared keys are easy to implement and can be used in many applications. This chapter discusses the process of implementing Internet Protocol Security (IPSec) using preshared keys on the Cisco VPN 3000 Series Concentrators. The clever graphical user interface (GUI) makes the implementation process easy.

How to Best Use This Chapter

By taking the following steps, you can make better use of your time:

•Keep your notes and answers for all your work with this book in one place for easy reference.

•Take the “Do I Know This Already?” quiz, and write down your answers. Studies show retention is significantly increased through writing facts and concepts down, even if you never look at the information again.

•Use the diagram in Figure 4-1 to guide you to the next step.

“Do I Know This Already?” Quiz 127

1What methods can you use for user authentication on the Cisco VPN 3000 Series Concentrators?

2What methods can you use for device authentication between VPN peers?

3What are the three types of preshared keys?

4What is a unique preshared key?