Cisco Secure VPN Exam Certification Guide - Cisco press

Exam Topics Discussed in This Chapter

This chapter covers the following topics, which you need to master in your pursuit of certification as a Cisco Certified Security Professional:

19Overview of software client’s firewall feature

20Software client’s Are You There feature

21Software client’s Stateful Firewall feature

22Software client’s Central Policy Protection feature

23Client firewall statistics

24Customizing firewall policy

C H A P T E R 6

Configuring the Cisco VPN Client

Firewall Feature

This chapter deals with configuring the Cisco VPN Client firewall feature set. You learn about the Cisco VPN Client’s basic configuration, how to create filters on the concentrator, and how to configure firewall features.

The VPN Client has an integrated Stateful Firewall feature as part of the client package. This client can be enabled to block all traffic coming into the user’s system that does not originate from the head-end concentrator’s network. This provides a good measure of security against intrusion from the Internet.

Cisco’s VPN Client also works with third-party private firewalls from Zone Labs and Network ICE. These third-party firewalls provide additional features that are not found in the Stateful Firewall feature.

When connecting to a Cisco VPN 3000 Series Concentrator, the VPN Client receives instructions from the concentrator on how to configure and use the private firewall, if any, that can be installed with the VPN Client. The VPN concentrator can be configured to supply a firewall policy to the VPN Client so that every VPN Client connecting to the VPN concentrator has a centrally administered firewall policy for maximum protection of network resources.

This chapter discusses the various personal firewalls that can be used in conjunction with the VPN Client. The chapter also discusses the configuration steps necessary on the VPN concentrator and the VPN Client to make the best use of personal firewalls on VPN networks.

How to Best Use This Chapter

By taking the following steps, you can make better use of your time:

•Keep your notes and answers for all your work with this book in one place for easy reference.

•Take the “Do I Know This Already?” quiz, and write down your answers. Studies show retention is significantly increased through writing facts and concepts down, even if you never look at the information again.

•Use the diagram in Figure 6-1 to guide you to the next step.

“Do I Know This Already?” Quiz 261

1You have a number of clients running Windows 98 and a remote VPN 3002 Hardware Client assigned to the same group. Your supervisor wants you to force everyone on this group connecting to have a firewall running on his or her machine. Can you do this?

2How is the Always On option set on the VPN Client?

3In addition to IPSec, what tunneling protocols does the VPN Client support?

4How often does the VPN Client poll the personal firewall when using Are You There (AYT)?

262 Chapter 6: Configuring the Cisco VPN Client Firewall Feature

5You are using BlackICE as a client firewall. You are presently connected through the VPN. What happens if you stop the service running BlackICE? Does the VPN remain connected? If so, for how long? Can you connect again if BlackICE is not running?

6Which two products from Zone Labs work with the VPN Client to enable the Are You There (AYT) capability?

7What protocols are not automatically blocked when using the Stateful Firewall (Always On) feature?

8You want to have secure VPN connections to the private network of the head-end concentrator and unsecured communications to the Internet. How would you configure the VPN Client’s Stateful Firewall feature to support this split tunneling?

9What is another name for the Stateful Firewall client that is a part of the Cisco VPN Client?

10Where are the rules set for a client when using Central Protection Policy (CPP) with Zone AlarmPro?

“Do I Know This Already?” Quiz 263

11Why is CPP not used with the Tunnel Everything option?

12On what screen do you configure CPP?

13On the VPN Client, where do you see the current compression used for a VPN connection?

14From the VPN Client, where can you view the secured routes that are enabled to the client?

15What is meant by the term Packets bypassed on the Statistics tab of the Connection Status screen?

264 Chapter 6: Configuring the Cisco VPN Client Firewall Feature

16What debug classes do you use when creating a rule with the following options:

a.Drop

b.Drop and Log

c.Forward

d.Forward and Log

e.Apply IPSec

f.Apply IPSec and Log

17How do you allow clients to use either of two firewalls? What is the only vendor you can do this with?

18On the VPN 3000 Concentrator Series devices, you configure the client firewall properties on the Client FW tab of the Configuration | User Management | Groups | Add (or Modify) screen. You can only select one firewall policy from that screen. What are the three types of firewall policies that you can choose from on the Client FW tab?

The answers to this quiz are listed in Appendix A, “Answers to the “Do I Know This Already?” Quizzes and Q&A Sections.” The suggestions for your next steps, based on quiz results, are as follows:

•9 or less overall score—Read the entire chapter, including the “Foundation Topics” and “Foundation Summary” sections, the “Q&A” section, and the scenarios at the end of the chapter.

•10–15 overall score—Begin with the “Foundation Summary” section, continue with the “Q&A” section, and then read the scenarios. If you are having difficulty with a particular subject area, read the appropriate section in the “Foundation Topics” section.

•15–18 overall score—If you feel you need more review on these topics, go to the “Foundation Summary” section, then to the “Q&A” section, then to the scenarios. Otherwise, skip this chapter and go to the next chapter.

266 Chapter 6: Configuring the Cisco VPN Client Firewall Feature