Introduction |
|
xix | |
Chapter 1 Fundamentals of Cisco Next-Generation Security |
|
1 | (26) |
|
The New Threat Landscape and Attack Continuum |
|
|
2 | (2) |
|
|
3 | (1) |
|
Cisco ASA 5500-X Series Next-Generation Firewalls and the Cisco ASA with FirePOWER Services |
|
|
4 | (3) |
|
Cisco Firepower Threat Defense (FTD) |
|
|
7 | (1) |
|
Cisco Firepower 4100 Series |
|
|
7 | (1) |
|
Cisco Firepower 9300 Series |
|
|
7 | (1) |
|
Cisco FTD for Cisco Integrated Services Routers (ISRs) |
|
|
8 | (1) |
|
Next-Generation Intrusion Prevention Systems (NGIPS) |
|
|
8 | (1) |
|
Firepower Management Center |
|
|
9 | (1) |
|
|
9 | (3) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
13 | (3) |
|
|
13 | (2) |
|
|
15 | (1) |
|
Cisco Hybrid Email Security |
|
|
16 | (1) |
|
|
16 | (6) |
|
|
16 | (4) |
|
Cisco Security Management Appliance |
|
|
20 | (1) |
|
Cisco Cloud Web Security (CWS) |
|
|
21 | (1) |
|
Cisco Identity Services Engine (ISE) |
|
|
22 | (1) |
|
Cisco Meraki Cloud-Managed MDM |
|
|
23 | (1) |
|
Cisco Meraki Cloud-Managed Security Appliances |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
25 | (2) |
Chapter 2 Introduction to and Design of Cisco ASA with FirePOWER Services |
|
27 | (38) |
|
Introduction to Cisco ASA FirePOWER Services |
|
|
28 | (1) |
|
Inline versus Promiscuous Mode |
|
|
29 | (2) |
|
|
29 | (1) |
|
Promiscuous Monitor-Only Mode |
|
|
30 | (1) |
|
Cisco ASA FirePOWER Management Options |
|
|
31 | (5) |
|
Accessing the Cisco ASA FirePOWER Module Management Interface in Cisco ASA 5585-X Appliances |
|
|
32 | (2) |
|
Accessing the Cisco ASA FirePOWER Module Management Interface in Cisco ASA 5500-X Appliances |
|
|
34 | (2) |
|
Cisco ASA FirePOWER Services Sizing |
|
|
36 | (1) |
|
Cisco ASA FirePOWER Services Licensing |
|
|
37 | (5) |
|
|
37 | (1) |
|
|
38 | (1) |
|
The URL Filtering License |
|
|
38 | (1) |
|
|
39 | (1) |
|
Viewing the Installed Cisco ASA FirePOWER Module Licenses |
|
|
39 | (2) |
|
Adding a License to the Cisco ASA FirePOWER Module |
|
|
41 | (1) |
|
Cisco ASA FirePOWER Compatibility with Other Cisco ASA Features |
|
|
42 | (1) |
|
Cisco ASA FirePOWER Packet Processing Order of Operations |
|
|
42 | (3) |
|
Cisco ASA FirePOWER Services and Failover |
|
|
45 | (4) |
|
What Happens When the Cisco ASA FirePOWER Module Fails? |
|
|
49 | (1) |
|
Cisco ASA FirePOWER Services and Clustering |
|
|
49 | (7) |
|
|
51 | (1) |
|
How Connections Are Established and Tracked in a Cluster |
|
|
52 | (1) |
|
How a New TCP Connection Is Established and Tracked in a Cluster |
|
|
52 | (1) |
|
How a New UDP-Like Connection Is Established and Tracked in a Cluster |
|
|
53 | (1) |
|
Centralized Connections in a Cluster |
|
|
54 | (1) |
|
What Happens When the Flow Owner Fails |
|
|
55 | (1) |
|
Deploying the Cisco ASA FirePOWER Services in the Internet Edge |
|
|
56 | (1) |
|
Deploying the Cisco ASA FirePOWER Services in VPN Scenarios |
|
|
56 | (2) |
|
Deploying Cisco ASA FirePOWER Services in the Data Center |
|
|
58 | (3) |
|
Firepower Threat Defense (FTD) |
|
|
61 | (2) |
|
|
63 | (2) |
Chapter 3 Configuring Cisco ASA with FirePOWER Services |
|
65 | (54) |
|
Setting Up the Cisco ASA FirePOWER Module in Cisco ASA 5585-X Appliances |
|
|
65 | (4) |
|
Installing the Boot Image and Firepower System Software in the Cisco ASA 5585-X SSP |
|
|
67 | (2) |
|
Setting Up the Cisco ASA FirePOWER Module in Cisco ASA 5500-X Appliances |
|
|
69 | (18) |
|
Installing the Boot Image and Firepower System Software in the SSD of Cisco ASA 5500-X Appliances |
|
|
69 | (4) |
|
Configuring of Cisco ASA 5506-X, 5508-X, and 5516-X Appliances |
|
|
73 | (5) |
|
|
78 | (1) |
|
Setting Up the Cisco ASA to Allow ASDM Access |
|
|
79 | (1) |
|
|
80 | (2) |
|
Setting Up a Device Name and Passwords |
|
|
82 | (1) |
|
|
83 | (4) |
|
Configuring the Cisco ASA to Redirect Traffic to the Cisco ASA FirePOWER Module |
|
|
87 | (4) |
|
Configuring the Cisco ASA FirePOWER Module for the FMC |
|
|
91 | (1) |
|
Configuring the Cisco ASA FirePOWER Module Using the ASDM |
|
|
92 | (22) |
|
Configuring Access Control Policies |
|
|
92 | (1) |
|
Creating a New Access Control Policy |
|
|
93 | (1) |
|
Adding Rules to the Access Control Policy |
|
|
94 | (4) |
|
|
98 | (1) |
|
|
98 | (2) |
|
Access Control Policy Advanced Settings |
|
|
100 | (2) |
|
Configuring Intrusion Policies |
|
|
102 | (2) |
|
|
104 | (4) |
|
Configuring File Policies |
|
|
108 | (3) |
|
Reusable Object Management |
|
|
111 | (1) |
|
Keeping the Cisco FirePOWER Module Up-to-Date |
|
|
111 | (3) |
|
|
114 | (4) |
|
Installing FTD Boot Image and Software |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
Static and Dynamic Routing in FTD |
|
|
117 | (1) |
|
|
118 | (1) |
Chapter 4 Troubleshooting Cisco ASA with FirePOWER Services and Firepower Threat Defense (FTD) |
|
119 | (22) |
|
|
119 | (21) |
|
Displaying the Access Control Policy Details |
|
|
121 | (4) |
|
Displaying the Network Configuration |
|
|
125 | (3) |
|
|
128 | (2) |
|
Analyzing Running Processes |
|
|
130 | (2) |
|
Using the System Log (Syslog) |
|
|
132 | (4) |
|
Monitoring and Troubleshooting System Tasks |
|
|
136 | (1) |
|
Generating Advanced Troubleshooting Logs |
|
|
136 | (4) |
|
Useful ASA Debugging Commands |
|
|
140 | (1) |
|
|
140 | (1) |
Chapter 5 Introduction to and Architecture of Cisco AMP |
|
141 | (30) |
|
Introduction to Advanced Malware Protection (AMP) |
|
|
141 | (2) |
|
|
143 | (1) |
|
Doing Security Differently |
|
|
144 | (5) |
|
|
144 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
147 | (1) |
|
Dynamic Analysis with Threat Grid |
|
|
147 | (1) |
|
The Retrospective Framework |
|
|
148 | (1) |
|
|
149 | (1) |
|
|
149 | (2) |
|
|
150 | (1) |
|
|
151 | (1) |
|
Installing the Cisco AMP Private Cloud |
|
|
151 | (18) |
|
|
169 | (2) |
Chapter 6 Cisco AMP for Networks |
|
171 | (12) |
|
Introduction to Advanced Malware Protection (AMP) for Networks |
|
|
171 | (10) |
|
What Is That Manager Called, Anyway? |
|
|
171 | (1) |
|
|
172 | (1) |
|
What Does AMP for Networks Do? |
|
|
172 | (2) |
|
Where Are the AMP Policies? |
|
|
174 | (2) |
|
|
176 | (2) |
|
|
178 | (3) |
|
|
181 | (2) |
Chapter 7 Cisco AMP for Content Security |
|
183 | (12) |
|
Introduction to AMP for Content Security |
|
|
183 | (1) |
|
Content Security Connectors |
|
|
184 | (1) |
|
Configuring Cisco AMP for Content Security |
|
|
185 | (7) |
|
Configuring the Web Security Appliance (WSA) for AMP |
|
|
185 | (4) |
|
Configuring the Email Security Appliance (ESA) for AMP |
|
|
189 | (3) |
|
|
192 | (2) |
|
|
194 | (1) |
Chapter 8 Cisco AMP for Endpoints |
|
195 | (60) |
|
Introduction to AMP for Endpoints |
|
|
196 | (1) |
|
What Is AMP for Endpoints? |
|
|
197 | (1) |
|
Connections to the AMP Cloud |
|
|
198 | (1) |
|
Firewalls, Destinations, and Ports, Oh My! |
|
|
198 | (1) |
|
|
199 | (13) |
|
|
199 | (1) |
|
|
199 | (2) |
|
Advanced Custom Detections |
|
|
201 | (3) |
|
Android Custom Detections |
|
|
204 | (1) |
|
IP Blacklists and Whitelists |
|
|
205 | (2) |
|
|
207 | (2) |
|
|
209 | (3) |
|
The Many Faces of AMP for Endpoints |
|
|
212 | (1) |
|
|
212 | (15) |
|
|
214 | (1) |
|
|
215 | (5) |
|
|
220 | (6) |
|
|
226 | (1) |
|
Known Incompatible Software |
|
|
227 | (1) |
|
|
227 | (6) |
|
|
228 | (1) |
|
|
229 | (2) |
|
|
231 | (2) |
|
|
233 | (1) |
|
|
233 | (2) |
|
|
234 | (1) |
|
|
234 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
Installing AMP for Endpoints |
|
|
236 | (14) |
|
Groups, Groups, and More Groups |
|
|
236 | (2) |
|
|
238 | (1) |
|
Distributing via Cisco AnyConnect |
|
|
238 | (1) |
|
Installing AMP for Windows |
|
|
239 | (3) |
|
|
242 | (3) |
|
|
245 | (2) |
|
Installing AMP for Android |
|
|
247 | (1) |
|
|
247 | (1) |
|
Deploying the AMP for Android Connector |
|
|
248 | (2) |
|
|
250 | (1) |
|
Proxy Server Autodetection |
|
|
250 | (1) |
|
Incompatible Proxy Security Configurations |
|
|
251 | (1) |
|
|
251 | (3) |
|
|
254 | (1) |
Chapter 9 AMP Threat Grid: Malware Analysis and Threat Intelligence |
|
255 | (8) |
|
|
255 | (3) |
|
Cisco AMP Threat Grid Cloud Solution |
|
|
258 | (1) |
|
Cisco AMP Threat Grid On-Premises Appliance |
|
|
259 | (2) |
|
|
260 | (1) |
|
Network Segment Configuration |
|
|
261 | (1) |
|
|
261 | (2) |
Chapter 10 Introduction to and Deployment of Cisco Next-Generation IPS |
|
263 | (22) |
|
|
263 | (8) |
|
|
264 | (1) |
|
|
265 | (3) |
|
|
268 | (2) |
|
NGIPS Deployment Locations and Scenarios |
|
|
270 | (1) |
|
NGIPS Deployment Design Considerations |
|
|
271 | (6) |
|
Threat Management and System Capabilities |
|
|
271 | (1) |
|
|
272 | (1) |
|
|
273 | (3) |
|
Management Platform Integration |
|
|
276 | (1) |
|
|
276 | (1) |
|
NGIPS Deployment Lifecycle |
|
|
277 | (6) |
|
|
278 | (1) |
|
Product Selection and Planning |
|
|
279 | (2) |
|
Implementation and Operation |
|
|
281 | (1) |
|
|
282 | (1) |
|
|
283 | (2) |
Chapter 11 Configuring Cisco Next-Generation IPS |
|
285 | (22) |
|
|
286 | (6) |
|
|
286 | (1) |
|
|
287 | (2) |
|
Configuring a Cisco Firepower Intrusion Policy |
|
|
289 | (2) |
|
|
291 | (1) |
|
|
292 | (11) |
|
|
293 | (1) |
|
|
294 | (1) |
|
|
295 | (2) |
|
|
297 | (1) |
|
Managing Snort Rules in FMC |
|
|
298 | (1) |
|
Cisco NGIPS Preprocessors |
|
|
299 | (2) |
|
Firepower Recommendations |
|
|
301 | (2) |
|
|
303 | (2) |
|
|
305 | (1) |
|
|
306 | (1) |
Chapter 12 Reporting and Troubleshooting with Cisco Next-Generation IPS |
|
307 | (22) |
|
|
307 | (17) |
|
|
308 | (5) |
|
Intrusion Event Workflows |
|
|
313 | (2) |
|
|
315 | (1) |
|
|
316 | (2) |
|
|
318 | (1) |
|
|
319 | (1) |
|
|
320 | (1) |
|
|
321 | (1) |
|
|
322 | (2) |
|
|
324 | (4) |
|
|
324 | (1) |
|
|
325 | (2) |
|
|
327 | (1) |
|
|
328 | (1) |
Index |
|
329 | |