vzw BiASC asbl

Cisco ASA NAT – Configuration Guide

The Cisco ASA and Cisco ASA-X firewalls provides nearly infinite flexibility in so far as their NAT configuration. From the modularity of using objects, to the simplicity of configuring Auto NAT, to the granularity of Manual NAT, to the precision of NAT precedence  — the ASA can do it all.

This article covers each of these concepts in detail, explaining what they mean, when to use them, and how to apply them. If you read it from start to finish, and were able to follow with the examples and illustrations, then you can decidedly consider yourself an address translation expert on the Cisco ASA platform.

Part 1 – NAT Syntax
Objects - Real and Mapped - Auto NAT  - Manual NAT 

Part 2 – NAT Configuration Examples
Static NAT - Static PAT - Dynamic PAT - Dynamic NAT

Part 3 – Advanced NAT
Policy NAT - Twice NAT - NAT Precedence - Identity NAT

Here is the complete guide: http://www.practicalnetworking.net/stand-alone/cisco-asa-nat/

April 16, 2018 By Ed Harmoush

New Hardware Bundle CCNA + Security for Netacad Members

Every Cisco Academy is able to buy Cisco hardware at a discount of 75%. Here is a quote from 2018 only for BiASC members. Prices are subject to change.

 A Cisco Netacad hardware bundle is a fixed grouping of hardware that you cannot change. It consists of:

• Three routers
• Three switches
• Extra modules, cabling and licences
• Adaptive Security Appliance ASA (only for CCNA Security*)

Below are the unit prices for the standard lab equipment for CCNA and CCNA Security

• LAN Switch WS-C2960: €330.32
• Internet Router Cisco ISR 4321 : €508.87
• Internet Router with integrated firewall Cisco ISR 4321 with security bundle: €763.94 (*)
• Firewall Device ASA5506-K9 ASA 5506-X with FirePOWER services: €253.80 (*)

(*) Only necessary for CCNA Security courses

REMARK: for the CCNA 1 and CCNA 2 courses it is not necessary to buy hardware equipment. It is feasible only to use the simulation tool Packet Tracer. As a member of BiASC educational institutions have the license to use Packet Tracer for their students.

Understating Cisco IOS v15 Licenses

What are the ISO v15 Feature sets (technology package) types we have now days with ISR G2:

 

1. IP Base (ipbaseK9)come and running with any new ISR G2 routers (1900,2900,3900 Series) , its entry level for Cisco IOS functionality
2. DATA (dataK9)support MPLS.ATM. Multiprotocol support
3. Unified Commuincations (ucK9) support VOIP & IP Telephony
4. Security (securityK9) support Cisco IOS Firewall , IPS , IPsec , 3DES, VPN

URL: https://learningnetwork.cisco.com/docs/DOC-20321

The State of CyberSecurity - Cisco Live 2018

   

PDF: Download BRKSEC-2010

Case Study: http://blog.talosintelligence.com/2017/10/bad-rabbit.html

CCNA Security | Networking Academy Course Updates 2016 | Career-Ready

Course Overview

CCNA Security introduces the core security concepts and skills needed to troubleshoot and monitor computer networks and help ensure the integrity of devices and data.

It emphasizes the practical application of the skills needed to design, implement, and manage network security systems.

Benefits

CCNA R&S students interested building security and data protection expertise for the Cisco CCNA Security career certification and jobs as network security specialists.

Learning Components

• 11 chapters, quizzes, and chapter exams
• 13 Cisco® Packet Tracer activities and one Packet Tracer Practice Skills Based Assessment (SBA)
• 16 hands-on labs
• One each: pre-test, certification practice exam, practice final, final exam and skills-based assessment

Features

Target Audience: 2-year and 4-year college students in Networking or Engineering programs

Prerequisites: CCNA R&S: Scaling Networks

Languages: English

Course Delivery: Instructor-led

Estimated Time to Complete: 70 hours

Recommended Next Course: CCNP R&S ROUTE

Target Audience: 2-year and 4-year college students in Networking or Engineering programs

Prerequisites: CCNA R&S: Scaling Networks

Languages: English

Course Delivery: Instructor-led

Estimated Time to Complete: 70 hours

Recommended Next Course: CCNP R&S ROUTE

Introduction to Cybersecurity | Networking Academy Course Updates 2016

Course Overview

The Introduction to Cybersecurity course explores cyber trends, threats and staying safe in cyberspace, and protecting personal and company data. 

Benefits

Learn how to protect your personal data and privacy online and in social media, and why more and more IT jobs require cybersecurity awareness and understanding.

Learning Components

• 5 modules
• Interactive and instructional content
• 8 Activities and 7 lab exercises that reinforce learning
• 4 quizzes and 1 final exam
• Links to related resources

Features

Target Audience: Upper secondary and 2-Year college students, general audience

Prerequisites: None

Languages: Chinese-S, English

Course Delivery: Instructor -led or Self-paced

Estimated Time to Complete: 15 hours

Recommended Next Course: Cybersecurity Essentials, releasing Fall 2016

Pathway to become a Network Security Administrator | Course Progression

Below is a pathway through the various Cisco Networking Academy Courses if you want to become a Network Security Specialist

 

 

 

 

Remote Access Using Clientless VPN or AnyConnect Client

BRKSEC-2697 - Remote Access using Clientless VPN (2014 Milan)
Presentation by Hakan Nohre - CSE, Cisco

This session will provide Information and Details about Clientless VPN on the Cisco ASA Firewall. For certain use cases like Contractor Access or BYOD, customers want to have a more differentiated access than the well known Full Tunnel (AnyConnect). We will show and explain how an ASA can be used to provide Secure Remote Access with no need to install a VPN Client. As simple browser based access might not satisfy everybody's needs, we will go through advanced configurations like VDI access for iPAD as well. The target audience are security administrators that are familiar with ASA Firewalls and want to learn more about the Cisco Clientless VPN Solutions.

PDF:  Download BRKSEC-2697-Clientless SSL

BRKSEC-3033 - Advanced AnyConnect Deployment and Troubleshooting with ASA (2015 Milan)
Presentation by Hakan Nohre - CSE, Cisco

Remote access VPN can provide a flexible, transparent and yet secure working environment for mobile workers. This advanced session will explain different deployment options using Cisco AnyConnect Client with ASA. We will cover different options for strong authentication, One-time-password and client certificates and how these authentication options can be used together with posture assessment and enterprise directories for granular authorization. We will also cover AnyConnect customization and how to create an office like user experience by allowing domain logon and mapping of disk drives, whilst connected over the internet. Coverage of IPv6 when using AnyConnect is also included in this session. The expected audience are network or security engineers with previous experience of AnyConnect and ASA 5500, and with a good understanding of enterprise IT infrastructure, PKI and Active Directory. The attendees will benefit from following the session: BRKSEC-2697 "Remote Access using Clientless VPN"

PDF:  Download BRKSEC-3033-AnyConnect SSL

Written to Realised Security Policy (2015 Melbourne)

Secure Access is Cisco’s Architecture for Context-based Identity and Access Control, including: – Profiling Technologies – RADIUS – IEEE 802.1X (Dot1x) – Guest Services – Device Management – TrustSec – Identity Services Engine (ISE)

Presentation by  Yuval Shchory - Product Line Manager, CiscoLive Melbourne 2015

PDF:  Download BRKSEC-1011-Security Policy

Summary

TrustSec and Security Group Tags - Presentation

In this session we review elements of Cisco TrustSec which are part of the CCIE Security Lab Exam Topics List. Cisco TrustSec covers network access methods such as 802.1X and enables segmented policy enforcement from device/remote access through to protected resources such as the data center. Key concepts reviewed are: building the CTS domain using NDAC, classification by SGTs and propagation via SXP, and policy enforcement using SGACLs.

Presentation by: Natalie Timms - Principal, Natalie Timms Consulting 

PDF:  Download Examining TrustSec CP-1003

ABC's of Identity Management

The ABC's of Identity Management covers the essentials of identity management for todays networks.  This session is designed to cover the elements of identity management as used for end users as well as administrative users.

• Presentation:  Brandon Carroll - CEO, Global Config Technology Solutions, Inc.
• PDF:  Download ABCs of Identity Management CP-1002

 

Advanced Cisco IOS Security | CiscoLive 2016 BRKSEC-3007

Speaker(s) Jason Scobbie - Technical Lead, Cisco

The increase in network complexity has pushed security to the forefront of design and policy. This session provides guidance on design and deployment of an effective security access policy for IOS routers. It starts by providing configuration guidance on deploying a comprehensive Zone Based Firewall (ZBFW) policy, including monitor tools, rate limiting, connection control and advanced application layer filtering.

The session reinforces advanced security through identity-based features including downloadable ACLs, user-based authentication and SGT integration. These solutions are provided within the framework of active, passive and transparent authentication. The session continues with ensuring redundancy by showing examples of setting up two routers with ZBFW in a high availability pair. The session concludes with protections against various network common network attacks. IPv6 security features are integrated throughout the session. The session integrates troubleshooting and monitoring tools to bridge theory and application. A complete sample configuration is a deliverable for participants to build a custom and independent security policy.

The session is targeted at security administrators who are responsible for their network access policies. It is important to emphasize that this breakout does not cover VPN, L2 Security, IOS IPS or IOS hardening techniques. This session expands on the fundamentals discussed in BRKSEC-2007.

PDF+APPENDIX:  Download BRKSEC-3007-ADVANCED-IOS-SECURITY

IOC Bucket | Community Supported Threat Intelligence

Indicator of Compromise: a system to describe the artifacts of compromise, and the methods to detect them.
Very high confidence indicators: FileItem, RegistryItem, EventLogItem, ProcessItem, ServiceItem

www.openioc.org

IOC BUCKET
IOC Bucket is a global community of computer security professionals who have a vested interest in sharing Indicators of Compromise (IOC) discovered during their research. Through the contributions of industry standard OpenIOC's, IOC Bucket will be the largest repository of Open Source Indicators. On the website you can check indicators found on your network against our reputation database to determine the possibility of infection using one of the 500 fields supported by the OpenIOC format.

OpenIOC Online Editor

Postgraduate Programme | Information Systems Management | Cisco Certification | Corning | VMware | 2016-2017 | Brussels

In central Burssels Odisee University College offers a full Cisco Certification Networking Academy Programme including CCNA, Security and CCNP. This postgraduate programme of 30 to 60 credits starts early October 2016.

 

The contents of the course modules of the postgraduate programme in Information Systems Management have been aligned with new certification tracks of Cisco, VMware and Corning. Starting the first week of October, we welcome you in the Cisco labs at the Odisee Brussels Campus every Monday through Thursday from 18 tot 21pm.

Complete Course Description

• Download Postgraduate-degree-programme-information-systems-management-2016-2017

Course Modules

• Interconnecting Network Devices 1 (CCNA)
• Interconnecting Network Devices 2 (CCNA)
• Network Security (CCNA Specialist)
• Advanced Switching (CCNP)
• Advanced Routing (CCNP)
• Datacenter Technologies (VMWare, Corning)
• System & Network Design Case Study

Emerging Security Threats 2016

Presentation by: Jaeson Schultz - Technical Leader, Cisco TALOS

Cisco's Threat Research Analysis and Communications (TRAC) team specialises in early-warning intelligence and threat analysis necessary for maintaining a secure network. People responsible for defending networks realise that the security threat landscape is constantly in flux as attackers evolve their skills. TRAC advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk we will perform deep analysis of recent threats and see how TRAC leverages indicators of compromise (IOC) against large datasets to deliver product improvements and mitigation strategies.

PDF:  Download Emerging Security Threats BRKSEC-2010

Cisco Global Cybersecurity Scholarship for Netacad Students

In the new digital era, organizations rely on cybersecurity to protect themselves, enable trust, move faster, add value, and grow. As the volume and sophistication of cyberattacks rises, organizations are experiencing a significant shortage of IT professionals with cybersecurity skills. To help close this security skills gap, Cisco is introducing the Global Cybersecurity Scholarship program. The new CCNA Cyber Ops certification and the CCIE Security revisions are designed to address the critical skills deficit, providing the job-ready knowledge needed to meet current and future challenges of network security.

Cisco wants to help successful candidates to get certified. Scholarship awards are available from August 1, 2016, until the end of July 2017. Candidates are offered training, mentoring, and certification for the skills needed in the security operations center (SOC) analyst job role. 

Scholarship Award Details

• The instructor-led e-learning training consists of two courses and two assessments, along with mentoring and coaching, representing a significant monetary investment in your career.
• Mentoring and exam preparation are included.
• The cost of all exam fees is included.

Qualifications

To be considered for a scholarship, applicants must have these qualifications:

General:

• At least 18 years old
• English proficiency

Basic competency (one or more of the following):

• Cisco certification (Cisco CCENT certification or higher)
• Relevant industry certification [(ISC)2, CompTIA Security+, EC-Council, GIAC, ISACA]
• Cisco Networking Academy letter of completion (CCNA 1 and CCNA 2)

Cisco Security Product Portfolio in 5 Minutes

Keywords

Before-During-After an Attack

Before an Attack

• Network Perimeter
• Endpoint user - Remote user
• OpenDNS
• Firewall - port-hopping applications
• Identity Services Engine (who what when where)
• Trustsec
• VPN

During an Attack

• Intrusion Prevention System
• Web & Email Security

After an attack

• Scoping Containing Remediating
• Advanded Malware Protection AMP (retrospective security)
• Cognitice Threat Analytics
• Lancope Threatwatch
• TALOS

Source

Cisco, Cisco Security Product Portfolio in 5 Minutes, Published on Youtube, 27 JAN 2016, 5:25
URL: https://www.youtube.com/watch?v=sFaOz1aujOE

On the Sony Hack at the International Cyber Security Strategy Congress ICSS2015

On the Sony Hack at the International Cyber Security Strategy Congress ICSS2015 in Leuven, Belgium. Topic of the Congress: Cyber Security and Forensic Readiness
More info: https://www.icss2015.eu/

Bruce Schneier, Sony Hack & Cyber Security Strategy, Belgian Cybercrimecenter
Published 8 March 2015, 59:11
URL: https://www.youtube.com/watch?v=9m-KSuggQr0

 

CCNA Security version 2.0

The need for information security and network security skills continues to grow and the resulting career opportunities for your students are tremendous. Teaching CCNA Security is key in addressing the skills-gap shortage and staying current on the latest curriculum is critical.

Now available, CCNA Security version 2.0 in English, includes updated/new content and labs capturing information on the changing network security trends and technologies. The course allows students with Cisco CCENT-level skills to enroll in and successfully complete the CCNA Security curriculum. CCNA Security aligns with the Implementing Cisco Network Security (IINS) certification exam (210-260).

More info 

https://www.netacad.com/documents/301287/922858/CCNA+Security+2.0+Announcement.mp4/52c4fa0e-2b64-4ee0-a56f-504e9cb5126c

Kevin Mitnick Explaining Hacking - CeBIT Global Conference 2015

K. Mitnick, Live Hacks at CeBIT Global Conferences 2015, 
YouTube, 21 MAR 2015, 1:12:23
URL: https://www.youtube.com/watch?v=Q7G3kKRdUl4

Keywords: trojan, backdoor