67. Network Security Notes
Cisco Network Security devices
Some of Cisco's Dedicated Firewall Devices are:
Cisco ASA (Adaptive Security Appliance)
can implement packet filtering, stateful packet inspection, application inspection, etc.
can implement NAT/PAT, SSH and VPN
Cisco IPS (Intrusion Prevention System)
an inline deep packet inspection feature that effectively mitigates a wide range
of network attacks
transparent fw deployment (layer 2)
a sensor checking packets based on preinstalled signatures and reputations then do the action as configured
Different Platforms to implement IPS:
*dedicated IPS appliance
*on a router that has an IOS version that supports IPS feature
*router module (NME-IPS, AIM-IPS)
*ASA FW Module (AIM-SSM)
Cisco NGFW and NGIPS (Next Generation Firewall / IPS)
a. proactive and intelligent
can implement Application Visibility and Control (AVC) oldy known as DPI
can implement Advanced Malware Protection (AMP)
can implement URL Filtering
b. access to cisco tools
Cisco Talos Security Intelligence and Research Group
*detection research, threat intelligence, engine development, vulnerability research and development and outreach
Cisco Firepower series
Firepower 1000 series
designed for small business, branch office
threat inspection from 650mbps to 2.2 gbps
includes AVC, with AMP and URL options
Firepower 2100 series
designed for sales and remote offices
threat inspection from 2.0 to 8.5 gbps
includes AVC, with AMP and URL options
fail-to-wire interfaces available
Firepower 4100 series
designed for internet-edge, high-performance environments
threat inspection from 10 to 20gbps
includes AVC, with AMP and URL options
fail-to-write interfaces available