1. © 2006 Cisco Systems, Inc. All rights reserved. Network Security 2 Module 2: Configure Network Intrusion Detection and Prevention

2. © 2006 Cisco Systems, Inc. All rights reserved. Lesson 2.2 Configure Attack Guards on the PIX Security Appliance Module 2: Configure Network Intrusion Detection and Prevention

3. © 2006 Cisco Systems, Inc. All rights reserved. SNMP Inspection asa1(config)# snmp-map SNMP_DENY_V1 asa1(config-snmp-map)# deny version 1... asa1(config)# policy-map global_policy asa1(config-pmap)# class class-default asa1(config-pmap-c)# inspect snmp SNMP_DENY_V1... asa1(config)# service-policy global_policy global snmp-map: To deny a specific version of SNMP inspect snmp: To enable SNMP application inspection SNMP manager 10.0.0.3 10.0.0.11.19 Traps SNMP- Managed Device SNMP v1 Internet

4. © 2006 Cisco Systems, Inc. All rights reserved. Monitors all UDP transactions on port 53:  Tracks DNS request ID and opens a connection slot  Closes connection slot immediately after answer is received  Translates the DNS A record – Before release 6.2: alias command – Release 6.2 and later: DNS record translation  Reassembles the DNS packet to verify its length (default = 512 bytes) DNS Server Client 105053 Request Response DNS Inspection

5. © 2006 Cisco Systems, Inc. All rights reserved. FragGuard and Virtual Reassembly

6. © 2006 Cisco Systems, Inc. All rights reserved. Default Fragment Configuration

7. © 2006 Cisco Systems, Inc. All rights reserved. Fragment command

8. © 2006 Cisco Systems, Inc. All rights reserved. Show fragment

9. © 2006 Cisco Systems, Inc. All rights reserved. AAA Floodguard

10. © 2006 Cisco Systems, Inc. All rights reserved. SYN Flood attack

11. © 2006 Cisco Systems, Inc. All rights reserved. TCP Intercept

12. © 2006 Cisco Systems, Inc. All rights reserved. SYN Cookies

13. © 2006 Cisco Systems, Inc. All rights reserved. Embryonic connection limit

14. © 2006 Cisco Systems, Inc. All rights reserved. Q and A

15. © 2006 Cisco Systems, Inc. All rights reserved.