Network Security Architecture Implementation
As soon as the security policy has been defined, the next step is implementing the policy in the form of a network security design. We will discuss various security principles and design issues throughout this book. The first step to take after a security policy has been created is to translate it into procedures. These procedures are typically laid out as a set of tasks that must be completed to successfully implement the policy. These procedures upon execution result in a n..
Static NAT works just like the example in Figure 4-6, but with the IP addresses statically mapped to each other via configuration commands. With static NAT: ■ A particular Inside Local address always maps to the same Inside Global (public) IP address. ■ If used, each Outside Local address always maps to the same Outside Global (public) IP address. ■ Static NAT does not conserve public IP addresses. Although static NAT does not help with IP address conservation, sta..
VACLs are configured as a VLAN access map in much the same format as a route map. A VLAN access map consists of one or more statements, each having a common map name. First, you define the VACL with the following global configuration command: Switch(config)# vlan access-map map-name [sequence-number] Access map statements are evaluated in sequence according to the sequence-number. Each statement can contain one or more matching conditions, followed by an action. Next, defin..
The BGP protocol includes an MD5-based authentication system for authenticating peers: Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#router bgp 65500 Router1(config-router)#neighbor 192.168.55.5 remote-as 65501 Router1(config-router)#neighbor 192.168.55.5 password password-1234 Router1(config-router)#exit Router1(config)#end Router1# The same password must be configured on both routers: Router2#configure term..
You can use the offset-list configuration command to modify the metrics of routes that EIGRP learns through a particular interface: Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z.Router1(config)#access-list 22 permit 192.168.30.0Router1(config)#router eigrp 55Router1(config-router)#offset-list 22 in 10000 Serial0.1Router1(config-router)#exitRouter1(config)#endRouter1# This command can also modify the EIGRP metrics of routes as the..
