Network Security Architecture Implementation
As soon as the security policy has been defined, the next step is implementing the policy in the form of a network security design. We will discuss various security principles and design issues throughout this book. The first step to take after a security policy has been created is to translate it into procedures. These procedures are typically laid out as a set of tasks that must be completed to successfully implement the policy. These procedures upon execution result in a n..
Static NAT works just like the example in Figure 4-6, but with the IP addresses statically mapped to each other via configuration commands. With static NAT: ■ A particular Inside Local address always maps to the same Inside Global (public) IP address. ■ If used, each Outside Local address always maps to the same Outside Global (public) IP address. ■ Static NAT does not conserve public IP addresses. Although static NAT does not help with IP address conservation, sta..
Traditionally, queuing of packets within IP routers has been first-in, first-out (FIFO). More recently, Layer 3 quality of service features have been introduced to enable large-scale IP networks to effectively handle a mix of best-effort, and mission-critical or time-sensitive applications. This is typically achieved through congestion management and control algorithms implemented in a packet scheduler associated with the outgoing interface. The scheduler may pe..
VACLs are configured as a VLAN access map in much the same format as a route map. A VLAN access map consists of one or more statements, each having a common map name. First, you define the VACL with the following global configuration command: Switch(config)# vlan access-map map-name [sequence-number] Access map statements are evaluated in sequence according to the sequence-number. Each statement can contain one or more matching conditions, followed by an action. Next, defin..
The BGP protocol includes an MD5-based authentication system for authenticating peers: Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#router bgp 65500 Router1(config-router)#neighbor 192.168.55.5 remote-as 65501 Router1(config-router)#neighbor 192.168.55.5 password password-1234 Router1(config-router)#exit Router1(config)#end Router1# The same password must be configured on both routers: Router2#configure term..
