Difference between IGP(Interior Gateway Protocols) & EGP(Exterior Gateway Protocols)

IGP:

• Within a single autonomous system
• Single network administration
• Unique routing policy
• Make best use of network resource
• An IGP (Interior Gateway Protocol) is a protocol for exchanging routing information between gateways (hosts with routers) within an autonomous network (for example, a system of corporate local area networks).
• IGP’s fall into two categories:
  • Distance Vector Protocols
    • Routing Information Protocol (RIP)
    • Interior Gateway Routing Protocol (IGRP)
  • Link State Protocols
    • Open Shortest Path First (OSPF)
    • Intermediate System to Intermediate System (IS-IS)

EGP:

• Among different autonomous systems
• Independent administrative entities
• Communication between independent network infrastructures
• Exterior Gateway Protocol (EGP) is a protocol for exchanging routing information between two neighbor gateway hosts (each with its own router) in a network of autonomous systems.
• EGP is commonly used between hosts on the Internet to exchange routing table information.
• Examples of an EGP:
  • Border Gateway Protocol (BGP)
  • Exterior Gateway Protocol (Replaced by BGP)

READ MORE - Difference between IGP(Interior Gateway Protocols) & EGP(Exterior Gateway Protocols)

Why to use the Cisco Enterprise Composite Model

• Cisco has used the three-level hierarchical network design model for years. This older model (also referred to as the switch block model) provided a high-level idea of how a reliable network could be conceived but was largely conceptual, because it did not provide specific guidance.

• Cisco therefore developed a newer design model-the enterprise composite model-that is significantly more complex.
• This model attempts to address the major shortcomings of the hierarchical model by expanding the older version and making specific recommendations about how and where certain network functions should be implemented.

The enterprise composite model is broken up into three areas :

• Enterprise campus
• Enterprise edge
• Service provider edge

The Enterprise Campus module deals with the campus, defined as one or more buildings on a local area connected with a high speed network. The campus does not provide remote/Internet access. The campus is broken into functional areas, described below.

• Campus backbone (core layer)
• Building distribution
• Building access
• Management
• Server farm (for enterprise services)

The Enterprise Edge module connects the Enterprise Campuses, and other internal resources such as the WAN.

• E-Commerce
• Internet connectivity
• Remote access (dial-up and VPN)
• WAN (internal links)

The Service Provider edge is the demarcation to the Internet and other remote access services.

• Internet service provider (ISP)
• Public Switched Telephone Network (PSTN) for dialup
• Frame Relay, ATM, and PPP for private connectivity

READ MORE - Why to use the Cisco Enterprise Composite Model

Cisco CCNA Security 640-553 IINS Tutorials Part-16

Rivest, Shamir, and Adleman (RSA) Invented by Ron Rivest, Adi Shamir, and Len Adleman in 1977, RSA is one of the most common asymmetric algorithms in use today. This public-keyalgorithm was patented until September 2000, when the patent expired, making the algorithm part of the public domain. RSA has been widely embraced over the years, in part because of its ease of implementation and its flexibility.

role-based command-line interface (CLI) views Can be used to provide different sets of configuration information to different administrators. However, unlike making commands available via privilege levels, using role-based CLI views you can control exactly what commands an administrator has access to.

RTP Control Protocol (RTCP) Provides information about an RTP flow, such as information about the quality of the call. In a Cisco environment, RTCP typically uses odd-numbered UDP ports in the range 16,384 to 32,767.

salami attack A collection of small attacks that result in a larger attack when combined.

salt A series of random bits added to a password. When the password is hashed, and that hash is stored in a database, two identical passwords do not create the same hash. This also protects the passwords from attacks involving rainbow tables.

Secure RTP (SRTP) Secures the transmission of voice via Real-time Transport Protocol (RTP). Specifically, SRTP adds encryption, authentication, integrity, and antireplay mechanisms to voice traffic.

Secure Shell (SSH) A protocol that provides encryption and authentication functions for remote terminal sessions. This allows an administrator to securely attach to and exchange information with a router, for example. Cisco recommends that SSH be used instead of Telnet because Telnet sends data in plain text.

Security level Defines the type of security algorithm performed on SNMP packets. Examples of security levels are noAuthNoPriv, authNoPriv, and authPriv.

Security model Defines an approach for user and group authentication. Cisco IOS supports the SNMPv1, SNMPv2c, and SNMPv3 security models.

Security policy A continually changing document that dictates a set of guidelines for network use. These guidelines complement organizational objectives by specifying rules for how the network is used.

READ MORE - Cisco CCNA Security 640-553 IINS Tutorials Part-16

Cisco CCNA Security 640-553 IINS Tutorials Part-17

Security zone Consists of a group of interfaces to which a policy can be applied. Grouping interfaces into zones involves two steps. First, a zone must be created so that interfaces may be attached to it. Second, an interface must be configured to be a member of a given zone.

SHA-1 Secure Hash Algorithm 1. One of five cryptographic hash functions known as SHA hash functions. They were designed by the National Security Agency (NSA) and published by the National Institute of Standards and Technology (NIST) as a U.S. Federal Information Processing Standard. SHA-1 computes a fixed-length digital representation (a message digest) from an input data sequence (the message) of any length.

Signature definition file (SDF) A database of signatures used to identify malicious traffic. Modern routers typically ship with an SDF file installed in flash memory. However, the administrator usually needs to periodically update the router’s SDF, because Cisco routinely updates these files to address emerging threats.

Simple Network Management Protocol (SNMP) A management protocol that allows an SNMP manager to collect information from an SNMP agent.

Skinny Client Control Protocol (SCCP) A Cisco-proprietary signaling protocol often called Skinny protocol. SCCP is often used for signaling between Cisco IP Phones and Cisco Unified Communications Manager servers. However, some Cisco gateways also support SCCP. SCCP is considered a client/server protocol, such as MGCP and H.248.

Small Computer Systems Interface (SCSI) In terms of SAN networking, the SCSI communications model serves as the basis for all the major SAN transport technologies. In fact, you could say that a SAN can best be described as the merging of SCSI and networking.

SNMP agent A piece of software that runs on a managed device (such as a server, router, or switch).

SNMP GET A message that is used to retrieve information from a managed device

SNMP manager Runs a network management application. Sometimes called a Network Management Server (NMS).

SNMP SET A message that is used to set a variable in a managed device or to trigger an action on the managed device.

READ MORE - Cisco CCNA Security 640-553 IINS Tutorials Part-17

Cisco CCNA Security 640-553 IINS Tutorials Part-18

SNMP trap An unsolicited message sent from the managed device to an SNMP manager. It can be used to notify the SNMP manager about a significant event that occurred on a managed device.

Snooping Broadly defines a class of attacks focused on compromising the confidentiality of data. In terms of SAN deployments, these attacks seek to give an attacker access to data that would otherwise be confidential.

Software Encryption Algorithm (SEAL) This kind of encryption uses a 160-bit encryption key. It offers the benefit of having less of an impact on the CPU compared to other software-based algorithms. It is an alternative to software-based DES, 3DES, and AES.

Spam over IP telephony (SPIT) VoIP spam. A SPIT attack on your Cisco IP Phone could, for example, make unsolicited messages periodically appear on the phone’s LCD screen or make the phone ring periodically.

Spoofing Imitating a given resource by alternative means. In network terms this might represent the spoofing of an IP address, where an attacker poses as the valid recipient at a given IP address to intercept traffic.

Standard access control list (ACL) Standard ACLs allow traffic to be permitted or denied from only specific IP addresses. With these ACLs, the packet’s destination and the ports involved are not taken into account.

Static firewall This first-generation firewall technology analyzes network traffic at the transport protocol layer. IP packets are examined to see if they match one of a set of rules defining which data flows are allowed. These rules specify whether communication is allowed based on information contained in the network and transport layer headers as well as the direction of the packet flow.

Storage-area network (SAN) In a SAN, storage devices are shared among all networked servers as peer resources. A SAN may be used to connect servers to storage, servers to each other, and storage to storage.

Stream cipher Uses smaller units of plain text than what are used with block ciphers. Typically they work with bits. Transformation of these smaller plain-text units also varies, depending on when during the encryption process they are encountered. One of the great benefits of stream ciphers as compared to block ciphers is that they are much faster. Generally they do not increase the message size because they can encrypt an arbitrary number of bits.

Supplicant A user device (such as a PC) that requests permission to access the network. This device must support the 802.1x standard. For example, a PC running the Microsoft Windows XP operating system supporting 802.1x could act as a supplicant.

READ MORE - Cisco CCNA Security 640-553 IINS Tutorials Part-18

Cisco CCNA Security 640-553 IINS Tutorials Part-20

Transparent firewall A Layer 2 firewall that behaves like a “stealth firewall.” In other words, it is not seen as a router hop to connected devices. In this implementation, the security appliance connects the same network on its inside and outside ports. However, each interface resides on a separate VLAN.

Transport mode Uses a packet’s original IP header, as opposed to adding a tunnel header for packets traveling over an IPsec-protected VPN. This approach works well in networks in which increasing a packet’s size could cause an issue.

Triple Data Encryption Standard (3DES) Applies the DES algorithm three times in a row to a plain-text block, but each application uses a different key. Applying DES three times with different keys makes brute-force attacks on 3DES unfeasible. This stems from the fact that the basic algorithm has stood the test of time, weathering 35 years in the field, proving quite trustworthy.

Trojan horse A piece of software that appears to perform a certain action but in fact performs another action, such as a computer virus. This action, generally encoded in a hidden payload, may or may not be malicious in nature.

Tunnel mode Unlike transport mode, tunnel mode encapsulates an entire packet traveling over an IPsec-protected VPN. As a result, the encapsulated packet has a new IPsec header. This new header has source and destination IP address information that reflects the two VPN termination devices at two different sites. Therefore, tunnel mode is frequently used in an IPsec site-to-site VPN.

Turbo access control list (ACL) Processes ACLs into lookup tables for greater efficiency. Turbo ACLs use the packet header to access these tables in a small, fixed number of lookups, independent of the existing number of ACL entries.

User datagram protocol (UDP) A communications protocol that has no error recovery features and is mostly used to send streamed material over the Internet.

VACL VLAN access control list. An ACL applied within a VLAN, as opposed to an ACL applied when traffic travels from one VLAN, or subnet, to another (as typically seen on a router).

virtual private network (VPN) A logical connection (sometimes called a tunnel) that can be established over an “untrusted” network (such as the Internet). An IPsec VPN can use a series of security protocols and algorithms to protect the traffic flowing over a VPN tunnel.

virtual SAN (VSAN) Created from a collection of ports that are part of a set of connected Fibre Channel switches. Together these ports form a virtual fabric. Ports within a single switch may be partitioned off to form multiple VSANs. Conversely, multiple switches may be used together, and any number of their ports may be joined to form a single VSAN.

READ MORE - Cisco CCNA Security 640-553 IINS Tutorials Part-20

CCNA Security Certification Overview

640-553 IINS IINS - Implementing Cisco IOS Network Security

CCNA Security is a new Associate Level certification designed to build upon the CCNA certification and as a prerequisite for the CCSP - Cisco Certified Security Professional certification. The Cisco CCNA Security certification validates the knowledge required to install, troubleshoot, and monitor Cisco security network devices. In addition, CCNA Security confirms an individual’s skills for job roles such as network security specialist, security administrator, and network security support engineer.

READ MORE - CCNA Security Certification Overview