Cisco PIX Firewalls: Configure, Manage, and Troubleshoot

Features

• Cover Type: Paperback with 544 pages
• Published by: Syngress
• Edition: 2nd Edition May 1, 2005
• Written in: English
• ISBN 10 Number: 1597490040
• ISBN 13 Number: 978-1597490047
• Book Dimensions: 9.1 x 7 x 1.3 inches
• Weighs: 1.8 pounds

Product Description
#1 Best-Selling PIX Book Completely Updated for Cisco PIX Version 7.0

This completely updated bestseller covers Cisco PIX Security Appliance software Version 7.0, as well as the entire family of Cisco PIX 500 Series Firewalls. The book clearly explains how to leverage the integrated remote access and site-to-site VPN capabilities found in PIX Firewalls. It also illustrates how to securely extend your network to tele-workers, remote and satellite offices, business partners, suppliers, and customers. The authors thoroughly document all enhancements to PIX 7.0, including virtual LAN (VLAN)-based virtual interfaces, OSPF Dynamic Routing over VPNs, Secure Hypertext Transfer Protocol (HTTPS) Authentication Proxy, Local User Authentication Database for Network and VPN Access, Advanced Encryption Standard (AES), Support for VPN Accelerator Card+ (VAC+), DHCP Server Support on Multiple Interfaces. Special attention is paid to intrusion protection configuration.

• Create Multiple Security ContextsCreate virtual firewalls within a single appliance, each with its own set of security policies, logical interfaces, and administrative domain.
  
  
• Utilize PIX 7.0's Advanced Active Failover DesignCreate an easy-to-manage, high-availability solution using geographically separated appliances, that continuously synchronize their connection state and device configuration data.
  
  
• Sleep Easy with Scheduled System ReloadsSchedule PIX security appliance reloads at specific times to better manage network downtime and remote-access VPN connections more efficiently.
  
  
• Secure Communications with SSHv2 and Secure Copy ProtocolUse SSHv2 to securely manage PIX appliances and begin using SCP for secure file transfer between appliances.
  
  
• Take Advantage of the New ASDMWith ASDM all you need is a Web browser to deploy, configure, and monitor a PIX appliance, or to setup a VPN.
  
  
• Deploy OSPF Dynamic RoutingUse OSPF to detect service outages and automatically reroute your network and VPN traffic for optimal performance and flexibility.
  
  
• Realize the Benefits of IPv6PIX 7.0 provides IPv6-enabled inspection services for HTTP, FTP, SMTP, ICMP, TCP, and UDP.
  
  
• Manage and Contain Malicious AttacksUse your PIX firewall to protect against SYN Floods, malicious fragmentation of traffic, and excessive connection establishment by configuring limits.
  
  
• Download the Bonus, Complete E-Book for PIX software 6.xIf you are migrating from 6.x or running a mixed environment, download a FREE copy of Syngress's best-selling PIX 6.x book.

Your Solutions Membership Gives You Access to:

A comprehensive FAQ page that consolidates all of the key points of this book into an easy-to-search Web page

"From the Author" Forum where the authors post timely updates and links to related sites

Downloadable chapters from these best-selling books:

Configuring NetScreen Firewalls

Dr. Tom Shinder's Configuring ISA Server 2004

Microsoft Log Parser Toolkit

Google Hacking for Penetration Testers

TABLE OF CONTENTS

Introduction to Security and Firewalls

Introduction to PIX Firewalls

PIX Firewall Operations

Adaptive Security Device Manager

Application Inspection

Filtering, Intrusion Detection, and Attack Management

Services

Configuring Authentication, Authorization, and Accounting

PIX Firewall Management

Configuring Virtual Private Networking

Configuring Failover

Troubleshooting and Performance Monitoring

Reader Reviews
Anyone who has ever deployed a network and talked to a Cisco sales representative is probably familiar with the PIX device. Anyone who has ever used one knows that there are hundreds of commands and combinations available to them, and it's easy to get lost. A book like Cisco PIX Firewalls by Charles Riley, Umer Khan, Michael Sweeney, along with Thorsten Behrens, Brian Browne, Daniel Klingerman, and Ido Dubrawsky can help you navigate this powerful feature set. While the Cisco PIX product, which actually refers to a device product line and its associated operating system, isn't open source, there is a full set of documentation available on the Cisco web site. You can look up commands and even many common tasks which can help you achieve your goal. So, a big question in my review of this book is "Does Cisco PIX Firewalls offer substantially more than these freely available documents?" The book is not divided into any major sections, but follows a simple path. Provide an overview of the product, some of the basic functionality, and then move on to a task based approach of solutions. These include failover, VPN, IPv6, content inspection, and management with the newly designed ASDM product. This organization works pretty well. A generic overview of security, security policy, and how firewalls play a role in that is covered in Chapter 1. The overview is very brief, and the authors seem to have included it for completeness only. If you're looking at a book on the PIX firewall, chances are you're familiar with what a firewall does in part. My only big complaint about this chapter is that some of the figures on NAT and PAT are confusing because they use RFC1918 address space (private address space) on both sides of the device. When they talk about how this is used internally and then use it externally, it gets confusing to remember which network is which. Sadly, this network structure continues into other chapters, perpetuating the confusion. In chapter 2 you get an overview of the PIX software and hardware lines. Sadly, this chapter is a bit muddled. While the overview itself covers all the right bases, at times some additional material would have been helpful. Supplementing text descriptions with a simple picture would be nice, so that people could know at a glace which device they're looking at (ie a PIX 506E vs a 525). A software and hardware matrix would have been helpful, too, to reduce the confusion you get with Cisco's myriad of configurations. In several places, the one letter abbreviations from the output is not explained, including the firewall states and routing output. And finally, this appears to be common in this book, there's an inconsistency in bolding which text is input and which is output. The "bold is input, normal is output" convention is not always obeyed. These may sound like nits, but consistency helps with clarity, and at times the material is muddled. Overall, there are some real strengths in the book, and a few weaknesses as well. One example of a real gem is the case study in chapter 3, showing a featured network and the associated PIX configuration. This lets you see how you would outline your goals and then achieve them using the PIX feature set and commands. This example was well written and useful. The breakdown of commands as new, existing, or deprecated is also quite useful given that the book covers a major new release, 7.0. The coverage of the new ASDM feature, which provides a GUI management interface to the PIX software, is pretty good. With that chapter, and chapter 9 covering management, you should be up and running in no time at all. The same goes for the new content inspection feature, covered in chapter 5. While it's brief, it contains a lot of useful information that you'll need to enable features. What's missing from that, though, is any serious overview of the problems the prior version of the feature, the 'fixup' command, caused in the past and if the new inspection feature suffers those same problems. Finally, the chapters on virtual private networking and failover are succinct but enough to get you started with a basic running configuration. Sometimes there are real stinkers, though. Some of the formatting makes getting information out of the output difficult. Word wrap and oddities really detract from the quality of the material in those places. Many of the figures can be unclear due to the quantity of information they try and present. Here, two figures may have been useful instead of one fully packed figure. The book has a few errors in it, too, which may have been the result of a speedy printing cycle. Figure 2.3, for example, shows an incorrect TCP header. I suspect many of the errors, inconsistencies and other problems in it are due to two reasons. First, the publisher wanted to get this book out quickly to match the release of PIX 7.0 as closely as possible. Secondly, the number of contributing authors (6 authors and a technical editor) made a cohesive writing style and their edits difficult to choreograph completely. Overall, Cisco PIX Firewalls has some value to it, covering new PIX 7.0 features clearly and skillfully. Unfortunately, it suffers from some production problems and errors which weaken it's strength and rating. Syngress also has four eBooks available with this book, one of which covers PIX migrations with earlier versions. While this wont replace the official Cisco documentation, it augments it nicely and, for some of the features covered, surpasses the Cisco documentation. If you're looking at deploying a Cisco PIX soon or upgrading from 6.x to 7.0, you should pick up this book.