Integrated Security Technologies and Solutions - Volume II

Aaron Woland, CCIE® No. 20113, is a principal engineer in Cisco’s Advanced Threat Security group and works with Cisco’s largest customers all over the world. His primary job responsibilities include security design, solution enhancements, standards development, advanced threat solution design, endpoint security, and futures.Aaron joined Cisco in 2005 and is currently a member of numerous security advisory boards and standards body working groups. Prior to joining Cisco, Aaron spent 12 years as a consultant and technical trainer.Aaron’s other publications include Integrated Security Technologies and Solutions - Volume I; both editions of Cisco ISE for BYOD and Secure Unified Access; Cisco Next- Generation Security Solutions: All-in-one Cisco ASA FirePOWER Services, NGIPS and AMP; CCNP Security SISAS 300-208 Official Cert Guide; the CCNA Security 210-260 Complete Video Course; and many published white papers and design guides.Aaron is one of only five inaugural members of the Hall of Fame Elite for Distinguished Speakers at Cisco Live, and he is a security columnist for Network World, where he blogs on all things related to security. His other certifications include GHIC, GCFE, GSEC, CEH, MCSE, VCP, CCSP, CCNP, and CCDP, among others.You can follow Aaron on Twitter: @aaronwoland.Vivek Santuka, CCIE® No. 17621, is a consulting systems engineer at Cisco and is a security consultant to some of Cisco’s largest customers. He has over 13 years of experience in security, focusing on identity management and access control. Vivek is a member of multiple technical advisory groups.Vivek holds two CCIE certifications: Security and Routing and Switching. In addition, he holds RHCE and CISSP certifications and is a Distinguished Speaker at Cisco Live.Vivek is also the coauthor of the Cisco Press books AAA Identity Management Security and Integrated Security Technologies and Solutions – Volume I.You can follow Vivek on Twitter: @vsantuka.Jamie Sanbower, CCIE® No. 13637 (Routing and Switching, Security, and Wireless), is a principal systems engineer for Cisco’s Global Security Architecture Team. Jamie has been with Cisco since 2010 and is currently a technical leader and member of numerous advisory and working groups.With over 15 years of technical experience in the networking and security industry, Jamie has developed, designed, implemented, and operated enterprise network and security solutions for a wide variety of large clients. He is coauthor of the Cisco Press book Integrated Security Technologies and Solutions - Volume I.Jamie is a dynamic presenter and is a Cisco Live Distinguished Speaker. Prior to Cisco, Jamie had various roles, including director of a cyber security practice, senior security consultant, and senior network engineer.Chad Mitchell, CCIE® No. 44090, is a technical solutions architect at Cisco supporting the Department of Defense and supporting agencies. In his daily role, he supports the sales teams as a technical resource for all Cisco security products and serves as the Identity Services Engine subject matter expert for Cisco’s US Public Sector team.Chad has been with Cisco since 2013 supporting the DoD and other customers and is a contributing member to the Policy & Access Technical Advisors Group. Prior to joining Cisco, Chad spent 7 years as a deployment engineer and systems administrator implementing Cisco security products for customers.While his primary area of expertise is enterprise network access control with ISE, Chad is well versed on all Cisco security solutions such as ASA firewalls, Firepower NGFW/IPS/IDS, and Stealthwatch, to name a few; he also has first-hand experience deploying these solutions in customer production environments.Chad’s other certifications include CCDA, CCNP, Network+, Security+, and many other industry certifications.

• Introduction xixPart I Knock, Knock! Who’s There? 1Chapter 1 Who and What: AAA Basics 3Fundamentals of AAA 3Understanding the Concept of Triple-A in the Real World 4Compare and Select AAA Options 4TACACS+ 7RADIUS 12Comparing RADIUS and TACACS+ 15Summary 16Chapter 2 Basic Network Access Control 17What Is Cisco ISE? 17ISE Architecture for Network Access AAA 18Configuring ISE for Single/Standalone and Multinode Deployments 23ISE Configuration for Network Access 32802.1X and Beyond 54Configuring Wired Network Access with ISE 71Configuring Wireless Network Access with ISE 115Verifying Dot1X and MAB 140Summary 148Chapter 3 Beyond Basic Network Access Control 149Profiling with ISE 149ISE Profiler and CoA 175Profiles in Authorization Policies 178Passive Identities and EasyConnect 180Summary 191Chapter 4 Extending Network Access with ISE 193Get Ready, Get Set, Prerequisites 194BYOD Onboarding with ISE 197MDM Onboarding and Enforcement with ISE 236Posture Assessment and Remediation with ISE 244Guest Access with ISE 265TrustSec with ISE 287Summary 306Chapter 5 Device Administration Control with ISE 307The Case for Centralized AAA 307RADIUS Versus TACACS+ for Device Administration 308Using TACACS+ for Device Administration 309Using RADIUS for Device Administration 343Summary 352Part II Spread the Love! 353Chapter 6 Sharing the Context 355The Many Integration Types of the Ecosystem 356pxGrid in Depth 361Summary 406Chapter 7 APIs in Cisco Security 407APIs 101 407Firepower Management Center APIs 413Identity Services Engine APIs 424Advanced Malware Protection APIs 428Threat Grid APIs 433Umbrella APIs 435Summary 437References 437Part III c2889775343d1ed91b 439Chapter 8 Security Connectivity 441Hashing, Ciphers, Cryptography, and PKI 441Virtual Private Networks 461Layer 2 Encryption: IEEE 802.1AE/MACsec 470Summary 474References 474Chapter 9 Infrastructure VPN 477IPsec with IKEv1 478IPsec with IKEv2 484EzVPN 492DMVPN 500FlexVPN 514GETVPN 532Summary 541References 541Chapter 10 Remote Access VPN 543Remote Access VPN Overview 543Cisco AnyConnect Secure Mobility Client 546Client-Based Remote Access VPN 554Clientless Remote Access VPN 586Summary 595References 595Part IV The Red Pill 597Chapter 11 Security Virtualization and Automation 599Cisco Virtual Solutions and Server Virtualization 599Virtualization and Automation Solutions 602Summary 613References 61497815877147074, TOC, 2/28/19