CCIE Self-Study: Security Protocols

Exam Topics in This Chapter

• Remote Authentication Dial-In User Service (RADIUS)
• Terminal Access Controller Access Control System Plus (TACACS+)
• Advanced Encryption Standard (AES)
• EAP, PEAP, TKIP, TLS
• Data Encryption Standard (DES)
• Triple DES (3DES)
• IP Security (IPSec)
• Internet Key Exchange (IKE)
• Certificate Enrollment Protocol (CEP)
• Point-to-Point Tunneling Protocol (PPTP)
• Layer 2 Tunneling Protocol (L2TP)

You can find a list of all of the exam topics in the introduction to this book. For the latest updates on exam topics, visit Cisco.com.

This chapter covers some of today's most widely used technologies that enable network administrators to ensure that sensitive data is secure from unauthorized sources.

Standards such as IP Security (IPSec) and encryption standards are covered, as are all the fundamental foundation topics you need to understand to master the topics covered in the CCIE Security written exam.

The chapter ends with a discussion of some of the security features used in wireless networking to improve security. Protocols such as Extensible Authentication Protocol (EAP), Protected Extensible Authentication Protocol (PEAP), Temporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC), and Transport Layer Security (TLS) are discussed, all of which are newly defined protocols used to help secure vulnerable wireless networks.

This chapter covers the following topics:

• Security protocol topics— Sections are included for authentication, authorization, and accounting (AAA), RADIUS, and TACACS+.
• Encryption Technology Overview— Covers encrypting IP using standard encryption such as 3DES, AES, and IPSec. The mechanism used to authenticate encryption tunnels is also covered.
• Certificate Enrollment Protocol— Describes the Cisco-defined certificate management protocol, CEP, and how a device communicates with a Certificate Authority (CA).
• EAP, PEAP, and TKIP— Shows common new mechanisms used in the fight to keep intruders and hackers away from wireless networks.

"Do I Know This Already?" Quiz

The purpose of this assessment quiz is to help you determine how to spend your limited study time.

If you can answer most or all of these questions, you might want to skim the "Foundation Topics" section and return to it later, as necessary. Review the "Foundation Summary" section and answer the questions at the end of the chapter to ensure that you have a strong grasp of the material covered.

If you already intend to read the entire chapter, you do not necessarily need to answer these questions now. If you find these assessment questions difficult, read through the entire "Foundation Topics" section and review it until you feel comfortable with your ability to answer all of these questions and the "Q & A" questions at the end of the chapter.

Answers to these questions can be found in Appendix A, "Answers to Quiz Questions."

1. What are the three components of AAA? (Choose the three best answers.)
   1. Accounting
   2. Authorization
   3. Adapting
   4. Authentication
2. What Cisco IOS command must be issued to start AAA on a Cisco router?
   1. aaa old-model
   2. aaa model
   3. aaa new model
   4. aaa new-model
   5. aaa new_model
3. What mathematical algorithm initiates an encrypted session between two routers by exchanging public keys over an insecure medium such as the Internet?
   1. Routing algorithm
   2. Diffie-Hellman algorithm
   3. The switching engine
   4. The stac compression algorithm
4. Can you configure RADIUS and TACACS+ to be used on the same router?
   1. No.
   2. Yes, provided you have the same lists names applied to the same interfaces.
   3. Yes, provided you have the different lists names applied to the same interfaces.
   4. Yes, provided you have the different list names applied to different interfaces.
5. How do you remotely launch ACS to a Windows 2000 device? (The remote IP address is 10.1.1.1 and the client is Internet Explorer.)
   1. Type launch.
   2. Type 10.1.1.1.
   3. Type 10.1.1.1:2002.
   4. Type 10.1.1.1:8080.
6. What RADIUS attribute is used by vendors and not predefined by RFC 2138?
   1. 1
   2. 2
   3. 3
   4. 4
   5. 13
   6. 26
   7. 333
   8. 33
7. RADIUS can support which of the following protocols?
   1. PPP
   2. OSPF
   3. AppleTalk
   4. IPX
   5. NLSP
8. When a RADIUS server identifies the wrong password entered by the remote user, what packet type is sent?
   1. ACCEPT-USER
   2. REJECT-USERS
   3. REJECT-DENY
   4. REJECT-ACCEPT
   5. REJECT-ERROR
   6. ACCESS-REJECT
9. Identify the false statement about RADIUS.
   1. RADIUS is a defined standard in RFC 2138/2139.
   2. RADIUS runs over TCP port 1812.
   3. RADIUS runs over UDP port 1812.
   4. RADIUS accounting information runs over port 1646.
10. What is the RADIUS key for the following configuration? If this configuration is not valid, why isn't it? (Assume that this configuration is pasted into Notepad and not on an active router.)

    aaa authentication login use-radius group radius local
    aaa authentication ppp user-radius if-needed group radius
    aaa authorization exec default group radius
    aaa authorization network default group radius
    radius-server 3.3.3.3
    radius-server key IlovemyMum

    1. The RADIUS key is IlovemyMum, and it is a valid configuration.
    2. The RADIUS key is Ilovemymum, and it is a valid configuration.
    3. This configuration will not work because the command aaa new-model is missing.
    4. The RADIUS key is 3.3.3.3, and it is a valid configuration.
11. What is the RADIUS key for the following configuration?

    aaa new-model
    aaa authentication login use-radius group radius local
    aaa authentication ppp user-radius if-needed group radius
    aaa authorization exec default group radius
    aaa authorization network default group radius
    radius-server 3.3.3.3
    radius-server key IlovemyMum

    1. The RADIUS key is IlovemyMum.
    2. The RADIUS key is Ilovemymum.
    3. No RADIUS key exists.
    4. The RADIUS key is 3.3.3.3.
12. What versions of TACACS does Cisco IOS support? (Select the best three answers.)
    1. TACACS+
    2. TACACS
    3. Extended TACACS
    4. Extended TACACS+
13. TACACS+ is transported over which TCP port number?
    1. 520
    2. 23
    3. 21
    4. 20
    5. 49
14. What is the predefined RADIUS server key for the following configuration?

    radius-server host 3.3.3.3
    radius-server key CCIEsrock

    1. 3.3.3.3
    2. Not enough data
    3. CCIESROCK
    4. CCIEsRock
    5. CCIEsrock
15. What does the following command accomplish?

    tacacs_server host 3.3.3.3

    1. Defines the remote TACACS+ server as 3.3.3.3
    2. Defines the remote RADIUS server as 3.3.3.3
    3. Nothing, because it is not a valid IOS command
    4. Configures a Radius server 3.3.3.3
    5. An Invalid IOS command
16. Which of the following protocols does TACACS+ support?
    1. PPP
    2. AppleTalk
    3. NetBIOS
    4. All of these
17. Which of the following key lengths are not supported by AES?
    1. 64
    2. 128
    3. 192
    4. 256
    5. 512
18. What is the number of bits used with a standard DES encryption key?
    1. 56 bits
    2. 32 bits; same as IP address
    3. 128 bits
    4. 256 bits
    5. 65,535 bits
    6. 168 bits
19. What is the number of bits used with a 3DES encryption key?
    1. 56 bits
    2. 32 bits; same as IP address
    3. 128 bits
    4. 256 bits
    5. 65,535 bits
    6. 168 bits
20. In IPSec, what encapsulation protocol encrypts only the data and not the IP header?
    1. ESP
    2. AH
    3. MD5
    4. HASH
21. In IPSec, what encapsulation protocol encrypts the entire IP packet?
    1. ESH
    2. ESP
    3. AH
    4. MD5
    5. HASH
22. Which of the following is AH's IP number?
    1. 23
    2. 21
    3. 50
    4. 51
    5. 500
    6. 444
23. Which of the following is ESP's IP number?
    1. 23
    2. 21
    3. 50
    4. 51
    5. 500
    6. 444
24. Which of the following is not part of IKE phase I negotiations?
    1. Authenticating IPSec peers
    2. Exchanging keys
    3. Establishing IKE security
    4. Negotiating SA parameters
25. Which of the following is not part of IKE phase II?
    1. Negotiating IPSec SA parameters
    2. Periodically updating IPSec SAs
    3. Occasionally updating SAs (at most, once a day)
    4. Establishing IPSec security parameters
26. Which is the fastest mode in IPSec?
    1. Main mode
    2. Fast mode
    3. Aggressive mode
    4. Quick mode
27. Certificate Enrollment Protocol (CEP) runs over what TCP port number? (Choose the best two answers.)
    1. Same as HTTP
    2. Port 80
    3. Port 50
    4. Port 51
    5. Port 333
    6. Port 444
28. Which of the following are new features aimed at increasing wireless security? (Choose the best four answers.)
    1. TKIP
    2. AES
    3. EAP
    4. PEAP
    5. MIC
    6. 802.1D
    7. ESP
    8. AH