CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide Premium Edition and Practice Test

By Joseph Muniz, James Risler, Steven Chimes
Published Dec 7, 2021 by Cisco Press. Part of the Official Cert Guide series.

Premium Edition eBook

Your Price: $63.99
List Price: $79.99
About Premium Edition eBooks

The Premium Edition eBook and Practice Test is a digital-only certification preparation product combining an eBook with enhanced Pearson Test Prep practice tests.

Your purchase will deliver:

Link to download the Pearson Test Prep exam engine
Access code for question database
eBook in the following formats, accessible from your Account page after purchase:

EPUB The open industry format known for its reflowable content and usability on supported mobile devices.

PDF The popular standard, which reproduces the look and layout of the printed page.

This eBook requires no passwords or activation to read. We customize your eBook by discreetly watermarking it with your name, making it uniquely yours.

eBook FAQ

eBook Download Instructions

Add to cart

Also available in other formats.

Description

Sample Content

Updates

Copyright 2022
Pages: 496
Edition: 1st

Premium Edition eBook
ISBN-10: 0-13-666059-2
ISBN-13: 978-0-13-666059-0

CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide, Premium Edition eBook and Practice Test

The exciting new CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide, Premium Edition eBook and Practice Test is a digital-only certification preparation product combining an eBook with enhanced Pearson IT Certification practice test. The Premium Edition eBook and Practice Test contains the following items:

* The CCNP Security Virtual Private Networks SVPN 300-730 Premium Edition Practice Test, including four full practice exams and enhanced practice test features
* PDF and EPUB formats of the new CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide from Cisco Press, which are accessible via your PC, tablet, and smartphone

About the Premium Edition Practice Test

This Premium Edition contains an enhanced version of the Pearson IT Certification Practice Test (PCPT) software with four full practice exams. In addition, it contains all the chapter-opening assessment questions from the book. This integrated learning package

* Enables you to focus on individual topic areas or take complete, timed exams
* Includes direct links from each question to detailed tutorials to help you understand the concepts behind the questions
* Provides unique sets of exam-realistic practice questions
* Tracks your performance and provides feedback on a module-by-module basis, laying out a complete assessment of your knowledge to help you focus your study where it is needed most

Pearson IT Certification Practice Test minimum system requirements:
Windows 10, Windows 8.1; Microsoft .NET Framework 4.5 Client; Pentium-class 1 GHz processor (or equivalent); 512 MB RAM; 650 MB disk space plus 50 MB for each downloaded practice exam; access to the Internet to register and download exam databases

About the Premium Edition eBook

CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide focuses specifically on the objectives for the Implementing Secure Solutions with Virtual Private Networks (SVPN) exam. Three leading Cisco security technology experts share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.

CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide presents you with an organized test preparation routine through the use of proven series elements and techniques. "Do I Know This Already?" quizzes open each chapter and enable you to decide how much time you need to spend on each section. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly.

Well regarded for its level of detail, assessment features, and challenging review questions and exercises, this official study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time. It helps you master all the topics on the Implementing Secure Solutions with Virtual Private Networks (SVPN) 300-730 exam, deepening your knowledge of

* Site-to-site virtual private networks on routers and firewalls
* Remote access VPNs
* Troubleshooting using ASDM and CLI
* Secure communications architectures

Sample Pages

Download the sample pages (includes Chapter 5)

Introduction xxxi
Part I Virtual Private Networks (VPN)
Chapter 1 Understanding the Implementing Secure Solutions with Virtual Private Networks SVPN 300-730 Exam 2
Why Learn VPN Technology 2
The Cisco Certification Program 6
The SVPN 300-730 Exam 8
Exam Preparation 13
Summary 13
Chapter 2 Introduction to Virtual Private Networks (VPN) 14
"Do I Know This Already?" Quiz 15
Foundation Topics 17
VPN Offerings 17
    VPN Technologies vs. Services 17
    Remote Access VPNs 18
        Remote Access VPN Use Cases 19
    Site-to-Site VPNs 20
        Hub-and-Spoke Design 20
        Spoke-to-Spoke Design 20
        Full Mesh Design 21
        Hybrid Design 21
        Tiered Hub-and-Spoke Design 22
VPN Technology Components 23
    Hardware VPN Support 23
        Routers 23
        Security Appliances 26
        VPN Clients 28
        Other VPN Clients 29
VPN Protocols 29
    Point-to-Point Tunneling Protocol (PPTP) 30
        PPTP Pitfalls 30
    Secure Socket Tunneling Protocol (SSTP) 31
    SSL/TLS 31
    IPsec with IKE 31
    IPsec with IKEv2 32
    Easy VPN 32
    L2TP 32
    VPN Protocol Comparison 33
Cisco VPN Portfolio 33
    DMVPN 33
        DMVPN Use Cases 33
    Group Encrypted Transport VPN (GETVPN) 33
    FlexVPN 34
    SSL VPN 34
        SSL VPN Use Cases 34
    Site-to-Site VPN Comparison 34
    Cisco ASA Licensing 37
        Time-Based License 37
        Licensing Options 38
    Cisco Secure Firewall Series for Site-to-Site VPNs 39
        Cisco Secure Firewall Limitations 39
    Cisco Meraki Licensing 40
        Cisco Meraki VPN Options 40
Cisco Security Appliance Management 41
    Cisco Security Management Options 41
VPN Logging 42
    Logging Collection Points 42
    ASA Logging 42
    SIEM 43
    VPN Client Logging 44
    DART 44
    Logging Challenges 45
Summary 47
References 47
Exam Preparation Tasks 48
Part II Site-to-Site VPN
Chapter 3 Site-to-Site VPNs 50
"Do I Know This Already?" Quiz 51
Foundation Topics 53
Site-to-Site VPN Architecture 54
    Site-to-Site Design Considerations 54
    Scoping a Project 54
Site-to-Site Components 55
    Routers vs. Security Appliances 55
    Cisco Security Appliances for Site-to-Site VPNs 56
    IPsec 56
        Authentication Header 56
        Encapsulating Security Payload 57
        Comparing AH and ESP 57
    ISAKMP 58
        IKE Security Association 58
        IKE Version 1 and 2 58
        Key IKE Concepts 60
        IKE Authentication 61
VPN Tunnel Concepts 62
    IPsec Tunnel Mode 63
    IPsec Transport Mode 63
    Certificate Authorities 64
    Crypto Map Concepts 64
    GETVPN/DMVPN/FlexVPN 64
        GETVPN 65
        DMVPN 65
        FlexVPN 65
Router Configuration with IKEv1 66
    Planning the VPN 67
    Configuring the Tunnel 68
        Why Use GRE with IPsec? 68
        Configuring a GRE Tunnel 68
    Configuring Network Address Translation 70
        NAT Example 71
    Configuring Encryption and IPsec 72
        IKE Policy Example 73
    Authentication Options 73
        Pre-shared Key Example 74
        Digital Certificate Example 74
    Configuring a Crypto Map 75
        Crypto Map Example 76
        Applying Crypto Maps 77
    Configuring QoS 78
Router Configuration with IKEv2 78
    Primary Router Configuration Example 78
        Defining the IKEv2 Keyring 78
        Defining the IKEv2 Proposal 79
        Defining IKEv2 Policies 79
        Defining a Crypto ACL for IPsec Secured Traffic 79
        Defining a Transform Set 80
    Defining an IKEv2 Profile 80
        Defining Crypto Maps 80
        Activating Crypto Maps 81
    Repeating Similar Steps for the Other Router 81
Appliance Configuration 83
    ASDM Example 83
    ASA Command-Line Example 87
    Cisco Secure Firewall Example 93
    Cisco Meraki Example 97
High Availability 99
    High Availability Options 100
    High Availability Considerations 101
    High Availability Costs 102
    High Availability Technology Considerations 102
    Bidirectional Forwarding Detection 103
    IOS Failover Example 103
Summary 104
References 104
Exam Preparation Tasks 105
Chapter 4 Group Encrypted Transport VPN (GETVPN) 106
"Do I Know This Already?" Quiz 107
Foundation Topics 109
MPLS Security Challenges 109
GETVPN Overview 111
GDOI Protocol 111
GETVPN Benefit Summary 113
GETVPN Components 113
    GETVPN Key Server 113
    GETVPN Group Member 115
    GETVPN GDOI Protocol 115
    GETVPN Security Controls 115
        Rekeying 115
        TBAR 115
        IP-D3P 116
GETVPN Design Considerations 116
    GETVPN Fault Tolerance Considerations 116
    Key GETVPN Considerations 117
GETVPN Implementation and Configuration 117
    Configuring a Key Server 119
        IKE Phase 1 Policy 119
        Key Server PSK Authentication 120
        IKE Phase 2 Policy 120
        Key Server RSA Key 120
        Key Server GDOI 120
        Unicast Rekeying Parameters 120
        Key Server Policy Access List 121
    Configuring Group Members 121
        Group Member IKE Phase 1 Policy 121
        Group Member PSK Authentication 122
        Group Member GDOI Information 122
        Crypto Maps 123
GETVPN Status Commands 123
    Group Member Show Commands 126
    GETVPN Status Commands Summary 128
Summary 128
References 129
Exam Preparation Tasks 129
Chapter 5 Dynamic Multipoint Virtual Private Network (DMVPN) 130
"Do I Know This Already?" Quiz 131
Foundation Topics 134
DMVPN Overview 134
    Legacy Crypto Map VPN Solutions 135
    Modern VPN Needs 135
    DMVPN Risks 136
    DMVPN Core Concepts 136
    DMVPN Example 136
DVMPN Network Components 137
    mGRE 137
        GRE and mGRE Advantages 138
    NHRP 138
        NHRP Example 139
    Remaining DMVPN Components 139
    Solution Breakdown 139
DMVPN Design Considerations 140
    DMVPN Planning 140
    DMVPN Fault Tolerance Considerations 141
    Key DMVPN Considerations 141
    DMVPN Phases 141
        DMVPN Phase 1 141
        DMVPN Phase 2 142
        DMVPN Phase 3 143
DMVPN Phase 1 Hub-and-Spoke Implementation 144
    Crypto IPsec Policy Configuration 145
        Creating an IKE Policy 145
        Creating Pre-shared Key Authentication Credentials 146
        Creating a Profile 147
        Creating a Transform Set 148
    GRE Tunnel Configuration 148
        Creating a Multipoint GRE Tunnel on the Hub 148
        Creating a GRE Tunnel on the Spoke 149
    NHRP Hub-and-Spoke Configuration 150
        Configure NHRP on the Hub 150
        Configure NHRP on the Spoke 150
        Configure Tunnel Protection 151
        Configure Tunnel Optional Parameters 152
    Routing Protocol Configuration 152
        Configure Routing on the Hub 152
        Configure Routing on the Spoke Using IPV4 153
        Configure Routing on the Spoke Using IPV6 153
DMVPN Phase 2 Spoke-to-Spoke Implementation 154
    IPsec for Spoke-to-Spoke 154
    Spoke-to-Spoke Routing 154
    IPv6 Spoke-to-Spoke Routing Configuration 155
DMVPN Phase 3 Spoke-to-Spoke Implementation 155
    Enable NHRP Redirects on the Hub 155
    Enable NHRP Shortcuts on the Spoke 156
DMVPN Troubleshooting 156
    Troubleshooting the Crypto IPsec Policy Configuration 156
        Troubleshooting IKE Phase 2 157
    Troubleshooting the GRE Tunnel Configuration 157
        Validating the Tunnel 158
    Troubleshooting the NHRP Hub-and-Spoke Configuration 158
        NHRP Registration 158
        Tunnel Configuration 158
        Debugging 159
    Troubleshoot the Routing Configuration 159
    DMVPN Troubleshooting Summary 160
Summary 160
References 161
Exam Preparation Tasks 161
Chapter 6 FlexVPN Configuration and Troubleshooting 164
"Do I Know This Already?" Quiz 165
Foundation Topics 168
FlexVPN Overview 168
    FlexVPN Advantages 169
        Modular Framework 169
        Configuring Service Parameters 169
        IKEv2 Benefits Summarized 169
    FlexVPN Versus Other Options 170
        Benefits of IKEv2 171
        FlexVPN Requirements 171
FlexVPN Components 172
    FlexVPN Component Roles 173
        FlexVPN Smart Defaults 173
        Router Smart Defaults 174
FlexVPN Design Considerations 174
    FlexVPN Planning 174
    Key FlexVPN Consideration 175
FlexVPN Implementation: Hub-and-Spoke (IPv4/IPv6) 175
    Hub-and-Spoke Configuration Summary 176
    Step 1: IKEv2 Proposal and IKEv2 Policy Configuration 177
        FlexVPN IKEv2 Proposal 177
        FlexVPN Transform Set 178
    Step 2: IKEv2 Authorization Policy Configuration 178
        AAA 178
        Hub Pool 179
        ACL Permitting Traffic 179
        Attach to Authorization Policy 180
    Step 3: Keyring and IKEv2 Profile Configuration 180
        Keyring 180
        IKEv2 Profile 181
    Step 4: IPsec Profile Configuration 182
        Create Loopback Address 182
        Virtual Template 183
        Pre-shared IKEv2 Keyring 183
    FlexVPN Spoke Configuration 183
        Spoke AAA Configuration 183
        Spoke Access List 184
        Spoke Keyring 184
        Spoke Authorization Policy 184
        Spoke IKEv2 Profile 185
        Spoke IPsec Profile 185
        Spoke Tunnel Interface 186
FlexVPN Implementation: Spoke-to-Spoke (IPv4/IPv6) 186
    FlexVPN NHRP 187
    FlexVPN Spoke-to-Spoke Spoke Router 188
        Spoke-to-Spoke Keyring 188
        Spoke-to-Spoke Route Injection 188
        Spoke-to-Spoke IKEv2 Profile 189
        Spoke-to-Spoke Add NHRP 189
        Spoke-to-Spoke Virtual Template 190
FlexVPN Troubleshooting 191
    Connectivity Troubleshooting 192
    Step 1: IKEv2 Proposal and IKEv2 Policy Troubleshooting 192
        IKEv2 Debugging 193
    Step 2: IKEv2 Authorization Policy Troubleshooting 193
    Step 3: Keyring and IKEv2 Profile Troubleshooting 194
    Step 4: IPsec Profile Troubleshooting 194
        NHRP Troubleshooting 195
Summary 197
References 197
Exam Preparation Tasks 198
Part III Remote Access Virtual Private Network
Chapter 7 Remote Access VPNs 200
"Do I Know This Already?" Quiz 202
Foundation Topics 204
Remote VPN Architecture 205
    NAS and Client-Side Software 205
    Remote Access Technology Considerations 206
Remote Access Components 207
    Remote Access Capable Routers 207
    Remote Access Capable Security Appliances 208
    AnyConnect Secure Mobility Client 209
        User Experience 209
        AnyConnect Protocol Support 209
        AnyConnect Security Capabilities 210
        AnyConnect Platform Support 210
        AnyConnect Profile Editor 211
        AnyConnect VPN Profile Example 212
    VPN Connection Profiles, Group Policies, and Users 214
        Group Policies 214
        Connection Profiles 214
    Split Tunneling 215
        Split Tunneling Configuration 216
    SSL VPN/WebVPN 219
        WebVPN Example 220
        SSL VPN Options 221
        SSL VPN Licensing 222
Encryption Algorithms 223
    Encryption Trends 223
    Encryption Algorithm Categories 223
        Comparing Encryption Options 224
    Elliptic Curve Cryptography Algorithms 225
        ECC Threats 225
        Encryption Algorithm Math 225
        ECC Math 226
        Combining ECC with Other Algorithms 227
    Applying Elliptic Curve Cryptography to a VPN 227
        Diffie Hellman Groups 228
High Availability 228
    Load Balancing 229
    Failover Design 229
    Load Balancing Considerations 229
Cisco ASDM Remote Access Configuration 230
Cisco ASA CLI Remote Access Configuration 237
    Default Tunnel Groups 239
Cisco Secure Firewall Remote Access VPN 241
    Cisco Secure Firewall Features 241
Cisco Meraki Remote Access VPN 248
    Meraki Remote Access Configuration Example 249
Router Configuration 250
    Key Concepts for Remote Access on Routers 251
        Remote Access on Router Configuration Example 251
Summary 255
References 256
Exam Preparation Tasks 257
Chapter 8 Clientless Remote Access SSL VPNs on the ASA 258
"Do I Know This Already?" Quiz 259
Foundation Topics 260
Clientless SSL VPN Overview 261
    ASA as a Proxy 262
    Cisco VPN Options 262
Clientless SSL VPN Prerequisites 263
    Software Licenses 263
    License Options 264
        AnyConnect Plus Subscription and Perpetual 264
        AnyConnect Apex Subscription 264
        AnyConnect VPN Only Perpetual License 264
    License Option Summary 265
    Software Support Requirements 266
    Clientless SSL VPN Prerequisites Summary 267
Basic Clientless SSL VPN Configuration 267
    Step 1: Installing an Identity Certificate 268
        Generating a New RSA Key Pair Using ASDM 268
        Generating a New RSA Key Pair Using CLI 269
        Creating an Identity Certificate Request Using ASDM 269
        Creating an Identity Certificate Request Using CLI 270
        Installing a Signed Identity Certificate Using ASDM 271
        Installing a Signed Identity Certificate Using CLI 272
    Step 2: Applying an Identity Certificate to the Interface(s) 273
        Applying the Identity Certificate Using ASDM 273
        Applying the Identity Certificate Using CLI 274
    Step 3: Enabling Clientless SSL VPN on an Interface 274
        Enable Clientless SSL VPN Interface Using ASDM 274
        Enable Clientless SSL VPN Interface Using CLI 275
    Step 4: Configuring Group Policies 276
        Group Policy Selection 276
        Creating Group Policies Using ASDM 277
        Creating Group Policies Using CLI 277
        Group Policy Attributes for Clientless SSL VPNs 278
        WebVPN Group Policy Attributes 279
        WebVPN Group Policy vs. Group Policy Attributes 280
    Step 5: Configuring Connection Profiles 280
        Default Connect Profiles 281
        Creating a Connection Profile Using ASDM 281
        Creating a Connection Profile Using CLI 282
        Connection Profile General Attributes 283
        Connection Profile WebVPN Attributes 283
    Step 6: Configuring User Authentication 284
        Authentication Servers 285
        Configuring Authentication Using ASDM 286
        Configuring Local Authentication Using CLI 287
Extended Clientless SSL VPN Configuration Options 287
    Configuring Bookmarks 287
        Bookmark Support 288
        Creating a Bookmark List 289
        Applying the Bookmark List to a Group Policy Using ASDM 290
        Applying the Bookmark List to a Group Policy Using CLI 291
    Configuring Web ACLs 291
        Web ACL Support 291
        Creating a Web ACL Using ASDM 292
        Creating a Web ACL Using CLI 293
        Applying a Web ACL to a Group Policy Using ASDM 293
        Applying a Web ACL to a Group Policy Using CLI 294
    Configuring Application Access via Port Forwarding 294
        Creating a Port Forwarding List Using ASDM 295
        Creating a Port Forwarding List Using CLI 295
        Applying a Port Forwarding List to a Group Policy Using ASDM 296
        Applying a Port Forwarding List to a Group Policy Using ASDM 296
    Configuring Application Access via Smart Tunnels 297
        Smart Tunnel Requirements 297
        Smart Tunnel Benefits 298
        Creating a Smart Tunnel List Using ASDM 298
        Creating a Smart Tunnel List Using ASDM 299
        Applying the Smart Tunnel List to a Group Policy Using ASDM 300
        Applying the Smart Tunnel List to a Group Policy Using CLI 300
    Configuring Client/Server Plug-ins 301
        Obtaining Plug-ins 301
Summary 302
References 302
Exam Preparation Tasks 303
Chapter 9 AnyConnect VPNs on the ASA and IOS 306
"Do I Know This Already?" Quiz 307
Foundation Topics 309
AnyConnect VPN Review 310
    SSL VPN Versus IKEv2 310
AnyConnect SSL VPN Prerequisites on ASA 310
    AnyConnect Licenses 311
    Supported Operating Systems 311
        Compatible Browsers 311
        Administrative Privileges 311
Basic AnyConnect SSL VPN Configuration on ASA 312
    Step 1: Installing an Identity Certificate 312
    Step 2: Loading an AnyConnect Package 312
        Loading an AnyConnect Package Using ASDM 313
        Loading an AnyConnect Package Using CLI 314
    Step 3: Enabling AnyConnect VPN Client SSL Access 315
        Enabling AnyConnect VPN Using ASDM 315
        Enabling AnyConnect VPN Using CLI 315
    Step 4: Configuring a Group Policy 316
        Configure Group Policy Using ASDM 317
        Configure Group Policy Using CLI 318
    Step 5: Configuring an AnyConnect Connection Profile 319
        Configuring an AnyConnect Connection Profile Using ASDM 319
        Configuring an AnyConnect Connection Profile Using CLI 320
        Configuring a Group URL for an AnyConnect Connection Profile Using ASDM 322
        Configuring a Group URL for an AnyConnect Connection Profile Using CLI 323
    Step 6: Configuring User Authentication 324
        Creating a AAA Server Group Using ASDM 324
        Creating a AAA Server Group Using CLI 325
        Adding RADIUS Servers to a AAA Server Group Using ASDM 325
        Adding RADIUS Servers to a AAA Server Group Using CLI 326
        Configuring a Connection Profile to Use the RADIUS Server Group Using ASDM 326
        Configuring a Connection Profile to Use the RADIUS Server Group Using CLI 327
    Step 7: Defining an Address Pool 328
        Creating an Address Pool Using ASDM 328
        Creating an Address Pool Using CLI 328
        Applying the Address Pool to a Group Policy Using ASDM 329
        Applying the Address Pool to a Group Policy Using CLI 330
        AnyConnect Installation 330
        Connecting from the AnyConnect Client 331
Extended AnyConnect SSL VPN Configuration on ASA 331
    Configuring DNS and WINS Using ASDM 332
        Configuring DNS and WINS Using CLI 332
        Configuring Split Tunneling Using ASDM 333
        Configuring Split Tunneling Using CLI 335
        Configuring a Traffic Filter Using ASDM 335
        Configuring a Traffic Filter Using CLI 336
AnyConnect IKEv2 VPN on ASA 337
    Step 1: Enabling IPsec (IKEv2) 337
        Configuring IPsec (IKEv2) Using ASDM 337
        Configuring IPsec (IKEv2) Using CLI 338
    Step 2: Configuring an AnyConnect Client Profile for IKEv2 340
        Profile Storage 340
        Creating AnyConnect Client Profile for IKEv2 Using ASDM 341
AnyConnect IKEv2 VPN on Routers 342
    Step 1: Configuring PKI 343
        Generating a Key Pair 343
        Creating a Trustpoint 344
        Trust Point Policy 344
        Configuring a Trustpoint 345
        Define Trust Policy 345
        Disable FQDN 345
        Importing the Root CA Certificate 345
        Generating a Certificate Signing Request (CSR) 346
        Importing the Signed Server Certificate 347
    Step 2: Disabling the HTTP and HTTPS Servers on the Router 349
    Step 3: Configuring AAA 349
    Step 4: Creating an IKEv2 Authorization Policy 349
    Step 5: Creating an IKEv2 Profile 350
        Create New IKEv2 Profile 350
        Identifying Match Criteria 350
        RSA Certificate Authentication 351
        Authenticating Remote Users 351
        Authentication List 351
        Virtual Template 351
        AnyConnect Client Profile 351
        Configuration Summary 351
    Step 6: Creating a Virtual Template 352
        Creating the AnyConnect Client Profile 353
        AnyConnect Profile Editor 354
        Copying to the Router 355
        Reboot 356
        Configuring Split Tunneling 357
Summary 357
References 358
Exam Preparation Tasks 358
Chapter 10 Troubleshooting Remote Access VPNs 362
"Do I Know This Already?" Quiz 363
Foundation Topics 365
Troubleshooting Clientless SSL VPNs on the ASA 366
    Troubleshooting Categories 366
    Step 0: SSL VPN Components 367
    Step 1: Connectivity Troubleshooting 368
        Troubleshooting Questions 368
        Exam-Focused Connectivity Troubleshooting 368
        ASA WebVPN Service 370
        Troubleshooting Certificates 370
        Applied Certificates 371
        Full Certificate Chain 371
        Correct Certificate 371
        Certificate Debug Commands 371
        The capture Command 372
        Connectivity Troubleshooting Summary 372
    Step 2: Login Troubleshooting 372
        Connection Profile Group URL 373
        Viewing Group URLs 373
        Profile Selection 373
        Authentication 374
        ASA Authentication Testing 375
        Debug ASA to Authentication System 375
        Authorization 375
        Authorization Debugging 376
        Group Policy 377
        Group Policy Validation Using CLI 378
        Login Troubleshooting Summary 378
    Step 3: Clientless WebVPN Service Issues 379
        Validating WebVPN Service Details 380
        WebVPN Debugging 380
        Validating DNS Configuration 381
        ASA Plug-ins 381
        Bookmarks 382
        DAP and Bookmarks 383
        DNS and Bookmarks 383
        WebVPN Services Troubleshooting Summary 383
    Step 4: Application Access 383
        ASA-to-Application Connectivity 384
        Application-to-ASA Connectivity with Port Forwarding 384
        Application Troubleshooting Summary 384
Troubleshooting AnyConnect SSL VPNs on the ASA 385
    Step 1: Connectivity Troubleshooting 386
    Step 2: Login Troubleshooting 387
    Step 3: Network Access Troubleshooting 387
        AnyConnect Enabled 387
        Group Policy Configuration 388
        Address Pool 389
        Validating the Address Pool 389
        Routing Problems 390
        DNS Troubleshooting 391
        DNS Split Tunnel Range 392
        Browser Proxy 392
        NAT Problem 393
        capture Command 394
        capture Command Options 394
        Traffic Filters 395
        Troubleshooting Traffic Filters 395
        Network Access Troubleshooting Summary 396
    Step 4: Diagnostics and Reporting Tool (DART) 396
    Step 5: Diagnostic Commands 396
    Step 6: Application 399
Troubleshooting AnyConnect IKEv2 VPNs on the ASA 400
    Step 0: Prepare 400
    Steps 1 and 2: Connectivity and Login to the VPN Concentrator 402
    Step 3: VPN Status Validation 402
        Command 1: show vpn-sessiondb detail anyconnect 403
        Command 2: show crypto ikev2 sa 405
        Command 3: show crypto ikev2 sa detail 405
        Command 4: show crypto ipsec sa 406
        Command 5: debug crypto ikev2 255 408
    Step 4: Host Troubleshooting 408
        Invalid Host Entry 409
Troubleshooting AnyConnect IKEv2 VPNs on Routers 410
    Steps 1 and 2: Connectivity and Login to the Router 411
    Step 3: VPN Status Validation 411
        Command 1: show crypto ipsec sa detail 411
        Command 2: show crypto session detail 412
        Command 3: debug aaa 413
Summary 414
Reference 415
Exam Preparation Tasks 415
Part IV SVPN Preparation
Chapter 11 Final Preparation 418
Getting Ready 418
Tools for Final Preparation 420
    Pearson Cert Practice Test Engine and Questions on the Website 420
        Accessing the Pearson Test Prep Software Online 420
        Accessing the Pearson Test Prep Software Offline 420
    Customizing Your Exams 421
    Updating Your Exams 422
        Premium Edition 422
    Chapter-Ending Review Tools 423
Suggested Plan for Final Review/Study 423
Summary 423
Appendix A Answers to the "Do I Know This Already?" Quizzes 424
Appendix B Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730) Exam Updates 430
Glossary of Key Terms 433

Online Elements
Appendix C Memory Tables
Appendix D Memory Tables Answer Key
Appendix E Study Planner
Glossary of Key Terms

9780136660606    TOC    10/29/2021

Errata

We've made every effort to ensure the accuracy of this book and its companion content. Any errors that have been confirmed since this book was published can be downloaded below.

Download the errata (64 KB .doc)

Submit Errata

Cisco Press Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Cisco Press and its family of brands. I can unsubscribe at any time.

Privacy Notice

Overview

Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Cisco Press products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.

Surveys

Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.

Newsletters

If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@ciscopress.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.

Security

Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.

Children

This site is not directed to children under the age of 13.

Marketing

Pearson may send or direct marketing communications to users, provided that

Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
Such marketing is consistent with applicable law and Pearson's legal obligations.
Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.

Choice/Opt-out

Users can always make an informed choice as to whether they should proceed with certain services offered by Cisco Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.ciscopress.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

As required by law.
With the consent of the individual (or their parent, if the individual is a minor)
In response to a subpoena, court order or legal process, to the extent permitted or required by law
To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
To investigate or address actual or suspected fraud or other illegal activities
To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.

Links

This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020

Email Address