CCNP Security VPN 642-647 Official Cert Guide

✍ Scribed by Jim Thomas, Howard Hooper

• Publisher: Cisco Press
• Year: 2011
• Tongue: English
• Leaves: 821
• Edition: 1
• Category: Library

✦ Synopsis

Trust the best selling Official Cert Guide series from Cisco Press to help you learn, prepare, and practice for exam success. They are built with the objective of providing assessment, review, and practice to help ensure you are fully prepared for your certification exam.   CCNP Security VPN 642-647 Official Cert Guide presents you with an organized test preparation routine through the use of proven series elements and techniques. “Do I Know This Already?” quizzes open each chapter and enable you to decide how much time you need to spend on each section. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly. Master Cisco CCNP Security VPN 642-647EAM topics Assess your knowledge with chapter-opening quizzes Review key concepts with exam preparation tasks Practice with realistic exam questions on the CD-ROM CCNP Security VPN 642-647 Official Cert Guide, focuses specifically on the objectives for the CCNP Security VPN exam. Cisco Certified Internetwork Expert (CCIE) Howard Hooper share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics.   The companion CD-ROM contains a powerful Pearson IT Certification Practice Test engine that enables you to focus on individual topic areas or take a complete, timed exam. The assessment engine also tracks your performance and provides feedback on a module-by-module basis, laying out a complete assessment of your knowledge to help you focus your study where it is needed most.   Well-regarded for its level of detail, assessment features, comprehensive design scenarios, and challenging review questions and exercises, this official study guide helps you master the concepts and techniques that will enable you to succeed on the exam the first time.   The official study guide helps you master all the topics on the CCNP Security VPN exam, including: Configuring policies, inheritance, and attributes AnyConnect Remote Access VPN solution AAA and Dynamic Access Policies (DAP) High availability and performance Clientless VPN solutions SSL VPN with Cisco Secure Desktop Easy VPN solutions IPsec VPN clients and site-to-site VPNs CCNP Security VPN 642-647 Official Cert Guide is part of a recommended learning path from Cisco that includes simulation and hands-on training from authorized Cisco Learning Partners and self-study products from Cisco Press. To find out more about instructor-led training, e-learning, and hands-on instruction offered by authorized Cisco Learning Partners worldwide, please visit www.cisco.com/go/authorizedtraining.   The print edition of the CCNP Security VPN 642-647 Official Cert Guide contains a free, complete practice exam.   Pearson IT Certification Practice Test minimum system requirements: Windows XP (SP3), Windows Vista (SP2), or Windows 7; Microsoft .NET Framework 4.0 Client; Microsoft SQL Server Compact 4.0; Pentium class 1GHz processor (or equivalent); 512 MB RAM; 650 MB disc space plus 50 MB for each downloaded practice exam   Also available from Cisco Press for Cisco CCNP Security study is the CCNP Security VPN 642-647 Official Cert Guide Premium Edition eBook and Practice Test. This digital-only certification preparation product combines an eBook with enhanced Pearson IT Certification Practice Test.   This integrated learning package: Allows you to focus on individual topic areas or take complete, timed exams Includes direct links from each question to detailed tutorials to help you understand the concepts behind the questions Provides unique sets of exam-realistic practice questions Tracks your performance and provides feedback on a module-by-module basis, laying out a complete assessment of your knowledge to help you focus your study where it is needed most  

✦ Table of Contents

Contents......Page 10
Introduction......Page 25
“Do I Know This Already?” Quiz......Page 34
Examining ASA Control Fundamentals......Page 37
Routing the Environment......Page 47
Address Translations and Your ASA......Page 49
AAA for Network-Based Access......Page 52
ASA VPN Technology Comparison......Page 55
Managing Your ASA Device......Page 58
Packet Processing......Page 59
Controlling VPN Access......Page 60
The Good, the Bad, and the Licensing......Page 63
Exam Preparation Tasks......Page 75
“Do I Know This Already?” Quiz......Page 78
Policies and Their Relationships......Page 80
Understanding Connection Profiles......Page 81
Understanding Group Policies......Page 87
Configure User Attributes......Page 90
Using External Servers for AAA and Policies......Page 91
Exam Preparation Tasks......Page 101
“Do I Know This Already?” Quiz......Page 104
Full SSL VPN Technology Overview......Page 107
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 114
Deploying Your First Full-Tunnel AnyConnect SSL VPN Solution......Page 116
Deploying Your First AnyConnect IKEv2 VPN Solution......Page 123
Client IP Address Allocation......Page 128
Advanced Controls for Your Environment......Page 135
Troubleshooting the AnyConnect Secure Mobility Client......Page 142
Exam Preparation Tasks......Page 148
“Do I Know This Already?” Quiz......Page 150
Authentication Options and Strategies......Page 152
Provisioning Certificates as a Local CA......Page 157
Configuring Certificate Mappings......Page 165
Provisioning Certificates from a Third-Party CA......Page 170
Advanced PKI Deployment Strategies......Page 182
Doubling Up on Client Authentication......Page 186
Troubleshooting Your Advanced Configuration......Page 192
Exam Preparation Tasks......Page 194
“Do I Know This Already?” Quiz......Page 196
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 198
AnyConnect Installation Options......Page 199
Managing AnyConnect Client Profiles......Page 208
Advanced Profile Features......Page 212
Advanced AnyConnect Customization and Management......Page 219
Exam Preparation Tasks......Page 226
“Do I Know This Already?” Quiz......Page 228
Configuring Local and Remote Group Policies......Page 230
Full SSL VPN Accountability......Page 240
Authorization Through Dynamic Access Policies......Page 244
Troubleshooting Advanced Authorization Settings......Page 247
Exam Preparation Tasks......Page 250
“Do I Know This Already?” Quiz......Page 252
Cisco Secure Desktop Overview and Configuration......Page 255
AnyConnect Posture Assessment and Host Scan......Page 262
Configure Prelogin Policies......Page 265
AnyConnect Network Access, Web Security, and Telemetry Modules......Page 269
Exam Preparation Tasks......Page 277
“Do I Know This Already?” Quiz......Page 280
Overview of High Availability and Redundancy Methods......Page 282
Deploying DTLS......Page 286
Performance Assurance with QOS......Page 287
AnyConnect Redundant Peering and Failover......Page 296
Hardware-Based Failover with VPNs......Page 298
Redundancy in the VPN Core......Page 302
Exam Preparation Tasks......Page 307
“Do I Know This Already?” Quiz......Page 310
Clientless SSL VPN Overview......Page 313
SSL VPN Building Blocks......Page 314
Deployment Procedures and Strategies......Page 320
Deploying Your First Clientless SSL VPN Solution......Page 324
Basic Access Control......Page 350
Content Transformation......Page 358
Troubleshooting a Basic Clientless SSL VPN......Page 362
Exam Preparation Tasks......Page 366
“Do I Know This Already?” Quiz......Page 368
Overview of Advanced Clientless SSL VPN Settings......Page 371
Application Access Through Port Forwarding......Page 374
Application Access Using Client-Server Plug-Ins......Page 380
Application Access Through Smart Tunnels......Page 388
Configuring SSL/TLS Proxies......Page 394
Troubleshooting Advanced Application Access......Page 397
Exam Preparation Tasks......Page 401
“Do I Know This Already?” Quiz......Page 404
Basic Portal Layout Configuration......Page 406
Portal Localization......Page 412
Getting Portal Help......Page 417
AnyConnect Portal Integration......Page 418
Clientless SSL VPN Advanced Authentication......Page 420
Using an External and Internal CA for Clientless Access......Page 422
Clientless SSL VPN Double Authentication......Page 430
Deploying Clientless SSL VPN Single Sign-On......Page 434
Troubleshooting PKI and SSO Integration......Page 437
Exam Preparation Tasks......Page 441
“Do I Know This Already?” Quiz......Page 444
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 447
DAP Record Aggregation......Page 458
Troubleshooting DAP Deployment......Page 463
Exam Preparation Tasks......Page 468
“Do I Know This Already?” Quiz......Page 470
Cisco Secure Desktop Overview and Configuration......Page 472
Configure Prelogin Criteria......Page 483
Host Endpoint Assessment......Page 491
Authorization Through DAPs......Page 492
Troubleshooting Cisco Secure Desktop......Page 494
Exam Preparation Tasks......Page 496
“Do I Know This Already?” Quiz......Page 498
High-Availability Deployment Information and Common Strategies......Page 500
Content Caching for Optimization......Page 503
Clientless SSL VPN Load Sharing Using an External Load Balancer......Page 504
Clustering Configuration for Clientless SSL VPN......Page 505
Troubleshooting Load Balancing and Clustering......Page 508
Exam Preparation Tasks......Page 510
“Do I Know This Already?” Quiz......Page 512
IPsec Review......Page 514
Cisco IPsec VPN Client Features......Page 519
IPsec Client Software Installation and Basic Configuration......Page 522
Advanced Profile Settings......Page 529
Troubleshooting VPN Client Connectivity......Page 538
Exam Preparation Tasks......Page 543
“Do I Know This Already?” Quiz......Page 546
Configuration Procedures, Deployment Procedures, and Information Gathering......Page 548
Easy VPN Basic Configuration......Page 550
Controlling Your Environment with Advanced Features......Page 570
Troubleshooting a Basic Easy VPN......Page 577
Exam Preparation Tasks......Page 579
“Do I Know This Already?” Quiz......Page 582
Authentication Options and Strategies......Page 584
Configuring PKI with IPsec Easy VPNs......Page 587
Configuring Mutual/Hybrid Authentication......Page 592
Configuring Digital Certificate Mappings......Page 593
Provisioning Certificates from a Third-Party CA......Page 597
Advanced PKI Deployment Strategies......Page 601
Troubleshooting Advanced Authentication for Easy VPN......Page 606
Exam Preparation Tasks......Page 608
“Do I Know This Already?” Quiz......Page 610
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 612
Configuring Local and Remote Group Policies......Page 613
Accounting Methods for Operational Information......Page 619
Exam Preparation Tasks......Page 628
“Do I Know This Already?” Quiz......Page 630
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 633
Easy VPN Client HA and Failover......Page 635
Hardware-Based Failover with VPNs......Page 637
Clustering Configuration for Easy VPN......Page 643
Troubleshooting Device Failover and Clustering......Page 646
Exam Preparation Tasks......Page 650
“Do I Know This Already?” Quiz......Page 652
Easy VPN Remote Hardware Client Overview......Page 654
Configuring a Basic Easy VPN Remote Client Using the ASA 5505......Page 656
Configuring Advanced Easy VPN Remote Client Settings for the ASA 5505......Page 658
Troubleshooting the ASA 5505 Easy VPN Remote Hardware Client......Page 664
Exam Preparation Tasks......Page 668
“Do I Know This Already?” Quiz......Page 670
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 673
IKEv1 Phase 1......Page 675
IKEv1 Phase 2 (Quick Mode)......Page 676
Configuring a Basic IPsec Site-to-Site VPN......Page 678
Configure Advanced Authentication for IPsec Site-to-Site VPNs......Page 687
Troubleshooting an IPsec Site-to-Site VPN Connection......Page 692
Exam Preparation Tasks......Page 695
“Do I Know This Already?” Quiz......Page 698
Configuration Procedures, Deployment Strategies, and Information Gathering......Page 700
High Assurance with QoS......Page 701
Deploying Redundant Peering for Site-to-Site VPNs......Page 709
Site-to-Site VPN Redundancy Using Routing......Page 710
Hardware-Based Failover with VPNs......Page 714
Troubleshooting HA Deployment......Page 719
Exam Preparation Tasks......Page 721
Tools for Final Preparation......Page 724
Suggested Plan for Final Review/Study......Page 727
Summary......Page 728
Appendix A: Answers to the “Do I Know This Already?” Quizzes......Page 730
Appendix B: 642-647 CCNP Security VPN Exam Updates, Version 1.0......Page 734
Appendix C: Memory Tables......Page 736
Appendix D: Memory Tables Answer Key......Page 768
C......Page 802
E......Page 803
P......Page 804
S......Page 805
X......Page 806
A......Page 807
C......Page 809
F......Page 813
H......Page 814
J-K......Page 815
N......Page 816
P......Page 817
S......Page 818
U......Page 819
W-X-Y-Z......Page 820