CCNA Security: The Journey Begins... (Definitive Starting Guide)

Just yesterday I scheduled my CCNA Security exam. I felt this would be a good time to provide a starting tips for those who are not sure where to begin. In this post, I will address how to get to go about studying to get certified, talk about preparation materials, as well as lab setup choices.

Getting Started

Understanding what you will actually be tested on is an essential step for developing a study plan. First, I highly recommend familiarizing yourself with the official CCNA Security Syllabus, Exam Topics, and Exam FAQ. Take the time to figure out exactly what topics you may encounter on the exam. You should also take the time to familiarize yourself with Question Types and Exam Policies.

Now that you have a general understanding of what's covered, I will now cover different ways you can go about learning the material.

Option 1: Attend a Class or Bootcamp

Cisco offers top notch training through education partners. If you would like to learn using a structured curriculum this may be a viable option. Some of the advantages to this approach are:

• Access to world class Cisco Certified instructors
• Structured curriculum
• Pre-built labs to further hone your skills
• Exposure to concepts and ideas beyond just the certification
• Examinations
• Access to physical/virtual lab environments
• Lab environments based off real world scenarios

If this option interests you, I would advice using the Global Learning Locator to find a class near you. Out of pocket, these classes are typically pretty expensive. If you are currently employed or work for a Cisco Certified Partner, they may be willing to cover these costs for you. The cost for one of these classes can range anywhere from $3000-4000 USD. So check with your boss or your personal finances to determine whether this is a viable option.

Option 2: Attend a Cisco Networking Academy Course

Another option is to check out the actual Cisco Networking Academy program for the CCNA Security. Like Option 1, the CNA offers a structured curriculum for learning the concepts covered in the 640-554 exam. The CNA is on of the largest IT training academies worldwide with over 1,000,000 students, and 10,000 academies in over 100 countries. The offered CNA courses are available to both college and non-college students.

Use the Academy Locator to find an academy near you. As a NetAcad, student you will have access to:

• Structured curriculum developed through industry partnerships
• Pre-built labs to further hone your skills
• Packet Tracer simulation software (practice tool which simulates Cisco hardware)
• Cisco Certified instructors
• Online assessments and practice exams
• Chance to receive a certificate of completion and letter signed by John Chambers for completion of the program (first attempt grade 80% or above on final exam)
• Chance to receive a voucher (first attempt grade of 75% or above on final exam) which offers a substantial discount when you schedule your certification exam
• As a netacad student at the (CCNA level only) you are eligible to compete in the Cisco NetRiders Skills Challenge
• And many more benefits...

Some colleges and universities have also integrated the CNA as part of their degree programs. An additional benefit is that you could also receive college credit for attending the class. As a college undergrad, I attended both the CCNA Discovery, CCNA Exploration, and later the CCNP course as a grad student. My personal experience with the academy was very pleasant. The top notch curriculum through the CNA also made learning networking lots of fun. I cannot recommend the CNA enough.

If this option interests you, make sure to utilize the Academy Locator. The cost of this course is relative to the institution offering it. Make sure to ask this question when contacting an academy.

Option 3: Self Study

If you are highly self driven and motivated to learn, self studying is a great alternative (and cheaper) to a formal class. This is the route I opted for in my CCNA Sec studies. Ultimately, this path is more difficult to pursue. However, with a structured approach, you can master the 640-554 exam with relative ease.

Preparation Materials

Now I will talk about some free and also pay prep materials that will help you master the 640-554 exam. My personal recommendation is to combine both free materials as well as pay options for your studies.

    Free Options:

Cisco does offer some free prep materials for the IINS Exam. I would also recommend using youtube to your advantage. There are many video lessons freely available for your consumption. Also, consider joining a Study Group. CertCollection is also another great user community for studying a variety of IT exams. When having trouble understanding concepts, you would be surprised how a like minded community can help in explaining complex topics. Study groups and user forums are also a great source for GNS3 and Packet Tracer labs. Use these resources to your advantage.

    Pay Options:

Title: CCNA Security 640-554 Official Cert Guide and LiveLessons Bundle (Recommended)
Authors: Keith Barker, Scott Morris

The official cert guide is the definitive book I would recommend for those with prior exposure to information security. This book provides a concise and straight to the point discussion on all exam topics. It provides chapter quizzes as well as a companion disc with a practice test. Optionally, you can buy the premium upgrade (instructions provided in the book) which will give you access to additional practice exams. This book can be bought by itself or as a bundle with live lessons. I also highly recommend the live lessons which are from the author of the book as well.

Title: Implementing Cisco IOS Network Security (IINS 640-554) Foundation Learning Guide (2nd Edition) (Foundation Learning Guides) (Optional)
Authors: Catherine Paquet

The Foundation Learning Guide books contain the same material covered in the Cisco Networking Academy program mentioned above. This book is great for those that are newer to the Information Security industry. If you do not have a background in Information Assurance, Security Design, and/or Encryption algorithms, you should think about picking up a copy. Unlike the cert guide, the author spends more time covering these topics. I would even go so far as to say some chapters could even be used for a general security design class. If you have little or no background in IS I highly recommend this book.

Title: CBT Nuggets: CCNA Security (Optional)
Authors: Keith Barker

This video training series is authored by the same author of the cert guide book. Keith does a great job of breaking down the exam topics and combines real world experience with classroom instruction. Definitely consider this product if you prefer video lessons over text based publications.

Title: CCNA Portable Command Guide (Optional)
Authors: Bob Vachon

The portable command guide series of books are great for quickly covering a lot of material really quick. Aside from quick command lookups this book also contains all the concepts/material covered in the other books mentioned in a quick format. This is a great resource for the final days before your exam or as an aid for your lab work.

Title: CCNA Security Lab Manual Version 1.1 (2nd Edition) (Recommended)
Authors: Cisco Networking Academy

This is the same lab manual used by the Cisco Networking Academy. This book is highly recommended since it provides all the same labs offered to NetAcad students. Great for all your hands on practicing needs.

One final website I will recommend is Safari Books Online. If you can afford the yearly $400 subscription fee, you will have access to all Cisco press books as well as certification books for a variety of companies/products.

Practice Exams

As mentioned previously, the official cert guide comes with a practice exam. Optionally you can also upgrade to the premium and receive access to additional practice exams. It's no secret there are many exam dumps out there from companies like Pass4Sure, Lead2Pass. If you have a .vce reader there are also many websites out there which contain exam dumps as well. Exam Collection has a large databank of these .vce files. Just remember, if you use a dump, make sure you understand the concepts behind the question/answers and not just the answer itself. Securitytut is also a good resource for practice lab simulations (using packet tracer) and practice questions.

Also, as previously mentioned, join a study group and user forums. Users regularly post questions as well as practice lab simulations online.

Lab Equipment

Ideally real equipment is the way to go. According to the lab manual presented above you will need:

• 3 1841 routers
• 3 2950-T switches
• 1 ASA 5505
• 3 desktop machines

You may be asking why couldn't I just replace the 1841's with 2600 series routers? The short answer is you can but unfortunately the 2600 series doesn't support zone based firewall or IOS IPS which is covered in the 640-554 exam. The longer do's and dont's discussion about purchasing lab equipment can be found here. You should also make sure the equipment your buying comes with IOS version 12.4 with advanced IP services.

Another alternative is to virtualize your lab equipment using GNS3. GNS3 by itself is not enough to practice everything covered in the 640-554 exam (most notably Layer 2 security). For my personal lab setup, I took a hybrid approach which only cost $90. I bought two 2960-TT-L switches and borrowed a 2621XM. I then used USB Ethernet NIC's (make sure they support VLAN tagging) to connect my physical equipment to my GNS3 virtualized topology.

In another post, I wrote about how I accomplished this using individual NIC's. In a subsequent post, I plan on discussing in more detail how to set up a hybrid lab in more depth using both individual NIC's and a breakout switch design. GNS3 can also be used to emulate the ASA as well. However, in order to obtain image files required by GNS3, you will need to have access to a Cisco CCO account. I won't link to any sites here, but I will also say you can find GNS3 supported IOS and ASA image files elsewhere on the internet.

Just as an example, my physical and GNS3 lab topologies for the Chapter 9 lab from the lab manual are illustrated below:

 

 

 

For reference, here is the original topology:

This lab setup gives me the flexibility to complete all the labs in the lab manual (including Layer 2 security) all for $90 - $140. Additionally, another option is to completely virtualize your lab in GNS3 and use Cisco's Packet Tracer for practicing layer 2 hardening. As you can say there are a variety of ways to setup a practice lab. I recommend the hybrid approach for the budget conscious.

Study Plan

This study plan assumes you 1.5 - 2 months worth of preparation time. If you have less, I recommend first taking a practice exam, then focus on the areas you are weakest. If your not sure if you fully understand a certain topic, write it down and keep going. Develop a algorithm (checklist) for different configuration tasks. Example:

For configuring a radius server:

• Configure hostname
• Configure enable secret and enable service password-encryption
• Configure AAA
• AAA new-model
• Create AAA authentication list with group radius
• Configure a radius server host (change auth port, accounting port, and configure a key)

Forming checklists like these will get you into good habits and will burn the configuration steps into your brain. Also make a list of all the different ways you can secure the Control, Data, and Management plane and study that list.

Assuming you bought the Cert guide, make sure to read the Introduction. They provide an already laid out study plan that I think you will find useful. In the first week, research common attacks on the network infrastructure and read the first 3 chapters of the cert guide. If you bought the foundation learning guide as well, make sure to read Chapters 1 and 2 as well. In week 1, also go through the Intro lab to make sure you can access your routers via CCP. You will have to know CCP and ASDM in and out come exam day.

Dedicate subsequent weeks to each Part of either book (ex. week 1 is dedicated to Part 1 so on and so forth). Ask questions in study groups if you are still unclear about something. Here is the general study plan I developed for myself. As a rough timeline I recommend doing the following:

• Week 1: Read part 1 of CertGuide or Foundation book. Perform intro CCP lab from the lab manual as well as lab Chapter 1 Lab A. Research online common attacks on network infrastructure.
• Week 2: Proceed by reading part 2 of either book. Perform labs Chapter 2 Lab A, Chapter 3 Lab A.
• Week 3: Read part 3 of either book and do labs Chapter 4 Lab A, Chapter 5 Lab A, and Chapter 6 Lab A.
• Week 4: Early in the week start reading Part 4 and work on Chapter 7 Lab A. Later in the week work on the Chapter 8 labs.
• Week 5: Keep working on labs. If you marked down topics you didn't fully understand go back and read again. Finish the week off with Chapter 9 Lab A (Challenge lab). At this point you should have been exposed to most of the material in the book. If time permits during this week, take your first practice exam.
• Remaining weeks until exam: Take the same approach as week 5. Work on the remaining labs. Review concepts you are not sure about. Keep taking practice exams.

Welp, that's all for this post! If you would like to contribute studying tips, please do so in the comments. Take care!

Five Quirks I Noticed in GNS3 - A Begginers Guide

Greeting from Kailua Kona, Hawaii! I haven't used GNS3 in a few years. When I decided to use GNS3 as a study tool for my CCNA Security exam, I found some features didn't perform expected. In this post, I wanted to highlight some unexpected problems and lessons learned during my studies using GNS3.

1. Connecting anything other than a Dynamips device to a Cloud

The GNS3 cloud device is used to bridge a connect between your physical and virtual GNS3 equipment. The cloud can also be used for connecting to a remote GNS3 lab or even virtual machines using hypervisors other than VirtualBox. When designing my physical/virtual topology, one thing I  immediately noticed is that you could not directly connect a cloud to a qemu based device (Juniper Router, Cisco ASA, Cisco PIX, Cisco IDS) or a virtual box host to a NIO Ethernet cloud. In fact, doing so produces the following dynamips error message:

"Device does not support this type of NIO. Use an ETHSQ or hub to bridge the connection to the NIO instead."

This is a dynamips generated error message. My take is that dynamips is being used to bridge the connection between the physical NIC on the host machine to the qemu based device (which is essentially a virtual machine using the qemu wrapper). As a result, dynamips cannot detect the type of interface on the other end of the connection. This problem is mitigated by using an EtherSwitch or a GNS3 switch or hub device to bridge the connection between a non dynamips based device and a GNS3 cloud. I constructed the following connection guide to illustrate how this works.

 

 

  2. The Command "copy run start" is not Enough

 

Don't get me wrong, you should always issue this command to commit changes to the startup config. Omitting this important command in any lab simulation during the CCNA or CCNA Security will be a huge detriment to your overall score. However, expecting changes to the startup config to remain in GNS3 using the command "copy run start" will leave you sorely disappointed. I found this out after a half hour of aggravation.

 

Cisco routers and their file systems are emulated using Dynamips in GNS3. This is important to note because when a virtual dynamips router is powered down, in GNS3, the filesystem goes bye bye. As a result, issuing the command "copy run start" by itself will not allow any changes to remain on the next boot. To be certain configuration changes will persist, you must issue "copy run start" in the IOS command line and then navigate to the "File" dropdown menu of GNS3 and click either "Save project" or "Save project as...". Make sure to tick the following option when you save.

• Save nvrams and virtual hard drives

If these options are not enabled when saving a project then any changes made to the startup config will not persist during the next boot. When enabled and the project is saved, the startup configurations are exported and saved to local disk. These files are then imported by dynamips when the virtual router is powered back on. Just as a quick recap:

 

1.  Issue "copy run start"
2. Navigate to the "File" dropdown menu in GNS3 and click either "Save project" or "Save project as..."
1. Check the following options:
1. Save nvrams and virtual hard drives

This will save you the frustration of having to copy and paste your config back into the command line each time your virtual routers boot.

3. Cannot Modify the flash: Filesystem of dynamips (Cisco) Devices

This problem I ran into when trying to upload an IPS signature for Cisco IOS IPS. If you issue a "?" from privileged exec mode you will notice the command "mkdir" for creating a new directory is not present. The installation of an IPS signature file requires one to upload the sig file to a new directory in flash memory using tftp or by another file transfer protocol.

I tested this on the following devices:

2961
3745
7200

On the 2961 and 3745 the mkdir command is not initially supported. Trying to format the flash: filesystem produces the following error:

"%Error formatting flash: (No device available)"

In order to make changes to the flash file system, you must first issue an "erase flash:" to reinitialize flash: and then issue "format flash:" to reformat the file system. This is demonstrated below.

R1#erase flash:

Erasing the flash filesystem will remove all files! Continue? [confirm]

Current DOS File System flash card in flash: will be formatted into Low End File System flash card!  Continue? [confirm]

Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased

Erase of flash: complete

R1#format flash:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "flash:".  Continue? [confirm]
Current Low End File System flash card in flash: will be formatted into DOS File System flash card!  Continue? [confirm]
Primary Partition created...Size 16 MB
Drive communication & 1st Sector Write OK...
Writing Monlib sectors....
Monlib write complete
Format: All system sectors written. OK...
Format: Total sectors in formatted partition: 32736
Format: Total bytes in formatted partition: 16760832
Format: Operation completed successfully.
Format of flash: complete
R1#mkdir flash:ipsdir
Create directory filename [ipsdir]?
Created dir flash:/ipsdir
R1#sho flash:
-#- --length-- -----date/time------ path
1            0 Mar 01 2002 00:14:14 ipsdir
16564224 bytes available (2048 bytes used)

Oddly enough, the 7200 series router supports the "mkdir" command from the get go. However, trying to create a directory in flash: or view the flash card file system produces the following results:

R3#mkdir flash:ipsdir
Create directory filename [ipsdir]?
%Filesystem does not support mkdir operations
R3#sho flash:
Open device slot0 failed (Bad device info block)

This tells me that dynamips has a problem emulating the PCMIA card in the router and the flash: filesystem keeps corrupting itself. Trying to reformat the flash: file system also produces the following result:

R3#format flash:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "flash:".  Continue? [confirm]
Enter volume ID (up to 64 chars)[default slot0:]:
%Error formatting slot0: (Can not find flash algorithm)

Entering "erase ?" does not reveal an option for erasing flash: or slot0: which is also the PCMIA card (sometimes may also be disk0:). Ultimately, to fix the problem on the 7200 you have to issue "format disk0:".

The moral of the story is to always reinitialize the flash card and reformat the file system when creating a new router instance. Dynamips has problems emulating PCMIA flash card memory. Some potential workarounds are to try different IOS versions or a different series of router entirely. As a final note, I did not encounter this problem on ASA 8.4(2) which tells me this problem is specific to dynamips devices and not qemu based devices (ASA,PIX,IDS,Juniper).

4. Some IOS Commands Cause the Virtual Router Instance to Crash

In the end, there is no substitute for having access to a real rack of equipment. Emulation is never perfect, there will always be some feature that doesn't perform as expected. In my studies, I found that IOS resiliency features are not supported at all. Issuing a "secure boot-image" or "secure boot-config" causes dynamips to crash. As a result, you will have to restart your host machine for the virtual router instance to work again.

Another thing I learned is never to issue "reload" from the command line. Doing so causes dynamips to bug out and continually tries to start and close itself again. This results in a console window that will not respond because the device is continually trying to reboot itself. Always use the "Reload all devices" button or right click the virtual router and "Reload" (remember to copy run start and save the GNS3 project for configuration changes to persist). This problem was not present on the ASA.

5. Qemu Based Devices (Juniper, PIX, ASA, IDS) Take a Long Time to Boot

Another lesson learned is that devices virtualized under Qemu take a very long time to boot (7-8 minutes). If you install JunOS olives or Cisco IDS .iso to say something like VMware, the boot time is substantially reduced. Likewise, the same is true if you have access to a Virtual Adaptive Security Appliance image through a CCO account. Using VMware to virtualize some appliances yields a substantially less time to boot (1-2 minutes instead of 7-8). This is by no means is a deal breaker. If so, there are many guides out there that describe how to virtualize these devices in VMware. In a subsequent post, I will describe how to get JunOS and Cisco IDS up and running in GNS3 and possibly in VMware.

GNS3 For Fun and Profit!

As some of you already know I am practicing for the CCNA Security. I made this topology for my own reference but I thought I should share it with everyone. Another goal of mine is to demonstrate the power of GNS3. This is my approach to a hybrid physical/virtual lab environment in GNS3. In preparation for the CCNA Security exam, I am going through the lab manual that is part of the Cisco Network Academy Curriculum. For the Chapter 9 lab in particular, part of the requirements for this lab is to perform spanning-tree and port security which simply cannot be done (even with the EtherSwitch) in GNS3. GNS3 cannot emulate layer 2 switches due to the complexity of emulating an ASIC chip. However, GNS3 does support routers which you can install a switch line card for layer 2 features. Despite having support for a layer 2 switch line card, many layer 2 features are not supported, such as: port security, Multiple Spanning Tree, Rapid Spanning Tree, and STP enhancements and more. With this limitation in mind, I decided to buy a couple 2960 Catalyst switches and then connect them both to a physical router. I won't explain the wiring as you can just look at my GNS3 topology below.

 

Logically, this design functions in GNS3 per the specifications detailed in the original lab topology. For reference, here is the original topology from the lab manual:

There are multiple ways to setup a lab like this. One way is to connect each device  (like illustrated above) to a separate NIC (I actually bought some USB Ethernet NIC's for this purpose). Another method is to use a "breakout switch." With a breakout switch you connect each physical device to a different switch port and assign to a separate vlan. You can then trunk the connections to the NIC on your pc/server (provided the NIC installed supports 802.1q trunking).

An example of a breakout switch design can be found here. In a subsequent post, I might illustrate a hybrid topology with the "breakout switch" design.

I can also combine my physical equipment with virtualized appliances like a Cisco PIX, ASA, and/or IDS. GNS3 even supports Juniper virtualization. GNS3 also has direct integration into Virtual Box. You can also do some neat stuff in VMware using a design as my topology above. All in all, the possibilities with GNS3 are virtually (no pun intended) endless. It's really neat stuff.

My end goal is to make a CCIE hybrid/virtual topology. This is only a stepping stone. I am also going to create another topology using Juniper/Cisco equipment in a physical/virtual environment.

Let me know if you have any questions in the comments below.