Cisco Secure Firewall Services Module (FWSM) Best practices for securing networks with FWSM Ray Blair, CCIEreg; No. 7050 Arvind Durai, CCIE No. 7016 The Firewall Services Module (FWSM) is a high-performance stateful-inspection firewall that integrates into the Ciscoreg; 6500 switch and 7600 router chassis. The FWSM monitors traffic flows using application inspection engines to provide a strong level of network security. The FWSM defines the security parameter and enables the enforcement of security policies through authentication, access control lists, and protocol inspection. The FWSM is a key component to anyone deploying network security. Cisco Secure Firewall Services Module (FWSM)covers all aspects of the FWSM. The book provides a detailed look at how the FWSM processes information, as well as installation advice, configuration details, recommendations for network integration, and reviews of operation and management. This book provides you with a single source that comprehensively answers how and why the FWSM functions as it does. This information enables you to successfully deploy the FWSM and gain the greatest functional benefit from your deployment. Practical examples throughout show you how other customers have successfully deployed the FWSM. By reading this book, you will learn how the FWSM functions, the differences between the FWSM and the ASA Security Appliance, how to implement and maintain the FWSM, the latest features of the FWSM, and how to configure common installations. Ray Blair, CCIEreg; No. 7050, is a consulting systems architect who has been with Cisco for more than 8 years, working primarily on security and large network designs. He has 20 years of experience in designing, implementing, and maintaining networks that have included nearly all networking technologies. Mr. Blair maintains three CCIE certifications in Routing and Switching, Security, and Service Provider. He is also a CNE and a CISSP. Arvind Durai, CCIE No. 7016, is an advanced services technical leader for Cisco. His primary responsibility has been in supporting major Cisco customers in the enterprise sector. One of his focuses has been on security, and he has authored several white papers and design guides in various technologies. Mr. Durai maintains two CCIE certifications, in Routing and Switching and Security. Understand modes of operation, security levels, and contexts for the FWSM Configure routing protocols and the host-chassis to support the FWSM Deploy ACLs and Authentication, Authorization, and Accounting (AAA) Apply class and policy maps Configure multiple FWSMs for failover support Configure application and protocol inspection Filter traffic using filter servers, ActiveX, and Java filtering functions Learn how IP multicast and the FWSM interact Increase performance with firewall load balancing Configure IPv6 and asymmetric routing Mitigate network attacks using shunning, anti-spoofing, connection limits, and timeouts Examine network design, management, and troubleshooting best practices This security book is part of the Cisco Pressreg; Networking Technology series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Ray Blair is a consulting systems architect and has been with Cisco Systems for more than eight years, working primarily on security and large network designs. He has 20 years of experience with designing, implementing, and maintaining networks that have included nearly all networking technologies. His first four years in the high-technology industry started with designing industrial computer systems for process monitoring. Mr. Blair maintains three Cisco Certified Internetwork Expert (CCIE) certifications in Routing and Switching, Security, and Service Provider. He also is a Certified Novell Engineer (CNE) and a Certified Information Systems Security Professional (CISSP).

 

Arvind Durai is an advanced services technical leader for Cisco Systems. His primary responsibility has been in supporting major Cisco customers in the Enterprise sector, some of which includes Financial, Manufacturing, E-commerce, State Government, and Health Care sectors. One of his focuses has been on security, and he has authored several white papers and design guides in various technologies. Mr. Durai maintains two Cisco Certified Internetwork Expert (CCIE) certifications in Routing and Switching and Security. Mr. Durai holds a Bachelor of Science degree in Electronics and Communication, a Master’s degree in Electrical Engineering (MS), and Master’s degree in Business Administration (MBA).

 

Cisco Secure Firewall Services Module (FWSM) Cisco Secure Firewall Services Module (FWSM) IntroductionFirewalls are one of the main components used in securing a network infrastructure, and having an in-depth understanding of how these devices function is paramount to maintaining a secure network.This book was written to provide an understanding of the functionality of the Firewall Services Module (FWSM), from both a hardware and software perspective and to be a practical design guide with configuration examples for the design, implementation, operation, and management of FWSM in various deployment scenarios. Who Should Read This Book?This book is targeted at individuals who would like an in-depth understanding of the FWSM. It is focused primarily for those who design, implement, or maintain the FWSM, such as security/network administrators. To get the most value from the material, the reader should have at least an intermediate knowledge of networking and security. How This Book Is OrganizedThis book is organized into five sections that cover the basic introduction of firewalls, initial and advanced configurations, design guides and configuration examples, and features and functionality introduced in FWSM version 4.x code:Chapter 1, "Types of Firewalls":This chapter explains the functionality of the different types of firewalls.Chapter 2, "Overview of the Firewall Services Module":This chapter covers specifications, installation information, performance, and virtualization; shows a comparison of IOS FW, ASA, and FWSM; and also explains the hardware and software architecture.Chapter 3, "Examining Modes of Operation":This chapter examines the modes of operation (transparent/routed) and explains the advantages of each.Chapter 4, "Understanding Security Levels":This chapter explains how traffic flows between interfaces, using both NAT and PAT and routed and transparent modes.Chapter 5, "Understanding Contexts":This chapter provides an overview of the benefits of contexts and how to manage them.Chapter 6, "Configuring and Securing the 6500/7600 Chassis":This chapter explains how to configure the host chassis to support the FWSM.Chapter 7, "Configuring the FWSM":This chapter covers the initial configuration of the FWSM.Chapter 8, "Access Control Lists":This chapter examines the use of ACLs.Chapter 9, "Configuring Routing Protocols":This chapter explains the use of routing protocols on the FWSM.Chapter 10, "AAA Overview":This chapter covers the principles of using authentication, authorization, and accounting.Chapter 11, "Modular Policy":This chapter covers the use of class and policy maps.Chapter 12, "Understanding Failover in FWSM":This chapter explains the use and configuration of using multiple FWSMs for high availability.Chapter 13, "Understanding Application Protocol Inspection":This chapter covers the use and configuration of application and protocol inspection.Chapter 14, "Filtering":This chapter examines how traffic can be filtered using filter servers and how Active X and Java filtering function.Chapter 15, "Managing and Monitoring the FWSM":This chapter covers the different options of managing and monitoring the FWSM.Chapter 16, "Multicast":This chapter explains the interaction of multicast with the FWSM and provides some practical examples.Chapter 17, "Asymmetric Routing":This