CCNP Security : SECURE 課程 (可考取 Cisco IOS Security Specialist 認證)

合格保障：學員若考試不合格，本中心均會代付考試費，令學員可免費重考！詳情...

Cisco Systems Inc. 是全球最大的網路設備生產商，在世界各地設有 120 個以上的分支據點。Cisco 的產品包括 Switch (交換器)、LAN Router (區域網路由器)、WAN Router (廣域網路由器)、IOS (Internetwork Operating System) 網路管理操作系統、ASA (Adaptive Security Appliances)、IPS (Intrusion Prevention System) 等。全球的大企業、銀行、大學和政府機構之網路設備，無一不採用 Cisco 的產品，管理 Cisco 網路設備便成為一門專業的學問。

為了能證明你有專業水準來安裝、設定及管理 Cisco 的網路安全產品，Cisco 便推出其 CCNP Security (Cisco Certified Network Professional - Security，Cisco 認可網路安全專業人仕) 國際認可考試。要考取 CCNP Security 國際認可證書，必須通過以下 4 科的考試及持有有效的 CCNA Security 證書：

• CCNP Security: SECURE (Securing Networks with Cisco Routers and Switches) - 642-637
• CCNP Security: FIREWALL (Deploying Cisco ASA Firewall Solutions) - 642-617
• CCNP Security: VPN (Deploying Cisco ASA VPN Solutions) - 642-647
• CCNP Security: IPS (Implementing Cisco Intrusion Prevention System) - 642-627

此外，為了能證明你有專業水準來安裝、設定及管理 Cisco的 IOS 安全產品，Cisco 便推出其Cisco IOS Security Specialist (Cisco 認可IOS安全專業人仕) 國際認可考試。要考取 Cisco IOS Security Specialist 國際認可證書，只須通過以下的考試及持有有效的 CCNA Security 證書：

• CCNP Security: SECURE (Securing Networks with Cisco Routers and Switches) - 642-637

本課程只教授 CCNP Security: SECURE (Securing Networks with Cisco Routers and Switches) - 642-637

本中心的 CCNP Security: SECURE 課程由 Franco Tsang (擁有 CCIE : Security, CCIE : Service Provider 及 CCIE : Routing and Switching 三項 CCIE 證書) 籌備多時，精心編排。由上堂、溫習、實習、考試研習、做試題至最後考試，均為你度身訂造，作出有系統的編排。務求真正教識你，又令你考試及格。

本中心為 Cisco 指定的 CCNP Security: SECURE 考試試場，報考時請致電本中心，登記欲報考之科目考試編號、考試日期及時間 (最快可即日報考)。

臨考試前要繳付考試費 HK$1,565，及必須出示下列兩項有效之身份證明文件，否則考生不可進行考試，而已繳付之考試費亦不會退回：
1. 香港身份證 及
2. 附有考生姓名及簽名的證件 (如信用咭、香港特區護照、BNO等)

考試題目由澳洲考試中心傳送到你要應考的電腦，考試時以電腦作答。所有考試題目均為英文，而大多數的考試題目為單項選擇題 (意即 O) 或多項選擇題 (意即 口)，其餘則為配對題及實戰題。作答完成後會立即出現你的分數，結果即考即知！考試不合格便可重新報考，不限次數。欲知道作答時間、題目總數、合格分數等詳細考試資料，可瀏覽本中心網頁 "各科考試分數資料"。

為進一步加強本中心 Cisco 的課程質素，本中心投放大量資源購買 Cisco 器材，以供學員進行實習。以下是本中心擁有的 Cisco 器材 (種類繁多，未能盡錄)：

課堂由導師以講座形式教授課程理論及進行眾多的商業實習，而實習時段由學員親自進行商業實習。

SECURE:

1 Layer 2 (Ethernet) Security
1.1 Ethernet Frame Structure
1.2 Security in MAC Address Table
1.2.1 Understanding the current MAC Address Table status
1.3 Common Attacks in MAC Address Table
1.3.1 Preventing MAC Address Table Attack
1.3.2 實習: Basic Port Security
1.3.3 實習: Port Security with automatic errdisable recovery
1.4 VLAN Security
1.4.1 Basic VLAN Concept
1.4.2 Basic Trunk concept
1.4.3 DTP (Dynamic Trunking Protocol)
1.4.4 Trunking protocol
1.4.5 Tagging Attack - VLAN Hopping
1.4.6 802.1Q or ISL Tagging Attack or Information Gathering
1.4.7 Double-Encapsulated 802.1Q
1.5 DHCP Security issues
1.5.1 DHCP Process
1.5.2 Attacks Against DHCP
1.5.3 Countermeasure to DHCP Exhaustion Attack
1.5.4 實習: DHCP Snooping
1.5.5 DHCP Snooping Binding Table
1.5.6 Protecting ARP Infrastructure
1.5.7 Dynamic ARP Inspection (DAI)
1.5.8 實習: Dynamic ARP Inspection
1.5.9 IP Source Guard:
1.5.10 實習: IP Source Guard
1.6 Identity Management in Layer 2 environment
1.6.1 Basic Identity Concept - AAA
1.6.2 IEEE 802.1x
1.6.3 IEEE 802.1x architecture
1.6.4 實習: IEEE 802.1x
1.6.5 實習: Configure AAA for Telnet connection in Switch1
1.7 Security in Spanning Tree Protocol
1.7.1 Attack 1: Rouge Root Bridge
1.7.2 Attack 2: Rouge BPDU Message
1.7.3 Attack 3: BPDU DoS (Denial of Service)
1.8 HSRP Security
1.8.1 實習: Basic HSRP
1.8.2 實習: HSRP MD5 Authentication
1.9 VRRP Security:
1.9.1 實習: Basic VRRP:
1.9.2 實習: VRRP MD5 Authentication

2 IOS Advanced CBAC
2.1 Basic overview in IOS CBAC
2.2 Advanced topics in IOS CBAC
2.2.1 實習: Advanced CBAC

3 IOS Zone Based Firewall (ZFW)
3.1 Introduction of IOS Zone Based Firewall
3.2 Cisco Policy Language (CPL) Configuration
3.2.1 Define zones
3.2.2 Define zone-pairs
3.2.3 Define class-maps
3.2.4 Define policy-maps
3.2.5 實習: Basic ZFW Configuration
3.2.6 實習: Advanced ZFW Configuration

4 Authentication Proxy
4.1 Introduction of Authentication Proxy
4.2 Authentication Proxy Process
4.3 Configuration Procedure
4.4 實習: Authentication Proxy

5 IOS IPS
5.1 Introduction of IOS IPS
5.2 Configuration Procedure
5.3 實習: IOS IPS

6 IPSec (IP Security) VPN
6.1 Introduction to IPSec
6.2 IPSec Standard
6.3 Types of IPSec VPNs
6.3.1 Site-to-Site VPN
6.3.2 Tunnel Building Process for Site-to-Site IPSec VPN
6.3.3 Remote-Access VPN
6.3.4 Tunnel Building Process for Remote-Access IPSec VPN
6.4 Details concepts understanding of IKE Phase 1
6.4.1 Management Connection
6.4.2 Diffie-Hellman
6.4.3 Peer Authentication
6.4.4 Configuring IKE Phase1
6.4.5 實習: Configure IKE Policy
6.4.6 Configure IKE peer authentication
6.4.7 實習: Configure IKE Pre-Shared Key
6.4.8 實習: Configure IKE RSA Encryption Nounce
6.4.9 IOS Certificate Authority
6.4.10 實習: Configure IOS CA
6.4.11 實習: Configure Router1 to obtain certificate from IOS CA
6.4.12 Details concepts understanding of IKE Phase 2
6.4.13 Crypto Access List
6.4.14 Transform Set
6.4.15 Crypto Map
6.5 Site-to-Site (L2L) VPN
6.5.1 實習 : Site-to-Site (L2L) VPN
6.5.2 CACCTP (Crypto Access Check on Clear-Text Packet)
6.5.3 實習: CACCTP
6.5.4 實習: Site-to-Site (L2L) VPN with dynamic crypto map
6.5.5 Advanced Application of Dynamic Crypto Map – TED
6.5.6 實習: TED (Tunnel Endpoint Discovery)
6.5.7 IPSec in GRE Tunnel overview
6.5.8 實習: Basic GRE Tunnel
6.5.9 IPSec in GRE
6.5.10 實習: IPSec in GRE
6.5.11 VTI (Virtual Tunnel Interface)
6.5.12 實習: Site-to-Site IPSec VPN with VTI
6.5.13 More examples in Site-to-Site VPN
6.5.14 實習: Cert-Based IPSec Site-to-Site VPN
6.6 DMVPN (Dynamic Multipoint VPN)
6.6.1 Introduction to DMVPN
6.6.2 Technical Overview of DMVPN
6.6.3 實習: DMVPN (RIPv2 as routing protocol)
6.6.4 實習: DMVPN (OSPFv2 as routing protocol)
6.6.5 實習: DMVPN (EIGRP as routing protocol)
6.6.6 Redundancy design in DMVPN
6.6.7 實習: Dual-Hub DMVPN
6.7 GET (Group Encrypted Transport) VPN
6.7.1 GDOI (Group Domain of Interpretation)
6.7.2 Tunnel Header Preservation
6.7.3 Components in GET VPN
6.7.4 Group SA
6.7.5 Rekey Process
6.7.6 Basic Mutlicast Concepts
6.7.7 實習: Basic Multicast Concepts
6.7.8 Basic Multicast Routing Concepts
6.7.9 實習: Basic PIM-SM
6.7.10 Group Encrypted Transport (GET) VPN Configuration Procedures.
6.7.11 實習: GET VPN
6.7.12 More about rekey concepts
6.7.13 實習: Experiencing Re-Key Process.

7 Troubleshooting IPSec VPN Connection
7.1 IKE Phase 1 Troubleshooting
7.2 IKE Phase 2 Troubleshooting
7.3 Fragmentation Problems in IPSec VPN

8 Miscellaneous Topic: Flexible Packet Matching (FPM)
8.1 Background of today’s filtering challenges
8.2 FPM Configuration Procedures.
8.3 Protocol Header Description File (PHDF)
8.4 Example in FPM: Configuring FPM for MyDoom Packets
8.5 實習: FPM

9 Miscellenous Topic: Appliance Trust

10 Miscellaneous Topic: Private VLAN
10.1 Protected Switchport
10.1.1 實習: Protected Switchport
10.2 Private VLAN
10.2.1 實習: Private VLAN

11 Miscellaneous Topic: SNMPv3
11.1 實習: Basic SNMP
11.2 SNMPv3
11.2.1 實習: SNMPv3

12 Control Plane Security
12.1 實習: Input Control Plane Security
12.2 實習: Output Control Plane Security

13 Regular Expression
13.1 Regular Expression
13.1.1 實習: Filtering web traffic to franco.com
13.1.2 實習: Filtering BGP Routes by using regular expression.

14 Miscellaneous Topic: Policy-based Routing and NAT
14.1 Policy-based Routing
14.1.1 實習: Policy-based routing
14.2 Policy-based NAT
14.2.1 Basic NAT Review
14.2.2 實習: Basic NAT
14.2.3 Introduction of Policy-based NAT
14.2.4 實習: Policy-based NAT

15 Miscellaneous Topic: Transparent Zone Base Firewall
15.1 The problem we face
15.2 General but not allowed solution.
15.3 A brainstorm solution
15.4 Concept of Bridging
15.4.1 Introduction of Bridging
15.4.2 Operation in Basic Bridging
15.4.3 IRB Bridging
15.4.4 實習：Configure IRB Bridging
15.5 Zone Base Firewall under IRB bridging
15.5.1 實習: Transparent Zone Base Firewall

16 Miscellaneous Topic: Details of input traffic

17 Miscellaneous Topic: Details of output traffic