Chaprer 7 Firewalls

Cisco Secure Firewall

• This chapter covers topics like introduction to Cisco Secure Firewall, comparing network security solutions, deployment modes, high availability/clustering, access control, Cisco Secure Firewall intrusion policies, security intelligence updates, and keeping software up-to-date.
• It covers SCOR 350-701 exam objectives related to network security.
• There's a "Do I Know This Already?" quiz to assess student understanding before diving deeper.

Foundation Topics Section

• Covers introduction to Cisco Secure Firewalls, comparing network security solutions that provide firewall capabilities, deployment modes, high availability/clustering, access control, intrusion policies, malware defense, and keeping software up-to-date.

Key Topics

• Introduction to Cisco Secure Firewall: Cisco Secure Firewalls (formerly Cisco next-generation firewalls) provide comprehensive security, protecting against attacks throughout the attack continuum; they detect, block and defend against past attacks.

• Cisco Firewall History and Legacy: Cisco's firewall journey started with the Centri Firewall, followed by the popular PIX, and later the Cisco Adaptive Security Appliance (ASA) in the early 2000s. The term FirePOWER is used for the Cisco ASA FirePOWER Services module while Firepower (lowercase) refers to the FTD unified image and newer software.

• Cisco Secure Firewall: A security product that provides comprehensive protection against attacks.

• Cisco Secure Firewall Threat Defense (FTD): A unified software combining Cisco ASA features, legacy FirePOWER Services, and new features. It's deployable on various appliances (1000 Series, 2100 Series, etc.).

• Cisco Secure Firewall Deployments: Different models of Cisco Secure Firewalls (1000 Series, 2100 Series, etc.) are designed for specific use cases (small businesses, branch offices, large enterprises, etc.).

• Cisco Secure Firewall Cloud Native: Designed to seamlessly integrate security capabilities into a cloud-native form factor, leveraging Kubernetes orchestration.

• Cisco Secure Firewall ISA3000: This appliance is specifically for IoT/OT (Internet of Things/Operational Technology) infrastructure security. It secures industrial protocols and applications.

• Cisco Secure Firewall Threat Defense Virtual: A dynamic security solution designed for virtualized infrastructure.

• Security Information and Event Management (SIEM): A security solution that aggregates and analyzes security event data, providing real-time threat detection and incident response.

• Security Orchestration, Automation, and Response (SOAR): A solution automating and orchestrating security operations, using machine learning (ML) and AI for rapid response.

• eXtended Detection and Response (XDR): Unifies and correlates data across endpoints, networks and cloud environments, improving overall threat visibility and response times.

• Cisco SecureX: A comprehensive XDR solution unifying and correlating data across endpoints, networks, and cloud environments. It has a centralized console.

• Cisco Secure Firewall Deployment Modes: Includes routed (Layer 3) and transparent (Layer 2) modes for firewall deployment.

• Security Contexts: Enables a physical firewall to be partitioned into multiple standalone firewalls, each with its own configuration.

• Cisco Secure Firewall Deployment Modes: Describes Routed and Transparent modes, with different deployment considerations.

• Firewall Capabilities and Cisco Integrated Services Routers (ISRs): historically used to run Cisco Secure Firewall software.

• Cisco Secure Firewall Intrusion Prevention (NGIPS): A next-generation IPS that evolves beyond signature-based detection towards dynamic analysis and context-based decisions.

• Cisco Secure Firewall Threat Defense Virtual: Provides greater flexibility and agility for virtualized network security.

• Cisco Secure Firewall Cloud Native: A cloud-native implementation of the firewall using Kubernetes for scalable deployment and management.

• Cisco Secure Firewall ISA3000: A solution specializing in the security of industrial protocols and OT networks.

• Cisco Secure Firewall: Covers various aspects and features of Cisco secure firewall technologies.

• Comparing Network Security Solutions Discusses differences in features among various Cisco firewall products (e.g., ASA, FTD, ZBFW).

• Implementing Access Control: ACLs (access control lists), and different types of ACLs like standard, extended, and time-based ACLs are covered. Access control is essential for all traffic traversing the firewall.

  • Includes considerations for defining and applying ACLs.

• Cisco Secure Firewall Intrusion Policies: Provides overview of intrusion policies, how they work, and their capabilities.

• Security Intelligence, Security Updates, and Keeping Firepower Software Up-to-Date: Details on Keeping Firepower software up-to-date (includes Snort rules updates, vulnerability database updates, geolocation updates, proactive and reactive security analyses, and more). Details on Security Intelligence and how it aids in quickly blocking connections and improving performance.

• Cisco Secure Malware Defense: Covers Cisco's malware detection and defenses, including file reputation and sandboxing for analyzing potential threats.

• Exam Preparation Tasks: Offers guidance for exam preparation, with choices for exercises, a separate final preparation chapter, and online test prep resources.