Chapter 3 of 4 · Cisco CCNP 300-410 ENARSI
Infrastructure Security
IOS AAA, ACLs and uRPF, control plane policing and IPv6 first hop security features.
- 4topics
- 20 minfast track
- 1diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Troubleshooting IOS AAATroubleshoot device login security with IOS AAA, comparing TACACS+, RADIUS and the local database, method lists, fallback…Diagram5 min
- 2Router Security with ACLs and uRPFTroubleshoot IPv4 standard, extended and time based ACLs, IPv6 traffic filters and unicast reverse path forwarding in strict and…5 min
- 3Control Plane PolicingTroubleshoot control plane policing on IOS XE: class maps, ACL matching rules, policing actions and how CoPP can block SSH, SNMP…5 min
- 4IPv6 First Hop SecurityDescribe IPv6 first hop security: RA guard, DHCPv6 guard, the binding table, ND inspection and snooping, and IPv6 source guard on…5 min
About this chapter
What this chapter covers
Infrastructure Security is about protecting the routers and switches themselves, and the traffic that flows through them.
The chapter covers four areas. Device access control with AAA, filters and spoofing checks on the router, protection of the control plane, and security features for IPv6 on the local link.
Three of the topics ask you to troubleshoot, so you should be able to read configuration and output and find the fault. The IPv6 first hop security topic asks you to describe the features.
How the topics fit together
The topics protect different places, from the login prompt to the first hop.
- AAA decides who may log in and what they may do.
- ACLs and uRPF filter packets, and drop spoofed sources, on router interfaces.
- CoPP limits what can reach the router's CPU, such as SSH, SNMP and routing protocols.
- IPv6 first hop security protects hosts from false router advertisements and spoofed addresses.
A common thread is the order of checks and the effect of a default action. An ACL has an implicit deny, an AAA list has fallback rules, and CoPP has a default class.
Several of these features can cut you off from the device. Keep a console session open while you test.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise the configurations in a lab, and break them on purpose. Remove a protocol from a CoPP class, or reject a user at the AAA server, and see how the device behaves and what the show commands say.
Ready for more practice?
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.