351-018 CCIE Security Written Certified Practice Exam (Beta)

Understanding ICMP for Network Troubleshooting

• PMTUD and ICMP: Learn which ICMP types and codes are crucial for Path MTU Discovery (PMTUD) and must never be dropped by your firewall. This ensures proper packet delivery.

  • ICMPv6 Type 1 Code 0 (No Route to Host): Indicates a destination is unreachable.
  • ICMPv6 Type 1 Code 1 (Communication Administratively Prohibited): Indicates communication is blocked by policy.
  • ICMPv6 Type 2 Code 0 (Packet Too Big): Signals the MTU is too small along the path.
  • ICMPv6 Type 3 Code 1 (Fragment Reassembly Time Exceeded): Indicates a fragment couldn't be reassembled within the allotted time.
  • ICMPv6 Type 128 Code 0 (Echo Request): Used for ping functionality.
  • ICMPv6 Type 129 Code 0 (Echo Reply): The response to an echo request (ping).

• Cisco IOS Router and TTL: How Cisco routers handle packets with a Time-To-Live (TTL) value of 1 or less. Understand the different ICMP responses generated.

  • Drop packet and reply with ICMP Type 3, Code 1 (Destination Unreachable, Host Unreachable).
  • Drop packet and reply with ICMP Type 11, Code 0 (Time Exceeded, Hop Count Exceeded).

Mobile IPv6 vs. Mobile IPv4: Key Differences

• Mobile IP Protocol Comparison: A detailed comparison of Mobile IPv6 and Mobile IPv4, covering essential aspects.

  • Foreign Agent: Mobile IPv6 doesn't require a foreign agent, unlike Mobile IPv4.
  • Route Optimization: Mobile IPv6 incorporates route optimization as a core feature, while IPv4 relies on extensions.
  • Address Discovery: Both use a directed broadcast approach for home agent address discovery.
  • Routing Header: Mobile IPv6 utilizes its own routing header; Mobile IPv4 relies on IP encapsulation.
  • Neighbor Discovery: Mobile IPv4 has adopted IPv6 Neighbor Discovery (ND).

• Key Differences (Choose Three):

  • Mobile IPv6 does not require a foreign agent, but Mobile IPv4 does.
  • Mobile IPv6 supports route optimization as a fundamental part of the protocol; IPv4 requires extensions.
  • Mobile IPv6 and Mobile IPv4 use a directed broadcast approach for home agent address discovery.

AES Encryption Algorithm: Security Fundamentals

• AES (Advanced Encryption Standard): A widely used symmetric block cipher for data encryption.
  • FIPS Approved: It's a FIPS-approved symmetric block cipher, ensuring its security standards.
  • Block Sizes: Supports block sizes of 128, 192, or 256 bits.
  • Key Sizes: Supports key sizes of 128, 192, or 256 bits.
  • Factoring Resistance: Based on the presumed difficulty of factoring large integers.

IKEv2 vs. IKEv1: Enhancing IPsec VPNs

• IKEv2 Advantages: Why IKEv2 is preferred over IKEv1 for remote-access IPsec VPNs.
  • EAP Authentication: Supports EAP authentication methods.
  • NAT Traversal: Inherently supports NAT traversal.
  • Random Message IDs: Uses random message IDs for enhanced security.
  • Faster Negotiation: The IKEv2 SA and IPsec SA can be established in six messages instead of nine.
  • Encryption Protection: All IKEv2 messages are encryption-protected.

MAC sec: Layer 2 Security

• MAC sec (Media Access Control Security): A security protocol defined under IEEE 802.1AE.
  • AES and 3DES Modes: Supports GCM modes of AES and 3DES.
  • Hop-by-Hop Encryption: Provides hop-by-hop encryption at Layer 2.
  • Frame Order: Expects a strict order of frames to prevent anti-replay attacks.
  • MKA: Uses MKA (Master Key Agreement) for session and encryption key management.
  • EAP PACs: Uses EAP PACs (EAP Privacy Assurance Configuration) to distribute encryption keys.

SSH Protocol: Secure