CCNA Sec 02

Fundamentals of VPN Technology and Cryptography

• VPN refers to a logical connection between the two devices.
• Cheaper than other WAN technologies.
• Types of VPNs encryption protocols.
• IPSec VPN.
• Implements security of IP packets at L3, and can be used for site-to-site VPNs and remote-access VPNs.
• SSL (Secure Sockets Layer) VPN.
• Implements security of TCP sessions over encrypted SSL tunnels.
• Can be used for remote-access VPNs (also used to securely visit a web server that supports it via HTTPS).
• MPLS (Multiprotocol Label Switching) VPN (MPLS L3VPN).
• Allows a company with two or more sites to have logical connectivity between the sites using the service
provider network for transport.
• No encryption by default.
• IPsec could be used on top of the MPLS VPN to add confidentiality (through encryption).
• Two Main Types of VPNs.
• Site-to-site VPNs.
• Two or more sites that they want to connect securely together (likely using the Internet).
• Remote-access VPNs.
• Users that build a VPN connection from their individual computer to the corporate headquarters.
• Can use IPsec or Secure Shell (SSL) technologies.

• Main Benefits of VPNs.

• Confidentiality.
• Only the intended parties can understand the data that is sent.
• The part that makes the message secret is the key or “secret” that is used to encrypt the data.
• Must be known by the sender and the receiver.
• Data integrity.
• Authentication with:
- Pre-shared keys used for authentication only
- Public and private key pairs used for authentication only
- User authentication (in combination with remote-access VPNs).
• Ciphers.
CCNA Sec Page 1
• Ciphers.
• A set of rules, which can also be called an algorithm, about how to perform encryption or decryption.
• Common methods that ciphers:
• Substitution.
• Substitutes one character for another.
• The exact method of substitution could be referred to as the key.
• If both parties involved in the VPN understand the key, they can both encrypt and decrypt data.
• Transposition.
• Uses many different options, including the rearrangement of letters.
• Ex. if we have the message “This is secret” we could write it out (top to bot-tom, left to right) as shown.

• Keys.
• Encryption Methods.
• Stream Ciphers (cipher digit stream).
• A symmetric key cipher, where each bit of plaintext data to be encrypted is done 1 bit at a time against the bits
of the key.
• Block Ciphers.
• A symmetric key cipher that operates on a group of bits called a block.
• May take a 64-bit block of plain text and generate a 64-bit block of cipher text.
• Examples:
- Advanced Encryption Standard (AES)
- Triple Digital Encryption Standard (3DES)
- Blowfish
- Digital Encryption Standard (DES)
- International Data Encryption Algorithm (IDEA)
• Block ciphers may add padding in cases where there is not enough data to encrypt.
• Key algorithms.
• Symmetric.
• Uses the same key to encrypt the data and decrypt the data.
• Examples:
- DES
- 3DES
- AES
- IDEA
- RC2, RC4, RC5, RC6
- Blowfish
• Used for most of the data that we protect in VPNs today.
• Much faster to use a symmetrical encryption algorithm.
• The more difficult the key, the more stronger encryption.
• The minimum symmetric key length should be at least 128 bits.
• Asymmetric.
• An example of an asymmetric algorithm is public key algorithms.
• We use two different keys (key pair) that mathematically work together as a pair.
• These keys are the public key and the private key.
• We use asymmetric algorithms for things such as authenticating a VPN peer or generating keying material that
we could use for our symmetrical algorithms.

CCNA Sec Page 2

•
we could use for our symmetrical algorithms.
• The public key is published and available to anyone who wants to use it.
• The private key is known only to the device that owns the public-private key pair.
• Examples of asymmetrical algorithms.
• RSA (Rivest, Shamir, and Adleman).
• The primary use of this asymmetrical algorithm today is for authentication.
• The key length may be from 512 to 2048 (Recommended 1024).
• DH (Diffie-Hellman).
• Allows devices to establish shared secret keys over an untrusted network.
• This key will be used with symmetric algorithms as 3DES, AES.
• ElGamal.
• Asymmetrical encryption system is based on the DH exchange.
• DSA (Digital Signature Algorithm).
• Was developed by the U.S. National Security Agency.
• ECC (Elliptic Curve Cryptography).
• OTP (one-time pad).
• A good example of a key that is only used once.
• To encrypt a 32-bit message, we use a 32-bit key, also called the pad , which is used one time only.
• Each bit from the pad is mathematically computed with a corresponding bit from our message, and the results
are our cipher text.
• The pad must also be known by the receiver if he wants to decrypt the message.
• Hashes.
• Hashing is a method used to verify data integrity.
• It is a one-way function.
• The result of the hash is a fixed-length small string of data called (digest or message digest or hash).
• The three most popular types of hashes:
- Message Digest 5 (MD5): This creates a 128-bit digest.
- Secure Hash Algorithm1 (SHA-1): This creates a 160-bit digest.
- Secure Hash Algorithm 2 (SHA-2): Options include a digest between 224 bits and 512 bits.
• Hashed Message Authentication Code (HMAC).
• It includes in its calculation a secret key.
• Digital Signatures.
• Prove that you are who you say you are.
• Keyspace.
• Refers to all the possible key values for a key.
• Next-Generation Encryption Protocols.
• Elliptic Curve Cryptography (ECC).
• Replaces RSA signatures with the ECDSA algorithm.
• Replaces the DH key exchange with ECDH.
• AES in the Galois/Counter Mode (GCM) of operation.
• ECC Digital Signature Algorithm.
• SHA-256, SHA-384, and SHA-512.
• IPSec.
• A collection of protocols and algorithms used to protect IP packets at Layer 3.
• Provides:
- Confidentiality through encryption.
- Data integrity through hashing and HMAC.
- Authentication using digital signatures or using a pre-shared key (PSK) that is similar to a password.
• Types of IPSec.
CCNA Sec Page 3
• Types of IPSec.
• Encapsulating Security Payload (ESP).
• Can do all the features of Ipsec.
• Authentication Header (AH).
• Can do many parts of the IPsec objectives, except encryption of the data.
-------------------------------------------------------------------------------------------------------------------
• Encryption algorithms for confidentiality: DES, 3DES, AES.
• Hashing algorithms for integrity: MD5, SHA.
• Authentication algorithms: Pre-shared keys (PSK), RSA digital signatures.
• Key management: for ex. Diffie-Hellman (DH), which can dynamically generate symmetrical keys.
• SSL.
• There is not an IPsec client or software currently running on everybody’s computer.
• Even if there were, not everyone has a certificate or a PSK for authentication.
• Every web browser on every computer supports SSL.
• Public Key Infrastructure (PKI).
• Key pair.
• A set of two keys that work in combination with each other as a team.
• The public key may be shared with everyone.
• The private key is not shared with anyone.
• CA (Certificate Authority).
• A computer or entity that creates and issues digital certificates. .
• Inside the certificate the ip and the FQDN and the public key for the issuer.
• In the final certificate is a URL that other devices can check to see whether this certificate has been revoked and
the validity date.
• Most web browsers maintain a list of the more common trusted public CA servers.
• Root certificate.
• Contains the public key of the CA server and the other details about the CA server.

• Identity certificate.
• Similar to a root certificate, but it describes the client and contains the public key of the client.

CCNA Sec Page 4

•

• X.500 and X.509v3 Certificates.

• X.500.
• A series of standards focused on directory services and how those directories are organized.
• Popular network operating systems have been based on X.500, including Microsoft Active Directory.
• The foundation from which you see common directory elements such as CN=Bob (Common Name = CN),
OU=engineering (organiza-tional unit = OU), O=cisco.com (organization = O), and so on
• X.509 Version 3.
• A standard for digital certificates.
• LDAP is a common protocol that is used to do lookups from a directory.
• Most digital certificates contain:
• Serial number.
• Assigned by the CA and used to uniquely identify the certificate.
• Subject.
• The person or entity that is being identified.
• Signature algorithm.
• The specific algorithm that was used for signing the digital certificate.
• Signature.
• The digital signature from the certificate authority.
• Issuer.
• The entity or CA that created and issued the digital certificate.
• Valid from.
• The date the certificate became valid
• Valid to.
• The expiration date of the certificate.
• Key usage.
• The functions for which the public key in the certificate may be used
• Public key.
• The public portion of the public and private key pair generated by the host whose certificate is issued.
• Thumbprint algorithm.
• The hash algorithm used for data integrity.

CCNA Sec Page 5

• The hash algorithm used for data integrity.
• Thumbprint.
• The actual hash.
• Certificate revocation list location.
• The URL that can be checked to see whether the serial number of any certificates issued by the CA have
been revoked
• Enrolling with the CA.
• Step 1: Trust the CA server.
• You cannot verify the signature on a certificate until you have the CA public key.
• You could download and install the root certificate.
• Step 2: Request your own identity certificate.
• This involves generating a public-private key pair and including the public key portion in any requests.
• The CA takes all of your information and generate an identity certificate, and sent it back yo you.
• PKCS (Public Key Cryptography Standards).
• A PKI standard that control the format and use of certificates, including requests to a CA for new certificates,
the format for a file that is going to be the new identity certificate, and the file format and usage access for
certificates.
• PKCS#10.
• A format of a certificate request sent to a CA that wants to receive its identity certificate.
• Includes the public key for the entity desiring a certificate.
• PKCS#7.
• A format that can be used by a CA as a response to a PKCS#10 request.
• The response itself will very likely be the identity certificate that had been previously requested.
• PKCS#1.
• RSA Cryptography Standard.
• PKCS#12.
• A format for storing both public and private keys using a symmetric password-based key to “unlock” the data
whenever the key needs to be used or accessed.
• PKCS#3.
• Diffie-Hellman key exchange.
• Simple Certificate Enrollment Protocol (SCEP).
• Automate most of the process for requesting and installing an identity certificate.
• It is not an open standard.
• Supported by most Cisco devices and allow it to get and install both root and identity certificates.
• Revoked Certificates.
• A certificate contains information on where an updated list of revoked certificates can be obtained.
• Peers check this URL to check the validity of the certificate.
• The revoked certificates are listed based on its serial number.
• The URL could point to the CA server itself or to some other publicly available resource on the Internet.
• Basic ways to check certificates validity:
• Certificate revocation list (CRL).
• A list of certificates, based on their serial numbers, that had initially been issued by a CA but have since been
revoked and as a result should not be trusted.
• Could be accessed by several protocols, including LDAP and HTTP.
• Could also be obtained via SCEP.
• Online Certificate Status Protocol (OCSP).
• Alternative to CRLs.
• Client simply sends a request to find the status of a certificate and gets a response without having to know the
complete list of revoked certificates.
CCNA Sec Page 6
•
complete list of revoked certificates.
• AAA.
• Cisco AAA services also provide support for validating digital certificates.
• Uses for Digital Certificates.
• Can be used for clients who want to authenticate a web server using HTTPS, SSL, TLS.
• SSL remote-access VPNs.
• With IPSec for authentication with certificate.
• Can also be used with protocols such as 802.1X
• PKI Topologies.
• Root CA.
• The first and the main CA server.
• Subordinate CAs
• Secondery for the root.
• The root CA delegates the authority (to the subordinate CAs) to create and assign identity certificates.
• The root CA signs the digital certificates of its subordinate or intermediate CAs, and the subordinate CAs are
the ones to issue certificates to clients.
• Cross-Certifying Cas.
• You could have a CA with a horizontal trust relationship over to a second CA so that clients of either CA could
trust the signatures of the other CA.

• ASA’s Certificate.
• ASA uses a self-signed digital certificate by default.
• ---------------------------------------------------------------------------------------------------------------
• Generating a New Key Pair.
• ASA(config)# crypto key generate rsa label asa-pair1 modulus 1024 noconfirm
• Authenticating and Enrolling with a New CA via SCEP.
• ASA1(config)# crypto ca trustpoint asa-point1
• ASA1(config-ca-trustpoint)# keypair asa-pair1
• Specify what the certificate may be used for.
• ASA1(config-ca-trustpoint)# id-usage ssl-ipsec
• Specify whether or not the fully qualified domain name (fqdn) will be required.
• ASA1(config-ca-trustpoint)# no fqdn
• Specify the x.500 common name (CN).
• ASA1(config-ca-trustpoint)# subject-name CN=site3
• Specify where the CA server can be reached. HTTP must be running on the CA server.
• ASA1(config-ca-trustpoint)# enrollment url http://30.0.0.8/certsrv/mscep/mscep.dll
• Specify the password from CA server.

CCNA Sec Page 7

• Specify the password from CA server.
• ASA1(config-ca-trustpoint)# password the-password
• Retrieve and install the root certificate. ("nointeractive" to not prompt the user for additional information).
• ASA1(config)# crypto ca authenticate asa-point1 nointeractive
• Request and install the identity certificate from the CA. The "noconfirm" will avoid prompting the user for
additional confirmation messages.
• ASA1(config)# crypto ca enroll asa-point1 noconfirm

• ASDM conf.
• To add a CA certificate.
• ASDM, Device Management, Certificate Management, CA Certificates, Add

CCNA Sec Page 8

• To view the ASA certificate.
• ASDM, Device Management, Certificate Management, Identity Certificates, Add, Add a New Identity Certificate

CCNA Sec Page 9

•

• Review Key PKI Components.

CCNA Sec Page 10

•

Fundamentals of IP Security
• IPSec.
• A Layer3 protocol provides confidentiality, data integrity, and authentication of the VPN.

• Internet Key Exchange (IKE) Protocol.

• Used to negotiate and establish secured site-to-site or remote access VPN tunnels.
• A framework provided by the Internet Security Association and Key Management Protocol (ISAKMP) and
parts of two other key management protocols, Oakley and Secure Key Exchange Mechanism (SKEME).
• IKE uses UDP, Port Number 500.
• IKE phases.
• IKE Phase1.
• IPsec peers negotiate and authenticate each other.
• IKE Phase 2.
• Peers negotiate keying materials and algorithms for the encryption of the data.
• IKE versions.
• IKEv1.
• Defined in RFC 2409, The Internet Key Exchange.
• IKE v2.
• Defined in RFC 4306, Internet Key Exchange (IKEv2) Protocol.
• Both IKEv1 and IKEv2 protocols operate in two phases.
• IKE_SA (IKEv2 phase1).
• Consisting of the message pair IKE_SA_INIT.
• IKE_SA_INIT is used to initiate the IKE negotiation.
• SA (security association) is the keying material used to encrypt packets over the VPN tunnel.

CCNA Sec Page 11

• SA (security association) is the keying material used to encrypt packets over the VPN tunnel.
• Its attributes are defined in the key exchange policy.
• CHILD_SA (IKEv2 phasev2)
• The first CHILD_SA (Phase 2 SA) is the IKE_AUTH message pair.
• Additional CHILD_SA message pairs can be sent for rekey and informational messages.
• Its attributes are defined in the data policy.
• IKEv1.
• IKE Phase 1 tunnel (once established) will not used to forward user packets, but rather only to protect
management traffic related to the VPN between the two routers.
• Ex. Packets such as a keepalive message to verify that the VPN tunnel is still working.
• Main mode.
• The Initiator proposes policies by sending one or more Security Association proposals.
• Uses 5 messages between the initiator and the responder to establish IKE SA.
• Most current VPN implementations default to using main mode.
• Aggressive mode.
• Uses only three messages to establish IKE SA.
• The first two messages in Aggressive mode exchange include almost everything required to form IKE SA.
• Quicker than Main Mode, but endpoint identities are exchanged in Clear-Text.
• Step1: Five basic items need to be agreed
• Hash algorithm: MD5 or SHA (Secure Hash Algorithm).
• Encryption algorithm: DES, 3DES, AES with various key lengths. (Longer is better for keys).
• Diffie-Hellman (DH) group: Group 1 uses 768 bits, group 2 uses 1024, and group 5 uses 1536.
More secure DH groups are part of the next-generation encryption (NGE):
Group 14 or 24: Provides 2048-bit
Groups 15 and 16: Support 3072-bit and 4096-bit
Group 19 or 20: Supports the 256-bit and 384-bit ECDH groups respectively
- The purpose of DH is to generate shared secret keying material (symmetric keys).
- It is important to note that the DH exchange itself is asymmetrical (and is CPU intensive).
• Authentication method: PSK or RSA signatures.
• Lifetime: How long until this IKE Phase 1 tunnel should be torn down.
The default is one day, listed in seconds.
This is the only parameter that does not have to exactly match with the other peer to be accepted.
A shorter lifetime is considered more secure.
• Step2: Run the DH Key Exchange.
• To have symmetrical keying material.
• Step 3: Authenticate the Peer.
• Peers authenticate each other by method they agreed upon.
• All IKE phase 2 negotiantions are secured by the phase 1 tunnel.
• IKE Phase 2 tunnel is called Quick mode.
• The IKE Phase 2 tunnel really creates two one-way tunnels: one from R1 to R2 and one from R2 to R1.
• We have one IKE Phase 1 bidirectional tunnel used for management between the two VPN peers and two IKE
Phase 2 unidirectional tunnels used for encrypting and decrypting end-user packets.
• These tunnels are often referred to as the security agreements or security associations between peers.
• Each SA is assigned a unique number for tracking.
• Crypto ACL.
• An ACL that has been created to identify which traffic should be encrypted.
• Not applied directly to any interface, but instead it is referenced by a policy called a crypto map.
• The crypto map is directly applied to an interface.
• Tunnel mode (the default).

CCNA Sec Page 12

• Tunnel mode (the default).
• Means that R1 will take any outbound packets matching the access list, encrypt them and then re-encapsulate
them inside of an IPsec packet, which is then forwarded to the peer (R2).
• On the other side of the VPN tunnel, it will need to be in tunnel mode to work.
• The IP header and the payload are encrypted.
• Transport mode.
• Used only when the transit traffic is directly from and to the endpoints of the VPN tunnel (such as R 1 and R2
talking amongst themselves).
• Only the packet payload is encrypted.
• CLI configurations.
• R1(config)# crypto isakmp policy 1
• R1(config-isakmp)# authentication pre-share
• R1(config-isakmp)# encr aes
• R1(config-isakmp)# hash sha
• R1(config-isakmp)# group 2
• R1(config-isakmp)# lifetime 3600
• R1(config)# crypto isakmp key cisco123 address 43.0.0.2
• Crypto ACL.
• R1(config)# access-list 100 permit ip 10.0.0.0 0.0.0.255 172.16.0.0 0.0.0.255
• R1(config)# crypto ipsec transform-set MY-SET esp-sha-hmac esp-aes
• R1(cfg-crypto-trans)# mode tunnel
• R1(config)# crypto map SDM_CMAP_1 1 ipsec-isakmp
• R1(config-crypto-map)# match address 100
• R1(config-crypto-map)# set transform-set MY-SET
• R1(config-crypto-map)# set peer 43.0.0.2
• R1(config)# interface GigabitEthernet1/0
• R1(config-if)# crypto map SDM_CMAP_1
• Configuring and Verifying Ipsec by CCP.
• Configure > Security > VPN > Site-to-Site VPN

CCNA Sec Page 13

CCNA Sec Page 14
CCNA Sec Page 15
CCNA Sec Page 16
•

CCNA Sec Page 17

• To mirror configurations to a remote peer by CCP.

CCNA Sec Page 18

•

• SPI (Security Parameter Index).

• A way of tracking a specific Security Association (SA) between router and a peer.
• Think of it as a serial number (unique) for each SA.
• PFS (Perfect Forward Secrecy).
• The ability for IKE Phase 2 to run the DH algorithm again, instead of using the keys generated during the DH
from IKE Phase 1.
• This feature is off by default for most platforms.
• The IPsec or IKE Phase 2 is really two tunnels:
• One for traffic from R1 to R2
• Another from R2 to R1.
• They have different SPIs, but together, these two unidirectional tunnels make up the "IPsec" tunnel.

CCNA Sec Page 19

 Implementing IPsec Site-to-Site VPNs

• IPsec framework protocols.

• AH (Authentication Header).
• IP protocol 51.
• Used when confidentiality is not required.
• Provides data authentication and integrity.
• ESP (Encapsulating Security Payload).
• IP protocol 50.
• Can provide confidentiality, integrity, and authentication.

CCNA Sec Page 20

• To authenticate with certificate.
• Implement NTP or conigure time manually.

• CA Server.
• CA# clock set 10:10:10 may 10 2016
• CA(config)# ntp master
• CA(config)# crypto key generate rsa general-keys exportable label pair1 modulus 1024
• So export that pair pair1 keys to that path and encrypt it with 3des, and protect with this password cisco
• CA(config)# ip http server
• CA(config)# crypto pki server internet
• CA(config-cs-server)# issuer-name CN=internet.test.local l=cairo c=egypt (location=cairo, country=egypt)
• CA(config-cs-server)# lifetime certificate 365 (1 year)
• CA(config-cs-server)# grant auto
• CA(config-cs-server)# no shutdown - then choose a password P@ssw0rd
• CA# show crypto pki server
----------------------------------------------------------------------------------
• CA Client.
• R1(config)# ntp server 1.1.1.2
• R1(config)# crypto key generate rsa modulus 1024 label pair1
• R1(config)# crypto pki trustpoint point1
• R1(config-trustpoint)# enrollment url http://1.1.1.2
• R1(config-trustpoint)# rsakeypair pair1
• R1(ca-trustpoint)# fqdn test.local [optional]
• R1(ca-trustpoint)# subject-name CN=Site1,o=test.local [optional]
• R1(ca-trustpoint)# password P@ssw0rd
• To request and install the ca certificate.
CCNA Sec Page 21
• To request and install the ca certificate.
• R(config)# crypto pki authenticate point1 , yes
• To request and install a certificate from that ca.
• R(config)# crypto pki enroll point1 , no , no , yes
• R# show crypto pki certificates
----------------------------------------------------------------------------------
• Configure the IKEv1 Phase 1 policy.

CCNA Sec Page 22

•

• Specify which outpound tra ffic to encrypt.

CCNA Sec Page 23

•
• CLI Implementation of the Crypto Policy.
• R(config)# crypto isakmp policy 1
• R(config-isakmp)# encr aes
• R(config-isakmp)# group 2
• R(config-isakmp)# authentication rsa-sig
• R(config-isakmp)# hash sha
• R(config-isakmp)# lifetime 3600
• R# show crypto isakmp policy
• R(config)# crypto ipsec transform-set MYSET esp-aes esp-sha-hmac
• R(config)# access-list 100 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.0.255
• R(config)# crypto map MYMAP 1 ipsec-isakmp
• R(config-crypto-map)# match address 100
• R(config-crypto-map)# set peer 209.165.201.1
• R(config-crypto-map)# set transform-set MYSET
• R(config-crypto-map)# set pfs group2
• R(config)# interface GigabitEthernet1/0
• R(config-if)# crypto map MYMAP
• Troubleshooting IPsec Site-to-Site VPNs in Cisco IOS.
• To verify the IKEv1 Phase 1 policy or policies in place.
• R# show crypto isakmp policy
• Verify cryptomaps and where they are applied.
• R# show crypto map
• Debug the IKEv1 Phase 1 process
• R# debug crypto isakmp
• Check to see if there is an IKEv1 Phase 1 tunnel already in place.
• R# show crypto isakmp sa
• To view Crypto Engine Connections.
• R# show crypto engine connections active
• Alternative site-to-site VPN technologies:
• Dynamic Multipoint VPN (DMVPN).
• A Cisco solution for deploying highly scalable IPsec site-to-site VPNs.
CCNA Sec Page 24
• A Cisco solution for deploying highly scalable IPsec site-to-site VPNs.
• Enables branch locations to communicate directly with each other over the Internet without requiring a
permanent VPN connection between sites.
• FlexVPN
• Can be deployed over either public Internet connections or a private MPLS VPN network.
• Designed for the concentration of both site-to-site and remote access VPNs.
• Implementing and Verifying an IPsec Site-to-Site VPN in Cisco ASA
• IKEv2 supported in Cisco ASA Software Version 8.4 and later.

• ASDM > Wizards > VPN Wizards > Site-to-Site VPN Wizard .

CCNA Sec Page 25

CCNA Sec Page 26
CCNA Sec Page 27
• Troubleshooting commands.
• ASA1# show isakmp stats
• ASA1# show crypto ipsec sa

CCNA Sec Page 28

• ASA1# show crypto ipsec sa
• ASA1# show isakmp sa detail
• ASA1# show vpn-sessiondb
• ASA1# debug crypto ikev1|ikev2
• ASA1# debug crypto ipsec
• ASA1# debug crypto ikev2
• ASA1# debug crypto ikev2

Implementing SSL VPNs Using Cisco ASA

• Clientless SSL VPN.

CCNA Sec Page 29

•

CCNA Sec Page 30

CCNA Sec Page 31
•

CCNA Sec Page 32

 -----------------------------------------------------------------------------------------------------------------------
• RAVPN AnyConnect Secure Mobility Client Connections.

CCNA Sec Page 33

CCNA Sec Page 34
CCNA Sec Page 35
CCNA Sec Page 36