Book Review: SSL Remote Access VPNs
SSL Remote Access VPNs
Jazib Frahim, CCIE No. 5459
Qiang Huang, CCIE No. 4937
Right in the middle of a pretty big SSL VPN roll out here at my place of employment, Cisco Press released SSL Remote Access VPNs. They couldn’t have had better timing, as there was a good deal I was still confused about.
First, let me get this clear from the start: I hate ASDM. It has its uses, like monitoring. The traffic and VPN monitoring interfaces are wonderful. However, as far as configuration goes, the command-line is preferable. That being said, 95% of this book, including configuration, revolves around ASDM.
The first chapter explains remote access VPNs, which should be pretty familiar to anyone with IPSec VPN experience. Nothing new here, but certainly a good refresher and a good way to build context for the rest of the book.
The next couple chapters focus on SSL VPN technology, as well as SSL VPN design considerations. Definitely a nice review, considering SSL is certainly not a new technology, but building high encryption VPNs using SSL certainly is.
Chapter 4 is just an overview of ASA appliances and IOS routers and their SSL VPN capabilities. It’s only a few pages, so it’s not exactly deep reading, but useful nonetheless.
Next is a chapter on SSL VPN on the ASA. Probably the best part of the book, it mostly focuses on clientless SSL VPN. It has a (too short) section on configuring the AnyConnect client. This is the part that I personally found the most useful, which is why I was disappointed that it was so short. Also included are Dynamic Access Policies (DAP), and a couple of deployment scenarios.
The next chapter is on SSL VPN on IOS routers. I have to admit, I only skimmed this chapter, as it just wasn’t relevant to my deployment. But from what I could tell, it was just as thorough as the previous chapter, and possibly more so. It also included most of the SDM configuration in CLI form as well, and I have to wonder why the ASA chapter didn’t have more CLI in it as well.
Finally, there is a short chapter on SSL VPN management. This chapter basically just shows you some of the monitoring interface in ASDM. Sadly, nothing in the way of CLI, but that’s a pretty recurring theme in this book.
In conclusion, I would have to say this book is certainly worth picking up if you’re planning on doing an SSL VPN roll out any time soon. The only real issue I had with the book was what I’ve already mentioned a few times, and that is the lack of CLI. I realize Cisco is really pushing SDM and ASDM, but they need to understand that network engineers are -not- point and click kind of people. Leave that to the MCSEs!
Finally, I’d like to thank Jamie Adams from Cisco Press for sending me the book for review. I really appreciate everything she’s done for me!
- Chris
No commentsThe new Cisco Aironet 1140
After the success of the Aironet 1131AG, there was bound to be a new model following in its footsteps that would support the new 802.11n (draft) protocol. Cisco released the Aironet 1250AGN a while back, but it was obviously meant as a replacement for the Aironet 1230AG and/or 1240AG rugged indoor access points. Finally, they have released their upgrade model to the Aironet 1131AG access point, the Aironet 1140AGN!
No commentsCheating? Absolutely.
I was reading the comments today at the bottom of the article from my previous blog entry, and was astonished at one of the comments left:
Cheater? I don’t think so
Submitted by Abyss (not verified) on Fri, 06/06/2008 - 11:36am.
I found your article interesting, but I disagree with you on one part.
I don’t believe TestKing is really cheating. I’ve used them for my A+, Network+, and my recently passed (on first try!) CCNA. Of course, I didn’t just memorize all the answers, but when you look at the person that does, in the process of memorizing answers, they tend to really learn the material.
I found that using TestKing with CCNA helped me remember some of the harder things, which the test can tend to be (Knowing which protocols are for which purpose, for example), things like this TestKing helps out with amazingly.
Of course, the biggest part with CCNA is that TestKing can’t really pass you, even if you do memorize every question and not understand it (which I admit may be possible, in this case it IS cheating, and the person doesn’t deserve their certification), is the Simulations. No matter how much TestKing you do, you won’t be able to do the Simulations unless you understand what you are doing.
In summary: I don’t believe TestKing is as much a “cheater” resource as you do. I believe it can be used to “cheat” but the majority of users (in my experience) use it for a valuable study resource, and help with the tougher knowledge questions.
Good article though! I agree with your other methods of learning, and I’d add one extra thing: Cisco NetAcademy, if available to you, or the Cisco Self-Study Books (Published by Cisco Press), Those helped me the most!
This seriously blew my mind. It’s one thing to not care you’re cheating, but its a whole other thing to believe what you’re doing is alright. So I posted my reply:
Cheater? Absolutely.
Submitted by IPv6Freely (not verified) on Thu, 07/10/2008 - 11:20am.I think you’re mistaken. Using testking is absolutely cheating. What if - in highschool you stole a copy of your final exam, answers and all, from the teachers desk drawer, and used it to study… would that be cheating? I think anyone with common sense would say it is. This is absolutely no different.
Sure, somebody who cheats using Testking may not be able to do the sims, but you can certainly pass the CCNA without the sims. Theres usually only one or two of them. And they’re usually so incredibly basic, anyone who even skimmed through their CCNA book would be able to do them.
Testking is not a study resource. It is an actual copy of the actual exam, word for word, including diagrams. Whether you will admit it or not, you will retain the information you’re looking at - thereby cheating.
I also wanted to mention that by you cheating, my certification is less valuable. I think Testking and Pass4Sure and all of those other products (which are all owned by the same company) has tainted the certification, so many employers now look at the CCNA as being as worthless as the A+, or similar. CCNA is now simply a stepping stone towards certifications that employers will care about.
I worked my butt off to get where I am, and you cheating is basically a slap in the face - and I don’t appreciate it.
I think my reply says it all….
No commentsHow to Pass the CCNA…The Right Way.
Jeremy D. Cioara, CCIE No. 11727 weighs in on what he’s discovered regarding how to pass the CCNA, and why employers are going to have to screen their candidates even more thoroughly.
No commentsPricing the new Cisco Nexus 5000
- Consolidate the data center and protect investments in existing server, network, storage, and facilities assets
- Decrease the total cost of ownership by simplifying the data center infrastructure
- Increase business agility with easier, faster, and pervasive data center virtualization
- Enhance business resilience with greater operational continuity
- Use existing operational models and administrative domains for easy deployment
The following is the pricing breakdown:
Chassis Cisco Nexus 5020 Chassis - 40-port 10 GE 2RU switch with 5 Fan Modules and no power supplies (req SFP+) N5K-C5020P-BF $34,500 Power Supply and Fan Modules Nexus 5020 1200W AC Power Supply N5K-PAC-1200W(=) $1,500 Nexus 5020 Power Supply Blank N5K-P2-BLNK= $75 Nexus 5020 Fan Module N5K-C5020-FAN= $300 Expansion Modules N5000 6-port 10 Gigabit Ethernet Module (req SFP+) N5K-M1600(=) $5,400 N5000 Expansion Module Blank N5K-M1-BLNK= $75 Transceivers and Cables 10GBase SR SFP+ optic SFP-10G-SR(=) $1,795 10GBase Copper SFP+ (Twinax) cable 1 meter SFP-H10GB-CU1M(=) $150 10GBase Copper SFP+ (Twinax) cable 3 meter SFP-H10GB-CU3M(=) $210 10GBase Copper SFP+ (Twinax) cable 5 meter SFP-H10GB-CU5M(=) $260
More information can be found at: http://www.cisco.com/en/US/products/ps9670/index.html
No commentsThe Password Meter
Ever have to think up a strong password for a critical system, and wonder just how secure the password is? Well the guys over at www.passwordmeter.com have come up with a system that checks your password and scores it based on things like number of characters, number of consecutive upper/lower case characters, etc.
No word yet on whether they use AJAX or something to store these passwords, and the site isn’t SSL protected, so use at your own risk. Definitely a neat application, though.
No commentsWhy the CCNA has lost its value
The Cisco CCNA has lost a lot of its value in recent years, mostly due to exam cheating materials such as Testking and Pass4Sure which allow you to download actual copies of the certification exam (complete with solutions) to study from
These are quite common in India, and this page demonstrates this. Thanks for de-valuing my cert, you douchebags
Pass4Sure certified Pakistanis finally got what they deserved…
Pakistan removed from the Internet by ZDNet’s Richard Stiennon — 4:30 PM Eastern (US). The telecom company that carries most of Pakistan’s traffic, PCCW, has found it necessary to shut Pakistan off from the Internet while they filter out the malicious routes that a Pakistani ISP, PieNet, announced earlier today. Evidently PieNet took this step to enforce a decree from the Pakistani government that ISP’s […]
Why did I use the title I did? Well… if the idiots overseas didn’t feel it necessary to cheat on their certification exams using things like Testking and Pass4Sure, they might have known how to solve the issue at the source, rather then doing something stupid and drastic.
1 commentBring the Thunder!
Winelibrary TV, hosted by the one and only Gary Vaynerchuk, is running a contest this week, called the “Bring the Thunder” contest (which he has referred to on-camera as the “Spread the Thunder” contest…). I have decided to write a blog post about my experience with wine, which exists solely because of Gary V and his Thundershow.
This is the video explaining the contest, if you haven’t heard of it yet:
To re-cap what Gary said in the video, the prizes are:
- Grand Prize (1). The Grand Prize winner will receive a trip to co-host Wine Library TV with Gary Vaynerchuk, then a private dinner with Gary in New York City, and we’ll put you up at a hotel in New York.
- Runners-up (5). The 5 Runners-up will receive an AppleTV. Watch the Thunder Show in glorious high defintion!
- Sub-winners (25). 25 sub-runners-up will win an exclusive Wine Library TV Schwag pack, featuring the *NEW* limited edition Wine Library TV wristband and more!
So where do I begin? At the beginning, I suppose.
One day I was watching Diggnation, and Gary Vaynerchuk from Winelibrary TV was hanging out with Kevin and Alex. I thought “cool, they’re friends.” A few weeks later, Kevin and Alex mentioned WLTV on the show, so I decided to check it out. Everything changed at that moment. The first time I watched WLTV, I was hooked. Gary is exciting to watch, has a great personality, and really knows his stuff. I watched for a few months before I even bought my first bottle of wine. (Keep in mind that up until that point, I had only had one glass of wine in my entire life, and it was on a dinner date with an old friend. I had simply said “I’ll have what she’s having.”)
I asked Gary V what I should buy via both email and via his “Ask Gary” Facebook application. Gary suggested Ercavio Roble La Mancha 2005 as well as an Australian Shiraz. I hit up Winelibrary and bought the Ercavio Roble La Mancha, as well as a bottle of Little Penguin Shiraz and a bottle of Amaroo Shiraz. When the package arrived, I hit up Walmart to buy an inexpensive set of wine glasses and a corkscrew. Once I got home, I was absolutel
y blown away by the packing. The box was MUCH smaller then I had expected, with extremely efficient and safe packing materials used. The Styrofoam inserts were custom shaped for wine bottles!
Let’s just say the wine was not what I was expecting. I was expecting to taste the fruit that Gary always talked about with Australian Shiraz. I tasted… alcohol. Nothing at all but alcohol. I let the bottle of Little Penguin sit out with the cork out overnight, to let the alcohol dissipate a bit. The second day it was definitely better. I’ve heard Gary talk on the show about how with time and practice, you don’t even notice the alcohol anymore, so I figure I’ll just keep plugging away at it, trying different wines, until I really start to enjoy them.
I just wanted to give a big thank you to Gary V for turning me on to tasting wine, and giving me a little bit of entertainment every day!
Finally, I figured a list of what I have done to “Bring/Share the Thunder” was in order, so here it is:
- Obviously, this blog post.
- Talk about WLTV all the time with people at work.
- Showed my mom WLTV when I was back home over Christmas. She liked it enough to ask me to go bookmark the site on her laptop
- I’ve been wearing my WLTV wristbands while playing racquetball at least twice a week
- I’ve changed my email signature at work to include a link to WLTV
- Subscribed to the WLTV Feedburner Feed.
- Added a WLTV badge to my website
- Added a WLTV widget to my website
- And finally, I created a group on Facebook - “Help Chris win the ‘Bring the Thunder’ contest!”. I’ve invited all my friends, and as of this point have 28 members (Including Mr Vaynerchuk, and some people who probably joined after seeing Gary V join). I’m aiming for 100 at some point, even though that may not happen until the contest is over.
I would absolutely love to win the contest, but the second prize (an AppleTV) and the third prize (WLTV prize packs) are pretty damn awesome too!
Because you (us), with a little bit of me (Gary V), we’re changing the wine world - whether they like it, or not.
No commentsDon’t you love when somebody proves your point by arguing?
Check out the IRC conversation I had today. First the guy argues, and then he proves my point completely.
No comments

