Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
2answers
33 views

Cisco MAC ACL loop holes

I know this is not a new topic but need to clarify a couple things. I have a typical office with hosts connected to a Cisco 3560-X in same VLAN. My goal is to prevent unauthorised hosts ever accessing ...
0
votes
0answers
15 views

panic:integer divide fault Message Observed on SRX 5800 Routine Engine

We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
0
votes
1answer
34 views

Did a “network hub” actually send and receive all data to every node? [duplicate]

In the early 2000s, I went to a store and bought a Netgear "network hub" either exactly this one, or extremely close to it: https://upload.wikimedia.org/wikipedia/commons/d/d9/...
0
votes
2answers
42 views

Bridge mode or straight replacement?

Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
1
vote
1answer
158 views

How to find invalid sessions on Juniper SRX 5800 series Firewall

In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know ...
1
vote
1answer
30 views

Nature of TCP Timeouts

Are timeouts in TCPs inherently part of sequence numbers, or is it an entirely different component of a TCP packet? I understand that timeouts provide some level of reliabilty to a data stream, in ...
0
votes
2answers
31 views

Is connecting via 2 VPNs secure

I know there are VPN services like Speedify that you can connect to with 2 internet connections wired and wifi to combine them on their servers to get a faster connection and then connect to what you'...
0
votes
0answers
18 views

Dynamic CAK, how MSK is derived at supplicant end?

For MACsec, dynamic CAK scenario using EAP-TLS, MSK at Authenticator is derived from Authentication-server as part of MPPE-Send-Key and MPPE-Recv-Key, which are used to further derive CAK/CKN. I am ...
0
votes
1answer
39 views

Finding patch levels on networking equipment

Our management wants to know twice a week which of our networking equipment like our Cisco ASA firewalls, routers are missing patches for the vulnerabilities.They also would like a report when needed ...
3
votes
3answers
94 views

What does “terminating incoming connections” mean and what does it imply for network security?

During a recent conversation with a network security team, one of them said: "Look, if that server is terminating incoming connections, it must be in the DMZ." What does it mean to "...
0
votes
1answer
39 views

Can a random person flood my IP address with excessive amount of garbage packets?

After studying networking for some time, I just realize that the Layer 3 and Layer 2 don't care about the content of the packets they forward. All they care is the header, and further processing of ...
0
votes
1answer
38 views

Routing or forwarding unsolicited packets back to source - as a way to mitigate nuisance traffic?

I've identified a particular IPv4 /24 subnet that is responsible for a great deal of the unsolicited packets being rejected by my router (and making my log files larger than I'd like them to be). As ...
1
vote
0answers
23 views

What are the good hardware, software and equipment's suggestions to set up a wireless infrastructure? [closed]

I am working on providing wireless infrastructure suggestions to a client like what software, hardware and equipment will be required to a client in order for them to set up the wireless ...
0
votes
2answers
32 views

How to find the client's application port during communication [closed]

After reading firewall rules about inbound and outbount I have some questions and the most sources focus on the server's ports. What happens to the client side when is trying to make a connection to ...
0
votes
2answers
89 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
0
votes
2answers
76 views

Help segmenting/isolate my network with VLANs [closed]

I have a couple of IP cameras (live view and recording via an NVR) and DVR (with analogue cameras) connected by ethernet on my network. Nothing is separated atm; i.e. everything can access everything ...
0
votes
1answer
58 views

blacklisting mac address on my router to “isolate” IP cameras?

I currently have two very cheap Chinese IP Cameras. I just discovered they are vulnerable to attacks and as you can expect there are not patches by the provider. My final goal is to isolate them with ...
0
votes
2answers
38 views

Is it possible to completely mask an IP address to a point where no IP address can be detected yet an active connection is live?

I’ll keep it short and sweet; We all know to connect to internet you’ll need an address like 2001:x** or 192.x**. Using a vpn, while it does encrypt things and mask your IP, it still returns an IP. ...
1
vote
2answers
72 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
0
votes
1answer
283 views

Disable TLS v1.0 in Cisco ISR4321/K9

I would like to know the command on how I can disable the TLS v1.0 and v1.1 in the Cisco ISR4321/K9 and just retain TLS v1.2 ? John
0
votes
1answer
27 views

Why we use IP address in sockets? [closed]

When a server want to create a socket, it will use a combination of its IP address and some well-known port, let us say 80. So, when a segment arrived, both the server IP and port 80 will be used to ...
0
votes
1answer
24 views

Some questions about a DMZ and where to place my web servers? [duplicate]

Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question. I read a lot about networking last few ...
1
vote
3answers
2k views

Which is the best way to encrypt all the IP traffic in LAN?

I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices). I have ...
2
votes
1answer
330 views

Juniper SRX Application Inactivity Timeout

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Does it matter if the order ...
0
votes
1answer
35 views

Does CSMA/CA have anti-DoS measures, and if yes which?

So as far as i understand, you can deny other devices access to a WiFi by flooding the channel they are on with data, so that the channel is never "idle", thus preventing other devices from using it - ...
0
votes
1answer
426 views

Secure MPLS configuration: Does TCP port 646 (LDP) need to be generally exposed?

I am looking for expertise on MPLS configurations and security. A recent Nmap scan of my organization's public IPv4 perimeter networks has discovered a system which appears to be listening on TCP port ...
0
votes
1answer
134 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0
votes
0answers
122 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
0
votes
1answer
190 views

Cisco IOS Sanitization: Any Way to Not Use NVRAM?

We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers ...
0
votes
2answers
48 views

Why doesn't NAT drop packets with spoofed public source IP?

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/, The following code: ip nat inside source list INSIDE pool OUTSIDE overload will translate packets with a ...
3
votes
0answers
51 views

Arp Protect in dynamic VLAN environment

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which ...
0
votes
3answers
214 views

Configuring a network for 100% isolation (for security)

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several ...
1
vote
2answers
79 views

The Best Way to Secure sFlow Exports?

Hi Network Masters, I have recently gotten my network devices to export sFlow records to my sFlow collector. Trouble is, all those sFlow exports are being sent across my network in cleartext. A lot ...
2
votes
1answer
3k views

What is the purpose of native VLAN on a trunk link?

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a ...
0
votes
1answer
26 views

Are Port Numbers Strictly Attached to the Protocol? [duplicate]

I was playing around with hosting a local webserver, and decided to host it on port 53 as an experiment. Turns out I was able to make an HTTP GET request to localhost:53 without any issues (using ...
1
vote
2answers
73 views

Different Wi-Fi security levels under same private subnet

I'm working on an assignment and I'm given a hypothetical scenario where: A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can ...
3
votes
1answer
103 views

Is TR-069 a security risk?

My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory ...
1
vote
1answer
292 views

Cisco ASA looping broadcast packet

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24 So i have found very interesting things in LAN ...
3
votes
4answers
1k views

What's the advantage of having VLANs if you enable inter-vlan routing?

If you configure VLANs with each having their own subnets, is there a point to have them if inter-vlan routing is enabled? Since VLANs will have access to other VLANs, the security argument is not ...
0
votes
1answer
349 views

What is the difference between VPN and Domain fronting?

What is Domain fronting? and how it is different from a VPN?
0
votes
1answer
49 views

Session, presentation and application layer

I almost finished the ccna, in the meantime I'm following Pentesting courses, I noticed enough interesting protocols at the session level. I wish I could understand them as I did with cisco, but I ...
0
votes
1answer
77 views

Is Network Bridging secure [closed]

Bridging two network cars in Windows allows the two separate networks to connect. Assuming there are three NIC cards present in a machine: A, B and C. If I bridge NIC A and B, is there a possibility ...
1
vote
1answer
165 views

How to implement port security in SDN using pox controller and ovs?

How can I defend against DHCP starvation attacks or MAC spoofing in an SDN environment?
0
votes
1answer
100 views

Multicast in enterprise network

Once I have heard from a professional that multicast is forbidden (or not suggested or not allowed) in enterprise networks from 2014. (He referenced to a standard or recommendation document or ...
1
vote
1answer
73 views

Is this computer a threat? On same network range, but in a workgroup

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server ...
2
votes
1answer
2k views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
1answer
363 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
1
vote
1answer
65 views

SDN Flow-modification attack

What are the steps that can be taken to prevent flow-modification attacks on an SDN controller? The attack would look as follows(As seen by the image): Does OpenDaylight or any other controller have ...
1
vote
1answer
320 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
0
votes
1answer
143 views

How to change ip TTL=1 on flat network for security [closed]

Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of ...

1
2 3 4 5 6