Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Home network, not secure ? Any help appreciated [closed]

Currently w/Verizon for their Gigabit connection spending $250 monthly on services and in 2 years. My bank account w/$5000 has been taken. Our iPhones calls have been setup w/out permission to ...
user avatar
0 votes
0 answers
6 views

Draytek Vigor2862 Strict Bind Allows unregistered MAC to connect via WIFI [closed]

I have a Draytek Vigor282 WIFI router which has Bind IP to MAC enabled. Also, the Strict Bind mode is enabled. I have a device that successfully connected to the WIFI SSID1 having added its MAC ...
user avatar
0 votes
3 answers
50 views

Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]

I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
user avatar
  • 101
1 vote
4 answers
69 views

What is the difference between having a firewall inside vs outside the network?

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow. The Question: What would the use case scenario be for firewall outside vs. ...
user avatar
0 votes
0 answers
36 views

IP pkt len in ESP transport mode? How to validate ESP pad length?

What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode? For instance, in tunnel mode below are the values:- Outer-IP header's Packet length = ...
user avatar
  • 1,095
0 votes
2 answers
30 views

IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?

Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
user avatar
  • 1,095
1 vote
1 answer
26 views

Explanation about SNMPv3 USM

Context I am having trouble understanding the USM model in SNMPv3. I base my research and understanding on RFC 3414. My problem is that authentication is not enforced in some implementations of SNMP, ...
user avatar
  • 121
0 votes
1 answer
34 views

OSPF Theory Question | Area Design

I know there are many assumptions to this question but: Would it be possible to simultaneously configure all area x routers through something like SNMP for the purpose of merging with another area? If ...
user avatar
  • 39
0 votes
1 answer
30 views

OSPF Theory Question | Topology Changes | LSU Flooding

Could you create a script on an ospf router that enable/disables interfaces randomly, and faster than time neighbor routers update their LSDBs, making a network that's constantly flooded with LSU ...
user avatar
  • 39
0 votes
3 answers
93 views

What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel?

What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel? I know that MPLS is a type of WAN. and IPsec VPN tunnel is an encrypted connection (private) over the internet. But what is MPLS VPN?...
user avatar
0 votes
0 answers
10 views

Deactivating / Activating Fabric Links on SRX5800 Series Firewall While Replacing SCB

Can someone please explain why it is mandatory to deactivate the fabric links (fab0/fab1) before replacing the SCB on SRX 5800 / SRX 5600 series Firewall. This is mentioned in the below Juniper ...
user avatar
  • 1,058
-1 votes
1 answer
43 views

Holding session option in Fortiweb

I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
user avatar
  • 1
0 votes
1 answer
126 views

Does Loop Protect Protocol work with Port-Security?

I'm working for a company which wants to change its network equipment. We are changing old aruba by aruba 6100. We are also changing network link, we remove network interconnection and we connect the ...
user avatar
1 vote
2 answers
43 views

Do routers overwrite options of IP packets?

If i use IP options to send secret messages outside of the network using for example EIP, will the router replace them before sending out to the internet?
user avatar
0 votes
2 answers
45 views

Cisco MAC ACL loop holes

I know this is not a new topic but need to clarify a couple things. I have a typical office with hosts connected to a Cisco 3560-X in same VLAN. My goal is to prevent unauthorised hosts ever accessing ...
user avatar
0 votes
0 answers
22 views

panic:integer divide fault Message Observed on SRX 5800 Routine Engine

We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
user avatar
  • 1,058
0 votes
1 answer
62 views

Did a "network hub" actually send and receive all data to every node? [duplicate]

In the early 2000s, I went to a store and bought a Netgear "network hub" either exactly this one, or extremely close to it: https://upload.wikimedia.org/wikipedia/commons/d/d9/...
user avatar
  • 1
1 vote
2 answers
100 views

Bridge mode or straight replacement?

Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
user avatar
  • 175
1 vote
1 answer
685 views

How to find invalid sessions on Juniper SRX 5800 series Firewall

In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know ...
user avatar
  • 1,058
1 vote
1 answer
39 views

Nature of TCP Timeouts

Are timeouts in TCPs inherently part of sequence numbers, or is it an entirely different component of a TCP packet? I understand that timeouts provide some level of reliabilty to a data stream, in ...
user avatar
0 votes
2 answers
36 views

Is connecting via 2 VPNs secure

I know there are VPN services like Speedify that you can connect to with 2 internet connections wired and wifi to combine them on their servers to get a faster connection and then connect to what you'...
user avatar
  • 101
0 votes
1 answer
42 views

Finding patch levels on networking equipment

Our management wants to know twice a week which of our networking equipment like our Cisco ASA firewalls, routers are missing patches for the vulnerabilities.They also would like a report when needed ...
user avatar
2 votes
3 answers
205 views

What does "terminating incoming connections" mean and what does it imply for network security?

During a recent conversation with a network security team, one of them said: "Look, if that server is terminating incoming connections, it must be in the DMZ." What does it mean to "...
user avatar
0 votes
1 answer
45 views

Can a random person flood my IP address with excessive amount of garbage packets?

After studying networking for some time, I just realize that the Layer 3 and Layer 2 don't care about the content of the packets they forward. All they care is the header, and further processing of ...
user avatar
  • 401
0 votes
1 answer
68 views

Routing or forwarding unsolicited packets back to source - as a way to mitigate nuisance traffic?

I've identified a particular IPv4 /24 subnet that is responsible for a great deal of the unsolicited packets being rejected by my router (and making my log files larger than I'd like them to be). As ...
user avatar
1 vote
0 answers
25 views

What are the good hardware, software and equipment's suggestions to set up a wireless infrastructure? [closed]

I am working on providing wireless infrastructure suggestions to a client like what software, hardware and equipment will be required to a client in order for them to set up the wireless ...
user avatar
0 votes
2 answers
40 views

How to find the client's application port during communication [closed]

After reading firewall rules about inbound and outbount I have some questions and the most sources focus on the server's ports. What happens to the client side when is trying to make a connection to ...
user avatar
0 votes
2 answers
135 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
user avatar
0 votes
2 answers
96 views

Help segmenting/isolate my network with VLANs [closed]

I have a couple of IP cameras (live view and recording via an NVR) and DVR (with analogue cameras) connected by ethernet on my network. Nothing is separated atm; i.e. everything can access everything ...
user avatar
  • 101
0 votes
1 answer
145 views

blacklisting mac address on my router to “isolate” IP cameras?

I currently have two very cheap Chinese IP Cameras. I just discovered they are vulnerable to attacks and as you can expect there are not patches by the provider. My final goal is to isolate them with ...
user avatar
  • 101
0 votes
2 answers
44 views

Is it possible to completely mask an IP address to a point where no IP address can be detected yet an active connection is live?

I’ll keep it short and sweet; We all know to connect to internet you’ll need an address like 2001:x** or 192.x**. Using a vpn, while it does encrypt things and mask your IP, it still returns an IP. ...
user avatar
1 vote
2 answers
87 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
user avatar
  • 13
0 votes
1 answer
1k views

Disable TLS v1.0 in Cisco ISR4321/K9

I would like to know the command on how I can disable the TLS v1.0 and v1.1 in the Cisco ISR4321/K9 and just retain TLS v1.2 ? John
user avatar
  • 1
0 votes
1 answer
50 views

Why we use IP address in sockets? [closed]

When a server want to create a socket, it will use a combination of its IP address and some well-known port, let us say 80. So, when a segment arrived, both the server IP and port 80 will be used to ...
user avatar
0 votes
1 answer
46 views

Some questions about a DMZ and where to place my web servers? [duplicate]

Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question. I read a lot about networking last few ...
user avatar
  • 199
1 vote
3 answers
4k views

Which is the best way to encrypt all the IP traffic in LAN?

I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices). I have ...
user avatar
2 votes
1 answer
604 views

Juniper SRX Application Inactivity Timeout

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Does it matter if the order ...
user avatar
  • 157
0 votes
1 answer
62 views

Does CSMA/CA have anti-DoS measures, and if yes which?

So as far as i understand, you can deny other devices access to a WiFi by flooding the channel they are on with data, so that the channel is never "idle", thus preventing other devices from using it - ...
user avatar
1 vote
1 answer
912 views

Secure MPLS configuration: Does TCP port 646 (LDP) need to be generally exposed?

I am looking for expertise on MPLS configurations and security. A recent Nmap scan of my organization's public IPv4 perimeter networks has discovered a system which appears to be listening on TCP port ...
user avatar
0 votes
1 answer
242 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
user avatar
0 votes
0 answers
238 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
user avatar
  • 157
0 votes
1 answer
280 views

Cisco IOS Sanitization: Any Way to Not Use NVRAM?

We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers ...
user avatar
0 votes
2 answers
66 views

Why doesn't NAT drop packets with spoofed public source IP?

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/, The following code: ip nat inside source list INSIDE pool OUTSIDE overload will translate packets with a ...
user avatar
3 votes
0 answers
56 views

Arp Protect in dynamic VLAN environment

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which ...
user avatar
0 votes
3 answers
240 views

Configuring a network for 100% isolation (for security)

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several ...
user avatar
1 vote
2 answers
107 views

The Best Way to Secure sFlow Exports?

Hi Network Masters, I have recently gotten my network devices to export sFlow records to my sFlow collector. Trouble is, all those sFlow exports are being sent across my network in cleartext. A lot ...
user avatar
  • 135
3 votes
1 answer
5k views

What is the purpose of native VLAN on a trunk link?

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a ...
user avatar
  • 401
0 votes
1 answer
31 views

Are Port Numbers Strictly Attached to the Protocol? [duplicate]

I was playing around with hosting a local webserver, and decided to host it on port 53 as an experiment. Turns out I was able to make an HTTP GET request to localhost:53 without any issues (using ...
user avatar
  • 115
1 vote
2 answers
79 views

Different Wi-Fi security levels under same private subnet

I'm working on an assignment and I'm given a hypothetical scenario where: A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can ...
user avatar
  • 125
3 votes
1 answer
139 views

Is TR-069 a security risk?

My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory ...
user avatar
  • 401

1
2 3 4 5 6