Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
4 votes
4 answers
2k views

Do I get any security benefits by NATing a network that's already behind a firewall?

I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
0 votes
2 answers
41 views

To Uplink and downlink devices in asa 5525-x

How to find the uplink and downlink devices which is connected to the ASA 5525-x. Is there any command for that?
1 vote
2 answers
43 views

WiFi password: What is the exposure? Is it only local or can WiFi password be used remotely somehow?

(As everyone does) I have a local WiFi password that is used for signing in and using the WiFi for local users. I have a separate & far stronger (64 char) admin password to gain access to my WiFi ...
  • 111
0 votes
1 answer
47 views

What are unusual ports?

I found the unusual ports at 2 places, maybe one has got the idea from the other without acknowledging it. Hi, I am trying to understand mismatch port application. I am reading the article: https://...
1 vote
1 answer
86 views

802.1X needs 802.1AE more than 802.1, 802.3 does, true?

In some networks basics course the statement was made by lecturer 802.1AE was the extension developed and implemented due to shortages of 802.1X. No references were made, at this point, to the ...
0 votes
1 answer
32 views

How do I partition my on-premises network so one part can only access the external (internet)?

Currently, our setup is the following: I need to make a change so there is no wireless access to our NAS. The Wifi "passthrough" needs to only be able to communicate with the external ...
  • 101
0 votes
3 answers
61 views

Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]

I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
  • 101
1 vote
4 answers
172 views

What is the difference between having a firewall inside vs outside the network?

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow. The Question: What would the use case scenario be for firewall outside vs. ...
0 votes
0 answers
49 views

IP pkt len in ESP transport mode? How to validate ESP pad length?

What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode? For instance, in tunnel mode below are the values:- Outer-IP header's Packet length = ...
  • 1,095
0 votes
2 answers
71 views

IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?

Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
  • 1,095
1 vote
1 answer
48 views

Explanation about SNMPv3 USM

Context I am having trouble understanding the USM model in SNMPv3. I base my research and understanding on RFC 3414. My problem is that authentication is not enforced in some implementations of SNMP, ...
  • 121
0 votes
1 answer
36 views

OSPF Theory Question | Area Design

I know there are many assumptions to this question but: Would it be possible to simultaneously configure all area x routers through something like SNMP for the purpose of merging with another area? If ...
  • 41
0 votes
1 answer
38 views

OSPF Theory Question | Topology Changes | LSU Flooding

Could you create a script on an ospf router that enable/disables interfaces randomly, and faster than time neighbor routers update their LSDBs, making a network that's constantly flooded with LSU ...
  • 41
0 votes
3 answers
183 views

What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel?

What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel? I know that MPLS is a type of WAN. and IPsec VPN tunnel is an encrypted connection (private) over the internet. But what is MPLS VPN?...
-1 votes
1 answer
52 views

Holding session option in Fortiweb

I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
  • 1
0 votes
1 answer
210 views

Does Loop Protect Protocol work with Port-Security?

I'm working for a company which wants to change its network equipment. We are changing old aruba by aruba 6100. We are also changing network link, we remove network interconnection and we connect the ...
1 vote
2 answers
49 views

Do routers overwrite options of IP packets?

If i use IP options to send secret messages outside of the network using for example EIP, will the router replace them before sending out to the internet?
0 votes
2 answers
58 views

Cisco MAC ACL loop holes

I know this is not a new topic but need to clarify a couple things. I have a typical office with hosts connected to a Cisco 3560-X in same VLAN. My goal is to prevent unauthorised hosts ever accessing ...
0 votes
0 answers
26 views

panic:integer divide fault Message Observed on SRX 5800 Routine Engine

We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
  • 1,078
0 votes
1 answer
110 views

Did a "network hub" actually send and receive all data to every node? [duplicate]

In the early 2000s, I went to a store and bought a Netgear "network hub" either exactly this one, or extremely close to it: https://upload.wikimedia.org/wikipedia/commons/d/d9/...
  • 1
1 vote
2 answers
110 views

Bridge mode or straight replacement?

Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
  • 175
1 vote
1 answer
928 views

How to find invalid sessions on Juniper SRX 5800 series Firewall

In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know ...
  • 1,078
1 vote
1 answer
43 views

Nature of TCP Timeouts

Are timeouts in TCPs inherently part of sequence numbers, or is it an entirely different component of a TCP packet? I understand that timeouts provide some level of reliabilty to a data stream, in ...
0 votes
2 answers
38 views

Is connecting via 2 VPNs secure

I know there are VPN services like Speedify that you can connect to with 2 internet connections wired and wifi to combine them on their servers to get a faster connection and then connect to what you'...
  • 101
0 votes
1 answer
46 views

Finding patch levels on networking equipment

Our management wants to know twice a week which of our networking equipment like our Cisco ASA firewalls, routers are missing patches for the vulnerabilities.They also would like a report when needed ...
2 votes
3 answers
322 views

What does "terminating incoming connections" mean and what does it imply for network security?

During a recent conversation with a network security team, one of them said: "Look, if that server is terminating incoming connections, it must be in the DMZ." What does it mean to "...
0 votes
1 answer
57 views

Can a random person flood my IP address with excessive amount of garbage packets?

After studying networking for some time, I just realize that the Layer 3 and Layer 2 don't care about the content of the packets they forward. All they care is the header, and further processing of ...
  • 401
0 votes
1 answer
75 views

Routing or forwarding unsolicited packets back to source - as a way to mitigate nuisance traffic?

I've identified a particular IPv4 /24 subnet that is responsible for a great deal of the unsolicited packets being rejected by my router (and making my log files larger than I'd like them to be). As ...
1 vote
0 answers
25 views

What are the good hardware, software and equipment's suggestions to set up a wireless infrastructure? [closed]

I am working on providing wireless infrastructure suggestions to a client like what software, hardware and equipment will be required to a client in order for them to set up the wireless ...
0 votes
2 answers
45 views

How to find the client's application port during communication [closed]

After reading firewall rules about inbound and outbount I have some questions and the most sources focus on the server's ports. What happens to the client side when is trying to make a connection to ...
user avatar
0 votes
2 answers
152 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
0 votes
2 answers
117 views

Help segmenting/isolate my network with VLANs [closed]

I have a couple of IP cameras (live view and recording via an NVR) and DVR (with analogue cameras) connected by ethernet on my network. Nothing is separated atm; i.e. everything can access everything ...
  • 101
0 votes
1 answer
193 views

blacklisting mac address on my router to “isolate” IP cameras?

I currently have two very cheap Chinese IP Cameras. I just discovered they are vulnerable to attacks and as you can expect there are not patches by the provider. My final goal is to isolate them with ...
  • 101
0 votes
2 answers
48 views

Is it possible to completely mask an IP address to a point where no IP address can be detected yet an active connection is live?

I’ll keep it short and sweet; We all know to connect to internet you’ll need an address like 2001:x** or 192.x**. Using a vpn, while it does encrypt things and mask your IP, it still returns an IP. ...
1 vote
2 answers
96 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
  • 13
0 votes
1 answer
2k views

Disable TLS v1.0 in Cisco ISR4321/K9

I would like to know the command on how I can disable the TLS v1.0 and v1.1 in the Cisco ISR4321/K9 and just retain TLS v1.2 ? John
  • 1
0 votes
1 answer
87 views

Why we use IP address in sockets? [closed]

When a server want to create a socket, it will use a combination of its IP address and some well-known port, let us say 80. So, when a segment arrived, both the server IP and port 80 will be used to ...
0 votes
1 answer
81 views

Some questions about a DMZ and where to place my web servers? [duplicate]

Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question. I read a lot about networking last few ...
  • 219
2 votes
3 answers
5k views

Which is the best way to encrypt all the IP traffic in LAN?

I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices). I have ...
2 votes
1 answer
794 views

Juniper SRX Application Inactivity Timeout

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Does it matter if the order ...
  • 157
0 votes
1 answer
68 views

Does CSMA/CA have anti-DoS measures, and if yes which?

So as far as i understand, you can deny other devices access to a WiFi by flooding the channel they are on with data, so that the channel is never "idle", thus preventing other devices from using it - ...
1 vote
1 answer
1k views

Secure MPLS configuration: Does TCP port 646 (LDP) need to be generally exposed?

I am looking for expertise on MPLS configurations and security. A recent Nmap scan of my organization's public IPv4 perimeter networks has discovered a system which appears to be listening on TCP port ...
0 votes
1 answer
285 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0 votes
0 answers
287 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
  • 157
0 votes
1 answer
319 views

Cisco IOS Sanitization: Any Way to Not Use NVRAM?

We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers ...
0 votes
2 answers
78 views

Why doesn't NAT drop packets with spoofed public source IP?

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/, The following code: ip nat inside source list INSIDE pool OUTSIDE overload will translate packets with a ...
3 votes
0 answers
58 views

Arp Protect in dynamic VLAN environment

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which ...
0 votes
3 answers
275 views

Configuring a network for 100% isolation (for security)

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several ...
1 vote
2 answers
123 views

The Best Way to Secure sFlow Exports?

Hi Network Masters, I have recently gotten my network devices to export sFlow records to my sFlow collector. Trouble is, all those sFlow exports are being sent across my network in cleartext. A lot ...
  • 135
3 votes
1 answer
5k views

What is the purpose of native VLAN on a trunk link?

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a ...
  • 401

1
2 3 4 5 6