Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

0
votes
0answers
13 views

Layer that the IP Security Protocol sits on? [on hold]

I was confused a bit on what layer would IP Security Protocol sit on? Would it be TCP/IP? Or am I totally off?
1
vote
2answers
26 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
7
votes
1answer
115 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
0
votes
1answer
33 views

Fortinet configuration translation

We have a small case of security breach in one of our sites, we have a contractor that is suppose to stay out of our firewall Fortinet, today i noticed these two paragraphs that look fishy. My site ...
5
votes
3answers
905 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
6
votes
2answers
460 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
2
votes
2answers
70 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
1
vote
2answers
48 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
0
votes
1answer
55 views

Why don't most routers automatically update their firmware? [closed]

Recently I realised that my new router's firmware was outdated. Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could ...
7
votes
3answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
1
vote
1answer
47 views

Cisco ASA access list on interface on which cryptomap is applied

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
0
votes
1answer
43 views

Trade Floor Network Design Feedback [closed]

I have an assignment that I am working on. Now I admit, I am far from knowledgeable and I have nowhere to turn to for help at the moment. I am not asking for someone to complete the assignment for me, ...
2
votes
2answers
57 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
1
vote
0answers
14 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...
1
vote
0answers
110 views

How are required Keys inside MACSec Key agreement protocol (MKA) generated?

I am trying to wrap my head around MACSec Key agreement protocol (MKA) and its relation with MACSec and other protocols. So bear with me. To my understanding in order to MACSec to work, all nodes ...
0
votes
1answer
27 views

Implications of ipv6 on LAN security [duplicate]

I'm not sure whether this is really the correct place to post this question, because it's not really about a "professional" setting. However, I have the standard setup with computers behind a netgear ...
3
votes
0answers
147 views

Hardening Cisco router on Internet-MANAGEMENT PLANE

I need confirmation that I understood the Cisco manual right. So my network is like this: ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1 ...
1
vote
1answer
54 views

Can scapy specify a source IP when used to simulate SYN / UDP flood attacks

I would like to test an IDS in a test network. I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
4
votes
1answer
129 views

Securing/Hardening Cisco router on Internet

In my company we have Cisco ASA firewall as edge device on the Internet. So outside interface with public IP address and security level 0 and inside interfaces with higher security levels. Standard ...
3
votes
1answer
145 views

How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
1
vote
1answer
23 views

Rogue Wireless Scanning

Is Rogue Wireless scanning required for a "wired" network? The organization does not have a wireless environment. I am just curious the reasons behind conducting the scan and what is the risk if the ...
3
votes
1answer
178 views

What is the difference between “Message Digest” and Checksum?

As far as I understand Message Digest is a certain Hash function that is derived from the original payload, so that even if a single bit changes the Message Digest proves to be different, thus ...
6
votes
3answers
319 views

Is UDP Usage in Routing Information Protocol (RIP) a Secure Practice?

I know that UDP is a connectionless transport layer protocol. Since it is easy to fake your source IP and source Port in your headers, what keeps anyone from poisoning routing tables via RIP? It seems ...
3
votes
1answer
79 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
1
vote
2answers
87 views

Should my internet gateway know about internal network/vlans?

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have ...
1
vote
1answer
72 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
1
vote
3answers
151 views

Use of /30 instead of /31

Besides wasting IP addresses. Is there any other compelling reason to use a /31 subnet over a /30 on Point to Point links? I am interested from a security perspective mainly. Would a /31 be more ...
0
votes
1answer
47 views

Is it possible for a spy to send 100 Peta Byte of secret data securely online? [closed]

Suppose a spy in an enemy country has got access to 100 or more Peta Byte of top secret data. He wants to pass on the data to his headquarters. But he also wants to make sure that at no cost the data ...
4
votes
1answer
125 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
1
vote
2answers
68 views

Separate a network within the enterprise environment

What will be the best solution, to securely separate a network and have internet connectivity. In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate ...
2
votes
1answer
139 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
1
vote
0answers
38 views

What are some options to replace a computer that is dual homed on 2 separate VLAN's? [closed]

One is a "secure" VLAN, the other is a "house" VLAN. At some point, a workflow was developed in which a decision was made that sales staff needed to take some of their materials received from clients ...
1
vote
1answer
42 views

Sensor to collector communication from SPAN, Inline or TAP

I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network. My ...
3
votes
1answer
66 views

Example VLAN without any Router — Security Problems?

I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually ...
3
votes
1answer
72 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
1
vote
1answer
98 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
1
vote
4answers
1k views

VLANS vs. subnets for network security and segmentation

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure ...
0
votes
1answer
53 views

D-link managed switch or Cisco managed switch? [closed]

Can anyone tell me the difference between D-link managed switch and cisco managed switch? And why we go for cisco managed switch.
1
vote
1answer
55 views

Unsecured devices and IPv6

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out. There are a lot of horror stories about ...
1
vote
3answers
83 views

How do protocols get blocked even over open ports?

This might be a stupid question, but I'm wondering how a network blocks a protocol like SSH even if the server is listening on port that isn't blocked, like 80. I've even tried port forwarding an non-...
1
vote
0answers
112 views

Monitoring interfaces on VyOS then SSH output to another machine (Security Onion) [closed]

I am trying to figure out the best way I can monitor interfaces on a VyOS interface from a Security Onion instance using Squil (Snort alerts etc). I am thinking SSH to VyOS to activate monitor ...
1
vote
1answer
144 views

Are brute force attack on public facing interface of internet router normal?

Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
4
votes
4answers
93 views

Terminals vs. Secure Access Servers?

I have come across some devices by a companay called "Lantronix" that produce 'Secure Access Servers'. The description makes it sound like they are physical devices that pretty much do what Terminal ...
2
votes
2answers
352 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
2answers
1k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
3
votes
2answers
261 views

Dynamic ARP Inspection - Does it check port in the binding database?

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis. If PCA (macA,...
0
votes
0answers
220 views

Default traffic policy for interfaces with “security-level 0”

I'm pretty new to Firewalls so this question might be a bit dumb but I need to know this ASAP and unfortunately I do not have an ASA at home to test with. f I have two interfaces on the ASA ...
2
votes
1answer
176 views

Switch-to-Switch Traffic Protection

I am currently working a project dealing with network security, and my question is that what is a feasible way to protect traffic on a switch-to-switch link in a LAN, not end-host-to-end-host ...
0
votes
2answers
87 views

How to block outside initiated traffic in NPTv6?

NPTv6 does prefix translation between one IPv6 address to another. Is there a way to prevent outside initiated traffic to inside (preferably in A10 AX devices)?
2
votes
1answer
241 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...