Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

Juniper MX Routing Engine Firewall Filter

I'm having difficulties with something I initially thought would be rather simple. I need to apply an outbound firewall filter on an MX10003's management interface. I'm currently using Lo0.0 as the ...
0
votes
1answer
30 views

Cisco IOS Sanitization: Any Way to Not Use NVRAM?

We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers ...
0
votes
0answers
14 views

AES Encryption/Router Configuration [closed]

I am not sure if this is the right place to ask this question, if it is not, let me know. I was looking for the AES encryption key used on my router for my WPA2-Personal connection. I looked at the ...
-1
votes
0answers
13 views

Is this web adress appears to be safe? [closed]

https://secure.letsendhardshiptoday.com/donate-yemen-fru-rt/?gclid=Cj0KCQjwmdzzBRC7ARIsANdqRRmWWUe4jNFJD62k4BTw84ko7iElen7ghMEg0O_RqIegwEG1XFG-RHsaAiuzEALw_wcB What is the meaning of word"secure" in ...
0
votes
2answers
36 views

Why doesn't NAT drop packets with spoofed public source IP?

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/, The following code: ip nat inside source list INSIDE pool OUTSIDE overload will translate packets with a ...
3
votes
0answers
38 views

Arp Protect in dynamic VLAN environment

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which ...
0
votes
2answers
150 views

Configuring a network for 100% isolation (for security)

I'm configuring a LAN for an office. It's a new setup, and therefore there are desktops but no servers and no PC-to-PC communications - everything is on the cloud. The exception to this are several ...
1
vote
2answers
42 views

The Best Way to Secure sFlow Exports?

Hi Network Masters, I have recently gotten my network devices to export sFlow records to my sFlow collector. Trouble is, all those sFlow exports are being sent across my network in cleartext. A lot ...
2
votes
1answer
166 views

What is the purpose of native VLAN on a trunk link?

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a ...
0
votes
0answers
45 views

Compatible peap+freeradius+openldap

On my new job I have inherited a service wpa2-enterprice with peap+freeradius+openldap. As NAS we use ArubaIAP with enabled function "eap-termination". And this bundle works well! Little deep: In ...
0
votes
1answer
20 views

Are Port Numbers Strictly Attached to the Protocol? [duplicate]

I was playing around with hosting a local webserver, and decided to host it on port 53 as an experiment. Turns out I was able to make an HTTP GET request to localhost:53 without any issues (using ...
1
vote
2answers
65 views

Different Wi-Fi security levels under same private subnet

I'm working on an assignment and I'm given a hypothetical scenario where: A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can ...
3
votes
1answer
76 views

Is TR-069 a security risk?

My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory ...
1
vote
1answer
128 views

Cisco ASA looping broadcast packet

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24 So i have found very interesting things in LAN ...
2
votes
3answers
228 views

What's the advantage of having VLANs if you enable inter-vlan routing?

If you configure VLANs with each having their own subnets, is there a point to have them if inter-vlan routing is enabled? Since VLANs will have access to other VLANs, the security argument is not ...
0
votes
1answer
64 views

What is the difference between VPN and Domain fronting?

What is Domain fronting? and how it is different from a VPN?
0
votes
1answer
21 views

Session, presentation and application layer

I almost finished the ccna, in the meantime I'm following Pentesting courses, I noticed enough interesting protocols at the session level. I wish I could understand them as I did with cisco, but I ...
0
votes
1answer
33 views

Is Network Bridging secure [closed]

Bridging two network cars in Windows allows the two separate networks to connect. Assuming there are three NIC cards present in a machine: A, B and C. If I bridge NIC A and B, is there a possibility ...
1
vote
1answer
72 views

How to implement port security in SDN using pox controller and ovs?

How can I defend against DHCP starvation attacks or MAC spoofing in an SDN environment?
0
votes
1answer
56 views

Multicast in enterprise network

Once I have heard from a professional that multicast is forbidden (or not suggested or not allowed) in enterprise networks from 2014. (He referenced to a standard or recommendation document or ...
1
vote
1answer
45 views

Is this computer a threat? On same network range, but in a workgroup

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server ...
2
votes
1answer
507 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
1answer
120 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
1
vote
1answer
58 views

SDN Flow-modification attack

What are the steps that can be taken to prevent flow-modification attacks on an SDN controller? The attack would look as follows(As seen by the image): Does OpenDaylight or any other controller have ...
1
vote
1answer
200 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
0
votes
1answer
66 views

How to change ip TTL=1 on flat network for security [closed]

Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of ...
4
votes
2answers
636 views

why do we use a layer 2 switch in a DMZ rather than a layer 3?

I've been trying to learn about DMZs. It's hard to find a technical explanation that does not dive head long into the complexities of Cisco hardware, which I'm finding confusing as I'm new to ...
-2
votes
1answer
256 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
1
vote
1answer
50 views

Why aren't we using digital signatures for the DHCP?

Why aren't we using digital signatures for the DHCP in order to stop Rouge DHCP attacks?
1
vote
1answer
51 views

Protect Cisco C3560CX switch from unauthorized access on remote location

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch. What are the best practices in this case/scenario? So, I will shut down password ...
3
votes
1answer
45 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
4
votes
1answer
397 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...
1
vote
1answer
50 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
3
votes
1answer
2k views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
1
vote
0answers
38 views

Dedicated Internet Router or VRF on L3? [closed]

I need to route public networks on our equipment. I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic. [ISP RTR]+---/30-Network-...
3
votes
1answer
434 views

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? ...
1
vote
1answer
43 views

Network Security Tunnel

In the Tunnel Interface, when I edit the tunnel information, it shows: Attributes Values Tunnel Source IF10 Tunnel Destination 1.0.0.1 Tunnel Mode GRE What does IF10 ...
2
votes
2answers
63 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
6
votes
1answer
958 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
0
votes
1answer
40 views

Fortinet configuration translation [closed]

We have a small case of security breach in one of our sites, we have a contractor that is suppose to stay out of our firewall Fortinet, today i noticed these two paragraphs that look fishy. My site ...
6
votes
3answers
969 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
7
votes
2answers
1k views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
3
votes
2answers
150 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
2
votes
2answers
73 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
0
votes
1answer
78 views

Why don't most routers automatically update their firmware? [closed]

Recently I realised that my new router's firmware was outdated. Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could ...
8
votes
3answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
1
vote
1answer
163 views

Cisco ASA access list on interface on which cryptomap is applied [closed]

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
0
votes
1answer
89 views

Trade Floor Network Design Feedback [closed]

I have an assignment that I am working on. Now I admit, I am far from knowledgeable and I have nowhere to turn to for help at the moment. I am not asking for someone to complete the assignment for me, ...
3
votes
2answers
199 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
1
vote
0answers
138 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...

1
2 3 4 5 6