Questions tagged [security]
A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.
305
questions
0
votes
1
answer
64
views
What's the difference between RED and VPN?
I know that RED is Remote Ethernet Device and VPN is Virtual Private Network.
But I think that they work as the same way.
Someone can help me?
- 53
0
votes
1
answer
74
views
VPLS over GRE over IPSEC
I need to connect to L2 networks over the internet, which means I'll need some form of security as well.
The first obvious idea is IPSec, but what I'm not sure whether I need GRE over IPSec or simply ...
- 13
0
votes
1
answer
48
views
DH groups support for isakmp policy
When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
- 57
0
votes
1
answer
48
views
enable https on Dell Networking N1548P
I am trying to enable https and disable http to make dell more secure. I am trying to generate self-sign certificate with these commands and having this error.
(config)#crypto certificate 1 generate
(...
- 145
0
votes
1
answer
23
views
Wifi air encription
I have a scenario where a Network Access Control (NAC) controlls the acces to a SSID (username and password), so the wifi controller doesnt have a password for it. Obviously the mobile devices ...
- 101
0
votes
1
answer
40
views
MAC Authentication using RADIUS with redundant links to hosts
I am considering using a RADUIS for MAC authentication. But the concern I have is that in my network each host has two links going to two switches (SW-A, SW-B) the link going to (SW-B) is a "...
- 5
0
votes
1
answer
58
views
Is the security of BGP using a pre-shared key dependent on the security of MD5?
The german wikipedia article to BGP states (translated):
In the basic configuration, a BGP-Router is susceptible to spoofig
attacks, through which the attacker can manipulate the routers. By using
an ...
- 103
0
votes
1
answer
142
views
Best Practices for Configuring Port Security on a Layer 2 Switch
How to configure port security on trunk and interfaces
I'm learning about port security and have a few questions. I have a layer 2 switch with interfaces f0/1-22 in access mode to access VLANs, ...
- 27
0
votes
2
answers
103
views
IPsec PFS Confusion
I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
- 1
1
vote
5
answers
99
views
Are there any methods of differentiate between a single computer and a NAT router?
As far as I know, a traffic from a NAT router should appear similar to traffic from one computer with a single IP address. If you do not have any access to a network (let's say you are an ISP), can ...
- 113
2
votes
4
answers
146
views
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
- 157
4
votes
4
answers
2k
views
Do I get any security benefits by NATing a network that's already behind a firewall?
I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
- 41
0
votes
2
answers
51
views
To Uplink and downlink devices in asa 5525-x
How to find the uplink and downlink devices which is connected to the ASA 5525-x. Is there any command for that?
- 1
1
vote
2
answers
56
views
WiFi password: What is the exposure? Is it only local or can WiFi password be used remotely somehow?
(As everyone does) I have a local WiFi password that is used for signing in and using the WiFi for local users.
I have a separate & far stronger (64 char) admin password to gain access to my WiFi ...
- 111
0
votes
1
answer
343
views
What are unusual ports?
I found the unusual ports at 2 places, maybe one has got the idea from the other without acknowledging it.
Hi,
I am trying to understand mismatch port application. I am reading the article:
https://...
- 105
1
vote
1
answer
270
views
802.1X needs 802.1AE more than 802.1, 802.3 does, true?
In some networks basics course the statement was made by lecturer 802.1AE was the extension developed and implemented due to shortages of 802.1X. No references were made, at this point, to the ...
- 23
0
votes
1
answer
90
views
How do I partition my on-premises network so one part can only access the external (internet)?
Currently, our setup is the following:
I need to make a change so there is no wireless access to our NAS. The Wifi "passthrough" needs to only be able to communicate with the external ...
- 101
0
votes
3
answers
168
views
Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]
I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
- 101
1
vote
4
answers
543
views
What is the difference between having a firewall inside vs outside the network?
I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.
The Question:
What would the use case scenario be for firewall outside vs. ...
- 131
0
votes
0
answers
87
views
IP pkt len in ESP transport mode? How to validate ESP pad length?
What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode?
For instance, in tunnel mode below are the values:-
Outer-IP header's Packet length = ...
- 1,124
0
votes
2
answers
298
views
IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?
Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
- 1,124
1
vote
1
answer
116
views
Explanation about SNMPv3 USM
Context
I am having trouble understanding the USM model in SNMPv3. I base my research and understanding on RFC 3414.
My problem is that authentication is not enforced in some implementations of SNMP, ...
- 121
0
votes
1
answer
43
views
OSPF Theory Question | Area Design
I know there are many assumptions to this question but:
Would it be possible to simultaneously configure all area x routers through something like SNMP for the purpose of merging with another area? If ...
- 41
0
votes
1
answer
44
views
OSPF Theory Question | Topology Changes | LSU Flooding
Could you create a script on an ospf router that enable/disables interfaces randomly, and faster than time neighbor routers update their LSDBs, making a network that's constantly flooded with LSU ...
- 41
0
votes
3
answers
669
views
What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel?
What is the difference between MPLS, MPLS VPN and IPsec VPN tunnel?
I know that MPLS is a type of WAN. and IPsec VPN tunnel is an encrypted connection (private) over the internet.
But what is MPLS VPN?...
- 1
-1
votes
1
answer
57
views
Holding session option in Fortiweb
I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
- 1
0
votes
1
answer
319
views
Does Loop Protect Protocol work with Port-Security?
I'm working for a company which wants to change its network equipment.
We are changing old aruba by aruba 6100. We are also changing network link, we remove network interconnection and we connect the ...
- 1
1
vote
2
answers
77
views
Do routers overwrite options of IP packets?
If i use IP options to send secret messages outside of the network using for example EIP, will the router replace them before sending out to the internet?
- 11
0
votes
2
answers
65
views
Cisco MAC ACL loop holes
I know this is not a new topic but need to clarify a couple things.
I have a typical office with hosts connected to a Cisco 3560-X in same VLAN.
My goal is to prevent unauthorised hosts ever accessing ...
0
votes
0
answers
31
views
panic:integer divide fault Message Observed on SRX 5800 Routine Engine
We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
- 1,110
0
votes
1
answer
195
views
Did a "network hub" actually send and receive all data to every node? [duplicate]
In the early 2000s, I went to a store and bought a Netgear "network hub" either exactly this one, or extremely close to it: https://upload.wikimedia.org/wikipedia/commons/d/d9/...
- 1
1
vote
2
answers
147
views
Bridge mode or straight replacement?
Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
- 175
1
vote
1
answer
1k
views
How to find invalid sessions on Juniper SRX 5800 series Firewall
In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know ...
- 1,110
1
vote
1
answer
44
views
Nature of TCP Timeouts
Are timeouts in TCPs inherently part of sequence numbers, or is it an entirely different component of a TCP packet?
I understand that timeouts provide some level of reliabilty to a data stream, in ...
0
votes
2
answers
40
views
Is connecting via 2 VPNs secure
I know there are VPN services like Speedify that you can connect to with 2 internet connections wired and wifi to combine them on their servers to get a faster connection and then connect to what you'...
- 101
0
votes
1
answer
48
views
Finding patch levels on networking equipment
Our management wants to know twice a week which of our networking equipment like our Cisco ASA firewalls, routers are missing patches for the vulnerabilities.They also would like a report when needed ...
2
votes
3
answers
661
views
What does "terminating incoming connections" mean and what does it imply for network security?
During a recent conversation with a network security team, one of them said: "Look, if that server is terminating incoming connections, it must be in the DMZ."
What does it mean to "...
- 23
0
votes
1
answer
79
views
Can a random person flood my IP address with excessive amount of garbage packets?
After studying networking for some time, I just realize that the Layer 3 and Layer 2 don't care about the content of the packets they forward. All they care is the header, and further processing of ...
- 413
0
votes
1
answer
96
views
Routing or forwarding unsolicited packets back to source - as a way to mitigate nuisance traffic?
I've identified a particular IPv4 /24 subnet that is responsible for a great deal of the unsolicited packets being rejected by my router (and making my log files larger than I'd like them to be). As ...
0
votes
2
answers
76
views
How to find the client's application port during communication [closed]
After reading firewall rules about inbound and outbount I have some questions and the most sources focus on the server's ports.
What happens to the client side when is trying to make a connection to ...
user23106
0
votes
2
answers
178
views
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
This question is about encryption in data communications, defined broadly to include:
Line scrambling at layer 1
MACsec at layer 2
IPsec at layer 3
TLS at layer 4
etc.
All of these encryption ...
- 339
0
votes
2
answers
160
views
Help segmenting/isolate my network with VLANs [closed]
I have a couple of IP cameras (live view and recording via an NVR) and DVR (with analogue cameras) connected by ethernet on my network.
Nothing is separated atm; i.e. everything can access everything ...
- 101
0
votes
1
answer
376
views
blacklisting mac address on my router to “isolate” IP cameras?
I currently have two very cheap Chinese IP Cameras. I just discovered they are vulnerable to attacks and as you can expect there are not patches by the provider.
My final goal is to isolate them with ...
- 101
0
votes
2
answers
50
views
Is it possible to completely mask an IP address to a point where no IP address can be detected yet an active connection is live?
I’ll keep it short and sweet;
We all know to connect to internet you’ll need an address like 2001:x** or 192.x**.
Using a vpn, while it does encrypt things and mask your IP, it still returns an IP.
...
1
vote
2
answers
111
views
IPSec Tunnel Mode
Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
- 13
0
votes
1
answer
3k
views
Disable TLS v1.0 in Cisco ISR4321/K9
I would like to know the command on how I can disable the TLS v1.0 and v1.1 in the Cisco ISR4321/K9 and just retain TLS v1.2 ?
John
- 1
0
votes
1
answer
162
views
Why we use IP address in sockets? [closed]
When a server want to create a socket, it will use a combination of its IP address and some well-known port, let us say 80.
So, when a segment arrived, both the server IP and port 80 will be used to ...
0
votes
1
answer
132
views
Some questions about a DMZ and where to place my web servers? [duplicate]
Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question.
I read a lot about networking last few ...
- 219
2
votes
3
answers
7k
views
Which is the best way to encrypt all the IP traffic in LAN?
I'm trying to encrypt all the IP traffic in a small LAN network but the in that network all kind of devices are connected i.e. PCs, Laptops, IP Cameras, IP Sensors, etc (new and old devices).
I have ...
- 21
2
votes
1
answer
1k
views
Juniper SRX Application Inactivity Timeout
Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Does it matter if the order ...
- 157