Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

1
vote
1answer
38 views

Is this computer a threat? On same network range, but in a workgroup

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server ...
1
vote
1answer
45 views

SDN Flow-modification attack

What are the steps that can be taken to prevent flow-modification attacks on an SDN controller? The attack would look as follows(As seen by the image): Does OpenDaylight or any other controller have ...
0
votes
1answer
50 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
2
votes
1answer
49 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
0
votes
1answer
45 views

How to change ip TTL=1 on flat network for security [closed]

Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of ...
3
votes
2answers
86 views

why do we use a layer 2 switch in a DMZ rather than a layer 3?

I've been trying to learn about DMZs. It's hard to find a technical explanation that does not dive head long into the complexities of Cisco hardware, which I'm finding confusing as I'm new to ...
-2
votes
1answer
49 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
0
votes
1answer
41 views

Why aren't we using digital signatures for the DHCP?

Why aren't we using digital signatures for the DHCP in order to stop Rouge DHCP attacks?
1
vote
1answer
44 views

Protect Cisco C3560CX switch from unauthorized access on remote location

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch. What are the best practices in this case/scenario? So, I will shut down password ...
2
votes
1answer
39 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
4
votes
1answer
264 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...
3
votes
1answer
296 views

Must a broadcast request come from the same network?

I was reading about Smurf Attacks and how Smurf Amplifier Registry keeps track of servers used for amplifying the attack, then I wondered, can a request coming from anywhere broadcast it to all parts ...
1
vote
3answers
1k views

BGP community blackhole

We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic. ISP said use 64682:0 community for RTBH, I did ...
4
votes
1answer
692 views

IPv6 BGP peering via link-local addresses

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border ...
4
votes
5answers
869 views

Are there any security advantages to activating VLAN tagging?

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?
3
votes
3answers
514 views

What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms. Let's say ...
7
votes
3answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
1
vote
2answers
55 views

Unidirectional Subnet Communication

Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly. Essentially my question is this: Is it possible to allow subnet S1to ...
2
votes
1answer
204 views

How does Sourcefire IPS understand which application is sending the packet?

I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
1
vote
1answer
83 views

Unsecured devices and IPv6

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out. There are a lot of horror stories about ...
2
votes
2answers
2k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
1
vote
1answer
33 views

Network Security Tunnel

In the Tunnel Interface, when I edit the tunnel information, it shows: Attributes Values Tunnel Source IF10 Tunnel Destination 1.0.0.1 Tunnel Mode GRE What does IF10 ...
1
vote
1answer
1k views

How does a Cisco ACL handle fragments

We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a ...
3
votes
1answer
769 views

Locked myself out of my Cisco switch

I have officially made the dumbest mistake ever. My switch is a Catalyst 2960 Series, configured this way: Current configuration : 10052 bytes ! ! Last configuration change at 19:15:28 UTC Wed Oct ...
1
vote
3answers
2k views

Unknown Unicast Flooding

I'm focusing currently on the "Unknown Unicast Flooding", and the proposed solutions from Cisco. I really need deep information about: Cisco Blocking Unknown Unicast Flooding (UUFB) Unknown Unicast ...
3
votes
1answer
445 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
3
votes
1answer
246 views

How to secure DMZ and client-to-client tunnel?

I found out our DMZ zone is not as secure as it should be. We use NAT to translate internet services from DMZ to internet. We have some developers out of organization. Some of them connect via client-...
0
votes
1answer
40 views

Fortinet configuration translation [closed]

We have a small case of security breach in one of our sites, we have a contractor that is suppose to stay out of our firewall Fortinet, today i noticed these two paragraphs that look fishy. My site ...
1
vote
1answer
41 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
1
vote
1answer
92 views

Cisco ASA access list on interface on which cryptomap is applied [closed]

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
3
votes
1answer
736 views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
3
votes
1answer
184 views

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? ...
1
vote
0answers
31 views

Dedicated Internet Router or VRF on L3? [closed]

I need to route public networks on our equipment. I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic. [ISP RTR]+---/30-Network-...
2
votes
2answers
46 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
7
votes
1answer
425 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
6
votes
3answers
939 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
7
votes
2answers
748 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
2
votes
2answers
53 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
3
votes
2answers
82 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
2
votes
1answer
513 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
0
votes
1answer
60 views

Why don't most routers automatically update their firmware? [closed]

Recently I realised that my new router's firmware was outdated. Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could ...
0
votes
1answer
52 views

Trade Floor Network Design Feedback [closed]

I have an assignment that I am working on. Now I admit, I am far from knowledgeable and I have nowhere to turn to for help at the moment. I am not asking for someone to complete the assignment for me, ...
3
votes
2answers
108 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
1
vote
0answers
72 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...
1
vote
0answers
436 views

How are required Keys inside MACSec Key agreement protocol (MKA) generated?

I am trying to wrap my head around MACSec Key agreement protocol (MKA) and its relation with MACSec and other protocols. So bear with me. To my understanding in order to MACSec to work, all nodes ...
1
vote
1answer
60 views
0
votes
1answer
64 views

Implications of ipv6 on LAN security [duplicate]

I'm not sure whether this is really the correct place to post this question, because it's not really about a "professional" setting. However, I have the standard setup with computers behind a netgear ...
4
votes
0answers
254 views

Hardening Cisco router on Internet-MANAGEMENT PLANE

I need confirmation that I understood the Cisco manual right. So my network is like this: ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1 ...
4
votes
1answer
219 views

Securing/Hardening Cisco router on Internet

In my company we have Cisco ASA firewall as edge device on the Internet. So outside interface with public IP address and security level 0 and inside interfaces with higher security levels. Standard ...