Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
1
vote
2answers
88 views

Separate a network within the enterprise environment

What will be the best solution, to securely separate a network and have internet connectivity. In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate ...
3
votes
1answer
524 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
1
vote
0answers
39 views

What are some options to replace a computer that is dual homed on 2 separate VLAN's? [closed]

One is a "secure" VLAN, the other is a "house" VLAN. At some point, a workflow was developed in which a decision was made that sales staff needed to take some of their materials received from clients ...
1
vote
1answer
71 views

Sensor to collector communication from SPAN, Inline or TAP

I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network. My ...
3
votes
1answer
81 views

Example VLAN without any Router — Security Problems?

I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually ...
3
votes
1answer
95 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
2
votes
1answer
114 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
2
votes
4answers
2k views

VLANS vs. subnets for network security and segmentation

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure ...
0
votes
1answer
62 views

D-link managed switch or Cisco managed switch? [closed]

Can anyone tell me the difference between D-link managed switch and cisco managed switch? And why we go for cisco managed switch.
1
vote
1answer
84 views

Unsecured devices and IPv6

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out. There are a lot of horror stories about ...
1
vote
3answers
84 views

How do protocols get blocked even over open ports?

This might be a stupid question, but I'm wondering how a network blocks a protocol like SSH even if the server is listening on port that isn't blocked, like 80. I've even tried port forwarding an non-...
1
vote
0answers
130 views

Monitoring interfaces on VyOS then SSH output to another machine (Security Onion) [closed]

I am trying to figure out the best way I can monitor interfaces on a VyOS interface from a Security Onion instance using Squil (Snort alerts etc). I am thinking SSH to VyOS to activate monitor ...
1
vote
1answer
190 views

Are brute force attack on public facing interface of internet router normal?

Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
3
votes
4answers
97 views

Terminals vs. Secure Access Servers?

I have come across some devices by a companay called "Lantronix" that produce 'Secure Access Servers'. The description makes it sound like they are physical devices that pretty much do what Terminal ...
2
votes
2answers
592 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
2answers
2k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
3
votes
2answers
382 views

Dynamic ARP Inspection - Does it check port in the binding database?

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis. If PCA (macA,...
2
votes
1answer
234 views

Switch-to-Switch Traffic Protection

I am currently working a project dealing with network security, and my question is that what is a feasible way to protect traffic on a switch-to-switch link in a LAN, not end-host-to-end-host ...
1
vote
2answers
102 views

How to block outside initiated traffic in NPTv6?

NPTv6 does prefix translation between one IPv6 address to another. Is there a way to prevent outside initiated traffic to inside (preferably in A10 AX devices)?
2
votes
1answer
260 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
1
vote
2answers
623 views

What are the advantages and (if any) disadvantages of putting security on both switches and routers?

I appreciate some of the most obvious advantages of security on both switches and routers are things like stopping unauthorized access and preventing any unwanted configurations. However, I can't ...
0
votes
1answer
36 views

Getting “public” IP's while keeping firewall enabled [closed]

Current situation: The internet available to me is a shared router that I do not have administrative access to. If really needed I could reset the password but I rather not. I plugged in a network ...
0
votes
3answers
521 views

Is there an “active” network tap (not just passive)? [closed]

Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc. Another thing that would interest my ...
2
votes
1answer
40 views

Cisco port ACL for one IP

I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following: ip address 192.168.1.1 255.255.255.248 My question is, How to create an ACL to limit the connections for ports 80 ...
1
vote
1answer
156 views

Can a fortigate firewall know which device tried to access its restricted url?

In my network, a specific url is being blocked by fortiguard firewall. Now I want to know which all devices had tried to access that blocked url. I traced the mac address inside the packet. But how ...
1
vote
1answer
253 views

Client security using UDP

Introduction I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess ...
2
votes
1answer
221 views

Cisco 0-day CMP exploit

Just found today there is a 0-day exploit in many Cisco switch which use CMP cluster management protocol which allow remote command execution. https://tools.cisco.com/security/center/content/...
-1
votes
2answers
71 views

Is “port-forwarding” used just for comfort?

If I can easely bind some computer in internal network to a port on the router by code - so its right to say that we need "port-forwording" only for cases that it easier to us then build a new ...
1
vote
1answer
378 views

What is the ports that I should close in firewall to protect my LAN?

I use a firewall with two interfaces to protect my network but I don't know witch ports to close or open in LAN and WAN interface ? thanks for your help !!
2
votes
1answer
537 views

How does S/RTBH work in BGP?

We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe. So, to prevent DDoS we have null routed the destination (...
1
vote
1answer
34 views

Switch Configuration Security — Signed Configurations

Assume a scenario where a network technician in an organization may remotely access network devices for routine maintenance, but should only be able to set up network configurations (e.g. VLAN ...
1
vote
2answers
230 views

Shut down the port when someone plug out the cable

We have Cisco Catalyst 2960-S switches, And we noticed some employees plug out the internet cables to connect them to their Lab top. I want the command that I can use to make the port shutdown when ...
1
vote
2answers
72 views

Single Mode Fiber Optic Connectors

What is the purpose / function of media converters on Single-Fiber mode cable runs? How does this work or is necessary?
-1
votes
1answer
256 views

Can't Configure CISCO ASA 5505 firewall

HELP ME..!!!! I want to Design my Network as like as Below. I tried several times but Failed (Failed to ping Web server from my Local LAN and also from LAN). My configuration is: interface Vlan1 ...
5
votes
2answers
2k views

IPv6 and online privacy and security

I am studying up on IPv6 and part of the talk was about how the machines generate or can have multiple IPv6 addresses for internal use and external use. Does this mean that there is no longer a "...
1
vote
1answer
2k views

How does a Cisco ACL handle fragments

We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a ...
3
votes
1answer
1k views

Cisco Catalyst 2960 X MAC access list

I am using a MAC access list on this switch, so I go about it by first creating the MAC access list: #conf t #mac access-list extended aclname # permit host XXXX.XXXX.XXXX any Then, I tie this list ...
3
votes
1answer
836 views

Locked myself out of my Cisco switch

I have officially made the dumbest mistake ever. My switch is a Catalyst 2960 Series, configured this way: Current configuration : 10052 bytes ! ! Last configuration change at 19:15:28 UTC Wed Oct ...
2
votes
1answer
344 views

Cisco Layer2 ACL and STP

i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only. mac access-list extended PROTECTED permit any host ffff.ffff.ffff 0x800 0x0 permit any host ffff....
1
vote
2answers
88 views

Isolating a workstation on a network for remote access by contractors

Is it possible to isolate a computer on a network such that it can be accessed remotely by contractors, but not have access to any of the other machines on the network in any way? I understand it ...
5
votes
2answers
25k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
1
vote
2answers
83 views

Can I access a TOR website without TOR [closed]

I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (...
0
votes
1answer
26 views

Is it possible for secure third-party peering at wireless access points? [closed]

If the question title doesn't make sense, please forgive me, I'm not a networking person. I will try to describe what I mean: When you view your available networks on your computer, some are your ...
1
vote
2answers
3k views

Preventing a Cisco router from appearing in a traceroute

I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line: no ip unreachables on the Internet-facing interface, and while this ...
2
votes
2answers
585 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
1
vote
1answer
291 views

Self-signed certificate change on Cisco3750

I'm running a script, that checks the configuration changes between the saved and running config. I have noticed, that the hash that goes after crypto pki certificate chain TP-self-signed-34586112 ...
2
votes
2answers
272 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
1
vote
2answers
295 views

Does a VPN service “anonymize” a mobile connection just as much as a landline connection?

I recently read about a proposal by the military government in Thailand to make tourist SIM-cards "trackable". That got me thinking about security when accessing the Internet via a mobile connection ...
3
votes
2answers
1k views

Splitting a switch with VLANS. Is it secure?

I'm trying to get my head around VLAN terms tagged, untagged, and PVID. From my understanding so far: every port on a switch can be mapped to a particular VLAN. when a packet (assigned to a VLAN) ...
1
vote
1answer
2k views

HP ProCurve switch off weak ciphers - disable SSH CBC Mode Ciphers and RC4

Is there any option for HP switches to change/modify used ssh ciphers? For exmaple in cisco we can issue commands: ip ssh server algorithm encryption aes256-ctr ip ssh server algorithm mac hmac-sha1 ...