Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
2
votes
1answer
228 views

Cisco 0-day CMP exploit

Just found today there is a 0-day exploit in many Cisco switch which use CMP cluster management protocol which allow remote command execution. https://tools.cisco.com/security/center/content/...
-1
votes
2answers
72 views

Is “port-forwarding” used just for comfort?

If I can easely bind some computer in internal network to a port on the router by code - so its right to say that we need "port-forwording" only for cases that it easier to us then build a new ...
1
vote
1answer
554 views

What is the ports that I should close in firewall to protect my LAN?

I use a firewall with two interfaces to protect my network but I don't know witch ports to close or open in LAN and WAN interface ? thanks for your help !!
2
votes
1answer
621 views

How does S/RTBH work in BGP?

We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe. So, to prevent DDoS we have null routed the destination (...
1
vote
1answer
35 views

Switch Configuration Security — Signed Configurations

Assume a scenario where a network technician in an organization may remotely access network devices for routine maintenance, but should only be able to set up network configurations (e.g. VLAN ...
1
vote
2answers
269 views

Shut down the port when someone plug out the cable

We have Cisco Catalyst 2960-S switches, And we noticed some employees plug out the internet cables to connect them to their Lab top. I want the command that I can use to make the port shutdown when ...
1
vote
2answers
74 views

Single Mode Fiber Optic Connectors

What is the purpose / function of media converters on Single-Fiber mode cable runs? How does this work or is necessary?
-1
votes
1answer
377 views

Can't Configure CISCO ASA 5505 firewall

HELP ME..!!!! I want to Design my Network as like as Below. I tried several times but Failed (Failed to ping Web server from my Local LAN and also from LAN). My configuration is: interface Vlan1 ...
5
votes
2answers
2k views

IPv6 and online privacy and security

I am studying up on IPv6 and part of the talk was about how the machines generate or can have multiple IPv6 addresses for internal use and external use. Does this mean that there is no longer a "...
1
vote
1answer
2k views

How does a Cisco ACL handle fragments

We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a ...
4
votes
1answer
1k views

Cisco Catalyst 2960 X MAC access list

I am using a MAC access list on this switch, so I go about it by first creating the MAC access list: #conf t #mac access-list extended aclname # permit host XXXX.XXXX.XXXX any Then, I tie this list ...
3
votes
1answer
1k views

Locked myself out of my Cisco switch

I have officially made the dumbest mistake ever. My switch is a Catalyst 2960 Series, configured this way: Current configuration : 10052 bytes ! ! Last configuration change at 19:15:28 UTC Wed Oct ...
2
votes
1answer
470 views

Cisco Layer2 ACL and STP

i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only. mac access-list extended PROTECTED permit any host ffff.ffff.ffff 0x800 0x0 permit any host ffff....
1
vote
2answers
89 views

Isolating a workstation on a network for remote access by contractors

Is it possible to isolate a computer on a network such that it can be accessed remotely by contractors, but not have access to any of the other machines on the network in any way? I understand it ...
5
votes
2answers
31k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
2
votes
2answers
91 views

Can I access a TOR website without TOR [closed]

I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (...
0
votes
1answer
26 views

Is it possible for secure third-party peering at wireless access points? [closed]

If the question title doesn't make sense, please forgive me, I'm not a networking person. I will try to describe what I mean: When you view your available networks on your computer, some are your ...
1
vote
2answers
4k views

Preventing a Cisco router from appearing in a traceroute

I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line: no ip unreachables on the Internet-facing interface, and while this ...
2
votes
2answers
974 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
1
vote
1answer
514 views

Self-signed certificate change on Cisco3750

I'm running a script, that checks the configuration changes between the saved and running config. I have noticed, that the hash that goes after crypto pki certificate chain TP-self-signed-34586112 ...
2
votes
2answers
334 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
1
vote
2answers
748 views

Does a VPN service “anonymize” a mobile connection just as much as a landline connection?

I recently read about a proposal by the military government in Thailand to make tourist SIM-cards "trackable". That got me thinking about security when accessing the Internet via a mobile connection ...
2
votes
2answers
2k views

Splitting a switch with VLANS. Is it secure?

I'm trying to get my head around VLAN terms tagged, untagged, and PVID. From my understanding so far: every port on a switch can be mapped to a particular VLAN. when a packet (assigned to a VLAN) ...
1
vote
1answer
3k views

HP ProCurve switch off weak ciphers - disable SSH CBC Mode Ciphers and RC4

Is there any option for HP switches to change/modify used ssh ciphers? For exmaple in cisco we can issue commands: ip ssh server algorithm encryption aes256-ctr ip ssh server algorithm mac hmac-sha1 ...
1
vote
1answer
53 views

Cisco Show Privilege via SNMP

How to get Cisco privilege level via SNMP? R1#show privilege Current privilege level is 15 Which MIB or OID?
1
vote
1answer
939 views

Is there anyway to set Quota for users in Fortigate?

someone told me that there is a solution for setting Quota in New FortiOS (v5.4), but i can't find anything to do that. i just want to know, is there anyway to set Quota for my local internet users, ...
2
votes
1answer
1k views

How can i open a group of ports in ASA 5512?

Am dealing ASA first time. I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on ...
10
votes
1answer
26k views

Why should the native VLAN never be used?

Currently studying for a CCNA Security, I have been taught to never use the native VLAN for security purposes. This old discussion from Cisco forum states it very clearly: You should never use the ...
3
votes
1answer
5k views

Apple devices causing “Land Attack” on Cisco ASA

Recently migrated to a Cisco ASA/Sourcefire implementation in our enviroment and have been going through the logs on the ASA. Looking over the logs I noticed multiple critical errors that kept coming ...
1
vote
3answers
2k views

BGP community blackhole

We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic. ISP said use 64682:0 community for RTBH, I did ...
1
vote
2answers
61 views

Unidirectional Subnet Communication

Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly. Essentially my question is this: Is it possible to allow subnet S1to ...
2
votes
1answer
267 views

cisco ACL no counter

We have few access-list and all showing counter for hit but one access list not showing anything. C3850#show access-lists 101 Extended IP access list 101 5 permit ip 101.142.61.0 0.0.0.255 any (7 ...
2
votes
1answer
2k views

Cisco: Storm-control configuration put interface in port-channel in suspended state

I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state. Hardware: 3 stacked 3850 (IOS XE ...
4
votes
5answers
1k views

Are there any security advantages to activating VLAN tagging?

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?
1
vote
1answer
47 views

Privilege levels

PacketTracer does not support the function of associating views with specific users, therefore I tried another approach. My goal is to have two different users, one with privilege 15 and one with ...
1
vote
6answers
2k views

How can a leased line be securely shared between businesses?

The owner of a business site (in the UK) with about 10 independent business on it (of which I occupy one) is thinking of installing a leased line for shared use by those businesses. He is asking what ...
1
vote
3answers
9k views

How can I allow the same MAC address on different ports with port security?

How can I allow my laptop MAC address on every port with port security? Is it even possible? When I try, I get this: SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX Found ...
4
votes
3answers
780 views

What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms. Let's say ...
2
votes
1answer
210 views

How does Sourcefire IPS understand which application is sending the packet?

I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
2
votes
1answer
392 views

Comparison of Network Security Models

Our company is comparing and discussing network security models and I would like to know what the "best" model is based on objective measurable data. To aid in this, I am looking for a summary and ...
4
votes
1answer
2k views

What happens with tagged traffic on access port of Cisco switch?

I am broading up more this unanswered question: VLAN tagging and access port Let's assume I am trying to accomplish Double Tagging Attack. From my understanding, prerequisites of this attack is to be ...
1
vote
1answer
151 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
3
votes
3answers
2k views

Cisco Storm-Control default action when an optional action is configured

I have looked through as much Cisco, and other, documentation as I could find on the subject, but I couldn't find a solid answer on this question. The default action for an interface that exceeds the ...
4
votes
1answer
835 views

What's the difference between WPA and WPA2?

What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?
4
votes
1answer
215 views

How do we prevent loss of sensitive information from MAC spoofing?

While IP addresses are often dynamically assigned during runtime, hardware addresses (so called MAC addresses) are usually statically allotted when a network interface card is manufactured. What ...
5
votes
2answers
156 views

IPv6 built-in security?

At one time IPv6 was supposed to have built-in security. I don't know how it was supposed to be implemented, but my guess is that perhaps, if your stack and application supported it, you could simply ...
0
votes
1answer
29 views

How is a message digest decrypted? [closed]

Trying to get my head around digital signatures and hit a slight block. The book I am using gives the following information Device A hashes a message to create a message digest Device A encrypts the ...
15
votes
3answers
76k views

How to verify that a UDP port is open? [closed]

I have here a dilemma. I have a device that communicates to another remote device but there is a firewall between them. It's a UDP connection, so TCP utilities don't work to test if the specific port ...
1
vote
0answers
277 views

Effects of ip options drop command on Cisco 4507 Device

Are there any services or applications traversing a router that will be impacted by the command, "ip options drop"? I know the router warns about RSVP when you input this command, but this 4510 is not ...
2
votes
1answer
5k views

Nested private networks (private network within private network) [closed]

I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would ...