Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

1
vote
1answer
117 views

Opinion on techinique to solve arp poisoning

I have been researching about prevention of ARP spoofing in an individual's device (smart phone or laptop) in a public network. If we save the MAC address of the default gateway at the time of ...
4
votes
3answers
460 views

How can I know about if there is a smurf attack on my network?

I have been having network issues. The users report to me problems with the internet, but actually the problem is on my network. I have a sonicwall firewall and the device logs indicate posible tcp ...
12
votes
1answer
30k views

What are the benefits and cons of IGMP snooping?

Our new router is asking if we want IGMP snooping enabled. Not being familiar with this, I looked to the internet and got the following wiki description: IGMP snooping is the process of listening ...
2
votes
1answer
77 views

Malware lab with watchguard firewall

I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already ...
2
votes
2answers
2k views

How can I find which natted private IP address is communicating on Cisco ASA 5508

Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall? ...
2
votes
2answers
63 views

How are computer networks protected against continous DHCPREQUEST requests?

A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small. How are ...
1
vote
0answers
41 views

Securing WLAN using one time authentication [on hold]

We have a wireless SSID for Managers which I need to secure using one time authentication. Currently we are using MAC filtering but it is insecure. So I am wondering if there is a certificate based ...
1
vote
1answer
442 views

Multiple DHCP Offers - Which is selected? [on hold]

I have created a testing scenario in VMWare for a man in the middle attack using DHCP spoofing. It's for a college project. Windows 8 machine bridged to host adapter Kali linux bridged to host ...
3
votes
1answer
182 views

dmz and ip-phone on medium network

Hi I'm trying to sketch a computer network. The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone. ...
1
vote
1answer
2k views

Is a brute force UDP hole punch possible if both external IPs, and both internal ports are known to each client?

So I was just reading about hole punch techniques for UDP and TCP. I read that TCP hole punch can easily be accomplished if a UDP connection has already been established. So here is my theoretical ...
2
votes
1answer
283 views

How to sandbox internal IPs on the same subnet with one to one NAT

I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal ...
6
votes
1answer
3k views

How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?

For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
4
votes
1answer
2k views

Can you only allow local login when TACACS is unavailable on a Juniper?

I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to ...
4
votes
1answer
708 views

IPv6 BGP peering via link-local addresses

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border ...
4
votes
4answers
9k views

Toggle Switch for an Ethernet Cable

Is it possible to place a switch in one of the four/five wires of an Ethernet cable that will disable it? For my hardware project I would like the user to be able to disable the internet connection ...
4
votes
1answer
20k views

How should I diagnose why my Cisco ASA denies traffic?

I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 4.2.2.2 on tcp/9000 How can I diagnose why this is happening from the Cisco ASA CLI?
2
votes
1answer
46 views

Phone signaling encryption

If we encrypt the signaling between the phones and call manager but not the voice packets, can the call still be intercepted, reassembled and listened to?
1
vote
1answer
60 views

In case of an intrusion does changing my private ip/lan ip helps?

In case of an intrusion does changing my private ip/lan ip helps ?
2
votes
1answer
784 views

OSPF with Multiple VLANs

In a Level 3 network with multiple, isolated (i.e. firewalled) VLANs, how does OSPF interact with the VLANs? Specifically: Is it standard to use multiple OSPF instances, i.e. one per VLAN? If the ...
1
vote
0answers
317 views

wpa-aes EAP-peap authentication problem

I'm trying to connect ubiquity NanoStation M2 as Station/Router mode to a hotspot that I believe has WPA/AES security and EAP-PEAP for auth. I have tested the username and password from my laptop and ...
3
votes
1answer
173 views

Does violation restrict still apply within same switch but different port

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back ...
16
votes
5answers
20k views

Do I need to set the enable secret on Cisco device?

I'm setting up a Cisco 2901 router. I have a login password on the console line, and the vty lines are configured to only accept ssh connections with public key authentication. The auxiliary line is ...
3
votes
1answer
359 views

Per-user network authentication without mac-filtering

I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis. One user may have ...
3
votes
1answer
1k views

How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?

How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like ...
7
votes
1answer
5k views

Configuring a password policy on Cisco IOS or NX-OS

I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know ...
0
votes
1answer
831 views

How does ingress filtering protect against legitimate spoof packets?

I am learning about Ingress Filtering where unauthorised packets are filtered out from entering the network. To get a better understanding of it , I found an article which said: the system ...
3
votes
1answer
1k views

Cisco ASA 8.2(5) same security routing issue

I have an ASA 5510 running 8.2(5) with the following configuration and I am having problems routing traffic between sub-interfaces at the same security level. Although not shown there are ACL's for ...
4
votes
1answer
2k views

IOS-XE: request system shell vulnerability

Catalyst-3650#request system shell Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..] ...
3
votes
1answer
576 views

Spoofed 127.0.0.0/8 possible?

If packets with ip source and/or ip destination 127.0.0.0/8 leaves the node, what can possibly happen? Can this be used as an attack vector against control plane (assuming L2 connectivity)? Scenarios:...
7
votes
2answers
552 views

Switch security when in an unsecured location

I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots ...
1
vote
3answers
343 views

Network architecture for a school

I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own ...
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
3
votes
1answer
316 views

Cisco SG500x-24P - Discard untagged

Cisco SG500X-24P Switch. Goal Only admin tagged frames, discard untagged frames (ingress & egress) Question Is the following configuration correct: Port VLAN Mode: General VLANs: 100T, 200T, ...
2
votes
1answer
349 views

Listen-only (stealth) CDP on IOS

I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
2
votes
1answer
158 views

Best Authentication Practice

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a ...
2
votes
1answer
236 views

On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with ...
4
votes
1answer
1k views

Are users of Captive Portal wifi (web authentication) vulnerable to sniffing?

I understand that connecting to a wireless network using a WEP/WPA key is also encrypting the data you send over the network, hiding it from potential sniffers in range of the network (please correct ...
14
votes
1answer
2k views

Enterprise Network Equipment vulnerable to heartbleed

On 09/04/2014 the The Heartbleed vulerability was disclosed by the OpenSSL team. The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness ...
2
votes
1answer
541 views

Do routers validate the IP packet length?

Do routers verify the actual IP packet size with that mentioned in the packet?
0
votes
2answers
1k views

NAT vs PAT Security

i don't know if i have duplicated a questions..but then i still want to ask which one is more risky to be deploy in networking will it be PAT or NAT PAT will make it risky for routing as it will ...
7
votes
2answers
14k views

Securing Cisco device from brute force attacks

I'm trying to block users from configuring a Cisco IOS device if they have entered incorrect passwords a number of times. This is the command I'm using: Router(config)# login block-for 120 attempts 3 ...
4
votes
1answer
648 views

EIGRP MD5 authentication

I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible? ...
3
votes
2answers
561 views

Domain name for SSH

What is the purpose of a domain name to create SSH keys? Before enabling SSH on firewall/router, we need to create domain name. Why is it necessary to do that? What does a domain name do and how is ...
3
votes
2answers
2k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...
3
votes
1answer
898 views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
2answers
10k views

To Inspect ESMTP on ASA or not?

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing ...
9
votes
2answers
2k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
4k views

Cisco: storm-control unicast

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though. Reading the Cisco docs online ...
6
votes
2answers
173 views

Help with basic network security issue

I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now ...