Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

38
votes
11answers
34k views

How do you prevent rogue wireless access points on a network?

Depending on what type of traffic is going over the network, it's often not feasible that an employee brings a wireless router and sets it up into your network. This is because often, they are not or ...
32
votes
8answers
7k views

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Is MAC address filtering the most suitable option to prevent someone connecting their own device to the network by plugging into Ethernet wall sockets? What if they unplug a device and clone its MAC?
15
votes
6answers
2k views

Securing OSPF with only passive interfaces

I know that to secure OSPF you should 1) use OSPF authentication, 2) use passive interface command on interfaces that do not have ospf neighbors. If I only use the passive interface command and not ...
15
votes
3answers
19k views

MPLS vs Encrypted VPNs - traffic security?

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no ...
15
votes
5answers
20k views

Do I need to set the enable secret on Cisco device?

I'm setting up a Cisco 2901 router. I have a login password on the console line, and the vty lines are configured to only accept ssh connections with public key authentication. The auxiliary line is ...
14
votes
5answers
35k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
14
votes
2answers
591 views

What is the purpose of BGP TTL security?

What attack vectors does the BGP TTL security knob protect against?
14
votes
1answer
2k views

Enterprise Network Equipment vulnerable to heartbleed

On 09/04/2014 the The Heartbleed vulerability was disclosed by the OpenSSL team. The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness ...
12
votes
3answers
472 views

I want to perform monitoring of my network infrastructure, can this safely be done with SNMPv2?

I need to perform monitoring of my network infrastructure but I'm wondering if using SNMPv2 is secure? What are the weaknesses of SNMPv2?
12
votes
3answers
44k views

How to verify that a UDP port is open? [closed]

I have here a dilemma. I have a device that communicates to another remote device but there is a firewall between them. It's a UDP connection, so TCP utilities don't work to test if the specific port ...
11
votes
2answers
3k views

Extend MACSec encryption over provider bridge

I already asked this question on SF, but figured it might be a better fit here. Is it at all possible to extend MACSec encryption over a provider bridge? Will the typical 802.1ad implementation be ...
10
votes
2answers
11k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
10
votes
1answer
18k views

Why should the native VLAN never be used?

Currently studying for a CCNA Security, I have been taught to never use the native VLAN for security purposes. This old discussion from Cisco forum states it very clearly: You should never use the ...
10
votes
1answer
462 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
9
votes
3answers
14k views

Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)

Setup: Cisco router with multiple VLAN's configured on it. How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this: access-list 102 deny ip 1.1.1.0 0....
9
votes
1answer
27k views

What are the benefits and cons of IGMP snooping?

Our new router is asking if we want IGMP snooping enabled. Not being familiar with this, I looked to the internet and got the following wiki description: IGMP snooping is the process of listening ...
9
votes
1answer
1k views

Blocking IPv6 RA advertisements on Juniper EX series switch

How do I go about blocking IPv6 RA advertisements on access ports on a Juniper EX series switch? I know that Cisco offers ra-guard as an option much like bpdu-guard on spanning tree, I am just not ...
8
votes
2answers
2k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
8
votes
1answer
2k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
7
votes
6answers
399 views

What is the name of these broadband street cabinet connectors, and are they secure?

Can anyone help enlighten me, do these connectors have a formal name/standard? These are found in a street side ISP broadband cabinet for residential customers in the UK. Would I be correct in ...
7
votes
4answers
1k views

Website filtering via IOS

Our office network uses the 1921/K9 router along with SG300 L3 switch (and a few other L2 switches) all with base modules. If we wanted to block employees from visiting certain websites, what would be ...
7
votes
2answers
737 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
7
votes
3answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
7
votes
1answer
477 views

How do you define an IOS zone-based firewall policy to inspect “any”?

When configuring ZBFW on IOS, the "class-default" class doesn't allow the inspect action (only pass and drop). What is the recommended way to match all traffic for stateful inspection? Matching TCP, ...
7
votes
2answers
3k views

Is ICMP spoofing practical?

How practical is ICMP spoofing? scenario 1: in a NAT environment, how does NAT keep track of ICMP sessions (not technically sessions since it's not connection-oriented?) For ECHO/ECHO response ...
7
votes
2answers
552 views

Switch security when in an unsecured location

I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots ...
7
votes
1answer
420 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
7
votes
3answers
768 views

Placement of firewall for VPN RA and L2L tunnels

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX ...
6
votes
4answers
7k views

Which is the Preferred location of an IPS within a network? [closed]

In the context of protecting a campus network, which is the Preferred location of an IPS within a network? Within an ISR router IPS as a separate device Within ASA
6
votes
2answers
1k views

IPv6 and online privacy and security

I am studying up on IPv6 and part of the talk was about how the machines generate or can have multiple IPv6 addresses for internal use and external use. Does this mean that there is no longer a "...
6
votes
2answers
14k views

Securing Cisco device from brute force attacks

I'm trying to block users from configuring a Cisco IOS device if they have entered incorrect passwords a number of times. This is the command I'm using: Router(config)# login block-for 120 attempts 3 ...
6
votes
3answers
938 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
6
votes
3answers
555 views

Is UDP Usage in Routing Information Protocol (RIP) a Secure Practice?

I know that UDP is a connectionless transport layer protocol. Since it is easy to fake your source IP and source Port in your headers, what keeps anyone from poisoning routing tables via RIP? It seems ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
1k views

DHCP Snooping Confusion

I'm trying to work out how to enable dhcp snooping and dynamic arp inspection on our guest network and I'm a little confused.... Here's the situation: We have a hub and spoke topology, with a ...
6
votes
2answers
172 views

Help with basic network security issue

I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now ...
6
votes
1answer
2k views

DHCP-Snooping on 3com S4210

I'm setting up dhcp snooping with IP source guard and DAI on some 3com S4210 switches. I found problem with recording bindings in snooping database. In some cases I know that there is PC connected to ...
6
votes
2answers
11k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
6
votes
1answer
3k views

DNS options Ironport Web security appliance

I'm running a Ironport WSA in transparent mode. In advanced proxy config - DNS Options I find the following: Find web server by: Specify how the appliance should find the location of the requested ...
5
votes
4answers
697 views

How risky is a personal-use-only wireless subnet inside the corporate subnet?

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
5
votes
2answers
144 views

IPv6 built-in security?

At one time IPv6 was supposed to have built-in security. I don't know how it was supposed to be implemented, but my guess is that perhaps, if your stack and application supported it, you could simply ...
5
votes
1answer
3k views

Cisco: storm-control unicast

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though. Reading the Cisco docs online ...
5
votes
8answers
6k views

How can I use SSL remote access VPN for connecting two sites?

I have a Fortigate 110C on my central site. I have a remote site office too. The users at the remote site need to access the central site via a VPN. Can I run SSL client software on one of the PC's or ...
5
votes
2answers
2k views

Cisco commands to find rogue access point connected

Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). ...
5
votes
3answers
1k views

RA VPN notification

I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/...
5
votes
1answer
5k views

Configuring a password policy on Cisco IOS or NX-OS

I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know ...
4
votes
4answers
96 views

Terminals vs. Secure Access Servers?

I have come across some devices by a companay called "Lantronix" that produce 'Secure Access Servers'. The description makes it sound like they are physical devices that pretty much do what Terminal ...
4
votes
2answers
23k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
4
votes
2answers
4k views

How to mitigate UDP Flood?

Servers with majority of its traffic in UDP (new connections are expected), what can be used to effectively mitigate UDP flood? For example forged source IPs with variable sized UDP payload (typically ...
4
votes
1answer
264 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...