We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
1
vote
2answers
3k views

Preventing a Cisco router from appearing in a traceroute

I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line: no ip unreachables on the Internet-facing interface, and while this ...
2
votes
2answers
664 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
1
vote
1answer
356 views

Self-signed certificate change on Cisco3750

I'm running a script, that checks the configuration changes between the saved and running config. I have noticed, that the hash that goes after crypto pki certificate chain TP-self-signed-34586112 ...
2
votes
2answers
293 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
1
vote
2answers
379 views

Does a VPN service “anonymize” a mobile connection just as much as a landline connection?

I recently read about a proposal by the military government in Thailand to make tourist SIM-cards "trackable". That got me thinking about security when accessing the Internet via a mobile connection ...
3
votes
2answers
1k views

Splitting a switch with VLANS. Is it secure?

I'm trying to get my head around VLAN terms tagged, untagged, and PVID. From my understanding so far: every port on a switch can be mapped to a particular VLAN. when a packet (assigned to a VLAN) ...
1
vote
1answer
2k views

HP ProCurve switch off weak ciphers - disable SSH CBC Mode Ciphers and RC4

Is there any option for HP switches to change/modify used ssh ciphers? For exmaple in cisco we can issue commands: ip ssh server algorithm encryption aes256-ctr ip ssh server algorithm mac hmac-sha1 ...
1
vote
1answer
47 views

Cisco Show Privilege via SNMP

How to get Cisco privilege level via SNMP? R1#show privilege Current privilege level is 15 Which MIB or OID?
1
vote
1answer
839 views

Is there anyway to set Quota for users in Fortigate?

someone told me that there is a solution for setting Quota in New FortiOS (v5.4), but i can't find anything to do that. i just want to know, is there anyway to set Quota for my local internet users, ...
2
votes
1answer
1k views

How can i open a group of ports in ASA 5512?

Am dealing ASA first time. I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on ...
10
votes
1answer
22k views

Why should the native VLAN never be used?

Currently studying for a CCNA Security, I have been taught to never use the native VLAN for security purposes. This old discussion from Cisco forum states it very clearly: You should never use the ...
3
votes
1answer
4k views

Apple devices causing “Land Attack” on Cisco ASA

Recently migrated to a Cisco ASA/Sourcefire implementation in our enviroment and have been going through the logs on the ASA. Looking over the logs I noticed multiple critical errors that kept coming ...
1
vote
3answers
1k views

BGP community blackhole

We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic. ISP said use 64682:0 community for RTBH, I did ...
1
vote
2answers
57 views

Unidirectional Subnet Communication

Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly. Essentially my question is this: Is it possible to allow subnet S1to ...
2
votes
1answer
214 views

cisco ACL no counter

We have few access-list and all showing counter for hit but one access list not showing anything. C3850#show access-lists 101 Extended IP access list 101 5 permit ip 101.142.61.0 0.0.0.255 any (7 ...
2
votes
1answer
2k views

Cisco: Storm-control configuration put interface in port-channel in suspended state

I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state. Hardware: 3 stacked 3850 (IOS XE ...
4
votes
5answers
985 views

Are there any security advantages to activating VLAN tagging?

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?
1
vote
1answer
47 views

Privilege levels

PacketTracer does not support the function of associating views with specific users, therefore I tried another approach. My goal is to have two different users, one with privilege 15 and one with ...
1
vote
6answers
2k views

How can a leased line be securely shared between businesses?

The owner of a business site (in the UK) with about 10 independent business on it (of which I occupy one) is thinking of installing a leased line for shared use by those businesses. He is asking what ...
1
vote
3answers
8k views

How can I allow the same MAC address on different ports with port security?

How can I allow my laptop MAC address on every port with port security? Is it even possible? When I try, I get this: SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX Found ...
4
votes
3answers
569 views

What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms. Let's say ...
2
votes
1answer
207 views

How does Sourcefire IPS understand which application is sending the packet?

I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
2
votes
1answer
381 views

Comparison of Network Security Models

Our company is comparing and discussing network security models and I would like to know what the "best" model is based on objective measurable data. To aid in this, I am looking for a summary and ...
4
votes
1answer
1k views

What happens with tagged traffic on access port of Cisco switch?

I am broading up more this unanswered question: VLAN tagging and access port Let's assume I am trying to accomplish Double Tagging Attack. From my understanding, prerequisites of this attack is to be ...
1
vote
1answer
138 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
3
votes
3answers
2k views

Cisco Storm-Control default action when an optional action is configured

I have looked through as much Cisco, and other, documentation as I could find on the subject, but I couldn't find a solid answer on this question. The default action for an interface that exceeds the ...
4
votes
1answer
742 views

What's the difference between WPA and WPA2?

What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?
4
votes
1answer
207 views

How do we prevent loss of sensitive information from MAC spoofing?

While IP addresses are often dynamically assigned during runtime, hardware addresses (so called MAC addresses) are usually statically allotted when a network interface card is manufactured. What ...
5
votes
2answers
155 views

IPv6 built-in security?

At one time IPv6 was supposed to have built-in security. I don't know how it was supposed to be implemented, but my guess is that perhaps, if your stack and application supported it, you could simply ...
0
votes
1answer
29 views

How is a message digest decrypted? [closed]

Trying to get my head around digital signatures and hit a slight block. The book I am using gives the following information Device A hashes a message to create a message digest Device A encrypts the ...
13
votes
3answers
58k views

How to verify that a UDP port is open? [closed]

I have here a dilemma. I have a device that communicates to another remote device but there is a firewall between them. It's a UDP connection, so TCP utilities don't work to test if the specific port ...
1
vote
0answers
266 views

Effects of ip options drop command on Cisco 4507 Device

Are there any services or applications traversing a router that will be impacted by the command, "ip options drop"? I know the router warns about RSVP when you input this command, but this 4510 is not ...
2
votes
1answer
4k views

Nested private networks (private network within private network) [closed]

I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would ...
2
votes
4answers
276 views

Does a router add security to front-end servers?

I'm pursuing the reason behind why routers add security to a domain of a server architecture and front-end HTTP and HTTPS servers. Architecture: Assume I get a static IP of 100.100.100.100 from an ...
3
votes
1answer
274 views

How to secure DMZ and client-to-client tunnel?

I found out our DMZ zone is not as secure as it should be. We use NAT to translate internet services from DMZ to internet. We have some developers out of organization. Some of them connect via client-...
3
votes
1answer
297 views

Must a broadcast request come from the same network?

I was reading about Smurf Attacks and how Smurf Amplifier Registry keeps track of servers used for amplifying the attack, then I wondered, can a request coming from anywhere broadcast it to all parts ...
1
vote
2answers
72 views

Partitioning servers from the rest of the network

I'm an undergraduate looking for ways to experiment with network security techniques on my residential local area network, so much of this is going to be very new to me. Forgive me in advance for ...
1
vote
3answers
2k views

Unknown Unicast Flooding

I'm focusing currently on the "Unknown Unicast Flooding", and the proposed solutions from Cisco. I really need deep information about: Cisco Blocking Unknown Unicast Flooding (UUFB) Unknown Unicast ...
1
vote
2answers
572 views

Cisco Small Business SG300-10P and Ubiquiti Wireless APs, is is possible to enable IP Source Guard?

Problem: We have our Ubiquiti wireless APs hooked up to an SG300-10P. The user's MAC can roam from AP to AP without asking DHCP for an address. We want to have IP Source Guard enabled as a best ...
2
votes
2answers
65 views

private-vlan pimary vlan port not set to promiscuous?

What is the behavior of a port in a private-vlan pimary vlan that isn't set to promiscuous?
1
vote
2answers
124 views

Firewalling of individual ethernet ports in an organization

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on ...
1
vote
0answers
60 views

Cyberoam Internet Issue

I have a security problem on my network, sometimes some computers are disconecting from internet, when i visualised log files of my cyberoam , i found in top domains some adresses not recognised like ...
1
vote
4answers
138 views

Small network security Issue [on hold]

I have a router and switch in my institute. The switch is connected 15 PCs in a lab. With little effort, how can i block social sites, video buffering and torrentz.eu downloading? Please suggest a ...
1
vote
1answer
868 views

Cyberoam : Issue Web Filter Policy

I am a beginner, I want to Block a Specific Website in cyberoam I have followed this tutorial : Block a Specific Website to block a Specific Website in cyberoam. the first URL has been blocked ...
0
votes
2answers
1k views

Strange Nmap Scan Results

Sometimes I receive some odd, or inconsistent port scan results. Consider the two following excerpts, copied from my command shell: user@host:~$ nmap 10.1.1.0/24 Starting Nmap 6.47 ( http://nmap.org ...
1
vote
0answers
115 views

preventing network sniffing and eavesdropping using ping

We are using ping on the connection between aserver and the client pc, to check if there is an interruption, probably caused by sniffing or eavesdropping devices. During the ping, it will run a code ...
3
votes
1answer
56 views

How to secure data transmission over a non-secure Wi-Fi

I connect to a organization's non-secure Wi-Fi provided to guests. it is said that my data transmissions are not private and could be intercepted by others. What can I do to secure my data ...
0
votes
1answer
68 views

Is it possible to auto update router firewall filter?

Developer here, not a sysadmin. After reading over my firewall logs and seeing (assuming bot inititied) DROP entries, I'd like to script something to auto-update my firewall settings to deny their ...
1
vote
2answers
353 views

How can I access switch port protected by 802.1X thats in a seperate collision domain seperated by a T1 bridge

I want to be able to remotely access an Ethernet switch-port protected by 802.1x. The switch I want to access is at a distant site, but I have a T1 circuit that goes from that site to my office. I ...
3
votes
1answer
143 views

How to manage ACL in a routed network

I have a full mesh core network running OSPF. I use OSPF down to the "L3 Agg switches". Now I want to restrict traffic between some of the networks at our site, but how is this done when there is ...