Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
1
vote
1answer
532 views

Multiple DHCP Offers - Which is selected? [closed]

I have created a testing scenario in VMWare for a man in the middle attack using DHCP spoofing. It's for a college project. Windows 8 machine bridged to host adapter Kali linux bridged to host ...
3
votes
1answer
235 views

dmz and ip-phone on medium network

Hi I'm trying to sketch a computer network. The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone. ...
2
votes
1answer
3k views

Is a brute force UDP hole punch possible if both external IPs, and both internal ports are known to each client?

So I was just reading about hole punch techniques for UDP and TCP. I read that TCP hole punch can easily be accomplished if a UDP connection has already been established. So here is my theoretical ...
2
votes
1answer
356 views

How to sandbox internal IPs on the same subnet with one to one NAT

I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal ...
6
votes
1answer
4k views

How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?

For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
4
votes
2answers
2k views

Can you only allow local login when TACACS is unavailable on a Juniper?

I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to ...
4
votes
1answer
1k views

IPv6 BGP peering via link-local addresses

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border ...
6
votes
4answers
14k views

Toggle Switch for an Ethernet Cable

Is it possible to place a switch in one of the four/five wires of an Ethernet cable that will disable it? For my hardware project I would like the user to be able to disable the internet connection at ...
4
votes
1answer
24k views

How should I diagnose why my Cisco ASA denies traffic?

I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 4.2.2.2 on tcp/9000 How can I diagnose why this is happening from the Cisco ASA CLI?
2
votes
1answer
47 views

Phone signaling encryption

If we encrypt the signaling between the phones and call manager but not the voice packets, can the call still be intercepted, reassembled and listened to?
1
vote
1answer
62 views

In case of an intrusion does changing my private ip/lan ip helps?

In case of an intrusion does changing my private ip/lan ip helps ?
2
votes
1answer
1k views

OSPF with Multiple VLANs

In a Level 3 network with multiple, isolated (i.e. firewalled) VLANs, how does OSPF interact with the VLANs? Specifically: Is it standard to use multiple OSPF instances, i.e. one per VLAN? If the ...
1
vote
0answers
397 views

wpa-aes EAP-peap authentication problem

I'm trying to connect ubiquity NanoStation M2 as Station/Router mode to a hotspot that I believe has WPA/AES security and EAP-PEAP for auth. I have tested the username and password from my laptop and ...
3
votes
1answer
178 views

Does violation restrict still apply within same switch but different port

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back ...
16
votes
5answers
24k views

Do I need to set the enable secret on Cisco device?

I'm setting up a Cisco 2901 router. I have a login password on the console line, and the vty lines are configured to only accept ssh connections with public key authentication. The auxiliary line is ...
3
votes
1answer
365 views

Per-user network authentication without mac-filtering

I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis. One user may have ...
3
votes
1answer
2k views

How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?

How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like ...
7
votes
1answer
6k views

Configuring a password policy on Cisco IOS or NX-OS

I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know ...
1
vote
1answer
853 views

How does ingress filtering protect against legitimate spoof packets?

I am learning about Ingress Filtering where unauthorised packets are filtered out from entering the network. To get a better understanding of it , I found an article which said: the system ...
3
votes
1answer
1k views

Cisco ASA 8.2(5) same security routing issue

I have an ASA 5510 running 8.2(5) with the following configuration and I am having problems routing traffic between sub-interfaces at the same security level. Although not shown there are ACL's for ...
4
votes
1answer
2k views

IOS-XE: request system shell vulnerability

Catalyst-3650#request system shell Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..] ...
3
votes
1answer
751 views

Spoofed 127.0.0.0/8 possible?

If packets with ip source and/or ip destination 127.0.0.0/8 leaves the node, what can possibly happen? Can this be used as an attack vector against control plane (assuming L2 connectivity)? Scenarios:...
7
votes
2answers
569 views

Switch security when in an unsecured location

I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots ...
1
vote
3answers
427 views

Network architecture for a school

I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own ...
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
3
votes
1answer
332 views

Cisco SG500x-24P - Discard untagged

Cisco SG500X-24P Switch. Goal Only admin tagged frames, discard untagged frames (ingress & egress) Question Is the following configuration correct: Port VLAN Mode: General VLANs: 100T, 200T, ...
2
votes
2answers
449 views

Listen-only (stealth) CDP on IOS

I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
2
votes
1answer
165 views

Best Authentication Practice

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a ...
2
votes
1answer
242 views

On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with ...
5
votes
1answer
1k views

Are users of Captive Portal wifi (web authentication) vulnerable to sniffing?

I understand that connecting to a wireless network using a WEP/WPA key is also encrypting the data you send over the network, hiding it from potential sniffers in range of the network (please correct ...
14
votes
1answer
2k views

Enterprise Network Equipment vulnerable to heartbleed

On 09/04/2014 the The Heartbleed vulerability was disclosed by the OpenSSL team. The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness ...
2
votes
1answer
702 views

Do routers validate the IP packet length?

Do routers verify the actual IP packet size with that mentioned in the packet?
0
votes
2answers
2k views

NAT vs PAT Security

i don't know if i have duplicated a questions..but then i still want to ask which one is more risky to be deploy in networking will it be PAT or NAT PAT will make it risky for routing as it will ...
7
votes
2answers
16k views

Securing Cisco device from brute force attacks

I'm trying to block users from configuring a Cisco IOS device if they have entered incorrect passwords a number of times. This is the command I'm using: Router(config)# login block-for 120 attempts 3 ...
4
votes
1answer
696 views

EIGRP MD5 authentication

I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible? ...
3
votes
2answers
973 views

Domain name for SSH

What is the purpose of a domain name to create SSH keys? Before enabling SSH on firewall/router, we need to create domain name. Why is it necessary to do that? What does a domain name do and how is ...
3
votes
2answers
3k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...
3
votes
1answer
1k views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
2answers
11k views

To Inspect ESMTP on ASA or not?

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing ...
9
votes
2answers
3k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
5k views

Cisco: storm-control unicast

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though. Reading the Cisco docs online ...
6
votes
2answers
187 views

Help with basic network security issue

I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now ...
4
votes
2answers
790 views

The Difference Between ACL and FPM

What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
5
votes
1answer
1k views

Is Layer 3 web auth with Layer 2 PSK more secure?

I have configured a Cisco WLC to authenticate users using External Web Authentication at Layer 3. Are client wifi connections more resilient against eavesdroppers with a pre-shared key at Layer 2 ...
2
votes
2answers
2k views

IP-over-IP tunnels - necessary to limit source IPs?

I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer. I would like to know, if I should add additional precautions ...
15
votes
3answers
22k views

MPLS vs Encrypted VPNs - traffic security?

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no ...
1
vote
1answer
700 views

JunOS: Using route-filter in policy statements

I am configuring some policy statements on JunOS 11. I am filtering inbound BGP prefixes using the below syntax. It's fairly simply and self explanatory, you can guess whats it's doing just by looking ...
8
votes
1answer
2k views

DHCP-Snooping on 3com S4210

I'm setting up dhcp snooping with IP source guard and DAI on some 3com S4210 switches. I found problem with recording bindings in snooping database. In some cases I know that there is PC connected to ...
5
votes
2answers
2k views

Cisco commands to find rogue access point connected

Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). ...