We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
4
votes
1answer
660 views

EIGRP MD5 authentication

I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible? ...
3
votes
2answers
599 views

Domain name for SSH

What is the purpose of a domain name to create SSH keys? Before enabling SSH on firewall/router, we need to create domain name. Why is it necessary to do that? What does a domain name do and how is ...
3
votes
2answers
2k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...
3
votes
1answer
924 views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
2answers
10k views

To Inspect ESMTP on ASA or not?

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing ...
9
votes
2answers
2k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
4k views

Cisco: storm-control unicast

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though. Reading the Cisco docs online ...
6
votes
2answers
179 views

Help with basic network security issue

I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now ...
4
votes
2answers
742 views

The Difference Between ACL and FPM

What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
5
votes
1answer
1k views

Is Layer 3 web auth with Layer 2 PSK more secure?

I have configured a Cisco WLC to authenticate users using External Web Authentication at Layer 3. Are client wifi connections more resilient against eavesdroppers with a pre-shared key at Layer 2 ...
2
votes
2answers
1k views

IP-over-IP tunnels - necessary to limit source IPs?

I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer. I would like to know, if I should add additional precautions ...
15
votes
3answers
20k views

MPLS vs Encrypted VPNs - traffic security?

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no ...
1
vote
1answer
692 views

JunOS: Using route-filter in policy statements

I am configuring some policy statements on JunOS 11. I am filtering inbound BGP prefixes using the below syntax. It's fairly simply and self explanatory, you can guess whats it's doing just by looking ...
8
votes
1answer
2k views

DHCP-Snooping on 3com S4210

I'm setting up dhcp snooping with IP source guard and DAI on some 3com S4210 switches. I found problem with recording bindings in snooping database. In some cases I know that there is PC connected to ...
5
votes
2answers
2k views

Cisco commands to find rogue access point connected

Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). ...
4
votes
1answer
978 views

WEP 152bit encryption key… Why?

As stated here: http://documentation.netgear.com/wag102/enu/202-10120-01/v1/WAG102-4-10.html and in many other sources, WEP key can be 64bit, 128bit (factors of 2) and 152bit length. Factor of 2 ...
4
votes
3answers
271 views

Router neighbour config discovery

I am new to the whole networking world and I apologize if this is a re-post of a question. What I want to know is that is there a mechanism for routers to discover its environment. NOT what a ...
14
votes
5answers
35k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
5
votes
3answers
1k views

RA VPN notification

I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/...
8
votes
3answers
775 views

Placement of firewall for VPN RA and L2L tunnels

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX ...
3
votes
1answer
756 views

Firewall behind a firewall

I currently have a NETGEAR FVS338. If I was to connect another firewall of it's type directly to it or to the switch under the first firewall, could I still VPN into the 2nd firewall? I would like to ...
7
votes
1answer
1k views

DHCP Snooping Confusion

I'm trying to work out how to enable dhcp snooping and dynamic arp inspection on our guest network and I'm a little confused.... Here's the situation: We have a hub and spoke topology, with a ...
3
votes
1answer
85 views

3rd Party VPN Device Security

One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel. Another vendor wanted to install their VPN device (Cisco ...
7
votes
2answers
12k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
10
votes
1answer
471 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
4
votes
4answers
935 views

Encrypting All Network Traffic

For a corporate network, is there a way to possibly encrypt all network traffic on the local network? I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-...
11
votes
2answers
3k views

Extend MACSec encryption over provider bridge

I already asked this question on SF, but figured it might be a better fit here. Is it at all possible to extend MACSec encryption over a provider bridge? Will the typical 802.1ad implementation be ...
10
votes
2answers
11k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
7
votes
2answers
3k views

Is ICMP spoofing practical?

How practical is ICMP spoofing? scenario 1: in a NAT environment, how does NAT keep track of ICMP sessions (not technically sessions since it's not connection-oriented?) For ECHO/ECHO response ...
6
votes
1answer
3k views

DNS options Ironport Web security appliance

I'm running a Ironport WSA in transparent mode. In advanced proxy config - DNS Options I find the following: Find web server by: Specify how the appliance should find the location of the requested ...
5
votes
4answers
712 views

How risky is a personal-use-only wireless subnet inside the corporate subnet?

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
4
votes
2answers
4k views

How to mitigate UDP Flood?

Servers with majority of its traffic in UDP (new connections are expected), what can be used to effectively mitigate UDP flood? For example forged source IPs with variable sized UDP payload (typically ...
9
votes
1answer
1k views

Blocking IPv6 RA advertisements on Juniper EX series switch

How do I go about blocking IPv6 RA advertisements on access ports on a Juniper EX series switch? I know that Cisco offers ra-guard as an option much like bpdu-guard on spanning tree, I am just not ...
7
votes
4answers
1k views

Website filtering via IOS

Our office network uses the 1921/K9 router along with SG300 L3 switch (and a few other L2 switches) all with base modules. If we wanted to block employees from visiting certain websites, what would be ...
4
votes
4answers
1k views

Can a VLAN bridge be used to replace a bypass switch with an IPS device?

I am wondering if it's possible to set up a way to remove the need for a bypass switch when using an IPS device. To summarize, I would have an IPS device acting as a virtual wire on a connection I'm ...
8
votes
1answer
2k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
3
votes
1answer
333 views

Source of Cisco NBAR dropped traffic

I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic. I see the dropped traffic by typing "show policy-map interface XXX" how can i find the source of the ...
5
votes
8answers
6k views

How can I use SSL remote access VPN for connecting two sites?

I have a Fortigate 110C on my central site. I have a remote site office too. The users at the remote site need to access the central site via a VPN. Can I run SSL client software on one of the PC's or ...
10
votes
3answers
14k views

Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)

Setup: Cisco router with multiple VLAN's configured on it. How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this: access-list 102 deny ip 1.1.1.0 0....
6
votes
4answers
7k views

Which is the Preferred location of an IPS within a network? [closed]

In the context of protecting a campus network, which is the Preferred location of an IPS within a network? Within an ISR router IPS as a separate device Within ASA
2
votes
4answers
1k views

Cisco 1921 security features in the default bundle

Bought a Cisco 1921 router without any additional modules. This is the first time I'm using a non-home router. What security features should I enable so that users are relatively safe when using the ...
8
votes
6answers
419 views

What is the name of these broadband street cabinet connectors, and are they secure?

Can anyone help enlighten me, do these connectors have a formal name/standard? These are found in a street side ISP broadband cabinet for residential customers in the UK. Would I be correct in ...
7
votes
1answer
489 views

How do you define an IOS zone-based firewall policy to inspect “any”?

When configuring ZBFW on IOS, the "class-default" class doesn't allow the inspect action (only pass and drop). What is the recommended way to match all traffic for stateful inspection? Matching TCP, ...
39
votes
11answers
35k views

How do you prevent rogue wireless access points on a network?

Depending on what type of traffic is going over the network, it's often not feasible that an employee brings a wireless router and sets it up into your network. This is because often, they are not or ...
14
votes
2answers
650 views

What is the purpose of BGP TTL security?

What attack vectors does the BGP TTL security knob protect against?
13
votes
3answers
477 views

I want to perform monitoring of my network infrastructure, can this safely be done with SNMPv2?

I need to perform monitoring of my network infrastructure but I'm wondering if using SNMPv2 is secure? What are the weaknesses of SNMPv2?
15
votes
6answers
2k views

Securing OSPF with only passive interfaces

I know that to secure OSPF you should 1) use OSPF authentication, 2) use passive interface command on interfaces that do not have ospf neighbors. If I only use the passive interface command and not ...