Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
3
votes
1answer
2k views

How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?

How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like ...
7
votes
1answer
5k views

Configuring a password policy on Cisco IOS or NX-OS

I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know ...
0
votes
1answer
843 views

How does ingress filtering protect against legitimate spoof packets?

I am learning about Ingress Filtering where unauthorised packets are filtered out from entering the network. To get a better understanding of it , I found an article which said: the system ...
3
votes
1answer
1k views

Cisco ASA 8.2(5) same security routing issue

I have an ASA 5510 running 8.2(5) with the following configuration and I am having problems routing traffic between sub-interfaces at the same security level. Although not shown there are ACL's for ...
4
votes
1answer
2k views

IOS-XE: request system shell vulnerability

Catalyst-3650#request system shell Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..] ...
3
votes
1answer
643 views

Spoofed 127.0.0.0/8 possible?

If packets with ip source and/or ip destination 127.0.0.0/8 leaves the node, what can possibly happen? Can this be used as an attack vector against control plane (assuming L2 connectivity)? Scenarios:...
7
votes
2answers
560 views

Switch security when in an unsecured location

I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots ...
1
vote
3answers
392 views

Network architecture for a school

I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own ...
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
3
votes
1answer
324 views

Cisco SG500x-24P - Discard untagged

Cisco SG500X-24P Switch. Goal Only admin tagged frames, discard untagged frames (ingress & egress) Question Is the following configuration correct: Port VLAN Mode: General VLANs: 100T, 200T, ...
2
votes
2answers
418 views

Listen-only (stealth) CDP on IOS

I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
2
votes
1answer
161 views

Best Authentication Practice

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a ...
2
votes
1answer
238 views

On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with ...
5
votes
1answer
1k views

Are users of Captive Portal wifi (web authentication) vulnerable to sniffing?

I understand that connecting to a wireless network using a WEP/WPA key is also encrypting the data you send over the network, hiding it from potential sniffers in range of the network (please correct ...
14
votes
1answer
2k views

Enterprise Network Equipment vulnerable to heartbleed

On 09/04/2014 the The Heartbleed vulerability was disclosed by the OpenSSL team. The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness ...
2
votes
1answer
605 views

Do routers validate the IP packet length?

Do routers verify the actual IP packet size with that mentioned in the packet?
0
votes
2answers
2k views

NAT vs PAT Security

i don't know if i have duplicated a questions..but then i still want to ask which one is more risky to be deploy in networking will it be PAT or NAT PAT will make it risky for routing as it will ...
7
votes
2answers
15k views

Securing Cisco device from brute force attacks

I'm trying to block users from configuring a Cisco IOS device if they have entered incorrect passwords a number of times. This is the command I'm using: Router(config)# login block-for 120 attempts 3 ...
4
votes
1answer
668 views

EIGRP MD5 authentication

I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible? ...
3
votes
2answers
729 views

Domain name for SSH

What is the purpose of a domain name to create SSH keys? Before enabling SSH on firewall/router, we need to create domain name. Why is it necessary to do that? What does a domain name do and how is ...
3
votes
2answers
2k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...
3
votes
1answer
962 views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
2answers
10k views

To Inspect ESMTP on ASA or not?

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing ...
9
votes
2answers
2k views

Are IPv6 Wildcard Matches in Cisco IOS Possible?

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as ...
6
votes
2answers
5k views

Change Ping Response for Traffic Blocked by Access Control List

I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1. I have created the ACL: R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip ...
6
votes
1answer
4k views

Cisco: storm-control unicast

Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though. Reading the Cisco docs online ...
6
votes
2answers
182 views

Help with basic network security issue

I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now ...
4
votes
2answers
763 views

The Difference Between ACL and FPM

What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
5
votes
1answer
1k views

Is Layer 3 web auth with Layer 2 PSK more secure?

I have configured a Cisco WLC to authenticate users using External Web Authentication at Layer 3. Are client wifi connections more resilient against eavesdroppers with a pre-shared key at Layer 2 ...
2
votes
2answers
1k views

IP-over-IP tunnels - necessary to limit source IPs?

I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer. I would like to know, if I should add additional precautions ...
15
votes
3answers
21k views

MPLS vs Encrypted VPNs - traffic security?

Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no ...
1
vote
1answer
696 views

JunOS: Using route-filter in policy statements

I am configuring some policy statements on JunOS 11. I am filtering inbound BGP prefixes using the below syntax. It's fairly simply and self explanatory, you can guess whats it's doing just by looking ...
8
votes
1answer
2k views

DHCP-Snooping on 3com S4210

I'm setting up dhcp snooping with IP source guard and DAI on some 3com S4210 switches. I found problem with recording bindings in snooping database. In some cases I know that there is PC connected to ...
5
votes
2answers
2k views

Cisco commands to find rogue access point connected

Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). ...
4
votes
1answer
1k views

WEP 152bit encryption key… Why?

As stated here: http://documentation.netgear.com/wag102/enu/202-10120-01/v1/WAG102-4-10.html and in many other sources, WEP key can be 64bit, 128bit (factors of 2) and 152bit length. Factor of 2 ...
4
votes
3answers
273 views

Router neighbour config discovery

I am new to the whole networking world and I apologize if this is a re-post of a question. What I want to know is that is there a mechanism for routers to discover its environment. NOT what a ...
14
votes
5answers
35k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
5
votes
3answers
1k views

RA VPN notification

I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/...
8
votes
3answers
791 views

Placement of firewall for VPN RA and L2L tunnels

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX ...
3
votes
1answer
866 views

Firewall behind a firewall

I currently have a NETGEAR FVS338. If I was to connect another firewall of it's type directly to it or to the switch under the first firewall, could I still VPN into the 2nd firewall? I would like to ...
7
votes
1answer
1k views

DHCP Snooping Confusion

I'm trying to work out how to enable dhcp snooping and dynamic arp inspection on our guest network and I'm a little confused.... Here's the situation: We have a hub and spoke topology, with a ...
3
votes
1answer
86 views

3rd Party VPN Device Security

One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel. Another vendor wanted to install their VPN device (Cisco ...
7
votes
2answers
12k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
10
votes
1answer
500 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
4
votes
4answers
953 views

Encrypting All Network Traffic

For a corporate network, is there a way to possibly encrypt all network traffic on the local network? I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-...
11
votes
2answers
3k views

Extend MACSec encryption over provider bridge

I already asked this question on SF, but figured it might be a better fit here. Is it at all possible to extend MACSec encryption over a provider bridge? Will the typical 802.1ad implementation be ...
10
votes
2answers
11k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
8
votes
2answers
3k views

Is ICMP spoofing practical?

How practical is ICMP spoofing? scenario 1: in a NAT environment, how does NAT keep track of ICMP sessions (not technically sessions since it's not connection-oriented?) For ECHO/ECHO response ...
6
votes
1answer
4k views

DNS options Ironport Web security appliance

I'm running a Ironport WSA in transparent mode. In advanced proxy config - DNS Options I find the following: Find web server by: Specify how the appliance should find the location of the requested ...
6
votes
4answers
724 views

How risky is a personal-use-only wireless subnet inside the corporate subnet?

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...