Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
5
votes
1answer
355 views

Hardening Cisco router on Internet-MANAGEMENT PLANE

I need confirmation that I understood the Cisco manual right. So my network is like this: ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1 ...
4
votes
2answers
4k views

How to mitigate UDP Flood?

Servers with majority of its traffic in UDP (new connections are expected), what can be used to effectively mitigate UDP flood? For example forged source IPs with variable sized UDP payload (typically ...
4
votes
2answers
374 views

why do we use a layer 2 switch in a DMZ rather than a layer 3?

I've been trying to learn about DMZs. It's hard to find a technical explanation that does not dive head long into the complexities of Cisco hardware, which I'm finding confusing as I'm new to ...
4
votes
1answer
356 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...
4
votes
1answer
209 views

How do we prevent loss of sensitive information from MAC spoofing?

While IP addresses are often dynamically assigned during runtime, hardware addresses (so called MAC addresses) are usually statically allotted when a network interface card is manufactured. What ...
4
votes
4answers
936 views

Encrypting All Network Traffic

For a corporate network, is there a way to possibly encrypt all network traffic on the local network? I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-...
4
votes
1answer
787 views

What is the difference between “Message Digest” and Checksum?

As far as I understand Message Digest is a certain Hash function that is derived from the original payload, so that even if a single bit changes the Message Digest proves to be different, thus ...
4
votes
5answers
1k views

Are there any security advantages to activating VLAN tagging?

I understand the concepts of generating a VLAN. However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?
4
votes
3answers
615 views

What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms. Let's say ...
4
votes
3answers
271 views

Router neighbour config discovery

I am new to the whole networking world and I apologize if this is a re-post of a question. What I want to know is that is there a mechanism for routers to discover its environment. NOT what a ...
4
votes
3answers
536 views

How can I know about if there is a smurf attack on my network?

I have been having network issues. The users report to me problems with the internet, but actually the problem is on my network. I have a sonicwall firewall and the device logs indicate posible tcp ...
4
votes
1answer
2k views

Can you only allow local login when TACACS is unavailable on a Juniper?

I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device. Is there a way to restrict local accounts from being accessed if the router has access to ...
4
votes
1answer
22k views

How should I diagnose why my Cisco ASA denies traffic?

I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 4.2.2.2 on tcp/9000 How can I diagnose why this is happening from the Cisco ASA CLI?
4
votes
2answers
744 views

The Difference Between ACL and FPM

What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.
4
votes
4answers
1k views

Can a VLAN bridge be used to replace a bypass switch with an IPS device?

I am wondering if it's possible to set up a way to remove the need for a bypass switch when using an IPS device. To summarize, I would have an IPS device acting as a virtual wire on a connection I'm ...
4
votes
1answer
661 views

EIGRP MD5 authentication

I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible? ...
4
votes
1answer
985 views

WEP 152bit encryption key… Why?

As stated here: http://documentation.netgear.com/wag102/enu/202-10120-01/v1/WAG102-4-10.html and in many other sources, WEP key can be 64bit, 128bit (factors of 2) and 152bit length. Factor of 2 ...
4
votes
1answer
1k views

Cisco Catalyst 2960 X MAC access list

I am using a MAC access list on this switch, so I go about it by first creating the MAC access list: #conf t #mac access-list extended aclname # permit host XXXX.XXXX.XXXX any Then, I tie this list ...
4
votes
1answer
1k views

What happens with tagged traffic on access port of Cisco switch?

I am broading up more this unanswered question: VLAN tagging and access port Let's assume I am trying to accomplish Double Tagging Attack. From my understanding, prerequisites of this attack is to be ...
4
votes
1answer
757 views

What's the difference between WPA and WPA2?

What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?
4
votes
1answer
2k views

IOS-XE: request system shell vulnerability

Catalyst-3650#request system shell Activity within this shell can jeopardize the functioning of the system. Are you sure you want to continue? [y/n] y Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..] ...
4
votes
1answer
1k views

Are users of Captive Portal wifi (web authentication) vulnerable to sniffing?

I understand that connecting to a wireless network using a WEP/WPA key is also encrypting the data you send over the network, hiding it from potential sniffers in range of the network (please correct ...
4
votes
1answer
255 views

Securing/Hardening Cisco router on Internet

In my company we have Cisco ASA firewall as edge device on the Internet. So outside interface with public IP address and security level 0 and inside interfaces with higher security levels. Standard ...
4
votes
1answer
803 views

IPv6 BGP peering via link-local addresses

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border ...
4
votes
1answer
209 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
3
votes
4answers
103 views

Terminals vs. Secure Access Servers?

I have come across some devices by a companay called "Lantronix" that produce 'Secure Access Servers'. The description makes it sound like they are physical devices that pretty much do what Terminal ...
3
votes
1answer
1k views

Locked myself out of my Cisco switch

I have officially made the dumbest mistake ever. My switch is a Catalyst 2960 Series, configured this way: Current configuration : 10052 bytes ! ! Last configuration change at 19:15:28 UTC Wed Oct ...
3
votes
2answers
95 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
3
votes
2answers
1k views

Splitting a switch with VLANS. Is it secure?

I'm trying to get my head around VLAN terms tagged, untagged, and PVID. From my understanding so far: every port on a switch can be mapped to a particular VLAN. when a packet (assigned to a VLAN) ...
3
votes
1answer
360 views

Per-user network authentication without mac-filtering

I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis. One user may have ...
3
votes
1answer
1k views

Cisco ASA 8.2(5) same security routing issue

I have an ASA 5510 running 8.2(5) with the following configuration and I am having problems routing traffic between sub-interfaces at the same security level. Although not shown there are ACL's for ...
3
votes
2answers
10k views

To Inspect ESMTP on ASA or not?

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing ...
3
votes
1answer
353 views

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? ...
3
votes
1answer
297 views

Must a broadcast request come from the same network?

I was reading about Smurf Attacks and how Smurf Amplifier Registry keeps track of servers used for amplifying the attack, then I wondered, can a request coming from anywhere broadcast it to all parts ...
3
votes
2answers
145 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
3
votes
2answers
411 views

Dynamic ARP Inspection - Does it check port in the binding database?

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis. If PCA (macA,...
3
votes
1answer
140 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
3
votes
1answer
103 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
3
votes
2answers
66 views

How are computer networks protected against continous DHCPREQUEST requests?

A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small. How are ...
3
votes
2answers
608 views

Domain name for SSH

What is the purpose of a domain name to create SSH keys? Before enabling SSH on firewall/router, we need to create domain name. Why is it necessary to do that? What does a domain name do and how is ...
3
votes
1answer
764 views

Firewall behind a firewall

I currently have a NETGEAR FVS338. If I was to connect another firewall of it's type directly to it or to the switch under the first firewall, could I still VPN into the 2nd firewall? I would like to ...
3
votes
1answer
45 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
3
votes
1answer
1k views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
3
votes
1answer
705 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
3
votes
1answer
85 views

Example VLAN without any Router — Security Problems?

I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually ...
3
votes
1answer
4k views

Apple devices causing “Land Attack” on Cisco ASA

Recently migrated to a Cisco ASA/Sourcefire implementation in our enviroment and have been going through the logs on the ASA. Looking over the logs I noticed multiple critical errors that kept coming ...
3
votes
1answer
278 views

How to secure DMZ and client-to-client tunnel?

I found out our DMZ zone is not as secure as it should be. We use NAT to translate internet services from DMZ to internet. We have some developers out of organization. Some of them connect via client-...
3
votes
1answer
602 views

Spoofed 127.0.0.0/8 possible?

If packets with ip source and/or ip destination 127.0.0.0/8 leaves the node, what can possibly happen? Can this be used as an attack vector against control plane (assuming L2 connectivity)? Scenarios:...
3
votes
1answer
320 views

Cisco SG500x-24P - Discard untagged

Cisco SG500X-24P Switch. Goal Only admin tagged frames, discard untagged frames (ingress & egress) Question Is the following configuration correct: Port VLAN Mode: General VLANs: 100T, 200T, ...
3
votes
2answers
2k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...