Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
3
votes
2answers
2k views

How can I implement 802.1x when I need to use intermediate switches?

Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also ...
3
votes
1answer
964 views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
1answer
333 views

Source of Cisco NBAR dropped traffic

I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic. I see the dropped traffic by typing "show policy-map interface XXX" how can i find the source of the ...
3
votes
1answer
917 views

CCP Running issue

I already have installed CCP. but when I run it, it gives this message: Cisco configuration professional requires adobe flash player 10 or above I have Adobe Flash Player 18, and I reset the browser ...
3
votes
1answer
84 views

Malware lab with watchguard firewall

I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already ...
3
votes
1answer
196 views

dmz and ip-phone on medium network

Hi I'm trying to sketch a computer network. The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone. ...
3
votes
1answer
178 views

Does violation restrict still apply within same switch but different port

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back ...
3
votes
1answer
86 views

3rd Party VPN Device Security

One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel. Another vendor wanted to install their VPN device (Cisco ...
3
votes
1answer
59 views

How to secure data transmission over a non-secure Wi-Fi

I connect to a organization's non-secure Wi-Fi provided to guests. it is said that my data transmissions are not private and could be intercepted by others. What can I do to secure my data ...
3
votes
1answer
145 views

How to manage ACL in a routed network

I have a full mesh core network running OSPF. I use OSPF down to the "L3 Agg switches". Now I want to restrict traffic between some of the networks at our site, but how is this done when there is ...
3
votes
1answer
2k views

How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?

How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like ...
3
votes
0answers
46 views

Arp Protect in dynamic VLAN environment

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which ...
3
votes
1answer
1k views

How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
3
votes
3answers
2k views

Cisco Storm-Control default action when an optional action is configured

I have looked through as much Cisco, and other, documentation as I could find on the subject, but I couldn't find a solid answer on this question. The default action for an interface that exceeds the ...
2
votes
3answers
428 views

What's the advantage of having VLANs if you enable inter-vlan routing?

If you configure VLANs with each having their own subnets, is there a point to have them if inter-vlan routing is enabled? Since VLANs will have access to other VLANs, the security argument is not ...
2
votes
2answers
985 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
2
votes
2answers
67 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
2
votes
4answers
2k views

Cisco 1921 security features in the default bundle

Bought a Cisco 1921 router without any additional modules. This is the first time I'm using a non-home router. What security features should I enable so that users are relatively safe when using the ...
2
votes
1answer
280 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
2
votes
2answers
2k views

Splitting a switch with VLANS. Is it secure?

I'm trying to get my head around VLAN terms tagged, untagged, and PVID. From my understanding so far: every port on a switch can be mapped to a particular VLAN. when a packet (assigned to a VLAN) ...
2
votes
1answer
579 views

What is the purpose of native VLAN on a trunk link?

Most VLAN articles I've read recommend avoid using VLAN1 for ports with untagged traffic (aka access ports). I've heard enough of this nonsense. Except for the reserved values of 0x000 and 0xFFF, a ...
2
votes
2answers
76 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
2
votes
2answers
336 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
2
votes
1answer
778 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
1answer
165 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
2
votes
2answers
150 views

Should my internet gateway know about internal network/vlans?

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have ...
2
votes
2answers
3k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
2
votes
1answer
1k views

How can i open a group of ports in ASA 5512?

Am dealing ASA first time. I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on ...
2
votes
1answer
267 views

cisco ACL no counter

We have few access-list and all showing counter for hit but one access list not showing anything. C3850#show access-lists 101 Extended IP access list 101 5 permit ip 101.142.61.0 0.0.0.255 any (7 ...
2
votes
1answer
5k views

Nested private networks (private network within private network) [closed]

I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would ...
2
votes
5answers
359 views

New to Cisco IOS, how can I improve the security of this configuration?

I'm pretty new to IOS and I've been building up a configuration file in Packet Tracer. I still have NAT to setup, as I have to account for a couple of streamers. So, what should I do to configure the ...
2
votes
2answers
1k views

IP-over-IP tunnels - necessary to limit source IPs?

I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer. I would like to know, if I should add additional precautions ...
2
votes
1answer
84 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
1answer
392 views

Comparison of Network Security Models

Our company is comparing and discussing network security models and I would like to know what the "best" model is based on objective measurable data. To aid in this, I am looking for a summary and ...
2
votes
2answers
67 views

private-vlan pimary vlan port not set to promiscuous?

What is the behavior of a port in a private-vlan pimary vlan that isn't set to promiscuous?
2
votes
3answers
5k views

How to secure WiFi with user name and password?

We have internet access in both LAN and WLAN in our offices which is only used to internet access. How do we enable a password based authentication in this infrastructure so that authenticated user ...
2
votes
2answers
2k views

How can I find which natted private IP address is communicating on Cisco ASA 5508

Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall? ...
2
votes
1answer
334 views

How to sandbox internal IPs on the same subnet with one to one NAT

I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal ...
2
votes
1answer
47 views

Phone signaling encryption

If we encrypt the signaling between the phones and call manager but not the voice packets, can the call still be intercepted, reassembled and listened to?
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
2
votes
2answers
423 views

Listen-only (stealth) CDP on IOS

I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
2
votes
1answer
161 views

Best Authentication Practice

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a ...
2
votes
1answer
610 views

Do routers validate the IP packet length?

Do routers verify the actual IP packet size with that mentioned in the packet?
2
votes
1answer
120 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
2
votes
2answers
753 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
1answer
94 views

Cisco port ACL for one IP

I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following: ip address 192.168.1.1 255.255.255.248 My question is, How to create an ACL to limit the connections for ports 80 ...
2
votes
2answers
91 views

Can I access a TOR website without TOR [closed]

I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (...
2
votes
1answer
2k views

Cisco: Storm-control configuration put interface in port-channel in suspended state

I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state. Hardware: 3 stacked 3850 (IOS XE ...
2
votes
4answers
279 views

Does a router add security to front-end servers?

I'm pursuing the reason behind why routers add security to a domain of a server architecture and front-end HTTP and HTTPS servers. Architecture: Assume I get a static IP of 100.100.100.100 from an ...
2
votes
1answer
238 views

On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with ...