Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
3
votes
1answer
934 views

Centralized MAC address database for Cisco switches

I've seen this done before, but not sure how. Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central ...
3
votes
1answer
333 views

Source of Cisco NBAR dropped traffic

I recently implemented Cisco NBAR at a remote sites, edge router. to filter and drop P2P traffic. I see the dropped traffic by typing "show policy-map interface XXX" how can i find the source of the ...
3
votes
1answer
870 views

CCP Running issue

I already have installed CCP. but when I run it, it gives this message: Cisco configuration professional requires adobe flash player 10 or above I have Adobe Flash Player 18, and I reset the browser ...
3
votes
1answer
83 views

Malware lab with watchguard firewall

I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already ...
3
votes
1answer
188 views

dmz and ip-phone on medium network

Hi I'm trying to sketch a computer network. The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone. ...
3
votes
1answer
177 views

Does violation restrict still apply within same switch but different port

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back ...
3
votes
1answer
85 views

3rd Party VPN Device Security

One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel. Another vendor wanted to install their VPN device (Cisco ...
3
votes
1answer
56 views

How to secure data transmission over a non-secure Wi-Fi

I connect to a organization's non-secure Wi-Fi provided to guests. it is said that my data transmissions are not private and could be intercepted by others. What can I do to secure my data ...
3
votes
1answer
143 views

How to manage ACL in a routed network

I have a full mesh core network running OSPF. I use OSPF down to the "L3 Agg switches". Now I want to restrict traffic between some of the networks at our site, but how is this done when there is ...
3
votes
1answer
2k views

How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?

How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like ...
3
votes
1answer
885 views

How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
3
votes
3answers
2k views

Cisco Storm-Control default action when an optional action is configured

I have looked through as much Cisco, and other, documentation as I could find on the subject, but I couldn't find a solid answer on this question. The default action for an interface that exceeds the ...
2
votes
2answers
686 views

How can we identify layer two device in a network or what are those device effects on a frame

This is sample of a traceroute to google.com: TraceRoute from Network-Tools.com to 216.58.194.46 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 ...
2
votes
2answers
58 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
2
votes
4answers
1k views

Cisco 1921 security features in the default bundle

Bought a Cisco 1921 router without any additional modules. This is the first time I'm using a non-home router. What security features should I enable so that users are relatively safe when using the ...
2
votes
1answer
267 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
2
votes
2answers
64 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
2
votes
2answers
303 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
2
votes
1answer
67 views

Is TR-069 a security risk?

My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory ...
2
votes
1answer
261 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
1answer
63 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
2
votes
2answers
133 views

Should my internet gateway know about internal network/vlans?

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have ...
2
votes
2answers
2k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...
2
votes
1answer
1k views

How can i open a group of ports in ASA 5512?

Am dealing ASA first time. I want to install aplplication in my server and it needs some ports to be open in firewall. so i need to open tcp,udp,http,https,ssl ports. How can i configure this on ...
2
votes
1answer
221 views

cisco ACL no counter

We have few access-list and all showing counter for hit but one access list not showing anything. C3850#show access-lists 101 Extended IP access list 101 5 permit ip 101.142.61.0 0.0.0.255 any (7 ...
2
votes
1answer
4k views

Nested private networks (private network within private network) [closed]

I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would ...
2
votes
5answers
332 views

New to Cisco IOS, how can I improve the security of this configuration?

I'm pretty new to IOS and I've been building up a configuration file in Packet Tracer. I still have NAT to setup, as I have to account for a couple of streamers. So, what should I do to configure the ...
2
votes
2answers
1k views

IP-over-IP tunnels - necessary to limit source IPs?

I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer. I would like to know, if I should add additional precautions ...
2
votes
1answer
79 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
1answer
381 views

Comparison of Network Security Models

Our company is comparing and discussing network security models and I would like to know what the "best" model is based on objective measurable data. To aid in this, I am looking for a summary and ...
2
votes
2answers
65 views

private-vlan pimary vlan port not set to promiscuous?

What is the behavior of a port in a private-vlan pimary vlan that isn't set to promiscuous?
2
votes
3answers
5k views

How to secure WiFi with user name and password?

We have internet access in both LAN and WLAN in our offices which is only used to internet access. How do we enable a password based authentication in this infrastructure so that authenticated user ...
2
votes
2answers
2k views

How can I find which natted private IP address is communicating on Cisco ASA 5508

Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall? ...
2
votes
1answer
325 views

How to sandbox internal IPs on the same subnet with one to one NAT

I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal ...
2
votes
1answer
46 views

Phone signaling encryption

If we encrypt the signaling between the phones and call manager but not the voice packets, can the call still be intercepted, reassembled and listened to?
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
2
votes
1answer
160 views

Best Authentication Practice

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a ...
2
votes
1answer
564 views

Do routers validate the IP packet length?

Do routers verify the actual IP packet size with that mentioned in the packet?
2
votes
1answer
117 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
2
votes
4answers
3k views

VLANS vs. subnets for network security and segmentation

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure ...
2
votes
2answers
674 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
1answer
64 views

Cisco port ACL for one IP

I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following: ip address 192.168.1.1 255.255.255.248 My question is, How to create an ACL to limit the connections for ports 80 ...
2
votes
2answers
86 views

Can I access a TOR website without TOR [closed]

I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (...
2
votes
1answer
2k views

Cisco: Storm-control configuration put interface in port-channel in suspended state

I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state. Hardware: 3 stacked 3850 (IOS XE ...
2
votes
4answers
278 views

Does a router add security to front-end servers?

I'm pursuing the reason behind why routers add security to a domain of a server architecture and front-end HTTP and HTTPS servers. Architecture: Assume I get a static IP of 100.100.100.100 from an ...
2
votes
1answer
373 views

Listen-only (stealth) CDP on IOS

I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
2
votes
1answer
237 views

On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?

I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with ...
2
votes
1answer
183 views

Can scapy specify a source IP when used to simulate SYN / UDP flood attacks

I would like to test an IDS in a test network. I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
2
votes
1answer
266 views

Switch-to-Switch Traffic Protection

I am currently working a project dealing with network security, and my question is that what is a feasible way to protect traffic on a switch-to-switch link in a LAN, not end-host-to-end-host ...
2
votes
1answer
227 views

Cisco 0-day CMP exploit

Just found today there is a 0-day exploit in many Cisco switch which use CMP cluster management protocol which allow remote command execution. https://tools.cisco.com/security/center/content/...