Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
2
votes
1answer
569 views

How does S/RTBH work in BGP?

We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe. So, to prevent DDoS we have null routed the destination (...
2
votes
1answer
398 views

Cisco Layer2 ACL and STP

i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only. mac access-list extended PROTECTED permit any host ffff.ffff.ffff 0x800 0x0 permit any host ffff....
2
votes
1answer
207 views

How does Sourcefire IPS understand which application is sending the packet?

I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
2
votes
1answer
547 views

Do I need to setup NAT or ACL configurations for my DMZ setup?

I'm trying to setup a network configuration in my company like the one in the picture below. A web server publicly accessible in the DMZ but insulated from the internal LAN. For the firewall I'm ...
2
votes
1answer
74 views

IPsec tunnel with IPv6 and security gateways

Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german): Tunneling, an essential element of IPsec [...], is problematic for existing ...
2
votes
1answer
2k views

Is a brute force UDP hole punch possible if both external IPs, and both internal ports are known to each client?

So I was just reading about hole punch techniques for UDP and TCP. I read that TCP hole punch can easily be accomplished if a UDP connection has already been established. So here is my theoretical ...
2
votes
1answer
835 views

OSPF with Multiple VLANs

In a Level 3 network with multiple, isolated (i.e. firewalled) VLANs, how does OSPF interact with the VLANs? Specifically: Is it standard to use multiple OSPF instances, i.e. one per VLAN? If the ...
1
vote
3answers
95 views

What's the advantage of having VLANs if you enable inter-vlan routing?

If you configure VLANs with each having their own subnets, is there a point to have them if inter-vlan routing is enabled? Since VLANs will have access to other VLANs, the security argument is not ...
1
vote
3answers
262 views

Use of /30 instead of /31

Besides wasting IP addresses. Is there any other compelling reason to use a /31 subnet over a /30 on Point to Point links? I am interested from a security perspective mainly. Would a /31 be more ...
1
vote
3answers
365 views

Network architecture for a school

I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own ...
1
vote
2answers
61 views

Different Wi-Fi security levels under same private subnet

I'm working on an assignment and I'm given a hypothetical scenario where: A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can ...
1
vote
1answer
41 views

Is this computer a threat? On same network range, but in a workgroup

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server ...
1
vote
3answers
8k views

How can I allow the same MAC address on different ports with port security?

How can I allow my laptop MAC address on every port with port security? Is it even possible? When I try, I get this: SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX Found ...
1
vote
3answers
2k views

Unknown Unicast Flooding

I'm focusing currently on the "Unknown Unicast Flooding", and the proposed solutions from Cisco. I really need deep information about: Cisco Blocking Unknown Unicast Flooding (UUFB) Unknown Unicast ...
1
vote
2answers
124 views

Firewalling of individual ethernet ports in an organization

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on ...
1
vote
2answers
72 views

Single Mode Fiber Optic Connectors

What is the purpose / function of media converters on Single-Fiber mode cable runs? How does this work or is necessary?
1
vote
1answer
2k views

How does a Cisco ACL handle fragments

We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a ...
1
vote
4answers
138 views

Small network security Issue [closed]

I have a router and switch in my institute. The switch is connected 15 PCs in a lab. With little effort, how can i block social sites, video buffering and torrentz.eu downloading? Please suggest a ...
1
vote
1answer
49 views

Why aren't we using digital signatures for the DHCP?

Why aren't we using digital signatures for the DHCP in order to stop Rouge DHCP attacks?
1
vote
1answer
98 views

Unsecured devices and IPv6

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out. There are a lot of horror stories about ...
1
vote
2answers
3k views

Preventing a Cisco router from appearing in a traceroute

I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line: no ip unreachables on the Internet-facing interface, and while this ...
1
vote
6answers
2k views

How can a leased line be securely shared between businesses?

The owner of a business site (in the UK) with about 10 independent business on it (of which I occupy one) is thinking of installing a leased line for shared use by those businesses. He is asking what ...
1
vote
1answer
692 views

JunOS: Using route-filter in policy statements

I am configuring some policy statements on JunOS 11. I am filtering inbound BGP prefixes using the below syntax. It's fairly simply and self explanatory, you can guess whats it's doing just by looking ...
1
vote
1answer
34 views

Rogue Wireless Scanning

Is Rogue Wireless scanning required for a "wired" network? The organization does not have a wireless environment. I am just curious the reasons behind conducting the scan and what is the risk if the ...
1
vote
2answers
91 views

Separate a network within the enterprise environment

What will be the best solution, to securely separate a network and have internet connectivity. In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate ...
1
vote
2answers
749 views

What are the advantages and (if any) disadvantages of putting security on both switches and routers?

I appreciate some of the most obvious advantages of security on both switches and routers are things like stopping unauthorized access and preventing any unwanted configurations. However, I can't ...
1
vote
1answer
35 views

Switch Configuration Security — Signed Configurations

Assume a scenario where a network technician in an organization may remotely access network devices for routine maintenance, but should only be able to set up network configurations (e.g. VLAN ...
1
vote
1answer
2k views

HP ProCurve switch off weak ciphers - disable SSH CBC Mode Ciphers and RC4

Is there any option for HP switches to change/modify used ssh ciphers? For exmaple in cisco we can issue commands: ip ssh server algorithm encryption aes256-ctr ip ssh server algorithm mac hmac-sha1 ...
1
vote
2answers
578 views

Cisco Small Business SG300-10P and Ubiquiti Wireless APs, is is possible to enable IP Source Guard?

Problem: We have our Ubiquiti wireless APs hooked up to an SG300-10P. The user's MAC can roam from AP to AP without asking DHCP for an address. We want to have IP Source Guard enabled as a best ...
1
vote
2answers
1k views

Strange Nmap Scan Results

Sometimes I receive some odd, or inconsistent port scan results. Consider the two following excerpts, copied from my command shell: user@host:~$ nmap 10.1.1.0/24 Starting Nmap 6.47 ( http://nmap.org ...
1
vote
1answer
60 views

In case of an intrusion does changing my private ip/lan ip helps?

In case of an intrusion does changing my private ip/lan ip helps ?
1
vote
1answer
47 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
1
vote
3answers
86 views

How do protocols get blocked even over open ports?

This might be a stupid question, but I'm wondering how a network blocks a protocol like SSH even if the server is listening on port that isn't blocked, like 80. I've even tried port forwarding an non-...
1
vote
1answer
211 views

Are brute force attack on public facing interface of internet router normal?

Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
1
vote
1answer
165 views

Can a fortigate firewall know which device tried to access its restricted url?

In my network, a specific url is being blocked by fortiguard firewall. Now I want to know which all devices had tried to access that blocked url. I traced the mac address inside the packet. But how ...
1
vote
2answers
249 views

Shut down the port when someone plug out the cable

We have Cisco Catalyst 2960-S switches, And we noticed some employees plug out the internet cables to connect them to their Lab top. I want the command that I can use to make the port shutdown when ...
1
vote
1answer
362 views

Self-signed certificate change on Cisco3750

I'm running a script, that checks the configuration changes between the saved and running config. I have noticed, that the hash that goes after crypto pki certificate chain TP-self-signed-34586112 ...
1
vote
1answer
48 views

Cisco Show Privilege via SNMP

How to get Cisco privilege level via SNMP? R1#show privilege Current privilege level is 15 Which MIB or OID?
1
vote
1answer
848 views

Is there anyway to set Quota for users in Fortigate?

someone told me that there is a solution for setting Quota in New FortiOS (v5.4), but i can't find anything to do that. i just want to know, is there anyway to set Quota for my local internet users, ...
1
vote
3answers
1k views

BGP community blackhole

We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic. ISP said use 64682:0 community for RTBH, I did ...
1
vote
2answers
57 views

Unidirectional Subnet Communication

Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly. Essentially my question is this: Is it possible to allow subnet S1to ...
1
vote
1answer
47 views

Privilege levels

PacketTracer does not support the function of associating views with specific users, therefore I tried another approach. My goal is to have two different users, one with privilege 15 and one with ...
1
vote
1answer
139 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
1
vote
2answers
73 views

Partitioning servers from the rest of the network

I'm an undergraduate looking for ways to experiment with network security techniques on my residential local area network, so much of this is going to be very new to me. Forgive me in advance for ...
1
vote
1answer
465 views

Multiple DHCP Offers - Which is selected? [closed]

I have created a testing scenario in VMWare for a man in the middle attack using DHCP spoofing. It's for a college project. Windows 8 machine bridged to host adapter Kali linux bridged to host ...
1
vote
1answer
50 views

Cisco ASA looping broadcast packet

I have small office where running cisco ASA ASA5506 and version 9.4(1) and it's also configured for IPsec VPN tunnel, My LAN subnet is 10.1.1.0/24 So i have found very interesting things in LAN ...
1
vote
1answer
51 views

SDN Flow-modification attack

What are the steps that can be taken to prevent flow-modification attacks on an SDN controller? The attack would look as follows(As seen by the image): Does OpenDaylight or any other controller have ...
1
vote
1answer
126 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
1
vote
1answer
49 views

Protect Cisco C3560CX switch from unauthorized access on remote location

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch. What are the best practices in this case/scenario? So, I will shut down password ...
1
vote
1answer
42 views

Network Security Tunnel

In the Tunnel Interface, when I edit the tunnel information, it shows: Attributes Values Tunnel Source IF10 Tunnel Destination 1.0.0.1 Tunnel Mode GRE What does IF10 ...