9
PAT is used to translate multiple private IP addresses to a single public IP address.
PAT is used for internet connectivity mostly..
Static NAT is used to translate a single private IP address with a single public IP address. When application is hosted in the internal network wants to access application from internet static NATting is used. It's one to one ...
6
Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly.
The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have ...
5
Social engineering is one of the greatest risks associated with network security. Your first goal would be to present the ease of access to network resources and devices as a security risk. Depending on what kind of data your company deals with, you can schedule a PCI audit OR you can sell the idea of one to the higher-ups as a benefit to your company's ...
5
You can't have more than one access list per direction on an interface. So, to accomplish this, you will have to create a unique access-list for each interface that allows only the traffic you want.
5
The any eq 80 filters for the source port - applying that to a HTTP client makes it near impossible to connect to the server. HTTP clients use ephemeral source ports (49152-65535).
Since you don't know a client's source port you can only filter by destination port
permit tcp any host 10.23.3.10 eq 80
4
There is an implicit "deny" at the end of every access-list. So your current access-list actually says:
access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
access-list 111 deny ip any any
This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP ...
4
Static NAT is used to translate a single private IP address with a single public IP address. When application is hosted in the internal network wants to access application from internet static NATting is used. It's one to one NATting ...
Configuration part as below
Firstly servers should assigned static ip and make sure servers are reachable from router ...
4
As far as I know, the only thing which uses the "opposite mask" are the "wildcard bits" of access control lists in Cisco equipment. These can represent hosts or networks (and portions or aggregations of networks), but in practice they don't represent hosts because they are optional on Cisco IOS:
ip access-list standard NTPCLIENTS
permit 192.168.0.0 0.0....
4
You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in authentication methods that are available in most enterprise grade Wifi-controllers. Also look into limiting access for the Wifi network only to resources that ...
4
You can still ping the router IP because the ACL is only applied to traffic passing through the interface and not to the interface itself.
Well if you want to make it as described, you'll have to do it like this:
vlan 1 - 192.168.0.0/24
vlan 10 - 192.168.10.0/24
vlan 20 - 192.168.20.0/24
vlan 50 - 192.168.50.0/24
access-list 10 deny 192.168.50.0 0.0.0....
3
Access lists work on a first-match basis. The traffic will be compared to the list, starting with the first statement in the list. As soon as a match is found, then the router exits the list.
3
You are using the wrong command.
ip ssh source-interface command defines the source IP when starting an SSH session from the router. It has no effect on other traffic.
To control who can SSH into your router, you use an ACL and access-class.
ip access-list standard ALLOW-SSH
permit 192.168.100.0 0.0.0.255
line vty 0 15
transport ssh
access-class ALLOW-...
3
You are confusing routing with traffic flow. The routing protocol is used to learn networks from other routers. It does not directly affect the flow of traffic. If you want to block access to the host Server from 192.268.3.0/27, you want to block IP packets. So your access list would look something like this;
access-list 106 deny ip 192.168.3.0 0.0.0....
3
The root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the scope of this SE.
It is good practice to disable root access to your juniper devices. Most environments disable it in a few different ways.
blank out the ...
3
Nodes back off a random amount of time after a collision before trying to transmit. This prevents all the nodes from trying to transmit at the same time after a collision, causing another collision.
3
Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped.
When you put the ACL in the outbound direction, then packet are coming from VLAN 20, and the packets are allowed.
3
The best and possible option are
connect two networks with point to point leased line and Configure static route on both sites
connect two networks with ISP can configure IPsec site -Site tunnel to smoothly exchange traffic between two sites .
3 ) connect two networks with ISP can configure ipsec- GRE tunnel .
Even natting can be done at both ends to ...
3
Port adress translation is for outbound traffic
Static nat is for inbound traffic..
2
There are lots of ways to use Cisco routers with advanced routing features that can do what you are looking to do. They all fall under "Quality of Service," or QoS for short. Cisco routers can regulate bandwidth in many many ways, such as marking, prioritization, queueing, bandwidth shaping, and traffic engineering.
It sounds like you want to make sure that ...
2
Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your tampering immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in the tunnel.
There are two possibilities at play here:
the ASA isn't configured to hairpin traffic
the ASA isn't configured to allow those networks through the ...
2
Private VLANS are a layer 2 technology. To filter specific ports, you need something that operates at layer 4. There are virtualized firewalls that would be applied per VM that could do this for you.
2
You want to deny IP packets from that network. Update the first line of your ACL to read access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server and you should be good.
The fact that OSPF is your dynamic routing protocol has no impact on this question, it's just extra information that is throwing you off.
2
Shared physical media: only one device on the shared media can access it at any given time, the rest has to wait.
Halfduplex point to point links, uses the same physical media in both directions. It is the same frequency and point to point electromagnetic wave/channel.
It is halfduplex as a radio can only transmit or receive at a given point in time. The ...
2
If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming packet.
Port forwarding will allow publicly addressed packets toward a particular private address. The ACL could then include only the source address and RDP port ...
2
If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use show tcam int x/y acl in|out protocol, while for other Catalyst ...
2
Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https on 218. This has solved my problem.
2
Access control lists operate at layers 3 and 4 of the OSI or TCP/IP model. File operations like reading and writing are application layer functions, so network ACLs have little or no control at that layer.
If you think about it, reading a file can be very different depending on the application. Are you using FTP? A word processing program? A database ...
2
First off, CSMA/CD is ancient and hopefully not in serious use any more.
The timing for coax (10BASE5/2) is 16 BT for the potential collision detection delay followed by 32 BT jam time for all PHYs. PHYs with distinct transmit/receive channels (-T, -F) detect collisions earlier than coax.
After that, the random pause is started, its size increasing with ...
2
If I understand correctly, the problem is how to charge users based on how fast they consume data, rather than (or in addition to) how much data they consumed
Cisco IOS has a "show interfaces" command, where you can see this:
GigabitEthernet2/11 is up, line protocol is up (connected)
...
...
5 minute input rate 24871000 bits/sec, 2649 packets/sec
...
2
If you want to measure traffic and charge users based on how much traffic they generate, you will need to configure Netflow (or similar) to record traffic use.
If you want to limit each users' share of bandwidth, you can configure your router to limit each user's share of the available bandwidth.
Both require commercial-grade devices. You should consider ...
Only top voted, non community-wiki answers of a minimum length are eligible
