6
Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly.
The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have ...
5
Social engineering is one of the greatest risks associated with network security. Your first goal would be to present the ease of access to network resources and devices as a security risk. Depending on what kind of data your company deals with, you can schedule a PCI audit OR you can sell the idea of one to the higher-ups as a benefit to your company's ...
5
You can't have more than one access list per direction on an interface. So, to accomplish this, you will have to create a unique access-list for each interface that allows only the traffic you want.
5
The any eq 80 filters for the source port - applying that to a HTTP client makes it near impossible to connect to the server. HTTP clients use ephemeral source ports (49152-65535).
Since you don't know a client's source port you can only filter by destination port
permit tcp any host 10.23.3.10 eq 80
4
There is an implicit "deny" at the end of every access-list. So your current access-list actually says:
access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
access-list 111 deny ip any any
This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP ...
4
As far as I know, the only thing which uses the "opposite mask" are the "wildcard bits" of access control lists in Cisco equipment. These can represent hosts or networks (and portions or aggregations of networks), but in practice they don't represent hosts because they are optional on Cisco IOS:
ip access-list standard NTPCLIENTS
permit 192.168.0.0 0.0....
4
You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in authentication methods that are available in most enterprise grade Wifi-controllers. Also look into limiting access for the Wifi network only to resources that ...
4
You can still ping the router IP because the ACL is only applied to traffic passing through the interface and not to the interface itself.
Well if you want to make it as described, you'll have to do it like this:
vlan 1 - 192.168.0.0/24
vlan 10 - 192.168.10.0/24
vlan 20 - 192.168.20.0/24
vlan 50 - 192.168.50.0/24
access-list 10 deny 192.168.50.0 0.0.0....
3
Access lists work on a first-match basis. The traffic will be compared to the list, starting with the first statement in the list. As soon as a match is found, then the router exits the list.
3
You are using the wrong command.
ip ssh source-interface command defines the source IP when starting an SSH session from the router. It has no effect on other traffic.
To control who can SSH into your router, you use an ACL and access-class.
ip access-list standard ALLOW-SSH
permit 192.168.100.0 0.0.0.255
line vty 0 15
transport ssh
access-class ALLOW-...
3
You are confusing routing with traffic flow. The routing protocol is used to learn networks from other routers. It does not directly affect the flow of traffic. If you want to block access to the host Server from 192.268.3.0/27, you want to block IP packets. So your access list would look something like this;
access-list 106 deny ip 192.168.3.0 0.0.0....
3
The root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the scope of this SE.
It is good practice to disable root access to your juniper devices. Most environments disable it in a few different ways.
blank out the ...
3
Nodes back off a random amount of time after a collision before trying to transmit. This prevents all the nodes from trying to transmit at the same time after a collision, causing another collision.
3
Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped.
When you put the ACL in the outbound direction, then packet are coming from VLAN 20, and the packets are allowed.
2
There are lots of ways to use Cisco routers with advanced routing features that can do what you are looking to do. They all fall under "Quality of Service," or QoS for short. Cisco routers can regulate bandwidth in many many ways, such as marking, prioritization, queueing, bandwidth shaping, and traffic engineering.
It sounds like you want to make sure that ...
2
Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your tampering immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in the tunnel.
There are two possibilities at play here:
the ASA isn't configured to hairpin traffic
the ASA isn't configured to allow those networks through the ...
2
Private VLANS are a layer 2 technology. To filter specific ports, you need something that operates at layer 4. There are virtualized firewalls that would be applied per VM that could do this for you.
2
You want to deny IP packets from that network. Update the first line of your ACL to read access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server and you should be good.
The fact that OSPF is your dynamic routing protocol has no impact on this question, it's just extra information that is throwing you off.
2
Shared physical media: only one device on the shared media can access it at any given time, the rest has to wait.
Halfduplex point to point links, uses the same physical media in both directions. It is the same frequency and point to point electromagnetic wave/channel.
It is halfduplex as a radio can only transmit or receive at a given point in time. The ...
2
If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming packet.
Port forwarding will allow publicly addressed packets toward a particular private address. The ACL could then include only the source address and RDP port ...
2
If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the "show ip access-list [...]" output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use show tcam int x/y acl in|out protocol, while for other Catalyst ...
2
Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https on 218. This has solved my problem.
2
Access control lists operate at layers 3 and 4 of the OSI or TCP/IP model. File operations like reading and writing are application layer functions, so network ACLs have little or no control at that layer.
If you think about it, reading a file can be very different depending on the application. Are you using FTP? A word processing program? A database ...
2
First off, CSMA/CD is ancient and hopefully not in serious use any more.
The timing for coax (10BASE5/2) is 16 BT for the potential collision detection delay followed by 32 BT jam time for all PHYs. PHYs with distinct transmit/receive channels (-T, -F) detect collisions earlier than coax.
After that, the random pause is started, its size increasing with ...
2
If I understand correctly, the problem is how to charge users based on how fast they consume data, rather than (or in addition to) how much data they consumed
Cisco IOS has a "show interfaces" command, where you can see this:
GigabitEthernet2/11 is up, line protocol is up (connected)
...
...
5 minute input rate 24871000 bits/sec, 2649 packets/sec
...
2
If you want to measure traffic and charge users based on how much traffic they generate, you will need to configure Netflow (or similar) to record traffic use.
If you want to limit each users' share of bandwidth, you can configure your router to limit each user's share of the available bandwidth.
Both require commercial-grade devices. You should consider ...
2
The problem is that you don't have the access option on the ASA snmp-server user command like you do on IOS.
snmp-server user username group-name { v3 [ encrypted ]] [ auth { md5 | sha ]} auth-password [ priv [
des | 3des | aes ] [ 128 | 192 | 256 ] priv-password
As Ricky Beam points out, you use the snmp-server host command to restict the host access:
...
2
Considering that your ruleset is correct... Have you checked on the switch side? There might be an access-class configured on your vty.
p.s. you may want to use packet-tracer on ASA to check if traffic would be permited or just check the logbuffer via CLI/ASDM to see what is really going on.
Let me know if you need any help.
2
By default, directed broadcasts are filtered on ingress for all interfaces. You need to enable directed-broadcast forwarding on the incoming interface.
In the interface config context you need to
ip directed-broadcast
An ACE is only required with an active ACL on the interface not allowing this otherwise. Filtering to specific source addresses/patterns ...
2
You can place an extended ACL where you want (as long as it is in the path of the packet you want to filter of course). However, depending on the filtering parameters, it is usually better to put it close to the source. This way, undesirable traffic is denied close to the source network without crossing the network infrastructure, which limit bandwidth usage....
Only top voted, non community-wiki answers of a minimum length are eligible
