34

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return. You need a comprehensive security policy which can include such things as: Physical access limitations 802.1X as @robut ...


29

Lucas's answer above is a bit of a starting point. There are however two or three other things that must be considered. These end up being somewhat outside the scope of network engineering, but certainly have impacts for network engineering and security so here they go. You probably want some way of preventing wireless cards in company laptops from ...


24

One issue is that authentication ensures that only trusted devices are capable of exchanging routes on the network. Without authentication, you could introduce a non-trusted device and cause significant routing issues. For example: If area 0 is not authenticated, attach a router in area 0 with bogus routes to null0. You could even create a default route ...


24

No, you don't -- technically. But whether you can enter enable mode without one depends on how you log in. Here's the instant gratification version: You can enter via the console without an enable password, but you will be stuck in user mode if you use a simple vty login password without an enable password set. Here's the long-winded StackExchange ...


21

If SNMPv3 is not an option you can do some things to help secure SNMPv2 better. Don't enable the Read-Write string. There are very few reasons to enabled it. Choose community strings that are more complex and remove any that are 'private' or 'public'. Use an access-list on the community string to restrict what IP addresses can poll the device. Do not enable ...


20

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question. Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs. Is MPLS secure? Ultimately the question of security comes down to one unasked ...


16

IGMP Snooping is a feature for switches to learn what multicast groups are needed on which ports. Routers not handling multicast routing don't care. That said, without an mrouter in the network, you need to configure one (or more) igmp queriers. This ensures group membership reports are flood through the network periodically to keep the forwarding ...


14

SNMPv2 should not be used especially if SNMPv3 is available. There are some basic flaws in SNMPv2, predominantly the use of community strings which are sent over the network in an unencrypted form to query the network infrastructure. Also it's based on a community string instead of a separate username/password combination, SNMPv2 (and 1 for that matter) ...


14

First of all you need to build a policy prohibiting introducing network equipment into the network which is not owned by or approved by the company IT department. Next enforce port security so that unknown mac addresses cannot connect to your network. Third set up a separate wireless network under your control (if you give them what they want they are less ...


14

Fully agreed with Stefan. VRF is the way to go here. Quick example how to incorporate it to suggested config: ip vrf VLAN1 rd 42:1 ip vrf VLAN2 rd 42:2 ! int vlan1 ip vrf forwarding VLAN1 ip address 1.1.1.1 255.255.255.0 int vlan2 ip vrf forwading VLAN2 ip address 2.2.2.2 255.255.255.0 ! Now vlan1 and vlan2 routing is separated. To inspect ...


13

BGP TTL security makes your router only accept packets that have a very high TTL number, typically 254. Since TTL is decremented every time a packet is routed, configuring this feature on both neighbors ensures that only a directly connected neighbor router could have sent you this packet.


13

Merely putting personal-use internet on a different subnet is normally not sufficient unless that subnet is firewalled from the rest of the company; there are all kinds of internet vulnerabilities that hijack a users' PC and pose a threat to your company unless you are smart about protecting yourself. This is one example of a innocent-looking Wordpress ...


13

Even though dropbox uses AWS, they can be blocked... Blocking Dropbox I use an address-based approach for stuff like this, just lookup the address blocks that said company owns and filter it... Using Robtex information for AS19679 (Dropbox) to block dropbox... object-group network DROPBOX_AS19679 network-object 108.160.160.0 255.255.240.0 network-...


13

There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com. This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server. Then run a "whois" lookup ...


13

As with any new vulnerability, it's impacts are far-reaching. Infrastructure devices are no different. Most of them do incorporate vulnerable OpenSSL packages. It's nearly impossible to compile a listing of every vulnerable product1, since it affects anything that included OpenSSL libraries built with the original OpenSSL TLS heartbeat implementation ...


12

That should work. Either that or use something like: R1(config)#ip access-list extended MATCH-ALL R1(config-ext-nacl)#permit ip any any R1(config-ext-nacl)#class-map type inspect match-any CM_MATCH-ALL R1(config-cmap)#match access-group name MATCH-ALL R1(config-cmap)#policy-map type inspect PM_IN->OUT R1(config-pmap)#class CM_MATCH-ALL R1(config-pmap-c)#...


11

This really depends on the network topology and size, budget, and of course, your security policies! My answer below isn't really a direct answer to your question. If you post a topology map or give further information, a more precise answer can be given. Instead I have given some guidelines on IPSs in general, that apply to various situations including the ...


11

UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind that many services may not reply to arbitrary data and require protocol or application-specific requests in order to warrant a response. Certain ICMP codes can ...


11

You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to do with VLAN 1 (default VLAN) being set as a native VLAN. You should change the native VLAN from being VLAN 1 to a new VLAN that you create. The native VLAN ...


10

"Connectors"??? The blue distribution block? (possibly a distribution amp) The little "caps" -- actually terminators? Or the RG-59 compression crimps on the cables? It's as secure as the cabinet. (which is often not that secure) Almost everything on a cable network these days is encrypted, so a physical tap wouldn't do as much good as you might think. And ...


10

A reload is only required when changing encryption features or downgrading a permanent license. You shouldn't have to break your failover pair either. For a failover pair running >8.3(1), you only need a context license on the primary, and the secondary will inherit. Context licenses applied to both units in a failover pair will combine.


10

Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses? Using Facebook as an example... We police their bandwidth to a small fraction of our total directly on our ASA (because another group in the company owns the web-proxy). I normally lookup the ASN of the company (Facebook is 32934), then I go to http://as.robtex.com/...


9

Whereas SNMPv3 is significantly more secure than v2, you can at least mitigate some of the risk of implementing v2 by restricting access with an ACL. I would also advise against creating a read/write v2 community.


9

While ACLs are a simple and safe way, it doesn't scale well indeed. If your router provides VRF or at least the the VRF Lite feature you could group VLANs into VRFs. A VRF can be seen like a virtual router, VRF instances cannot talk to each other unless you explicitely define routing between them. In a complex network, I group VLANs into several security ...


9

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so ...


9

So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)? I have to confess that I mistakenly trusted the Nexus doc below which said only unknown unicast is rate-limited; ...


9

R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip access-group 1 in When i try to ping 10.1.1.1 it returns U.U.U -----> Which means destination host unreachable. The only thing you can do is add no ip unreachables to Serial0/0. This would make pings simply timeout instead of receiving an ICMP ...


9

This is a quick recipe: 1) Start a packet sniffer: sudo tcpdump -n -i eth2 icmp & [1] 1409 $ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes 2) Send an UDP packet: $ echo reply-me | nc -u 1.0.0.2 1000 3) If you receive 'ICMP port unreachable', that ...


9

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. Simply unpluuging it, waiting a few minutes, then plugging it back in should work. Also, Cisco maintains a Password Recovery Procedures web page with links to the ...


9

Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn: $ ip a s dev br0 3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether fc:aa:14:25:f1:f1 brd ff:ff:ff:ff:ff:ff inet ...


Only top voted, non community-wiki answers of a minimum length are eligible