34

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return. You need a comprehensive security policy which can include such things as: Physical access limitations 802.1X as @robut ...


26

No, you don't -- technically. But whether you can enter enable mode without one depends on how you log in. Here's the instant gratification version: You can enter via the console without an enable password, but you will be stuck in user mode if you use a simple vty login password without an enable password set. Here's the long-winded StackExchange ...


20

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question. Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs. Is MPLS secure? Ultimately the question of security comes down to one unasked ...


19

IGMP Snooping is a feature for switches to learn what multicast groups are needed on which ports. Routers not handling multicast routing don't care. That said, without an mrouter in the network, you need to configure one (or more) igmp queriers. This ensures group membership reports are flood through the network periodically to keep the forwarding ...


14

There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com. This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server. Then run a "whois" lookup ...


13

As with any new vulnerability, it's impacts are far-reaching. Infrastructure devices are no different. Most of them do incorporate vulnerable OpenSSL packages. It's nearly impossible to compile a listing of every vulnerable product1, since it affects anything that included OpenSSL libraries built with the original OpenSSL TLS heartbeat implementation ...


13

You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to do with VLAN 1 (default VLAN) being set as a native VLAN. You should change the native VLAN from being VLAN 1 to a new VLAN that you create. The native VLAN ...


12

UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind that many services may not reply to arbitrary data and require protocol or application-specific requests in order to warrant a response. Certain ICMP codes can ...


12

This is a quick recipe: 1) Start a packet sniffer: sudo tcpdump -n -i eth2 icmp & [1] 1409 $ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes 2) Send an UDP packet: $ echo reply-me | nc -u 1.0.0.2 1000 3) If you receive 'ICMP port unreachable', that ...


11

Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn: $ ip a s dev br0 3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether fc:aa:14:25:f1:f1 brd ff:ff:ff:ff:ff:ff inet ...


10

A reload is only required when changing encryption features or downgrading a permanent license. You shouldn't have to break your failover pair either. For a failover pair running >8.3(1), you only need a context license on the primary, and the secondary will inherit. Context licenses applied to both units in a failover pair will combine.


10

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. ...


9

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so ...


9

So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)? I have to confess that I mistakenly trusted the Nexus doc below which said only unknown unicast is rate-limited; ...


9

R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip access-group 1 in When i try to ping 10.1.1.1 it returns U.U.U -----> Which means destination host unreachable. The only thing you can do is add no ip unreachables to Serial0/0. This would make pings simply timeout instead of receiving an ICMP ...


9

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. Simply unpluuging it, waiting a few minutes, then plugging it back in should work. Also, Cisco maintains a Password Recovery Procedures web page with links to the ...


9

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be detected. 802.1X has had some serious attack vectors from the start and can only be regarded as a "better than nothing" approach. If you want serious port ...


8

For all practical purposes, NAT and PAT provide no network security, and should not be relied on for that purpose. That said, because PAT often is used with a pool of temporary addresses, a host only has a public address for as long as it is actually sending data to the Internet. If it stops, the translation expires, and the host is no longer reachable ...


8

As @tripleee said in his comment, looks like it is an IP from a reserved block, so it should not be public routable on the Internet (in an ideal world, that is :D). You can check by specifying an explicit whois server, for example $> whois -h whois.ripe.net 243.25.203.20 returns inetnum: 243.0.0.0 - 243.255.255.255 netname: IETF-RESERVED-...


7

If no DHCP clients are connected directly to your distribution or core then you wouldn't need to configure DHCP snooping there. You would just configure your access layer switches to untrust every port except for your uplinks to the distribution switches.


7

Based on your comments, the default sl_def_acl ACL didn't load into your configuration, for whatever reason. The behavior for the login-block feature is to use a quiet mode after certain parameters have been violated. In your case, after 3 failed attempts within 60 seconds will apply a quiet period ACL for 120 seconds. If you haven't explicitly defined a ...


7

Perhaps there is a misunderstanding of how the feature works... this is my base configuration... no explicit ACL is required for the basic functionality to work Baseline configuration before configuring the login block-for feature xconnect01#sh runn | i username|aaa|access-list username cisco privilege 15 password 7 13061E010803 aaa new-model aaa ...


7

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can override that basic function. Once inter-interface/intra-interface is enabled -- thus allowing traffic at all -- ACLs will apply. (You could set interfaces to ...


7

Regarding password complexity for local accounts, you have these options... Cisco NX-OS: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS rejects weak passwords by default. To disable this feature, use no password strength-checking in the global configuration. Cisco IOS: Password length: security password min-length. ...


7

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis? Use 802.1X with PEAP/MSCHAPv2. This authentication scheme will permit you to authenticate your users against a RADIUS ...


7

Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.


7

MAC spoofing is more about LAN disruption than stealing information. I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another host. On a LAN, packets are encapsulated in a frame, and are switched based on the frame. The packet doesn't contain MAC addresses, only the frames do. Switches ...


7

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with IP address 192.168.0.105 is trying to find out whether various link-local addresses are in use. IANA is the authority issuing IP address allocations, so the ...


7

A checksum is the general term used. A checksum can range from a check digit (parity bit) to a complex output string. Different checksums (examples below) can be chosen depending on the application. message digest hash algorithm digital fingerprint randomization function


7

Assuming you are talking about a PSK wireless network, then you misunderstand what is actually taking place. The PSK isn't sent from a client to the AP. Rather it is a common starting point from which the encryption key is built for the session. If the AP and the client have two different PSKs, they will not be able to establish encryption correctly which ...


Only top voted, non community-wiki answers of a minimum length are eligible