34

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return. You need a comprehensive security policy which can include such things as: Physical access limitations 802.1X as @robut ...


26

No, you don't -- technically. But whether you can enter enable mode without one depends on how you log in. Here's the instant gratification version: You can enter via the console without an enable password, but you will be stuck in user mode if you use a simple vty login password without an enable password set. Here's the long-winded StackExchange ...


20

IGMP Snooping is a feature for switches to learn what multicast groups are needed on which ports. Routers not handling multicast routing don't care. That said, without an mrouter in the network, you need to configure one (or more) igmp queriers. This ensures group membership reports are flood through the network periodically to keep the forwarding ...


14

You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to do with VLAN 1 (default VLAN) being set as a native VLAN. You should change the native VLAN from being VLAN 1 to a new VLAN that you create. The native VLAN ...


13

As with any new vulnerability, it's impacts are far-reaching. Infrastructure devices are no different. Most of them do incorporate vulnerable OpenSSL packages. It's nearly impossible to compile a listing of every vulnerable product1, since it affects anything that included OpenSSL libraries built with the original OpenSSL TLS heartbeat implementation ...


12

UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind that many services may not reply to arbitrary data and require protocol or application-specific requests in order to warrant a response. Certain ICMP codes can ...


12

This is a quick recipe: 1) Start a packet sniffer: sudo tcpdump -n -i eth2 icmp & [1] 1409 $ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes 2) Send an UDP packet: $ echo reply-me | nc -u 1.0.0.2 1000 3) If you receive 'ICMP port unreachable', that ...


12

Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn: $ ip a s dev br0 3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether fc:aa:14:25:f1:f1 brd ff:ff:ff:ff:ff:ff inet ...


10

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. ...


9

R1(config)#access-list 1 R1(config)#Deny 20.1.1.1 R1(config)#Permit any R1(config)# int s0/0 R1(config-if)#ip access-group 1 in When i try to ping 10.1.1.1 it returns U.U.U -----> Which means destination host unreachable. The only thing you can do is add no ip unreachables to Serial0/0. This would make pings simply timeout instead of receiving an ICMP ...


9

So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)? I have to confess that I mistakenly trusted the Nexus doc below which said only unknown unicast is rate-limited; ...


9

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. Simply unpluuging it, waiting a few minutes, then plugging it back in should work. Also, Cisco maintains a Password Recovery Procedures web page with links to the ...


9

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be detected. 802.1X has had some serious attack vectors from the start and can only be regarded as a "better than nothing" approach. If you want serious port ...


8

For all practical purposes, NAT and PAT provide no network security, and should not be relied on for that purpose. That said, because PAT often is used with a pool of temporary addresses, a host only has a public address for as long as it is actually sending data to the Internet. If it stops, the translation expires, and the host is no longer reachable ...


8

As @tripleee said in his comment, looks like it is an IP from a reserved block, so it should not be public routable on the Internet (in an ideal world, that is :D). You can check by specifying an explicit whois server, for example $> whois -h whois.ripe.net 243.25.203.20 returns inetnum: 243.0.0.0 - 243.255.255.255 netname: IETF-RESERVED-...


7

Perhaps there is a misunderstanding of how the feature works... this is my base configuration... no explicit ACL is required for the basic functionality to work Baseline configuration before configuring the login block-for feature xconnect01#sh runn | i username|aaa|access-list username cisco privilege 15 password 7 13061E010803 aaa new-model aaa ...


7

Based on your comments, the default sl_def_acl ACL didn't load into your configuration, for whatever reason. The behavior for the login-block feature is to use a quiet mode after certain parameters have been violated. In your case, after 3 failed attempts within 60 seconds will apply a quiet period ACL for 120 seconds. If you haven't explicitly defined a ...


7

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can override that basic function. Once inter-interface/intra-interface is enabled -- thus allowing traffic at all -- ACLs will apply. (You could set interfaces to ...


7

Regarding password complexity for local accounts, you have these options... Cisco NX-OS: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS rejects weak passwords by default. To disable this feature, use no password strength-checking in the global configuration. Cisco IOS: Password length: security password min-length. ...


7

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis? Use 802.1X with PEAP/MSCHAPv2. This authentication scheme will permit you to authenticate your users against a RADIUS ...


7

Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.


7

MAC spoofing is more about LAN disruption than stealing information. I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another host. On a LAN, packets are encapsulated in a frame, and are switched based on the frame. The packet doesn't contain MAC addresses, only the frames do. Switches ...


7

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with IP address 192.168.0.105 is trying to find out whether various link-local addresses are in use. IANA is the authority issuing IP address allocations, so the ...


7

A checksum is the general term used. A checksum can range from a check digit (parity bit) to a complex output string. Different checksums (examples below) can be chosen depending on the application. message digest hash algorithm digital fingerprint randomization function


7

Assuming you are talking about a PSK wireless network, then you misunderstand what is actually taking place. The PSK isn't sent from a client to the AP. Rather it is a common starting point from which the encryption key is built for the session. If the AP and the client have two different PSKs, they will not be able to establish encryption correctly which ...


7

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way: The WAN MACsec offering is standards based but offers additional capabilities not found in earlier MACsec capabilities. More specifically, MACsec can be leveraged by ...


7

MACsec actually adds to the ethernet frame header and trailer. You end up with a different value in the Ether Type field position, much like you do with 802.1Q, but the original Ether Type field is preserved.


7

The situation you describe is very similar to what cost Target* many millions of dollars when its network was hacked, and customer information was stolen. Never let another company have something with unfettered access to your network. You have not vetted the employees, subcontractors, or security of the other company. When that company gets hacked, the ...


6

Web authentication is really more of a means to limit/allow guest access on a clear network that requires no additional client configuration to connect. It is not meant as a way of providing secure access. So, unless the client only uses encrypted sessions (HTTPS, SSH, SFTP, VPN, etc.), then they are far more secure using a PSK than web authentication. ...


6

There are a couple of options for you, depending on how much money and time you want to invest. At the complex/high end, you can configure 802.1x authentication so that only domain users can access the wired network. This involves buying/building a radius server, tying that to your domain controller and configuring the switch to query the radius server ...


Only top voted, non community-wiki answers of a minimum length are eligible