4

No. When you establish a connection and ask a server to send you information, the server must know where to send the answer. So it needs to know your IP address. Even in the few cases where you send an information and don't require any response, this is simply not how the IP protocol works. A packet always contains the source and destination IP addresses, ...


4

SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their own key pairs, pack half of it into a CSR, an submit them using some HTTPish request. I used to run SCEP on Cisco gear for a few banks' IKEv2 based site to site ...


3

Is there a quick way using the Solarwinds modules we have to determine patch levels of our networking equipment, ASA firewalls, Aggregation Services Routers, VPN concentrators, Firepower Threat Defense etc. to see which device is vulnerable to which vulnerabilities which are shown by CVE numbers like CVE 2020-3452? If so, how? Yes and no. You can easily ...


3

For requirement , If client wants to access server which is hosted behind firewall hosted on another networks . Portforwarding is required . In firewall Souce : Client IP address Destination as : Server IP address Service port : RDP (TCP-3389) Action : Allow Security profile : ON


3

Generally all the application traffic is encrypted and send through networks and decrypted after reaching destination using SSL and TLS versions etc . It's not mandatory to use external encryption and decryption devices . IPsec is provided security purposes . IPsec is combination of two protocols , AH , ESP. confidential, intigrity , authentication of data ...


3

According to your requirement chosee the devices required Generally a network engineer motive should always be optimised , scalable realiable, secure network design and implementation ... Router(Edge router) Firewall(perimeter firewall) L3 switch(core switch) L2 switch (access switch) Router ISP internet link should land the this router , DNS forwarded ...


2

Vlans and inter-Vlan concepts are directly proportional to each other VLAN is defined as logical segmentation of network .. VLANs can segregate traffic according to our requirement .. By default different Vlàns traffic won't talk to each other . To ensure communication between different VLANs inter-Vlan routing need to be enabled at layer3 devices ..


2

But how is it more secure or why should we prefer it over the transport mode for given scenario? When using ESP, both tunnel and transport mode encrypt the payload. Tunnel mode also encrypts the addresses of the hosts, while transport does not. In addition, tunnel mode allows you to "hide" all the internal addresses, while transport mode requires that ...


2

If it's a hop on the path that a client (user) accesses publicly, whether a final destination (such as a webserver), or just a proxy/firewall, etc. that leads to another hop, it needs to sit in the DMZ and not be inside of your internal network. This way, no holes need to be punched for direct user access into your internal network, and only holes between ...


2

Trying to use some kind of retaliation is a bad idea. The source IP address you see may be spoofed, or some kind of amplification attack may be used. It is also quite possible that the attacker notices your attempts and intensifies the attack - very often, they've got significant resources, so beware. Retaliating likely solves no problem and causes new ones. ...


2

There isn't a show command that shows this information. Invalidated sessions are sessions that are due for cleanup/deletion, holding them in memory so that they could be viewed may present other issues. The behavior can change slightly depending on some configuration settings (i.e. set security flow tcp-session rst-invalidate-session). If your issue is a ...


1

That depends on your definition of secure. VPN can provide a secure link over an insecure network (e.g. the Internet) where the transported data cannot be listened in or manipulated by any third party. It's often called an overlay network because it creates a network (link) on top of another network. The nodes you connect through VPN become direct link ...


1

When using a VPN you are creating a connection into a network to which you would not otherwise have any access. (corp network, etc.) If you are connected to more than one, you become a potential insecure bridge between them. While a node in one network cannot directly reach anything in the other network(s), you can, so any compromised thing in one network ...


1

Destination server might be reseting or terminating session so that session is closed and unable to access resources on servers from outside networks When services on specific ports are not in listening mode session will get reseted or terminated at destination server end . To overcome this issue . please ensure services on specific ports are in listening ...


1

"Terminate" has two major meanings: It can mean filter or break a connection, or (much more likely here) it can mean "provide an endpoint" (accept a socket connection or create a tunnel end).


1

If my router's address is static and known, can people flood it with excessive amount of garbage packets? All they need is the known IP address. Of course, your router drops all traffic that doesn't fit one of its policies/connections. If this ever happens, can I do anything about it? If it's a clear attack you can ask your ISP for help. Especially ...


1

Generally "show xlate" command display the nat translation . For more visibility check ASA firewall traffic logs to find private IP address translation when dynamic NAT is in use .


1

I believe every device which supports a FIPS mode will allow generating encryption keys and certificate signing requests locally (JunOS KB example.) This allows you to avoid extracting crypto material from the device. It shouldn't be possible to be FIPS-compliant without these features. That doesn't necessarily mean they'll support specific key management ...


1

The issue is I have several IP cameras upstairs and downstairs and I have only one router capable of VLAN in my whole network. The constraint: Downstairs and upstairs are connected via a single cable. That won't work. An unmanaged switch can only be connected to a single VLAN. A connection can only be used for a single VLAN unless both sides support VLANs (=...


1

Blocking Internet access at the router isn't enough as a compromised camera can still do a lot of damage in your network. The camera/device doesn't necessarily be attacked directly from the Internet, it's possible to exploit vulnerabilities through other attack vectors (other compromised hosts, cross-site scripting, ...). VLANs are the way to go. They allow ...


1

The ability to specify TLS version was added in IOS-XE 16.4.1 so you will want to make sure you have that version or later. To specify version you can use the following commands: ip http server tls-version TLSv1.2 ip http client tls-version TLSv1.2 Reference document: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/https/configuration/xe-16-5/https-xe-16-...


1

Yes, applications can listen on a specific IP address / port, rather than listening for that port on all IPs. A common use-case is when running different web server software on two different IPs. This question is probably better-suited to the superuser section of Stack Exchange. To expand a bit, listening for port 80 on any IP on a system works roughly ...


1

Vlan allowed features allow us to allows only specific Vlans which we are specifying on trunk port . **For example ** Switch (config)#int f0/1 Switch(config)#switchport mode trunk Switch(config)Switchport trunk allowed vlan 10,20,30 Switch(config)#no shutdown Allowing specifically Vlan is good practice instead of allowing all vlans because network is ...


Only top voted, non community-wiki answers of a minimum length are eligible