You Can Have My Network When You Pry It From My Cold, Stiff Hands
|
|
|
- Daisy Short
- 6 years ago
- Views:
Transcription
1 Raising the Bar for the Attacker You Can Have My Network When You Pry It From My Cold, Stiff Hands Greg Scheidel
2 What Does Nirvana Look Like? Defensible Network [1] Limits an Intruder s Freedom to Maneuver Facilitates Monitoring (Can be Watched) Offers a Minimum Number of Services Is Maintainable (Can be Kept Current) DON T MAKE IT EASY RAISE THE BAR! [1] Bejtlich, Richard. The Tao of Network Security Monitoring: beyond Intrusion Detection. Addison-Wesley, 2010, pp Greg Scheidel (@greg_scheidel) 2
3 Reality Bites We re responsible for network security Network security is heavily dependent on network architecture We don t usually control network architecture We don t usually get to design the network from scratch Greg Scheidel (@greg_scheidel) 3
4 Techniques and Strategies Remember that security serves the business Don t get discouraged! Get embedded in organizational processes (e.g., technical review board, change control) Build relationships with network architects and system admins Understand the network architecture and offer concrete suggestions Greg Scheidel (@greg_scheidel) 4
5 Consistent IP Addressing Facilitates Network Administration Facilitates Triage / Investigation / Incident Response Facilitates Filtering and Monitoring via Firewall Rules and ACLs Greg Scheidel (@greg_scheidel) 5
6 Consistent IP Addressing: Example Remote Offices: x.0 / x.0 : Subnet x.1 : Gateway x.[8-15] : Servers x.[16-23] : Printers x.[ ] : Users New York Chicago / / x.255 : Broadcast [ ] (users) [ ] (users) Greg Scheidel (@greg_scheidel) 6
7 Cisco Wildcard Mask: Basics Standard mask /24 = s = network portion of the IP address, 0s = host portion All the 1s are on the left, all the 0s are on the right Wildcard mask /24 = s = static portion of the IP address, 1s = dynamic portion 1s and 0s can be intermingled x.50 = mask In other words: Greg Scheidel (@greg_scheidel) 7
8 Cisco Wildcard Mask: Analysis We re interested in addresses x.[ ]: x xxxx xxxx Mask uses 0 for bits that are always the same across all possible addresses; 1 for bits that change: Greg Scheidel (@greg_scheidel) 8
9 Cisco Wildcard Mask: Configuration Cisco Configuration:! Match on x.[ ] -> x.[ ] access list 101 deny ip log-input access list 101 permit ip any any! Apply to the interface facing the user subnet, inbound traffic interface <interface> ip access-group 101 in Greg Scheidel 9
10 Cisco Wildcard Mask: Application! access list 101 deny ip log-input access list 101 permit ip any any Apply ACL on interface facing user User -> Remote User > : > : DENIED DENIED New York Chicago / / 24 User -> Server > : > : Allowed Allowed OK OK User -> Local User > : > : (not filtered) (not filtered) [ ] (users) [ ] (users) Greg Scheidel (@greg_scheidel) 10
11 PVLAN: Basics PVLAN = Private VLAN Further Isolates Traffic Within a VLAN Layer 2 (L2) Traffic Control Port Types - control communications within the VLAN: Promiscuous: Communicate with any port Isolated: Communicate only with promiscuous ports Community: Communicate with promiscuous ports or ports in the same community Greg Scheidel (@greg_scheidel) 11
12 PVLAN: Illustrated Example Host PVLAN Port Type L2 Communications Limited To Ports Firewall Promiscuous All Ports FTP Server Isolated Firewall, DNS SSH Server Isolated Firewall, DNS DNS Server Promiscuous All Ports Web Server A Community #1 Firewall, DNS, Web Server B Web Server B Community #1 Firewall, DNS, Web Server A Firewall x.1 L3 Network x / L2 VLAN 200 FTP x.10 DNS x.20 SSH x.30 Firewall [promiscuous] DNS [promiscuous] FTP Server [isolated] SSH Server [isolated] WS-A WS-B Web Server A [community #1] Web Server B [community #1] x.40 x Greg Scheidel (@greg_scheidel) 12
13 PVLAN: Example More Details Host PVLAN Port Type L2 Communications Limited To Ports Switch Port Secondary VLAN ID Firewall Promiscuous All Ports eth 1/3 n/a FTP Server Isolated Firewall, DNS eth 1/1 301 SSH Server Isolated Firewall, DNS eth 1/6 301 DNS Server Promiscuous All Ports eth 1/5 n/a Web Server A Community #1 Firewall, DNS, Web Server B eth 1/2 302 Web Server B Community #1 Firewall, DNS, Web Server A eth 1/4 302 Primary VLAN ID is the VLAN that is being further segregated Secondary VLAN IDs identify VLANs to use for isolated and promiscuous ports within the primary VLAN Greg Scheidel (@greg_scheidel) 13
14 PVLAN: Example Config (1 of 3) Cisco Configuration:! Configure VLAN 200 as the primary VLAN so that it can contain individual PVLANs vlan 200 private-vlan primary! Configure VLAN 301 as a secondary VLAN: community PVLAN for the web servers using NLB vlan 301 private-vlan community! Configure VLAN 302 as a secondary VLAN: isolated PVLAN for the FTP and SSH servers vlan 302 private-vlan isolated! Associate the primary VLAN and the secondary VLANs vlan 200 private-vlan association add 301, Greg Scheidel (@greg_scheidel) 14
15 PVLAN: Example Config (2 of 3) Cisco Configuration (more ):! Configure the switch ports with the appropriate primary and secondary VLAN associations interface ethernet 1/1 description FTP server - PVLAN isolated switchport mode private-vlan host switchport private-vlan host-association interface ethernet 1/2 description Web Server A - PVLAN community #1 switchport mode private-vlan host switchport private-vlan host-association interface ethernet 1/3 description Firewall - PVLAN promiscuous switchport mode private-vlan promiscuous switchport private-vlan mapping , Greg Scheidel (@greg_scheidel) 15
16 PVLAN: Example Config (3 of 3) Cisco Configuration (last bit, I promise ): interface ethernet 1/4 description Web Server B - PVLAN community #1 switchport mode private-vlan host switchport private-vlan host-association interface ethernet 1/5 description DNS - PVLAN promiscuous switchport mode private-vlan promiscuous switchport private-vlan mapping ,302 interface ethernet 1/6 description SSH server - PVLAN isolated switchport mode private-vlan host switchport private-vlan host-association Greg Scheidel (@greg_scheidel) 16
17 PVLAN: Application to User Traffic! vlan 302 private-vlan isolated vlan 200 private-vlan primary private-vlan association add 302 interface ethernet 1/1 description router interface switchport mode private-vlan promiscuous switchport private-vlan mapping interface ethernet 1/2-24 switchport mode private-vlan host switchport private-vlan host-association New York Chicago / / Configure PVLAN on access switches User -> Local User > : > : DENIED DENIED [ ] (users) [ ] (users) Greg Scheidel (@greg_scheidel) 17
18 PVLAN: Fatal Flaw and Easy Fix Host IP Address MAC Address Router AA:AA:AA:AA:AA:AA Local User A BB:BB:BB:BB:BB:BB Local User B ??? PVLAN Bypass Packet: [BB:BB:BB:BB:BB:BB] -> [AA:AA:AA:AA:AA:AA] Router happily routes back to local subnet, bypassing PVLAN control Fix - VACL or ACL: access list 101 deny ip log-input access list 101 permit ip any any Already covered by our existing ACL (for the user segment, at least) Greg Scheidel (@greg_scheidel) 18
19 ACL + PVLAN = Block User -> User! Apply ACL on interface facing user Configure PVLAN on access switches User -> Remote User > : > : User -> Server > : > : User -> Local User > : > : DENIED DENIED Allowed Allowed DENIED DENIED New York Chicago / / [ ] (users) [ ] (users) Greg Scheidel (@greg_scheidel) 19
20 In Closing Build relationships with network architects; participate in their processes You can build (or upgrade to) a defensible network Remember that every block is an opportunity to detect Defend like it s your own network because it is! Greg Scheidel (@greg_scheidel) 20
21 Contact Information G REG S CHEIDEL C Y B E R S E C U R I T Y E N G I N E E g r e g _ s c h e i d e l www. I V S E C. C O M Greg Scheidel (@greg_scheidel) 21
CCNP Switch Questions/Answers Implementing VLANs in Campus Networks
Refer to the exhibit. Given the configuration information of the CAT1 and CAT2 switches, which statement is true? A. LACP will form a channel between the switches. B. Because the port-channel numbers do
Configuring Private VLANs
This chapter contains the following sections: Information About Private VLANs, page 1 Guidelines and Limitations for Private VLANs, page 6 Configuring a Private VLAN, page 6 Verifying Private VLAN Configuration,
MAC Address Filtering Setup (3G18Wn)
MAC Address Filtering Setup (3G18Wn) MAC Address Filtering MAC address filtering refers to the process of allowing (or denying) access to your wireless network based on the hardware address of the device
Access Control Lists and IP Fragments
Access Control Lists and IP Fragments Document ID: 8014 Contents Introduction Types of ACL Entries ACL Rules Flowchart How Packets Can Match an ACL Example 1 Example 2 fragments Keyword Scenarios Scenario
Configuring Private VLANs Using NX-OS
This chapter describes how to configure private VLANs on Cisco NX-OS devices. Private VLANs provide additional protection at the Layer 2 level. This chapter includes the following sections: Finding Feature
Configuring Web Cache Services By Using WCCP
CHAPTER 44 Configuring Web Cache Services By Using WCCP This chapter describes how to configure your Catalyst 3560 switch to redirect traffic to wide-area application engines (such as the Cisco Cache Engine
Antonio Cianfrani. Access Control List (ACL) Part I
Antonio Cianfrani Access Control List (ACL) Part I Index ACL? How to configure Standard ACL Extended ACL Named ACL Limiting the vty access ACL (1/3) Control lists applied to traffic incoming in / outgoing
Chapter 10 Lab 10-2, Securing VLANs INSTRUCTOR VERSION
CCNPv7.1 SWITCH Chapter 10 Lab 10-2, Securing VLANs INSTRUCTOR VERSION Topology Objectives Background Secure the server farm using private VLANs. Secure the staff VLAN from the student VLAN. Secure the
Cisco CCNA ACL Part II
Cisco CCNA ACL Part II Cisco CCNA Access List Applications This slide illustrates common uses for IP access lists. While this chapter focuses on IP access lists, the concept of access lists as mechanisms
CCNA Discovery 3 Chapter 8 Reading Organizer
Name Date Chapter 8 Reading Organizer After completion of this chapter, you should be able to: Describe traffic filtering and explain how Access Control Lists (ACLs) can filter traffic at router interfaces.
Sybex CCENT Chapter 12: Security. Instructor & Todd Lammle
Sybex CCENT 100-101 Chapter 12: Security Instructor & Todd Lammle Chapter 12 Objectives The CCENT Topics Covered in this chapter include: IP Services Describe the types, features, and applications of ACLs
Data Center Network Infrastructure
Data Center Network Infrastructure Data Center Definition A data center is a facility used for housing a large amount of electronic equipment, typically computers and communications equipment. is usually
Lab - Troubleshooting ACL Configuration and Placement Topology
Topology 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 8 Addressing Table Objectives Device Interface IP Address Subnet Mask Default Gateway HQ G0/1 192.168.1.1
Network Protocols - Revision
Network Protocols - Revision Luke Anderson luke@lukeanderson.com.au 18 th May 2018 University Of Sydney Overview 1. The Layers 1.1 OSI Model 1.2 Layer 1: Physical 1.3 Layer 2: Data Link MAC Addresses 1.4
Configuring Private VLANs
36 CHAPTER This chapter describes private VLANs (PVLANs) on Catalyst 4500 series switches. It also provides restrictions, procedures, and configuration examples. This chapter includes the following major
CCNA Access List Questions
CCNA Access List Questions Here you will find answers to CCNA Access list questions Note: If you are not sure about how to use Access list, please read my Access list tutorial Question 1 Your boss is learning
Configuring Cache Services Using the Web Cache Communication Protocol
Configuring Cache Services Using the Web Cache Communication Protocol Finding Feature Information, page 1 Prerequisites for WCCP, page 1 Restrictions for WCCP, page 2 Information About WCCP, page 3 How
Network Security. The Art of War in The LAN Land. Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, September 27th, 2018
Network Security The Art of War in The LAN Land Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, September 27th, 2018 Part I MAC Attacks MAC Address/CAM Table Review 48 Bit Hexadecimal Number Creates Unique
Configuring PPP over Ethernet with NAT
CHAPTER 3 The Cisco Secure Router 520 Ethernet-to-Ethernet routers support Point-to-Point Protocol over Ethernet (PPPoE) clients and network address translation (NAT). Multiple PCs can be connected to
Lab Configuring and Verifying Extended ACLs Topology
Topology 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 8 Addressing Table Objectives Device Interface IP Address Subnet Mask Default Gateway R1 G0/1 192.168.10.1
Bridging Traffic CHAPTER3
CHAPTER3 This chapter describes how clients and servers communicate through the ACE using either Layer 2 (L2) or Layer 3 (L3) in a VLAN configuration. When the client-side and server-side VLANs are on
Understanding Access Control Lists (ACLs) Semester 2 v3.1
1 Understanding Access Control Lists (ACLs) Access Control Lists 2 Access control lists (ACLs) are lists of instructions you apply to a router's interface. These lists tell the router what kinds of packets
Information about Network Security with ACLs
This chapter describes how to configure network security on the switch by using access control lists (ACLs), which in commands and tables are also referred to as access lists. Finding Feature Information,
Wireless Client Isolation. Overview. Bridge Mode Client Isolation. Configuration
Wireless Client Isolation Overview Wireless Client Isolation is a security feature that prevents wireless clients from communicating with one another. This feature is useful for guest and BYOD SSIDs adding
Object Groups for ACLs
The feature lets you classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs) to create access control policies for those groups. This feature lets you use
Configuring VLAN ACLs
35 CHAPTER This chapter describes how to configure VLAN ACLs (VACLs) on Catalyst 6500 series switches. Note For complete syntax and usage information for the commands used in this chapter, refer to the
Router and ACL ACL Filter traffic ACL: The Three Ps One ACL per protocol One ACL per direction One ACL per interface
CCNA4 Chapter 5 * Router and ACL By default, a router does not have any ACLs configured and therefore does not filter traffic. Traffic that enters the router is routed according to the routing table. *
Configuring Private Hosts
CHAPTER 25 This chapter describes how to configure the private hosts feature in Cisco IOS Release 12.2SX. Note For complete syntax and usage information for the commands used in this chapter, see the Cisco
Configuring IPv4. Finding Feature Information. This chapter contains the following sections:
This chapter contains the following sections: Finding Feature Information, page 1 Information About IPv4, page 2 Virtualization Support for IPv4, page 6 Licensing Requirements for IPv4, page 6 Prerequisites
Chapter 2 VLANs. CHAPTER 2 VLANs
[ 52 ] Chapter 2 Beginning in Version 6.2 of the PIX firewall, there is support for subinterfaces, trunk links, and. The PIX and ASA can support 802.1q encapsulation and a number of logical interfaces
Configuring Commonly Used IP ACLs
Configuring Commonly Used IP ACLs Document ID: 26448 Contents Introduction Prerequisites Requirements Components Used Conventions Configuration Examples Allow a Select Host to Access the Network Deny a
Configuring Private VLANs
36 CHAPTER This chapter describes private VLANs (PVLANs) on Catalyst 4500 series switches. It also provides restrictions, procedures, and configuration examples. This chapter includes the following major
Match-in-VRF Support for NAT
The feature supports Network Address Translation (NAT) of packets that communicate between two hosts within the same VPN routing and forwarding (VRF) instance. In intra-vpn NAT, both the local and global
Inspection of Router-Generated Traffic
Inspection of Router-Generated Traffic The Inspection of Router-Generated Traffic feature allows Context-Based Access Control (CBAC) to inspect traffic that is originated by or destined to the router on
Broadcast Infrastructure Cybersecurity - Part 2
SBE Webinar Series - 2018 Broadcast Infrastructure Cybersecurity - Part 2 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services KAMU FM-TV Broadcast Infrastructure Cybersecurity
Extended ACL Configuration Mode Commands
Extended ACL Configuration Mode Commands To create and modify extended access lists on a WAAS device for controlling access to interfaces or applications, use the ip access-list extended global configuration
Support for policy-based routing applies to the Barracuda Web Security Gateway running version 6.x only.
Support for policy-based routing applies to the Barracuda Web Security Gateway running version 6.x only. Transparently Routing Web Traffic to the Barracuda Web Security Gateway This article demonstrates
Lab - Configure a NIC to Use DHCP in Windows
Introduction In this lab, you will configure an Ethernet NIC to use DHCP to obtain an IP address and test connectivity between two computers. Recommended Equipment Wireless router Two computers running
Advanced Security and Forensic Computing
Advanced Security and Forensic Computing Unit 2: Network Security Elements Dr Dr Bill Buchanan, Reader, School of of Computing. >Unit 2: 2: Network Security Elements Advanced Security and Forensic Computing
Network Configuration Example
Network Configuration Example Configuring Private VLANs on a QFX Switch Using Extended Functionality Modified: 2016-08-01 Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089 USA 408-745-2000
Lab Configuring and Verifying Standard ACLs Topology
Topology 2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 9 Addressing Table Objectives Device Interface IP Address Subnet Mask Default Gateway R1 G0/1 192.168.10.1
Configuring Private VLANs
Finding Feature Information, on page 1 Prerequisites for Private VLANs, on page 1 Restrictions for Private VLANs, on page 1 Information About Private VLANs, on page 2 How to Configure Private VLANs, on
Lab - Troubleshooting Standard IPv4 ACL Configuration and Placement Topology
Lab - Troubleshooting Standard IPv4 ACL Configuration and Placement Topology 2016 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 8 Addressing Table Objectives
Unit 4: Firewalls (I)
Unit 4: Firewalls (I) What is a firewall? Types of firewalls Packet Filtering Statefull Application and Circuit Proxy Firewall services and limitations Writing firewall rules Example 1 Example 2 What is
Object Groups for ACLs
The feature lets you classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs) to create access control policies for those groups. This feature lets you use
Chapter 8: Subnetting IP networks. Introduction to Networks v5.1
Chapter 8: Subnetting IP networks Introduction to Networks v5.1 8.0 Introduction 8.1 Subnetting an IPv4 Network 8.2 Addressing Schemes 8.3 Design Considerations for IPv6 8.4 Summary 2013 Cisco and/or its
Configuring Layer 3 Interfaces
This chapter contains the following sections: Information About Layer 3 Interfaces, page 1 Licensing Requirements for Layer 3 Interfaces, page 4 Guidelines and Limitations for Layer 3 Interfaces, page
CyberPatriot Packet Tracer Tool Kit
CyberPatriot Packet Tracer Tool Kit https://www.uscyberpatriot.org/competition/training-materials/training-modules https://www.netacad.com/ http://www.uscyberpatriot.org/documents/training%20documents/cyberpatriot%20route
Implementing Traffic Filtering with ACLs
Implementing Traffic Filtering with ACLs Managing Network Device Security 2013 Cisco Systems, Inc. ICND1 3-36 How can you restrict Internet access for PC2? 2013 Cisco Systems, Inc. ICND1 3-37 ACL operation
Lab 6: Access Lists. Device Interface IP Address Subnet Mask Gateway/Clock Rate Fa 0/ R1
Lab 6: Access Lists Network Topology:- Device Interface IP Address Subnet Mask Gateway/Clock Rate Fa 0/0 192.168.0.1 255.255.255.0 ----- R1 Fa 0/1 192.168.10.1 255.255.255.0 ----- Se 0/0/0 10.0.0.1 255.255.255.252
Teacher s Reference Manual
UNIVERSITY OF MUMBAI Teacher s Reference Manual Subject: Security in Computing Practical with effect from the academic year 2018 2019 Practical 1: Packet Tracer - Configure Cisco Routers for Syslog, NTP,
Application Note 3Com VCX Connect with SIP Trunking - Configuration Guide
Application Note 3Com VCX Connect with SIP Trunking - Configuration Guide 28 May 2009 3Com VCX Connect Solution SIP Trunking Table of Contents 1 3COM VCX CONNECT AND INGATE... 1 1.1 SIP TRUNKING SUPPORT...
6 Network Security Elements
6 Network Security Elements http://www.asecuritysite.com/security/information/chapter06 6.1 Objectives The key objectives of this unit are to: Provide an overview of security devices and infrastructures.
Firewall Policy. Edit Firewall Policy/ACL CHAPTER7. Configure a Firewall Before Using the Firewall Policy Feature
CHAPTER7 The feature lets you view and modify firewall configurations access rules and CBAC inspection rules in the context of the interfaces whose traffic they filter. Using a graphical representation
Interconnecting Cisco Networking Devices Part 1 (ICND1) Course Overview
Interconnecting Cisco Networking Devices Part 1 (ICND1) Course Overview This course will teach students about building a simple network, establishing internet connectivity, managing network device security,
Introduction to Network Security Missouri S&T University CPE 5420 Network Access Control
Introduction to Network Security Missouri S&T University CPE 5420 Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology cetinkayae@mst.edu
CSC 4900 Computer Networks: Network Layer
CSC 4900 Computer Networks: Network Layer Professor Henry Carter Fall 2017 Chapter 4: Network Layer 4. 1 Introduction 4.2 What s inside a router 4.3 IP: Internet Protocol Datagram format 4.4 Generalized
Configuring Private VLANs
CHAPTER 15 This chapter describes how to configure private VLANs on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco
2002, Cisco Systems, Inc. All rights reserved.
2002, Cisco Systems, Inc. All rights reserved. Configuring IP Access Lists 2002, Cisco Systems, Inc. All All rights reserved. ICND v2.0 6-2 2 Objectives Upon completing this lesson, you will be able to:
VLAN Access Control Lists
VLAN access control lists (ACLs) or VLAN maps access-control all packets (bridged and routed). You can use VLAN maps to filter traffic between devices in the same VLAN. VLAN maps are configured to provide
WHITE PAPER: IRONSHIELD BEST PRACTICES MANAGEMENT VLANS
Written By: Philip Kwan April 2003 April 2003 2003 Foundry Networks, Inc. Summary The IronShield Best Practices: Management VLANs document is designed to help network and security administrators understand
Why Firewalls? Firewall Characteristics
Why Firewalls? Firewalls are effective to: Protect local systems. Protect network-based security threats. Provide secured and controlled access to Internet. Provide restricted and controlled access from
VLAN Access Control Lists
VLAN access control lists (ACLs) or VLAN maps access-control all packets (bridged and routed). You can use VLAN maps to filter traffic between devices in the same VLAN. VLAN maps are configured to provide
ActualTorrent. Professional company engaging Providing Valid Actual Torrent file for qualification exams.
ActualTorrent http://www.actualtorrent.com/ Professional company engaging Providing Valid Actual Torrent file for qualification exams. Exam : 300-206 Title : Implementing Cisco Edge Network Security Solutions
Configuring Secure (Router) Mode, Redundancy, Fault Tolerance, and HSRP
CHAPTER 4 Configuring Secure (Router) Mode, Redundancy, Fault Tolerance, and HSRP This chapter describes how to configure the following aspects of content switching that are necessary for the Content Services
Internetwork Expert s CCNA Security Bootcamp. Mitigating Layer 2 Attacks. Layer 2 Mitigation Overview
Internetwork Expert s CCNA Security Bootcamp Mitigating Layer 2 Attacks http:// Layer 2 Mitigation Overview The network is only as secure as its weakest link If layer 2 is compromised, all layers above
Security SSID Selection: Broadcast SSID:
69 Security SSID Selection: Broadcast SSID: WMM: Encryption: Select the SSID that the security settings will apply to. If Disabled, then the device will not be broadcasting the SSID. Therefore it will
Chapter 4 Network Layer: The Data Plane
Chapter 4 Network Layer: The Data Plane A note on the use of these Powerpoint slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you see
Cisco Networking Academy CCNP
Semester 3 v5 -Chapter 8 Cisco Networking Academy CCNP Minimizing Service Loss and Data Theft in a Campus Network Switch security concerns Network security coverage often focuses on edge-routing devices
A specific IP with specific Ports and Protocols uses a dedicated WAN (Load Balance Policy).
21. Multiple WAN Vigor 3300Bplus has three WAN interfaces, while Vigor 3300 and Vigor 3300V both have four WAN interfaces. With the Load Balance feature, you can use multiple WAN links simultaneously.
Understanding and Configuring Private VLANs
CHAPTER 8 This chapter describes private VLANs on the Catalyst 4000 family switches. It also provides guidelines, procedures, and configuration examples. This chapter includes the following major sections:
ASA/PIX Security Appliance
I N D E X A AAA, implementing, 27 28 access to ASA/PIX Security Appliance monitoring, 150 151 securing, 147 150 to websites, blocking, 153 155 access control, 30 access policies, creating for web and mail
Configuring DHCP. About DHCP Snooping, page 2 About the DHCPv6 Relay Agent, page 8
This chapter describes how to configure the Dynamic Host Configuration Protocol (DHCP) on a Cisco NX-OS device. This chapter includes the following sections: About DHCP Snooping, page 2 About the DHCP
Configuring Layer 3 Interfaces
This chapter contains the following sections: Information About Layer 3 Interfaces, page 1 Licensing Requirements for Layer 3 Interfaces, page 4 Guidelines and Limitations for Layer 3 Interfaces, page
Configuring DHCP Snooping
15 CHAPTER This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping on an NX-OS device. This chapter includes the following sections: Information About DHCP Snooping,
Routers use access lists to control incoming or outgoing traffic. You should know the following characteristics of an access list.
8.1. Access List Routers use access lists to control incoming or outgoing traffic. You should know the following characteristics of an access list. Access lists describe the traffic type that will be controlled.
DOWNLOAD PDF CISCO ASA 5505 CONFIGURATION GUIDE
Chapter 1 : Cisco ASA DMZ Configuration Example â Speak Network Solutions Cisco ASA Quick Start Guide. Step 1 Connect the power supply adaptor to the power cable.. Step 2 Connect the rectangular connector
Securing CS-MARS C H A P T E R
C H A P T E R 4 Securing CS-MARS A Security Information Management (SIM) system can contain a tremendous amount of sensitive information. This is because it receives event logs from security systems throughout
Lecture (04) Using VLANs to segment LANs. Dr. Ahmed M. ElShafee. Dr. Ahmed ElShafee, ACU Spring 2014, Practical Applications in Computer Networks 4.
Lecture (04) Using VLANs to segment LANs Dr. Ahmed M. ElShafee ١ 4.0 ٢ Topology ٣ item Configuration item Configuration Gateway Gateway PC1 DNS Port status Band width Duplex On PC2 DNS Port status Band
DC-228. ADSL2+ Modem/Router. User Manual. -Annex A- Version: 1.0
DC-228 ADSL2+ Modem/Router -Annex A- User Manual Version: 1.0 TABLE OF CONTENTS 1 PACKAGE CONTENTS...3 2 PRODUCT LAYOUT...4 3 NETWORK + SYSTEM REQUIREMENTS...6 4 DC-228 PLACEMENT...6 5 SETUP LAN, WAN...7
Finding Feature Information, page 2 Information About DHCP Snooping, page 2 Information About the DHCPv6 Relay Agent, page 8
This chapter describes how to configure the Dynamic Host Configuration Protocol (DHCP) on a Cisco NX-OS device. This chapter includes the following sections: Finding Feature Information, page 2 Information
Lab - Configure the Firewall in Windows 8
Introduction In this lab, you will explore the Windows Firewall and configure some advanced settings. Recommended Equipment Two computers directly connected or connected over the network Windows 8 installed
Network Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 6 Firewalls & VPNs Topics Firewall Fundamentals Case
How to Install Forcepoint NGFW in Amazon AWS TECHNICAL DOCUMENT
How to Install Forcepoint NGFW in Amazon AWS TECHNICAL DOCUMENT Table of Contents TABLE OF CONTENTS... 1 TEST NETWORK DIAGRAM... 2 PREPARING YOUR VPC... 3 IP addressing... 3 Virtual Private Cloud (VPC)...
Configuring PPP over Ethernet with NAT
This chapter provides an overview of Point-to-Point Protocol over Ethernet (PPPoE) clients and network address translation (NAT) that can be configured on the Cisco 819, Cisco 860, Cisco 880, and Cisco
Wireless LANs (CO72047) Bill Buchanan, Reader, School of Computing.
Bill Buchanan, Reader, School of Computing. W.Buchanan (1) Lab setup W.Buchanan (2) W.Buchanan (3) Console Server Con Cisco Aironet 1200 192.168.1.100 Port 2001 Con Cisco Aironet 1200 192.168.1.100 Port
CCNA Security PT Practice SBA
A few things to keep in mind while completing this activity: 1. Do not use the browser Back button or close or reload any Exam windows during the exam. 2. Do not close Packet Tracer when you are done.
Configuring Static and Dynamic NAT Translation
This chapter includes the following sections: Network Address Translation Overview, on page 1 Information About Static NAT, on page 2 Dynamic NAT Overview, on page 3 Timeout Mechanisms, on page 3 NAT Inside
Configuring a Palo Alto Firewall in AWS
Configuring a Palo Alto Firewall in AWS Version 1.0 10/19/2015 GRANT CARMICHAEL, MBA, CISSP, RHCA, ITIL For contact information visit Table of Contents The Network Design... 2 Step 1 Building the AWS network...
Scope and Sequence: CCNA Discovery
Scope and Sequence: CCNA Discovery Last updated April 22, 2008 Target Audience CCNA Discovery is primarily designed for Cisco Networking Academy students who are looking for career-oriented, information
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
CCRI Networking Technology I CSCO-1850 Spring 2014
CCRI Networking Technology I CSCO-1850 Spring 2014 Instructor John Mowry Telephone 401-825-2138 E-mail jmowry@ccri.edu Office Hours Room 2126 Class Sections 102 Monday & Wednesday 6:00PM-9:50PM, starts
Fundamentals of Network Security v1.1 Scope and Sequence
Fundamentals of Network Security v1.1 Scope and Sequence Last Updated: September 9, 2003 This document is exclusive property of Cisco Systems, Inc. Permission is granted to print and copy this document
Transparent or Routed Firewall Mode
This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. You can set the firewall mode independently for each context in multiple
Understanding PVLANs in UCS
Understanding PVLANs in UCS Introduction This document explains the PVLAN support in UCS - a feature which is introduced in the Balboa (1.4) release. This document explains the feature, the caveats and
Configuring a Management IP Address on Catalyst 4500/4000, 5500/5000, 6500/6000, and Catalyst Fixed Configuration Switches
Configuring a Management IP Address on Catalyst 4500/4000, 5500/5000, 6500/6000, and Catalyst Fixed Configuration Switches Document ID: 10594 Interactive: This document offers customized analysis of your
VLANs Level 3 Unit 9 Computer Networks
VLANs Some Requirements of LANs Need to split up broadcast domains to make good use of bandwidth People in different departments may need to be grouped together for access to servers Security: restrict
Antonio Cianfrani. Virtual LAN (VLAN)
Antonio Cianfrani Virtual LAN (VLAN) Ethernet Ethernet standard (IEEE 802.3) for Local Area Network (LAN). CSMA/CD (Carrier Sense Multiple Access/Collision Detection) Carrier Sense: all devices have to
Skills Assessment Student Practice
Skills Assessment Student Practice Topology Assessment Objectives Part 1: Develop the IPv4 Address Scheme (15 points, 20 minutes) Part 2: Initialize and Reload Devices (10 points, 5 minutes) Part 3: Configure
Retake - Skills Assessment Student Training (Answer Key)
Retake - Skills Assessment Student Training (Answer Key) Name:. Topology Assessment Objectives Part 1: Develop the IPv4 Address Scheme (15 points, 0 minutes) Part 2: Configure Device IPv4 and Security