1
vote
1answer
62 views

Switch to switch encryption over a wireless bridge (TrustSec?)

I am planning to connect an existing Cisco 3750 switch to a 3560C switch over a wireless PTP bridge. The bridge will be WPA2 protected, but I am looking for an additional measure of security between ...
4
votes
4answers
757 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
2
votes
2answers
254 views

How does Arista EOS and Cisco IOS encrypt tacacs+ encyption keys?

We're using tacacs for AAA on our network devices, and I'm interested/curious in how our devices are encrypting the passwords device side. Following the Arista EOS manual, page 139, I'm running: ...
-1
votes
1answer
84 views

Access Control Lists & DHCP

Please take a look at this image right here. In the image above you can see a virtual netwerk simulation program (CISCO Packet Tracer 6.0) where I'm trying to setup a network and secure it. However ...
0
votes
1answer
149 views

Cisco asa 5500 series - Logging VPN connections to easily search connection history

We have a fresh requirement to log information to do with vpn connections. The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / ...
0
votes
1answer
853 views

Site2Site tunnel via SSL VPN?

i have tried convincing my opposite office of the tunnel in question to get site-2-site ipsec up and running. However they are not really into that and run everything via SSL VPN.. Is it possible to ...
-2
votes
2answers
137 views

hardware antiddos solution [closed]

We have three servers on colo in datacenter for hi-load e-commerce web project connected via cisco catalyst 2960. We need to make antiddos system with hardware firewall, CISCO Guard etc. CISCO Guard ...
10
votes
3answers
523 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
3
votes
1answer
764 views

How do I go about Improving wireless security at the office (Radius? Certs?)

EDIT 1: Our environment is mixed, majority OSX with a few Windows and Linux boxes. More importantly, Android and Apple cellphones will also need wireless access on a regular basis. We have a redhat ...
1
vote
1answer
99 views

Allow one external client to use a NAT through ASA5510 Security Plus

I keep struggling with Cisco ASA. How I can make a certain NAT (RDP, SSL or whatever) and secure it by allowing just one external client with fixed internet IP to make use of this NAT?
-1
votes
2answers
68 views

Win Server Admin vs Cisco admin [closed]

currently I am study in Linux System Administration but I seek another field related to network and security administration, now I have a question: which of these fields is better to master: Windows ...
5
votes
1answer
763 views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
6
votes
4answers
1k views

Is Selling Old Cisco Routers a Security Issue?

I'm a system admin but I'm not Cisco certified and I'm not a network engineer. Basically I only use switches/routers/modems with a GUI. I've inherited a pile of old Cisco routers that are not in use ...
2
votes
1answer
271 views

Blocking GotoMyPc on ASA 5505

I am trying to block GotoMyPC traffic using a Cisco ASA 5505. On gotomypc.com they say you can block all traffic to poll.gotomypc.com to stop all access. What I have done is create a network group ...
0
votes
0answers
378 views

Cisco ASA 8.4 NAT Issue

I upgraded to 8.4 some time ago and I guess a lot of the NAT rules changed. The migration seemed to have gone flawlessly, but this afternoon I realized that I could SSH into a box inside my network ...
2
votes
1answer
2k views

Cisco reputation filters mis-identified site as malware or “misconfigured DNS”

A client came back to me this morning saying one of their clients couldn't access the website because their security service was identifying it as a threat. I searched for the particular error, but ...
0
votes
2answers
130 views

Should I ever configure a host with a public IP address to accept traffic from a private IP address?

I connect the 'net with a public static IP (my router's IP address for NAT) and a /29 subnet (for machines behind the router). On my router, I have: #sh ip route | inc x.x x.x.0.0/16 is ...
1
vote
2answers
553 views

Allowing communication through firewall

I have just recently been hired at a web development company right out of college. I am currently struggling with a task and was hoping to get some help with operating a firewall. I currently have 2 ...
1
vote
0answers
418 views

VPN Error 619: Behind Cisco Router WRT310N

I've researched a lot on all the forums and this error is too generic for any of the proposed solutions to work. I'll try to give as much detail and tried solutions. I'm running a CentOS PPTP server ...
0
votes
3answers
183 views

New Cisco Catalyst switches and ISL Trunks?

newer Catalysts do not offer the ISL trunk mode anymore. Now I fear VLAN-hopping/encapsulation attacks when using VLANs for WAN-isolation. What can I do to prevent such attacks? Can I mix ISL and ...
0
votes
2answers
291 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
0
votes
1answer
167 views

Deny DHCP relay by corporate security policy

I've been presented with some odd "security conventions" in a large company I'm contracting with and am trying to get some perspectives on them. I need to build a number of servers virtualization ...
0
votes
1answer
523 views

CISCO: ARP Poisoning Countermeasures

How can I prevent the Cisco Catalysts 2950/2960/3550/3750 from being vulnerable to ARP Poisoning? Can this be avoided with the ARP INSPECTION? Thanks
0
votes
2answers
334 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
0
votes
3answers
229 views

Does a 1 year break in career hinders the chance of new job IT job

I have 3 years experience as web developer as small Linux /window server networking. I had to go to overseas (home country) for some reason for about 1 year. I was thinking of doing some ...
1
vote
1answer
525 views

Cisco IOS rewrite http url

Is there a way that I can configure my router to rewrite http requests? So for example, if: http://www.example.com/porn.gif is being accessed, it'll be re-written as: ...
2
votes
2answers
315 views

Cisco ASA Security Contexts: Any Real World Installs?

We are looking at deploying a Cisco ASA 5520-I am looking at the security contexts feature, and was wondering if anyone has deployed their ASA in this way, and how it is working out for them. Have ...
-3
votes
1answer
568 views

“What would you define as a security event and a security incident and is there is a difference between them”? [closed]

"What would you define as a security event and a security incident and is there is a difference between them"? In terms of network "firewall" security.
0
votes
1answer
137 views

How can I secure CISCO Radius?

Cisco offers a WLAN system that allows admins to restrict WiFi access to authenticated users. However, the following statement bothers me: Use the secure https://1.1.1.1/login.html. .... ...
1
vote
5answers
199 views

Network Monitoring and Filtering [closed]

As the IT administrator for my company I have been tasked with deciding what traffic to filter, shape, and othewise monitor on our network. What protocols, applications, and other network traffic do ...
1
vote
1answer
2k views

ASA5520 7.2 to 8.x upgrade

Our customer wants to upgrade his ASA5520 from 7.2 to 8.x. He has quite a big config and uses lot of features. eg. a/s failover, subinterfaces, ~70 VPN tunnels (ssl and ipsec), bunch of grouped ...
1
vote
3answers
321 views

Do you actually keep IOS up to date?

In quite a few environments I see Cisco hardware treated as 'set it and forget it'. Many admins just don't even think about updating IOS. If you look in places like Packstorm or Bugtraq, some months ...