Hot answers tagged

11

You have a number of ways to restrict torrents: Blocking ports: this doesn't work, because p2p traffic can use pretty much any port (even ones below 1024) Deep inspection: looking at traffic and blocking based on type can help you a lot, however encrypted traffic all looks alike Destination filtering: this may also help a bit, but you'd have to maintain a ...


7

Have a good look at this question on DDoS mitigation - it is not something you will be able to solve by buying a faster switch, as an attacker can always get more traffic sources than your network can cope with. All the workable solutions manage it with routing or dropping packets within the ISP - if your ISP doesn't offer a solution you should consider ...


5

With physical access, so many parts of your network could be compromised. I'm not sure I would be looking at the cable and light, but at more basic things, like USB drives, rogue wifi access points, computers left logged in...


5

Cisco's own SDM (Security Device Manager) performs some basic auditing. "Cisco SDM allows users to perform one-step security audits to evaluate the strengths and weaknesses of their router configurations against common security vulnerabilities." For a list of features included, see AutoSecure Features Implemented in Cisco SDM . Another well-known tool is ...


5

Here's how to do it: tunnel_vpn_userX controls what subnets to tunnel, filter_vpn_userX applies normal access list filtering within that tunnel. object-group network tunnel_vpn_userX_local network-object <some local network> ... access-list tunnel_vpn_userX extended permit ip object-group tunnel_vpn_userX_local any access-list filter_vpn_userX ...


4

Context works great, what you want to know before deploying it is the unsupported feature in context mode: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747 I never see any performance drop when enabling context mode


4

The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes. Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post. It is worth while checking this site: Nitrix Hash Generator In there you can enter 'cisco' as the password and you'll recieve the common ...


4

BitTorrent can run on any port, and can be wrapped inside SSL, so blocking by ports or traffic data isn't going to get you anywhere. My suggestion would be to block HTTP traffic on any port which matches the tracker announce protocol, as per the specification. This won't work if the tracker is running on HTTPS, but most don't. It also won't prevent DHT from ...


4

You have a number of separate queries here, so I'll try and get through them. If you have the IP addresses then yes, you can get the 5505 to block - that's pretty simple - just add the IP addresses to the block list (or depending on your needs, block everything except traffic from known good IP's - whitelisting) Cisco offer SYN Flood protection - worth ...


3

The simplest way to mitigate BEAST is to do nothing at all. BEAST is a client attack. Servers can "protect" clients by enforcing the use of RC4-based cipher suites even if the client states that it prefers some CBC cipher suites. However, all recent Web browser versions include workarounds which make them immune to BEAST, namely the 1/n-1 split; and the ...


3

For general understanding, vtp allows central management of vlan domains, id and other attributes. It governs how other switches learn and understands vlan. Any updates related to vtp management is sent by the vtp server. Here, the risk lies when the md5 hash is known either by compromising the switch and running commands such as e.g show command, show vtp ...


3

There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB ...


3

Having recently had my 5510 taken down in a SYN-flood DDoS, the key thing you need to know is how big the DDoS is going to be. Our ASA 5510 hit its limit at 140,000 packets per second. Although the specs say 190,000 packets per second, other factors can influence the actual rate achieved. The 5505 can handle fewer packets per second than the 5510. Higher ...


3

For devices with ACLs you should try Tufin SecureTrack. It reads in the running config file and allows you to perform various kinds of analysis such as ACL overlap report, finding ACLs that match certain access patterns, for example ACLs allowing access from one zone to another etc.


3

You can also check out Nipper (http://www.titania.co.uk/) Nipper enables you to perform your own comprehensive security audits of your network devices. Nipper supports around 60 different network firewalls, switches and routers from a wide range of manufacturers such as Cisco, HP, Juniper, Check Point and Extreme Networks. It's cheap: $85 for ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


3

There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running: #ip ssh version 2 However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection ...


3

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? RADIUS: Microsoft has FIPS-certified crypto modules for their recent operating systems (search for "Microsoft"). Enabling FIPS mode via Group Policy will force use of that crypto module. However, as one answer pointed out, most RADIUS protocols are not allowable under FIPS. PAP, ...


3

I think you've answered the question yourself mostly: unless there are protections against sniffing inside the network an attacker could be able to see the configuration. But if this is a problem in your specific environment cannot be decided, because it is unknown if you have protections against sniffing or if the configurations are free from sensitive ...


2

It depends on what routing technology that you use. I know cisco switches have a optional security setting on allowing only a few MAC addresses associated with a port. See port-security. This makes it impossible to set up a bridge between your network and your colleague's network, as the bridge will proxy the arp packets between the two networks, hence ...


2

Use enable secret -- if nothing else, it's the solution that works on "legacy" versions, even if it has been changed in newest releases. (Apart from that, avoid local accounts. The only time a local account should be used is when there is a major problem in progress that prevents the router from communicating with an AAA server. Use TACACS+ when possible, ...


2

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is: switch1 -> router -> firewall(transparent) -> switch2 ...


2

From the paper you quote, additional Symbiotes would both complicate the code rewriting scenario, making disabling them theoretically more difficult; and the Symbiotes could be made to protect one another, making disabling them practically impossible. The attacker would need to get a precise image of all their entry points and disable them all in one fell ...


2

Use the AnyConnect VPN Client, Cisco VPN client does not support x64 The Cisco VPN Client supports: XP, Vista (x86/32-bit only), Windows 7 (x86/32-bit only), and Windows x64 (64-bit). Windows x64 support also provided by Cisco AnyConnect VPN Client Linux (Intel) Mac OS X 10.4 and 10.5 Solaris UltraSPARC (32- and 64-bit) Source: http://www.cisco.com/en/US/...


2

Given that: current browsers (including IE6) have patches to work around BEAST, it's a difficult attack to perform anyway, and there has been progress in attacking RC4 of late, preferring RC4 as a measure to defeat BEAST seems of questionable utility. It is certainly not a clear-cut win, and shouldn't be represented as a necessary basic security measure (...


2

CiscoConfParse (download link) is an open-source audit toolset that lets you express the audit as Python code. Disclaimer: I am the author. License: GPL


2

Did anyone perform a hard reset on the device? Usually there is a pin hole button you need to press for a few seconds to reset the device to the default configuration. Just a thought.


2

A feature request to add the functionality seems to have been resolved in recent IOS releases, adding the functionality. On (very) recent IOS versions (possibly restricted to certain trains, the documentation is extremely sparse), you should be able to: > enable # configure terminal (config)# ip ssh server algorithm encryption aes128-ctr aes192-ctr ...


2

Given that NIST has a copy of a Cisco document calling this out specifically, I'm going to think the answer is Yes. IANASA (i am not a security auditor) http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp948.pdf



Only top voted, non community-wiki answers of a minimum length are eligible