Cisco chapter 10-13 Flashcards
Common Network Attacks
- Distributed Denial of Service (DDos)
- Data Breach
- Malware
VPN Router
A VPN-enabled router provides a secure connection to remote users across a public network and into the enterprise network. VPN services can be integrated into the firewall.
Next-Generation Firewall (NGFW)
An NGFW provides stateful packet inspection, application visibility and control, a next-generation intrusion prevention system (NGIPS), advanced malware protection (AMP), and URL filtering.
Endpoints
Laptops, Desktops, Servers, Tablets, Phones, and BYODs
Network Access Control (NAC)
A NAC device includes authentication, authorization, and accounting (AAA) services. In larger enterprises, these services might be incorporated into an appliance that can manage access policies across a wide variety of users and device types. The Cisco Identity Services Engine (ISE) is an example of a NAC device.
Functions of Cisco Email Security Appliance (ESA)
- Block known threats
- Remediate against stealth malware that evaded initial detection.
- Discard emails with bad links
- Block access to newly infected sites
- Encrypt content in outgoing email to prevent data loss
Cisco Web Security Appliance WSA
Controls how users access the internet. Can block messaging, video, audio or restrict them. Can also blacklist URLs, filter URLs, scan for malware, categorize URLs, filter web applications, and encrypt and decrypt traffic over the web.
Authentication with Local Password
Using a password to log in to the switch and SSH for remote login can be helpful.
AAA
- Authentication
- Authorization
- Accounting
Authentication
- Local Authentication - usernames and passwords are stored in the network device itself.
- Server-based authentication - server stores log in info and the network device accesses it.
Authorization
Is automatic and does not require the users to perform additional steps for authentication.
Accounting
Collects ad reports user data. It also is used in authentication to log what users did while on the network. This can help identify when users performed malicious activities.
IEE 802.1 X
A port-based access control and authentication protocol that restricts unauthorized workstations from connecting to a LAN through public switch ports.
MAC Table Attacks
Includes MAC address flooding attacks.
VLAN Attacks
Includes VLAN hopping and VLAN double-tagging attacks. It also includes attacks between devices on a common VLAN.
DHCP Attacks
Includes DHCP starvation and DHCP spoofing attacks.
ARP Attacks
Includes ARP spoofing and ARP poisoning attacks.
Address Spoofing Attacks
Includes MAC address and IP address spoofing attacks.
STP Attacks
Includes Spanning Tree Protocol manipulation attacks.
Layer 2 Attack Mitigation
- Port Security
- DHCP Snooping
- Dynamic ARP Inspector DAI
- IP Source Guard IPSG
Common ways to secure unused ports on a layer 2 switch
Turn them off
Common ways to prevent MAC address attacks
Enable Port security
What commands do you use to enable port security?
- Interface f0/#
- switchport mode access
- switchport port-security
- end
Learning and Limiting MAC address
- Manually entered - assign static MAC addresses
- Dynamically Learned - current MAC address is secured unless the switch reboots.
- Dynamically Learned -Sticky - sticks Mac address to the running config
Port Security Aging
- Absolute-secured address is deleted after a certain amount of time
- Inactivity - the secured address is deleted only if they are inactive for a specified amount of time.
Parameters for port security aging
- Static - Enable aging for a statically configured secure address on this port
- time time - Specify the aging time for this port
- type absolute - set the absolute aging time
- type inactivity - set inactivity aging time.
Security Violation Modes on a layer 2 switch
- Shutdown(default) - when a new address is discovered, the port shuts down. Must toggle to reactivate.
- Restrict - drops the packets and must remove mac addresses on the table to allow them to pass. Generates a sys log
- Protect - this is the least secure. It does the same as restrict but does not generate a sys log or increase the violation counter
Types of Vlan attacks
- Vlan Spoofing- DTP messages can be sent by the attacker to have the switch enter trunk mode and allow them to target Vlans.
- Vlan hopping - double tagging a frame with two Vlan-ids. The example used an 802.1Q frame
How to Mitigate Vlan Attacks
- Disable DTP
- Diable unused ports and put them on an unused Vlan
