Router and Switch Security 2.1

Question 1

Routers

Answer 1

OSI layer 3 device. Routers can be combined into switches. Sometimes called layer 3 switches. Layer 2 is the switch, layer 3 is the router. Often connects diverse network types. LAN, WAN, copper, fiber. They are not designed to be security devices but they do have some features that help provide security. Access Control Lists for example can deny traffic like a firewall.

Question 2

Access Control List (ACL)

Answer 2

Used to allow or deny traffic. Used to define what traffic can come in and go out. Can evaluate traffic based on criteria such as source IP, destination IP, TCP port numbers, UDP port numbers, Internet Control Message Protocol (ICMP). Do not filter any RFC 1918 addresses (Private Network Addresses)

Question 3

Router Security Challenges

Answer 3

Spoofing attacks can trick routers into allowing traffic disguised as being safe.

Question 4

Switches

Answer 4

An OSI layer 2 device. Bridges traffic via hardware. Contains many ports, it is the core of an enterprise network.

Question 5

Switch Port Security

Answer 5

The inside of your network is relatively insecure. It is generally fairly easy to walk in a plug into a network.

Question 6

Network Access Control (NAC)

Answer 6

IEEE 802.1x - Port based NAC. This requires that everyone must authenticate even if you are plugged into the switch. You can also close unused physical ports through administrative functions. Stop spoofing via duplicate MAC address checking. Make extensive use of Extensible Authentication Protocol (EAP) and Extensible Authentication Dial in User Service (RADIUS)

Question 7

Loop Prevention

Answer 7

Switches connected together can send traffic back and forth together causing the network to loop the traffic and quickly bring the network down. Switches do not “count” traffic so it wont recognize repeat traffic. Spanning Tree Protocol (IEEE 802.1d) prevents loops in bridged networks. (Widely used)

Question 8

Flood Guard

Answer 8

Switch networks can be overflowed by MAC addresses. If you configure a maximum number of MAC addresses, you can prevent DDOS attacks. You can also configure specific MAC addresses.

Question 9

Layer 3 Switches

Answer 9

A switch (layer 2) and a router (layer 3) can be combined. They are still doing their respective jobs at each layer, the devices are just combined together.