Network security

Numbering on IOS

The same intent in three styles

! Standard, numbered: only the source can be matched
access-list 10 permit 10.1.20.0 0.0.0.255
!
! Extended, numbered
access-list 110 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
!
! Extended, named, with sequence numbers
ip access-list extended WEB-TO-SRV
 10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
 20 deny   ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255 log
 30 permit ip any any
!
interface GigabitEthernet0/0/1
 ip access-group WEB-TO-SRV in

Interface filters are applied with ip access-group NAME in|out. On VTY lines the command is access-class NAME in, usually with a standard ACL because only the source matters there.

ACLs are also a matching tool

The same ACL syntax selects traffic for NAT, route maps and PBR, QoS class maps, CoPP, crypto maps and debug filters. In those uses permit means "this matches" and deny means "this does not match", nothing is dropped by the ACL itself.

Worked example

Branch router R1 has users on 10.1.20.0/24. HQ router R2 has servers on 10.2.50.0/24 and printers on 10.2.60.0/24. Goal: users must not reach the servers, but must still reach the printers and the internet.

• Standard ACL on R1 inbound from the users: deny 10.1.20.0 0.0.0.255 blocks the users from the printers and the internet too. Wrong place.
• Standard ACL on R2 outbound toward the server LAN: only traffic heading to the servers is checked. Correct, but the denied packets already crossed the WAN.
• Extended ACL on R1 inbound from the users: deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255 then permit ip any any. Dropped at the first router, nothing else affected. Best.

The rule behind the rule

Filter as close to the source as the match criteria allow without collateral damage. Two more factors decide placement in practice:

• Administrative control. You can only filter on devices you own, which is why internet edge ACLs filter traffic arriving from sources you do not control.
• Direction. Inbound ACLs drop packets before the routing lookup. Outbound ACLs catch traffic arriving from every other interface toward one segment, but they do not filter traffic the router generates itself.

Worked examples

Turning a range into a wildcard

"Match 10.1.4.0 to 10.1.7.255." Third octet 4 is 00000100, 7 is 00000111. Only the last two bits change, so the third octet of the wildcard is 00000011 = 3: 10.1.4.0 0.0.3.255.

The range has to start on a boundary. 10.1.5.0 to 10.1.8.255 is not one block, so it takes three lines:

ip access-list extended RANGE-5-TO-8
 10 permit ip 10.1.5.0 0.0.0.255 any
 20 permit ip 10.1.6.0 0.0.1.255 any
 30 permit ip 10.1.8.0 0.0.0.255 any

Where wildcards are used

IOS ACLs, and OSPF and EIGRP network statements. Prefix lists use prefix lengths instead, Cisco ASA ACLs use normal subnet masks, and Junos firewall filters use prefix notation.

Consequences people forget

• An ACL with only deny lines blocks everything. It needs permits, often a final permit ip any any.
• An inbound ACL on a routed interface also sees control traffic aimed at the router: OSPF (IP protocol 89), BGP (TCP 179), HSRP, DHCP. Forget to permit them and the adjacency drops when the dead timer expires.
• On IOS, applying an ACL name that does not exist yet filters nothing. Deleting an ACL that is still applied also leaves the interface permitting everything.
• Outbound ACLs do not filter packets the router itself originates.

Seeing the drops

ip access-list extended WAN-IN
 10 permit ospf host 10.0.12.2 any
 20 permit tcp 10.1.0.0 0.0.255.255 10.2.50.0 0.0.0.255 eq 443
 999 deny ip any any log

R2# show ip access-lists WAN-IN
Extended IP access list WAN-IN
    10 permit ospf host 10.0.12.2 any (1204 matches)
    20 permit tcp 10.1.0.0 0.0.255.255 10.2.50.0 0.0.0.255 eq 443 (88512 matches)
    999 deny ip any any log (57 matches)

%SEC-6-IPACCESSLOGP: list WAN-IN denied tcp 10.1.20.30(50522) -> 10.2.50.10(22), 1 packet

IOS logs the first match right away and then summarizes repeat matches periodically (every five minutes by default). Logged packets are handled by the CPU, so log on a line with heavy traffic costs CPU. log-input also records the input interface and source MAC.

Stateless return traffic is clumsy

ip access-list extended INTERNET-IN
 10 permit tcp any 10.1.0.0 0.0.255.255 established
 20 permit udp any eq domain 10.1.0.0 0.0.255.255

established only checks for the ACK or RST flag in each packet, so a crafted ACK passes. Line 20 has to open every UDP port on every inside host to anything sourced from port 53. A stateful firewall instead allows only the reply to the exact DNS query that went out.

What a stateful firewall tracks and checks

• The 5-tuple, state and idle timer for each session. TCP sessions also get sanity checks: a session must start with a SYN, and segments must fit the expected sequence window.
• Application inspection for protocols that open extra connections (FTP data channels, SIP media): the firewall reads the control channel and opens only the needed pinhole.
• Idle timeouts, typically long for TCP and short for UDP and ICMP. Values are vendor specific.

Same split in the cloud

AWS security groups are stateful, AWS network ACLs are stateless, and the classic interview follow-up is that a NACL needs an outbound rule for the ephemeral return ports.

Configuration with TACACS+

username breakglass privilege 15 algorithm-type scrypt secret Br3akGlass2026
!
aaa new-model
!
tacacs server ISE1
 address ipv4 10.10.50.11
 key Tac4csKey2026
tacacs server ISE2
 address ipv4 10.10.50.12
 key Tac4csKey2026
!
aaa group server tacacs+ TAC-SERVERS
 server name ISE1
 server name ISE2
!
ip tacacs source-interface Loopback0
!
aaa authentication login default group TAC-SERVERS local
aaa authorization exec default group TAC-SERVERS local if-authenticated
aaa authorization commands 15 default group TAC-SERVERS local if-authenticated
aaa accounting exec default start-stop group TAC-SERVERS
aaa accounting commands 15 default start-stop group TAC-SERVERS

The local user is created first, so the device is never left with AAA on and no way in.

How method lists work

• default applies to every line unless a line names its own list with login authentication NAME.
• Methods are tried left to right. The next method is used only when the current one gives no answer (server down or unreachable). A reject is final.
• exec authorization decides whether you get a shell and at what privilege level. commands 15 sends every level 15 command to the server for a yes or no.
• Accounting start-stop sends a record when a session or command starts and when it ends.

Why a source interface

The server identifies network devices by IP. Pinning the source to a loopback means the request always comes from the address the server knows, whichever interface the packet leaves on.

Side by side

RADIUS message flow

Access-Request, then any number of Access-Challenge and Access-Request rounds (EAP runs here), then Access-Accept or Access-Reject. The Accept can carry policy: a VLAN, a downloadable ACL, a session timeout, a security group tag. Accounting-Request start, interim and stop records go to port 1813.

Why TACACS+ for administrators

Each command can be authorized and logged on its own, and the command text is encrypted on the wire. TCP also tells the device at once when a server is down, instead of waiting for UDP timeouts and retries.

Step by step on a wired port

1. Link comes up. The port is unauthorized: only EAPOL (EtherType 0x888E, sent to 01:80:C2:00:00:03), plus link protocols like CDP, LLDP and STP, are allowed.
2. The switch sends EAP-Request/Identity, or the client starts with EAPOL-Start. Cisco switches resend the request every 30 seconds by default (dot1x timeout tx-period).
3. The client answers with EAP-Response/Identity. In tunneled methods this outer identity can be anonymous.
4. The switch builds a RADIUS Access-Request with the EAP message plus its own details: NAS IP, port, and the client MAC in Calling-Station-Id.
5. The client and server run the EAP method (for example a TLS handshake for EAP-TLS) through several Access-Challenge rounds. The switch only relays and never sees the credentials.
6. The server sends Access-Accept with optional policy: VLAN (Tunnel-Private-Group-ID with Tunnel-Type VLAN and Tunnel-Medium-Type 802), a downloadable ACL, a security group tag, a reauthentication timer. The switch sends EAP-Success to the client.
7. The port is authorized for that MAC and accounting starts.

Minimum switch configuration

aaa new-model
aaa authentication dot1x default group ISE-RADIUS
aaa authorization network default group ISE-RADIUS
dot1x system-auth-control
!
interface GigabitEthernet1/0/10
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator

aaa authorization network is what lets the switch apply a VLAN or ACL from the server.

Configuration

interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 10
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security

The port must be a static access or trunk port. On a port left in a dynamic DTP mode the command is rejected. Sticky learning writes learned MACs into the running config, so save it to keep them.

The modes

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.5689.0bad on port GigabitEthernet1/0/5.

ASW1# show port-security interface GigabitEthernet1/0/5
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address:Vlan   : 0050.5689.0bad:10
Security Violation Count   : 3

Recovering from shutdown

shutdown then no shutdown on the port, or automatic recovery with errdisable recovery cause psecure-violation (default interval 300 seconds).

Mechanism in detail

• The table is shared by all VLANs on the switch, so once it is full, learning stops everywhere and unknown unicast flooding rises in every VLAN. The attacker sees only the floods in its own VLAN.
• Existing entries age out (300 seconds by default on Cisco) and cannot be relearned while the table stays full, so more and more traffic gets flooded.
• The switch does not crash. It keeps forwarding, just like a hub for anything it cannot learn.

Mitigation

interface range GigabitEthernet1/0/1 - 46
 switchport mode access
 switchport port-security maximum 3
 switchport port-security violation restrict
 switchport port-security

Also 802.1X so only authenticated devices get a port, and MAC table monitoring.

How you spot it

show mac address-table count shows the table near its platform limit, and show mac address-table interface Gi1/0/7 shows thousands of addresses on one access port where you expect one or two. With port security on, the violation log names the port directly.

What it looks like

• On a victim, arp -a shows the gateway 10.10.10.1 mapped to a workstation's MAC, often the same MAC as another IP in the table.
• Users see certificate warnings when the attacker tries to intercept TLS.
• DAI, if enabled, logs %SW_DAI-4-DHCP_SNOOPING_DENY with the attacker's MAC and the claimed IP.

Defenses, in order of value

1. Dynamic ARP Inspection with DHCP snooping on access VLANs.
2. 802.1X so only known devices get a port at all.
3. Port isolation or private VLANs where hosts never need to talk to each other.
4. Static ARP entries for a few critical devices. Does not scale.
5. Encryption everywhere, so interception gains little.
6. Detection: tools that alert on IP to MAC changes, and IDS signatures for gratuitous ARP storms.

Features and typical names

A rule in PAN-OS terms

set rulebase security rules Web-Out from trust to untrust source 10.10.0.0/16 destination any application [ ssl web-browsing ] service application-default action allow

application-default means each app is allowed only on its standard ports, so SSH tunnelled over 443 is not allowed by this rule.

TLS decryption limits

Forward proxy decryption re-signs server certificates with an internal CA that clients must trust. Applications with certificate pinning or mutual TLS break, and many companies exclude health, finance and privacy categories for legal reasons. With TLS 1.3 and forward secrecy, passive decryption with a server's private key no longer works; the firewall must sit inline as a proxy.

Detection methods

• Signature: known patterns of exploits and malware. Precise for known threats, blind to new ones.
• Anomaly or behavior: deviation from a learned baseline. Finds new things, more false positives.
• Protocol analysis: traffic that breaks the protocol's rules.
• Reputation: known bad IPs, domains and certificates.

Deployment practice

• Start an IPS in detect-only mode, tune out the false positives for your environment, then block on high-confidence signatures first.
• Most IPS today lives inside the NGFW. Standalone sensors such as Snort, Suricata (both can run as IDS or IPS) and Zeek (network monitoring) are common for visibility.
• Encrypted traffic hides payloads. Inspect after TLS decryption, or rely on metadata such as TLS fingerprints, certificates and flow behavior.
• Host-based IDS and endpoint detection see what the network cannot, inside encrypted sessions.

Rule pattern

Single firewall or two

• Three-legged: one firewall with inside, outside and DMZ interfaces. Cheaper and simpler, but one device and one policy hold everything.
• Back to back: an outer firewall between internet and DMZ, an inner firewall between DMZ and inside. Two layers to break through, sometimes from two vendors so one vulnerability does not open both. More cost and more rules to keep consistent.

Details that separate good from average

• Separate DMZ segments per service type (web, mail, partner), so one breach does not reach the others.
• Private VLANs or host firewalls inside a DMZ, because web servers rarely need to talk to each other.
• Keep application and data tiers on the inside or in their own zones; only the reverse proxy or load balancer sits in the DMZ.
• A WAF or CDN in front of public web apps.
• Logs from DMZ hosts and from the firewall go to a SIEM, since the DMZ is where attacks start. In the cloud the same idea is a public subnet holding only the load balancer, with the application in private subnets.

Walk an attack through the layers

A user receives a phishing email.

1. The mail filter catches most of these.
2. The user clicks anyway. Endpoint protection blocks the payload, or not.
3. The malware calls home. DNS security and URL filtering on the NGFW block the domain, or not.
4. The attacker tries to move sideways. Segmentation means the user VLAN can reach only the applications it needs, not server management ports or other users.
5. The attacker steals an admin password. MFA, TACACS+ with command authorization, and management reachable only from jump hosts stop it from becoming network control.
6. Something unusual happens anyway. NetFlow, IDS and the SIEM notice the odd flows.

Every step is a chance to stop or detect the attack. Without layers, step 2 is game over.

Not only technology

Patching, change control, backups that are tested and kept offline, least-privilege accounts, and training are layers too.

Configuration

hostname R1
ip domain name corp.example.com
crypto key generate rsa general-keys modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
username netadmin privilege 15 algorithm-type scrypt secret Str0ng-Admin-2026
enable algorithm-type scrypt secret Str0ng-Enable-2026
!
ip access-list standard MGMT-ONLY
 10 permit 10.99.0.0 0.0.0.255
 20 deny any log
!
line vty 0 15
 access-class MGMT-ONLY in
 transport input ssh
 login local
 exec-timeout 10 0
!
login block-for 120 attempts 5 within 60
login on-failure log
no ip http server
no ip http secure-server

With aaa new-model, the VTY lines use AAA method lists instead of login local.

R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 3

Password types on IOS

Inserting a line

R1# show ip access-lists BRANCH-IN
Extended IP access list BRANCH-IN
    10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
    20 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255
    30 permit ip any any
R1# configure terminal
R1(config)# ip access-list extended BRANCH-IN
R1(config-ext-nacl)# 15 permit tcp host 10.1.20.5 10.2.50.0 0.0.0.255 eq 22
R1(config-ext-nacl)# end
R1# show ip access-lists BRANCH-IN
Extended IP access list BRANCH-IN
    10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
    15 permit tcp host 10.1.20.5 10.2.50.0 0.0.0.255 eq 22
    20 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255
    30 permit ip any any

A line added without a sequence number goes to the end, below any explicit deny, where it never matches.

Changing ACLs safely on a remote router

• reload in 10 before the change, reload cancel once you know you can still reach the box.
• Build the new policy as a new ACL name, then swap it with one ip access-group NEW in command, which replaces the old binding in one step.
• Never delete and retype an ACL that is applied. Between the no and the new lines, the interface either permits everything or, once the first line exists, denies everything else.
• On Junos, commit confirmed 5 rolls back automatically unless you confirm.

Order of evaluation details

Switches evaluate ACLs in TCAM in parallel, but the result is the same as top down: the lowest sequence number that matches wins.

Example

ipv6 access-list V6-SERVERS-IN
 permit tcp 2001:db8:10::/64 host 2001:db8:50::10 eq 443
 permit icmp any any nd-ns
 permit icmp any any nd-na
 permit icmp any any packet-too-big
 deny ipv6 any any log
!
interface GigabitEthernet0/0/1
 ipv6 traffic-filter V6-SERVERS-IN in
!
line vty 0 15
 ipv6 access-class V6-MGMT in

Why ICMPv6 needs more care than ICMP in IPv4

• Neighbor Discovery replaces ARP and runs over ICMPv6.
• Packet Too Big drives path MTU discovery. Routers never fragment IPv6, so blocking it causes black holes for large packets.
• Router Advertisements carry the default gateway and prefixes for SLAAC. RFC 4890 gives recommendations for which ICMPv6 types to allow through firewalls.

The dual stack hole

An IPv4 ACL does not touch IPv6. A dual-stack interface with only ip access-group lets all IPv6 through. Every IPv4 policy needs an IPv6 twin.

Default behavior

Minimal policy: inside users to the internet

zone security INSIDE
zone security OUTSIDE
!
class-map type inspect match-any CM-WEB-DNS
 match protocol https
 match protocol http
 match protocol dns
 match protocol icmp
!
policy-map type inspect PM-IN-TO-OUT
 class type inspect CM-WEB-DNS
  inspect
 class class-default
  drop log
!
zone-pair security ZP-IN-OUT source INSIDE destination OUTSIDE
 service-policy type inspect PM-IN-TO-OUT
!
interface GigabitEthernet0/0/1
 zone-member security INSIDE
interface GigabitEthernet0/0/0
 zone-member security OUTSIDE

No OUTSIDE to INSIDE zone-pair is needed for the replies: inspect creates the session and the return packets match it. class-default in an inspect policy drops by default; drop log makes it visible.

ZBF replaced the older CBAC (ip inspect), and the two cannot be used on the same interface.

Three results, not two

Each method returns pass, fail or error. Pass logs you in, fail stops the list, and only error moves on to the next method. debug aaa authentication shows which method was tried and what it returned.

Console safety net

aaa authentication login CONSOLE local
line con 0
 login authentication CONSOLE

Lockouts and odd fallbacks seen in real life

• aaa new-model before a local user exists. New sessions have no working method.
• Wrong source address. The server does not know the request's source IP, so it ignores it. The router sees no answer and falls back to local, which looks like "TACACS+ is not working, but local logins work".
• Shared secret mismatch. The server cannot validate the request, or the device cannot decrypt the reply. Check the server's logs, which usually name the problem directly.
• Command authorization with no fallback. With aaa authorization commands 15 default group TAC-SERVERS and nothing after it, a server outage means you can log in but not run commands. Add local or if-authenticated.

Change discipline

Keep a second session open while changing AAA, test a new login before closing it, and on remote devices schedule reload in 10 first.

Comparison

The PEAP risk in one sentence

If the supplicant does not validate the server certificate and name, an attacker's fake access point or port can terminate the tunnel and collect MSCHAPv2 exchanges, which can be cracked offline. Push the trusted CA and the expected server name to clients by policy.

What EAP-TLS needs in practice

An internal CA, automatic enrollment (AD Certificate Services autoenrollment, or SCEP from MDM), revocation checking on the RADIUS server, and monitoring of certificate expiry. Windows Credential Guard also blocks single sign-on with MSCHAPv2-based methods, another push toward certificates.

Order and timing

interface GigabitEthernet1/0/22
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

With the default tx-period of 30 seconds and two retries, a device with no supplicant waits about 90 seconds before MAB starts, long enough for DHCP on some devices to give up. Lowering tx-period to 10 brings that to about 30 seconds. Another option is authentication order mab dot1x with priority dot1x mab: MAB runs first, and an 802.1X client can still take over when it sends EAPOL.

What the server sees

On Cisco switches a MAB request carries Service-Type Call-Check, and the MAC appears as the username and in Calling-Station-Id. The MAC format is configurable on the switch and normalized on most servers.

Making it less weak

• Narrow policy per device type: a printer gets a downloadable ACL that allows only the print servers, not the whole network.
• Profiling with DHCP options, LLDP or CDP, HTTP user agent and active scans, so a laptop presenting a printer's MAC gets flagged when its profile changes.
• Move devices to 802.1X with certificates whenever the device supports it.

What it checks on untrusted ports

• Drops server-to-client messages: DHCPOFFER, DHCPACK, DHCPNAK.
• Drops DHCPRELEASE and DHCPDECLINE for a binding that lives on a different port, so one client cannot release another's lease.
• Checks that the frame's source MAC equals the client hardware address inside the DHCP packet (ip dhcp snooping verify mac-address, on by default).
• Optional rate limit in packets per second. Exceeding it err-disables the port.
• Inserts DHCP option 82 by default on Catalyst switches, which can upset upstream relays (covered in the pitfalls question).

Configuration

ip dhcp snooping vlan 10,20
ip dhcp snooping
ip dhcp snooping database flash:dhcp-snooping.db
!
interface GigabitEthernet1/0/48
 description Uplink to DSW1
 ip dhcp snooping trust
!
interface range GigabitEthernet1/0/1 - 46
 ip dhcp snooping limit rate 15

Both the global command and the per-VLAN command are needed. For an EtherChannel uplink, put trust on the port-channel interface.

The binding table

ASW1# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:50:56:89:1A:2B   10.10.10.51      85740       dhcp-snooping   10    GigabitEthernet1/0/5
Total number of bindings: 1

The database line stores the table in flash so it survives a reload.

Configuration

ip arp inspection vlan 10
ip arp inspection validate src-mac dst-mac ip
!
arp access-list STATIC-HOSTS
 permit ip host 10.10.10.5 mac host 0050.5689.0005
ip arp inspection filter STATIC-HOSTS vlan 10
!
interface GigabitEthernet1/0/48
 ip arp inspection trust

Extra validation

• src-mac: the Ethernet source MAC must equal the sender MAC inside the ARP packet.
• dst-mac: in replies, the Ethernet destination must equal the target MAC inside the ARP packet.
• ip: rejects nonsense addresses such as 0.0.0.0, 255.255.255.255 and multicast. Give all three in one command. Each ip arp inspection validate line replaces the previous one.

What a drop looks like

%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Res) on Gi1/0/7, vlan 10.([0050.5689.0bad/10.10.10.1/0050.5689.1a2b/10.10.10.51/09:12:44 UTC Tue Nov 10 2026])

Reading the bracket: sender MAC, sender IP, target MAC, target IP, time. A host at 0050.5689.0bad told 10.10.10.51 that it owns the gateway address 10.10.10.1.

Static ARP ACLs

Hosts with fixed addresses have no DHCP binding. An ARP ACL lists their IP and MAC. With the static keyword on the filter, only the ACL is used and the binding table is not consulted for that VLAN.

Configuration

interface GigabitEthernet1/0/5
 ip verify source
!
ip source binding 0050.5689.0005 vlan 10 10.10.10.5 interface GigabitEthernet1/0/6

ip verify source filters on source IP. To filter on IP and MAC together, older Catalyst releases use ip verify source port-security, which needs port security on the port, and Catalyst 9000 uses ip verify source mac-check. The ip source binding line adds a static entry for a fixed-address host.

ASW1# show ip verify source
Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan
---------  -----------  -----------  ---------------  -----------------  ----
Gi1/0/5    ip           active       10.10.10.51                         10

Before the client has a lease, the port drops all IP traffic except DHCP.

Compared with uRPF

uRPF is a router feature that checks the source against the routing table per interface, so it stops spoofing of whole subnets at the edge. IPSG is per host, at the access port, against the lease. For IPv6 the equivalent is IPv6 Source Guard, part of the switch's device-tracking feature set.

Switch spoofing

Many Catalyst models default to dynamic auto, which becomes a trunk if the other side asks. An attacker sends DTP frames asking for a trunk and gets one.

Double tagging

Only possible when the attacker's access VLAN equals the trunk's native VLAN. The reply from the victim is tagged normally and never comes back to the attacker's VLAN, so it suits one-way attacks such as a flood or a crafted UDP packet.

Hardening template

vlan dot1q tag native
!
interface range GigabitEthernet1/0/1 - 46
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface range GigabitEthernet1/0/47 - 48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate

VLAN 999 has no access ports and is not in the allowed list. Unused ports are shut down and parked in an unused VLAN.

Which control stops which variant

Detection

• Pool utilization jumps to 100 percent in minutes. Alert on pool usage, not only on outages.
• The DHCP server shows hundreds of new leases with random-looking MACs from one relay or circuit ID.
• On the switch, the snooping rate limit err-disables the port and logs it, for example %PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Gi1/0/7, putting Gi1/0/7 in err-disable state.

For IPv6

Rogue Router Advertisements and DHCPv6 servers do the same job, and RA Guard and DHCPv6 Guard are the matching controls.

Server side

$ sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1
$ ss -n state syn-recv | wc -l

On Linux the value 1 (the default) means cookies are used only when the SYN queue overflows. The cost: the cookie can only carry a few MSS values, and options such as window scaling and SACK survive only when TCP timestamps are on, because Linux hides them in the timestamp.

Network side

• SYN proxy or SYN cookies on the firewall: the firewall answers the SYN itself and only opens a connection to the server after the client completes the handshake. PAN-OS zone protection, FortiGate DoS policies and Cisco firewalls all offer a form of this, triggered at a SYN rate you set.
• Embryonic connection limits per server or per source.
• Upstream help when the flood is large enough to fill the link. SYN cookies protect state, not bandwidth.

Why spoofed sources

The attacker does not need the replies, spoofing hides it, and the SYN-ACKs land on innocent hosts as backscatter. Ingress filtering (BCP 38) at networks everywhere is what makes spoofing harder.

Amplification in one paragraph

The attacker sends small requests with the victim's address as the source to open servers that send much larger replies. The victim receives the replies from thousands of legitimate servers. That is why open resolvers and exposed UDP services are a problem for everyone, not only their owners.

Upstream tools

• Scrubbing: always-on or on demand. On attack, the scrubbing provider announces your prefix (often a /24), cleans the traffic and returns it over a tunnel or direct link.
• RTBH: you tag the victim /32 to your ISP with the BLACKHOLE community 65535:666 (RFC 7999) or the ISP's own community, and the ISP drops it at its edge. The rest of your network survives; the victim address goes dark.
• BGP Flowspec (RFC 8955): pushes match and action rules, such as "drop UDP from source port 123 to 203.0.113.10", to routers that support it.

Local tools

• ACLs at the edge that drop well-known reflection source ports toward services that never need them.
• SYN cookies or SYN proxy, connection limits per source.
• CoPP so the routers keep their BGP sessions during the attack.
• CDN and anycast in front of public web services.

Do not be a source

BCP 38 (RFC 2827) ingress filtering so your customers and hosts cannot send spoofed sources, no open resolvers, no exposed amplifying services.

Runbook

Baseline traffic with NetFlow or sFlow, alert on deviations, keep ISP and scrubbing contacts and the agreed communities written down, and rehearse the diversion before you need it.

Example lines

no ip http server
no ip http secure-server
no ip source-route
service tcp-keepalives-in
service timestamps log datetime msec localtime show-timezone
!
interface GigabitEthernet0/0/0
 description ISP1
 no ip proxy-arp
 no ip redirects
 no cdp enable
 no lldp transmit
 no lldp receive
!
snmp-server group NETOPS v3 priv
snmp-server user nms1 NETOPS v3 auth sha Auth-Pass-2026 priv aes 128 Priv-Pass-2026
!
ntp authentication-key 1 md5 Ntp-Key-2026
ntp authenticate
ntp trusted-key 1
ntp server 10.99.0.10 key 1
!
logging host 10.99.0.20
logging trap informational

Newer releases offer stronger NTP and SNMP hash options; use them where both ends support them.

Why each matters

• CDP or LLDP on an internet or untrusted edge leaks model, software version and addresses.
• Time must be right for logs, certificates and correlation, and unauthenticated NTP can be spoofed.
• SNMPv2c communities travel in clear and often give read access to the whole config.
• Proxy ARP hides addressing mistakes and helps an attacker reach things through the router.
• Remote syslog keeps evidence when a device is wiped or rebooted.

The parts, in NIST terms

• Policy engine: decides whether a request is allowed, using identity, device posture, threat data.
• Policy administrator: sets up or tears down the session based on that decision.
• Policy enforcement point: the gateway, proxy, agent or firewall that lets the traffic through.

VPN versus ZTNA

Where to start

1. Inventory users, devices, applications and flows.
2. Strong identity: SSO with MFA everywhere.
3. Device trust: managed devices, posture checks.
4. Segment the crown jewels first, with group-based policy (TrustSec SGTs, cloud security groups, host firewalls) rather than IP-only rules.
5. Replace broad VPN access for contractors and third parties with per-application access.
6. Log every decision and watch for anomalies.

The method

1. Write the values you want to match in binary.
2. Bits that are the same in all of them: wildcard 0, and copy that bit into the base address.
3. Bits that differ: wildcard 1.
4. Check the result: the line matches every combination of the "1" bits. If your set is not every combination, you will match extra subnets and need more than one line.

Worked examples

The last one is the real-world use: when the addressing plan encodes site and function in fixed octets, one line matches "the voice subnet at every site" for QoS, PBR or a security policy.

Where it breaks

Subnets 1, 3 and 5 only cannot be one line, because the varying bits also produce 7. Non-contiguous wildcards are an IOS ACL feature: prefix lists, ASA ACLs and cloud security groups only take contiguous prefixes. Always add a remark line, because the next engineer will not decode 0.0.6.255 at a glance.

How it happens

Two internet edges, each with its own firewall. Inside, the gateway (HSRP) is active on side A, so traffic leaves via FW1. On the outside, ISP B advertises your prefix with a better path, so replies come back via FW2.

What it looks like on a Cisco ASA or Secure Firewall:

%ASA-6-106015: Deny TCP (no connection) from 192.0.2.80/443 to 10.10.10.51/51544 flags SYN ACK on interface outside

On PAN-OS the global counters show non-SYN TCP packets dropped for having no session, for example flow_tcp_non_syn_drop.

Design options

1. Make routing symmetric. Align the inside gateway with the outbound path, steer inbound with BGP (AS path prepending, more specific prefixes on the preferred link), or run the pair active/standby so only one path is live.
2. Share state. Clustered or active/active firewalls synchronize sessions and redirect a packet that arrives at the wrong member over a cluster link to the session owner. This needs low-latency links between members and adds complexity.
3. Place the firewall where paths converge, for example behind both edge routers instead of one per edge.
4. Bypass state checks for named flows, for example ASA TCP state bypass. You lose inspection for those flows, so keep it narrow and documented.

NAT makes symmetry even more important: the return packet must hit the same device that holds the translation.

The three phases

interface GigabitEthernet1/0/10
 ip access-group PRE-AUTH in
 authentication open
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator

A downloadable ACL written with source any gets the client's own IP substituted, which needs the switch's IP device tracking to know that IP.

Host modes

• single-host: one MAC per port, a second MAC is a violation.
• multi-host: the first MAC authenticates and the port opens for everyone behind it. Weak.
• multi-domain: one data device plus one voice device, the phone identified by the Cisco AV pair device-traffic-class=voice.
• multi-auth: every MAC authenticates on its own; one voice device plus many data devices.

When RADIUS is unreachable

interface GigabitEthernet1/0/10
 authentication event server dead action authorize vlan 10
 authentication event server alive action reinitialize

Plus radius-server dead-criteria and deadtime so the switch decides quickly that a server is down.

Change of authorization

RADIUS CoA (RFC 5176) lets the server reauthenticate, bounce or end a session, which posture checks, profiling updates and quarantine all rely on. On the switch: aaa server radius dynamic-author with the server as a client.

On current IOS-XE the same features are expressed in the newer policy style (IBNS 2.0) with access-session commands and control policies, and authentication convert-to new-style migrates.

Option 82

The access switch is a layer 2 device, not a relay, so when it adds option 82 (circuit ID with VLAN and port, remote ID with the switch MAC) the giaddr field stays 0.0.0.0. Cisco IOS relays and DHCP servers treat option 82 with a zero giaddr as invalid and drop it by default. debug ip dhcp server packet on an IOS DHCP server shows DHCPD: inconsistent relay information. Three ways out:

• Stop inserting it on the access switch: no ip dhcp snooping information option.
• Accept it on the IOS relay or server: ip dhcp relay information trusted on the SVI, or ip dhcp relay information trust-all globally.
• If an upstream switch also runs snooping and receives it on an untrusted port: ip dhcp snooping information option allow-untrusted there.

Static hosts

ARP ACLs for DAI (arp access-list plus ip arp inspection filter) and ip source binding for IPSG. Keep the list in the source of truth, because a printer replaced with a new MAC breaks again.

Persistence

ip dhcp snooping database flash:dhcp-snooping.db

Without it, a reload empties the table and DAI and IPSG block every client until it renews.

Rate limits

Raise ip arp inspection limit rate on ports with many hosts, and set errdisable recovery cause arp-inspection and dhcp-rate-limit so one burst does not leave a port down until someone notices.

Rollout order

1. DHCP snooping only, uplinks trusted. Watch the binding table fill.
2. Wait at least half a lease time so every active client has renewed through the switch.
3. Add static entries for fixed-address hosts.
4. DAI on a pilot VLAN, check the drop counters, then expand.
5. IP Source Guard last.

Configuration on IOS

interface GigabitEthernet0/0/1
 description Customer A, single-homed
 ip verify unicast source reachable-via rx
!
interface GigabitEthernet0/0/0
 description ISP1 transit
 ip verify unicast source reachable-via any

uRPF needs CEF. By default the default route does not count as a valid path; allow-default changes that. IPv6 uses ipv6 verify unicast source reachable-via rx.

Why strict breaks multihoming

With two ISPs, traffic from a given source can arrive on ISP2 while your best route back to that source is through ISP1. Strict mode drops it. Loose mode accepts it as long as any route exists.

Source-based RTBH

During an attack from known sources, a BGP trigger installs routes for those sources pointing to Null0 on every edge router. Loose uRPF then drops packets from those sources, because their only route is Null0. The same trick that blackholes destinations can blackhole sources.

Other platforms

Junos uses rpf-check on the logical interface (strict by default, mode loose available). Linux has net.ipv4.conf.<if>.rp_filter: 1 is strict, 2 is loose.

Example on an IOS-XE router

ip access-list extended COPP-ROUTING
 permit tcp host 10.0.12.2 host 10.0.12.1 eq bgp
 permit tcp host 10.0.12.2 eq bgp host 10.0.12.1
 permit ospf any any
ip access-list extended COPP-MGMT
 permit tcp 10.99.0.0 0.0.0.255 any eq 22
 permit udp 10.99.0.0 0.0.0.255 any eq snmp
 permit udp host 10.99.0.10 eq ntp any
ip access-list extended COPP-ICMP
 permit icmp any any echo
 permit icmp any any echo-reply
 permit icmp any any ttl-exceeded
 permit icmp any any unreachable
!
class-map match-all CM-COPP-ROUTING
 match access-group name COPP-ROUTING
class-map match-all CM-COPP-MGMT
 match access-group name COPP-MGMT
class-map match-all CM-COPP-ICMP
 match access-group name COPP-ICMP
!
policy-map PM-COPP
 class CM-COPP-ROUTING
  police 2000000 conform-action transmit exceed-action transmit
 class CM-COPP-MGMT
  police 1000000 conform-action transmit exceed-action drop
 class CM-COPP-ICMP
  police 128000 conform-action transmit exceed-action drop
 class class-default
  police 256000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input PM-COPP

The routing class only measures (exceed is still transmitted), so a burst after a big BGP update is never dropped. Rates here are in bits per second.

Things that catch people

• In a CoPP class ACL, permit means "belongs to this class" and deny means "try the next class". Nothing is dropped by the ACL itself.
• ARP is not IP, so IP ACLs never match it. It falls into class-default unless you add a class with match protocol arp. Police class-default too hard and ARP breaks.
• Roll out with exceed-action transmit everywhere first, read show policy-map control-plane, then set drops.

Platform notes

• Catalyst 9000 switches ship with a system CoPP policy (system-cpp-policy) whose class rates you tune.
• NX-OS applies a default CoPP profile (strict, moderate, lenient or dense) at setup.
• Junos does the same job with a firewall filter applied as input on the lo0 interface.