Network security
0 of 37 nailed
Cisco IOS24
show ip access-lists BRANCH-IN- Lists every line of an IPv4 ACL with its sequence number and hit count. Leave the name off to see all IPv4 ACLs.
show ip interface GigabitEthernet0/0/1 | include access list- Shows which ACL is applied inbound and outbound on an interface, the quickest check for a wrong name or direction.
clear ip access-list counters BRANCH-IN- Resets the hit counters of one ACL so a single test shows exactly which line matches.
ip access-list resequence BRANCH-IN 10 10- Renumbers an ACL starting at 10 in steps of 10, making room to insert lines between existing ones.
show ipv6 access-list V6-SERVERS-IN- Lists an IPv6 ACL with sequence numbers and match counts. The implicit ND permits and final deny are not shown.
show port-security interface GigabitEthernet1/0/5- Shows port security status, violation mode, maximum and learned MAC counts, the last source MAC and the violation counter.
show port-security address- Lists every secure MAC address on the switch with its VLAN, type (static, sticky, dynamic) and port.
show interfaces status err-disabled- Lists ports in err-disabled state and the reason, such as psecure-violation, arp-inspection or dhcp-rate-limit.
errdisable recovery cause psecure-violation- Re-enables ports shut by port security automatically after the recovery interval (300 seconds by default).
show ip dhcp snooping- Shows whether snooping is on, which VLANs are snooped, option 82 insertion, and trust and rate limit per interface.
show ip dhcp snooping binding- Lists the snooping binding table of MAC, IP, lease, VLAN and port that DAI and IP Source Guard rely on.
show ip arp inspection vlan 10- Shows the DAI validation checks, whether the VLAN is active, the attached ARP ACL and logging settings.
show ip arp inspection statistics vlan 10- Counts ARP packets forwarded and dropped by DAI per VLAN, with the reasons for drops.
show ip verify source- Lists the IP Source Guard filter on each port with the IP (and MAC, if checked) it permits.
show authentication sessions interface GigabitEthernet1/0/10 details- Shows one port's 802.1X or MAB session with status, method results, user name, VLAN and downloadable ACL.
show access-session interface GigabitEthernet1/0/10 details- The newer policy-style (IBNS 2.0) equivalent of show authentication sessions on IOS-XE.
show aaa servers- Shows each RADIUS and TACACS+ server's state (UP or DEAD), ports, dead history and request counters.
test aaa group ISE-RADIUS alice Passw0rd new-code- Sends a real RADIUS authentication request from the device and reports whether the user was accepted.
debug radius authentication- Prints RADIUS requests and replies with their attributes. Filter or limit it on busy switches.
show zone-pair security- Lists the zone-based firewall zone-pairs with source zone, destination zone and the attached inspect policy.
show policy-map type inspect zone-pair ZP-IN-OUT sessions- Shows the class-map counters and the stateful sessions currently open through one zone-pair.
show policy-map control-plane- Shows CoPP classes with conformed and exceeded packet counts, the first place to look when the CPU is under attack.
show ip ssh- Shows whether SSH is enabled, its version, the authentication timeout and the retry limit.
show login failures- Lists recent failed login attempts by user, source address and line, when login block-for is configured.
Junos2
show security flow session source-prefix 10.10.10.51- Lists the flow sessions on an SRX firewall for one source, with the policy that allowed each one.
show firewall filter GUEST-IN- Shows the counters and policers of a Junos firewall filter, for terms that have a count action.
PAN-OS2
test security-policy-match from <zone> to <zone> source <ip> destination <ip> protocol 6 destination-port 443- Shows which security rule would match a given flow on a Palo Alto firewall, without sending any traffic.
Example
Output test security-policy-match from trust to untrust source 10.10.10.51 destination 192.0.2.80 protocol 6 destination-port 443 show session all filter source 10.10.10.51- Lists the sessions on a Palo Alto firewall for one source address, with application, zones and NAT.
FortiOS1
diagnose debug flow trace start 20- Traces how the next 20 packets are handled on a FortiGate, including the matching policy. Set a filter first and enable output with diagnose debug enable.
Linux1
sysctl net.ipv4.tcp_syncookies- Shows whether Linux SYN cookies are enabled; 1, the default, sends cookies only when the SYN queue overflows.