VLAN ACLs (VACLs): Filtering Traffic Inside a VLAN
A router ACL only sees routed traffic, so it can never filter two hosts in the same VLAN. A VACL can. Real CML before/after: intra-VLAN ping goes 0% to 100% loss while the gateway ping still works.
Jaime
Latest posts — page 4
Static ARP ACLs: Inspecting ARP Without DHCP Snooping
DAI needs DHCP snooping bindings to validate ARP. On a static-IP segment there are none, so you supply the legitimate IP-to-MAC pairs with a static ARP ACL. Proven in CML: 8 spoofed ARPs dropped.
Router Service Hardening: Turning Off What You Never Needed
Harden a Cisco router by disabling unused services, proven with a real before-and-after Nmap scan taking Telnet from open to closed, plus syslog design.
NTP Authentication: Trusting the Clock Your Logs Depend On
Configure authenticated NTP on Cisco IOS XE, why IOS flags MD5 as weak, and how ntp authenticate and trusted-key stop a rogue server moving your clock.
Anti-Spoofing on the Edge: ACLs, uRPF, and RFC 2827 in Practice
Build RFC 2827 (BCP 38) anti-spoofing with an ingress ACL and uRPF strict mode, tested with real spoofed packets and live Cisco ACL log evidence.
CoPP vs CPPr: Which Control-Plane Defense to Deploy
CoPP is one aggregate policer; CPPr subdivides the control plane and adds port-filtering. A decision guide backed by a real CoPP police capture.
Control Plane Protection (CPPr): Beyond CoPP with Port-Filtering
CPPr subdivides the control plane into host, transit and cef-exception subinterfaces and adds port-filtering, next to real CoPP police captures from CML.
ZBF vs ASA vs FTD: Which Firewall Belongs Where
Cisco sells three different stateful firewalls, and engineers argue about which one is "best" as if there were a single answer. There is not. The Zone-Based Firewall, the ASA, and Firepower Threat Defense (FTD) are built for
Nested Class-Maps in ZBF: Building Layered Policy
Most Zone-Based Firewall policies you will see are flat: a class-map lists a handful of match protocol lines, a policy-map inspects that class, and a zone-pair binds it to a direction. That works, but it does
ZBF Port-Maps: Inspecting Applications on Non-Standard Ports
You have a Zone-Based Firewall inspecting traffic on your Cisco IOS XE router, you write match protocol http to inspect web traffic to your DMZ, and one particular application just will not pass. The app runs on TCP 8080,
Zone-Based Firewall on Cisco IOS XE: Zones, Zone-Pairs, and the Policy Model
The Zone-Based Firewall (ZBF) is the stateful firewall that lives inside Cisco IOS XE. It is not a bolt-on appliance and it is not a simple access list. It is a full policy engine that classifies traffic, inspects
MPLS Traffic Engineering Explained
MPLS Traffic Engineering exists to solve a problem the IGP creates. OSPF and IS-IS always forward along the shortest path, every flow, all the time. That is correct for reachability and terrible for capacity: the shortest path saturates while