Zone-Based Firewall on Cisco IOS XE: Zones, Zone-Pairs, and the Policy Model
The Zone-Based Firewall (ZBF) is the stateful firewall that lives inside Cisco IOS XE. It is not a bolt-
Network Security
Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
Latest
ASA
·
Clientless SSL VPN Is Gone: What Replaced WebVPN on Modern ASA
Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
ASA
·
Transparent Mode ACLs: EtherType Rules and What Bridges Through
Every ACL you have ever written on a firewall operates on IP: source address, destination address, port, protocol. A routed
ASA
·
Configuring a Transparent Firewall on the ASA
We learned the first lesson of transparent-mode firewalls the hard way, live, mid-command. Typing firewall transparent on our
ASA
·
TCP Normalization on the ASA: The Silent Connection Killer
Some of the hardest firewall tickets sound like ghost stories. A connection that works fine between two hosts dies the
ASA
·
Custom L7 Inspection on the ASA: Regex, Match Conditions, and Blocking What You Choose
This is where the ASA stops being a Layer 4 gate and starts reading your web traffic. In this article
ASA
·
Deep Packet Inspection on the ASA: Application Inspection Engines in Practice
A stateful firewall that only reads Layer 3 and Layer 4 headers is half a firewall. It can decide whether
ASA
·
The ASA Modular Policy Framework (MPF): class-map, policy-map, service-policy
If you have ever stared at an ASA configuration and wondered how a single firewall applies HTTP inspection here, a
SNMPv3 in Production: Users, Groups, Views, Traps, and Informs
SNMPv1 and v2c send everything - including your community string, which is effectively a password - in cleartext across the network. Anyone
VRF-Aware NAT on Cisco IOS XE
Two customers connect to your router. Both, entirely by coincidence, use 10.5.5.0/24 internally. Both have a
SD-WAN
·
Direct Internet Access (DIA) in Catalyst SD-WAN
For years, branch internet traffic took a ridiculous journey: from the branch, across the WAN, to a central data centre,
SD-Access Segmentation: Macro (VN) vs Micro (SGT)
Segmentation is the entire reason most organisations buy SD-Access. Not the automation, not the roaming - the ability to say