Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
Cisco sells three different stateful firewalls, and engineers argue about which one is "best" as if there were a single answer. There is not. The Zone-Based Firewall, the ASA, and Firepower Threat Defense (FTD) are built for
Most Zone-Based Firewall policies you will see are flat: a class-map lists a handful of match protocol lines, a policy-map inspects that class, and a zone-pair binds it to a direction. That works, but it does
You have a Zone-Based Firewall inspecting traffic on your Cisco IOS XE router, you write match protocol http to inspect web traffic to your DMZ, and one particular application just will not pass. The app runs on TCP 8080,
The Zone-Based Firewall (ZBF) is the stateful firewall that lives inside Cisco IOS XE. It is not a bolt-on appliance and it is not a simple access list. It is a full policy engine that classifies traffic, inspects
Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
Every ACL you have ever written on a firewall operates on IP: source address, destination address, port, protocol. A routed firewall never sees anything else, because anything that is not IP is simply not its concern. A transparent firewall is
We learned the first lesson of transparent-mode firewalls the hard way, live, mid-command. Typing firewall transparent on our ASAv did not politely switch a mode setting. It wiped the entire running configuration instantly, and because our SSH access
Some of the hardest firewall tickets sound like ghost stories. A connection that works fine between two hosts dies the moment it crosses the ASA, both endpoints swear nothing is wrong, and there is no deny in any ACL. Nine
This is where the ASA stops being a Layer 4 gate and starts reading your web traffic. In this article we build a custom Layer 7 HTTP inspection policy that blocks a specific URL by regular expression, and then we
A stateful firewall that only reads Layer 3 and Layer 4 headers is half a firewall. It can decide whether TCP port 21 is allowed, but it has no idea what the FTP control channel is negotiating on that port,
If you have ever stared at an ASA configuration and wondered how a single firewall applies HTTP inspection here, a connection limit there, and TCP normalization somewhere else without a tangle of one-off commands, the answer is the Modular
SNMPv1 and v2c send everything - including your community string, which is effectively a password - in cleartext across the network. Anyone with a packet capture has your read (or write) access. SNMPv3 fixes this with real authentication and encryption, but it