Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
Two customers with identical 10.5.5.0/24 subnets reach one shared exit through a single router. VRF-aware NAT on IOS XE keeps them separate, and this CML lab build shows two translation tables holding identical inside-local addresses.
DIA lets branch internet traffic exit locally instead of backhauling to a data center firewall. See how it works in Catalyst SD-WAN, how the data policy is configured, and the security question local breakout forces you to answer.
SD-Access segments in two layers: virtual networks for macro-segmentation and SGTs for micro-segmentation. This post explains what each layer isolates, how they combine, and where the policy is actually enforced.
IKEv1 and IKEv2 configured on the same DMVPN in a CML lab, with real SA output shown side by side. The migration turns out to be a single-line profile swap, and you see exactly why IKEv2 negotiates faster.
ARP believes any answer it hears, which is why ARP spoofing works. Dynamic ARP Inspection and IP Source Guard fix that using the DHCP snooping binding table. Real CML output, plus an honest note on what a virtual switch can enforce.
DHCP snooping builds the binding table that DAI and IP Source Guard depend on. You see how the table populates, trusted vs untrusted ports, Option 82, and verification, with real CML output and an honest platform limitation.
One flooding host can saturate an entire VLAN. Storm control caps broadcast, multicast, and unknown-unicast rates per port; this covers the configuration, both threshold styles, the right action, and an honest note on platform support.
A well-designed BGP community scheme turns per-neighbor route-maps into a scalable signaling system. This guide builds one end to end on IOS XE, proves it with lab output, and includes a working RTBH trigger.
The management plane is the softest target on the box. This article hardens it on Cisco IOS XE with real captures: SSH done right, VTY restrictions, and brute-force protection, alongside AAA and CoPP in the infrastructure security cluster.
RESTCONF, Catalyst Center, and SD-WAN Manager APIs are doors into your infrastructure. Learn tokens, TLS, and least privilege for network APIs, framed for network engineers rather than web developers.
MACsec (IEEE 802.1AE) encrypts and authenticates every Ethernet frame on the link itself, so an attacker tapping the cable sees only ciphertext. This article explains how it works, how MKA distributes keys, and where it fits.
Time-based ACLs, object groups, and IPv6 ACLs on Cisco IOS XE, with real output including a schedule that shows inactive because of when the lab ran. Make policy readable, reusable, and time-aware instead of a flat wall of lines.