VRF-Aware NAT on Cisco IOS XE
Two customers connect to your router. Both, entirely by coincidence, use 10.5.5.0/24 internally. Both have a host at 10.5.5.50. Both need to reach the same shared service out one exit interface. In a
Network Security
Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
Latest posts — page 3
Direct Internet Access (DIA) in Catalyst SD-WAN
For years, branch internet traffic took a ridiculous journey: from the branch, across the WAN, to a central data centre, out through the corporate firewall, to the internet - and all the way back. Every Office 365 request, every YouTube video,
SD-Access Segmentation: Macro (VN) vs Micro (SGT)
Segmentation is the entire reason most organisations buy SD-Access. Not the automation, not the roaming - the ability to say "guests cannot reach the finance systems, IoT devices cannot reach each other, and contractors only touch the two applications
DMVPN with IKEv1 vs IKEv2: Configuration and Migration
Every DMVPN carries IPsec, and every IPsec deployment sits on one of two key-exchange protocols: IKEv1, the original from 1998, or IKEv2, its 2005 replacement. Most networks still run IKEv1 because it works and nobody wanted to touch a
Dynamic ARP Inspection and IP Source Guard: The L2 Security Stack
ARP is the most trusting protocol in the building. A host asks "who has 10.10.10.1?" and believes whatever answer comes back, with no verification of any kind. So an attacker replies "I do"
DHCP Snooping in Depth: Bindings, Option 82, and Trusted Ports
Every Layer 2 security feature worth having is built on one foundation: a table that says "this IP address, with this MAC, is legitimately on this port." DHCP snooping builds that table. Dynamic ARP Inspection uses it to
Storm Control: Stopping Broadcast Floods at the Port
A single misbehaving host can take down an entire VLAN. It does not take a spanning tree loop - a NIC stuck in a fault state, a virtualised workload gone wrong, or a genuine attack can flood broadcast frames fast enough
Designing BGP Policy with Communities: A Practical Framework
Most networks use BGP communities the way most people use a junk drawer: things get put in, nobody agrees what they mean, and after two years nobody dares throw anything away. That is a shame, because a well-designed community
Hardening the Management Plane on Cisco IOS XE
The management plane is how you reach and control your devices: SSH sessions, SNMP polls, NTP syncs, the VTY lines an engineer logs into. It is also the softest target on the box, because it is the one part of
REST API Security: Tokens, TLS, and Least Privilege for Network APIs
Network automation is no longer optional, and every automated network is driven by APIs: RESTCONF on the routers, the Catalyst Center intent API, the SD-WAN Manager API, cloud provider APIs. Each of those is a new door into your
MACsec Explained: 802.1AE Link Encryption
Almost every security control on a network protects traffic at Layer 3 and above. IPsec encrypts IP payloads, TLS encrypts sessions, and VPNs tunnel across untrusted networks. But all of them assume the Layer 2 link underneath is just a
Advanced ACLs on IOS XE: Time-Based, Object-Group, and IPv6 ACLs
The access list you learned for the CCNA (permit this host, deny that subnet) still works, but it does not scale and it does not express intent. When you have forty admin hosts, a policy that only applies during business