09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 22<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 21<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 23<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 514<br />

access-list 100 permit tcp any 172.16.30.0 0.0.0.255 eq 514<br />

Host sessions over slow WAN connections and TCP transactions that have long<br />

windows between acknowledgements can be interpreted as attacks. So some<br />

consideration should be given <strong>to</strong> <strong>the</strong> types of data transactions being handled by <strong>the</strong><br />

router before implementing .<br />

Address masquerading is quite simple <strong>to</strong> accomplish. A system without access<br />

assumes <strong>the</strong> IP address of a system with access. System services that function<br />

without au<strong>the</strong>ntication (that is, NFS, rlogin, TFTP) are particularly vulnerable <strong>to</strong><br />

masquerading, because <strong>the</strong> IP address is used as <strong>the</strong> au<strong>the</strong>ntication identifier. To<br />

defend against address masquerading, you need <strong>to</strong> deny external <strong>network</strong> packets<br />

that contain your local <strong>network</strong> address in <strong>the</strong> source address field. In addition, you<br />

should filter out inbound source packets that might originate from <strong>the</strong> unregistered<br />

IPv4 address space. Here is an example of that kind of denial. The local <strong>network</strong><br />

address range is 12.14.52.0 /22. The 10.0.0.0, 172.16.0.0, and 192.168.0.0<br />

ranges are <strong>the</strong> "unassigned" IP address ranges, which should always be filtered out<br />

just as a standard precaution:<br />

!<br />

interface serial 0<br />

ip address 12.14.116.1 255.255.255.0<br />

ip access-group 99 in<br />

!<br />

access-list 99 deny 12.14.52.0 0.0.0.255<br />

access-list 99 deny 12.14.53.0 0.0.0.255<br />

access-list 99 deny 12.14.54.0 0.0.0.255<br />

access-list 99 deny 12.14.55.0 0.0.0.255<br />

access-list 99 deny 10.0.0.0 0.255.255.255<br />

access-list 99 deny 172.16.0.0 0.0.255.255<br />

access-list 99 deny 192.168.0.0 0.0.255.255<br />

access-list 99 permit any any<br />

NOTE<br />

Here are some of <strong>the</strong> better security/hack information sites on <strong>the</strong> Web:

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!