Network Security Basics

Goals and principles

Security teams describe what they protect with the CIA triad. Confidentiality means only authorized people can read data (encryption, access control). Integrity means data is not changed without anyone noticing (hashes, digital signatures). Availability means systems and data are reachable when they are needed (redundancy, protection against denial of service). Every control on this page serves at least one of the three.

No single control is perfect, so networks use defense in depth: several independent layers, each able to stop or slow an attacker when another fails. A stolen laptop plugged into an office port might be stopped by 802.1X; if that is misconfigured, segmentation limits what it can reach; if that fails too, a firewall rule or logging on the server may still catch it.

Segmentation and zones

Network segmentation divides one network into smaller parts, so that a problem in one part — malware, a misbehaving device, an intruder — cannot spread freely to the rest. The building blocks are familiar from other pages:

• Virtual local area networks (VLANs) separate traffic at layer 2 on the same switches (see Switching and VLANs).
• Subnets give each segment its own IP range, so traffic between segments must pass a router or layer 3 switch — the natural place to filter it.
• Security zones group segments by trust level, such as inside, outside and DMZ, and a firewall enforces the rules between zones.

A typical office puts users, servers, printers, voice, guests and network management in separate VLANs and subnets. The guest Wi-Fi then reaches the Internet but not the file servers, and a printer with an old firmware cannot be used as a stepping stone to the finance department.

The DMZ

Servers that the Internet must reach, such as a public web server or a mail relay, are the most exposed systems in a network. They go into a DMZ (demilitarized zone, also called a screened subnet): a separate segment between the outside and the inside. The firewall allows the Internet to reach only specific services in the DMZ, and allows the DMZ to reach the inside network only where strictly needed — or not at all. If a DMZ server is compromised, the attacker is still outside the internal network.

Access control lists

An access control list (ACL) is an ordered list of permit and deny statements that a router or layer 3 switch compares against packets. Applied to an interface in one direction — in as packets arrive, or out as they leave — it decides which packets may pass. ACLs are also reused elsewhere to select traffic, for example to tell network address translation (NAT) which addresses to translate or to restrict who may log in to the device.

Standard and extended ACLs

Either type can also be named instead of numbered (ip access-list extended WEB-ONLY). Names are easier to read in a configuration, and named ACLs let you insert or delete a single line by its sequence number.

The placement rule follows from what each type can see. A standard ACL knows only the source, so if you place it near the source it blocks that source from everything behind the router; near the destination it blocks only the one path you meant. An extended ACL is precise enough to drop unwanted traffic right where it enters the network, before it wastes bandwidth crossing links.

Wildcard masks

ACLs describe address ranges with a wildcard mask, which looks like an inverted subnet mask: a 0 bit means "this bit must match", a 1 bit means "ignore this bit". For a whole subnet, subtract the subnet mask from 255.255.255.255:

• 192.168.20.0 0.0.0.255 — every address in 192.168.20.0/24 (mask 255.255.255.0).
• 10.1.4.0 0.0.3.255 — 10.1.4.0/22 (mask 255.255.252.0).
• host 192.168.50.10 — exactly one address; shorthand for wildcard 0.0.0.0.
• any — every address; shorthand for 0.0.0.0 255.255.255.255.

How an ACL is processed

Three rules explain nearly every ACL surprise:

1. Top-down: lines are compared in order, from the lowest sequence number up.
2. First match wins: at the first line that matches, the router permits or denies the packet and stops reading.
3. Implicit deny: every ACL ends with an invisible deny any (for extended ACLs, deny ip any any). A packet that matches no line is dropped.

So put specific lines before general ones, and make sure an ACL contains at least one permit — an ACL of only deny lines blocks everything. On Cisco IOS, each interface can have at most one ACL per direction per protocol (one inbound and one outbound IPv4 ACL).

Configuring ACLs on Cisco IOS

A standard ACL that lets only the administrators' subnet into the management network, applied outbound on the interface that faces that network (close to the destination):

R1(config)# access-list 10 remark Only admins may reach management
R1(config)# access-list 10 permit 192.168.99.0 0.0.0.255
R1(config)# interface GigabitEthernet0/3
R1(config-if)# ip access-group 10 out

• remark adds a comment line; it does not match anything.
• permit 192.168.99.0 0.0.0.255 allows sources in 192.168.99.0/24; everything else hits the implicit deny.
• ip access-group 10 out applies the ACL to packets leaving GigabitEthernet0/3. Without this command an ACL does nothing.

A named extended ACL, applied inbound on the interface where the users' subnet 192.168.20.0/24 enters the router (close to the source):

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 192.168.20.0 0.0.0.255 host 192.168.50.10 eq 443
R1(config-ext-nacl)# permit udp any host 192.168.50.53 eq 53
R1(config-ext-nacl)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group WEB-ONLY in

• Line 1 permits HTTP Secure (HTTPS, TCP port 443) from the users' subnet to the web server 192.168.50.10.
• Line 2 permits Domain Name System (DNS) queries (UDP port 53) from any source to the DNS server 192.168.50.53.
• Everything else arriving on GigabitEthernet0/1 is dropped by the implicit deny — including traffic to the Internet. That is exactly the kind of side effect to think about before you apply an ACL.

show access-lists lists every ACL with its sequence numbers and a hit counter per line, which is the quickest way to see which line a flow is matching:

R1# show access-lists
Standard IP access list 10
    10 permit 192.168.99.0, wildcard bits 0.0.0.255 (27 matches)
Extended IP access list WEB-ONLY
    10 permit tcp 192.168.20.0 0.0.0.255 host 192.168.50.10 eq 443 (152 matches)
    20 permit udp any host 192.168.50.53 eq domain (88 matches)

IOS numbers the lines 10, 20, 30 … automatically and shows well-known ports by name (domain for 53). Hits on the implicit deny are not counted; add an explicit deny ip any any log at the end if you need to see them.

Simulating ACL matching

The logic is simple enough to write in a few lines of Python with the standard ipaddress module. The helper turns an address plus wildcard mask into a network by inverting the wildcard into a subnet mask; check() then walks the list top-down and stops at the first match. The last part shows why order matters.

import ipaddress


def wildcard_network(address, wildcard):
    """Turn an ACL address + wildcard mask into an ip_network."""
    inverted = int(ipaddress.ip_address(wildcard)) ^ 0xFFFFFFFF
    netmask = ipaddress.ip_address(inverted)
    return ipaddress.ip_network(f"{address}/{netmask}")


ANY = wildcard_network("0.0.0.0", "255.255.255.255")

# Extended ACL WEB-ONLY: (sequence, action, protocol, source, destination, port)
WEB_ONLY = [
    (10, "permit", "tcp", wildcard_network("192.168.20.0", "0.0.0.255"),
     wildcard_network("192.168.50.10", "0.0.0.0"), 443),
    (20, "permit", "udp", ANY, wildcard_network("192.168.50.53", "0.0.0.0"), 53),
]


def matches(rule, packet):
    _, _, protocol, source, destination, port = rule
    p_protocol, p_source, p_destination, p_port = packet
    if protocol != "ip" and protocol != p_protocol:
        return False
    if ipaddress.ip_address(p_source) not in source:
        return False
    if ipaddress.ip_address(p_destination) not in destination:
        return False
    return port is None or port == p_port


def check(acl, packet):
    for rule in acl:  # top-down: the first matching line decides
        if matches(rule, packet):
            return f"{rule[1]} (line {rule[0]})"
    return "deny (implicit deny)"


packets = [
    ("tcp", "192.168.20.15", "192.168.50.10", 443),    # HTTPS to the web server
    ("tcp", "192.168.20.15", "192.168.50.10", 22),     # SSH to the web server
    ("udp", "192.168.20.31", "192.168.50.53", 53),     # DNS query
    ("icmp", "192.168.20.15", "192.168.50.10", None),  # ping
]

print("any =", ANY)
for packet in packets:
    protocol, source, destination, port = packet
    target = f"{destination}:{port}" if port else destination
    print(f"{protocol:4} {source} -> {target:17} {check(WEB_ONLY, packet)}")

# The same permit, but below a broad deny: it can never be reached.
WRONG_ORDER = [
    (10, "deny", "ip", wildcard_network("192.168.20.0", "0.0.0.255"), ANY, None),
    (20,) + WEB_ONLY[0][1:],
]
print("Wrong order, HTTPS:", check(WRONG_ORDER, packets[0]))

any = 0.0.0.0/0
tcp  192.168.20.15 -> 192.168.50.10:443 permit (line 10)
tcp  192.168.20.15 -> 192.168.50.10:22  deny (implicit deny)
udp  192.168.20.31 -> 192.168.50.53:53  permit (line 20)
icmp 192.168.20.15 -> 192.168.50.10     deny (implicit deny)
Wrong order, HTTPS: deny (line 10)

Real ACLs also accept non-contiguous wildcards, such as 192.168.20.0 0.0.0.254 for every even address in the subnet, which this helper does not handle; for normal subnet-sized ranges the result is the same. Python's own syntax — functions, tuples, f-strings — is explained in the Python topic.

Firewalls

An ACL on a router is a stateless packet filter: it judges every packet on its own, without memory. That becomes awkward for return traffic. When a user opens a web page, the reply comes back from port 443 to a random high port on the client; a stateless filter must either permit a wide range of inbound ports or break the connection.

A stateful firewall solves this with a connection table (state table). When an inside host opens a connection that the policy allows, the firewall records it: addresses, ports, protocol and, for TCP, where the connection is in its lifecycle. Returning packets that belong to a recorded connection are allowed automatically; inbound packets that belong to no connection are dropped. Entries disappear when the connection closes or times out.

# A stateful firewall allows traffic from inside to outside and records
# each connection. Inbound packets pass only if they answer a recorded one.
connections = set()


def outbound(source, destination):
    connections.add((source, destination))
    print(f"OUT {source} -> {destination}  permit, recorded")


def inbound(source, destination):
    if (destination, source) in connections:  # the reply swaps both ends
        verdict = "permit (reply to a known connection)"
    else:
        verdict = "drop (no matching connection)"
    print(f"IN  {source} -> {destination}  {verdict}")


outbound("192.168.1.50:51724", "203.0.113.80:443")
inbound("203.0.113.80:443", "192.168.1.50:51724")
inbound("198.51.100.66:443", "192.168.1.50:51724")
inbound("203.0.113.80:443", "192.168.1.50:3389")
print("Connection table:", len(connections), "entry")

OUT 192.168.1.50:51724 -> 203.0.113.80:443  permit, recorded
IN  203.0.113.80:443 -> 192.168.1.50:51724  permit (reply to a known connection)
IN  198.51.100.66:443 -> 192.168.1.50:51724  drop (no matching connection)
IN  203.0.113.80:443 -> 192.168.1.50:3389  drop (no matching connection)
Connection table: 1 entry

Real firewalls also check TCP flags and sequence numbers, so a forged packet with the right addresses but an impossible sequence number is still dropped. The first packet of a connection is checked against the rule base; everything after that is a fast table lookup.

Next-generation firewalls

A next-generation firewall (NGFW) is a stateful firewall that also looks inside the traffic, up to layer 7. It can recognize applications regardless of port (a chat app tunneled over 443 is still identified), enforce rules per user or group instead of per IP address, filter URLs by category, and include an intrusion prevention system (IPS) that blocks known attack patterns. Inspecting encrypted traffic requires Transport Layer Security (TLS) decryption on the firewall, which has privacy and performance costs.

VPNs

A VPN (virtual private network) carries private traffic across an untrusted network, usually the Internet, inside an encrypted and authenticated tunnel. To the devices at each end it looks as if they share a private link.

• Site-to-site VPN: two gateways (routers or firewalls) build a permanent tunnel between two locations, such as a branch office and headquarters. Users notice nothing; their traffic is encrypted only while it crosses the Internet between the gateways.
• Remote-access VPN: a single user's device runs VPN client software and connects to a VPN gateway, for example when working from home. The tunnel starts on the laptop itself.

IPsec and TLS VPNs

IPsec (Internet Protocol Security) protects traffic at layer 3. The Internet Key Exchange (IKE) protocol, on UDP port 500, authenticates the peers and negotiates keys. The data itself travels in ESP (Encapsulating Security Payload, IP protocol 50), which provides encryption and integrity; when a NAT device sits in the path, ESP is wrapped in UDP port 4500 (NAT traversal). The older AH (Authentication Header, IP protocol 51) provides integrity but no encryption. Site-to-site VPNs are usually IPsec.

TLS VPNs (often still called SSL VPNs) build the tunnel with Transport Layer Security, typically over TCP port 443. Because port 443 is open almost everywhere, they work well for remote access from hotels and home networks; many clients switch to DTLS over UDP for better performance.

What exactly is encrypted depends on the mode. In IPsec tunnel mode, used between gateways, the whole original packet — including its private source and destination addresses — is encrypted and placed behind a new IP header with the gateways' public addresses. In transport mode only the payload is protected and the original IP header stays visible. In every case, protection ends at the tunnel endpoint: behind the VPN gateway, traffic travels unencrypted across the internal network unless the application encrypts it too.

Switch security

Many attacks start inside the building, from a device plugged into a wall socket. Access switches have several features to stop them.

Port security

Port security limits which and how many source media access control (MAC) addresses may use a switch port. A port in a meeting room might allow two MAC addresses (an IP phone and a laptop); a third device, or a tool that floods the switch with fake MAC addresses, triggers a violation.

Switch1(config)# interface GigabitEthernet0/5
Switch1(config-if)# switchport mode access
Switch1(config-if)# switchport access vlan 10
Switch1(config-if)# switchport port-security
Switch1(config-if)# switchport port-security maximum 2
Switch1(config-if)# switchport port-security mac-address sticky
Switch1(config-if)# switchport port-security violation restrict

• switchport mode access is required: port security cannot be enabled on a port that negotiates its mode dynamically.
• switchport port-security turns the feature on. On its own it allows one MAC address and uses violation mode shutdown.
• maximum 2 allows two secure MAC addresses.
• mac-address sticky learns the first addresses dynamically and writes them into the running configuration, so they survive a reload once you save it.
• violation restrict sets what happens when an extra address appears (see the table).

Switch1# show port-security interface GigabitEthernet0/5
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address:Vlan   : 0000.5e00.5312:10
Security Violation Count   : 3

Two sticky addresses were learned and three frames from an extra device were dropped. In shutdown mode the port status would read Secure-shutdown and show interfaces status would show it as err-disabled; you recover it with shutdown followed by no shutdown on the interface, after removing the cause.

DHCP snooping and dynamic ARP inspection

A rogue DHCP server — a home router plugged in by mistake, or an attacker's laptop — can hand out itself as the default gateway and see all traffic. DHCP snooping classifies switch ports as trusted (uplinks and the port of the real DHCP server) or untrusted (everything else, by default). DHCP server messages such as OFFER and ACK arriving on an untrusted port are dropped. As a side effect the switch builds a binding table: which IP address was leased to which MAC address, on which port and VLAN. The DHCP page explains the exchange itself.

Switch1(config)# ip dhcp snooping
Switch1(config)# ip dhcp snooping vlan 10
Switch1(config)# ip arp inspection vlan 10
Switch1(config)# interface GigabitEthernet0/24
Switch1(config-if)# ip dhcp snooping trust
Switch1(config-if)# ip arp inspection trust

The first two lines enable DHCP snooping globally and for VLAN 10. GigabitEthernet0/24 is the uplink toward the DHCP server, so it is trusted for both features. Dynamic ARP inspection (DAI), enabled on the third line, uses the snooping binding table to check Address Resolution Protocol (ARP) messages on untrusted ports: an ARP reply claiming that the gateway's IP address belongs to some other MAC address is dropped. That stops ARP spoofing, explained on ARP and ICMP.

802.1X port-based authentication

Port security trusts MAC addresses, which are easy to fake. 802.1X is the IEEE standard for port-based network access control: a device must authenticate — with a username and password or, better, a certificate — before the switch port or wireless network lets its traffic through. Three roles take part:

• Supplicant: the client device (its 802.1X software) that asks for access.
• Authenticator: the switch or wireless access point that controls the port. Until authentication succeeds, it passes only authentication traffic.
• Authentication server: usually a RADIUS (Remote Authentication Dial-In User Service) server that checks the credentials and tells the authenticator whether to open the port, often including which VLAN to assign.

Between supplicant and authenticator, the Extensible Authentication Protocol (EAP) travels directly in Ethernet frames (EAP over LAN, EAPOL); the authenticator relays it to the RADIUS server inside RADIUS messages. The same mechanism secures enterprise Wi-Fi (WPA2- and WPA3-Enterprise), covered on Wireless Networking.

Securing device management

Whoever controls the switches and routers controls the network, so access to the devices themselves deserves the strictest protection.

R1(config)# ip domain name example.com
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# username netadmin privilege 15 secret Example-Only-42
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# access-class 10 in

• A domain name plus crypto key generate rsa creates the RSA (Rivest–Shamir–Adleman) key pair that Secure Shell (SSH) needs; ip ssh version 2 refuses the old, weaker SSH version 1.
• username … secret creates a local account with a hashed password (never use the reversible password keyword). The password here is a placeholder.
• On the virtual terminal lines, login local uses those accounts, transport input ssh refuses Telnet, and access-class 10 in reuses the standard ACL from above so only the admins' subnet may even try to log in. Configure every vty line the device has (often 0–15): a line left at its defaults is a way around these rules.

Use SSH, never Telnet: Telnet sends everything, passwords included, in clear text. In larger networks, local accounts are replaced by AAA (authentication, authorization and accounting) against a central server using Terminal Access Controller Access-Control System Plus (TACACS+) or RADIUS, so each administrator has a personal account, permissions can be limited per command, and every change is logged.

Finally, disable unused switch ports. An open port in an empty office is an invitation:

Switch1(config)# interface range GigabitEthernet0/10 - 20
Switch1(config-if-range)# switchport mode access
Switch1(config-if-range)# switchport access vlan 999
Switch1(config-if-range)# shutdown

The ports are forced into access mode (no trunk negotiation), moved to an unused "parking" VLAN 999 that goes nowhere, and shut down.

Zero trust and least privilege

Traditional designs trusted everything inside the firewall. That fails once an attacker is inside — through phishing, a stolen laptop or a compromised supplier. Zero trust drops the idea of a trusted inside: every request is authenticated, authorized and checked (who is the user, is the device healthy, is this access normal) no matter where it comes from, and access is granted per application rather than to whole networks.

Least privilege is the principle under all of this: every user, device and service gets only the access it needs for its task, and no more. A monitoring server needs read-only SNMP, not an administrator account; a printer VLAN needs to reach the print server, not the database.

Common attacks at a glance