Network Security and Services
Network Security and Services tests device hardening, Layer 2 access controls, basic ACLs, and the supporting services that keep a network manageable. RSTECH-level questions focus on port security, secure management, DHCP, DNS, NAT, NTP, syslog, and SNMP, with an emphasis on correct configuration and verification.
Hardening and Layer 2 controls
Use enable secret, local usernames with secret, SSH instead of Telnet, exec-timeout, and banners. Disable unused ports and place them in an unused VLAN. Port security limits MAC addresses on an access port: switchport port-security maximum 1, mac-address sticky, and a violation mode of protect, restrict, or shutdown. Shutdown puts the port into err-disabled state and requires errdisable recovery or manual shutdown/no shutdown. DHCP snooping blocks rogue DHCP servers by trusting only uplink ports; dynamic ARP inspection and BPDU guard add further protection.
ACLs and services
Standard ACLs filter by source address and should be placed near the destination. Extended ACLs filter source, destination, protocol, and port and should be placed near the source. Every ACL ends with an implicit deny. NAT overload translates many inside addresses to one outside address using ports. A Cisco router can act as a DHCP server with an address pool, excluded addresses, and a default router. NTP synchronizes time; syslog levels run from 0 (emergencies) to 7 (debugging); SNMPv3 adds authentication and encryption over v2c community strings.
Worked example
Secure Fa0/10 so only the first learned MAC is allowed and a second MAC shuts the port down. Enter interface configuration, use switchport mode access, switchport port-security, switchport port-security maximum 1, switchport port-security mac-address sticky, and switchport port-security violation shutdown. The reasoning: sticky learning records the first source MAC seen; a second MAC triggers the shutdown violation and err-disables the port. To recover automatically, configure errdisable recovery cause psecure-violation and an interval. Port security must be applied to access ports, not dynamic trunk ports.
Traps that cost marks
- An ACL's implicit deny drops traffic not explicitly permitted.
- Port security does not work as expected on trunk or dynamic ports.
- DHCP snooping trust belongs on the uplink toward the legitimate server.
- NAT requires clear inside and outside interface designations.
- SNMPv2c sends community strings in cleartext; SNMPv3 is the secure choice.