Network Security and Access Control
Authentication and authorisation
AAA separates authentication, authorisation and accounting. TACACS+ uses TCP 49 and encrypts the entire payload, making it the usual choice for device administration. RADIUS uses UDP 1812/1813 and encrypts only the password, which suits network access policy. 802.1X carries EAP over LAN (EAPOL) between supplicant and authenticator, with the switch relaying to the RADIUS server; MAB falls back to a MAC address when no supplicant exists.
Enforcement points
Router ACLs are stateless and evaluated top-down with an implicit deny all at the end, so ordering is everything. Wildcard masks are inverted subnet masks: 0.0.0.255 matches the last octet. Direction is from the device's perspective - inbound means entering the interface before the routing decision. Firewalls add stateful inspection; zone-based policy ties interfaces to zones and permits traffic between zones explicitly.
Layer 2 hardening
Port security limits learned MACs and can restrict, protect or shut down. DHCP snooping marks uplinks as trusted and blocks rogue servers; Dynamic ARP Inspection uses the snooping table to drop forged ARP; IP Source Guard binds source IP to port.
Crypto and segmentation
IPsec uses IKE (v2 preferred) for key exchange, then ESP for confidentiality and integrity; AH provides integrity only and does not survive NAT. TLS protects application sessions and should be terminated as close to the workload as policy allows. Segmentation and least-privilege east-west rules reduce blast radius - zero trust means authenticate and authorise every flow, not simply trust the LAN.
Worked example
An ACL reads: permit tcp any host 10.0.0.5 eq 443, then deny ip any any, then permit ip any any. The third line never matches. Worse, reversing the first two lines blocks the intended HTTPS traffic with no log entry. The fix is to place the specific permit before the deny, and log denies during validation.
Traps that cost marks
Using a subnet mask instead of a wildcard, applying an ACL in the wrong direction, forgetting the implicit deny, and assuming AH traverses NAT.