Basic Terminology

IP addresses: Each machine on the internet is assigned a unique address called an IP address.
Domain Names: Human readable ip addresses are called domain names.
Protocols: Predefined way that someone(program or person) who wants to use a service, talks with that service.
IP:  the main delivery system for information over the internet
TCP(transmission control protocol): used to break apart and rebuild information that travels over the intenet
HTTP(Hyper Text Transfer Protocol): used for webpages
FTP: used to download & upload files
UDP(User Datagram Protocol): used for information that require no response, such as streaming audio & video
ICMP(Internet Control Message Protocol): used by a router to exchange the information with other routers
SMTP(Simple Mail Transport Protocol): used to send text based information
SNMP(Simple Network Management Protocol): Used to collect system information from a remote computer.
Telnet: Used to perform commands on a remote computer

ACCESS CONTROL LIST

• 
  

• For protecting routers, Layer 3 forwarding (IP routing), and the layer 3 control plane(routing protocols), additionally RFCs 2827 & 3704 outline other types of protections
• RFC 2827 addresses issues with
• the use of the IP source & destination fields in the IP header to form some kind of attack
• RFC 3704 details some issues related to how the tools of 2827 may be best deployed over the internet.
• 
  

KEY LAYER 3 SECURITY recommendations from SAFE blueprint

• Using Secure Shell, enable secure telnet access to a router user interface.
• Enable SNMP security, particularly  adding SNMPv3 support
• Turn off all unnecessary servieces on the router platform
• Turn on logging to provide an audit trail
• Enable routing protocol authentication
• Enable the CEF forwarding path to avoid using flow-based paths like fast switching

General Layer 2 Security Recommendatinos

• Put unused switch ports in an unused VLAN & not use the VLAN 1.
• Native VLANs are not use on trunks.
• Reason is, an attacker on an access port might be able to hop from its access port VLAN to a trunk's native VLAN by sending frames that begin with multiple 802.1Q header.
• Cisco suggest using a different native VLAN for each trunk.
• Private VLANs restrict hosts on some ports from sending frames directly to each other.
• Private VLANs are created with some number of selected ports in the primary VLAN, with other isolated & community ports in one or more secondary VLANs.
• Isolated ports can send frames only to selected ports, and community ports can send frames to selected ports & other community ports in the same 2ry VLAN.
• Private VLANs could be applied generally for better security by making user ports isolated,
• They only allowing them access to ports like routers, servers or other network services.
• However, DHCP snooping, DAI & IP source gaurd are typically better choices
• Attackers uses the default gateway to overcome security provided by PVlans,
• to solve this router simply need inbound ACL, that denies traffic whose source & destination ip address are in the same local connected subnet.