# Security **URL:** https://forum.networklessons.com/c/routing-switching/security/21.md [Latest](https://forum.networklessons.com/latest.md) · [Categories](https://forum.networklessons.com/categories.md) --- ## [About the Security category](https://forum.networklessons.com/t/about-the-security-category/27)
**Author:** [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 12:33pm UTC](https://forum.networklessons.com/t/about-the-security-category/27 "2016-12-13T12:33:23Z")
Any general security questions that are not about the ASA can be discussed here. --- ## [Unidirectional VPN](https://forum.networklessons.com/t/unidirectional-vpn/55469)
**Author:** [@1130](https://forum.networklessons.com/u/1130)\ **Replies:** 2\ **Last updated:** [February 18, 2025, 7:34pm UTC](https://forum.networklessons.com/t/unidirectional-vpn/55469 "2025-02-18T19:34:09Z")
Hi, first of all I hope the category of this post is somewhat accurate. Now for my question: I would like to establish an ipsec-isakmp based VPN that only works unidirectional. To iplement the unidirectional aspect of … --- ## [IOS-XE with IPv4/IPv6 Stateless DHCP and Zone Firewall](https://forum.networklessons.com/t/ios-xe-with-ipv4-ipv6-stateless-dhcp-and-zone-firewall/42470)
**Author:** [@tdean](https://forum.networklessons.com/u/tdean)\ **Replies:** 0\ **Last updated:** [January 22, 2024, 11:50pm UTC](https://forum.networklessons.com/t/ios-xe-with-ipv4-ipv6-stateless-dhcp-and-zone-firewall/42470 "2024-01-22T23:50:11Z")
Just because someone might find this useful as I found little help for the stateless IPv6 configuration to get the range from the ISP: Features of this config: IPv4 and IPv6 DHCP from ISP to end user. Zone firewall fo… --- ## [DMVPN using VRF aware ikev2 ios-xe](https://forum.networklessons.com/t/dmvpn-using-vrf-aware-ikev2-ios-xe/40251)
**Author:** [@jamesobradley](https://forum.networklessons.com/u/jamesobradley)\ **Replies:** 2\ **Last updated:** [October 24, 2023, 10:27pm UTC](https://forum.networklessons.com/t/dmvpn-using-vrf-aware-ikev2-ios-xe/40251 "2023-10-24T22:27:34Z")
Hello! Do you have any good troubleshooting references that could help as I begin to tackle the subject of DMVPN using vrf aware ikev2 connections? I have purchased the IKEv2 IPsec Virtual Privat Networks cisco press b… --- ## [Types of IPSec config](https://forum.networklessons.com/t/types-of-ipsec-config/39060)
**Author:** [@bh2o](https://forum.networklessons.com/u/bh2o)\ **Replies:** 3\ **Last updated:** [August 31, 2023, 6:16am UTC](https://forum.networklessons.com/t/types-of-ipsec-config/39060 "2023-08-31T06:16:17Z")
Hi Rene, In your course (Encor) you went through 3 types of IPSec tunnels, could you please verify if understanding is correct? It seems like 2 and 3 are more handy hence used more often ? 1.Cisco IPsec Tunnel Mode Co… --- ## [Telnet and SSH into a new switch](https://forum.networklessons.com/t/telnet-and-ssh-into-a-new-switch/36525)
**Author:** [@ajeet.ccnanp](https://forum.networklessons.com/u/ajeet.ccnanp)\ **Replies:** 1\ **Last updated:** [May 11, 2023, 4:56am UTC](https://forum.networklessons.com/t/telnet-and-ssh-into-a-new-switch/36525 "2023-05-11T04:56:08Z")
Hello friends , I have new cisco switch and I want to configure TELNET.SSH on it. Kindly tell me how configure it --- ## [SSL VPN second try!](https://forum.networklessons.com/t/ssl-vpn-second-try/32081)
**Author:** [@hannes.1967.hiller](https://forum.networklessons.com/u/hannes.1967.hiller)\ **Replies:** 14\ **Last updated:** [November 20, 2022, 6:18am UTC](https://forum.networklessons.com/t/ssl-vpn-second-try/32081 "2022-11-20T06:18:21Z")
Hi Folks, I am quite new to crypto. What’s absolute necessary that an IOS Router answers a TCP connect request by an AnyConnect client? I had an running config, had a router crash and can’t get it work again. When it… --- ## [VPN through Cascading Routers](https://forum.networklessons.com/t/vpn-through-cascading-routers/5835)
**Author:** [@bbanford86](https://forum.networklessons.com/u/bbanford86)\ **Replies:** 8\ **Last updated:** [June 26, 2021, 6:11am UTC](https://forum.networklessons.com/t/vpn-through-cascading-routers/5835 "2021-06-26T06:11:33Z")
I am working on a project in which we are installing equipment throughout a campus which we will need remote access to. The campus is providing us an outside network connection from their network which we are planning on… --- ## [Access Control List for SSH](https://forum.networklessons.com/t/access-control-list-for-ssh/11226)
**Author:** [@vishaul](https://forum.networklessons.com/u/vishaul)\ **Replies:** 3\ **Last updated:** [May 22, 2020, 8:04am UTC](https://forum.networklessons.com/t/access-control-list-for-ssh/11226 "2020-05-22T08:04:56Z")
Hi, I want to restrict SSH access to only certain IP addresses (Loopback & Management VLAN), on a router in this case Can you say if the configs below will work. int gig0/1 ip address 192.168.100.22 255.255.255.252 no… --- ## [MACsec: How do end devices work with MKA?](https://forum.networklessons.com/t/macsec-how-do-end-devices-work-with-mka/11239)
**Author:** [@nguyenvanca2110](https://forum.networklessons.com/u/nguyenvanca2110)\ **Replies:** 0\ **Last updated:** [May 19, 2020, 7:38am UTC](https://forum.networklessons.com/t/macsec-how-do-end-devices-work-with-mka/11239 "2020-05-19T07:38:10Z")
Hello, I am studying about Switching security (specifically MACsec 802.1AE) base 802.1X Authentication. I know that the step to establish a MACsec communication: Firstly, an end device (supplicant) will be authentica… --- ## [Can DMVPN spoke and hub be configured on sam Router?](https://forum.networklessons.com/t/can-dmvpn-spoke-and-hub-be-configured-on-sam-router/1211)
**Author:** [@rohitcn1234](https://forum.networklessons.com/u/rohitcn1234)\ **Replies:** 5\ **Last updated:** [October 3, 2019, 5:48pm UTC](https://forum.networklessons.com/t/can-dmvpn-spoke-and-hub-be-configured-on-sam-router/1211 "2019-10-03T17:48:09Z")
Hi I am trying to configure DMVPN Hub and Spoke on a single router, although all the configs are right i do not see Tunnel getting formed ? Just wanted to know if it is possible to configure this on a single router ? I… --- ## [AAA, 802.1x, Dot1x dynamic port configuration](https://forum.networklessons.com/t/aaa-802-1x-dot1x-dynamic-port-configuration/7477)
**Author:** [@nelsonjonathanscott](https://forum.networklessons.com/u/nelsonjonathanscott)\ **Replies:** 0\ **Last updated:** [June 19, 2019, 5:03pm UTC](https://forum.networklessons.com/t/aaa-802-1x-dot1x-dynamic-port-configuration/7477 "2019-06-19T17:03:19Z")
Hi, I’m working on setting up my switch to use 802.1x for user authentication on the switch along with port authentication for the end user/endpoints. I’m running 15.2(4) on my 2960x stack. I’ve gotten the switch user… --- ## [A qustion about DAI packet tracer](https://forum.networklessons.com/t/a-qustion-about-dai-packet-tracer/6922)
**Author:** [@orene10](https://forum.networklessons.com/u/orene10)\ **Replies:** 0\ **Last updated:** [April 24, 2019, 1:12pm UTC](https://forum.networklessons.com/t/a-qustion-about-dai-packet-tracer/6922 "2019-04-24T13:12:20Z")
Dear Rene’ I need your help please : Following the packet tracer of DAI in this further link : https://networklessons.com/switching/dai-dynamic-arp-inspection , there is an important line : SW1(config)#ip arp inspectio… --- ## [NAT over VPN and Outside interface](https://forum.networklessons.com/t/nat-over-vpn-and-outside-interface/6711)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 2\ **Last updated:** [April 11, 2019, 8:04pm UTC](https://forum.networklessons.com/t/nat-over-vpn-and-outside-interface/6711 "2019-04-11T20:04:02Z")
Dear Rene, I want to achieve NAT over VPN tunnel and over Internet using Outside interface of ASA to same Internal IP. I created VPN tunnel with ASA Outside interface and nat one static IP 10.120.0.3 to 10.0.0.3. This … --- ## [ACL different output displayed](https://forum.networklessons.com/t/acl-different-output-displayed/6668)
**Author:** [@skygremlin](https://forum.networklessons.com/u/skygremlin)\ **Replies:** 2\ **Last updated:** [April 1, 2019, 2:55pm UTC](https://forum.networklessons.com/t/acl-different-output-displayed/6668 "2019-04-01T14:55:58Z")
I’m trying to figure out why a new subnet can’t get out of our VSS L3 switch’s. So I started looking at the ACL’s. I found if I run a show ip access-lists and compare that to the access-list section of show run.. The … --- ## [IP Source Guard](https://forum.networklessons.com/t/ip-source-guard/6246)
**Author:** [@rightpoints23](https://forum.networklessons.com/u/rightpoints23)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 2:14pm UTC](https://forum.networklessons.com/t/ip-source-guard/6246 "2019-02-13T14:14:03Z")
I configured the switch port for voice and data vlans. I was trying to use IP source guard for this port but it was failing. I can see the phone IP address in the DHCP binding table but the IP source guard was failing. … --- ## [Login authenication AUTH\_LIST](https://forum.networklessons.com/t/login-authenication-auth-list/6127)
**Author:** [@alexander.abelincon](https://forum.networklessons.com/u/alexander.abelincon)\ **Replies:** 0\ **Last updated:** [January 31, 2019, 6:32am UTC](https://forum.networklessons.com/t/login-authenication-auth-list/6127 "2019-01-31T06:32:36Z")
login authenication AUTH\_LIST The syntax for login authenication what does the AUTH\_LIST do ? Is it an variable for the name of an access-list? Or is login authenication AUTH\_LIST is an actual excutable command for VT… --- ## [IKEv2 For Site to Site VPN](https://forum.networklessons.com/t/ikev2-for-site-to-site-vpn/5527)
**Author:** [@saini.bhupesh](https://forum.networklessons.com/u/saini.bhupesh)\ **Replies:** 3\ **Last updated:** [November 27, 2018, 9:53am UTC](https://forum.networklessons.com/t/ikev2-for-site-to-site-vpn/5527 "2018-11-27T09:53:03Z")
Hi Rene, Can you help me these configs crypto ikev2 proposal AMT\_Proposal encryption aes-cbc-256 integrity sha512 group 14 ! ! crypto ikev2 keyring AMT-DMVPN-KEY peer ANY address 0.0.0.0 0.0.0.0 pre-shared-key… --- ## [Configure Wired 802.1x with NPS and Cisco Switch](https://forum.networklessons.com/t/configure-wired-802-1x-with-nps-and-cisco-switch/5118)
**Author:** [@aungzawtun305](https://forum.networklessons.com/u/aungzawtun305)\ **Replies:** 1\ **Last updated:** [October 11, 2018, 11:04am UTC](https://forum.networklessons.com/t/configure-wired-802-1x-with-nps-and-cisco-switch/5118 "2018-10-11T11:04:48Z")
Dear Sir, I am beginner in networking. i would like to ask about 802.1x authenication . i try to configure 802.1x Configure Wired 802.1X with NPS without using ISE or third-party appliance. i followed these tutorials. … --- ## [3515 ACS and ISE](https://forum.networklessons.com/t/3515-acs-and-ise/4637)
**Author:** [@vlagrott](https://forum.networklessons.com/u/vlagrott)\ **Replies:** 1\ **Last updated:** [August 17, 2018, 2:55pm UTC](https://forum.networklessons.com/t/3515-acs-and-ise/4637 "2018-08-17T14:55:01Z")
Hi, I am trying to figure out what to order. I have an existing 3515 with ACS application and ordering a new 3515 with ISE application. The goal is to upgrade the existing 3515 to ISE. I will have around 150 nodes. Is th… --- ## [Cisco ACS to ISE migration](https://forum.networklessons.com/t/cisco-acs-to-ise-migration/4555)
**Author:** [@vlagrott](https://forum.networklessons.com/u/vlagrott)\ **Replies:** 5\ **Last updated:** [August 17, 2018, 2:48pm UTC](https://forum.networklessons.com/t/cisco-acs-to-ise-migration/4555 "2018-08-17T14:48:35Z")
Hi, I currently have SNS-3515-ACS-K9 running 5.8.1.4. I have to get two appliances for primary/secondary. Currently, I only have one appliance. The second appliance will be 3515-ISE-K9. Does Cisco provide a migration to… --- ## [Ipsec vpn site to site behind adsl](https://forum.networklessons.com/t/ipsec-vpn-site-to-site-behind-adsl/4248)
**Author:** [@magsisitroyfranklin](https://forum.networklessons.com/u/magsisitroyfranklin)\ **Replies:** 1\ **Last updated:** [July 4, 2018, 5:32pm UTC](https://forum.networklessons.com/t/ipsec-vpn-site-to-site-behind-adsl/4248 "2018-07-04T17:32:47Z")
Hi Renee, I hope you will read this i just want to ask you if it is possible to create a ipsec vpn site to site behind adsl connection? if it is possible how… thanks for you reply --- ## [Cisco vpn client](https://forum.networklessons.com/t/cisco-vpn-client/4137)
**Author:** [@mexaud](https://forum.networklessons.com/u/mexaud)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 9:33am UTC](https://forum.networklessons.com/t/cisco-vpn-client/4137 "2018-06-22T09:33:17Z")
Hello, am new here, have a qn that i need your help. Which port(s) is used to enable VPN client to run across a network perimeter? the issue is i am running a vpn client to connect to a remote partner but it doesnt go … --- ## [Prefix-List and Access-List](https://forum.networklessons.com/t/prefix-list-and-access-list/3092)
**Author:** [@bil-khan](https://forum.networklessons.com/u/bil-khan)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 12:02pm UTC](https://forum.networklessons.com/t/prefix-list-and-access-list/3092 "2018-03-06T12:02:48Z")
I want to know a detailed explanation with examples on difference between access list and prefix list --- ## [Cisco devices login using Radius/2FA & Local](https://forum.networklessons.com/t/cisco-devices-login-using-radius-2fa-local/2827)
**Author:** [@sivak80nayan](https://forum.networklessons.com/u/sivak80nayan)\ **Replies:** 1\ **Last updated:** [February 9, 2018, 11:20am UTC](https://forum.networklessons.com/t/cisco-devices-login-using-radius-2fa-local/2827 "2018-02-09T11:20:05Z")
I want to access my Cisco devices using 2FA(Radius+LoginTC) as primary login and secondary as Local login, there should be time out between 2FA and Local access, Incase 2FA is down and also is it possible to configure th… --- ## [Using IPSEC transport mode](https://forum.networklessons.com/t/using-ipsec-transport-mode/572)
**Author:** [@drbk563](https://forum.networklessons.com/u/drbk563)\ **Replies:** 1\ **Last updated:** [January 11, 2016, 11:11am UTC](https://forum.networklessons.com/t/using-ipsec-transport-mode/572 "2016-01-11T11:11:17Z")
Hi, Why can’t I use transport mode when setting up site to site vpns? I tried setting up a site to site vpn and using transport mode and I noticed it didn’t change phase 2 still showed tunnel mode. Thank you --- ## [DHCP Snooping with Relays](https://forum.networklessons.com/t/dhcp-snooping-with-relays/2570)
**Author:** [@mailharrye](https://forum.networklessons.com/u/mailharrye)\ **Replies:** 1\ **Last updated:** [December 20, 2017, 4:10pm UTC](https://forum.networklessons.com/t/dhcp-snooping-with-relays/2570 "2017-12-20T16:10:38Z")
How do you configure DHCP snooping with relays? --- ## [TACAC+ configure](https://forum.networklessons.com/t/tacac-configure/2322)
**Author:** [@tityaouch168](https://forum.networklessons.com/u/tityaouch168)\ **Replies:** 4\ **Last updated:** [November 10, 2017, 2:34pm UTC](https://forum.networklessons.com/t/tacac-configure/2322 "2017-11-10T14:34:02Z")
Hi all, did you used to configure TACACS+ with cisco N3K ? we try but when we telnet it still use local database user. any suggestion plz help share. --- ## [Jumbo Frame and Route based VPN tunnel](https://forum.networklessons.com/t/jumbo-frame-and-route-based-vpn-tunnel/1881)
**Author:** [@azmuddincisco](https://forum.networklessons.com/u/azmuddincisco)\ **Replies:** 3\ **Last updated:** [July 7, 2017, 11:38am UTC](https://forum.networklessons.com/t/jumbo-frame-and-route-based-vpn-tunnel/1881 "2017-07-07T11:38:08Z")
I think I saw a lesson about Jumbo frame couple of months ago, but I do not find it anymore. Would someone please help me to find this lesson? Also, I am not sure if there is any lesson for Route based VPN. I have not fo… --- ## [Applying multiple access lists to an interface](https://forum.networklessons.com/t/applying-multiple-access-lists-to-an-interface/42)
**Author:** [@gordonflash984](https://forum.networklessons.com/u/gordonflash984)\ **Replies:** 4\ **Last updated:** [July 6, 2017, 10:09am UTC](https://forum.networklessons.com/t/applying-multiple-access-lists-to-an-interface/42 "2017-07-06T10:09:23Z")
If I want to apply 2 different access lists to my outside interface inbound i.e access list 110 and 111 I have to combine them into 1 access list or choose the one I want to apply? From my understanding you can only hav… [Next page](https://forum.networklessons.com/c/routing-switching/security/21.md?page=1)