NEED FOR IPv6

• IPv4 has 32 bits address value which gives us only 4,294,467,295 IP addresses.

• Initially only Non VLSM were used which caused the system to use classfull addresses.

• Hence Class C gives you a block of 256 IP addresses, class B is 65.535 IP addresses, and
a class A even 16,777,216 IP addresses

• If the total assigned addresses were not used then it lead to wastage of address values

• To overcome this wastage we introduced VLSM (Variable Length Subnet Mask) –

Classless Addressing,

• We could use any subnet mask we like and create smaller subnets, we no longer had to
use the class A, B, or C networks
 NEED FOR IPv6

• IP version 5 was used for an experimental project called “Internet Stream Protocol”

• IPv6 has 128-bit addresses and has a much larger address space than 32-bit IPv4

IPv6: 34,02,82,36,69,20,93,84,63,46,33,74,60,74,31,76,82,11,456 (addresses)

IPv4: 4,29,44,67,295 (addresses)

• IPv6 addresses are hexadecimal and since they are 128-bit, they are quite long(8 groups
of 2 Bytes)

• If there is a string of zeros then you can remove them once.

Original: 2041:0000:140F:0000:0000:0000:875B:131B
Short: 2041:0000:140F::875B:131B
 NEED FOR IPv6

• The address can be shortened even more:

• Short: 2041:0000:140F::875B:131B
• Shorter: 2041:0:140F::875B:131B

• If we have a “hexadectet” with 4 zeros then you can remove those and leave a single
zero.

• Just like how IPv4 addresses have a subnet mask like [Link] , for IPv6 we use
a prefix length.

• If we have an IPv6 prefix: 2001:1111:2222:3333::/64 , then it means that

2001:1111:2222:3333 is the prefix and everything behind it can be used for hosts.
 NEED FOR IPv6

• Each hexadecimal character represents 4 binary bits

• IPv6 use stateless address autoconfiguration (SLAAC)

• There are 3 main type of address types : Unicast , Multicast and Anycast.

• In IPv6 we use , 17 -UDP (v6) : for data streaming (stateless)

6 -TCP (v6) : for controlled Transmission (statefull)
1 -ICMP(v6): for controlling data flow , error reporting , Diagnostics
 IPv6 (CHARACTERISTICS)

• No Broadcast traffic: that’s right, we don’t use broadcasts anymore. We use multicast
instead. This means some protocols like ARP are replaced with other solutions.

• Stateless Autoconfiguration: this is like a “mini DHCP server.” Routers running IPv6
are able to advertise the IPv6 prefix and gateway address to hosts so that they can
automatically configure themselves and get access outside of their own network.

• Address Renumbering: renumbering static IPv4 addresses on your network is a pain. If

you use stateless autoconfiguration for IPv6, you can easily swap the current prefix with
another one.

• Mobility: IPv6 has built-in support for mobile devices. Hosts will be able to move from
one network to another and keep their current IPv6 address.
 IPv6 (CHARACTERISTICS)

• No NAT / PAT: we have so many IPv6 addresses that we don’t need NAT or PAT
anymore. Every device in your network can have a public IPv6 address.

• IPsec: IPv6 has native support for IPsec, you don’t have to use it, but it’s built-in the
protocol.

• Improved header: the IPv6 header is simpler and doesn’t require checksums. It also has
a flow label that is used to quickly see whether certain packets belong to the same flow.

• Migration Tools: IPv4 and IPv6 are incompatible, so we need migration tools. We can
use multiple tunneling techniques to transport IPv6 over IPv4 networks (or the other way
around). Running IPv4 and IPv6 simultaneously is called “dual stack.”
 IPv6 (ADDRESSING TYPES)

• The Internet Assigned Numbers Authority (IANA) allocates only a small portion of the
whole IPv6 space.

• IANA provides global unicast addresses that start with leading leftmost bits 001.
IPv6 (ADDRESSING TYPES)
 IPv6 (ADDRESSING TYPES)

Unicast -

• A network layer identifier for a single interface of IPv6 enabled node.

• Packets sent to a unicast address are delivered to the interface configured with that IPv6
address.

• Therefore, it is one-to-one communication.

 IPv6 (ADDRESSING TYPES)

Multicast -

• A network layer identifier for a set of interfaces, belonging to different IPv6 enabled
nodes.

• Packets sent to a multicast address are delivered to all interfaces identified by that
address.

• Therefore, it is one-to-many communication.

 IPv6 (ADDRESSING TYPES)

Anycast -

• A network layer identifier for a set of interfaces, belonging to different IPv6 enabled
nodes.

• Packets sent to an anycast address are delivered to the "closest" interface identified by
that address.

• "Closest" typically means the one with the best routing metric according to the IPv6
routing protocol.

• Therefore, it is one-to-closest communication.

 IPv6 (GLOBAL UNICAST)

• Aggregatable global unicast addresses are part of the global routing prefix.

• The structure of these addresses enables for aggregation of routing entries to achieve a
smaller global IPv6 routing table.

• At present, all global unicast addresses start with binary value 001 (2000::/3).

• Their structure consists of a 48-bit global routing prefix and a 16-bit subnet ID also
referred to as Site-Level Aggregator (SLA).
 IPv6 (GLOBAL UNICAST)

• example of allocating global unicast addresses.

• IANA currently allocates addresses from the prefix 2000::/3 to the regional
providers.

• For example, part of this address space is allocated to ARIN.

• ARIN then allocates sub-parts of this address space 2001:18::/23 to ISPs and
large customers.
 IPv6 (LOCAL LINK)

• IPv6 link-local is a special type of unicast address that is auto-configured on any

interface using a combination of the link-local prefix FE80::/10 (first 10 bits equal to
1111 1110 10) and the MAC address of the interface.

• It enable nodes attached to a common link to communicate without the need for
globally unique addresses
 IPv6 (LOCAL LINK)

• When several IPv6 enabled nodes are connected to a switch, they will auto-configure
their interfaces with link-local addresses, will discover each other, and be able to
communicate.

• The scope of the link-local address is only its respective link.

• Routers do not forward packets that have a link-local source or destination addresses to
other links
 IPv6 (LOCAL LINK)

• A loopback address identifies a logical interface that has no physical representation and is
always up and running.

• Packets sent to a loopback address are returned (looped) on the same interface.

• Loopback addresses are typically used for testing the TCP/IP networking stack.

• In IPv4, the entire network [Link]/8 address range is reserved for loopback addresses

• Most operating systems use the address [Link] as the loopback address and is
called "localhost" by default

• The rest of the [Link]/8 address space is typically not used.

• the IPv6 address 0:0:0:0:0:0:0:1/128 is reserved for loopback identifier

 IPv6 (UNSPECIFIED)

• The unspecified address in a special type of address with all binary bits set 0.

• Therefore, in v4 it looks like [Link]/32 and in v6 it looks like 0:0:0:0:0:0:0:0 or

completely shortened as ::/128.

• The unspecified address is used by the Operating Systems in the absence of any valid IP
address and processes like DHCP.
 IPv6 (UNIQUE LOCAL ADDRESS)

• A unique local address is a special type of globally unique IPv6 address that has the
following characteristics:

• It has a globally unique prefix similar to global unicast addresses.

• If it is accidentally leaked outside of the organization, there will be no conflict with other
IPv6 global prefixes.

• Its structure is well-known which allows for easy filtering at site boundaries.

• It allows sites to be interconnected without creating any address conflicts.

• It is an Internet Service Provider independent address space.

IPv6 (UNIQUE LOCAL ADDRESS)
 IPv6 (MULTICAST ADDRESS)

• Network multicast is a technique in which a node sends packets to multiple destinations

simultaneously (one-to-many).

• The destinations actually are a set of interfaces, identified by a single multicast address
known as a multicast group.

• In IPv6, multicast addresses are distinguished from all other types by the value of the
leftmost 8 bits of the addresses: a value of 11111111 (hex digits FF) identifies that the
address is multicast.

• Therefore, all multicast addresses are part of the prefix ff00::/8, which is equivalent to the
IPv4 multicast address space of [Link]/4.
 IPv6 (MULTICAST ADDRESS)

• Two important rules apply to IPv4 and IPv6 multicast:

• Packets sent to a multicast group always has a unicast source address.

• A multicast address can not be a source address of a packet.

• There aren't broadcast addresses in IPv6.

• In IPv6 this functionality is done using special multicast groups.

• In IPv6, all well-known multicast addresses start with the prefix ff00::/12.

• The first 3 hexadecimal digits of an address will always be ff0

IPv6 (MULTICAST ADDRESS)
 IPv6 (SOLICITED MULTICAST ADDRESS)

• A solicited-node multicast address is a special type of IPv6 multicast.

• It is used as a more efficient approach for broadcast delivery.

• A solicited-node multicast address is generated automatically using an IPv6 unicast of an

interface.

• When an interface is configured with an IPv6 unicast address, a solicited-node multicast

address is generated automatically based on the unicast address for this interface and the
node joins the multicast group.

• Any unicast address has a corresponding solicited-node multicast address.

• This auto-generated multicast group is then used for address resolution, neighbor
discovery, and duplicate address detection.
IPv6 (SOLICITED MULTICAST ADDRESS)
 IPv6 (ANYCAST ADDRESS)

• An anycast address is a network layer identifier typically assigned to more than one
interface (a set of interfaces), belonging to different IPv6 enabled nodes.

• Packets sent to an anycast address are delivered to the "nearest" interface identified by
that address.

• "Nearest" typically means the one with the best routing metric according to the IPv6
routing protocol.

• Anycast addresses are allocated from the unicast address space, therefore they are
indistinguishable from global unicast addresses.

• Configuring the same unicast address to more than one interface makes it an anycast
address.
 IPv6 (ADDRESSING ASSIGNMENT)

• AFRINIC: Africa
• APNIC: Asia/Pacific
• ARIN: North America
• LACNIC: Latin America and some Caribbean Islands
• RIPE NCC: Europe, Middle east and Central Asia
IPv6 (ADDRESSING ASSIGNMENT)

• IANA is using the 2000::/3 prefix for global unicast address space.

• According to this list, RIPE NCC received prefix 2001:4000::/23

from IANA.

• A large ISP called Ziggo in The Netherlands receives prefix

2001:41f0::/32 from RIPE NCC.

• The ISP assigns prefix 2001:41f0:4060::/48 to one of their

customers.
 IPv6 (ADDRESSING ASSIGNMENT)

• The 48-bit prefix that we received is typically called the global routing prefix or site
prefix.

• The interface ID is normally 64 bit which means we have 16 bits left to create subnets.

• 16 bits gives us 4 hexadecimal characters.

• All possible combinations from 0000 to FFFF are valid subnets

 IPv6 (EUI -64)

• EUI-64 (Extended Unique Identifier) is a method we can use to automatically

configure IPv6 host addresses.

• An IPv6 device will use the MAC address of its interface to generate a unique 64-bit
interface ID.

• The MAC address is split it into two pieces and the value “FFFE” is inserted in between
the two pieces so that we have a 64 bit value and the 7th bit of the interface ID is
inverted.
 IPv6 (EUI -64)

• If the MAC address is 1234:56AA:ABCD , the the Interface ID is given by

1234: 56 FF:FEAA:ABCD

Consider the first 4 hexadecimal bit : 1234

Here the seventh bit can be obtained by converting the starting values 1 and 2
00010010 Is converted to 00010000

Hence the Interface ID is given by : 1034:56FF:FEAA:ABCD

 IPv6 (Neighbor Discovery Protocol)

• ND (Neighbor Discovery Protocol) replaces the functionality of ARP

• ND uses ICMP and solicited-node multicast addresses to discover the layer two address
of other IPv6 hosts on the same network (local link).

• It operates at the link layer of OSI model.

• It allows for stateless auto configuration of IP addresses

• Stateless IP configuration allows node to connect to the internet without DHCP server.

• NDP helps in mapping of IPv6 address to physical Address

• It performs Neighbor Unreachability Detection to find if neighbor is reachable or not.

 IPv6 (Neighbor Discovery Protocol)

• It performs Duplicate Address Detection (DAD) which help to determine if an IP address

is already in use.

• It contains 5 ICMPv6 type messages to accomplish this:

• Router Solicitation (ICMPv6 type 133)

• Router Advertisement (ICMPv6 type 134)
• Neighbor Solicitation (ICMPv6 type 135)
• Neighbor Advertisement (ICMPv6 type 136)
• Redirect Message (ICMPv6 type 137)
 IPv6 (Router Solicitation Message)

• A multicast message is send from the user to identify the various routers present in the
topology

• This message request all the available routers to send the address information about the
receiver.

• This message is called Router Solicitation Message.

• The router Solicitation message contains the following header fields :

• ICMPv6 type : 133

• Source IPv6 address : local link address of the Source
• Destination IPv6 address : All router destination multicast address (for all
routers)
 IPv6 (Router Advertisement Message)

• Router Advertisement is in response to the Router Solicitation Message

• It is send by routers only

• The Router Advertisement Header contains the following header fields :

• ICMPv6 type : 134

• Source IPv6 address : router link local address
• Destination IPv6 address : All node multicast address (to all node)

• The Route Advertisement Message contains IPv6 prefix, Address auto configuration
(stateless or state full),Default gateway information,Hop limit and maximum transmission
unit.(MTU)
 IPv6 (Neighbor Solicitation Message)

• It is used by nodes to determine link layer address of the neighbor or if neighbor is

reachable.

• It help to identify the mac address of the neighbor.

• The Neighbor Solicitation Header contains the following header fields :

• ICMPv6 type : 135

• Source IPv6 address : unicast address of sender
• Destination IPv6 address : Solicitated node Multicast of receiver MAC address
 IPv6 (Neighbor Solicitation Message)

• The neighbor solicitation message is used primarily to find the layer two address of
another IPv6 address on the local link.

• It is used for DAD (Duplicated Address Detection) also.

• The source address will be the source address of the host sending the neighbor
solicitation.

• The destination address will be the solicited-node multicast address of the remote host.

• This message also includes the layer two address of the host sending it.

• In the ICMP header of this packet, you will find a type value of 135.
 IPv6 (Neighbor Advertisement Message)

• It is used by nodes to reply to Neighbor Solicitation Message

• It help to identify the mac address of the neighbor.

• The Neighbor Advertisement Header contains the following header fields :

• ICMPv6 type : 136

• Source IPv6 address : unicast address of sender
• Destination IPv6 address : unicast address of receiver
 IPv6 (Redirect Message)

• It is send by the router to the sender

• It is used to send information of a better path to the destination than the previous path

• The Redirect Header contains the following header fields :

• ICMPv6 type : 137

• Source IPv6 address : SRS link local address of Router
• Destination IPv6 address : Link local Address of a node
 DHCPv6

• In IPv6 , the Ipv6 address can be obtained by three methods :

• Stateless Address Auto Configuration (SLAAC)

• Stateful Address Autoconfiguration

• Manual

• SLAAC : The ability of a host to get address information itself

• It does not maintain state such as address assignment

• By default IPv6 hosts use SLAAC

 DHCPv6

• Stateful address autoconfiguration refer to centrally manage IPv6 address assignment

• Client and Server state must be maintained

• Here a DHCPv6 Server is used for Address state Configuration

• DHCPv6 help in configuring IPv6 clients with IP prefixes

• It is used if router advertisement message enables the use of DHCPv6

• The default multicast address for all IPv6 DHCP server: FF02:1:2
 DHCPv6

• Initially a neighbour solicitation address is send to the local router

• The local router will inform the node to approach a DHCP server if it is not aware of the
address

• The node will send a Solicit , Advertise, Request and Reply for obtaining the IPv6
address

• A network can use both stateful and stateless autoconfiguration .

 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)

• Access-list (ACL) is a set of rules defined for controlling network traffic and reducing
network attacks.

• ACLs are used to filter traffic based on the set of rules defined for the incoming or
outgoing of the network.

• ACL are configured on interfaces of routers.

• Access-lists work on the network (layer 3: IP address) and the transport (layer 4: Port
number) layer and can be used for two different things:

• Filtering
• Classification
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)

• ACL is implemented to filter both inbound traffic (data coming into the router) and
outbound traffic (data going out of router)

ACL features -

• The set of rules defined are matched serial wise i.e. matching starts with the first line,
then 2nd, then 3rd, and so on.

• The packets are matched only until it matches the rule. Once a rule is matched then no
further comparison takes place and that rule will be performed.

• There is an implicit denial at the end of every ACL, i.e., if no condition or rule matches
then the packet will be discarded.
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)

• Access-lists don’t use subnet masks but wildcard bits.

• A wildcard mask can be thought of as an inverted subnet mask. A wildcard mask will use
1s for host bits and 0s for network bits

• For example, a subnet mask of [Link] (11111111.11111111.11111111.00000000)

inverts to a wildcard mask of [Link] (00000000.00000000.00000000.11111111).

• Wildcard masks are also used for:

• Routing protocols such as OSPF, EIGRP and BGP
• Route maps
• IP summarization
• Network Address Translation (NAT)
• Virtual Routing and Forwarding (VRFs)
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)

SUBNET MASK SLASH NOTATION WILDCARD MASK

[Link] /8 [Link]
[Link] /16 [Link]
[Link] /24 [Link]
[Link] /25 [Link]
[Link] /26 [Link]
[Link] /27 [Link]
[Link] /28 [Link]
[Link] /29 [Link]
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
• Inbound access lists -

When an access list is applied on inbound packets of the interface then first the packets will
be processed according to the access list and then routed to the outbound interface.

• Outbound access lists -

When an access list is applied on outbound packets of the interface then first the packet will
be routed and then processed at the outbound interface.

• ACL can do filtering based on

• Layer 2 ( MAC address){CCNP TOPIC}

• Layer 3 ( IP address)
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
• There are two types of ACL :

• Standard ACL
• Extended ACL

STANDARD ACCESS-LIST -

• These are the Access-list that are made using the source IP address only.

• These ACLs permit or deny the entire protocol suite.

• They don't distinguish between the IP traffic such as TCP, UDP, HTTPS, etc.

• By using numbers 1-99 or 1300-1999, the router will understand it as a standard ACL and
the specified address as the source IP address.
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
EXTENDED ACCESS-LIST -

• These are the ACL that uses source IP, Destination IP, source port, and Destination port.

• These types of ACL, we can also mention which IP traffic should be allowed or denied.

• These use range 100-199 and 2000-2699.

 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
• There are two categories of access-list:

1. Numbered access-list -

• These are the access list that cannot be deleted specifically once created i.e if we want to remove any rule from an
Access-list then this is not permitted in the case of the numbered access list.

• If we try to delete a rule from the access list then the whole access list will be deleted.

• The numbered access-list can be used with both standard and extended access lists.

2. Named access list -

• In this type of access list, a name is assigned to identify an access list.

• It is allowed to delete a named access list, unlike numbered access list.

• Like numbered access lists, these can be used with both standards and extended access lists.
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
• The standard Access-list is generally applied close to the destination.

• The extended Access-list is generally applied close to the source.

• We can assign only one inbound and outbound ACL is permitted per interface.

• We can't remove a rule from an Access-list if we are using numbered Access-list. If we try
to remove a rule then the whole ACL will be removed.

• If we are using named access lists then we can delete a specific rule.

• Every new rule which is added to the access list will be placed at the bottom of the access
list.
 SECURITY FUDAMENTALS (ACCESS CONTROL LIST)
• There is an implicit deny at the end of every access list.

• At least one permit statement should be present in our Access-list otherwise all traffic will
be denied.

• Standard access lists and extended access lists cannot have the same name

• Improve network performance.

• Provides security as the administrator can configure the access list according to the needs
and deny the unwanted packets from entering the network.

• Provides control over the traffic as it can permit or deny according to the need of the
network.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)
• A VPN (Virtual Private Network) is a powerful tool that enhances online privacy, protects
sensitive data, and enables secure access to the internet.

• It is one of the best ways to protect yourself and enhance your internet experience.

• Whether you're looking to secure your data, bypass geo-restrictions, or simply want
to maintain your anonymity online, a VPN is an invaluable tool.

• It is a technology that creates a secure, encrypted connection between your device and the
internet.

• It essentially acts as a private tunnel for your internet traffic, preventing hackers, ISPs,
and even governments from monitoring your activities.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)
• When using a VPN, your IP address is masked, and your online actions are routed
through a remote server, making it harder to track your online activity.

• A VPN hides your IP address, ensuring that your browsing habits and activities remain
private.

• A VPN encrypts your connection, making it safer to browse the internet on networks like
those in cafes or airport.

• A VPN allows you to access content that may be blocked in certain regions (such as
streaming platforms, social media sites, etc.). Some ISPs throttle your connection speed
when you stream or play games. A VPN can bypass this, allowing for faster internet
speeds.
• A VPN enables secure access to private networks, making it ideal for businesses and
remote workers.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)
Working Process of VPN :

• Connection Establishment: When you activate a VPN on your device, it connects to a

server operated by the VPN provider.

• Encryption: The VPN encrypts your data (information, files, web traffic) so that it’s
unreadable to anyone trying to intercept it.

• Traffic Redirection: Your device’s internet traffic is routed through the VPN server,
which can be located in any country. This makes it appear as though you’re browsing
from the server’s location, masking your actual IP address.

• Decryption: Once your data reaches the VPN server, it is decrypted and sent to the
destination (such as a website, app, or service). Any response from the server is then sent
back to you through the encrypted tunnel.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)

The main types of VPNs:

1. Remote Access VPN

• A Remote Access VPN allows individual users to connect to a network remotely, such as
accessing work files from home. It's ideal for people who need secure access to a private
network from anywhere.

2. Site-to-Site VPN

• A Site-to-Site VPN is used to connect two networks, often used by businesses with
multiple office locations. It securely links two private networks over the internet, enabling
employees to access resources from both locations.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)

3. Mobile VPN

• A Mobile VPN is designed for mobile devices like smartphones and tablets.

• It ensures stable connections even when switching between different networks (such as
from Wi-Fi to mobile data) and is used in industries like healthcare and logistics where
users need continuous access while moving.

4. MPLS VPN (Multiprotocol Label Switching)

• An MPLS VPN is used mainly by large businesses and enterprise networks.

• It routes data between different locations through an efficient network that prioritizes
data traffic. It's often more complex and provides more scalability compared to traditional
VPNs.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)

5. PPTP VPN (Point-to-Point Tunneling Protocol)

• PPTP is one of the oldest VPN protocols and is known for being fast but less secure
compared to others.

• It is rarely used in modern systems due to its vulnerabilities, but it’s still available on
some legacy systems.

6. L2TP/IPsec VPN (Layer 2 Tunneling Protocol with IPsec)

• L2TP combined with IPsec offers more security than PPTP.

• It uses encryption to secure data, making it a popular option for users who need a reliable,
moderately secure connection.
 SECURITY FUDAMENTALS (VIRTUAL PRIVATE NETWORK)

7. OpenVPN

• OpenVPN is a highly secure, open-source VPN protocol known for its flexibility and
strength in encryption.

• It’s often used for custom VPN setups and is highly configurable, making it a popular
choice for advanced users.

8. IKEv2/IPsec VPN (Internet Key Exchange version 2)

• IKEv2 is a fast, stable, and secure VPN protocol that works well on mobile devices.

• It automatically reconnects when the device switches between networks, providing

continuous service without interruptions.
 VIRTUAL PRIVATE NETWORK(ADVANTAGES)
• Privacy Protection: VPNs keep your online activities private and anonymous, preventing
third parties from tracking you.

• Bypass Geo-Restrictions: VPNs enable you to access content that might be restricted in
your country or region, such as streaming services (Netflix, BBC iPlayer).

• Enhanced Security: With end-to-end encryption, VPNs protect your data from hackers,
especially on public Wi-Fi networks.

• Prevents Data Throttling: VPNs help avoid internet speed throttling imposed by your
Internet Service Provider (ISP), particularly when streaming or gaming.

• Work Resources Remotely: Securely access your work or school network, even from
remote locations.
 VIRTUAL PRIVATE NETWORK(DISADVANTAGES)

• Slower Speeds: Using a VPN may slow down your internet speed due to the encryption
process and server routing.

• Not All VPNs Are Equal: Some VPN services may log your data or provide subpar
protection, so it’s essential to choose a reliable VPN provider.

• Can Be Blocked: Certain websites or countries may block VPN access, limiting your
ability to connect to certain services.

• Requires Configuration: Setting up a VPN may require a bit of technical knowledge,

especially if you're doing it manually.

• Cost: While there are free VPNs available, premium VPNs offer more reliable services
and better security, which can be a recurring expense.
 VIRTUAL PRIVATE NETWORK

When selecting a VPN, consider the following factors:

• Security Features: Look for strong encryption, no-logs policies, and secure protocols
(e.g., OpenVPN, IKEv2).

• Speed: If streaming or gaming is a priority, choose a VPN with high-speed servers.

• Location of Servers: More server locations provide better access to geo-blocked content.

• Device Compatibility: Ensure the VPN is compatible with your devices (Windows, Mac,
Android, iOS).

• Customer Support: Choose a VPN with excellent customer support in case you
encounter issues.
 SECURITY FUDAMENTALS (ADDRESS SPOOFING)
• The most basic protocols used in network are :

• Layer two:
• VLANs
• Spanning tree
• Trunks

• Layer three:
• IP
• Routing
• Routing Protocols

• Layer four:
• UDP and TCP
 SECURITY FUDAMENTALS (ADDRESS SPOOFING)
• There are many different attacks. Here is an overview:

• Address spoofing
• Reconnaissance attacks
• Buffer overflow attack
• Malware

• There are two major types of Address Spoofing

• IP Spoofing
• MAC Spoofing
 SECURITY FUDAMENTALS (MAC SPOOFING)
• MAC spoofing is when someone or something intercepts, manipulate or otherwise
tampers with the control messages exchanged between a networked device and its
unique MAC address.

• This can be accomplished by modifying the hardware itself with an inline switch to
forward messages from one MAC address to another.

• Spoofing the identity of that device by forwarding messages from an innocent bystander's
device.

• Tampering with messages sent from legitimate access points, or capturing packets that
contain response data that is ultimately manipulated before it reaches its destination
 SECURITY FUDAMENTALS (IP SPOOFING)
• IP Spoofing is a technique used by a hackers to gain unauthorized access to computers

• The intruder sends message to a computer system with an IP address indicating message
is coming from a different IP address than its actually coming from.

• If intent is to gain unauthorized access, then Spoof IP address will be that of a system the
target considers a trusted host.

• To successfully perpetrate an IP Spoofing attack, hacker must find IP address of a

machine that the target system considers a trusted source.
 SECURITY FUDAMENTALS (DoS ATTACK)

• Denial of Service (DoS) is a cyber-attack on an individual Computer or Website with the

intent to deny services to intended users.

• Their purpose is to disrupt an organization's network operations by denying access to its

users.

• Denial of service is typically accomplished by flooding the targeted machine or resource

with surplus requests in an attempt to overload systems and prevent some or all legitimate
requests from being fulfilled.

• For example, if a bank website can handle 10 people a second by clicking the Login
button, an attacker only has to send 10 fake requests per second to make it so no
legitimate users can log in.

• DoS attacks exploit various weaknesses in computer network technologies.

 SECURITY FUDAMENTALS (DoS ATTACK)

• They may target servers, network routers, or network communication links.

• They can cause computers and routers to crash and links to bog down.

• The most famous DoS technique is the Ping of Death.

• The Ping of Death attack works by generating and sending special network messages
(specifically, ICMP packets of non-standard sizes) that cause problems for systems that
receive them.

• This attack could cause unprotected Internet servers to crash quickly.

 SECURITY FUDAMENTALS (DoS ATTACK)

• Another variant of the DoS is the Smurf attack.

• This involves emails with automatic responses.

• If someone emails hundreds of email messages with a fake return email address to
hundreds of people in an organization with an autoresponder on in their email, the
initially sent messages can become thousands sent to the fake email address.

• If that fake email address belongs to someone, this can overwhelm that person's account.
DoS attacks can cause the following problems:

• Ineffective services
• Inaccessible services
• Interruption of network traffic
• Connection interference
 SECURITY FUDAMENTALS (DoS ATTACK)

• Prevention Given that Denial of Service (DoS) attacks are becoming more frequent, it is
a good time to review the basics and how we can fight back.

• Cloud Mitigation Provider - Cloud mitigation providers are experts at providing DDoS
mitigation from the cloud.

• Firewall - This is the simplest and least effective method. Python scripts are often written
to filter out malicious traffic, or existing firewalls can be utilized by enterprises to block
such traffic.

• Internet Service Provider (ISP) - Some enterprises use their ISP to provide DDoS
mitigation. These ISPs have more bandwidth than an enterprise would, which can help
with large volumetric attacks.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
• A reflection attack involves an attacker spoofing a target's IP address and sending a
request for information,

• It primarily using the User Datagram Protocol (UDP) or in some caes, the Transmission
Control Protocol (TCP).

• The server then responds to the request, sending an answer to the target’s IP address.

• This "reflection" - using the same protocol in both directions - is why this is called a
reflection attack.

• Any server operating UDP or TCP-based services can be targeted as a reflector.

Adequate DNS DDoS protection solutions can assist in mitigating these types of attacks.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
• Amplification attacks generate a high volume of packets that are used to overwhelm the target website
without alerting the intermediary.

• This occurs when a vulnerable service responds with a large reply when the attacker sends his request, often
called the “trigger packet”.

• Using readily available tools, the attacker is able to send many thousands of these requests to vulnerable
services, thereby causing responses that are considerably larger than the original request and significantly
amplifying the size and bandwidth issued to the target.

• A reflection amplification attack is a technique that allows attackers to both magnify the amount of
malicious traffic they can generate and obscure the sources of the attack traffic.

• This type of distributed denial-of-service (DDoS) attack overwhelms the target, causing disruption or
outage of systems and services.

• The most prevalent forms of these attacks rely on millions of exposed DNS, NTP, SNMP, SSDP, and other
UDP/TCP-based services.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
• Reflection amplification attacks are relatively easy to identify because they usually
involve a large volumetric attack.

• Such attacks are indicated by a substantial flood of packets with the same source port to a
single target.

• The incoming packets rarely share the same destination port number, which is why this is
a good indication of an attack.

• Attackers will often use multiple vulnerable services at the same time, combining these
into extremely large attacks.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
• Reflection amplification attacks are dangerous because the servers used for these types of attacks
can be ordinary servers with no clear sign of having been compromised, making it difficult to
prevent them.

• Attackers mostly use reflection amplification attacks because they don’t require sophisticated
tools to launch.

• These attacks require minimal effort to create enormous volumetric attacks by using a modest
source of bots or a single robust server.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
The following steps to mitigate reflection amplification attacks:

1) RATE LIMITING

• One general DDoS mitigation strategy is to employ rate limiting, which can be applied to
destinations or to sources, to prevent systems from being overwhelmed.

• Destination rate limiting may inadvertently impact legitimate traffic, making this a less desirable
approach.

• Rate limiting the source is considered more effective. This approach restricts sources based on a
deviation from a previously established access policy.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
2) BLOCKING PORTS

• Blocking ports that are not needed can reduce vulnerability to attacks.

• This does not prevent attacks on ports that are used by both legitimate and attacker traffic,
however.

3) TRAFFIC SIGNATURE FILTERS

• Traffic signature filters can be used to identify repetitive structures that are indicative of an attack.

• The downside to such filtering may be its impact on performance. Inspecting every packet may
ultimately overwhelm defenses.
 SECURITY FUDAMENTALS (REFLECTION AND APPLIFICATION)
4) Threat Intelligence Service

• Threat intelligence services can help organizations identity vulnerable servers, allowing them to
block the IP addresses of these vulnerable servers.

• This proactive approach can provide more precise mitigation

 SECURITY FUDAMENTALS (MITM)
• A man-in-the-middle (MITM) attack is a cyberattack where an attacker intercepts and potentially
alters communication between two parties without either party being aware of the intrusion.

• The attacker inserts themselves into the communication channel, acting as a "middleman".

• This allows them to eavesdrop on the conversation, steal data, or even impersonate one of the
parties.

Eavesdropping:

• The attacker can listen in on the conversation and steal information like passwords, credit card
details, or other sensitive data.
Data alteration:

• The attacker can modify the data being exchanged, potentially leading to fraudulent transactions
or the spread of malware
 SECURITY FUDAMENTALS (MITM)
Impersonation:

• The attacker can impersonate one of the parties, convincing the other party to take actions that
benefit the attacker, such as revealing login credentials or transferring funds

PREVENTION

• Use strong, unique passwords

• Enable two-factor authentication
• Use a VPN
• Only visit HTTPS websites
• Be cautious of suspicious emails and links
• Use anti-malware software
 SECURITY FUDAMENTALS (RECONNAISSANCE ATTACK)

• A reconnaissance attack is not a “real” attack.

• Before an attacker launches an attack, he or she might want as much information as

possible.

• The attacker will learn as much as possible about the target. For example:

• Information about the company:

• Public IP addresses
• Use scanning tools like Nmap to find:
• IP addresses, Open ports, The OS version

• Use tools like ZAP to find security vulnerabilities.

• All information found can be used for an actual attack.

 SECURITY FUDAMENTALS (BUFFER OVERFLOW ATTACK)

• A buffer is a temporary area for data storage.

• In operating systems, applications, and in hardware we use buffers.

• When data is stored within the buffer boundaries, everything works as it should. A buffer
overflow occurs when a process tries to write more data to the buffer than the buffer can
hold.

• When data overflows outside of the buffer space, data can get stored in adjacent memory
locations, overwriting data in those locations.

• An attacker could cause a service or system to crash, or include malicious code and
attempt to run it.
 SECURITY FUDAMENTALS (MALWARE)

• Malware is a catch-all term for all malicious software

• It is designed to access systems, and cause damage, and disruptions.

• Malware comes in many forms:

• Viruses and worms

• Ransomware
• Trojan attacks
• Spyware
 SECURITY FUDAMENTALS (MALWARE)

• Viruses and worms are types of malware.

• These are malicious software programs that can replicate from one system to another.

• Viruses are usually attached to executable files.

• Once the target opens the file, the virus infects the computer and attempts to spread
through the network, infected email attachments, removable drives, etc.

• The difference between a virus and a worm, is that a worm is standalone software that
usually replicates itself by infecting systems with vulnerabilities
 SECURITY FUDAMENTALS (MALWARE)

• Viruses and worms are types of malware.

• These are malicious software programs that can replicate from one system to another.

• Viruses are usually attached to executable files.

• Once the target opens the file, the virus infects the computer and attempts to spread
through the network, infected email attachments, removable drives, etc.

• The difference between a virus and a worm, is that a worm is standalone software that
usually replicates itself by infecting systems with vulnerabilities
 SECURITY FUDAMENTALS (MALWARE)

• A computer virus is a type of malicious software (malware) designed to attach itself

to a legitimate file or program in order to spread from one system to another.

• It Requires Human Action:

• A virus cannot spread by itself. It needs the user to run the infected program or file
(for example, opening a malicious email attachment or executing an infected
application) for it to activate and start infecting the system.

• Attaches to Host Files:

• Viruses embed themselves into other executable files, documents, or system files.
When the infected file is run, the virus activates.
 SECURITY FUDAMENTALS (MALWARE)

• Spreads Locally or Through Devices:

• Viruses often spread through USB drives, shared files, infected downloads, or email
attachments.

• They are less likely to spread rapidly over a network compared to worms.

• Can Cause Damage:

• Depending on its purpose, a virus can:

• Delete or corrupt files
• Slow down system performance
• Display unwanted messages
 SECURITY FUDAMENTALS (MALWARE)

Types of Computer Viruses

• File Infector Virus: Attaches to executable files (.exe or .dll).

• Macro Virus: Infects documents like Word or Excel by exploiting macros.

• Boot Sector Virus: Targets the boot sector of hard drives or USBs.

• Polymorphic Virus: Changes its code each time it spreads, making it hard to detect.

• Resident Virus: Hides in the system memory and infects files as they are opened.
 SECURITY FUDAMENTALS (MALWARE)

• Ransomware
• Ransomware encrypts files and folders on your computer and notifies the victim that
the decryption key can be purchased to unlock the data.

• Trojan attacks

• Trojans are malicious programs designed to mislead users. This could be a program
that you install that also includes malicious code. It could be a USB stick that
executes code when you insert it into your computer. Unlike viruses or worms,
trojans don’t replicate themselves.

• Spyware
• Spyware is malware that is installed on your computer with or without your
permission. Spyware collects information about the user, computer usage, browsing
habits, etc. This information is forwarded to an external location.
 SECURITY FUDAMENTALS (PHISING)

• With a phishing attack, the attacker tries to lure victims into sharing confidential information
• There are many different ways to do this:

• Emails: we’ve all seen these before. Fake invoices, system upgrades, parcel deliveries, etc. The
email contains a request and a link from the attacker.

• Vishing: this is a voice call where the attacker claims to be from some bank or helpdesk, asking
the victim to perform specific actions on their computer or phone.

• Smishing: fake SMS messages that include links from the attacker.
• There are two variations when it comes to phishing:

• Spear phishing: target a specific group of people. These could be people working for the
same company or in the same department.

• Whaling: target high profile individuals. For example, a CEO, CTO, etc.
 SECURITY FUDAMENTALS (PORT SECURITY)

• Switches learn MAC addresses when the frame is forwarded through a switch port.

• By using port security, users can limit the number of MAC addresses that can be learned
to a port,

• It can set static MAC addresses and set penalties for that port if it is used by an
unauthorized user.

• Users can either use restrict, shut down or protect port-security commands.
 SECURITY FUDAMENTALS (PORT SECURITY)

• Protect -

• This mode drops the packets with unknown source mac addresses until you
remove enough secure mac addresses to drop below the maximum value.

• Restrict -

• This mode performs the same function as protecting, i.e drops packets until
enough secure mac addresses are removed to drop below the maximum value.

• In addition to this, it will generate a log message, increment the counter value, and
will also send an SNMP trap.
 SECURITY FUDAMENTALS (PORT SECURITY)

• Shut Down -

• This mode is mostly preferred as compared to other modes as it shut down the
port immediately if unauthorized access is done.

• It will also generate a log, increment counter value, and send an SNMP trap.

• This port will remain in a shutdown state until the administrator will perform the
"no shutdown" command.
 SECURITY FUDAMENTALS (PORT SECURITY)

• Sticky –

• This is not a violation mode.

• By using the sticky command, the user provides static Mac address security
without typing the absolute Mac address.

• For example, if user provides a maximum limit of 2 then the first 2 Mac addresses
learned on that port will be placed in the running configuration.

• After the 2nd learned Mac address, if the 3rd user wants to access then the
appropriate action will be taken according to the violation mode applied.
 SECURITY FUDAMENTALS (AAA)

• AAA (Authentication, Authorization, Accounting) is a standard-based framework

• It is used to control who is permitted to use network resources (through authentication)

• What they are authorized to do (through authorization)

• Capture the actions performed while accessing the network (through accounting).

• AAA can be implemented by using the local database of the device or by using an
external ACS server.
 SECURITY FUDAMENTALS (AAA)

• Authentication is the process by which it can be identified that the user is allowed to
access a network or not

• This is achieved by asking some credentials such as username and password.

• Network administrators can control how a user is authenticated if someone wants to

access the network.

• Some of these methods include using the local database of that device (router) or
sending authentication requests to an external server like the ACS server (Auto -
Configuration Server).

• To specify the method to be used for authentication, a default or customized

authentication method list is used.
 SECURITY FUDAMENTALS (AAA)

• Authorization provides capabilities to enforce policies on network resources after the

user has gained access to the network resources through authentication.

• After the authentication is successful, authorization can be used to determine what

resources is the user allowed to access and the operations that can be performed.

• The administrator can use the authorization method list to specify the resources the user
can view.
 SECURITY FUDAMENTALS (AAA)

• Accounting provides means of monitoring and capturing the events done by the user
while accessing the network resources.

• It even monitors how long the user has access to the network.

• The administrator can create an accounting method list to specify what should be
accounted for and to whom the accounting records should be sent.
 SECURITY FUDAMENTALS (AAA IMPLEMENTATION)
Local database -

• To use the local running configuration of the router or switch to implement AAA, we should create users
first for authentication and provide privilege levels to users for Authorization.

ACS server -

• This is the common method used.

• An external ACS server is used (can be ACS device or software installed on Vmware) for AAA on which
configuration on both router and ACS is required.

• The configuration includes creating a user, separate customized method list for authentication,
Authorization, and Accounting.

• The client or Network Access Server (NAS) sends authentication requests to the ACS server and the
server takes the decision to allow the user to access the network resource or not according to the
credentials provided by the user.
 SECURITY FUDAMENTALS (802.1X)
• 802.1X is the mechanism that will block or unblock the interface.

• It’s called port-based control

• All traffic is being dropped with the exception of EAPoL (Extensible Authentication Protocol
over LAN).

• EAP is what we use to exchange authentication information.

• Once the user is given access to network only if they are authenticated

• The user device is called the supplicant which supplies authentication information.

• The switch is called the authenticator because it accepts the authentication information

• User information is stored on the authentication server.

 SECURITY FUDAMENTALS (802.1X)
• There are two types of authentication servers:

• RADIUS
• TACACS+

• The most common authentication server is RADIUS (Remote Authentication Dial In

User Service).

• It’s a protocol that has been standardized by the IETF.

• TACACS+ (Terminal Access Controller Access-Control System) does a similar job, but
it is Cisco proprietary.
 SECURITY FUDAMENTALS (DHCP SNOOPING)
• DHCP snooping is a technique where we configure our switch to listen in on DHCP
traffic and stop any malicious DHCP packets.

• DHCP snooping ensures that DHCP clients only receive IP addresses from authorized
DHCP servers.

• A DHCP-snooping-enabled switch creates a binding table that records the IP address,

MAC address, VLAN ID, and lease time for each DHCP client.

• The switch verifies DHCP messages against this table.

• If a message comes from a host not in the binding table or if it's an offer from a non-
trusted port, the switch drops the message.
 SECURITY FUDAMENTALS (DHCP SNOOPING)
• DHCP snooping prevents unauthorized devices from impersonating DHCP servers and
assigning rogue IP addresses to clients, potentially leading to man-in-the-middle attacks.

• By managing DHCP requests and ensuring fair distribution of IP addresses, DHCP

snooping helps prevent attackers from exhausting a DHCP server's pool.

• By ensuring that only legitimate DHCP servers can assign IP addresses, DHCP snooping
helps maintain network stability and reduces the risk of unauthorized access.
 SECURITY FUDAMENTALS (ARP POISONING)
• Address Resolution Protocol (ARP) poisoning is when an attacker sends falsified ARP
messages over a local area network (LAN) to link an attacker’s MAC address with the IP
address of a legitimate computer or server on the network.

• Once the attacker’s MAC address is linked to an authentic IP address, the attacker can
receive any messages directed to the legitimate MAC address.

• As a result, the attacker can intercept, modify or block communicates to the legitimate
MAC address.

• An ARP attack can be directed at “cheating” a host computer or a network router. If a

router has the wrong MAC address for a given IP address, then all communications are
routed to the wrong host. This is called ARP attack in router
 SECURITY FUDAMENTALS (FIREWALL – Statefull Inspection)

• The stateful inspection is also referred to as dynamic packet filtering.

• It is the type of firewall technology that monitors the state of active connections and uses
the information to permit the network packets through the firewall.

• Stateful inspection is generally used in place of stateless inspection of static packet

filtering and is well suited with TCP and similar protocols, although it can also support
protocols like UDP.

• Stateful inspection is the kind of network firewall technology that filters data packets
supported by state and context.

• It is currently one of the leading common firewall technologies in use today.

 SECURITY FUDAMENTALS (FIREWALL – Packet Inspection)

• Packet inspection typically focuses on the header of network packets, which contains
information like source and destination IP addresses, port numbers, and protocol types

• DPI examines the contents of data packets using specific rules preprogrammed by the
user, an administrator, or an internet service provider (ISP)

• DPI can pinpoint the application or service that launched the threat.