Authentication of the junction ports?

Hi all

Maybe a stupid question, but I am unable to find a satisfactory answer.

We have a couple of 3560 switches, all connected to 3750 battery. One of these 3560 switches is in an open area and asked me if that could be considered a security risk. Of course, whether in an open place is a risk, but if anyone where them unplug the connection of the trunk to our battery and then plug it into another switch, what will happen?

Should / could authenticate us ports/channel-groups of circuits? I have all the switches configured for authentication ssh connection and network (mac based) against a radius server, but I have not configured authentication on trunk ports that I found descriptions that dot1x cannot be enabled on the ports of junction.

Thanks in advance

Chris

Hello

I suggest the following:

> Organise a physical envelope (locked) or any other control of physical security to ensure authorized access to the device. Work around any technical solution or bandage should be only temporary. What is a righteous person happening to your switches? DOS attack! This could also be done by mistake, with the result a unstructred threat.

> Allow follow-up of these switches (ICMP, SNMP), so that you are alerted when they are disconnected.

> Change the default NATIVE VLAN (vlan1)

> Disable trunk negotiation (mode ON)

Concerning

Farrukh

Tags: Cisco Security

Similar Questions

  • Authentication of the machine and 802. 1 x

    I'm trying to get the machines to authenticate against active directory using 802.1 x. It works fine when I use PEAP and CHAP authentication. Works like a dream, no problems at all. But I need to check that the machine is a part of the domain, the user will have to sign later anyway. It is important that our machines are checked as part of Active Directory, and then authenticate the port to pass traffic.

    I followed all the documentation to get this working, I'm looking for is something of undocumented who does this work for others.

    Any help would be greatly appreciated.

    Thank you

    Mitch

    I assume that you have configured AD to automatically enroll for certificates Machines and the machines each have a computer certificate?

    You have enabled remote access to machines (AD users & computers, enable remote access or using the remote access policy?)

    Others that I had no problems setting this up.

    If you want to enable computer-only authentication then you must edit the registry (or lower the changes through Group Policy):

    [quote]

    Activate computer-only authentication using the registry

    To set up authentication computer only through the registry, all Windows-based wireless clients must have the value of the following registry value:

    HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode = 2

    With the AuthMode setting set to 2, only computer authentication is attempted. User authentication is never attempted.

    To add this registry setting on all of your computers running Windows, you can use the following tools:

    ? Regini.exe from the Windows 2000 Server Resource Kit tools

    ? The Windows Server 2003 Resource Kit Tools reg.exe

    In both cases, you create a script file which is read by the tool add a registry setting. The tool must be run in the security context of a local administrator account.

    Alternatively, you can use network management software to change the settings of the registry on the managed computers. [/ quote]

    http://www.Microsoft.com/technet/prodtechnol/winxppro/deploy/ed80211.mspx

  • ASA by the issue of authentication of the tunnel-group

    Is it possible to do so by the tunnel-group authentication on ASA 8.4.x?

    Here are the scenarios:

    (1) tunnel-group_A performs authentication using the digital certificate (PKI)

    (2) tunnel-group_B performs the authentication using AAA (RSA SecurID token)

    (3) tunnel-group_C performs authentication for LOCAL assistance (AAA user defined locally)

    Tunnel-group_A, B, and C are all using the same physical interface and outside the interface.

    I tested it, but it doesn't work the way I expected.  BTW, I have already disabled "interface authentication ssl certificate outside of port 443"

    Here are the results of the tests:

    If the tunnel group_A is configured with the certificate, then tunnel_group_B connection will fail, but connection tunnel-group_C works very well.

    It seems that tunnel-group_B trying to authenticate with certificate too, if she does not.  BTW, it seems to authenticate to the LOCAL help will still work.

    I understand that you can configure tunnel_group_A to "both" certificate and AAA, but that's not what I want.

    Anyone seen this before?  Is there a way to bypass?

    Thank you

    Joe,

    Yes, I would then use Group-url. And I would create and profile of XML with the specific URL in the list of servers.

    List of servers

    Let me know.

  • Is it possible to set up SMTP authentication with the vCSA 5.5?

    Hello.

    I have a vCenter Server Virtual Appliance 5.5 and SMTP server that requires SMTP authentication with port 587.

    I found the advanced settings "mail.smtp.port", but I found no parameters as 'mail.smtp.username' and 'mail.smtp.password '.

    Is it possible to set up SMTP authentication with the vCSA 5.5?


    Best regards.

    No, can't be done.

    Set up a separate SMTP relay that would make authentication for you. as explanation then post

    Configuring vCenter for e-mail with SMTP authentication. Adventures in a virtual world

  • WebServiceConnection.getJaxWSPort () - could not determine the wsdl ports

    Hey all,.

    I have an ADF application that communicates with a Web Service through a Web Service proxy. I have to configure the Web Service end point when running, so I followed the steps described in this blog: http://biemond.blogspot.com/2012/02/changing-your-adf-connections-in.html

    This works very well when building the Web Service proxy using the constructor that takes the WSDL URL and port as arguments:


    Context ctx is ADFContext.getCurrent () .getConnectionsContext ();.

    WebServiceConnection wsc = (WebServiceConnection) ctx.lookup ("SpiderPawsService");       

    SpiderPawsService spiderPawsService = new SpiderPawsService (wsc.getWsdlUrl (), wsc.getModel () .getName ());

    SpiderPawsPort spiderPawsPort = spiderPawsService. getPawsPart();

    However, an exception is thrown stating "could not determine the wsdl ports" when getting a handle on the Web Service proxy by doing this:

    SpiderPawsService spiderPawsService = wsc.getJaxWSPort (SpiderPawsService .class);

    Now, you might ask, why not just use the first approach? Well, the Web Service requires authentication and currently the username and password is read from a properties file encrypted and sent in the header of SOAP using a SOAPHandler. However, the power that the username and password are configurable as the end point. When you change Web Service endpoint in WebLogic Enterprise Manager, I noticed that you can supply a user name and password. However, I looked at the methods provided by the WebServiceConnection and I've not found a way to get a handle on the credentials. This means that I can't look at the information to pass to the Web Service. So, I thought that maybe by using the second approach, the container will create the Web Service proxy and could inject the credentials for me so that I can't provide them explicitly. Any thoughts or ideas?

    Environment:

    JDeveloper 11.1.1.6.0

    Oracle Enterprise Manager 11.1.1.6.0

    Thank you

    Bill

    I think you should use it like this: (you should get an object of Type Port, not the Service itself)

                Context ctx = ADFContext.getCurrent().getConnectionsContext();
                WebServiceConnection wsc =
                    (WebServiceConnection)ctx.lookup("SpiderPawsService");
                SpiderPawsPortType portType = wsc.getJaxWSPort(SpiderPawsPortType.class);
    
  • Change the listening port

    I am running Oracle 10.2 on Solaris. I want to change the listening port of 1521 to 2690. I've read that I'm supposed to change /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora and restart the receiver. Here's my listener.ora:

    OPENVIEWLISTENER =
    (DESCRIPTION =
    (ADDRESS_LIST =
    ((ADDRESS = (PROTOCOL = tcp (PORT = 2690))(HOST=flare)))
    SID_LIST_OPENVIEWLISTENER =
    (SID_LIST =
    (SID_DESC =
    (GLOBAL_DBNAME = openview)
    (ORACLE_HOME=/opt/oracle/product/10.2.0/db_1)
    (SID_NAME = OpenView))
    )


    After the reboot, it is still the 1521:

    bash-beginning of lsnrctl $ 3.00

    LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 24-AUG-2008 16:53:33

    Copyright (c) 1991, 2005, Oracle. All rights reserved.

    From /opt/oracle/product/10.2.0/db_1/bin/tnslsnr: Please wait...

    TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
    System settings file is /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
    Log messages written to /opt/oracle/product/10.2.0/db_1/network/log/listener.log
    Listen on: (DESCRIPTION = (ADDRESS = (PROTOCOL = tcp)(HOST=flare.halcyoninc.com) (PORT = 1521)))

    Connection to (ADDRESS = (PROTOCOL = tcp)(HOST=) (PORT = 1521))
    STATUS of the LISTENER
    -----
    Alias LISTENER
    For Solaris TNSLSNR version: Version 10.2.0.1.0 - Production
    Departure date 24-AUG-2008 16:53:34
    Uptime 0 days 0 h 0 min 0 sec
    Draw level off
    Security ON: OS Local Authentication
    SNMP OFF
    Parameter Listener of the /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora file
    The listener log file /opt/Oracle/product/10.2.0/Db_1/network/log/listener.log
    Summary of endpoints listening...
    (DESCRIPTION = (ADDRESS = (PROTOCOL = tcp)(HOST=flare.halcyoninc.com) (PORT = 1521)))
    The listener supports no services
    The command completed successfully

    What I am doing wrong? :(

    user527462 wrote:
    I am running Oracle 10.2 on Solaris. I want to change the listening port of 1521 to 2690. I've read that I'm supposed to change /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora and restart the receiver. Here's my listener.ora:

    OPENVIEWLISTENER =
    (DESCRIPTION =
    (ADDRESS_LIST =
    ((ADDRESS = (PROTOCOL = tcp (PORT = 2690))(HOST=flare)))
    SID_LIST_OPENVIEWLISTENER =
    (SID_LIST =
    (SID_DESC =
    (GLOBAL_DBNAME = openview)
    (ORACLE_HOME=/opt/oracle/product/10.2.0/db_1)
    (SID_NAME = OpenView))
    )

    After the reboot, it is still the 1521:

    bash-beginning of lsnrctl $ 3.00

    LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 24-AUG-2008 16:53:33

    Copyright (c) 1991, 2005, Oracle. All rights reserved.

    From /opt/oracle/product/10.2.0/db_1/bin/tnslsnr: Please wait...

    TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
    System settings file is /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
    Log messages written to /opt/oracle/product/10.2.0/db_1/network/log/listener.log
    Listen on: (DESCRIPTION = (ADDRESS = (PROTOCOL = tcp)(HOST=flare.halcyoninc.com) (PORT = 1521)))

    Connection to (ADDRESS = (PROTOCOL = tcp)(HOST=) (PORT = 1521))
    STATUS of the LISTENER
    -----
    Alias LISTENER
    For Solaris TNSLSNR version: Version 10.2.0.1.0 - Production
    Departure date 24-AUG-2008 16:53:34
    Uptime 0 days 0 h 0 min 0 sec
    Draw level off
    Security ON: OS Local Authentication
    SNMP OFF
    Parameter Listener of the /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora file
    The listener log file /opt/Oracle/product/10.2.0/Db_1/network/log/listener.log
    Summary of endpoints listening...
    (DESCRIPTION = (ADDRESS = (PROTOCOL = tcp)(HOST=flare.halcyoninc.com) (PORT = 1521)))
    The listener supports no services
    The command completed successfully

    What I am doing wrong? :(

    Your listener.ora sets a listener named OPENVIEWLISTENER. You have not specified the name of the listener when starting it and so he went with the default values (name of the LISTENER listener and so on). The command you are looking for is lsnrctl start OPENVIEWLISTENER

    concerning

    Niall Litchfield
    http://www.orawin.info/

  • iPhone 7 will not play audio via the USB port on the car.

    When I plug my iPhone USB port 7 more in my car (15 Jeep Grand Cherokee), the artist/song/podcast information appears on the screen, but the sound plays through the speakers of the phone.  I have confirmed that my settings are all the same as they were on my 6s, who played without any problems via the USB connection.  Bluetooth streaming works fine - no problems at all.  Any ideas, or is this a problem similar to that people have with CarPlay?

    Welcome to Apple Support communities, kevo.mac!

    Congratulations on your new iPhone 7 more! I see that you connect with your Jeep Grand Cherokee using the USB port. Everything seems to work fine, except that the music plays through the phone instead. I'll be happy to help you to get this working.

    Help to connect your iPhone, iPad or iPod touch with your car radio

    If you are using USB playback

    Restart your iOS device and your car.
    Connect your iOS device to another stereo USB port (if you have one).
    Try another USB cable.
    Update your iOS device.
    Install the updates to the firmware of your car radio.
    Test of audio playback from a different application. If you can not play audio from a specific third party application, contact the developer of the app for help.
    If you can not play audio from an app Apple, contact Apple technical support.

    Enjoy your weekend!

  • Thunderbolt Display 27-inch TV using the HDMI port Minidisplay

    My setup is macbook air, Thunderbolt Display, 55 inch TV.

    Wanted to know if I plug Thunderbolt display on TV through HDMI Adapter Mini DisplayPort / (Thunderbolt), it will be able to display of Macbook Air, Thunderbolt display and TV even time?

    Thank you.

    The Thunderbolt ports and displays: frequently asked questions (FAQ) - Apple Support

    An alternative would be to buy an Apple TV, then use AirPlay on your Mac to stream content both Thunderbolt display, Mac and TV, but the TV must be HDTV.

  • I cannot set the outgoing port Thunderbird 38.0.1.

    Thunderbird 38.0.1 does not allow me to set the outgoing port, parameters of account or in the Assistant accounts again. To be able to do was my only reason for considering change of Qualcomm Eudora. This flexibility is apparently available in earlier versions. It is now a feature requiring the paid version?

    Thunderbird is not free so no idea what you are talking about a paid version.

    The menu bar, select Tools - Account Settings

    At the bottom of the account from the list on the left side is Server outgoing (SMTP)
    As the name suggests, you configure the outgoing server there.

    No menu bar tools showing? Press the ALT key.

  • Keep for the authentication of the printer

    Plug for authentication (of the printer) cannot print

    What is your specific question or a question with Apple network you want support for?

  • Which side is the usb port 3 on a 2015 macbook pro with the retina display?

    Which side is the usb port 3 on a 2015 macbook pro with the retina display?

    I found the answer. It's the left side near the microphone.

  • Using the Ethernet Port on a remote Express

    I have just moved into a new House and has Verizon FiOS installed.  Verizon provided a router modem combination like my main wireless service.

    I have an IP phone that I need to use in my office located in another room and the Verizon tech said that it would be very expensive to run a separate line in this room.

    I have a generation current Airport Express.  I would like to use the Express to join/expand the wireless network in the office, but my question is, the LAN on the Express port will be active so that I can connect the IP phone to the LAN port and use the phone via wireless Express?

    If possible, can you give us some guidance on how to configure the Express?

    Thank you

    David

    I would use the Express to join the network wireless Office

    The AirPort Express, expected to be able to 'join' the wireless network that is provided by the modem/FIOS router, assuming that the device uses wireless standard... parameters and... He Express is located where it can receive a strong signal of the FIOS router/modem wireless.

    But, the Express can not "extend" or "repetition" of the FIOS wireless network, given that "expand" function requires the Express receive a wireless signal from another Apple wireless router.

    .. .my question is, the LAN on the Express port will be active so that I can connect the IP phone to the LAN port and use the phone via wireless Express?

    Yes.  In fact, you can use the LAN or WAN port, or both at the same time... because both ports behave as LAN ports when the AirPort Express "joins" a wireless network.

    can you give us some guidance on how to configure the Express?

    What camera... Mac, PC, iPhone / iPad... will you use for this?  What operating system is that it uses?

  • How can I get multi channel audio via the HDMI port on an early 2015 MacBook Pro?

    I try to get the 7.1 audio channels to flow from my MacBook Pro to a cinema set up. The display works fine now I plug the HDMI in however the sound still Mac speakers. I checked the settings and no HDMI output is available. An airtime option is available, but that returns only two channels as a maximum to the receiver. When I go to the configuration of the source on the receiver it receives video at 1080 p 60herts however it is specifically stated No Audio from the Source.

    Also, I have connected my iPhone 6 s more using an Apple through the same HDMI cable adapter and it works perfectly. We also use HDMI with our PS4 occasionally and it works perfectly, even with the 3D.

    Thus, the MacBook Pro is early 2015 with an i5, the receiver is a Harmon Kardon AVR 2700 (we run 7.1 channels of this) and we are connecting via the HDMI port through a 50 ft HDMI before. The receiver sends the audio to a projector with 1080 p 60 hertz if it changes anything...

    Also if it helps the receiver supports dts - hd master audio decoding, Dolby True HD/Digital Plus decoding, HDMI 1.4 (HDMI is compatible 2.0), as well as multi-channel input and PCM and linear PCM.

    I use a "Behringer UCA202' audio device I bought on amazon.com for only $29.

    It works very well for the audio 5.1 or 7.2. Works connect optical toslink. Just plug it into a usb port on your Mac and a cable optical toslink to your AV receiver.

    My Yahmaha 7.2 audio/video receiver is measuring process the digital signal in THX, DTS, Dolby digital Pro logic, a cinema, etc.

  • Open the TCP Port

    I'm trying to implement a TCP port to listen to music on my home network through JRiver. The server and work remotely on my home network. But I want to access on the network side.

    I use ATT Uverse to access the internet. I disabled wireless and ATT modem to transmit to my Airport Extreme.

    I have these instructions to configure the port:

    1. Open AirPort Utility and change your AirPort Extreme or AirPort Express. Select the tab network (image). Select the sign of closer Port settings box. The Type of Firewall entry should be IPv4 Port Mapping. Enter a description like JRiver Media Center. Enter the Public 52199 TCP Port. Enter the private IP address, it's the IP address of your JRiver Media Center PC at home. Enter the TCP Port private 52199. Click on save, and then click Update. (image)

    When coming to this page, however, the firewall main entry box Type "IPv6" entered and grayed out, so it cannot be changed.

    Any help would be greatly appreciated.

    Sorry, but no image is available.

    However, to start, running the AirPort Utility > select the AirPort Extreme > change > Internet tab > Internet Options...

    What is the value to configure IPv6? If it is 'Automatically', change it to "Link-local." only (Note: I'm assuming that your ISP DO provide you IPv6 service still.)

  • HP laptop - 15-f233wm: external monitor connected to the HDMI port has video but NO sound

    If I connect an external monitor to the HDMI port and check my audio device on the right on the screen cone winder it displays 2 only) 1 HP and Intel) 2 Audio display speakers and No HDMI option selection.

    Ernie4576 wrote:

    If I connect an external monitor to the HDMI port and check my audio device on the right on the screen cone winder it displays 2 only) 1 HP and Intel) 2 Audio display speakers and No HDMI option selection.

    By adopting the option monitor MHDI PC/AV Pc mode will solve the problem, I use a unit screen color Samsung TYPE model / MODEL: C27F591FD (N).

    The device playback option on the care of the portable property are all set to default, Intel C27f591 display sound card works fine!

Maybe you are looking for

  • ZumoCast and Bionic files not supported.

    ZumoCast is installed on my Win7 PC and my Bionic. I see most of my a lot with the Bionic files but when I try to view the files in the player the screen goes all black, as it tries to read the files but nothing ever happens. Then when I press the ba

  • How to uninstall a program that cannot be deleted

    How to remove PC cleaner & PC run

  • Intel (r) grafics media accelerator driverproblem

    I have a qotation mark (yellow) on the video controller and code 28 when trying to fix it says I need to insert the disk with the driver of Intel(r) grafics media Accelerator, in drive

  • Upgrade Windows 2000 to XP.

    I'll upgrade my computer from WIN2K to XP. Can I put the disc in and upgrade? Should I reinstall all my drivers? What concerns should I have, and what do I expect to have to do, then let the installation disc to do its job?

  • Need help with the identification of the model

    Hello Can you please help me identify the right model? Model #: Dx0DPart number: 909648 - 02LProduct ID: D10DP 2GF/2 gr INTL It is there no Dell service tag, so it seems to be a legacy Wyse. I can't find it under https://appservices.wyse.com/pages/se