network-security

name	network-security
description	Network security controls including ACLs (standard/extended/named/object-group), NAT/PAT, IPsec VPN (IKEv1/IKEv2, site-to-site, remote access), zone-based firewall, VLAN security hardening (DHCP snooping, DAI, 802.1X, port security), and common attack vectors (ARP spoofing, VLAN hopping, rogue DHCP, DDoS mitigation). Use when designing or auditing firewall policy, ACL rules, VPN configurations, or switch security hardening.
metadata	{"author":"Ryan Loiselle","version":"1.1","sources":[{"title":"IMIT 6.28 — Network and Communications Security Standard (v5.0, 2022)","note":"§3.1 network controls, §3.5 segregation, §3.6 routing controls, §3.7 communication security — baseline controls for any BC Gov network.","url":"https://www2.gov.bc.ca/assets/gov/government/services-for-government-and-broader-public-sector/information-technology-services/standards-files/09_-_communications_security_standard_v10.pdf"},{"title":"IMIT 6.28 Specifications (v1.0, 2024)","url":"https://www2.gov.bc.ca/assets/gov/government/services-for-government-and-broader-public-sector/information-technology-services/standards-files/imit_628_netowrk_and_communications_security_specifications.pdf"},{"title":"IMIT 5.08 — Network-to-Network Connectivity Security Standard (v2.0, 2022)","note":"3PG security transit point requirements: stateful firewall, IPS/IDS, default-deny, encryption per IMIT 6.10, log retention ≥ 13 months.","url":"https://www2.gov.bc.ca/assets/gov/government/services-for-government-and-broader-public-sector/information-technology-services/standards-files/imit_508_network_to_network_connectivity_standard.pdf"},{"title":"IMIT 5.08 Specifications (v1.0, 2022)","url":"https://www2.gov.bc.ca/assets/gov/government/services-for-government-and-broader-public-sector/information-technology-services/standards-files/imit_508_network-to-network_connectivity_specifications.pdf"},{"title":"IMIT 6.13 — Network Security Zones Standard / Specifications","note":"Zone model that firewall and ACL design must align with on BC Gov networks.","url":"https://intranet.gov.bc.ca/assets/intranet/mtics/ocio/es/enterprise-services-division/information-security-branch/information-security-standards-and-guidelines/imit_613_network_security_zones_standard_v5.pdf"}]}
compatibility	Cisco IOS/IOS-XE ACLs, Cisco ASA/FTD, zone-based firewall (ZBF), Linux iptables/nftables, general IP security principles.

Network Security Skill

Access control, encryption, firewall design, and Layer 2 security hardening.

Related skills:

• IPsec VPN depth and Zero Trust architecture → ../zero-trust-architect/SKILL.md
• Routing / switching context → ../network-architect/SKILL.md

---

Access Control Lists (IOS/IOS-XE)

Standard ACL (source IP only)

ip access-list standard MGMT-PERMIT
 permit 10.10.0.0 0.0.255.255
 deny   any log

! Apply — standard ACLs as close to destination as possible
interface GigabitEthernet0/0
 ip access-group MGMT-PERMIT in

Extended ACL (src, dst, protocol, port)

ip access-list extended INTERNET-OUT
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit udp 10.0.0.0 0.255.255.255 any eq 53
 deny   ip any any log

interface GigabitEthernet0/1
 ip access-group INTERNET-OUT out

! Extended ACLs as close to source as possible

Object-Group ACL (IOS-XE — cleaner, reusable)

object-group network INTERNAL-RFC1918
 10.0.0.0 255.0.0.0
 172.16.0.0 255.240.0.0
 192.168.0.0 255.255.0.0

object-group service PERMITTED-OUTBOUND
 tcp destination eq 443
 tcp destination eq 80
 udp destination eq 53

ip access-list extended OUTBOUND-POLICY
 permit object-group PERMITTED-OUTBOUND object-group INTERNAL-RFC1918 any
 deny ip any any log

ACL Design Rules

- Extended ACL: place closest to source (reduces unnecessary traffic traversal)
- Standard ACL: place closest to destination
- Always end with explicit deny any log (implicit deny does not log)
- Use 'log' on deny entries for visibility; avoid 'log' on high-volume permit entries (CPU)
- Named ACLs always preferred (reorderable, descriptive)
- Sequence numbers: leave gaps (10, 20, 30) for later insertions
- Verify with: show ip access-lists <name> (check hit counters)

---

NAT / PAT

! PAT (overload) — most common; many-to-one
ip nat inside source list NAT-INSIDE interface GigabitEthernet0/1 overload

ip access-list standard NAT-INSIDE
 permit 10.0.0.0 0.255.255.255

interface GigabitEthernet0/0
 ip nat inside

interface GigabitEthernet0/1
 ip nat outside

! Static NAT — 1:1 mapping for DMZ servers
ip nat inside source static 10.0.0.10 203.0.113.10

! Static PAT — port forwarding
ip nat inside source static tcp 10.0.0.10 443 203.0.113.5 443

! Verify
show ip nat translations
show ip nat statistics
clear ip nat translation *    ! clears dynamic table

---

IPsec VPN

IKEv2 Site-to-Site (IOS-XE)

! Crypto IKEv2 proposal (encryption settings)
crypto ikev2 proposal IKEV2-PROPOSAL
 encryption aes-cbc-256
 integrity sha256
 group 19

crypto ikev2 policy IKEV2-POLICY
 proposal IKEV2-PROPOSAL

! IKEv2 profile (authentication and matching)
crypto ikev2 profile IKEV2-PROFILE
 match identity remote address 203.0.113.2
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-SITE-B

crypto ikev2 keyring KR-SITE-B
 peer SITE-B
  address 203.0.113.2
  pre-shared-key secret-key-here

! Transform set (IPsec ESP)
crypto ipsec transform-set TS-AES256 esp-aes 256 esp-sha256-hmac
 mode tunnel

! Crypto map
crypto map CM-SITE-B 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TS-AES256
 set ikev2-profile IKEV2-PROFILE
 match address ACL-VPN-TRAFFIC
 set pfs group19

interface GigabitEthernet0/1
 crypto map CM-SITE-B

! Traffic selector ACL (mirror on far end)
ip access-list extended ACL-VPN-TRAFFIC
 permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255

IPsec Troubleshooting

show crypto isakmp sa           # IKEv1 phase 1 SA (should be ACTIVE/QM_IDLE)
show crypto ikev2 sa detail     # IKEv2 SA status
show crypto ipsec sa            # phase 2 SA, encap/decap counters
show crypto map
debug crypto isakmp             # verbose IKE negotiation (use carefully in production)
debug crypto ipsec

# Common failure causes:
# - Mismatched pre-shared key → AUTH_FAILED in ISAKMP
# - Mismatched transform set → NO_PROPOSAL_CHOSEN
# - Mismatched ACL (traffic selectors not mirrored) → QM fails
# - MTU issues → tunnelled ICMP works but TCP sessions drop (MSS clamping needed)
ip tcp adjust-mss 1360          ! on tunnel or inside interface; clamp TCP MSS

---

Zone-Based Firewall (ZBF — IOS-XE)

! Define zones
zone security INSIDE
zone security DMZ
zone security OUTSIDE

! Class maps (traffic classification)
class-map type inspect match-any INTERNET-APPS
 match protocol http
 match protocol https
 match protocol dns

! Policy maps (action)
policy-map type inspect INSIDE-TO-OUTSIDE
 class type inspect INTERNET-APPS
  inspect
 class class-default
  drop log

! Zone-pairs (apply policy between zones)
zone-pair security ZP-INSIDE-OUTSIDE source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE-TO-OUTSIDE

! Assign interfaces to zones
interface GigabitEthernet0/0
 zone-member security INSIDE

interface GigabitEthernet0/1
 zone-member security OUTSIDE

---

Layer 2 Security Hardening

DHCP Snooping

! Enable globally and per VLAN
ip dhcp snooping
ip dhcp snooping vlan 10,20,30

! Trust only uplinks / DHCP server ports
interface GigabitEthernet0/1   ! uplink to distribution
 ip dhcp snooping trust

! All access ports are untrusted by default
! Rate limit DHCP on untrusted ports
interface range GigabitEthernet0/2-24
 ip dhcp snooping limit rate 10

! Verify
show ip dhcp snooping binding
show ip dhcp snooping statistics

Dynamic ARP Inspection (DAI)

! Requires DHCP snooping binding table
ip arp inspection vlan 10,20,30

! Trust uplinks
interface GigabitEthernet0/1
 ip arp inspection trust

! ARP ACL for static devices (printers, servers without DHCP)
arp access-list STATIC-SERVERS
 permit ip host 10.0.0.100 mac host aabb.cc11.2233
ip arp inspection filter STATIC-SERVERS vlan 10

show ip arp inspection statistics vlan 10

802.1X Port Authentication

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control

radius server CORP-RADIUS
 address ipv4 10.0.0.5 auth-port 1812 acct-port 1813
 key radius-secret

interface GigabitEthernet0/5
 switchport mode access
 dot1x port-control auto
 dot1x host-mode multi-auth  ! allows phone + PC on same port
 dot1x timeout quiet-period 10
 spanning-tree portfast

Additional L2 Hardening

! Disable DTP on all access ports
interface range GigabitEthernet0/2-24
 switchport nonegotiate
 switchport mode access

! Shutdown unused ports
interface range GigabitEthernet0/10-20
 shutdown
 description ** UNUSED **

! Change native VLAN off VLAN 1
interface GigabitEthernet0/1
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,99

! Disable CDP on untrusted ports
interface range GigabitEthernet0/2-24
 no cdp enable

! Storm control (prevent broadcast storms)
interface range GigabitEthernet0/2-24
 storm-control broadcast level 10.00
 storm-control action shutdown

---

Attack Vectors and Mitigations

Attack	Description	Mitigation
ARP Spoofing / Poisoning	Attacker replies to ARP with own MAC → MITM	DAI, static ARP entries, 802.1X
VLAN Hopping (switch spoofing)	Attacker negotiates trunk via DTP	switchport nonegotiate, never use VLAN 1 on trunks
VLAN Hopping (double-tagging)	Exploit native VLAN to jump one hop	Change native VLAN to unused VLAN (e.g. 999)
Rogue DHCP	Attacker serves DHCP responses	DHCP Snooping (untrusted all access ports)
CAM Overflow	Flood MAC table → switch broadcasts all → sniff	Port security: switchport port-security maximum 2
STP Attack	Attacker sends BPDU to become root	BPDU Guard, Root Guard
IP Spoofing	Forge source IP	uRPF (ip verify unicast source reachable-via rx)
Smurf DDoS	Broadcast amplification	Disable directed broadcast: no ip directed-broadcast
DNS Amplification	Abuse open resolvers	Disable recursion on authoritative; rate limiting; DNS firewall

---

Firewall Policy Design Principles

1. Default deny — whitelist only what is explicitly needed
2. Stateful inspection for return traffic — don't manually permit return flows
3. Segment DMZ from inside — DMZ-to-inside requires explicit permit (never implicit)
4. Log denies — but not at line rate (use sampling or rate limiting)
5. Explicit permit before implicit deny on all interfaces
6. Never permit 'any any' even temporarily — use time-limited ACEs if must
7. Egress filtering — filter outbound from all interfaces (not just inbound from outside)
8. Null-route known bad prefixes at edge routers (RTBH)
9. Scrubbing: normalise fragments, enforce MSS, reject illegal flag combos
10. Separate management plane — OOB management or dedicated VRF

---

BC Gov IMIT Standards — Mapping to Controls

For BC Government networks, the following standards translate to concrete controls in this skill. Cite them in design docs and STRA submissions.

IMIT Standard	Section	Controls implemented in this skill
6.28 Network & Communications Security	§3.1 Network controls	Configuration controls, MFA on devices, change management, baseline integrity
6.28	§3.3 Logging, monitoring, detection	SIEM forwarding, IDS/IPS sensors, log boundary capture
6.28	§3.5 Segregation	Zone segmentation, VLANs, security gateways, NetworkPolicy, ZBF
6.28	§3.6 Routing controls	Anti-spoofing ACLs, uRPF, authenticated routing protocols, prefix filtering
6.28	§3.7 Communication security	Encrypted transport (SSH/TLS/IPsec), anti-malware on transit
6.13 Network Security Zones	Zone model	DMZ / Zone B / Zone A boundaries; SDN Low/Medium/High
5.08 N2N Connectivity (3PG)	§5 Specifications	Stateful firewall + IPS/IDS at transit, default-deny, NAT to hide internals
5.08	§5.1.3 Data in transit	IMIT 6.10 cryptography; encrypted tunnels / MPLS / isolated VLANs; PCI → separate physical router per circuit
5.08	§5.1.4 Logging	Raw logs retained ≥ 13 months; available to Province SIEM

Full URLs are in this skill's frontmatter sources: block.

---

NETWORK_SECURITY_KNOWLEDGE

Append discoveries here. Format: YYYY-MM-DD: <note>