Network Security Basics

A network attack exploits a weakness to cause harm. Naming the weakness and the resource under pressure helps you choose a defense that can actually work.

Connect the attack to the weakness

A threat can cause harm: an attacker, an insider or a fire. A vulnerability is a weakness, such as old firmware or a default password. An exploit is the technique or code used against that weakness. A mitigation removes the weakness or reduces its effect. For a vulnerable VPN login service, the flaw is the vulnerability, attack code is the exploit, and installing the vendor's fix is the mitigation. Turning off the exposed service can reduce exposure while the update is arranged.

The attack surface is the collection of places an attacker can try: services, ports, accounts, devices and wireless networks. Disabling an unused management service removes an entry point. Adding another password to that unused service leaves the entry point present.

Separate three kinds of overload

A denial-of-service (DoS) attack makes a service unavailable. A distributed DoS (DDoS) uses many sources, often compromised devices controlled as a botnet. Blocking one address leaves the other sources sending traffic.

In a SYN flood, many TCP handshakes stop after the server sends SYN-ACK. The final ACK never arrives, leaving half-open connections waiting in a queue. SYN cookies let the server defer keeping connection state until the client completes the handshake. Connection-rate limits and shorter time-outs can also reduce the pressure.

Work through reflection and amplification

With reflection, an attacker forges the victim's source address in requests to other servers. Those servers reply to the victim. With amplification, the replies are larger than the requests. UDP-based services are attractive because there is no initial connection handshake to validate the claimed source.

Suppose 500 bots each send 4 Mbit/s of queries. Their combined request rate is 2,000 Mbit/s, or 2 Gbit/s. A 60-byte query producing a 3,000-byte reply gives an amplification factor of 50. Ignoring other overhead, the victim receives about 100 Gbit/s. The large replies come from the reflectors, even though the attacker sent much less traffic.

Put the defense before the bottleneck

If the incoming link is already full, the organization's firewall receives only the traffic that gets through that link. Dropping attack packets there cannot restore the capacity lost upstream. The ISP or a cloud scrubbing service must filter a large volumetric flood before it reaches the business connection. Preventing open DNS resolvers and filtering forged source addresses also reduces a network's usefulness to attackers.

A traffic spike alone is not enough to identify an attack. Compare connection counts, half-open sessions, request patterns and CPU load with the normal baseline. A busy sales event can increase legitimate demand too.

Local networks rely on learned information: which port reaches a MAC address, which MAC address belongs to a gateway, and which server answers a name. Attackers can replace that information and redirect traffic.

Recognize an on-path position

An on-path attack, also called a man-in-the-middle attack, sends communication through the attacker. The attacker can read or change unencrypted traffic, or drop it. HTTPS and SSH protect content even when the path crosses an untrusted device, provided identity checks succeed.

MAC flooding sends many fake source MAC addresses to fill a switch's address table. Frames for unknown destinations may then be flooded within the VLAN, exposing traffic to other ports. Port security limits the addresses learned on a port. The effect of a full table depends on the switch, so check its behavior instead of assuming every frame becomes visible.

Follow a forged ARP mapping

ARP maps a local IPv4 address to a MAC address. In ARP spoofing, an attacker sends false ARP messages. ARP poisoning is the resulting false cache entry.

A PC at 192.168.1.50 expects gateway 192.168.1.1 to have MAC address 00:1A:2B:3C:4D:5E. A forged reply claims that the gateway uses 00:AA:BB:CC:DD:EE. The PC now sends gateway-bound frames to that address. If the attacker forwards them, the connection may still work while the attacker sits on-path. Compare arp -a with the gateway's known address; the attacker's own IP need not appear in the cache. Dynamic ARP Inspection (DAI) rejects mappings that fail its checks.

Distinguish three ways to redirect clients

A false DHCP gateway can put routed traffic through the attacker. A false DNS server can redirect selected names. DHCP snooping blocks server replies from untrusted ports. DNSSEC validates signed DNS data; it does not encrypt DNS traffic. A poisoned DNS cache entry lasts until removal or expiry, while a malicious hosts-file entry stays until removed.

Check wireless and VLAN boundaries

A rogue access point joins the wired network without approval and opens an unwanted wireless route into it. An evil twin copies a legitimate SSID to attract clients. Wireless monitoring, wired 802.1X and correct authentication-server certificate validation help prevent these attacks. A familiar network name alone does not identify a trusted access point.

VLAN hopping bypasses the intended routing boundary. Switch spoofing succeeds when an endpoint negotiates a trunk. Double tagging exploits an access VLAN that is also an untagged trunk native VLAN: one switch removes the outer tag, exposing the inner target tag to the next switch. This path is generally one-way. Fixed access ports, static trunks, disabled negotiation and an unused native VLAN close these paths.

An attacker can gain network access by persuading a person, stealing a password or connecting a device. A technically sound firewall cannot check whether a caller claiming to be the helpdesk is telling the truth.

Read the request before reacting

Social engineering uses urgency, authority or helpfulness to obtain access. Phishing uses deceptive messages; spear phishing targets a particular person or role. Vishing uses voice calls and smishing uses text messages. An urgent message asking you to sign in at an unfamiliar domain is a reason to stop and verify through a known channel. Report the message and open the service through its known address.

Watching a password being typed is shoulder surfing. Searching discarded documents or equipment is dumpster diving. Following a badge holder through a locked door is tailgating. These methods exploit everyday work habits, so badge procedures, secure disposal and escorted visitors matter alongside software controls.

Tell malware apart by what it does

These labels can overlap. WannaCry was ransomware that also spread as a worm through vulnerable SMBv1 services on TCP 445 in May 2017. Patching, disabling SMBv1, filtering that service and separating network segments limited its spread. Endpoint protection helps detect malware, but new threats and password theft still require other controls. Backups kept beyond ransomware's reach support recovery.

Identify what the password attacker tries

Brute force tries combinations. A dictionary attack tries likely words, leaked passwords and variations. Password spraying tries a small number of common passwords across many accounts. Credential stuffing tests username-password pairs stolen from other services. Spraying spreads guesses across users; stuffing exploits password reuse.

An online attacker meets the live service's delays and lockouts. An offline attacker tests stolen password hashes without contacting the login service, so that service's lockout cannot slow the guesses. Long, unique passwords, a password manager, leaked-password checks and slow salted password hashing address different parts of the problem.

Protect the remaining routes in

Multifactor authentication (MFA) requires different factor types, so a password alone is insufficient. Hardware security keys can resist phishing that captures passwords and one-time codes. Ordinary code-based MFA can still be phished, so users must check where they sign in.

Lock network rooms and racks. Console access combined with a restart may let an intruder use a device's password-recovery procedure. A visitor who can reach an open switch port may connect a rogue device even without knowing a Wi-Fi password.

Segmentation separates device groups and controls communication between them. It limits lateral movement, an attacker's progress from a compromised device to other reachable systems.

Separate groups and enforce crossings

Physical segmentation uses separate equipment; an air gap has no connection to other networks. VLANs provide logical segmentation on shared switches. Each is a Layer 2 broadcast domain, normally with its own subnet.

A router, Layer 3 switch or firewall connects VLANs. Apply ACLs or firewall rules there. Creating VLANs without filtering leaves routed communication open: broadcast separation alone is not an access policy.

Group devices by their needs

Separate staff, servers, voice, guests, management and IoT devices. Personal BYOD devices usually receive limited access. OT, or operational technology, controls physical processes and needs strict isolation because outages have physical effects and patching can be difficult.

Management interfaces should accept connections only from approved administrator sources. Guests need internet access without internal access; cameras need their recorder. Effective isolation can also reduce the systems included in a payment-card security assessment. Demonstrate that isolation through the actual permitted paths.

Turn needs into rules

Use VLAN 10 Staff on 10.10.10.0/24, VLAN 20 Servers on 10.10.20.0/24, VLAN 30 Guest on 10.10.30.0/24, VLAN 40 Cameras on 10.10.40.0/24 and VLAN 99 Management on 10.10.99.0/24.

Deny other inter-segment flows. This is default deny: identify the required source, destination, protocol and service, then block the rest. A camera-to-recorder rule should not also open every server to the camera subnet.

Test the actual service

From each segment, test a required connection and a forbidden connection. A guest should load an approved public site but fail to open the internal printer's HTTPS interface. A camera should reach its recorder but fail to reach staff PCs. Confirm the expected rule's counter or log changes.

Ping tests ICMP only. A failed ping does not show whether TCP 443 is reachable. Repeat service tests after routing, VLAN or firewall changes.

VLAN security depends on keeping endpoints on access ports and controlling what trunks carry. VLAN tags identify traffic; they do not encrypt it or authenticate its sender.

Stop endpoints from becoming trunks

An access port serves one endpoint VLAN. A trunk carries several VLANs using 802.1Q tags. Its native VLAN carries untagged traffic unless native tagging is enabled.

In switch spoofing, an endpoint impersonates a switch and negotiates a trunk through Cisco DTP. Set endpoint ports to static access mode, real trunks to static trunk mode, and disable negotiation.

Remove the double-tagging path

Double tagging needs the attacker's access VLAN to match an untagged trunk native VLAN. The attacker adds an outer native-VLAN tag and an inner target-VLAN tag. Removal of the outer tag exposes the target tag to the next switch. The usual path is one-way, but can still inject harmful traffic.

Use an unused native VLAN with no endpoints, or enable native-VLAN tagging. Match the native VLAN at both ends: otherwise untagged frames can enter different VLANs at opposite ends. Keep users, servers and management off VLAN 1 and the native VLAN.

Configure and verify the roles

This Cisco IOS example assigns a staff endpoint and an uplink. VLAN 999 is unused; only the listed active VLANs need the trunk.

interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
!
interface GigabitEthernet1/0/48
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,99

Older switches supporting ISL may first need switchport trunk encapsulation dot1q. Limit the allowed list to the far end's actual needs. Check show interfaces trunk for operational trunks, native VLANs and allowed lists, and show interfaces GigabitEthernet1/0/5 switchport for static access operation.

Close unused ports and isolate peers

Shut down unused ports and assign them to an unrouted parking VLAN, such as VLAN 998. A live spare socket still provides a connection; the parking VLAN limits reach if a port is accidentally enabled.

Private VLAN isolated ports reach the promiscuous port, normally toward a gateway, but not each other. Community ports also reach their own community. Wireless client isolation offers comparable peer separation. Routing-boundary rules still control traffic leaving these groups.

An access control list (ACL) checks packets against ordered permit and deny entries. The first matching entry decides the result. If no entry matches, an implicit deny drops the packet.

Choose the fields you need

A standard IPv4 ACL matches only the source address. An extended ACL can match protocol, source, destination and TCP or UDP ports. Cisco numbered standard lists use 1–99 or 1300–1999; extended lists use 100–199 or 2000–2699. Named lists make their purpose easier to recognize and use sequence numbers for editing.

Cisco ACL address ranges use wildcard masks. A zero bit must match; a one bit is ignored. For a subnet, subtract its subnet mask from 255.255.255.255. A /24 uses 0.0.0.255. The range 192.168.10.64/26 uses 0.0.0.63 and covers .64 through .127. host 10.10.20.10 matches one address; any matches every address. Entering 255.255.255.0 as a wildcard would ignore the first three octets and match a last octet of zero, not the intended /24.

Read a complete policy

This named list filters traffic arriving at the router from staff:

ip access-list extended STAFF-IN
 10 permit tcp 10.10.10.0 0.0.0.255 host 10.10.20.10 eq 443
 15 permit udp 10.10.10.0 0.0.0.255 host 10.10.20.53 eq 53
 16 permit tcp 10.10.10.0 0.0.0.255 host 10.10.20.53 eq 53
 20 deny ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255
 30 permit ip 10.10.10.0 0.0.0.255 any

Trace one packet at a time:

1. Staff PC 10.10.10.25 sends TCP 443 to 10.10.20.10. Entry 10 matches, so it is permitted.
2. The same PC sends TCP 3389 to that server. Entries 10, 15 and 16 fail; entry 20 matches and denies it.
3. The PC sends TCP 443 to public server 203.0.113.80. Entry 20 does not match that destination; entry 30 permits it.
4. A packet with guest source 10.10.30.7 matches none of these staff-source entries. The implicit deny drops it.

DNS needs both UDP 53 and TCP 53, including TCP for responses that cannot be completed over UDP. Moving entry 30 above entry 20 would permit staff traffic to every server and make the deny unreachable. Removing entry 30 would block the remaining staff traffic, including internet access.

Apply the list where packets cross

On the staff VLAN interface, ip access-group STAFF-IN in filters packets entering the router from staff. Direction is relative to the router interface, not the user. out checks packets leaving that interface. An interface takes one list per protocol per direction.

Extended ACLs usually go near the source to drop unwanted traffic early. Standard ACLs usually go near the destination: because they cannot distinguish destinations, an early source-only deny could block other required paths.

Verify replies as well as requests

These router ACLs are stateless. A reply checked by another ACL needs its own permission. The Cisco established keyword checks TCP ACK or RST flags; it is not a state table and does not help UDP.

Use show access-lists to inspect match counters and show ip interface to confirm attachment and direction. Zero matches can indicate an entry shadowed by an earlier rule. A final explicit deny ip any any log makes denied traffic visible. For Cisco IPv6 ACLs, preserve the required neighbor discovery permissions: an explicit blanket deny before those permissions can break the local link.

A firewall applies traffic policy between networks or on an individual host. Choose its inspection method according to the decision it needs to make.

Compare inspection methods

A stateful firewall recording TCP 10.10.10.25:51514 to 203.0.113.80:443 can recognize the reversed reply. An unrelated incoming connection does not gain permission merely by using source port 443. A stateless filter instead needs appropriate rules for replies.

An application proxy terminates the client's connection and opens another to the server. A WAF specializes in web requests, including attacks such as SQL injection. A next-generation firewall (NGFW) adds application identification, user policy and functions such as IPS or URL filtering. A UTM appliance bundles security functions for smaller organizations.

Check addresses and transferred content

URL filtering checks web addresses or categories. Content filtering examines transferred material, such as executable files or confidential documents. TCP 443 permission alone cannot distinguish a business website from malware or a remote-access tool using HTTPS.

TLS inspection decrypts, inspects and re-encrypts traffic. Clients must trust its certificate authority. Apply organizational and privacy requirements, including exclusions for sensitive categories.

Read an ordered policy

Consider these first-match rules:

1. Allow Inside to Outside on TCP 80/443 and approved DNS, UDP/TCP 53.
2. Allow Outside to screened-subnet web server 172.16.1.10 on TCP 443.
3. Allow admin PCs 10.10.10.5 and .6 to that server on TCP 22.
4. Deny and log Screened subnet to Inside.
5. Deny and log the rest.

An inside browser matches rule 1. Outside SSH to the web server reaches rule 5 because it is neither published HTTPS nor traffic from a named admin. A compromised public server starting SMB into Inside hits rule 4. Matching replies use the stateful policy.

Use specific sources, destinations and services, with narrow exceptions before broad matches. Record purpose, owner and review date. Review logs and remove obsolete openings or shadowed rules.

A host firewall protects one device, including a traveling laptop. A network firewall protects traffic crossing its boundary. Internal attacks can avoid the internet edge, so keep both.

A public server must accept some internet traffic, but that does not mean the server should share unrestricted access to internal systems. Security zones make those different permissions visible.

Put public services in a screened subnet

A security zone groups interfaces or networks with a common policy. Inside is commonly the trusted zone, Outside the internet, and a screened subnet, also called a DMZ, holds public services. "Trusted" describes the policy grouping; infected devices can still exist there.

Allow Outside to the screened subnet only for published services. Deny Outside to Inside, while admitting replies to connections the stateful firewall allowed from Inside. Deny connections initiated from the screened subnet to Inside except narrowly named dependencies. For example, one web server may need one database port to one internal database. Administrative access should come from named admin hosts.

A three-interface firewall can enforce these boundaries. Alternatively, put the screened subnet between outer and inner firewalls. The latter creates separate policy boundaries but needs more equipment and administration. An attacker reaching a public server through an allowed outer rule still faces the inner rules; the allowed dependencies determine the remaining reach.

Combine publication with permission

Publish private web server 172.16.1.10 by translating public 203.0.113.10 TCP 443 to its private TCP 443 service. This is destination NAT, or port forwarding. The firewall needs both the translation and a rule allowing the published connection. The translation changes addressing; the rule decides permission. Products differ in whether a rule names the address before or after translation, so verify the address the rule actually matches.

Choose detection or prevention

An IDS receives copied traffic through a mirror port or TAP and raises alerts. It cannot directly drop the original packets. An IPS sits inline and can block traffic, including legitimate traffic misclassified as malicious. A fail-open IPS passes traffic during failure; a fail-closed IPS blocks it.

Signature detection matches known patterns and needs current signatures. Anomaly detection compares behavior with a normal baseline and can flag a new pattern. It also needs tuning: a large scheduled backup can resemble data theft.

Only the positive outcomes generate alerts. An alert is a finding to investigate, while a missed attack may leave no alert at all. Lowering sensitivity can reduce false positives and increase false negatives; raising it can have the opposite effect.

Place visibility where the data is available

A network sensor outside an HTTPS or VPN endpoint sees addresses, timing and volume but cannot read encrypted content. Inspect decrypted traffic at the endpoint, behind the VPN gateway or at an approved TLS-inspection point. Host-based detection can see activity on the server after decryption.

A honeypot is an isolated decoy with no legitimate users. Connections to it deserve investigation. A honeynet combines decoys. Keep them isolated so a compromised decoy cannot become a route into real systems.

Switch protections stop several attacks before packets reach a router or firewall. They check different evidence: a MAC address limit, the origin of a DHCP offer or an IP-to-MAC binding.

Limit addresses on a port

Port security limits the MAC addresses allowed through a port. Cisco switches default to one allowed address when the feature is enabled. Addresses can be entered manually, learned dynamically or learned as sticky addresses. Sticky addresses enter the running configuration and survive restart when that configuration is saved.

For a desk with one PC, use this Cisco IOS example:

interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict

A different laptop cannot send through the port after the PC's address is learned. With restrict mode, the original PC can return without the port being err-disabled. Check show port-security interface GigabitEthernet1/0/5. Shutdown mode needs administrative recovery, such as shutdown followed by no shutdown, or configured automatic recovery. MAC addresses can be copied, so port security is not strong device authentication.

Trust DHCP replies only from the correct direction

DHCP snooping blocks DHCP server messages on untrusted ports and builds a binding table of client IP, MAC address, port and VLAN. Enable it globally and for the needed VLANs with ip dhcp snooping and ip dhcp snooping vlan 10,20. On the verified path toward the authorized server, configure ip dhcp snooping trust. End-device ports stay untrusted. A user-port rate limit such as ip dhcp snooping limit rate 10 helps limit DHCP starvation requests.

If the genuine server's incoming path stays untrusted, legitimate offers are dropped too. Trust is a direction decision, not a statement that every uplink is safe. A link from an unprotected access switch can carry rogue offers.

Reuse bindings to inspect addresses

Dynamic ARP Inspection (DAI) checks ARP messages against valid IP-to-MAC bindings on untrusted ports. IP Source Guard checks source addressing in IP traffic using the bindings. For DHCP clients, establish snooping bindings before enforcing either feature. Static hosts need ARP ACL entries for DAI and manual source bindings for IP Source Guard; they do not acquire a DHCP binding simply by sending traffic.

Add protections for other control traffic

Storm control limits broadcast, multicast or unknown-unicast rates. BPDU guard disables an edge port receiving spanning-tree messages. RA guard blocks unauthorized IPv6 router advertisements on user ports. None performs the same check as DAI.

Test these changes in a lab or maintenance window with a recovery path available: an incorrect trust setting or missing binding can disconnect legitimate devices.

A cable connection or familiar MAC address does not identify an approved user. Network access control (NAC) decides whether a device may join and which access it receives, using identity, device information and often a health check.

Follow the three 802.1X roles

802.1X provides port-based access control on wired and wireless networks. The endpoint's supplicant requests access. The switch or access point is the authenticator controlling the connection. The authentication server, commonly RADIUS, checks the credentials. Before success, normal data traffic is blocked while EAP over LAN (EAPOL) authentication messages pass.

A laptop connects to port GigabitEthernet1/0/12. Its supplicant exchanges EAP messages with the switch. The switch relays them in RADIUS messages to the server. After validating the laptop's certificate, the server returns Access-Accept with VLAN 10. The switch admits the laptop into Staff. A rejected identity remains blocked or receives restricted access according to policy.

Choose and validate the authentication method

EAP-TLS authenticates client and server with certificates. The client proves possession of its private key without sending that key. PEAP creates a TLS tunnel using the server's certificate and checks a username and password inside it.

Both require the client to validate the authentication server's certificate. A PEAP client accepting an attacker's server can expose its password authentication exchange to cracking. EAP-TLS does not send the private key, but accepting a false server can still lead a device onto an attacker's network. Configure the trusted authority and expected server identity, not just the SSID.

Handle devices with different abilities

A printer without a supplicant may use MAC Authentication Bypass (MAB). The switch submits its MAC address to RADIUS as the identity. Because that address can be copied, put the printer into a restricted segment with only its required paths.

A posture assessment checks health, such as installed updates, active endpoint protection and an enabled firewall. A failing device can enter a quarantine VLAN that permits remediation services. After updates and a fresh check, it may receive normal access. A guest captive portal presents a web page for terms or a code; it serves a different purpose from certificate-based device authentication.

Apply the same ideas to Wi-Fi

WPA3-Personal uses SAE and better resists offline guessing than WPA2-Personal. Use Enterprise mode for staff and a separate guest network. Disable WPS and obsolete WEP or TKIP-based WPA.

NAC determines admission and placement. ACLs and firewalls still limit the admitted device's traffic. Introduce enforcement in stages: observe failures, test a small group, then expand. Inventory devices without supplicants and keep a documented administrative recovery route if RADIUS becomes unreachable.

Device hardening removes unnecessary entry points and secures the services that remain. Apply it to switches, routers, firewalls, access points and cameras, then check it again after software or configuration changes.

Remove easy entry points

Change factory credentials during setup. Mirai used common default logins on internet-connected devices in 2016 to build a large botnet. Disable unused switch ports and unnecessary services, including Telnet, plain HTTP management, UPnP and WPS. Disable discovery protocols such as CDP and LLDP on untrusted-facing ports where revealing device information creates exposure.

Encryption protects credentials in transit. Stored credentials need strong hashes too. Cisco type 9 uses scrypt and type 8 uses PBKDF2 with SHA-256. Type 5 is outdated. service password-encryption produces reversible type 7 obfuscation; it is not strong password storage.

Build SSH-only access

This Cisco IOS example assumes a switch supports the commands shown. Create the account interactively with a long, unique secret; do not reuse a password from an example.

hostname SW1
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2

Create the named administrator with username netadmin privilege 15 algorithm-type scrypt secret followed by the chosen secret. Then configure the remote-access lines:

line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0
 access-class MGMT-ONLY in

MGMT-ONLY is a separately defined ACL permitting only authorized administrator sources. login local selects local accounts; transport input ssh excludes Telnet; the idle timeout is 10 minutes. Verify an allowed SSH login and a denied login from an ordinary user segment.

Restrict the management path

Use a management VLAN and narrow source permissions. A jump box is a hardened server administrators enter first, letting devices accept management sessions from that source alone. In-band management uses the production network; out-of-band management uses a separate network or console path that can remain available during a production outage.

Login delays or lockouts reduce online guessing. For example, login block-for 120 attempts 5 within 60 blocks logins for 120 seconds after five failures within 60 seconds. Device settings must support the organization's password policy; a device minimum is not a recommendation to choose the shortest allowed secret.

Update and audit the device

Read the vendor advisory, obtain the official image and verify its hash or signature. Back up the configuration, update one device during the planned window, test the result and keep a rollback image. Replace end-of-life devices that no longer receive fixes.

Send logs to a central syslog service and synchronize clocks with NTP so events can be compared. Syslog commonly uses UDP 514. Keep approved configuration baselines and backups; compare them with running settings to find unexpected changes. A login banner states authorized-use and monitoring rules. Logs and baselines are useful only when access to them is controlled and changes are reviewed.

A successful login answers only one question: who has connected? Network administration also needs a decision about permitted actions and a record of what happened.

Separate the three AAA decisions

Authentication verifies identity. Authorization grants actions. Accounting records activity. Together they form AAA. An engineer can authenticate successfully but lack permission to change a route. Accounting can then record the attempted command.

Local accounts live on each device. Central AAA gives many devices one account directory and a common record. Removing a departing administrator once is safer and easier to check than editing accounts on 40 switches. Use personal accounts and role-based permissions so logs identify a person and a helpdesk role can view status without changing configurations.

Classic RADIUS commonly carries 802.1X, enterprise Wi-Fi and VPN authentication. TACACS+ supports detailed command authorization and accounting. Older RADIUS equipment may use UDP 1645 and 1646.

Understand fallback before enabling it

Cisco IOS aaa authentication login default group tacacs+ local tries the server group first. Local authentication is used when no server responds, not when a reachable server rejects the login. An incorrect password rejected by the server does not trigger a second attempt against local accounts.

aaa new-model enables AAA. aaa authorization exec default group tacacs+ local selects authorization methods, and aaa accounting commands 15 default start-stop group tacacs+ records privilege-level-15 commands. The server group, keys and reachability must also be configured. Keep a protected emergency local account and test the recovery route before relying on central service availability.

Choose passwords that resist guessing

Long, unique secrets and leaked-password checks matter more than a predictable mixture of symbols. US NIST guidance from 2025 calls for at least 15 characters for a password used alone and permits a minimum of 8 with another factor. Systems should allow at least 64 characters, avoid mandatory character mixtures and avoid routine forced changes without evidence of compromise.

For truly random lowercase letters, each added character multiplies the keyspace by 26. At 10 billion guesses per second, exhausting eight letters takes about 21 seconds; twelve takes about 110 days; sixteen about 138,000 years. A reused password or predictable phrase does not gain this random-keyspace protection. Slow salted hashing also reduces offline guessing speed.

Add a different factor and protect the records

MFA combines knowledge, possession or inherence: for example, a password and a hardware security key. A password plus a PIN is still knowledge only. Use MFA for remote administration and VPN access.

Accounting records contain personal data, including names, addresses and login times. Limit access and retention according to organizational policy and applicable law. On a customer's network, inspect only the data needed for the authorized job.

A VPN protects traffic between endpoints across an untrusted network. Choose the endpoint arrangement first, then decide which traffic uses it.

Match the VPN to the work

Branch hosts behind a site-to-site gateway need no individual VPN client. A remote-access client authenticates, preferably with MFA, and usually receives an address from an internal pool. A clientless portal suits a contractor who cannot install software, but exposes only the applications it supports and publishes.

Trace the inner and outer packets

The branch uses 10.20.0.0/16 and headquarters 10.10.0.0/16. Their public gateways are 198.51.100.1 and 203.0.113.1. A branch PC at 10.20.5.7 sends to file server 10.10.1.20.

1. Routing and VPN policy select the packet for the branch tunnel endpoint.
2. ESP tunnel processing encrypts the original packet and adds an outer header from 198.51.100.1 to 203.0.113.1.
3. Internet routers use the outer public addresses; the private destination remains protected inside.
4. Headquarters verifies and decrypts the packet, then forwards it to 10.10.1.20.

Protection ends at those endpoints. The local paths beyond them need suitable application protocols and access controls.

Choose full or split routing

A full tunnel sends all remote-device traffic through the organization, including public browsing. Company filtering can inspect that path, but it uses central bandwidth and may add delay.

A split tunnel sends selected destinations through the VPN. For example, 10.0.0.0/8 enters the tunnel while a public video service uses the worker's direct internet link. That traffic bypasses company gateway filtering; endpoint security remains necessary.

Choose full tunneling when policy requires central handling of all browsing. Choose split tunneling when permitted direct traffic would otherwise consume limited head-office capacity.

Limit admitted devices

VPN encryption does not remove malware. Combine remote access with MFA, posture checks and firewall rules limiting users to required resources. An infected authenticated laptop can attack reachable systems. The gateway operator can see traffic after decryption, so a VPN also does not hide activity from that operator.

IPsec separates peer setup from protected user traffic. Checking those stages independently helps explain why a VPN can report a connection while applications still fail.

Establish keys and security associations

Internet Key Exchange (IKE), normally IKEv2, starts on UDP 500. Peers authenticate with a pre-shared key or certificates, agree on compatible algorithms and derive keys. A security association (SA) records protection settings and key material. IKE establishes its protected control channel and negotiates IPsec SAs for data.

IPsec data SAs are directional, so two-way traffic needs a pair. Each peer applies its own lifetime policy; either can rekey before expiry. In IKEv2, different configured lifetimes do not by themselves prevent setup.

Distinguish the data protocols and modes

Gateway-to-gateway VPNs normally use ESP tunnel mode. AH covers address fields that NAT changes, which makes it unsuitable across NAT. ESP is IP protocol 50, not TCP port 50 or UDP port 50. Permit IKE, NAT-T when used, and native ESP when used between the gateway addresses.

GRE encapsulates without encryption. GRE over IPsec combines GRE's carriage of multicast or routing traffic with IPsec protection. The added encapsulation alone supplies no secrecy.

Account for packet size

An ESP tunnel commonly adds roughly 50–80 bytes per packet; NAT-T adds another 8-byte UDP header. A full 1,500-byte original packet plus those headers exceeds a 1,500-byte path MTU. Depending on the protocol and settings, it must be fragmented or is dropped. A smaller tunnel MTU, often about 1,400 bytes, and an adjusted TCP maximum segment size (MSS) help traffic fit. Small requests working while larger transfers stall is a useful sign of an MTU problem.

Compare other VPN choices

TLS VPNs, traditionally called SSL VPNs, commonly use TCP 443 and may also support UDP. They suit remote clients and browser portals. WireGuard uses UDP, often 51820, and a small set of modern algorithms. L2TP/IPsec combines older L2TP tunneling on UDP 1701 with IPsec protection. PPTP is obsolete and insecure.

Long random pre-shared keys are manageable for a few peers but awkward at scale. Certificates issued through a certificate authority (CA) and public key infrastructure (PKI) support individual renewal and revocation. Keep private keys secret, check expiry and trust, and revoke credentials that should no longer work. A self-signed certificate needs an explicitly established trust arrangement.

Locate the failing stage

Check gateway reachability, IKE version, algorithms and peer credentials first. Next inspect IKE and IPsec SAs separately. Confirm mirrored protected-network selectors, the required firewall permissions and routes into the tunnel. Finally test small and large application transfers. An IKE SA proves control-channel setup; it does not establish that the selected data path, firewall rules and packet sizes are correct.