ZZZ Network Security Implementation

The assignment content discusses the challenges and implementation of security measures on a network site 'ZZZ' which has poorly configured network devices, lacking security features such as Layer-2, Layer-3, and Layer-4 security. The solution proposes implementing port-security on access ports, configuring VTP mode to transparent, restricting network traffic flow based on IP addresses using Access-lists, and disabling Telnet and enabling SSH for secure management access.

Site “ZZZ” Challenges and Implementation
Site details and Challenges
Site ZZZ network is poorly configure according to network security. Need to improve network
devices security in various division. Need to implement Layer-2, Layer-3 and Layer-4 security
on network devices.
Site Solution and Technologies
Current network devices has less security, so need to improve its security using following
technologies.
1) Layer-2 Security
a. Access Port Security: Access port is used to connect end devices. Need to implement port-
security on access port. If there is a only PC than only on mac address allowed, if there is
an ip-phone with pc then only two mac address allowed, which are not changeable by any
user except network admin.
b. VTP mode: vtp protocol should be configure on transparent mode, because if any attacker
plug devices which has higher revision number than all network will be down.
2) Layer-3 Security
a. Access-list base on IP address: We can restrict network traffic flow base on ip address
using Access-list. Guest user can’t access LAN, they are able to access internet only. So we
can protect LAN user from Guest/attackers.
3) Layer-4 Security
a. Management ACL: Management Access-list is use to restrict network devices access base
on ip address and port address. I’m going to give access to few devices which are the only
can access network devices. Telnet should be disable in all network equipment. Because it
is not secure. Network admin should use SSH rather than Telnet.
Sample Configuration
1) Layer-2 Security
a. Access Port Security
Switch#configure terminal
Switch(config)#interface range 0/1-24
Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security mac-address sticky
Switch(config-if)#switchport port-security maximum 1
b. VTP mode
Switch#configure terminal
Switch(config)#vtp mode transparent
2) Layer-3 Security
Router#configure terminal
Router(config)#ip access-list extended L3
Router(config-ext-nacl)#deny ip 192.168.10.0 0.0.0.255 any

Router(config-ext-nacl)#permit ip any any
Router(config)#interface fa0/0
Router(config-if)#ip access-group L3 in
3) Layer-4 Security
Router#configure terminal
Router(config)#ip access-list extended MGNT
Router(config-ext-nacl)#permit ip 192.168.1.15 0.0.0.0 any eq 22
Router(config-ext-nacl)#permit ip 192.168.1.16 0.0.0.0 any eq 22
Router(config-ext-nacl)#permit ip 192.168.1.17 0.0.0.0 any eq 22
Router(config-ext-nacl)#deny ip any any
Router(config)#line vty 0 15
Router(config-if)#ip access-class MGNT
Bibliography
Cisco Official Certification Guide - CCNA Security by Michael D. Watkins, Kevin
Wallace