How to write up Network Security , part II ?

This is continuation of part I

• Consultant/guest access to network - How they separate guest/consultant subnet from the rest of the network ? Well, VLAN is not a good answer. One of the best is probably use of VRF Lite (creating virtual routers, virtual routing tables for guest traffic) for traffic and host segmentation. It's very important from PCI standpoint

IOS IPS

In order to setup IPS on IOS follow instructions here. My tftp server is at the address 192.10.1.200 and dynamips router has interface 192.10.1.6. The first step is to transfer signature files from tftp server to router.

How to write up Network Security ?

Most network security audit programs are written by people with risk or audit background and very little technical and operational experience. So there are a many risks and controls listed there which seem to make sense at first glance, but in fact always one of the below rules apply to them:

• Every network will comply with controls
• Controls cannot to be tested for effectiveness

Dynamic Virtual Tunnel Interface Easy VPN Server and Client

See below two scenarios:
1) SW1 ezVPN client connected to router R1 ezVPN server
2) SW1 ezVPN client connected to firewall ASA ezVPN server

VRF-aware IPSEC Virtual Interface Tunnels

R3 (f0/0 and f0/1) is connected to SW1 (f1/3 and f1/13) on two Fast Ethernet interfaces (R3 f0/0-SW1 f/13 and R3 f0/1 to SW1 f1/13). IPSEC Tunnel 100 and 200 are originating from both pairs of Fast Ethernet interfaces. Network 1.1.1.0 and 3.3.3.0 are routed over Tunnel 100 and 2.2.2.0 and 4.4.4.0 over Tunnel 200. See configurations below: