5 Network Security Fundamentals
Learn how network security controls traffic, protects device management, reduces Layer 2 risks, uses VPNs, and applies foundational hardening practices.
Security goals and traffic filtering
Network security protects the confidentiality, integrity, and availability of data and services. Core network-security practice includes controlling traffic with ACLs, securing management access, reducing Layer 2 attacks, understanding VPNs, and applying basic hardening. CCNA topics include ACLs, local device access control, VPN concepts, , and Layer 2 features such as , , and .
Access control lists
An is an ordered set of rules that permits or denies traffic matching specified conditions. On Cisco IOS, ACLs are commonly applied to an interface in the inbound or outbound direction. Inbound filtering checks packets as they arrive at an interface; outbound filtering checks them before they leave. An filters traffic but does not encrypt it or, by itself, track a connection's state.
IPv4 types and matching
A matches only the packet's source IPv4 address, so it is useful when a policy depends only on who sent the traffic. An can match source and destination addresses, protocol, and, where applicable, TCP or UDP ports. This supports more specific policies, such as permitting HTTP from one subnet to a particular server. ACLs can be numbered or named; named ACLs are easier to identify and edit. Number ranges and available syntax depend on type and platform.
Entries are checked in order, and processing stops at the first match. If no entry matches, the implicit final rule is deny. Place specific rules before broader rules, and check the effect of the implicit deny before applying an . A indicates which address bits must match: 0 means match the bit, while 1 means ignore it. For example, 0.0.0.255 matches a /24 network.
This example permits HTTP and HTTPS from a user subnet to one web server, denies other IP traffic from that subnet, and permits other traffic through the . Traffic outside the subnet that is not matched by the first three entries is not restricted by those entries.
The following numbered permits one source subnet and denies other sources. The accompanying description refers to a final permit making remaining traffic explicit, but the displayed commands instead use deny any; as written, that command explicitly denies unmatched sources. If deny any is omitted, the implicit deny blocks unmatched traffic.
The examples show Cisco IOS behavior. Confirm exact syntax and feature support for the device and software release in use.
Choosing placement
As a rule of thumb, place Extended ACLs near the traffic source to prevent unwanted traffic from crossing the network. Standard ACLs cannot match a destination and are often placed closer to the destination to avoid unintentionally blocking a source from reaching other destinations. Always consider the intended policy and test the filtering direction.
Secure device management
Limit management access to authorized administrators and use encrypted protocols. Prefer SSH over Telnet and HTTPS over HTTP because Telnet and HTTP do not protect credentials and sessions in transit. Use a console connection for initial setup or recovery, and restrict remote management to designated management hosts or networks.
This IOS-style example creates a local account, configures SSH, and permits SSH—not Telnet—on the virtual terminal (VTY) lines. Hostname, domain name, and key-generation requirements vary by platform and software release.
Use protected secrets rather than reusable plaintext line passwords where supported. Restrict management-plane reachability with management VLANs, ACLs, or other platform-supported controls. Back up configurations securely, apply software updates through a change process, and avoid exposing management interfaces directly to untrusted networks.
and administrator access
means authentication, authorization, and accounting. Authentication verifies identity; authorization determines what an authenticated user may do; and accounting records user activity and actions. A device can use a local user database or a centralized service such as RADIUS or TACACS+. Centralized services support consistent administration and auditing, but administrators need a tested fallback plan to retain authorized access if the service is unreachable. Cisco IOS XE supports login methods using local accounts and server groups.
Layer 2 protections
Layer 2 attacks exploit trust relationships within a local switching domain. Security features can help prevent rogue DHCP services, forged ARP messages, unauthorized devices, excessive traffic, and rogue IPv6 routers. Trust settings must match the actual topology: trusting the wrong port can undermine protection, while misconfiguring a legitimate infrastructure port can disrupt service.
distinguishes trusted ports—typically those leading to an authorized DHCP server or relay—from untrusted ports, typically those connected to end devices. It can drop unauthorized DHCP server messages arriving on untrusted ports and builds a binding table containing information such as a client's IP address, MAC address, VLAN, and switch port. can use this table to validate ARP traffic.
In many implementations, all ports are untrusted by default; trust only the required infrastructure path. Syntax and behavior vary across switch families.
(DAI) checks ARP messages received on untrusted interfaces against IP-to-MAC bindings, commonly from the database, and drops invalid messages. This helps defend against ARP spoofing and poisoning. Hosts with statically configured addresses may require an ARP or another supported binding method. Plan DAI and together, including across switches that share a VLAN.
and other protections
limits which source MAC addresses may use a switch port. Administrators can set a maximum number of MAC addresses, statically configure allowed addresses, or use sticky learning where supported. A violation action may restrict traffic or shut down the port, depending on configuration. Apply thoughtfully: phones, access points, docks, and small switches can legitimately present multiple MAC addresses.
This example allows up to two learned addresses and uses a restrictive violation response. Exact commands and defaults depend on the platform.
Other useful Layer 2 protections include:
Storm control limits selected broadcast, multicast, or unknown-unicast traffic to reduce the effect of traffic storms. Threshold behavior and supported traffic types vary by platform.
RA Guard filters unauthorized IPv6 Router Advertisement messages on Layer 2 ports. It helps prevent a rogue host from advertising itself as an IPv6 router. Use router-appropriate policy on legitimate router-facing ports and host policy on endpoint ports.
Disable unused switch ports or place them in an unused VLAN. Use access-port settings for endpoint ports where appropriate, and protect spanning-tree edge ports with suitable features such as BPDU Guard when supported and correctly deployed.
VPNs and
A virtual private network (VPN) creates a protected logical connection across an untrusted network. A VPN can provide tunneling, peer authentication, confidentiality, and integrity protection. It does not automatically secure every endpoint or every part of a network; configuration, identity verification, key management, and endpoint security remain important.
is a suite of protocols used to protect IP traffic. In common deployments, IKE negotiates security parameters and authenticates peers, while ESP provides confidentiality and/or integrity protection for data traffic. Exact algorithms and configuration depend on the platform and security policy.
Deployment patterns
Site-to-site VPN: connects networks through VPN gateways, such as two branch-office routers. Hosts typically send traffic through the tunnel without running VPN software themselves.
Remote-access VPN: connects an individual user's device to an organization's network, often using VPN client software and user authentication.
modes
In , protects an entire original IP packet by encapsulating it in a new IP packet; this is commonly used between VPN gateways. In , protects the payload while retaining the original IP header; it is typically used for host-to-host protection. The appropriate mode depends on the design.
Foundational security practices
Effective security combines technical controls with people and procedures. Apply these foundational practices:
Use least privilege: grant users and services only the access they need.
Use strong, unique credentials: protect secrets, apply a password-management policy, and use multifactor authentication where available.
Reduce exposure: disable unused services and ports, restrict management sources, and segment networks with VLANs and routing policies.
Maintain systems: install approved software updates, back up configurations, and test restoration procedures.
Monitor and review: collect logs, review authentication and configuration changes, and investigate unusual events.
Prepare users: provide awareness training and enforce physical access controls for network equipment.
Plan for failure: document configurations, retain secure recovery access, and test changes before broad deployment.
Together, ACLs filter traffic through ordered match rules, and unmatched traffic is denied unless explicitly permitted. Secure device management with SSH or HTTPS, local secrets or , and restricted management reachability. At Layer 2, , DAI, , storm control, and RA Guard address different threats and depend on correct trust and topology design. VPNs protect traffic across untrusted networks, while site-to-site and remote-access designs serve different needs. Combine these controls with least privilege, updates, monitoring, backups, and user awareness.