🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › IT Support / Networking › Networking Fundamentals and Infrastructure › Lesson 10
TEC-ITS43-04 · Lesson 10 · 10 clock hours · theory

Network Security Fundamentals

Objective. Students will describe common network attack types (DoS, VLAN hopping, ARP spoofing, rogue DHCP), explain mitigation strategies including ACLs and port security, and configure a basic numbered ACL on a Cisco router to permit or deny specified traffic.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Network Security Fundamentals

Every network you build or manage is a potential target. Understanding how attacks work is the first step toward stopping them. This lesson covers four common network-layer threats, the mitigation strategies used in the industry, and how to configure a numbered Access Control List (ACL) on a Cisco router.

Common Network Attack Types

Denial of Service (DoS) and Distributed DoS (DDoS)

A Denial of Service attack floods a target — a server, router, or entire network segment — with traffic or requests until it can no longer serve legitimate users. A Distributed DoS (DDoS) uses many compromised machines (a botnet) to amplify the flood. The result is the same: legitimate users are denied access to a resource. Mitigations include rate limiting, traffic scrubbing services, and upstream filtering at the ISP.

VLAN Hopping

VLANs segment a network so that traffic from one VLAN cannot normally reach another without passing through a Layer 3 device. VLAN hopping exploits trunk port negotiation or double-tagging to inject frames into a VLAN the attacker does not belong to. The most common form abuses Cisco's Dynamic Trunking Protocol (DTP). Mitigations include disabling DTP on all access ports (`switchport nonegotiate`), setting unused ports to a dedicated unused VLAN, and ensuring the native VLAN is not VLAN 1.

ARP Spoofing (ARP Poisoning)

The Address Resolution Protocol (ARP) maps IP addresses to MAC addresses on a local network segment. ARP has no authentication, so an attacker can broadcast fake ARP replies that associate the attacker's MAC address with the gateway's IP. Hosts update their ARP cache and begin sending traffic through the attacker — a classic man-in-the-middle (MitM) position. Mitigations include Dynamic ARP Inspection (DAI) on managed switches and static ARP entries for critical hosts.

Rogue DHCP Server

When a host requests an IP address, a rogue DHCP server can respond faster than the legitimate server and hand out its own gateway and DNS settings. Traffic from affected clients is redirected through the attacker. Mitigation is DHCP snooping on managed switches, which marks legitimate server ports as trusted and discards DHCP offers arriving on untrusted ports.

Mitigation Strategies

Port Security

Cisco switches can limit the MAC addresses allowed on an access port. If an unauthorized device is connected, the switch can shut the port down (err-disable), restrict additional MACs, or just drop the frames. This stops unauthorized devices from accessing the network physically.

Access Control Lists (ACLs)

ACLs are ordered lists of permit/deny statements that a router or Layer 3 switch applies to packets as they pass through an interface. There are two main types:

ACLs are processed top-down. The first matching statement wins. Every ACL ends with an implicit `deny any`, meaning any traffic that does not match a permit statement is dropped.

Configuring a Numbered ACL on a Cisco Router

The general workflow is:

1. Write the ACL statements in global configuration mode.

2. Apply the ACL to an interface in the correct direction (inbound or outbound).

Direction matters:

Example security policy: Block Telnet (TCP port 23) from the subnet 192.168.10.0/24 to any destination; permit all other traffic.

Because this policy specifies both a source subnet and a destination port, an extended ACL is required. Refer to the Worked Examples section for the full configuration.

Safety and Professional Practices

Network security work can affect live production systems. Always follow your organization's change management process before applying ACLs to production equipment. Test changes in a lab environment first — an incorrectly placed ACL can lock administrators out of devices or drop critical business traffic. When working in a wiring closet or data center, follow all site electrical safety rules. If you must work inside live equipment enclosures, be aware of electrical hazards from power supplies; if a task requires opening energized equipment, follow the facility's lockout/tagout (LOTO) procedures (OSHA 29 CFR 1910.147) and wear appropriate PPE. On the logical side, document every ACL you apply so your team can audit and roll back changes quickly.

Key terms10

Denial of Service (DoS)An attack that overwhelms a target with traffic or requests, preventing legitimate users from accessing a resource.
VLAN HoppingAn attack technique that exploits trunk port negotiation or double-tagging to send frames into a VLAN the attacker is not authorized to access.
ARP SpoofingAn attack in which a malicious host sends fake ARP replies to associate its MAC address with a legitimate IP address, enabling traffic interception.
Rogue DHCP ServerAn unauthorized DHCP server that responds to client requests with attacker-controlled network settings, potentially redirecting traffic.
Access Control List (ACL)An ordered set of permit and deny statements applied to a router interface that controls which packets are allowed or blocked based on defined criteria.
Standard ACLA type of Cisco ACL (numbered 1–99 or 1300–1999) that filters traffic based on source IP address only; should be placed closest to the destination.
Extended ACLA type of Cisco ACL (numbered 100–199 or 2000–2699) that filters traffic based on source IP, destination IP, protocol, and port; should be placed closest to the source.
DHCP SnoopingA switch security feature that designates trusted and untrusted ports for DHCP traffic, dropping DHCP offers received on untrusted ports to prevent rogue DHCP servers.
Dynamic ARP Inspection (DAI)A switch security feature that validates ARP packets against a trusted binding table, discarding packets with invalid IP-to-MAC mappings to prevent ARP spoofing.
Implicit DenyThe invisible final statement at the end of every Cisco ACL that drops any packet not matched by a previous permit statement.

Worked examples3

1. Write a numbered extended ACL to block Telnet (TCP port 23) from the subnet 192.168.10.0/24 to any destination, and permit all other traffic. Apply it to interface GigabitEthernet0/0 in the inbound direction.
  1. Step 1 – Choose the ACL number. This is an extended ACL (needs source, destination, and port), so use a number in the range 100–199. Choose 100.
  2. Step 2 – Write the deny statement. The source subnet 192.168.10.0/24 uses a wildcard mask of 0.0.0.255 (inverted subnet mask). The command is: access-list 100 deny tcp 192.168.10.0 0.0.0.255 any eq 23
  3. Step 3 – Write the permit statement. To allow all other traffic, add: access-list 100 permit ip any any
  4. Step 4 – Enter interface configuration mode and apply the ACL inbound (traffic arriving from the 192.168.10.0 subnet): interface GigabitEthernet0/0 → ip access-group 100 in
  5. Step 5 – Verify with: show ip access-lists 100 and confirm match counters increment when Telnet is attempted from 192.168.10.x.
Answer: Router(config)# access-list 100 deny tcp 192.168.10.0 0.0.0.255 any eq 23 Router(config)# access-list 100 permit ip any any Router(config)# interface GigabitEthernet0/0 Router(config-if)# ip access-group 100 in
2. Calculate the wildcard mask for the subnet 10.0.4.0/22, which will be used in an ACL statement.
  1. Step 1 – Write the subnet mask for /22 in dotted-decimal. A /22 mask is 255.255.252.0.
  2. Step 2 – Subtract each octet from 255 to get the wildcard mask: 255−255=0, 255−255=0, 255−252=3, 255−0=255.
  3. Step 3 – The wildcard mask is 0.0.3.255.
Answer: Wildcard mask: 0.0.3.255. The ACL source entry would read: 10.0.4.0 0.0.3.255
3. A standard ACL numbered 10 should block host 172.16.5.25 from reaching a file server. Determine the correct ACL statement and explain where to place it.
  1. Step 1 – Standard ACLs filter on source IP only. To match a single host, the wildcard mask is 0.0.0.0 (or use the 'host' keyword): access-list 10 deny host 172.16.5.25
  2. Step 2 – Add a permit for everything else to avoid blocking all traffic: access-list 10 permit any
  3. Step 3 – Standard ACLs cannot specify a destination, so placing them near the source would block traffic to all destinations, not just the file server. Apply the ACL on the interface closest to the file server (the destination) in the inbound or outbound direction facing the server.
  4. Step 4 – Apply outbound on the router interface connected to the file server's segment: ip access-group 10 out
Answer: access-list 10 deny host 172.16.5.25 access-list 10 permit any Apply outbound on the interface nearest the file server (closest to destination rule for standard ACLs).
In class: Threat taxonomy lecture: instructor presents each attack type with a diagram showing normal vs. attack traffic flow; students take structured notes and pair-share one real-world consequence for each threat type · ACL design exercise: given a security policy (block Telnet from a specific subnet, permit all other traffic), students write the ACL statements on paper, determine the correct interface and direction for application, and justify their placement using the 'closest to source vs. destination' rule for standard vs. extended ACLs · ACL configuration lab (short): students enter the written ACL on a Cisco router in the lab, apply it, and test with Telnet and ping from the blocked and permitted hosts; results are documented in the lab log
Materials: Cisco routers and lab PCs, PuTTY, CompTIA Network+ Study Guide (security domain), Cisco CCNA Official Cert Guide (ACL chapter), ACL design worksheet, lab log notebooks
Check: ACL permits correct traffic AND blocks specified traffic as verified by student's own test results; written ACL design worksheet checked for correct syntax and interface/direction rationale; 80% accuracy on a 10-question security concept quiz

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Network+ – Network Security
1. An attacker sends a flood of UDP packets to a web server until the server becomes unreachable to legitimate users. Which attack type best describes this?
CompTIA Network+ – Network Security
2. Which switch security feature prevents a rogue DHCP server from handing out addresses to clients on untrusted ports?
Cisco CCNA – IP Access Control Lists
3. A network technician needs to block traffic based on source IP, destination IP, and TCP port. Which type of Cisco ACL should be used?
Cisco CCNA – IP Access Control Lists
4. According to best practice, where should an extended ACL be placed relative to the traffic it is filtering?
Cisco CCST – Networking Concepts
5. A packet arrives at a router interface with an ACL applied. The ACL has one deny statement and one permit statement, but the packet does not match either statement. What happens to the packet?
Cisco CCNA – IP Access Control Lists
6. What wildcard mask would you use in a Cisco ACL statement to match only the single host 192.168.1.50?
CompTIA Network+ – Network Security
7. An attacker on a switch sends specially crafted frames with two 802.1Q VLAN tags to gain access to a VLAN they are not assigned to. Which attack is this?
Cisco CCNA – IP Access Control Lists
8. A technician applies the following ACL to a router interface and notices that no traffic from any host is reaching the destination, even though only one subnet was supposed to be blocked. What is the most likely cause? access-list 101 deny ip 10.1.1.0 0.0.0.255 any access-list 101 deny ip any any
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →