Network & Email · page 14

Builds SG rule sets per application tier with port notes.

Compares full-cone, restricted, port-restricted, and symmetric NAT.

Explains loopback NAT symptoms and plan steps for internal access.

Plans SYN cookies, rate limits, and upstream scrubbing steps.

References remotely-triggered blackhole setup with trigger host steps.

Plans GeoIP allow and deny lists per exposed service.

Normalizes, dedupes, and merges pasted IP allowlists into CIDR form.

Plans knock port sequences, timeouts, and firewall hooks.

Plans jails, findtime, and maxretry per service.

Steps through suppressing noisy Suricata and Snort alerts.

Generates HOME_NET and PORTS variables from CIDR lists.

Builds action, protocol, source, and destination rule headers.

Plans honeypot placement and tagging per network segment.

Plans DNS sinkhole zones, redirect targets, and logging scope.

Checks SSH v2, AAA, banners, and unneeded services on network gear.

Compares TACACS+ and RADIUS for device administration and access.

Plans IoT VLANs with allowed flows to brokers and clouds.

References Purdue levels 0 through 5 with zone boundaries.

Checks ICS segmentation steps from conduits to data diodes.

Lists categories to exclude from TLS interception and why.

Checks SSH bastion hardening from key rules to audit logging.

Generates change request fields with risk, rollback, and approvers.

Plans throughput and concurrent sessions from user and app counts.

Plans allowlist-only restricted network policies.