4. CCNA Security, Lab Example

Topology

Lab 2A

Resources used:
  1. 3 GNS emulated C7200 routers
  2. 2 Cisco 2960 switches
  3. PC_A (GNS3 WinXP SP3 host) configured to use eth2 USB-Ethernet adapter with CCP 2.5 and PuTTy SSH software
  4. PC_C (GNS3 WinXP SP3 host) bridged adapter eth4, PuTTy SSH and Tftpd32  
 Where to get optional software:
To download Cisco CCP 2.5 or later version simply register on Cisco website, log in and  proceed to download software. Service contract subscription is not required. Also I recommend to download CCP 2.5 Release Notes. It is a great source of helpful information.

There are few other pieces of software required in order to run CCP:
  • Flash player - I have ver 14.0.0.145 which can be downloaded here.
  • JRE versions 1.6.0_11 up to 1.6.0_27 download here.

Unfortunately CCP configuration guidelines found in Lab Manual are not complete. Be sure to follow instructions found in CCP Release notes to make all necessary configuration changes to Java and Flash Player.

Lets check if CCP functions properly.
Start with simple topology from previous discussion and make small modification. Save project as Lab2A.

Verify R1  fa0/1 IP Address and its status:

R1#sh ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES NVRAM  administratively down down   
FastEthernet0/1            192.168.1.1     YES NVRAM  up                    up     


Start PC_A and check it's IP Address (192.168.1.3/24) and Default Gateway (192.168.1.1) assignment.
 
Ping PC_A from router:

R1#ping 192.168.1.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 8/16/36 ms


Prepare router to accept CCP connections:

R1(config)#ip http server
R1(config)#ip http authentication local

R1(config)#username admin priv 15 password ciscosec

Run CCP on PC_A host, Select/Manage Community window pops up where you enter R1 IP, user name and password. For lab environment live "Connect Securely" check box unchecked.


Managing CCP Router Information 


Click OK and then Discover button. In a few seconds Discovery Status changes it's value to Discovered. Click Discovery Details. The result seen should be similar to picture below.

Discovery Details

Don't forget to save R1 configuration using copy r s command also save project data within GNS3. Use snapshots to establish "recovery point" in topology configuration.

I don't expect problems with CCP if all guidelines from CCP Release Notes have been followed.

Don't forget to install PuTTY SSH and Tftpd32 to the PC_A and PC_C hosts.
Create iso dvd image with all optional software needed for virtual hosts and store it in a place where it is easily accessible.  Then just mount it to the host cd drive for installation.

Complete topology placing R2 and R3 routers create connection to PC_C via S3 in the same way PC_A is connected.

Topology is ready for use when all these changes are implemented.

Part 1. Basic Router Configuration

Note: There is no way to specify which DCE or DTE cable is connected to the router in GNS3. Therefore clock rate command doesn't affect configuration. In fact both ends of serial link appear as DCE:

R1(config)#int s1/0
R1(config-if)#clock rate 128000
R1(config-if)#^Z
R1#sh controllers s1/0
...

line state: up
cable type : V.11 (X.21) DCE cable, received clockrate 128000
...


R2#sh controllers s1/0
...

cable type : V.11 (X.21) DCE cable, received clockrate 2015232
...


Configure static routing on routers

It can be done in the following way:

R1#sh run | include ip route
ip route 0.0.0.0 0.0.0.0 Serial1/0
R1#sh ip route
...
Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     10.0.0.0/30 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Serial1/0
C    192.168.1.0/24 is directly connected, FastEthernet0/1
S*   0.0.0.0/0 is directly connected, Serial1/0


R2#sh run | include ip route
ip route 192.168.1.0 255.255.255.0 Serial1/0
ip route 192.168.3.0 255.255.255.0 Serial1/1
R2#sh ip route
...
Gateway of last resort is not set

     10.0.0.0/30 is subnetted, 2 subnets
C       10.2.2.0 is directly connected, Serial1/1
C       10.1.1.0 is directly connected, Serial1/0
S    192.168.1.0/24 is directly connected, Serial1/0
S    192.168.3.0/24 is directly connected, Serial1/1


R3#sh run | include ip route
ip route 0.0.0.0 0.0.0.0 Serial1/1
R3#sh ip route
...
Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     10.0.0.0/30 is subnetted, 1 subnets
C       10.2.2.0 is directly connected, Serial1/1
C    192.168.3.0/24 is directly connected, FastEthernet0/1
S*   0.0.0.0/0 is directly connected, Serial1/1


Verify static routes with ping. You should be able to ping PC_C from PC_A.

Create topology Snap Shot at this point.

Check video showing Lab at work


No comments:

Post a Comment