I



Router configuration, Static and Dynamic Routing, Access control lists

In this lab you will learn: Time: 2 hrs

|Router Configuration |

|Static Routing |

|Access Control Lists |

|Dynamic Routing |

Required Reading

1. This handout.

2. Access lists

3. RIP

Part A: Cisco Router Configuration Time 40 min

Introduction:

Cisco routers are powered by the Cisco Internetwork Operating System(IOS) which allows the routers to be configured to perform specific tasks. Before you start configuration of a Cisco Router, you must understand the two EXEC modes available on a router: user EXEC mode and privileged EXEC mode. User mode allows you to perform basic trouble shooting tests, telnet to remote hosts, and list router system information. You know that the router is in this mode if the prompt is the router name followed by the greater than sign: RouterName>. Privileged mode, sometimes called “enable mode”, allows for full router configuration and advanced troubleshooting. “RouterName#” is an example of the privileged mode prompt. If you log into a router via a console or telnet connection, you enter user mode. Privileged mode requires that you issue the enable command.

Before you actually configure a Cisco router, you must understand the two main configuration modes: global configuration mode and interface configuration mode. You use global configuration mode to configure router settings that affect overall router operations. This is accomplished by the command configure after you are in the privileged mode. If you wish to configure a particular interface, you must use interface configuration mode. To enter this mode, you need to be in the global configuration mode. You then enter the interface command followed by the name and number of the interface you wish to enter. If the router is in global configuration mode, the prompt will be RouterName(config)# while in interface configuration mode it will be RouterName(config-if)#.

In this lab for each group, there will be one designated router and switch. It is the goal of this lab to accustom you with basic set up of a router.

You will be configuring the router so as to obtain this topology in the following diagram.

Lab Setup

1. One PC per group will be connected through the serial port to the router. One end of the crossover cable will be plugged into the console port of the router and the other will be connected to the COM1 port of the PC.

2. Each group has a switch and router along with cables (one for connecting the PC to the switch, one for connecting the switch to the router, and a crossover cable common to both groups for connecting the two routers together)

Task 1 - Use the program HyperTerminal to log on to the router.

1. Verify the router is turned off

2. Launch HyperTerminal at Start, Programs, Accessories, Communication, HyperTerminal. You will now need to configure HyperTerminal so that it communicates with the router out of COM1.

3. Type router For the Connection Description Name.

4. In the Connect To window the fourth field is titled "Connect Using:" Scroll down to select COM1,and then click OK

5. Confirm and change if necessary the following settings in the COM1 Properties window that pops up.

|Bits PerSecond: | 9600 |

|Data Bits: |8 |

|Parity: |None |

|Stop Bits: |1 |

|Flow Control: | Xon/Xoff |

6. Click OK. At the bottom left of the window, it should say "Connected" along an increasing time.

7. Turn on the router. Observe the boot-up procedure displaying in HyperTerminal. This lists information about the hardware, as well as the initial configuration. We will modify this configuration.

8. Note that there are two Ethernet interfaces at the back of the router. These interfaces should already each be currently assigned an IP address. You can see this by executing the command show interfaces.

You can type the ? command at any time to receive context sensitive help.

Task 2 – Reset router configuration

Because we are unsure of the validity of the current configuration, we need to erase it and configure it by ourselves. To erase the current configuration, we must be in Privileged Mode.

9. Type enable to enter Privileged Mode.

10. Type the password given on the chalkboard and press enter when prompt. The prompt should now end with #.

11. Type erase startup-config to clear the current configuration that resides on the router. (Note: Wait, it takes some time)

12. Confirm that you wish to erase nvram filesystem and wait till it completes

13. Type reload and confirm. This reboots the router and allows the changes to take effect. (Note: Wait, this also takes some time)

14. Type no if asked to save changes.

Task 3 –Configure the router

Once the router has finished booting up, you will be in the System Configuration Dialog

15. Type yes to enter.

16. Type no to skip the basic management setup.

17. Type yes to see the current interface summary.

18. Type in the name of your group for the host name(GroupA or GroupB)

19. Type in the password given on the chalkboard for the enable secret.

20. Type in the same password for the enable password. It will tell you not to use the same password, but it is okay, just type it in again.

21. Type in the same password for the virtual terminal password.

22. Type no to configuring the SNMP Network Management.

23. Type yes to configure IP.

24. Type no to IGRP and RIP routing, and bridging and configuring Async lines.

25. Type yes to configure the FastEthernet0/0 interface.

26. Type yes to use the RJ-45 connector.

27. Type yes to full duplex mode.

28. Type yes to configure IP on the interface.

29. Use the following table to answer the next question.

|Interface |Group A |Group B |Subnet Mask Address |

|FastEtherernet0/0 |192.168.0.1 |192.168.50.1 |255.255.255.0 |

|FastEthernet0/1 |192.168.100.1 |192.168.100.2 |255.255.255.0 |

30. Similarly configure the FastEthernet0/1 interface. Press Enter to save the newly created configuration.

31. Type show interfaces.

32. Verify that the IP addresses were correctly assigned.

33. Cable the host machines to the switch and cable the switch to the router via Ethernet cables. The switch should have a cable between it and the FastEthernet0/0 interface of the router.

34. Setup the host machines to have the required IP addresses as below and the correct gateway as below.

|Group A |IP Address |Subnet Mask Address |Gateway |

|Computer1 |192.168.0.2 |255.255.255.0 |192.168.0.1 |

|Computer2 |192.168.0.3 |255.255.255.0 |192.168.0.1 |

|Group B |IP Address |Subnet Mask Address |Gateway: |

|Computer1 |192.168.50.2 |255.255.255.0 |192.168.50.1 |

|Computer2 |192.168.50.3 |255.255.255.0 |192.168.50.1 |

One of the nice things about the Cisco IOS is that it does auto complete of commands, if you type a significant part of the command and press tab, the rest of the command will be added automatically. Another feature is the ability to abbreviate commands. Yet another and most useful feature is the ability to query for command syntax. For example if you don’t know what arguments are accepted for the show command, type show ? and a list of possible arguments is printed.

Part B: Static Routing Time 20 min

The remaining part of this lab is to connect the two routers of Groups A and B together so that Group A and B can communicate with each other. The remainder of router configuration will be done via the Ethernet interface of each host.

1. Click Start, choose Run, type telnet and click OK. A telnet session is now open.

2. Type open x where x is the IP address of the router interface that is connected to your switch. An example is for Computer1 of Group A typing open 192.168.0.1.

3. Type the password given on the board when prompted.

We will now set up a static routing table in each of the two routers. The idea is for the table to indicate that the other group's network can be reached via the 0/1 interfaces of both routers. To create a static entry in the routing table of the router, you must be in Configuration Mode.

4. Type enable to enter the configuration mode.

5. Type config terminal.

6. Using the command ip route, set up the static routing table.

The three values that this command takes is first the destination network and its subnet mask. These two values are then followed by the IP address of the next hop that can reach the destination network. As an example, Group A should issue the command: "ip route 192.168.50.0 255.255.255.0 192.168.100.2". ie. GroupA is setting up an entry to access GroupB 192.168.50.0 255.255.255.0 which we know can be accessed through the 0/1 interface of GroupB’s router.

7. By pinging a host from the other group, verify that the static routing table has been created, both groups should be able to communicate with each other.

8. From the Privileged Mode, type show ip route. (Post Lab 1)

9. Gaining information about the topology of our network. Tracert, short for traceroute, responds back with information on the route that was taken to the destination host, for example the number of hops between the two hosts. Type tracert on a host within your group's network, record the information that was returned. Now execute a tracert command on a host in the other group. Record this information. (Post Lab 2)

Part C: Access Lists Time 30 min

I. Introduction: Access list is one of the most important control mechanisms to control access to both internal and external network. Access lists are essentially permit or deny statements that filter traffic based on the source address, destination address, and protocol type of the packet. In this lab, you have a chance to setup a Cisco router access list from scratch.

Access-list format

access-list [list #] [permit | deny] [source address] [source wildcard mask] [source port] [destination wildcard] [destination port] [precedence precedence#] [tos tos] [log] [established]

where

[list #] : Standard IP access-lists are represented by a number in range 1-99

[permit | deny]: Either allow or deny access to certain source

[source address]: The IP address of the source

[source wildcard mask]: use to determine the significant number of bits of the source address

One of the most common problems with access list is lacking of planning. Since, access-list is accessed from top to bottom, therefore configuration and order of each entry must be very precise to work correctly.

Ex: The following access list is not correctly configured.

Access-list 1 deny any

Access-list 1 permit 168.243.32.0 0.0.0.255

Access-list 1 permit any

According to the access-list above, none of the computers on the network will be able to get access to the router because when a condition is satisfied by a rule in access-list. Router will NOT continue to check all remaining rules. Therefore, access list rules must appear in a logical order.

|Service |protocol |port |description |

|Ssh |tcp |22 |SSH-Remote Login Protocol |

|telnet |tcp |23 |Telnet |

|Smtp |tcp |25 |Simple Mail Transfer Protocol |

|Dns |udp |53 |Domain Name Server |

|Snmp |udp |161 |Simple Network Management Protocol |

|rip |udp |520 |Routing Information Protocol |

|http/www |tcp |80 |HyperText Transport Protocol (WWW) |

Task 1 – Reset Access List

1. Make sure you are in privileged mode.

2. Type configure terminal.

3. Type no access-list to delete any pre-existing access list.

4. Verify that router is able to communicate with both computers by using the ping command with the ip address of a machine in your group and one in the other group.

Task 2 – Create new Access List

Here you are going to configure the router so that one of the machines from the other group can talk with you, while the other is not.

5. Verify that there are no access lists using show access-lists

6. access-list 1 deny 192.168.50.3 (GroupB use 192.168.0.3)

7. access-list 1 permit 192.168.50.2 (GroupB use 192.168.0.2)

Task 3 – Applying Access List to Interfaces

8. Enter the interface configuration mode to configure the 0/0 interface. Type interface FastEthernet 0/0

9. Apply the above list(list 1) to the out side of the interface: ip access-group 1 out

10. Verify that the list has been entered, this time use the command show run.

11. To verify router correctly filtered packets from computer 1 to computer 2, use ping command from both host to verify.

Task 4 – More complicated Access Lists

Setup the following policy on the network:

1. PC1 has Telnet access disabled on both in and out.

2. Disable telnet access to and from machines with IP 128.83.144.xx (verify by telnet-ing to fettercairn)

3. Disable ftp access from and 128.83.120.xx. (verify by ftp-ing from lugh)

4. Disable web browsing from PC1.

5. Allow DNS, SSH, SNMP, SMTP and RIP.

6. Deny all other traffic to both internal and external network.

A sample access list.

! ----------------------- Begin blocked sites ------------------

! Sites we outright block.

! --------------------------------------------------------------

! engr.utexas.edu (128.83.43.245)

access-list 101 deny tcp 128.83.43.0 0.0.0.255 192.168.0.0 0.0.255.255

! bbc.co.uk 212.58.240.31

access-list 101 deny tcp 212.58.240.0 0.0.0.255 192.168.0.0 0.0.255.255

! 206.251.18.60 (don’t let pc1 access it)

access-list 101 deny tcp host 192.168.0.2 host 206.251.18.60

! ----------------------- End blocked sites ------------------

! Begin port filtering. TCP

!

! TCP ports to allow. To be secure, you should allow services

! to as FEW hosts as possible, and those hosts should have

! a VERY thorough security policy.

!

! Allow established tcp connections

!

access-list 101 permit tcp any any established

! Everything not explicity permitted below 1024 is denied

! 20 - ftp-data

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq ftp-data

! 21 - ftp

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq ftp

! 23 - telnet

! We don't allow telnet into our network.

! 25 - smtp

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq smtp

! 53 - DNS (TCP and UDP)

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq domain

! 79 - finger

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq finger

! 80 - www

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq www

! 517 - talk

access-list 101 permit tcp any 192.168.0.0 0.0.255.255 eq talk

! ----------------------------------------------------------------

!

! Block ports above 1023 which we don't want people to get to

access-list 101 deny tcp any 192.168.0.0 0.0.255.255 gt 1023

! ----------------------------------------------------------------

! All ICMP allowed. Many sites do not allow ICMP

! at all, and DENY all ICMP. It will cause services

! such as "traceroute" to be unusable, however.

!

access-list 101 permit icmp any any

! ------------------------ End Access Lists ---------------------

Part C: Dynamic Routing using RIP Time 30 min

Task 1 – Set up RIP

Set up RIP on each of the routers.

1. Copy paste the routing table to a Notepad window.

2. Delete all routing table entries using clear ip route all

3. Use the command router rip to set up RIP. As an example, if a router has interfaces connected to the networks 172.198.20.0 and 192.89.7.0. The following configuration shows how to set up a RIP process in the router.

router rip

network 172.198.20.0

network 192.89.7.0

4. (Which mode should you be to run the above command?) Change modes if necessary.

5. ping the other group. (is the ping successful? It shouldn’t be! Why? )

Task 2 – Observe RIP

6. Copy paste the routing table to the Notepad window. (Postlab 5)

7. See it happen! View the routing tables being sent and received with: debug ip rip

8. Don’t forget to do this command when you are done: undebug all

Post Lab(To be submitted in class on )

1. List the entries in the static routing table and explain.

2. What were the outputs you obtained for the two traceroutes. Explain the path.

3. Describe the usage and rules of access lists.

4. Turn in a hard copy of the access control list that you created.

5. Describe what happened.

6. At the end of the lab, copy paste the output from show running-config, show ip protocol and show ip interfaces commands. Briefly explain.

7. Here is a list of commands you have used. Write a sentence about each.

• enable

• reload

• show interfaces

• ip route

• config terminal

• ip access-group 1 out

• router rip

• show running-config

• show ip interfaces

-----------------------

GroupB

GroupA

PC4

RouterB

RouterA

SwitchB

SwitchA

PC3

PC2

PC1

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download