Cisco | Networking Academy* PT Activity: Configure a Network for Secure Operation Topology Diagram irewal Server caret Ca Cop Sins, NTP Sewer SydoaServer SH Client 192.168,1.5 192,168.16 192,108.35, Addressing Table DI eo cr Rt FAO! 192,168.1.1_ 255.255.255.0__| NIA St FAOIS ‘SO/OIO (DCE) | 10.4.4.1 255.255.255.252 | NIA NIA R2__| S010 10442 255.255.255.252 | NIA NA SOOM (DCE) | 10.222 255.255.255.252 _| NIA NA R3___ FAO 192.168.3.1 _255.255.255.0 | NIA 53 FAOIS SOMO T0224 255.255 255.252 | NIA NA PCA NIC 192,168.15 255.255.255.0 | 192,168.11 St FAO PCB NIC 192,168.16 | 265.255.2550 | 192,168.11 $2 FAQS Po-c [NIC 192.168.3.5 | 255.256.255.0 _|192.168.3.1 ‘53 FAOI6 ‘Acontnts ee Copyight © 1992-2008 Cisco Stans, ne. A ghis reared. This document i lace Publ earmaton, Page 1017CCNA Security Learning Objectives Secure the routers with strong passwords, password encryption and a login banner, Secure the console and VT lines with passwords. Configure local AAA authentication. Configure SSH server. Configure router for syslog. Configure router for NTP. ‘Secure the router against login attacks. Configure CBAC and ZPF firewalls. * Secure network switches, Introduction In this comprehensive practice activity, you will apply a combination of security measures that were introduced in the course. These measures are listed in the objectives. In the topology, R1 is the edge outer for the Company A while R3 is the edge router for Company B. These networks are interconnected via the R2 router which represents the ISP. You will configure various security features on the routers and switches for Company A and Company B. Not all security features will be ‘configured on Rt and R3, ‘The following preconfigurations have been made: © Hostnames on all devices © IP addresses on all devices © R2 console password: ciscoconpaSS © R2 password on VTY lines: ciscovtypa55 © R2 enable password: ciscoenpa5s © Static routing © Syslog services on PC-B © DNS lookup has been disabled © IP default gateways for all switches Task 1: Test Connectivity and Verify Configurations Step 1. Verify IP addresses. Step 2. Verify routing tables. Step 3. Test connectivity. From PC-A, ping PC-C at IP address 192.168.3.5. Task 2: Secure the Routers Step 1. Set minimum a password length of 10 characters on router R1 and R3. Step 2. Configure an enable secret password on router R1 and R3. Use an enable secret password of ciscoenpas5. ‘Acorn re Conyght © 1952-2008 Caco Stas, ne, Alighsraarvad The document is Caco Publi foto, Page 2017CCNA Security Step 3. Encrypt plaintext passwords. Step 4. Configure the console lines on R1 and R3. Configure a console password of ciscoconpaSS and enable login. Set the exec-timeout to log out after 5 minutes of inactivity. Prevent console messages from interrupting command entry. Step 5. Configure vty lines on Rt Configure a viy line password of ciscovtypaS5 and enable login. Set the exec-timeout to log out after 5 minutes of inactivity. Set the login authentication to use the default AAA list to be defined later. Note: The vty ines on R3 will be configured for SSH in a later task. Step 6. Configure login banner on R1 and R3. Configure a waming to unauthorized users with a message-of-the-day (MOTD) banner that says: ‘No Unauthorized Aecess!”. Task 3: Configure Local Authentication on R1 and R3 ‘Step 1. Configure the local user database. Create a local user account of Admin01 with a secret password of Admin01 pass. Step 2. Enable AAA services. Step 3. Implement AAA services using the local database. Create the default login authentication method list using local authentication with no backup method. Task 4: Configure NTP Step 1. Enable NTP authentication on PC-A. ‘On PC-A, choose the Config tab, and then the NTP button. Select On for NTP service. Enable authentication and enter a Key of 1 and a password of ciscontppass, Step 1. Configure R1 as an NTP Client. Configure NTP authentication Key 1 with a password of clscontppaSS. Configure R1 to synchronize with the NTP server and authenticate using Key 1 Step 2. Configure routers to update hardware clock. Configure routers to periodically update the hardware clock with the time learned from NTP. Task 5: Configure R1 as Syslog Client Step 1. Configure R1 to timestamp log messages. Configure timestamp service for logging on the routers, Step 2. Configure R1 to log messages to the syslog server. Configure the routers to identify the remote host (syslog server) that will receive logging messages. You should see a console message simiar to the following: SINGHOST_; = CLI initiated ARISTOP: Logging to host 192.168.1.6 port 514 ‘Acorn re Conyght © 1952-2008 Caco Stas, ne, Alighsraarvad The document is Caco Publi foto, Page 3017CCNA Security Step 3. Check for syslog messages on PC-B. ‘On R1, exit config mode to generate a syslog message. Open the syslog server on PC-B to view the message sent from R1. You should see a message similar to the following on the syslog server: ‘om console by console Task 6: Secure Router Against Login Attacks Step 1. Log unsuccessful login attempts to R1. Step 2. Telnet to R1 from PC-A. Telnet from PC-A to R1 and provide the username Admin01 and password Admin01paS5. The Telnet should be successful Step 3. Telnet to R1 from PC-A and check syslog messages on the syslog server. Exit from the current Telnet session and Telnet again to R1 using the username of baduser and any password, Check the syslog server on PC-B, You should see an error message similar to the following that is generated by the failed login attempt. SEC_LOGIN~4-LOGIN_FAL loGalpert:23] [Réa: in failed (user:baduser] [Source:192.168.1.5 @ login] at 15:01:23 UPC wed June 17 2009 Task 7: Configure SSH on R3 Step 1. Configure a domain name. Configure a domain name of ccnasecurity.com on R3. Step 2. Configure the incoming vty lines on R3. Use the local user accounts for mandatory login and validation and accept only SSH connections. ‘Step 3. Configure RSA encryption key pair for R3. Any existing RSA key pairs should be erased on the router. If there are no keys currently configured a message will be displayed indicating this. Configure the RSA keys with a modulus of 1024, Step 4. Configure SSH timeouts and authentication parameters. ‘Set the SSH timeout to 90 seconds, the number of authentication retries to 2, and the version to 2. Task 8: Configure CBAC on R1 Step 1. Configure a named IP ACL. Create an IP ACL named OUT-IN to block all trafic originating from the outside network, Apply the access list to incoming trafic on interface Serial 0/0/0. Step 2. Step 3. Confirm that traffic entering interface Serial 0/0/0 is dropped. From the PC-A command prompt, ping PC-C. The ICMP echo replies are blocked by the ACL. ‘Step 3. Create an inspection rule to inspect ICMP, Telnet and HTTP traffic. Create an inspection rule named IN-OUTAN to inspect ICMP, Telnet and HTTP traffic Step 4, Apply the inspect rule to the outside interface, Apply the IN-OUT-IN inspection rule to the interface where traffic exits to outside networks. ‘Acorn re Conyght © 1952-2008 Caco Stas, ne, Alighsraarvad The document is Caco Publi foto, Page aot?CCNA Security Step 5. Test operation of the inspection rule. From the PC-A command prompt, ping PC-C. The ICMP echo replies should be inspected and allowed through. Task 9: Configure ZPF on R3 ity. Verify that the intemal host can access external resources. Step 1. Test conner * From PC-C, test connectivity with ping and Telnet to R2; all should be successful © From R2 ping to PC-C. The pings should be allowed. Step 2. Create the firewall zones. Create an internal zone named IN-ZONE. Create an external zone named QUT-ZONE. Step 3. Create an ACL that defines internal traffic. Create an extended, numbered ACL that permits all IP protocols from the 192.168.3.0/24 source network to any destination, Use 101 for the ACL number. Step 4, Create a class map referencing the internal traffic ACL. Create a class map named IN-NET-CLASS-MAP to match ACL 101 Step 5. Specify firewall policies. Create a policy map named IN-2-OUT-PMAP to determine what to do with matched traffic. Specify a class type of inspect and reference class map IN-NET-CLASS-MAP. Specify the action of inspect for this policy map You should see the following console message: 8No specific protocol configured in class IN-NET-CLA’ All protocols will be inspected.” MAP for inspection. Exit to the global config prompt, Step 6. Apply firewall policies. Create a zone pair named IN-2-OUT-ZPAIR. Specify the source and destination zones that were created earlier. ‘Attach a policy map and actions to the zone pair referencing the policy map previously created, IN-2-OUT- PMAP. Exit to the global config prompt and assign the intemal and external interfaces to the security zones, Step 7. Test firewall functionality. Verify that the intemal host can still access external resources. * From PC-C, test connectivity with ping and Telnet to R2; all should be successful * From R2 ping to PC-C. The pings should now be blocked. ‘Acorn re Conyght © 1952-2008 Caco Stas, ne, Alighsraarvad The document is Caco Publi foto, Page sot?CCNA Security Task 10: Secure the Switches Step 1. Configure an enable secret password on all switches. Use an enable secret password of clscoenpaS5. Step 2. Encrypt plaintext passwords. Step 3. Configure the console lines on all switches. Configure a console password of ciscoconpass and enable login. Set the exec-timeout to log out after § minutes of inactivity. Prevent console messages from interrupting command entry. Step 4. Configure vty lines on all switches. Configure a vty line password of ciscovtypaS5 and enable login. Set the exec-timeout to log out after 5 minutes of inactivity. Set the basic login parameter. Step 5. Secure trunk ports on S1 and S2. Configure port Fa0/1 on $1 as a trunk port. Configure port Fa0/1 on $2 as a trunk port. Verify that S1 port Fa0/1 is in trunking mode. Set the native VLAN on S1 and $2 trunk ports to an unused VLAN 99, Set the trunk ports on $1 and S2 so that they do not negotiate by turing off the generation of DTP frames. Enable storm control for broadcasts on the $1 and S2 trunk ports with a 50 percent rising suppression level. Step 6. Secure access ports. Disable trunking on S1, S2 and $3 access ports Enable PorlFast on $1, S2, and $3 access port. Enable BPDU guard on the switch ports previously configured as access only. Enable basic default port security on all end-user access ports that are in use. Use the sticky option. Re-enable ‘each access port to which port security was applied Disable any ports not being used on each switch, Task 11: Verification Step 1. Test SSH configuration. Attempt to connect to R3 via Telnet from PC-C. From PC-C, enter the command to connect to R3 via Telnet at IP address 192.168,3.1 This connection should fail, since R3 has been configured to accept only SSH connections on the virtual terminal lines. From PC-C, enter the ssh -1 Admin01 192.168.3.1 command to connect to R3 via SSH. When prompted for the password, enter the password Admin01 paS5 configured for the local administrator. Use the show ip ssh command to see the configured settings. ‘Acontant re Conyght © 1982-2008 Caco Stas, ne, Alighsraarvad The documents Caco Publi fom, Page sot?CCNA Security Step 2. Verify timestamps, NTP status for R1 and PC-A. Step 3. Test CBAC firewall on R1. © Ping from PC-A to R2 at 10,2.2.2 (should succeed) © Telnet from PC-A to R2 10.2.2.2 (should succeed) Ping from R2 to PC-A at 192.168.1.3 (should fail) Stop 4. Test ZPF firewall on R3. © Ping from PC-C to R2 at 10.2.2.2 (should succeed) © Telnet from PC-C to R2 at 10.2.2.2 (should succeed) Ping from R2 to PC-C at 192.168.3.5 (should fail) © Telnet from R2 to R3 at 10.2.2.1 (should fall — only SSH is allowed) Step 5. Verify port security. ‘On S2, use the show run command to confirm that $2 has added a sticky MAC address for Fa0/18, This should be the MAC address of PC-B, Record the MAC address for later use, Select PC-B. Go to the Config tab. Select FastEthernet under the Interface section. Edit the MAC address field This should cause a port security violation and S2 should shut down port Fa0/18. Use the show interface Fa0/18 command to view the status of the port. The port should be in the err- disabled state. On PC-B, go to the Config tab, Select FastEthernet under the Interface section, Change the MAC address to another address. From interface configuration mode on switch S2 for Fa0/18, use the no switchport port-security mac- address sticky address command to remove the original PC-B leamed address, ‘Shutdown and then re-enable the Fa0/18 interface. ‘On S2, use the show run command to confirm that the port comes up and that the new MAC address has been learned, Note: If it is desired to reconnect the PC with the original MAC address, you can simply change the MAC address on the PC back to the original one and issue the shutdown and no shut down commands on port Fa0/18. If the PC or a NIC is being replaced and will have a new MAC address, you must first remove the old leamed address, Step 6. Check results. ‘Your completion percentage should be 100%. Click Check Results to see feedback and verification of which required components have been completed. ‘Acontant re Conyght © 1982-2008 Caco Stas, ne, Alighsraarvad The documents Caco Publi fom, Page 7017