Routing commands

Contents
Week 1 ................................................................................................................... 4
Part 1: Configure Basic Device Configuration on S1 ................................................. 4
Part 2: Configure SSH on R1 as a Secure Remote Access Method. ............................ 5
Step 1: Set the IP domain name and generate secure keys.................................... 5
Step 2: Create an SSH user and reconfigure the VTY lines for SSH-only access. ..... 5
Part 3: Configure IPv4 Addressing and Verify Connectivity ........................................ 6
Step 1: Assign IPv4 addresses to R1 and LAN devices. ......................................... 6
Step 2: Verify connectivity. PC1 and PC2 should be able to ping each other. .......... 7
Part 4: Configure IPv6 Addressing and Verify Connectivity ........................................ 8
Step 1: Assign IPv6 addresses to R1 and LAN devices. Referring to the Addressing
Table, configure IPv6 addressing for R1 LAN interfaces, PC-A and PC-B. ................ 8
Step 2: Verify connectivity. PC-A and PC-B should be able to ping each other. Page
2 of 2 ................................................................................................................ 8
Week 2 ................................................................................................................... 9
Part 1: Configure VLANs ........................................................................................ 9
Part 2: Assign Ports to VLANs ............................................................................... 10
Part 3: Configure Static Trunking .......................................................................... 11
Part 4: Configure End Devices with IP Addresses ................................................... 11
Part 5: Configure Router on a Stick VLAN .............................................................. 12
Week 3 ................................................................................................................. 14
Part 1: Build the Network and Configure Basic Device Settings............................... 14
Part 3: Configure and Verify a Stateless DHCPv6 server on R1 ................................ 15
Part 4: Configure a Stateful DHCPv6 server on R2 ................................................. 16
Part 5: Configure a DHCPv4 settings on R1 for both LANs ...................................... 16
week 4 .................................................................................................................. 18
Part 1: Configure Port Security ............................................................................. 18
Part 2: Verify Port Security ................................................................................... 19
week 6 .................................................................................................................. 21
Part 1: Configure IPv4 and IPv6 Addresses to Router Interfaces and Hosts .............. 21
Part 2: Configure IPv4 Static Routes on R1 and R2 ................................................. 22
Part 3: Configure IPv6 Static Routes on R1 and R2 ................................................. 22
Part 4: Configure IPv4 Default Route on R2 ........................................................... 23
Part 5: Configure IPv6 Default Route on R2 ........................................................... 23
 Week 1
Part 1: Configure Basic Device Configuration on S1
a. Disable DNS lookup

Switch> en

Switch# conf t

Switch (config)# no ip domain-lookup

b. Configure console password as “cisco” and encrypted privilege mode password

as “class”.

Switch (config)# line console 0

Switch (config-line)# password cisco

Switch (config-line)# login

Switch (config-line)# exit

Switch (config)# enable secret class

c. Configure vty lines password as “telnet”.

Switch (config)# line vty 0 4

Switch (config-line)# password telnet

Switch (config-line)# login

Switch (config-line)# exit

d. Show the current configuration and note that the passwords are in plain text.
Enter the command that encrypts plain text passwords: S1(config)# service
password-encryption

Switch# show running-config

Switch# conf t

Switch(config)# service password-encryption

 e. Verify that the passwords are encrypted.

Switch# show running-config

f. Configure banner motd “Authorized Users Only!”

Switch(config)# banner motd # ‘’Authorized Users Only!’’ #

Part 2: Configure SSH on R1 as a Secure Remote Access Method.

Step 1: Set the IP domain name and generate secure keys.
It is generally not safe to use Telnet, because data is transferred in plain text. Therefore,
use SSH whenever it is available.

a. Configure the domain name to be netacad.pka

Router> en

Router# conf t

Router(config)# hostname R1

R1 (config)# ip domain-name netacad.pka

b. Configure encrypted privilege mode password as “class”.

R1 (config)# enable secret class

c. Secure keys are needed to encrypt the data. Generate the RSA keys using a 1024
key length.

R1 (config)# crypto key generate rsa general-keys modulus 1024

Step 2: Create an SSH user and reconfigure the VTY lines for SSH-only
access.
a. Create an administrator user with cisco as the secret password.

R1 (config)# username administrator secret cisco

R1 (config)# line vty 0 4

R1 (config-line)# login local

R1 (config-line)# transport input ssh

Part 3: Configure IPv4 Addressing and Verify Connectivity

Step 1: Assign IPv4 addresses to R1 and LAN devices.

Referring to the Addressing Table, configure IPv4 addressing for R1 LAN interfaces, PC-A
and PC-B.

R1 (config)# interface gigabitethernet0/0

R1 (config-if)# ip address 192.168.1.1 255.255.255.0

R1 (config-if)# no shutdown

R1 (config-if)# ipv6 address 2001:db8:ACAD:A::1/64

R1 (config-if)# ipv6 address fe80::1 link-local

R1 (config-if)# exit

R1 (config)# interface gigabitethernet0/1

R1 (config-if)# ip address 192.168.2.1 255.255.255.0

R1 (config-if)# no shutdown

R1 (config-if)# ipv6 address 2001:db8:ACAD:B::1/64

R1 (config-if)# ipv6 address fe80::2 link-local

R1 (config-if)# exit

R1 (config)# ipv6 unicast-routing

R1 (config)# do wr

S1(config)# interface vlan 1

S1(config-if)# no shutdown

S1(config-if)# ip address 192.168.1.2 255.255.255.0

S1(config-if)# exit
S1(config)# ip default-gateway 192.168.1.1

S1(config)# do wr

Switch> en

Switch># conf t

Switch(config)# hostname S2

S2(config)# interface vlan 1

S2(config-if)# no shutdown

S2(config-if)# ip address 192.168.2.2 255.255.255.0

S2(config-if)# exit

S2(config)# ip default-gateway 192.168.2.1

S2(config)# do wr

(Configure PC-A and PC-B through the packet tracer interface (no need to use
commands)).

Step 2: Verify connectivity. PC1 and PC2 should be able to ping each other.
PC-A

C:\> ping 2001:db8:ACAD:B::10

C:\> ping 192.168.2.10

Verify telnet on switch 1:

C:\> telnet 192.168.1.2

Password:

Switch> en

Password:

Switch#
Verify ssh on router:

C:\> ssh -l administrator 192.168.1.1

Password:

R1>

R1> enable

Password:

R1#

Verify connectivity:

R1# show ip route

R1# show ipv6 route

R1# show ip interface brief

R1# show ipv6 interface brief

Part 4: Configure IPv6 Addressing and Verify Connectivity

Step 1: Assign IPv6 addresses to R1 and LAN devices. Referring to the
Addressing Table, configure IPv6 addressing for R1 LAN interfaces, PC-A
and PC-B.
Step 2: Verify connectivity. PC-A and PC-B should be able to ping each
other. Page 2 of 2

Did this in part 3.

 Week 2
Part 1: Configure VLANs
Configure VLANs on all three switches. Refer to the VLAN Table. Note that the VLAN
names must match the

values in the table exactly.

VLAN Number VLAN Name

101 Staff
102 Sales
103 IT

!!!!SW1!!!!!

Switch> en

Switch# conf t

Switch(config)# hostname SW1

SW1(config)# vlan 101

SW1(config-vlan)# name Staff

SW1(config-vlan)# vlan 102

SW1(config-vlan)#name Sales

SW1(config-vlan)#exit

SW1(config)# vlan 103

SW1(config-vlan)#name IT

SW1(config-vlan)# do sh history

(this should show you the last commands used from hostname to do sh history. Select
all the commands starting from vlan 101 and ending at name IT-> right click -> copy ->
now go to sw2 and sw3 -> en -> conf t -> change hostname ->and paste. (Good to also
do a “do wr” to save the configuration.))

After having done this type command (SW1# show vlan brief) to verify everything went
through correctly.

Tip : go to options -> preferences and select always show port labels in logical
workspace
Part 2: Assign Ports to VLANs
a. On SW2 and SW3, assign ports to the VLANs. Refer to the Addressing Table.
SW2(config)# interface fastEthernet 0/1

SW2(config-if)# switchport mode access

SW2(config-if)# switchport access vlan 101

SW2(config-if)# exit

SW2(config)# interface fa0/2

SW2(config-if)# switchport mode access

SW2(config-if)# switchport access vlan 102

SW2(config-if)# exit

SW2(config)# do sh history

Copy commands above and save to notepad

SW2(config)# interface fa0/3

SW2(config-if)# switchport mode access

SW2(config-if)# switchport access vlan 103

SW2(config-if)# exit

SW2(config)# do sh history

Copy paste new commands and add to notepad

Copy all notepad commands and paste in switch 3 starting from SW3(config)#

Use “show vlan brief” in e.g SW2# to verify VLAN status

!!Don’t forget to save with “do wr”!!

Part 3: Configure Static Trunking
a. Configure the link between SW1-SW2, SW1-SW3 and SW1-R1 as a static trunk.
Disable dynamic trunking on this port.

b. Disable DTP on the switch port on both ends of the trunk link.

A+B

A ) SW1(config)# interface range gigabitEthernet 0/1-2, fastEthernet 0/1

A) SW1(config-if-range)# switchport mode trunk
B) SW1(config-if-range)# switchport nonegotiate

SW2(config)# interface gigabitEthernet 0/1

SW2(config-if)# switchport mode trunk

SW2(config-if)# switchport nonegotiate

SW2(config-if)# exit

SW3(config}# interface gigabitEthernet 0/1

SW3(config-if)# switchport mode trunk

SW3(config-if)# switchport nonegotiate

SW3(config-if)# exit

To check e.g SW3# show interfaces trunk

!!Don’t forget to save with “do wr”!!

Part 4: Configure End Devices with IP Addresses

a. Configure PC’s with IP addresses, subnet mask and default gateways & ensure
that PC’s within the same VLAN can communicate with each other.

Add all Ip’s and default gateways from addressing table to pc’s
Part 5: Configure Router on a Stick VLAN
Configure the devices to meet the following requirements.

• Create sub-interfaces for VLANs on R1 and assign IP addresses based on the

Addressing Table.
• Verify that all PC’s can communicate with each other
• Copy the running configuration to the startup configuration.
Router> en

Router# conf t

Router(config)# hostname R1

R1(config)# interface gigabitEthernet 0/0

R1(config-if)# no shutdown

R1(config-if)# exit

R1(config)# interface gigabitEthernet 0/0.101

R1(config-subif)# encapsulation dot1Q 101

R1(config-subif)# ip address 192.168.101.1 255.255.255.0

R1(config-subif)# exit

R1(config)# interface gigabitEthernet 0/0.102

R1(config-subif)# encapsulation dot1Q 102

R1(config-subif)# ip address 192.168.102.1 255.255.255.0

R1(config-subif)# exit

R1(config)# interface gigabitEthernet 0/0.103

R1(config-subif)# encapsulation dot1Q 103

R1(config-subif)# ip address 192.168.103.1 255.255.255.0

R1(config-subif)# exit

To check R1# show ip interface brief

R1# copy running-config startup-config

R1# write

^^Use these 2 commands on the switches as well^^

Check by pinging pc4 from pc1 and pc2 from pc1
 Week 3

***************************************************************

***************************************************************

Part 1: Build the Network and Configure Basic Device Settings

***************************************************************

***************************************************************

hostname R1

interface gigabitEthernet 0/0

ip address 192.168.2.1 255.255.255.252

ipv6 address 2001:db8:abc:2::1/64

ipv6 address fe80::1 link-local

no shutdown

exit

interface gigabitEthernet 0/1

ip address 192.168.1.1 255.255.255.0

ipv6 address 2001:db8:abc:1::1/64

ipv6 address fe80::1 link-local

no shutdown

exit

ipv6 unicast-routing

hostname R2

interface gigabitEthernet 0/0

ip address 192.168.2.2 255.255.255.252

ipv6 address 2001:db8:abc:2::2/64

ipv6 address fe80::2 link-local

no shutdown

exit

interface gigabitEthernet 0/1

ip address 192.168.3.1 255.255.255.0

ipv6 address 2001:db8:abc:3::1/64

ipv6 address fe80::2 link-local

no shutdown

exit

ipv6 unicast-routing

***************************************************************

***************************************************************

Part 3: Configure and Verify a Stateless DHCPv6 server on R1

***************************************************************ipv6 nd other-
config-flag sets the "O" flag in Router Advertisements to notify IPv6 hosts that they need
to use DHCPv6 for additional configuration information. This could include DNS server
addresses or other network parameters.

***************************************************************

R1

ipv6 dhcp pool R1-Stateless

dns-server 2001:db8:acad::254

domain-name Stateless.com

exit

interface g0/1

ipv6 nd other-config-flag

ipv6 dhcp server R1-Stateless

exit
***************************************************************

***************************************************************

Part 4: Configure a Stateful DHCPv6 server on R2

***************************************************************when you use the
ipv6 nd managed-config-flag command, the RA messages will inform the hosts on the
network to use DHCPv6 for their full address configuration (IP address, prefix, etc.)
rather than autoconfiguring their address.

***************************************************************

R2

ipv6 dhcp pool R2-Stateful

address prefix 2001:db8:abc:3::/64

dns-server 2001:db8:abc:3::1

domain-name Stateful.com

exit

interface g0/1

ipv6 dhcp server R2-Stateful

ipv6 nd managed-config-flag

exit

***************************************************************

***************************************************************

Part 5: Configure a DHCPv4 settings on R1 for both LANs

***************************************************************The ip helper-
address command is primarily used for DHCP relay, allowing DHCP clients in one
subnet to reach DHCP servers in a different subnet by forwarding their broadcast
requests as unicast packets.

***************************************************************
R1

ip dhcp pool R1-LAN

network 192.168.1.0 255.255.255.0

default-router 192.168.1.1

dns-server 8.8.8.8

exit

ip dhcp excluded-address 192.168.1.1 192.168.1.10

ip dhcp pool R2-LAN

network 192.168.3.0 255.255.255.0

default-router 192.168.3.1

dns-server 8.8.8.8

exit

ip dhcp excluded-address 192.168.3.1 192.168.3.10

R2

interface GigabitEthernet0/1

ip helper-address 192.168.2.1

exit

***************************************************************

***************************************************************
 week 4

Objective

Part 1: Configure Port Security

Part 2: Verify Port Security

Background

In this activity, you will configure and verify port security on a switch. Port security
allows you to restrict a port’s ingress traffic by limiting the MAC addresses that are
allowed to send traffic into the port.

!Tip Options -> interface -> Check Always Show Port Labels in Logical Workspace.

Part 1: Configure Port Security

a. Access the command line for S1 and enable port security on Fast Ethernet ports
0/1 and 0/2.
S1> en

S1# conf t

S1 (config)# interface range fastEthernet 0/1-2 (interface range f0/1-2)

S1 (config-if-range)# switchport mode access (can’t use port-security if

interface is in dynamic mode)

S1 (config-if-range)# switchport port-security

b. Set the maximum so that only one device can access the Fast Ethernet ports 0/1
and 0/2.
S1 (config-if-range)# switchport port-security maximum 1

c. Secure the ports so that the MAC address of a device is dynamically learned and
added to the running configuration.
S1 (config-if-range)# switchport port-security mac-address sticky
 d. Set the violation mode so that the Fast Ethernet ports 0/1 and 0/2 are not
disabled when a violation occurs, but a notification of the security violation is
generated and packets from the unknown source are dropped.
S1 (config-if-range)# switchport port-security violation restrict

(index)

Protect: When a different mac address is used to access this port the port will drop
all packets coming through but it won’t log the security violation.

Restrict: When a different mac address is used to access this port the port the port
will drop all packets coming through and log the amount of security violations (1
ping is 1 violation).

Shutdown: When a different mac address is used to access this port the port will be
administratively shut down.

e. Disable all the remaining unused ports. Use the range keyword to apply this
configuration to all the ports simultaneously.
S1 (config)# interface range fastEthernet 0/3-24, gig0/2

S1 (config-if-range)# shutdown

S1 (config-if-range)# exit

S1 (config)# do wr (to save)

Part 2: Verify Port Security

a. From PC0, ping PC1.
Ping 192.168.1.3

b. Verify that port security is enabled and the MAC addresses of PC0 and PC1 were
added to the running configuration.
S1# show running config

c. Use port-security show commands to display configuration information.

S1# show port-security interface fastEthernet 0/1`
S1# show port-security interface fastEthernet 0/2
d. Attach Rogue Laptop to any unused switch port and notice that the link lights are
red.
Click on the lightning bolt on the bottom left then again on the lightning bolt just
to the right of the original one. Click on laptop then click on S1.

e. Enable the port and verify that Rogue Laptop can ping PC0 and PC1. After
verification, shut down the port connected to Rogue Laptop.
S1# conf t
S1 (config)# interface fastEthernet 0/3
S1 (config-if)# no shutdown
(verify connectivity)
S1 (config-if)# shutdown

f. Disconnect PC1 and connect Rogue Laptop to F0/2, which is the port to which
PC1 was originally connected. Verify that Rogue Laptop is unable to ping PC0.
Double click on the cable near pc1 and drag to laptop
Ping 192.168.1.2

g. Display the port security violations for the port to which Rogue Laptop is
connected.
S1# show port-security interface fastEthernet 0/2

h. Disconnect Rouge Laptop and reconnect PC1. Verify PC1 can ping PC0.
Double click on the cable near the laptop and drag back to pc1
Ping 192.168.1.2
 week 6

Instructions

Part 1: Configure IPv4 and IPv6 Addresses to Router Interfaces and

Hosts
a. Configure IPv4 and IPv6 addresses to routers based on the addressing table
Router> en
Router# conf t
Router(config) hostname R1
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ipv6 address 2001:ACAD:ABC:1::1/64
R1(config-if)# no shut
R1(config-if)# exit
R1(config)# interface gigabitEthernet 0/1
R1(config-if)# ip address 192.168.2.1 255.255.255.0
R1(config-if)# ipv6 address 2001:ACAD:ABC:2::1/64
R1(config-if)# no shut
R1(config-if)# exit
R1(config)# interface gigabitEthernet 0/2
R1(config-if)# ip address 192.168.5.1 255.255.255.0
R1(config-if)# ipv6 address 2001:ACAD:ABC:5::1/64
R1(config-if)# no shut
R1(config-if)# exit
R1(config)# ipv6 unicast-routing
R1(config)#exit
R1#wr

R2(config)# interface gigabitEthernet 0/0

R2(config-if)# ip address 192.168.3.1 255.255.255.0
R2(config-if)# ipv6 address 2001:ACAD:ABC:3::1/64
R2(config-if)# no shut
R2(config-if)# exit
R2(config)# interface gigabitEthernet 0/1
R2(config-if)# ip address 192.168.4.1 255.255.255.0
R2(config-if)# ipv6 address 2001:ACAD:ABC:4::1/64
R2(config-if)# no shut
 R2(config-if)# exit
R2(config)# interface gigabitEthernet 0/2
R2(config-if)# ip address 192.168.5.2 255.255.255.0
R2(config-if)# ipv6 address 2001:ACAD:ABC:5::2/64
R2(config-if)# no shut
R2(config-if)# exit
R2(config)# ipv6 unicast-routing
R2(config)#exit
R2#wr

b. Configure host devices with IPv4 and IPv6 addresses

Copy the ip address to the corresponding devices.

Part 2: Configure IPv4 Static Routes on R1 and R2

a. Configure IPv4 static routes on R1 for R2 LANs
R1(config)#ip route 192.168.3.0 255.255.255.0 192.168.5.2

R1(config)#ip route 192.168.4.0 255.255.255.0 192.168.5.2

R1(config)#exit

b. Configure IPv4 static routes on R2 for R1 LANs

R2(config)#ip route 192.168.1.0 255.255.255.0 192.168.5.1

R2(config)#ip route 192.168.2.0 255.255.255.0 192.168.5.1

R2(config)#exit

Part 3: Configure IPv6 Static Routes on R1 and R2

a. Configure IPv6 static routes on R1 for R2 LANs
R1(config)#ipv6 route 2001:ACAD:ABC:3::/64 2001:ACAD:ABC:5::2

R1(config)#ipv6 route 2001:ACAD:ABC:4::/64 2001:ACAD:ABC:5::2

 b. Configure IPv6 static routes on R2 for R1 LANs
R2(config)#ipv6 route 2001:ACAD:ABC:1::/64 2001:ACAD:ABC:5::1

R2(config)#ipv6 route 2001:ACAD:ABC:2::/64 2001:ACAD:ABC:5::1

Part 4: Configure IPv4 Default Route on R2

a. To test the default route functionality configure a Loopback1 interface on R1 with
IP address 1.1.1.1/32
R1(config)#interface loopback 1

R1(config-if)#ip address 1.1.1.1 255.255.255.255

b. Configure a default route on R2 that will point towards R1

R2(config)#ip route 0.0.0.0 0.0.0.0 192.168.5.1

Part 5: Configure IPv6 Default Route on R2

a. To test the IPv6 default route functionality configure a Loopback10 interface on
R1 with IP address 127::1/128
R1(config-if)#ipv6 address 127::1/128

b. Configure an IPv6 default route on R2 that will point towards R1

R2(config)#ipv6 route ::/0 2001:ACAD:ABC:5::1