[CCNA Security v2] 2.6.1.3 Packet Tracer - Configure Cisco Routers for Syslog, NTP, and SSH Operations



Packet Tracer - Configure Cisco Routers for Syslog, NTP, and SSH Operations
Addressing Table


Objectives

·         Configure OSPF MD5 authentication.
·         Configure NTP.
·         Configure routers to log messages to the syslog server.
·         Configure R3 to support SSH connections.
Background / Scenario

In this activity, you will configure OSPF MD5 authentication for secure routing updates.

The NTP Server is the master NTP server in this activity. You will configure authentication on the NTP server and the routers. You will configure the routers to allow the software clock to be synchronized by NTP to the time server. Also, you will configure the routers to periodically update the hardware clock with the time learned from NTP.

The Syslog Server will provide message logging in this activity. You will configure the routers to identify the remote host (Syslog server) that will receive logging messages.

You will need to configure timestamp service for logging on the routers. Displaying the correct time and date in Syslog messages is vital when using Syslog to monitor a network.

You will configure R3 to be managed securely using SSH instead of Telnet. The servers have been pre-configured for NTP and Syslog services respectively. NTP will not require authentication. The routers have been pre-configured with the following passwords:

·         Enable password: ciscoenpa55
·         Password for vty lines: ciscovtypa55
Note: Note: MD5 is the strongest encryption supported in the version of Packet Tracer used to develop this activity (v6.2). Although MD5 has known vulnerabilities, you should use the encryption that meets the security requirements of your organization. In this activity, the security requirement specifies MD5.

Part 1: Configure OSPF MD5 Authentication
Step 1: Test connectivity. All devices should be able to ping all other IP addresses.

Step 2: Configure OSPF MD5 authentication for all the routers in area 0.

Configure OSPF MD5 authentication for all the routers in area 0.

R1(config)# router ospf 1
R1(config-router)# area 0 authentication message-digest

Step 3: Configure the MD5 key for all the routers in area 0.

Configure an MD5 key on the serial interfaces on R1, R2 and R3. Use the password MD5pa55 for key 1.

R1(config)# interface s0/0/0
R1(config-if)# ip ospf message-digest-key 1 md5 MD5pa55

Step 4: Verify configurations.

a.     Verify the MD5 authentication configurations using the commands show ip ospf interface.

b.     Verify end-to-end connectivity.

Part 2: Configure NTP
Step 1: Enable NTP authentication on PC-A.

a.     On PC-A, click NTP under the Services tab to verify NTP service is enabled.

b.     To configure NTP authentication, click Enable under Authentication. Use key 1 and password NTPpa55 for authentication.

Step 2: Configure R1, R2, and R3 as NTP clients.

Verify client configuration using the command show ntp status.

Step 3: Configure routers to update hardware clock.

Configure R1, R2, and R3 to periodically update the hardware clock with the time learned from NTP.

Exit global configuration and verify that the hardware clock was updated using the command show clock.

Step 4: Configure NTP authentication on the routers.

Configure NTP authentication on R1, R2, and R3 using key 1 and password NTPpa55.

R1(config)# ntp authenticate
R1(config)# ntp trusted-key 1
R1(config)# ntp authentication-key 1 md5 NTPpa55

Step 5: Configure routers to timestamp log messages.

Configure timestamp service for logging on the routers.

Part 3: Configure Routers to Log Messages to the Syslog Server
Step 1: Configure the routers to identify the remote host (Syslog Server) that will receive logging messages.

The router console will display a message that logging has started.

Step 2: Verify logging configuration.

Use the command show logging to verify logging has been enabled.

Step 3: Examine logs of the Syslog Server.

From the Services tab of the Syslog Server’s dialogue box, select the Syslog services button. Observe the logging messages received from the routers.

Note: Log messages can be generated on the server by executing commands on the router. For example, entering and exiting global configuration mode will generate an informational configuration message. You may need to click a different service and then click Syslog again to refresh the message display.

Part 4: Configure R3 to Support SSH Connections
Step 1: Configure a domain name.

Configure a domain name of ccnasecurity.com on R3.

Step 2: Configure users for login to the SSH server on R3.

Create a user ID of SSHadmin with the highest possible privilege level and a secret password of ciscosshpa55.

R3(config)# username SSHadmin privilege 15 secret ciscosshpa55
Step 3: Configure the incoming vty lines on R3.

Use the local user accounts for mandatory login and validation. Accept only SSH connections.

Step 4: Erase existing key pairs on R3.

Any existing RSA key pairs should be erased on the router.

Note: If no keys exist, you might receive this message: % No Signature RSA Keys found in configuration.

Step 5: Generate the RSA encryption key pair for R3.

The router uses the RSA key pair for authentication and encryption of transmitted SSH data. Configure the RSA keys with a modulus of 1024. The default is 512, and the range is from 360 to 2048.

R3(config)# crypto key generate rsa
The name for the keys will be: R3.ccnasecurity.com
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
Note: The command to generate RSA encryption key pairs for R3 in Packet Tracer differs from those used in the lab.

Step 6: Verify the SSH configuration.

Use the show ip ssh command to see the current settings. Verify that the authentication timeout and retries are at their default values of 120 and 3.

Step 7: Configure SSH timeouts and authentication parameters.

The default SSH timeouts and authentication parameters can be altered to be more restrictive. Set the timeout to 90 seconds, the number of authentication retries to 2, and the version to 2.

Issue the show ip ssh command again to confirm that the values have been changed.

Step 8: Attempt to connect to R3 via Telnet from PC-C.

Open the Desktop of PC-C. Select the Command Prompt icon. From PC-C, enter the command to connect to R3 via Telnet.

PC> telnet 192.168.3.1
This connection should fail because R3 has been configured to accept only SSH connections on the virtual terminal lines.

Step 9: Connect to R3 using SSH on PC-C.

Open the Desktop of PC-C. Select the Command Prompt icon. From PC-C, enter the command to connect to R3 via SSH. When prompted for the password, enter the password configured for the administrator ciscosshpa55.

PC> ssh –l SSHadmin 192.168.3.1
Step 10: Connect to R3 using SSH on R2.

To troubleshoot and maintain R3, the administrator at the ISP must use SSH to access the router CLI. From the CLI of R2, enter the command to connect to R3 via SSH version 2 using the SSHadmin user account. When prompted for the password, enter the password configured for the administrator: ciscosshpa55.

R2# ssh –v 2 –l SSHadmin 10.2.2.1
Step 11: Check results.

Your completion percentage should be 100%. Click Check Results to view the feedback and verification of which required components have been completed.


Configuration R1:
Password: ciscoenpa55

enable
configure terminal
router ospf 1
 area 0 authentication message-digest
 exit
!
interface s0/0/0
 ip ospf message-digest-key 1 md5 MD5pa55
 exit
!
ntp authenticate
ntp trusted-key 1
ntp authentication-key 1 md5 NTPpa55
ntp update-calendar
ntp server 192.168.1.5
!
service timestamps log datetime msec
!
logging hot 192.168.1.6
!

Configuration R2: 

enable
configure terminal
router ospf 1
 area 0 authentication message-digest
 exit
!
interface s0/0/0
 ip ospf message-digest-key 1 md5 MD5pa55
 exit
!
interface s0/0/1
 ip ospf message-digest-key 1 md5 MD5pa55
 exit
!
ntp authenticate
ntp trusted-key 1
ntp authentication-key 1 md5 NTPpa55
ntp update-calendar
ntp server 192.168.1.5
!
service timestamps log datetime msec
!
logging hot 192.168.1.6
!

Configuration R3:

enable
configure terminal
router ospf 1
 area 0 authentication message-digest
 exit
!
interface s0/0/1
 ip ospf message-digest-key 1 md5 MD5pa55
 exit
!
ntp authenticate
ntp trusted-key 1
ntp authentication-key 1 md5 NTPpa55
ntp update-calendar
ntp server 192.168.1.5
!
service timestamps log datetime msec
!
logging hot 192.168.1.6
!
ip domain-name ccnasecurity.com
username SSHadmin privilege 15 secret ciscosshpa55
crypto key zeroize rsa
crypto key generate rsa
1024
ip ssh version 2
ip ssh authentication-retries 2
ip ssh time-out 90
!
line vty 0 15
 login local
 transport input ssh
!


Configuration NTP Server: 




Configuration Syslog Server: 


Nhận xét

Đăng nhận xét

Bài đăng phổ biến từ blog này

[CCNAv6 S2] 2.2.2.4 Packet Tracer - Configuring IPv4 Static and Default Routes

Hình ảnh
Packet Tracer - Configuring IPv4 Static and Default Routes Addressing Table Objectives Part 1: Examine the Network and Evaluate the Need for Static Routing Part 2: Configure Static and Default Routes Part 3: Verify Connectivity Background In this activity, you will configure static and default routes. A static route is a route that is entered manually by the network administrator to create a reliable and safe route. There are four different static routes that are used in this activity: a recursive static route, a directly attached static route, a fully specified static route, and a default route. Part 1:     Examine the Network and Evaluate the Need for Static Routing a.     Looking at the topology diagram, how many networks are there in total? b.    How many networks are directly connected to R1, R2, and R3? c.     How many static routes are required by each router to reach networks that are not directly ...
Đọc thêm

[CCNAv6 S2] 8.3.1.2 Packet Tracer - Skills Integration Challenge

Hình ảnh
Packet Tracer – Skills Integration Challenge Addressing Table VLAN Port Assignments and DHCP Information Scenario In this culminating activity, you will configure VLANs, trunks, DHCP Server, DHCP relay agents, and configure a router as a DHCP client. Requirements Using the information in the tables above, implement the following requirements: ·         Create VLANs on S2 and assign VLANs to appropriate ports. Names are case-sensitive ·         Configure S2 ports for trunking. ·         Configure all non-trunk ports on S2 as access ports. ·         Configure R1 to route between VLANs. Subinterface names should match the VLAN number. ·         Configure R1 to act as a DHCP server for the VLANs attached to S2. -       Create a DHCP pool for each VLAN. Names are case-sensitive. -       Assign the ap...
Đọc thêm

[CCNAv6 S3] 7.2.3.5 Packet Tracer - Troubleshooting EIGRP for IPv4

Hình ảnh
Packet Tracer – Troubleshooting EIGRP for IPv4 Addressing Table Scenario In this activity, you will troubleshoot EIGRP neighbor issues. Use show commands to identify errors in the network configuration. Then, you will document the errors you discover and implement an appropriate solution. Finally, you will verify full end-to-end connectivity is restored. Troubleshooting Process 1.     Use testing commands to discover connectivity problems in the network and document the problem in the Documentation Table. 2.     Use verification commands to discover the source of the problem and devise an appropriate solution to implement. Document the proposed solution in the Documentation Table. 3.     Implement each solution one at a time and verify if the problem is resolved. Indicate the resolution status in the Documentation Table. 4.     If the problem is not resolved, it may be necessary to first remove the implemented solution befor...
Đọc thêm