CIS-467-Lab-22
Lab Tasks:
1. Configure all routers, switches, and servers with the hostnames, connections, and IP addressing
depicted in the diagram.
a. R2 and R3 will act as the default gateway for the workstation and server segments.
b. Ensure that VLAN’s are used on SW-2 and SW-3 per the diagram.
2. Configure a static default route to the ISP router on R1.
3. Configure static routing for the following on the ISP router:
a. Configure a static route for the workstation network on the ISP router.
b. Configure a static route for the backbone transport network on the ISP router.
4. Configure OSPF connectivity between R1, R2, and R3 using the parameters depicted in the
topology.
a. All routed interfaces (except the ISP segment) should be members of Area 0.
b. R1 should originate a default route for all other routers.
c. Ensure you have full, 100% connectivity between ALL routed networks. Full connectivity
is validated when pings from the ISP router are successful to the following IP addresses:
i. 201.68.109.130 (R2 Outside)
ii. 201.68.109.131 (R3 Outside)
iii. 192.168.84.1 (R2 Inside)
iv. 172.21.35.1 (R3 Inside)
5. On R1 configure and apply an access control list that will prevent all sources from RFC 1918
networks from being sent out to the Internet.
6. Setup static NAT on R1 with the following translations:
a. 192.168.84.45 – 201.68.109.145
b. 192.168.84.53 – 201.68.109.153
c. 192.168.84.74 – 201.68.109.174
d. 192.168.84.80 – 201.68.109.180
7. Setup PAT on R1. Create the PAT entry so that the workstation subnet (172.21.35.0/24) is
translated out as R1’s external interface (201.68.109.98).
8. Configure R3 as a DHCP server with a DHCP pool of 172.21.35.0/24. Ensure clients receive the
correct default gateway for the network, and use the AD server for DNS. Exclude addresses
172.21.35.1 – 172.21.35.25 from being assigned by DHCP.
9. Create and apply an access control list on R1 using the information below. (Remember you used
NAT previously!!!)
a. Allow SMTP from the Internet to Mail.
b. Allow HTTP and HTTPS from the Internet to WWW and File.
c. Allow DNS requests from the Internet to AD.
d. Deny and log all other requests from the Internet to every server.
10. Create and apply access control lists on R3 using the information below.
a. Allow hosts on the workstation network to access LDAP, Kerberos, and RPC services on
AD.
b. Block and log workstation hosts from accessing File and WWW via SSH. Allow and log all
other requests from workstations.
c. Block and log all requests to workstation hosts using the Remote Desktop protocol.
d. Ensure all other services are allowed into the workstation network.
11. Setup AAA on R1, R2, and R3 so that users are authenticated by the active directory / ACS
server (192.168.84.53) for all local and remote management connections. Use Cisco123 as your
RADIUS key. Only permit SSH connections from the server network segment on each router.
Enable SSH and disable all other remote management services.
Once you have completed the lab, save it in softcopy, (the configuration files OR the packet tracer file).
Upload your file(s) to Blackboard.
Configuration R2:
enable
configure terminal
hostname R2
aaa new-model
aaa authentication login default group radius local
username Cisco123 secret 123
!
ip ssh version 2
ip ssh authentication-retries 2
ip ssh time-out 60
ip domain-name CCNASecurity.com
!
interface GigabitEthernet0/0
ip address 201.68.109.130 255.255.255.128
no shutdown
!
interface GigabitEthernet0/1
ip address 192.168.84.1 255.255.255.0
no shutdown
!
router eigrp 25
network 192.168.84.0
no auto-summary
!
router ospf 100
log-adjacency-changes
passive-interface GigabitEthernet0/1
network 201.68.109.128 0.0.0.127 area 0
!
radius-server host 192.168.84.53 auth-port 1812
radius-server key Cisco123
!
line vty 0 4
login authentication default
transport input ssh
!
end
Configuration ISP:
enable
configure terminal
hostname ISP
interface GigabitEthernet0/1
ip address 201.68.109.97 255.255.255.252
ip route 172.21.35.0 255.255.255.0 201.68.109.98
ip route 192.168.84.0 255.255.255.0 201.68.109.98
ip route 209.68.109.128 255.255.255.128 201.68.109.98
!
Configuration R1:
enable
configure terminal
hostname R1
!
aaa new-model
!
aaa authentication login default group radius local
!
username Cisco123 secret 123
!
ip ssh version 2
ip ssh authentication-retries 2
ip ssh time-out 60
ip domain-name CCNASecurity.com
!
interface GigabitEthernet0/0
ip address 201.68.109.98 255.255.255.252
ip access-group 110 in
ip access-group 20 out
ip nat outside
no shutdown
!
interface GigabitEthernet0/1
ip address 201.68.109.129 255.255.255.128
ip access-group 20 in
ip access-group 110 out
ip nat inside
no shutdown
!
router ospf 100
log-adjacency-changes
passive-interface GigabitEthernet0/0
network 201.68.109.128 0.0.0.127 area 0
default-information originate
!
ip nat inside source list 10 interface GigabitEthernet0/0 overload
ip nat inside source static 192.168.84.80 201.68.109.180
ip nat inside source static 192.168.84.74 201.68.109.174
ip nat inside source static 192.168.84.53 201.68.109.153
ip nat inside source static 192.168.84.45 201.68.109.145
ip route 0.0.0.0 0.0.0.0 201.68.109.97
!
access-list 10 permit 172.21.35.0 0.0.0.255
access-list 20 deny 10.0.0.0 0.255.255.255
access-list 20 deny 172.16.0.0 0.15.255.255
access-list 20 deny 192.168.0.0 0.0.255.255
access-list 20 permit any
access-list 110 permit tcp any host 192.168.84.74 eq smtp
access-list 110 permit tcp any host 192.168.84.80 eq www
access-list 110 permit tcp any host 192.168.84.80 eq 443
access-list 110 permit tcp any host 192.168.84.45 eq www
access-list 110 permit tcp any host 192.168.84.45 eq 443
access-list 110 permit udp any host 192.168.84.53 eq domain
access-list 110 deny ip any any
!
radius-server host 192.168.84.53 auth-port 1812
radius-server key Cisco123
line vty 0 4
transport input ssh
login local
exit
Configuration R3:
enable
configure terminal
hostname R3
!
ip dhcp excluded-address 172.21.35.1 172.21.35.25
!
ip dhcp pool WORKSTATIONS
network 172.21.35.0 255.255.255.0
default-router 172.21.35.1
dns-server 192.168.84.53
!
aaa new-model
!
aaa authentication login default group radius local
!
username Cisco123 secret 123
!
ip ssh version 2
ip ssh authentication-retries 2
ip ssh time-out 60
ip domain-name CCNASecurity.com
!
interface GigabitEthernet0/0
ip address 201.68.109.131 255.255.255.128
ip access-group 125 in
ip access-group 120 out
no shutdown
!
interface GigabitEthernet0/1
ip address 172.21.35.1 255.255.255.0
ip access-group 120 in
ip access-group 125 out
no shutdown
!
router ospf 100
log-adjacency-changes
passive-interface GigabitEthernet0/1
network 201.68.109.128 0.0.0.127 area 0
network 172.21.35.0 0.0.0.255 area 0
exit
!
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 389
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 88
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 135
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 2101
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 2103
access-list 120 permit tcp 172.21.35.0 0.0.0.255 host 192.168.84.53 eq 2105
access-list 120 deny tcp host 172.21.35.26 host 192.168.84.45 eq 22
access-list 120 deny tcp host 172.21.35.27 host 192.168.84.45 eq 22
access-list 120 deny tcp host 172.21.35.26 host 192.168.84.80 eq 22
access-list 120 deny tcp host 172.21.35.27 host 192.168.84.80 eq 22
access-list 120 permit ip any any
access-list 125 deny tcp any host 172.21.35.26 eq 3389
access-list 125 deny tcp any host 172.21.35.27 eq 3389
access-list 125 permit ip any 172.21.35.0 0.0.0.255
!
radius-server host 192.168.84.53 auth-port 1812
radius-server key Cisco123
!
line vty 0 4
login authentication default
transport input ssh
!
end
Not Finish!!!
END !~!
Nhận xét
Đăng nhận xét