16.5.1 Packet Tracer - Secure Network Devices Instructor Version
Topology
16.5.1 Packet Tracer - Secure Network Devices
Addressing Table
| Device | Interface | Address | Mask | Gateway |
|---|---|---|---|---|
| RTR-A | G0/0/0 | 192.168.1.1 | 255.255.255.0 | N/A |
| G0/0/1 | 192.168.2.1 | 255.255.255.0 | N/A | |
| SW-1 | SVI | 192.168.1.254 | 255.255.255.0 | 192.168.1.1 |
| PC | NIC | 192.168.1.2 | 255.255.255.0 | 192.168.1.1 |
| Laptop | NIC | 192.168.1.10 | 255.255.255.0 | 192.168.1.1 |
| Remote PC | NIC | 192.168.2.10 | 255.255.255.0 | 192.168.2.1 |
Requirements
Note: To keep this activity brief and easy to manage, some security configuration settings have not been made. In other cases, security best practices have not been followed.
In this activity you will configure a router and a switch based on a list of requirements.
Instructions
Step 1: Document the Network
Complete the addressing table with the missing information.
Step 2: Router configuration requirements:
• Prevent IOS from attempting to resolve mistyped commands to domain names.
• Hostnames that match the values in the addressing table.
Router(config)#hostname RTR-A
• Require that newly created passwords be at least 10 characters in length.
RTR-A(config)#security passwords min-length 10
• A strong ten-character password for the console line. Use @Cons1234!
RTR-A(config)#line console 0 RTR-A(config-line)#password @Cons1234! RTR-A(config-line)#login
• Ensure that console and VTY sessions close after 7 minutes exactly.
//RTR-A(config)#line console 0 RTR-A(config-line)#exec-timeout 7 0 RTR-A(config-line)#line vty 0 4 RTR-A(config-line)#exec-timeout 7 0
• A strong, encrypted ten-character password for the privileged EXEC mode. For this activity, it is permissible to use the same password as the console line.
RTR-A(config)#enable secret @Cons1234!
• A MOTD banner that warns about unauthorized access to the devices.
RTR-A(config)#banner motd #Unauthorized access prohibited.#
• Password encryption for all passwords.
RTR-A(config)#service password-encryption
• A user name of NETadmin with encrypted password LogAdmin!9.
RTR-A(config)#username NETadmin secret LogAdmin!9
• Enable SSH.
- Use security.com as the domain name.
- Use a modulus of 1024.
RTR-A(config)#no ip domain-lookup RTR-A(config)#ip domain-name security.com RTR-A(config-line)#crypto key generate rsa The name for the keys will be: RTR-A.security.com Choose the size of the key modulus in the range of 360 to 4096 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024
• The VTY lines should use SSH for incoming connections.
RTR-A(config-line)#line vty 0 4 RTR-A(config-line)#transport input ssh
• The VTY lines should use the username and password that were configured to authenticate logins.
RTR-A(config-line)#line vty 0 4 RTR-A(config-line)#login local
• Impede brute force login attempts by using a command that blocks login attempts for 45 seconds if someone fails three attempts within 100 seconds.
RTR-A(config)#login block-for 45 attempts 3 within 100
Step 3: Switch configuration requirements:
Switch(config)#hostname SW-1
• All unused switch ports are administratively down.
SW-1(config)#interface range fastEthernet0/1, fastEthernet0/3-9, fastEthernet0/11-24, GigabitEthernet0/2 SW-1(config-if-range)#shutdown
• The SW-1 default management interface should accept connections over the network. Use the information shown in the addressing table. The switch should be reachable from remote networks.
SW-1(config-if-range)#interface Vlan1 SW-1(config-if)#ip address 192.168.1.254 255.255.255.0 SW-1(config-if)#no shutdown SW-1(config-if)#ip default-gateway 192.168.1.1
• Use @Cons1234! as the password for the privileged EXEC mode.
SW-1(config)#enable secret @Cons1234!
• Configure SSH as was done for the router.
SW-1(config)#ip domain-name security.com SW-1(config-line)#crypto key generate rsa The name for the keys will be: SW-1.security.com Choose the size of the key modulus in the range of 360 to 4096 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [512]: 1024 % Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
• Create a user name of NETadmin with encrypted secret password LogAdmin!9
SW-1(config)#username NETadmin secret LogAdmin!9
• The VTY lines should only accept connections over SSH.
SW-1(config)#line vty 0 4 SW-1(config-line)#transport input ssh
• The VTY lines should only allow the network administrator account to access the switch management interface.
SW-1(config)#line vty 0 4 SW-1(config-line)#login local
• Hosts on both LANs should be able to ping the switch management interface.
Device Configs - Final
RTR-A
! ==============================================================
!--- 16.5.1 Packet Tracer - Secure Network Devices
!--- ANSWER SCRIPT FOR ROUTER RTR-A
!--- Usage: copy this whole file and paste it into the ROUTER RTR-A terminal (start at the Router> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
! ==============================================================
enable
configure terminal
! --------------------------------------------------------------
!--- Step 2: Router security configuration (G0/0/0 and G0/0/1 are pre-configured in the topology; this lab is security-only).
! --------------------------------------------------------------
!--- Hostname.
hostname RTR-A
!--- Prevent IOS from trying to resolve mistyped commands as host names.
no ip domain-lookup
!--- Set the domain name (required to generate RSA keys for SSH).
ip domain-name security.com
!--- Encrypt all plaintext passwords.
service password-encryption
!--- Require newly created passwords to be at least 10 characters (set BEFORE the passwords below).
security passwords min-length 10
!--- Strong 10-character enable secret for privileged EXEC.
enable secret @Cons1234!
!--- Local user with an encrypted secret password (used for SSH login).
username NETadmin secret LogAdmin!9
!--- Block logins for 45 seconds after 3 failed attempts within 100 seconds.
login block-for 45 attempts 3 within 100
!--- Banner warning against unauthorized access.
banner motd #Unauthorized access prohibited.#
!--- Console line: strong password, require login, close idle session after 7 minutes.
line console 0
password @Cons1234!
login
exec-timeout 7 0
exit
!--- VTY 0-4: SSH only, authenticate with local users, 7-minute idle timeout.
line vty 0 4
login local
transport input ssh
exec-timeout 7 0
exit
!--- VTY 5-15 left with 'no login' per the answer key. NOTE: this leaves those lines unauthenticated - a security gap the lab intentionally accepts ('some best practices have not been followed'). Consider securing them too on a real device.
line vty 5 15
no login
exit
!--- Generate 1024-bit RSA keys for SSH. IMPORTANT: '1024' below answers the modulus prompt - keep these two lines together with NO comment between them.
crypto key generate rsa
1024
end
! --------------------------------------------------------------
!--- Save the configuration to NVRAM (the answer script omits this). Press Enter when prompted.
! --------------------------------------------------------------
copy running-config startup-config
! ==============================================================
!--- Verification: show ip ssh ; show run | section vty ; show login
! ==============================================================
SW-1
! ============================================================== !--- 16.5.1 Packet Tracer - Secure Network Devices !--- ANSWER SCRIPT FOR SWITCH SW-1 !--- Usage: copy this whole file and paste it into the SWITCH SW-1 terminal (start at the Switch> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Step 3: Switch security configuration (reduced set - Step 3 requires fewer measures than the router). ! -------------------------------------------------------------- !--- Hostname. hostname SW-1 !--- Set the domain name (required to generate RSA keys for SSH). ip domain-name security.com !--- Strong enable secret for privileged EXEC. enable secret @Cons1234! !--- Local user with an encrypted secret password (used for SSH login). username NETadmin secret LogAdmin!9 !--- Shut down all unused ports (everything except F0/2, F0/10, and G0/1, which connect the router/PC/laptop). interface range f0/1, f0/3 - 9, f0/11 - 24, g0/2 shutdown exit !--- Management SVI (VLAN 1): IP address + activate so the switch is reachable over the network. interface vlan 1 ip address 192.168.1.254 255.255.255.0 no shutdown exit !--- Default gateway (RTR-A G0/0/0) so the switch is reachable from remote networks. ip default-gateway 192.168.1.1 !--- VTY 0-4: SSH only, authenticate with local users (only NETadmin can manage the switch). line vty 0 4 login local transport input ssh exit !--- Generate 1024-bit RSA keys for SSH. IMPORTANT: '1024' below answers the modulus prompt - keep these two lines together with NO comment between them. crypto key generate rsa 1024 end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM (the answer script omits this). Press Enter when prompted. ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: show ip ssh ; show ip interface brief ; ping from a remote host to 192.168.1.254 ! ==============================================================
