6.3.6 Lab – Basic Device Configuration and OSPF Authentication Answers

6.3.6 Lab – Basic Device Configuration and OSPF Authentication Answers version

Addressing Table

Objectives

Part 1: Configure Basic Device Settings

• Cable the network as shown in the topology.
• Configure basic IP addressing for routers and PCs.
• Configure OSPF routing.
• Configure PC hosts.
• Verify connectivity between hosts and routers.

Part 2: Secure the Control Plane

• Configure OSPF Authentication using SHA256
• Verify OSPF Authentication

Background / Scenario

The router is a critical component in any network. It controls the movement of data into and out of the network and between devices within the network. It is particularly important to protect network routers because the failure of a routing device could make sections of the network, or the entire network, inaccessible. Controlling access to routers and enabling reporting on routers is critical to network security and should be part of a comprehensive security policy.

In this lab, you will build a multi-router network and configure the routers and hosts. You will configure administrative roles with different privilege levels.

Note: The routers used with hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.6 (universalk9 image). The switches used in the labs are Cisco Catalyst 2960+ with Cisco IOS Release 15.2(7) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.

Note: Before you begin, ensure that the routers and the switches have been erased and have no startup configurations.

Required Resources

• 3 Routers (Cisco 4221 with Cisco XE Release 16.9.6 universal image or comparable with a Security Technology Package license)
• 2 Switches (Cisco 2960+ with Cisco IOS Release 15.2(7) lanbasek9 image or comparable)
• 2 PCs (Windows OS with a terminal emulation program, such as PuTTY or Tera Term installed)
  Console cables to configure Cisco networking devices
• Ethernet cables as shown in the topology

Instructions

Part 1: Configure Basic Device Settings

In this part, set up the network topology and configure basic settings, such as interface IP addresses.

Step 1: Cable the network.

Attach the devices, as shown in the topology diagram, and cable as necessary.

Step 2: Configure basic settings for each router.

a. Console into the router and enable privileged EXEC mode.

Router> enable
Router# configure terminal

Configure host names as shown in the topology.

R1(config)# hostname R1

Configure interface IP addresses as shown in the IP Addressing Table.

R1(config)# interface g0/0/0
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# no shutdown

R1(config)# interface g0/0/1
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown

b. To prevent the router from attempting to translate incorrectly entered commands as though they were host names, disable DNS lookup. R1 is shown here as an example.

R1(config)# no ip domain-lookup

Step 3: Configure OSPF routing on the routers.

a. Use the router ospf command in global configuration mode to enable OSPF on R1.

R1(config)# router ospf 1

b. Configure the network statements for the networks on R1. Use an area ID of 0.

R1(config-router)# network 192.168.1.0 0.0.0.255 area 0
R1(config-router)# network 10.1.1.0 0.0.0.3 area 0

c. Configure OSPF on R2 and R3.

R2(config)# router ospf 1
R2(config-router)# network 10.1.1.0 0.0.0.3 area 0
R2(config-router)# network 10.2.2.0 0.0.0.3 area 0

R3(config)# router ospf 1
R3(config-router)# network 10.2.2.0 0.0.0.3 area 0
R3(config-router)# network 192.168.3.0 0.0.0.255 area 0

d. Issue the passive-interface command to change the G0/0/1 interface on R1 and R3 to passive.

R1(config)# router ospf 1
R1(config-router)# passive-interface g0/0/1

R3(config)# router ospf 1
R3(config-router)# passive-interface g0/0/1

Step 4: Verify OSPF neighbors and routing information.

a. Issue the show ip ospf neighbor command to verify that each router lists the other routers in the network as neighbors.

R1# show ip ospf neighbor

Neighbor ID     Pri     State       Dead Time   Address      Interface
10.2.2.2          1     FULL/BDR    00:00:37    10.1.1.2     GigabitEthernet0/0/0

b. Issue the show ip route command to verify that all networks display in the routing table on all routers.

R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.1.0/30 is directly connected, GigabitEthernet0/0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0/0
O        10.2.2.0/30 [110/2] via 10.1.1.2, 00:01:11, GigabitEthernet0/0/0
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/0/1
L        192.168.1.1/32 is directly connected, GigabitEthernet0/0/1
O     192.168.3.0/24 [110/3] via 10.1.1.2, 00:01:07, GigabitEthernet0/0/0

Step 5: Configure PC host IP settings.

Configure a static IP address, subnet mask, and default gateway for PC-A and PC-C as shown in the IP Addressing Table.

Step 6: Verify connectivity between PC-A and PC-C.

a. Ping from R1 to R3.

If the pings are not successful, troubleshoot the basic device configurations before continuing.

b. Ping from PC-A, on the R1 LAN, to PC-C, on the R3 LAN.

If the pings are not successful, troubleshoot the basic device configurations before continuing.

Note: If you can ping from PC-A to PC-C you have demonstrated that OSPF routing is configured and functioning correctly. If you cannot ping but the device interfaces are up and IP addresses are correct, use the show run, show ip ospf neighbor, and show ip route commands to help identify routing protocol-related problems.

Step 7: Save the basic running configuration for each router.

Save the basic running configuration for the routers as text files on your PC. These text files can be used to restore configurations later in the lab.

Part 2: Configure OSPF Routing Protocol Authentication using SHA256 Hashing.

Step 1: Configure a key chain on all three routers.

a. Assign a key chain name and number.

R1(config)# key chain NetAcad
R1(config-keychain)# key 1

b. Assign the authentication key string.

R1(config-keychain-key)# key-string NetSeckeystring

c. Configure the encryption algorithm to be used for authentication, use SHA256 encryption.

R1(config-keychain-key)# cryptographic-algorithm hmac-sha-256

Step 2: Configure the GigabitEthernet interfaces to use OSPF authentication.

a. Use the ip ospf authentication command to assign the key-chain to the GigabitEthernet0/0/0 interface on R1 and R3.

R1(config)# interface g0/0/0
R1(config-if)# ip ospf authentication key-chain NetAcad
R1(config)#
*Jan 31 00:34:49.172: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.2 on GigabitEthernet0/0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

R3(config)# interface g0/0/0
R3(config-if)# ip ospf authentication key-chain NetAcad
R3(config)#
*Jan 31 00:32:31.998: %OSPF-5-ADJCHG: Process 1, Nbr 10.2.2.2 on GigabitEthernet0/0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

b. Use the ip ospf authentication command to assign the key-chain to both GigabitEthernet interfaces on R2.

R2(config)# interface g0/0/0
R2(config-if)# ip ospf authentication key-chain NetAcad
R2(config)# interface g0/0/1
R2(config-if)# ip ospf authentication key-chain NetAcad
R2(config-if)#
*Jan 31 00:37:48.379: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on GigabitEthernet0/0/0 from LOADING to FULL, Loading Done
*Jan 31 00:38:04.829: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.3.1 on GigabitEthernet0/0/1 from LOADING to FULL, Loading Done

Step 3: Verify OSPF Routing and Authentication is Correct.

a. Issue the show ip ospf interface command to verify that Authentication Key has been assigned to the GigabitEthernet interfaces on all routers.

R1# show ip ospf interface g0/0/0
GigabitEthernet0/0/0 is up, line protocol is up
  Internet Address 10.1.1.1/30, Interface ID 5, Area 0
  Attached via Network Statement
  Process ID 1, Router ID 192.168.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID Cost Disabled Shutdown Topology Name
       0         1      no       no        Base
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 192.168.1.1, Interface address 10.1.1.1
  Backup Designated router (ID) 10.2.2.2, Interface address 10.1.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 3
  Last flood scan time is 0 msec, maximum is 1 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.2.2.2 (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  Cryptographic authentication enabled
    Sending SA: Key 1, Algorithm HMAC-SHA-256 - key chain NetAcad

b. Issue the show ip ospf neighbor command to verify that each router lists the other routers in the network as neighbors.

R2# show ip ospf neighbor

Neighbor ID      Pri    State      Dead Time   Address      Interface
192.168.3.1        1    FULL/DR    00:00:37    10.2.2.1     GigabitEthernet0/0/1
192.168.1.1        1    FULL/DR    00:00:37    10.1.1.1     GigabitEthernet0/0/0

c. Issue the show ip route command to verify that all networks display in the routing table on all routers.

R3# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
O        10.1.1.0/30 [110/2] via 10.2.2.2, 00:08:15, GigabitEthernet0/0/0
C        10.2.2.0/30 is directly connected, GigabitEthernet0/0/0
L        10.2.2.1/32 is directly connected, GigabitEthernet0/0/0
O     192.168.1.0/24 [110/3] via 10.2.2.2, 00:08:12, GigabitEthernet0/0/0
      192.168.3.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.3.0/24 is directly connected, GigabitEthernet0/0/1
L        192.168.3.1/32 is directly connected, GigabitEthernet0/0/1

d. Use the ping command to verify connectivity between PC-A and PC-C.

If the pings are not successful, troubleshoot before continuing.

Router Interface Summary Table

Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.

Device Configs

Router R1

R1# show run

Building configuration…

Current configuration : 1444 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

platform punt-keepalive disable-kernel-core

!

hostname R1

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

key chain NetAcad

key 1

key-string NetSecKeyString

cryptographic-algorithm hmac-sha-256

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

ip address 10.1.1.1 255.255.255.252

ip ospf authentication key-chain NetAcad

negotiation auto

!

interface GigabitEthernet0/0/1

ip address 192.168.1.1 255.255.255.0

negotiation auto

!

router ospf 1

passive-interface GigabitEthernet0/0/1

network 10.1.1.0 0.0.0.3 area 0

network 192.168.1.0 0.0.0.255 area 0

!

ip forward-protocol nd

no ip http server

ip http secure-server

!

control-plane

!

line con 0

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end

Router R2

R2# show run

Building configuration…

Current configuration : 1298 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

platform punt-keepalive disable-kernel-core

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

key chain NetAcad

key 1

key-string NetSecKeyString

cryptographic-algorithm hmac-sha-256

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

ip address 10.1.1.2 255.255.255.252

ip ospf authentication key-chain NetAcad

negotiation auto

!

interface GigabitEthernet0/0/1

ip address 10.2.2.2 255.255.255.252

ip ospf authentication key-chain NetAcad

negotiation auto

!

router ospf 1

network 10.1.1.0 0.0.0.3 area 0

network 10.2.2.0 0.0.0.3 area 0

!

ip forward-protocol nd

no ip http server

ip http secure-server

!

control-plane

!

line con 0

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end

Router R3

R3# show run

Building configuration…

Current configuration : 1411 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

platform punt-keepalive disable-kernel-core

!

hostname R3

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

key chain NetAcad

key 1

key-string NetSecKeyString

cryptographic-algorithm hmac-sha-256

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

ip address 10.2.2.1 255.255.255.252

ip ospf authentication key-chain NetAcad

negotiation auto

!

interface GigabitEthernet0/0/1

ip address 192.168.3.1 255.255.255.0

negotiation auto

!

router ospf 1

passive-interface GigabitEthernet0/0/1

network 10.2.2.0 0.0.0.3 area 0

network 192.168.3.0 0.0.0.255 area 0

!

ip forward-protocol nd

no ip http server

ip http secure-server

!

control-plane

!

line con 0

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end