CCNA 3 V5 Skill Test Exam practice

exam-soultion

List of Area cover :

  • Configuration of initial device settings
  • IPv4 address assignment and configuration
  • Configuration and addressing of device interfaces
  • Configuration of the OSPFv2 routing protocol
  • Configuration of a default route
  • Configuration of ACL to limit device access
  • Configuration of switch management settings including SSH
  • Configuration of port security
  • Configuration of unused switch ports according to security best practices
  • Configuration of RPVST+
  • Configuration of  EtherChannel
  • Configuration of a router as a DHCP server
  • Configuration of VLANs and trunks
  • Configuration of routing between VLANs

Site 1:

  • Configure initial device settings.
  • Configure interfaces with IPv4 addresses, descriptions, and other settings.
  • Configure and customize OSPFv2.

HQ:

  • Configure interfaces with IPv4 addresses, descriptions, and other settings.
  • Configure and customize OSPFv2.
  • Configure named and numbered ACLs.
  • Configure and propagate a default route through OSPFv2.

Site 2:

  • Configure interfaces with IPv4 addresses, descriptions, and other settings.
  • Configure DHCP pools and excluded addresses.
  • Configure routing between VLANs.
  • Configure a standard ACL.
  • Configure OSPFv2.

SW-A:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings.
  • Activate and configure RPVST+.
  • Secure unused switch ports.
  • Configure port security.

SW-B:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings with SSH.
  • Activate RPVST+.

SW-C:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings.
  • Activate and configure RPVST+.
  • Configure switch ports with PortFast and BPDU Guard.

Router>en

Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname site-1
site-1(config)#no ip domain ?
lookup Enable IP Domain Name System hostname translation
name Define the default domain name
site-1(config)#no ip domain lookup
site-1(config)#enable secret cisco
site-1(config)#line console 0
site-1(config-line)#password cisco
site-1(config-line)#login
site-1(config-line)#
site-1(config-line)#exit
site-1(config)#line vty 0 4
site-1(config-line)#password cisco
site-1(config-line)#login
site-1(config-line)#exit
site-1(config)#
site-1(config)#line aux 0
site-1(config-line)#password cisco
site-1(config-line)#login
site-1(config-line)#exit
site-1(config)#line console 0
site-1(config-line)#logging sy
site-1(config-line)#logging synchronous
site-1(config-line)#exit
site-1(config)#banner motd “Authorized access only”
site-1(config)#service password en
site-1(config)#service password-en
site-1(config)#service password-encryption
site-1(config)#
site-1(config)#int s0/3/0
site-1(config-if)#bandwid
site-1(config-if)#bandwidth 128
site-1(config-if)#clock rate 64000
site-1(config-if)#ip address 192.168.100.22 255.255.255.252
site-1(config-if)#descripti
site-1(config-if)#description 2-central
site-1(config-if)#ip ospf cost 7500
site-1(config-if)#ip ospf mess
site-1(config-if)#ip ospf message-digest-key 1 md
site-1(config-if)#ip ospf message-digest-key 1 md5 xyz_ospf
site-1(config-if)#ip ospf authentication message-digest
site-1(config-if)#no shut

site-1(config)#int g0/0
site-1(config-if)#ip address 192.168.8.1 255.255.255.0
site-1(config-if)#des
site-1(config-if)#description
site-1(config-if)#description message-1A
site-1(config-if)#no shut

site-1(config-if)#
site-1(config)#int g0/1
site-1(config-if)#ip address 192.168.9.1 255.255.255.0
site-1(config-if)#des
site-1(config-if)#description clerck-1C
site-1(config-if)#no shut

OSPF on Site-1

site-1(config)#router ospf 1
site-1(config-router)#router-id 1.1.1.1
site-1(config-router)#area 0 authentication message-digest
site-1(config-router)#network 192.168.100.20 0.0.0.3 area 0
site-1(config-router)#network 192.168.8.0 0.0.0.255 area 1
site-1(config-router)#network 192.168.9.0 0.0.0.255 area 1
site-1(config-router)#

site-1(config-router)#passive-interface g0/0
site-1(config-router)#passive-interface g0/1
HQ:

Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no ip domain lookup
Router(config)#line console 0
Router(config-line)#logg
Router(config-line)#logging s
Router(config-line)#logging synchronous
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#
Router(config-line)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#
Router(config-line)#line aux 0
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#
Router(config-line)#service pass
Router(config-line)#service password
Router(config-line)#service password-encryption
Router(config)#banner motd “Authorized access only”
Router(config)#

Router(config)#int s0/3/0
Router(config-if)#bandwidth 128
Router(config-if)#ip address 192.168.100.21 255.255.255.252
Router(config-if)#description 2-East
Router(config-if)#ip ospf cost 7500

Router(config-if)#ip ospf message-digest-key 1 md5 xyz_ospf
Router(config-if)#ip ospf authentication message-digest
Router(config-if)#no shut

Router(config-if)#
%LINK-5-CHANGED: Interface Serial0/3/0, changed state to up

Router(config-if)#exit
Router(config)#

Router(config)#int s0/3/1
Router(config-if)#bandwidth 128
Router(config-if)#ip address 192.168.100.37 255.255.255.252
Router(config-if)#description 2-west
Router(config-if)#clock rate 128000

Router(config-if)#ip ospf message-digest-key 1 md5 xyz_ospf
Router(config-if)#ip ospf authentication mess
Router(config-if)#ip ospf authentication message-digest
Router(config-if)#no shut

%LINK-5-CHANGED: Interface Serial0/3/1, changed state to down
Router(config-if)#exit
Router(config)#

Router(config)#router ospf 1
Router(config-router)#router-id 2.2.2.2
Router(config-router)#area 0 authentication me
Router(config-router)#area 0 authentication message-digest
Router(config-router)#default-i
Router(config-router)#default-information or
Router(config-router)#default-information originate
Router(config-router)#network 192.168.100.20 0.0.0.3 area 0
Router(config-router)#

Router(config-router)#network 192.168.100.36 0.0.0.3 area 0

Site-2 Area 2:

Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname site-2
site-2(config)#no ip domain lookup
site-2(config)#enable secret cisco

site-2(config)#line console 0
site-2(config-line)#logg
site-2(config-line)#logging s
site-2(config-line)#logging synchronous
site-2(config-line)#password cisco
site-2(config-line)#login
site-2(config-line)#
site-2(config-line)#line aux 0
site-2(config-line)#password cisco
site-2(config-line)#login
site-2(config-line)#
site-2(config-line)#line vty 0 4
site-2(config-line)#password cisco
site-2(config-line)#login
site-2(config-line)#

site-2(config)#service password-encryption
site-2(config)#banner motd “Authorized access only”
site-2(config)#

site-2(config)#int s0/3/1
site-2(config-if)#bandwidth 128
site-2(config-if)#ip address 192.168.100.38 255.255.255.252
site-2(config-if)#description 2-central
site-2(config-if)#ip ospf message-digest-key 1 md5 xyz_ospf
site-2(config-if)#ip ospf authentication message-digest
site-2(config-if)#no shut

site-2(config)#ip dhcp excluded-address 10.10.2.1 10.10.2.5
site-2(config)#ip dhcp excluded-address 10.10.4.1 10.10.4.5
site-2(config)#ip dhcp excluded-address 10.10.8.1 10.10.8.5
site-2(config)#ip dhcp pool vlan2pool
site-2(dhcp-config)#network 10.10.2.0 255.255.255.0
site-2(dhcp-config)#default-router 10.10.2.1
site-2(dhcp-config)#dns-server 192.168.200.225

site-2(config)#ip dhcp pool vlan4pool
site-2(dhcp-config)#network 10.10.4.0 255.255.255.0
site-2(dhcp-config)#default-router 10.10.4.1
site-2(dhcp-config)#dns
site-2(dhcp-config)#dns-server 192.168.200.225
site-2(dhcp-config)#

site-2(config)#ip dhcp pool vlan8pool
site-2(dhcp-config)#network 10.10.8.0 255.255.255.0
site-2(dhcp-config)#default
site-2(dhcp-config)#default-router 10.10.8.1
site-2(dhcp-config)#dns
site-2(dhcp-config)#dns-server 192.168.200.225
site-2(dhcp-config)#exit
site-2(config)#

Inter – Vlan:
site-2(config)#int g0/0.2
site-2(config-subif)#encapsulation do
site-2(config-subif)#encapsulation dot1Q 2
site-2(config-subif)#ip address 10.10.2.1 255.255.255.0
site-2(config-subif)#exit
site-2(config)#

site-2(config)#int g0/0.4
site-2(config-subif)#encapsulation dot1Q 4
site-2(config-subif)#ip address 10.10.4.1 255.255.255.0
site-2(config-subif)#exit
site-2(config)#

site-2(config)#int g0/0.8
site-2(config-subif)#encapsulation dot1Q 8
site-2(config-subif)#ip address 10.10.8.1 255.255.255.0
site-2(config-subif)#exit
site-2(config)#

site-2(config)#int g0/0.15
site-2(config-subif)#en
site-2(config-subif)#encapsulation d
site-2(config-subif)#encapsulation dot1Q 15
site-2(config-subif)#ip address 10.10.15.1 255.255.255.0
site-2(config-subif)#exit
site-2(config)#

site-2(config)#int g0/0.25
site-2(config-subif)#encapsulation dot1Q 25
site-2(config-subif)#ip address 10.10.25.1 255.255.255.0
site-2(config-subif)#exit
site-2(config)#
Router summarization:
site-2(config)#int s0/3/1
site-2(config-if)#ip summary-address eigrp 100 10.10.0.0 255.255.240.0
site-2(config-if)#exit

Access-list:

site-2(config)#access-list 1 permit 10.10.15.0 0.0.0.255
site-2(config)#int g0/0.25
site-2(config-subif)#ip access-group 1 out
site-2(config-subif)#
OSPF

site-2(config-router)#router-id 3.3.3.3
site-2(config-router)#passive-in
site-2(config-router)#passive-interface g0/0
site-2(config-router)#network 192.168.100.36 0.0.0.3 area 0
site-2(config-router)#
site-2(config-router)#network 10.10.2.0 0.0.0.255 area 2
site-2(config-router)#network 10.10.4.0 0.0.0.255 area 2
site-2(config-router)#network 10.10.8.0 0.0.0.255 area 2
site-2(config-router)#network 10.10.15.0 0.0.0.255 area 2
site-2(config-router)#

SW1:

Switch>
Switch>en
Switch#config t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname Bldg1
Bldg1(config)#no ip domain lookup
Bldg1(config)#enable secret cisco
Bldg1(config)#service pass
Bldg1(config)#service password-encryption
Bldg1(config)#
Bldg1(config)#line console 0
Bldg1(config-line)#lo
Bldg1(config-line)#log
Bldg1(config-line)#logging s
Bldg1(config-line)#logging synchronous
Bldg1(config-line)#password cisco
Bldg1(config-line)#login

Bldg1(config)#line vty 0 5
Bldg1(config-line)#password cisco
Bldg1(config-line)#login
Bldg1(config-line)#exit
Bldg1(config)#banner motd “Authorized access only”
Bldg1(config)#

Bldg1(config)#ip default-gateway 10.10.25.1

Bldg1(config)#vlan 2
Bldg1(config-vlan)#name sales
Bldg1(config-vlan)#exit
Bldg1(config)#vlan 4
Bldg1(config-vlan)#name prod
Bldg1(config-vlan)#exit
Bldg1(config)#vlan 8
Bldg1(config-vlan)#name acct
Bldg1(config-vlan)#exit
Bldg1(config)#vlan 15
Bldg1(config-vlan)#name admin
Bldg1(config-vlan)#exit
Bldg1(config)#vlan 25
Bldg1(config-vlan)#name sv1-net
Bldg1(config-vlan)#exit
Bldg1(config)#vlan 99
Bldg1(config-vlan)#name null
Bldg1(config-vlan)#exit
Bldg1(config)#
Bldg1(config)#int vlan 25
Bldg1(config-if)#

%LINK-5-CHANGED: Interface Vlan25, changed state to up

Bldg1(config-if)#ip address 10.10.25.254 255.255.255.0
Bldg1(config-if)#no shut
Bldg1(config-if)#

Bldg1(config-if)#int fa0/5
Bldg1(config-if)#switchport mode access
Bldg1(config-if)#switchport access vlan 2
Bldg1(config-if)#exit
Bldg1(config)#int fa0/6
Bldg1(config-if)#switchport mode access
Bldg1(config-if)#switchport access vlan 4
Bldg1(config-if)#exit
Bldg1(config)#int fa0/7
Bldg1(config-if)#switchport mode access
Bldg1(config-if)#switchport access vlan 8
Bldg1(config-if)#exit
Bldg1(config)#int fa0/8
Bldg1(config-if)#switchport mode access
Bldg1(config-if)#switchport access vlan 15
Bldg1(config-if)#exit
Bldg1(config)#

Bldg1(config)#int range fa0/9-24
Bldg1(config-if-range)#switchport mode access
Bldg1(config-if-range)#switchport access vlan 99
Bldg1(config-if-range)#shutdown
Ether-channel:
Bldg1(config)#int range fa0/1,fa0/4
Bldg1(config-if-range)#channel-group 1 mode active
Bldg1(config)#int port-channel 1
Bldg1(config-if)#switchport mode trunk

Bldg1(config)#int range fa0/2-3
Bldg1(config-if-range)#channel-group 2 mode active
Bldg1(config-if-range)#int port-channel 2
Bldg1(config-if)#switchport mode trunk
Bldg1(config-if)#
PVST+:

Bldg1(config)#spanning-tree mode rapid-pvst
Bldg1(config)#spanning-tree vlan 2 root primary
Bldg1(config)#s
Bldg1(config)#sp
Bldg1(config)#spanning-tree vlan 4 root primary
Bldg1(config)#sp
Bldg1(config)#spanning-tree vlan 8 root secondary
Bldg1(config)#sp
Bldg1(config)#spanning-tree vlan 15 root secondary
Bldg1(config)#

configure port-Security :

Bldg1(config)#int fa0/5
Bldg1(config-if)#switchport port-security
Bldg1(config-if)#switchport port-security violation restrict
Bldg1(config-if)#switchport port-security maximum 2
Bldg1(config-if)#switchport port-security mac-address sticky
Bldg1(config-if)#exit
Bldg1(config)#

ldg1(config)#int fa0/6
Bldg1(config-if)#switchport port-security
Bldg1(config-if)#switchport port-security violation restrict
Bldg1(config-if)#switchport port-security maximum 2
Bldg1(config-if)#switchport port-security mac-address sticky
Bldg1(config-if)#exit
Bldg1(config)#

Bldg1(config)#int fa0/7
Bldg1(config-if)#switchport port-security
Bldg1(config-if)#switchport port-security violation restrict
Bldg1(config-if)#switchport port-security maximum 2
Bldg1(config-if)#switchport port-security mac-address sticky
Bldg1(config-if)#exit
Bldg1(config)#
Bldg1(config-if)#switchport port-security
Bldg1(config-if)#switchport port-security violation restrict
Bldg1(config-if)#switchport port-security maximum 2
Bldg1(config-if)#switchport port-security mac-address sticky
Bldg1(config-if)#
SW-B:

Switch>en
Switch#config t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname Bldg2
Bldg2(config)#no ip domain lookup
Bldg2(config)#enable secret cisco
Bldg2(config)#service pass
Bldg2(config)#service password-encryption
Bldg2(config)#line console 0
Bldg2(config-line)#password cisco
Bldg2(config-line)#logging s
Bldg2(config-line)#logging synchronous
Bldg2(config-line)#login
Bldg2(config-line)#
Bldg2(config-line)#line vty 0 15
Bldg2(config-line)#password cisco
Bldg2(config-line)#login
Bldg2(config-line)#exit
Bldg2(config)#banner motd “Authorized access only”
Bldg2(config)#

Bldg2(config)#line console 0
Bldg2(config-line)#password cisco
Bldg2(config-line)#logging s
Bldg2(config-line)#logging synchronous
Bldg2(config-line)#login
Bldg2(config-line)#
Bldg2(config-line)#line vty 0 15
Bldg2(config-line)#password cisco
Bldg2(config-line)#login
Bldg2(config-line)#exit
Bldg2(config)#banner motd “Authorized access only”
Bldg2(config)#
Bldg2(config)#
Bldg2(config)#ip ssh version 2
Please create RSA keys (of at least 768 bits size) to enable SSH v2.
Bldg2(config)#ip domain-name ccna.com
Bldg2(config)#crypto key generate rsa
The name for the keys will be: Bldg2.ccna.com
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
Vlan :
Bldg2(config)#
Bldg2(config-line)#login local
Bldg2(config-line)#transport input ssh
Bldg2(config-line)#exit
Bldg2(config)#line vty 5 15
Bldg2(config-line)#login local
Bldg2(config-line)#transport input ssh
Bldg2(config-line)#ip default-gateway 10.10.25.1
Bldg2(config)#
Bldg2(config)#vlan 2
Bldg2(config-vlan)#name sales
Bldg2(config-vlan)#exit
Bldg2(config)#vlan 4
Bldg2(config-vlan)#name prod
Bldg2(config-vlan)#exit
Bldg2(config)#vlan 8
Bldg2(config-vlan)#name acct
Bldg2(config-vlan)#exit
Bldg2(config)#vlan 15
Bldg2(config-vlan)#name admin
Bldg2(config-vlan)#exit
Bldg2(config)#vlan 25
Bldg2(config-vlan)#name sv1-net
Bldg2(config-vlan)#exit
Bldg2(config)#vlan 99
Bldg2(config-vlan)#name null

Bldg2(config)#int vlan 25
Bldg2(config-if)#
Bldg2(config-if)#ip address 10.10.25.253 255.255.255.0
Bldg2(config-if)#no shut
Bldg2(config)#int fa0/5
Bldg2(config-if)#switchport mode trunk

Ether-channel 1:

Bldg2(config)#int range fa0/1, fa0/4
Bldg2(config-if-range)#channel-group 2 mode active
Bldg2(config-if-range)#int port-channel 2
Bldg2(config-if)#switchport mode trunk
Bldg2(config-if)#
Bldg2(config-vlan)#exit
Bldg2(config)#

Bldg2(config)#int range fa0/2-3
Bldg2(config-if-range)#channel-group 3 mode active
Bldg2(config-if-range)#int port-channel 3
Bldg2(config-if)#switchport mode trunk

-PVST+
Bldg2(config)#spanning-tree mode rapid-pvst
Bldg2(config)#
SW -C:

Switch>en
Switch#config t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname bldg3
bldg3(config)#
bldg3(config)#no ip domain lookup
bldg3(config)#enable secret cisco
bldg3(config)#service pass
bldg3(config)#service password-encryption
bldg3(config)#banner motd “Authorized access only”
bldg3(config)#
bldg3(config)#line console 0
bldg3(config-line)#password cisco
bldg3(config-line)#login
bldg3(config-line)#
bldg3(config-line)#line vty 0 5
bldg3(config-line)#pass cisco
bldg3(config-line)#login
bldg3(config-line)#exit
bldg3(config)#

bldg3(config)#ip default-gateway 10.10.25.1

bldg3(config)#vlan 2
bldg3(config-vlan)#name sales
bldg3(config-vlan)#exit
bldg3(config)#vlan 4
bldg3(config-vlan)#name prod
bldg3(config-vlan)#exit
bldg3(config)#vlan 8
bldg3(config-vlan)#name acct
bldg3(config-vlan)#exit
bldg3(config)#vlan 15
bldg3(config-vlan)#name admin
bldg3(config-vlan)#exit
bldg3(config)#vlan 25
bldg3(config-vlan)#name sv1-net
bldg3(config-vlan)#exit
bldg3(config)#vlan 99
bldg3(config-vlan)#name null
bldg3(config-vlan)#exit
bldg3(config)#

bldg3(config)#int vlan 25
bldg3(config-if)#ip address 10.10.25.252 255.255.255.0
bldg3(config-if)#no shut
bldg3(config-if)#
Ether channel 1:

bldg3(config)#int range fa0/1, fa0/3
bldg3(config-if-range)#channel-group 3 mode active
bldg3(config-if-range)#int port-channel 3
bldg3(config-if)#switchport mode trunk
bldg3(config-if)#
bldg3(config)#int range fa0/2,fa0/4
bldg3(config-if-range)#channel-group 2 mode active
bldg3(config-if-range)#

bldg3(config-if-range)#int port-channel 2
bldg3(config-if)#switchport mode trunk
bldg3(config-if)#exit
bldg3(config)#

PVST+
bldg3(config)#spanning-tree mode rapid-pvst
bldg3(config)#sp
bldg3(config)#spanning-tree vlan 2 root secondary
bldg3(config)#sp
bldg3(config)#spanning-tree vlan 4 root secondary
bldg3(config)#sp
bldg3(config)#spanning-tree vlan 8 root primary
bldg3(config)#sp
bldg3(config)#spanning-tree vlan 15 root primary
bldg3(config)#

port fast BPDU Guard Configure :

bldg3(config)#int range fa0/5-8
bldg3(config-if-range)#sp
bldg3(config-if-range)#spanning-tree portfast

bldg3(config-if-range)#spanning-tree bpduguard enable
bldg3(config-if-range)#no shut
bldg3(config-if-range)#

bldg3(config)#int fa0/5
bldg3(config-if)#switchport mode access
bldg3(config-if)#switchport access vlan 2
bldg3(config-if)#exit

bldg3(config)#int fa0/6
bldg3(config-if)#switchport mode access
bldg3(config-if)#switchport access vlan 4
bldg3(config-if)#exit
bldg3(config)#int fa0/7
bldg3(config-if)#switchport mode access
bldg3(config-if)#switchport access vlan 8
bldg3(config-if)#exit
bldg3(config)#int fa0/8
bldg3(config-if)#switchport mode access
bldg3(config-if)#switchport access vlan 15
bldg3(config-if)#

Thank you

Momataj Momo

Advertisements

Practice Skills Assessment – Packet Tracer (Module One Exam Solution )

You will practice and be assessed on the following skills:

  • Configuration of initial IOS device settings
  • Design and calculation of IPv4 addressing
  • Configuration of IOS device interfaces including IPv4 and IPv6 addressing when appropriate
  • Addressing of network hosts with IPv4 and IPv6 addresses
  • Enhancing device security, including configuration of the secure transport protocol for remote device configuration
  • Configuration of a switch management interface

Requirements by device:

  • Town Hall router:
  • Configuration of initial router settings
  • Interface configuration and IPv4 and IPv6 addressing
  • Device security enhancement or “device hardening”
  • Secure transport for remote configuration connections as covered in the labs.
  • Backup of the configuration file to a TFTP server
  • Administration Switch:
  • Enabling basic remote management by Telnet
  • PC and Server hosts:
  • IPv4 full addressing
  • IPv6 addressing
Skill Test Exam Solution

Fig : Topology (Skill Test Exam Solution)

ccna-1-skill-final-1

Step 1:

Design an IPv4 addressing scheme and complete the Addressing Table based on the following requirements. Use the table above to help you organize your work.

a. Subnet the 192.168.1.0/24 network to provide 30 host addresses per subnet while wasting the fewest addresses.

b. Assign the fourth subnet to the IT Department LAN.

c. Assign the last network host address (the highest) in this subnet to the G0/0 interface on Town Hall.

d. Starting with the fifth subnet, subnet the network again so that the new subnets will provide 14 host addresses per subnet while wasting the fewest addresses.

e. Assign the second of these new 14-host subnets to the Administration LAN.

f. Assign the last network host address (the highest) in the Administration LAN subnet to the G0/1 interface of the Town Hall router.

g. Assign the second to the last address (the second highest) in this subnet to the VLAN 1 interface of the Administration Switch.

h. Configure addresses on the hosts using any of the remaining addresses in their respective subnets.

Step 2: Configure the Town Hall Router.

a. Configure the Town Hall router with all initial configurations that you have learned in the course so far:

· Configure the router hostname: Middle

· Protect device configurations from unauthorized access with the encrypted password.

· Secure all of the ways to access the router using methods covered in the course and labs.

· Newly-entered passwords must have a minimum length of 10 characters.

· Prevent all passwords from being viewed in clear text in device configuration files.

· Configure the router to only accept in-band management connections over the protocol that is more secure than Telnet, as was done in the labs. Use the value 1024 for encryption key strength.

· Configure user authentication for in-band management connections.

b. Configure the two Gigabit Ethernet interfaces using the IPv4 addressing values you calculated and the IPv6 values provided in the addressing table.

· Reconfigure the link local addresses as was practiced in the labs. The IPv6 link-local Interface ID should match the IPv6 unicast Interface ID as is practiced in the labs.

· Document the interfaces in the configuration file.

Step 3: Configure the Administration Switch.

Configure Administration Switch for remote management.

Step 4: Configure and Verify Host Addressing.

a. Use the IPv4 addressing from Step 1 and the IPv6 addressing values provided in the addressing table to configure all host PCs with the correct addressing.

b. Use the router interface link-local addresses as the IPv6 default gateways on the hosts.

c. All hosts should be able to ping each other over IPv4.

Step 5: Backup the Configuration of the Town Hall Router to TFTP.

a. Complete the configuration of the TFTP server using the IPv4 addressing values from Step 1 and the values in the addressing table.

b. Backup the running configuration of Town Hall to the TFTP Server. Use the default file name.

Solution : 

Router>
Router>enable
Router#configure terminal
Router(config)#interface g0/0
Router(config-if)#ip address 192.168.1.126 255.255.255.224
Router(config-if)#description IT Department LAN
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface g0/1
Router(config-if)#ip address 192.168.1.158 255.255.255.240
Router(config-if)#description Administration LAN
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#ipv6 unicast-routing
Router(config)#interface g0/0
Router(config-if)#ipv6 address 2001:db8:acad:A::1/64
Router(config-if)#ipv6 address FE80::1 link-local
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface g0/1
Router(config-if)#ipv6 address 2001:db8:acad:B::1/64
Router(config-if)#ipv6 address FE80::1 link-local
Router(config-if)#no shutdown
Router(config-if)#exit

Router(config)#
Router(config)#hostname Middle
Middle(config)#Enable secret class12345
Middle(config)#line console 0
Middle(config-line)#password cisconet2014
Middle(config-line)#login
Middle(config-line)#exit
Middle(config)#line vty 0 15
Middle(config-line)#password cisconet2014
Middle(config-line)#login
Middle(config-line)#exit
Middle(config)#line aux 0
Middle(config-line)#password cisconet2014
Middle(config-line)#login
Middle(config-line)#exit
Middle(config)#
Middle(config)#Banner motd “Authorized Access Only”
Middle(config)#security password min-length 10
Middle(config)#service password-encryption
Middle(config)#ip domain-name ccna.net
Middle(config)#username cisco secret cisconet2014
Middle(config)#crypto key generate rsa
The name for the keys will be: Middle.cisco.local
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

Middle(config)#line vty 0 15
Middle(config-line)#login local
Middle(config-line)#transport input ssh
Middle(config-line)#exit
Middle(config)#

—————————————–
Switch1 ip default gateway 192.168.1.158

—————————————–

Reception Host
default gateway FE80::1
default gateway 192.168.1.126

IP address 192.168.1.97/27
IPv6 address 2001:DB8:ACAD:A::FF/64

—————————————–

Operator Host

default gateway FE80::1
default gateway 192.168.1.126

IP address 192.168.1.98/27
IPv6 address 2001:DB8:ACAD:A::15/64

—————————————–

IT Host

default gateway FE80::1
default gateway 192.168.1.158

IP address 192.168.1.145/28
IPv6 address 2001:DB8:ACAD:B::FF/64

—————————————–

SERVER TFTP

default gateway FE80::1
default gateway 192.168.1.158

IP address 192.168.1.146/28
IPv6 address 2001:DB8:ACAD:B::15/64

—————————————–

Backup the Configuration of the Town Hall Router to TFTP.

Middle#copy running-config tftp
Address or name of remote host []? 192.168.1.146
Destination filename [Router-confg]? [Press Enter]

—————————————–

Momataj Momo

 

SSH: Brief Description about Secure Shell Configuration

Secure Shell (SSH) is a cryptographic network protocol for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH Server and SSH Client programs, respectively. The protocol specification distinguishes between two major versions that are referred to as SSH-1 and SSH-2.

Secure Shell improves network security by providing a means of establishing secure connections to networking devices for management thereby preventing hackers from gaining access.

Using Digital certificates, In public/private key cryptography , SSH is able to authenticate clients or server ensuring that the device or server you are about to connect to is exactly who they claim to be.

Telnet like SSH, Telnet can also be used to connect to your router but the main disadvantage of using Telnet is that does not encrypt its connections. This means that if a hackers is able to capture packets from Telnet session , he or she would able to view information contained within those packets , such as a client’s username and password , therefore gaining access to your router.

Configuration SSH Router : 

Step: 

1. Configure a hostname for the router using these command

Router > en

Router# config t

Router # Hostname R1

2. Configure a domain name with the IP domain-name command

R1(Config) # IP domain-name ciscolab.com

3. we generate a certificate that will be used to encrypt the SSH packets using

R1(config)# crypto key generate rsa

4. R1(config)# line vty 0 4

R1(config)# login local

R1(config)#transport input ssh

R1(config)# username XXXX (username) privilege 15 secret XXXX(password)

5. Fine turning your SSH configuration

R1(config)# line vty 0 4

R1(config)# exce-timeout 5

enable exce-timeout on your router to prevent anyone from gaining access to the device in cases you forget to logout or got distracted because of an emergency . This way, the router will automatically log you out after the session has been idle for a set time

R1(config) # line vty 0 4

6. Use access control list (ACL) – as an added layer of security . This will ensure that only device with certain IP address are able to connect to the router.

R1 (config)# access-list l permit 192,168.100.0 0.0.0.255

R1 (config)# line vty 0 4

R1 (config)# access-class 1 in

Enable SSH version  within this command :

R1(config)# line vty 0 4

R1(config)#ip ssh version 1

Configure SSH v2:

R1(config)#ip ssh version 2

Configure SSH v1 and v2:

R1(config)#no ip ssh version

Important Topics:

PuTTY is an SSH and telnet client, developed originally by Simon Tatham for the Windows platform.
SSH uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user, if necessary.
OpenSSH is a FREE version of the SSH connectivity tools that technical users of the Internet rely on.

In a short look of command again for SSH configuration:

Router>en

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#crypto ?

dynamic-map Specify a dynamic crypto map template

ipsec Configure IPSEC policy

isakmp Configure ISAKMP policy

key Long term key operations

map Enter a crypto map

Router(config)#hostname R1

R1(config)#ip domain-name demo.net

R1(config)#crypto key generate rsa

The name for the keys will be: R1.demo.net

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take

a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

R1(config)#interface fastethernet 0/0

*Mar 1 0:1:21.407: %SSH-5-ENABLED: SSH 1.99 has been enabled

R1(config-if)#ip address 172.16.0.1 255.255.0.0

R1(config-if)#no shutdown

R1(config-if)#

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

R1(config-if)#exit

R1(config)#username admin priv 15 secret password

R1(config)#aaa new-model

R1(config)#enable secret password

R1(config)#line vty 0 4

R1(config-line)#transport input ssh

R1(config-line)#end

R1#

 PC>ssh -l admin 172.16.0.1

Open

Password:

R1>

Thank you

Momataj Momo

Skill Test in packet Tracer : SSH Configuration

How to configure secure shell on a Cisco router:

SSH connect

SSH Configuration

Sept -1: Click on Router and go to CLI (Command line interface)

Router>en

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface fastethernet 0/0

Router(config-if)#ip address 192.168.1.1 255.255.255.0

Router (Config-if)# no shutdown

Router(config-if)#ip domain-name todopacketracer.com

Router(config)#hostneame ssh

Router(config)#hostname ssh

ssh(config)#crypto key generate rsa

The name for the keys will be: ssh.todopacketracer.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take

a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

ssh(config)#line vty 0 4

*Mar 1 0:2:27.345: %SSH-5-ENABLED: SSH 1.99 has been enabled

ssh(config-line)#transport input ssh

ssh(config-line)#login loca

ssh(config-line)#login local

ssh(config-line)#exit

ssh(config)#username toe privilege 15 password cisco

ssh(config)#enable secret cisco

ssh(config)#exit

ssh#

 

Step -2 : Click on PC and go to DESKTOP -> IP CONFIGURATION

PC config

PC IP ADDRESS CONFIG

Step – 3: click on Command prompt 

PC>SSH -l toe 192.168.1.1

Open

Password:

ssh#config terminal

Enter configuration commands, one per line. End with CNTL/Z.

ssh(config)#

Thank you

Momataj Momo