================================================

1. SETUP SSH
================================================
DTE ROUTER
==================================
CONF T
ip domain-name dteftui.com
crypto key generate rsa

1024

username admin secret dteftuissh

enable secret dteftuissh
line vty 0 15
transport input ssh
login local
exit
ip ssh version 2

DOSEN ROUTER
==================================
CONF T
ip domain-name dosen.com
crypto key generate rsa

1024

username admin secret dosenssh

enable secret dosenssh
line vty 0 15
transport input ssh
login local
exit
ip ssh version 2

================================================
2. SWITCH
================================================
SWITCH
===================================
en
conf t
int range fa0/4-24
shutdown
int range gig0/1-2
shutdown
exit
ip dhcp snooping
ip dhcp snooping vlan 10
interface fa0/1
ip dhcp snooping trust
interface fa0/2
ip dhcp snooping limit rate 3
interface fa0/3
ip dhcp snooping limit rate 3
exit
int fa0/1
switchport mode access
switchport port-security
switchport port-security maximum 20
switchport port-security mac-address sticky
switchport port-security violation restrict
exit
int fa0/1
speed 100
exit
int range fa0/2-3
speed 10
exit

================================================
3. Central Router
================================================
INI BISA UBAH SENDIRI, SO EZ

================================================
4. Central Router
================================================
CentralRouter
=================
en
conf t
ip access-list extended central
deny tcp 192.168.2.0 0.0.0.3 host 192.168.40.100 eq 80
deny tcp 192.168.2.0 0.0.0.3 host 192.168.40.100 eq 443
permit ip any any
int g0/0
ip access-group central out

================================================
5. VPN Gateway
================================================
VPN_Gateway
==================
en
conf t
ip access-list standard vpn_gateway
permit 192.168.40.0 0.0.0.255
permit 10.1.40.0 0.0.0.255
deny any
int g0/0
ip access-group vpn_gateway out

================================================
6. VPN
================================================
CentralRouter
==================
enable
conf t
license boot module c1900 technology-package securityk9

yes

exit
write

==================
RELOAD ROUTER!!!!!
==================
enable
conf t
aaa new-model
aaa authentication login VPNAUTH group radius local
aaa authorization network VPNAUTH local
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
ex
crypto isakmp client configuration group myciscogroup
key myciscogroup
pool VPNCLIENTS
netmask 255.255.255.0
ex
crypto ipsec transform-set 6 esp-3des esp-sha-hmac
crypto dynamic-map mymap 10
set transform-set 6
reverse-route
ex
crypto map mymap client authentication list VPNAUTH
crypto map mymap isakmp authorization list VPNAUTH
crypto map mymap client configuration address respond
crypto map mymap 10 ipsec-isakmp dynamic mymap
ip ssh version 1
spanning-tree mode pvst
int s0/0/0
crypto map mymap
ex
int vlan1
no ip address
shutdown
ip local pool VPNCLIENTS 201.1.100.100 201.1.100.150
ip route 201.1.100.0 255.255.255.0 10.1.40.2
radius-server host 192.168.40.200 auth-port 1645 key myciscovpn

CATATAN:
AAA SERVER
==================
IP ADDRESS PADA AAA SERVER: IP ADDRESS INTERFACE CENTRAL ROUTER YANG MENGARAH KE
DIRINYA
(int g0/0 dari central router = 192.168.40.1)

CentralRouter
==================
IP ADDRESS SEBAGAI HOST RADIUS SERVER: IP ADDRESS AAA SERVER (192.168.40.200)
dengan KEY pada AAA Server (myciscovpn)

VPN SERVER
==================
IP ADDRESS TES VPN: IP ADDRESS DARI CENTRAL ROUTER YANG MENGARAH KE DIRINYA
(int s0/0/0 dari central router = 10.1.40.1)