Vous êtes sur la page 1sur 129

Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-1

Objectives
Exploring the Functions of Routing p g g Understanding Binary Basics Constructing a Network Addressing Scheme Starting a Router C fi i a Ci Configuring Cisco R t Router Exploring the Packet Delivery Process Understanding Cisco Router Security Using the Cisco SDM Using a Cisco Router as a DHCP Server g Accessing Remote Devices
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-2

Lesson 1 Exploring the Functions of Routing


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-3

Routers

Cisco 2800 Series Router

Routers have th f ll i components: R t h the following t CPU Motherboard RAM ROM Routers have network adapters to which IP addresses are assigned. Routers may have the following two kinds of ports: Console: For the attachment of a terminal used for management Network: Different LAN or WAN media ports p Routers forward packets based upon a routing table.
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-4

Router Functions
RouterX# show ip route
[ ] D 192.168.1.0/24 [90/25789217] via 10.1.1.1

R 192.168.2.0/24 [120/4] via 10.1.1.2 O 192 168 3 0/24 [110/229840] via 10 1 1 3 192.168.3.0/24 i 10.1.1.3

1. Lets other routers know about changes 2. 2 Determines where to forward packets

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-5

Path Determination

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-6

Routing Tables

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-7

Routing Table Entries


Directly connected: Router attaches to this network Static routing: Entered manually by a system administrator Dynamic routing: Learned by exchange of routing y g y g g information y y y Default route: Statically or dynamically learned; used when no explicit route to network is known

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-8

Routing Metrics

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-9

Distance Vector Routing Protocols

Passes periodic copies of routing table to neighbor routes and accumulates distance vectors
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-10

Link State Link-State Routing Protocols

After initial flood passes small event triggered link-state updates to all flood, event-triggered link state other routers
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-11

Lesson 2 Understanding Binary Basics


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-12

Decimal vs. Binary Numbers


Decimal numbers are represented by the numbers 0 through 9. Binary numbers are represented by a series of 1s and 0s.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-13

Decimal and Binary Numbers Chart


Base-10 Decimal Conversion63204829
MSB Baseexponent Column Value Decimal Weight Column Weight 107 6 10000000 60000000 106 3 105 2 104 0 0 103 4 4000 102 8 100 800 101 2 10 20 LSB 100 9 1 9

1000000 100000 10000 1000 3000000 200000

60000000 + 3000000 + 200000 + 0 + 4000 + 800 + 20 + 9 = 63204829

Base-2 Binary Conversion11101001 (233)


MSB Baseexponent Column Value Decimal Weight Column Value 27 1 128 128 26 1 64 64 25 1 32 32 24 0 16 0 23 1 8 8 22 0 4 0 21 0 2 0 LSB 20 1 1 1

128 + 64 + 32 + 0 + 8 + 0 + 0 + 1 = 233
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-14

Powers of 2

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-15

Decimal to Binary Decimal-to-Binary Conversion

35 35 35 35
2007 Cisco Systems, Inc. All rights reserved.

= 25 + 21 + 20 = (32 * 1) + (2 * 1) + (1 * 1) = 0 + 0 + 1 + 0 + 0 + 0 +1 + 1 = 00100011
ICND1 v1.04-16

Binary to Decimal Binary-to-Decimal Conversion

1 0 1 1 1 0 0 1 = (128 * 1) + (64 * 0) + (32 * 1) + (16 * 1) + (8 * 1) + (4 * 0) + (2 * 0) + (1 * 1) 1 0 1 1 1 0 0 1 = 128 + 0 + 32 + 16 + 8 + 0 + 0 + 1 1 0 1 1 1 0 0 1 = 185


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-17

Lesson 3 Constructing a Network Addressing Scheme


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-18

Flat Topology

Problems
All devices share the same bandwidth. All devices share the same broadcast domain. It is difficult to apply a security policy.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-19

Subnetworks

Smaller networks are easier to manage. Overall traffic is reduced. You can more easily apply network security policies.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-20

What a Subnet Mask Does


Tells the router the number of bits to look at when routing Defines the number of bits that are significant Used as a measuring tool, not to hide anything

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-21

Possible Subnets and Hosts for a Class C Network

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-22

Possible Subnets and Hosts for a Class B Network

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-23

Possible Subnets and Hosts for a Class A Network

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-24

End System Subnet Mask Operation

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-25

How Routers Use Subnet Masks

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-26

Applying the Subnet Address Scheme

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-27

Octet Values of a Subnet Mask

Subnet masks, like IP addresses are represented in the dotted decimal masks addresses, format like 255.255.255.0
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-28

Default Subnet Masks


Example Class A address (decimal): Example Class A address (binary): Default Class A mask (binary): Default Class A mask (decimal): Default classful prefix length: Example Class B address (decimal): Example Class B address (binary): Default Class B mask (binary): Default Class B mask (decimal): Default classful prefix length: Example Class C address (decimal): Example Class C address (binary): Default Class C mask (binary): Default Class C mask (decimal): Default classful prefix length:
2007 Cisco Systems, Inc. All rights reserved.

10.0.0.0 00001010.00000000.00000000.00000000 11111111.00000000.00000000.00000000 255.0.0.0 /8 172.16.0.0 172 16 0 0 10010001.10101000.00000000.00000000 11111111.11111111.00000000.00000000 255.255.0.0 255 255 0 0 /16 192.168.42.0 192 168 42 0 11000000.10101000.00101010.00000000 11111111.11111111.11111111.00000000 255.255.255.0 255 255 255 0 /24
ICND1 v1.04-29

Procedure for Implementing Subnets


1. Determine the IP address assigned by the registry authority. 2. Based on the organizational and administrative structure, determine the number of subnets required. 3. Based on the address class and required number of subnets, determine the number of bits you need to borrow from the host ID. h t ID 4. Determine the binary and decimal value of the subnet mask. 5. 5 Apply the subnet mask to the network IP address to determine the subnet and host addresses. 6. Assign subnet addresses to specific interfaces.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-30

Eight Easy Steps for Determining Subnet Addresses

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-31

Eight Easy Steps for Determining Subnet Addresses (Cont.)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-32

Example: Applying a Subnet Mask for a Class C Address

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-33

Example: Applying a Subnet Mask for a Class B Address

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-34

Example: Applying a Subnet Mask for a Class A Address

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-35

Lesson 4 Starting a Router


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-36

Initial Startup of the Cisco Router


System startup routines initiate router software Router falls back to startup alternatives if needed

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-37

Bootup Output from the Router

Unconfigured vs. C fi U fi d Configured R t d Router


2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-38

Setup: The Initial Configuration Dialog

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-39

Setup Interface Summary

Any interface listed with OK? value "NO" does not have a valid configuration

Interface FastEthernet0/0 FastEthernet0/1 Serial0/0/0 Serial0/0/1

IP-Address unassigned unassigned unassigned unassigned

OK? Method Status NO NO NO NO unset unset unset unset up up up down

Protocol up up up down

Interfaces Found During Startup

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-40

Setup Initial Global Parameters

Configuring global parameters: Enter host name [Router]:RouterX The enable secret is a password used to protect access to privileged EC and configuration modes. This password, after entered, becomes encrypted in the configuration configuration. Enter enable secret: Cisco1 The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password: SanFran3 The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: Sanj0se Configure SNMP Network Management? [no]:

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-41

Setup Initial Protocol Configurations

Configure IP? [y ] g [yes]: Configure RIP routing? [yes]: no Configure CLNS? [no]: Configure bridging? [no]:

Depending on your software revision this text may appear.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-42

Setup Interface Parameters


Configuring interface parameters: Do you want to configure FastEthernet0/0 interface? [yes]: Use the 100 Base-TX (RJ-45) connector? [yes]: Operate in full-duplex mode? [no]: Configure IP on this interface? [yes]: IP address for this interface: 10.2.2.11 Subnet mask for this interface [255.0.0.0] : 255.255.255.0 Class A network is 10 0 0 0 24 subnet bits; mask is /24 10.0.0.0, Do you want to configure FastEthernet0/1 Do you want to configure Serial0/0/0 Do you want to configure Serial0/0/1 interface? [yes]: no

interface? [yes]: no interface? [yes]: no

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-43

Cisco AutoSecure

Would you like to go through AutoSecure configuration? [yes]: no AutoSecure di l t S dialog can b started l t be t t d later using " t secure" C i "auto " CLI

Depending on your software revision, this text may appear.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-44

Setup Script Review and Use


The following configuration command script was created: hostname RouterX enable secret 5 $1$aNMG$kV3mxjlWDRGXmfwjEBNAf1 enable password cisco line vty 0 4 interface FastEthernet0/0 password sanjose media-type 100BaseX no snmp-server half-duplex ! ip address 10.2.2.11 255.255.255.0 ip routing no mop enabled no clns routing ! no bridge 1 g interface F tEth i t f FastEthernet0/1 t0/1 ! shutdown no ip address ! interface Serial0/0/0 shutdown no ip address ! interface Serial0/0/1 shutdown no ip address dialer-list 1 protocol ip permit ! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. config [2] Save this configuration to nvram and exit. Enter your selection [2]: 2
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-45

Logging in to the Cisco Router

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-46

Router User-Mode Command List User Mode

RouterX>? Exec commands: access-enable access-profile clear connect disable disconnect enable exit help lat lock login logout -- More --

Create a temporary Access-List entry p y y Apply user-profile to interface Reset functions Open a terminal connection Turn off privileged commands p g Disconnect an existing network connection Turn on privileged commands Exit from the EXEC Description of the interactive help system Open a lat connection Lock the terminal Log in as a particular user Exit from the EXEC

You can abbreviate a command to the fewest characters that make a unique character string.
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-47

Router Privileged Mode Command List Privileged-Mode


RouterX#? Exec commands: access-enable access-profile access-template bfe cd clear clock configure connect copy debug delete dir disable disconnect enable erase exit help -- More --

Create a temporary Access-List entry Apply user-profile to interface Create a temporary Access-List entry For manual emergency modes setting Change current directory Reset functions Manage the system clock g y Enter configuration mode Open a terminal connection Copy from one file to another Debugging functions (see also 'undebug') Delete a file List files on a filesystem Turn off privileged commands Disconnect an existing network connection Turn on privileged commands p g Erase a filesystem Exit from the EXEC Description of the interactive help system

You can complete a command string by entering the unique character string, then pressing the Tab key.
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-48

show version Command


Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(12), RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright ( ) 1986 2006 b Ci C i ht (c) 1986-2006 by Cisco S t Systems, I Inc. Compiled Fri 17-Nov-06 12:02 by prod_rel_team ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1) RouterX uptime is 2 days, 21 hours, 15 minutes System returned to ROM by power-on System image file is "flash:c2800nm-advipservicesk9-mz.124-12.bin" This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third party third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Cisco 2811 (revision 53.50) with 249856K/12288K bytes of memory. Processor board ID FTX1107A6BB 2 F tEth FastEthernet i t f t interfaces 2 Serial(sync/async) interfaces 1 Virtual Private Network (VPN) Module DRAM configuration is 64 bits wide with parity enabled. 239K bytes of non-volatile configuration memory. 62720K bytes of ATA CompactFlash (Read/Write) Configuration register is 0x2102 RouterX#
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-49

Lesson 5 Configuring a Cisco Router


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-50

Overview of Router Modes

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-51

Saving Configurations

RouterX# RouterX#copy running-config startup-config Destination fil D ti ti filename [ t t [startup-config]? fi ]? Building configuration RourterX#

Copies the current configuration to NVRAM

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-52

Configuring Router Identification

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-53

Console Line Console-Line Commands

RouterX(config)#line console 0 RouterX(config-line)#exec-timeout 20 30 ( fi li )# i

Modifies console session timeout

RouterX(config)#line console 0 RouterX(config-line)#logging RouterX(config line)#logging synchronous

Redisplays interrupted console input

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-54

Configuring an Interface
RouterX(config)#interface type number RouterX(config-if)#

type i l d serial, ethernet, token ring, fddi h i includes i l h k i fddi, hssi, loopback, dialer, null, async, atm, bri, tunnel, and so on number is used to identify individual interfaces
RouterX(config)#interface type slot/port RouterX(config-if)#

For modular routers, selects an interface


RouterX(config-if)#exit

Quits from current interface configuration mode

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-55

Configuring an Interface Description


RouterX(config-if)# description string

string i a comment or a d i is description to h l you remember i i help b what is attached to this interface. The maximum number of characters for the string argument is 238.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-56

Disabling or Enabling an Interface

RouterX#configure terminal RouterX(config)#interface serial 0 RouterX(config if)#shutdown RouterX(config-if)#shutdown %LINK-5-CHANGED: Interface Serial0, changed state to administratively down %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to down

Administratively turns off an interface Ad i i t ti l t ff i t f


RouterX#configure terminal RouterX(config)#interface serial 0 RouterX(config-if)#no shutdown %LINK-3-UPDOWN: Interface Serial0, changed state to up %LINEPROTO-5-UPDOWN: %LINEPROTO 5 UPDOWN: Line Protocol on Interface Serial0, changed state to up Serial0

Enables an interface that is administratively shut down

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-57

Configuring IP Addresses

Unique addressing allows communication between end stations b t d t ti Path choice is based on destination address

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-58

Router show interfaces Command


RouterX#show interfaces Ethernet0 is up, line protocol is up Hardware is Lance, address is 00e0.1e5d.ae2f (bia 00e0.1e5d.ae2f) Internet address is 10.1.1.11/24 MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255 Encapsulation ARPA, loopback not set, keepalive set (10 sec) ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:07, output 00:00:08, output hang never Last clearing of "show interface" counters never Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 0/75, 0 drops 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec 0 packets/sec bits/sec, 81833 packets input, 27556491 bytes, 0 no buffer Received 42308 broadcasts, 0 runts, 0 giants, 0 throttles 1 input errors, 0 CRC, 0 frame, 0 overrun, 1 ignored, 0 abort 0 input packets with dribble condition detected 55794 packets output, 3929696 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 4 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out failures

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-59

Interpreting the Interface Status

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-60

Verifying a Serial Interface Configuration

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-61

Lesson 6 Exploring the Packet Delivery Process


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-62

Layer 2 Addressing

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-63

Layer 3 Addressing

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-64

Host to Host Host-to-Host Packet Delivery (1 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-65

Host to Host Host-to-Host Packet Delivery (2 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-66

Host to Host Host-to-Host Packet Delivery (3 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-67

Host to Host Host-to-Host Packet Delivery (4 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-68

Host to Host Host-to-Host Packet Delivery (5 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-69

Host to Host Host-to-Host Packet Delivery (6 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-70

Host to Host Host-to-Host Packet Delivery (7 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-71

Host to Host Host-to-Host Packet Delivery (8 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-72

Host to Host Host-to-Host Packet Delivery (9 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-73

Host to Host Host-to-Host Packet Delivery (10 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-74

Host to Host Host-to-Host Packet Delivery (11 of 17)


Destination 192.168.3.0/24 192.168.4.0/24 Next Hop Connected Connected Interface fa 0/0 fa 0/1

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-75

Host to Host Host-to-Host Packet Delivery (12 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-76

Host to Host Host-to-Host Packet Delivery (13 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-77

Host to Host Host-to-Host Packet Delivery (14 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-78

Host to Host Host-to-Host Packet Delivery (15 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-79

Host to Host Host-to-Host Packet Delivery (16 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-80

Host to Host Host-to-Host Packet Delivery (17 of 17)

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-81

Using the show ip arp Command g p p

Router# show ip arp

Protocol t l Internet Internet Internet Internet Internet Internet

Address dd 172.69.233.229 172.69.233.218 172.69.233.19 172.69.233.309 172 69 233 309 172.19.168.11 172.19.168.254

Age(min) ( i ) 9

Hardware Addr d dd 0000.0c59.f892 0000.0c07.ac00 0000.0c63.1300 0000.0c36.6965 0000 0c36 6965 0000.0c63.1300 0000.0c36.6965

Type ARPA ARPA ARPA ARPA ARPA ARPA

Interface t f Ethernet0/0 Ethernet0/0 Ethernet0/0 Ethernet0/0 Ethernet0/0 Ethernet0/0

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-82

p g ping
Router# R t #

ping [[protocol {host-name | system-address}]

To diagnose basic network connectivity use the ping command connectivity, in user EXEC or privileged EXEC mode.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-83

traceroute
Router# R t #

traceroute [protocol] destination

To discover the routes that packets will actually take when traveling to their destination address, use the traceroute command in user EXEC or privileged EXEC mode.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-84

Lesson 7 Understanding Cisco Router Security


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-85

Common Threats to Physical Installations

Hardware threats Environmental th t E i t l threats Electrical threats Maintenance threats

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-86

Configuring a Router Password

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-87

Configuring the Login Banner


Defines and enables a customized banner to be displayed before the username and password login prompts

RouterX# banner login " Access for authorized users only. Please enter your username and password. "

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-88

Telnet vs. SSH Access


Telnet Most common access method Insecure SSH Encrypted IP domain must be defined key must be generated
!--- The username command create the username and password for the SSH session username cisco password 0 cisco ip domain-name mydomain.com crypto key generate rsa ip ssh version 2 line vty 0 4 login local transport input ssh

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-89

Lesson 8 Using the Cisco SDM


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-90

Cisco Router and Security Device Manager

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-91

What Is Cisco SDM?


Embedded web-based management tool Provides intelligent wizards to enable quicker and easier deployments and does not require knowledge of Cisco IOS CLI or security expertise Tools for more advanced users: ACL editor VPN crypto map editor Cisco IOS CLI preview

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-92

Supported Cisco Routers and Cisco IOS Software Releases

Cisco SDM is supported on a number of Cisco router platforms and Cisco IOS Software releases. Always verify Cisco SDM router and Cisco IOS release support at www.cisco.com/go/sdm.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-93

Configuring Your Router to Support SDM


1. Enable the HTTP and HTTPS servers on your router. 2. Create a user account defined with privilege level 15 (enable privileges). 3. Configure SSH and Telnet for local login and privilege level 15.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-94

SDM Startup

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-95

Cisco SDM Main Window Layout and Navigation


Menu Bar

Toolbar Router Information

Configuration Overview

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-96

Cisco SDM Wizards


LAN configuration: C fi fi ti Configure LAN i t f interfaces and d DHCP WAN configuration: Configure PPP, Frame Relay, and g g y HDLC WAN interfaces Firewall VPN Security audit: Perform a router security audit, with a button for router lockdown IPS: Intrusion prevention system QoS: Quality of service

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-97

Lesson 9 Using a Cisco Router as a DHCP Server


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-98

Understanding DHCP
DHCP is built on a client-server model, as follows: The DHCP server hosts allocate network addresses and deliver configuration parameters. The term "client" refers to a host requesting initialization parameters from a DHCP server. DHCP supports these three mechanisms for IP address allocation: Automatic allocation; DHCP assigns a permanent IP address to a client. Dynamic allocation; DHCP assigns an IP address to a client for a limited period of time. Manual allocation; A client IP address is assigned by the network administrator, administrator and DHCP is used simply to convey the assigned address to the client. Dynamic allocation is the only that allows automatic reuse of an address that is no longer needed by the client to which it was assigned.
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-99

DHCP

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-100

Using a Router as a DHCP Server


Cisco IOS Software includes a full DHCP server implementation:
Assigns IP addresses from specified address pools within the router Can be configured to assign the IP address of these components: Domain Name System (DNS) server Default router

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-101

DHCP Server Using a Router

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-102

Additional Tasks

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-103

DHCP Pool

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-104

Checking the DHCP Configuration

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-105

DHCP Pool Status

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-106

Configuring a DHCP Server


Step 1. Define a range of addresses that DHCP is not to allocate. allocate

Step 2. Create the DHCP pool

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-107

Configuring a DHCP Server


Step 3. Configure the specifics of the pool.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-108

Configuring a DHCP Server


Example:

Disabling DHCP:
use the no service dhcp command.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-109

show ip dhcp conflict p p

RouterX# show ip dhcp conflict

IP address 172.16.1.32 172.16.1.64

Detection Method Ping Gratuitous ARP

Detection time Feb 16 2007 12:28 PM Feb 23 2007 08:12 AM

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-110

Verifying DHCP

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-111

Verifying DHCP

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-112

Configuring a DHCP Client

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-113

DHCP Relay
DHCP Problem

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-114

DHCP Relay

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-115

DHCP Relay

Broadcast

Broadcast

Helper address configuration that relays broadcasts to all servers on the segment. segment

RTA(config)#interface e0 RTA(config-if)#ip helper-address 172 24 1 255 RTA(config if)#ip helper address 172.24.1.255
But will RTA forward the broadcast?
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.04-116

Directed Broadcast

To allow all the nodes in the server farm to receive the broadcasts at Layer 2, e3 will need to be configured to forward directed broadcasts with the following command:

RTA(config)#interface e3 RTA(config-if)#ip directed-broadcast

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-117

DHCP Relay

L3 L2 Helper address configuration Broadca that relays broadcasts to all servers on the Broadca segment. segment st st RTA(config)#interface e0
RTA(config if)#ip helper address RTA(config-if)#ip helper-address 172.24.1.255 RTA(config)#interface e3
2007 Cisco Systems, Inc. All rights reserved.

RTA(config-if)#ip directed-broadcast

ICND1 v1.04-118

Lesson 10 Accessing Remote Devices


Module 4: LAN Connections

www.netpro.com.vn
2007 Cisco Systems, Inc. All rights reserved. ICND1 v1.01-119

Using Telnet to Connect to Remote Devices

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-120

Viewing Telnet Connections

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-121

Viewing SSH Connections

RouterB# show ssh Connection 0 Version 1.5 Encryption 3DES State Session Started Username guest

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-122

Suspending and Resuming a Telnet Session

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-123

Closing a Telnet Session

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-124

Using the ping and traceroute Commands

RouterX#ping 10.1.1.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5) round trip min/avg/max = 4/4/4 ms (5/5), round-trip RouterX#trace 192.168.101.101 Type escape sequence t abort. T to b t Tracing the route to 192.168.101.101 1 p1r1 (192.168.1.49) 20 msec 16 msec 16 msec 2 p1r2 (192 168 1 18) 48 msec * 44 msec 1 2 (192.168.1.18) RouterX

Tests the connectivity and path to a remote device

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-125

Module Summary
Cisco routers operate at Layer 3, and their function is path determination. Binary numbers are b Bi b based on th d the powers of 2 f 2. IP addressing: Dotted decimal representation of a binary string Identifies the network, subnet, and host Routers have a startup process where they test the hardware and load the operating system and configuration.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-126

Module Summary (Cont.)


Basic router configuration is usually done through the console port using CLI and consists of the host address and interface IP addressing. addressing Routers have hardware, environmental, electrical, and maintenance-related security threats similar to switches. Basic router security consists of a login banner and Telnet and SSH.

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-127

Module Summary (Cont.)


The Cisco IOS DHCP server is a full DHCP server that can be configured using Cisco SDM. Cisco IOS commands provide a set of tools for remote accessing Ci d id t ft l f t i and testing, as follows: Telnet e e SSH ping traceroute

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-128

2007 Cisco Systems, Inc. All rights reserved.

ICND1 v1.04-129

Vous aimerez peut-être aussi