Nagios, Nconf and Nrpe Debian/Ubuntu part 1/3

November 8, 2013 - 01:51 GNU/Linux no comments

Environment:
The only requirement for this guide is to have a debian or ubuntu

Install the necessary packages:
apt-get install wget build-essential apache2 php5-gd wget libgd2-xpm libgd2-xpm-dev libapache2-mod-php5

Download nagios and the plugin:

wget http://sourceforge.net/projects/nagios/files/nagios-4.x/nagios-4.0.1/nagios-4.0.1.tar.gz
wget https://www.nagios-plugins.org/download/nagios-plugins-1.5.tar.gz

# useradd nagios
groupadd nagcmd
usermod -a -G nagcmd nagios

tar zxvf nagios-4.0.1.tar.gz

Note: this Nagios version (4.0.1) has a bug in the map (statusmap.c). To solve this problem download and install the following patch before you start Nagios installation

Download the patch from this link:
http://tracker.nagios.org/view.php?id=470

Download the file: nagios-4-statusmap-2.patch

To apply the patch execute this command:

patch -p0 --verbose < patch_name

The patch fixes 2 files:
directory_nagios/cgi/statusmap.c
directory_nagios/common/objects.c

Even if this patch is for version 4.0.0, it also works for 4.0.1.
At first try the patch will fail, just manually enter the path to the source of nagios 4.0.1.

Now it is possible to install Nagios:

cd nagios-4.0.1

./configure --with-nagios-group=nagios --with-command-group=nagcmd --with-mail=/usr/bin/sendmail

make all
make install
make install-init
make install-config
make install-commandmode
make install-webconf

cp -R contrib/eventhandlers/ /usr/local/nagios/libexec/
chown -R nagios:nagios /usr/local/nagios/libexec/eventhandlers
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

There is another bug in Nagios, namely in: /etc/init.d/nagios
you have to change everything with a "hack" code.
Download the code from this website and copy it inside /etc/init.d/nagios
http://support.nagios.com/forum/viewtopic.php?f=7&t=12038&start=20#p64091

Install daemon
apt-get install daemon

Now it is possible to start nagios

/etc/init.d/nagios start

You can create the admin user for nagios:

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

The plugin:

apt-get install libssl-dev

tar zxvf nagios-plugins-1.5.tar.gz

cd nagios-plugins-1.5

./configure --with-nagios-user=nagios --with-nagios-group=nagios
make
make install

ln -s /etc/init.d/nagios /etc/rcS.d/S99nagios

Now if everything went well you should have your Nagios running on the browser:

http://<your.nagios.server.ip>/nagios

Solution PT Activity 8.6.1: Packet Tracer Skills Integration Challenge

August 25, 2013 - 18:41 Cisco 2 comments

Considerations:
1) Task 3: the pool name is not specified but should be called NAT_LIST or is not be possible to get 100%
2) Task 7: the VTP domain is called XYZCORP (capital letters) but the right domain is xyzcorp
3) Task 11 firewall ACL: the server xyzcorp is 209.165.200.246 and to permit port web access the code is "permit tcp any host 209.165.200.246 eq www" however to get 100% the code is "permit tcp any host 209.165.200.244 eq www" but is wrong and is not be possible to access the web server.

1: Configure Frame Relay in a Hub-and-Spoke Topology
Step 1. Configure the Frame Relay core.
Use the addressing tables and the following requirements.
HQ is the hub router. B1, B2, and B3 are the spokes.
HQ uses a point-to-point subinterface for each of the Branch routers.
B3 must be manually configured to use IETF encapsulation.
The LMI type must be manually configured as q933a for HQ, B1, and B2. B3 uses ANSI.

HQ
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname HQ
HQ(config)#int s0/0/0
HQ(config-if)#encapsulation frame-relay
HQ(config-if)#frame-relay lmi-type q933a
HQ(config-if)#no sh
HQ(config-if)#int s0/0/0.41 point-to-point
HQ(config-subif)#ip address 10.255.255.1 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 41
HQ(config-subif)#int s0/0/0.42 point-to-point
HQ(config-subif)#ip address 10.255.255.5 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 42
HQ(config-subif)#int s0/0/0.43 point-to-point
HQ(config-subif)#ip address 10.255.255.9 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 43
HQ(config-subif)#exit
HQ(config)#

B1
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B1
B1(config)#int s0/0/0
B1(config-if)#ip address 10.255.255.2 255.255.255.252
B1(config-if)#no sh
B1(config-if)#encapsulation frame-relay
B1(config-if)#frame-relay lmi-type q933a
B1(config-if)#exit
B1(config)#

B2
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B2
B2(config)#int s0/0/0
B2(config-if)#ip address 10.255.255.6 255.255.255.252
B2(config-if)#no sh
B2(config-if)#encapsulation frame-relay
B2(config-if)#frame-relay lmi-type q933a
B2(config-if)#exit
B2(config)#

B3
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B3
B3(config)#int s0/0/0
B3(config-if)#ip address 10.255.255.10 255.255.255.252
B3(config-if)#no sh
B3(config-if)#encapsulation frame
B3(config-if)#encapsulation frame-relay ietf
B3(config-if)#frame-relay lmi-type ansi
B3(config-if)#exit
B3(config)#

Step 2. Configure the LAN interface on HQ.

HQ
HQ(config)#int f0/0
HQ(config-if)#ip address 10.0.1.1 255.255.255.0
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#

Step 3. Verify that HQ can ping each of the Branch routers.

HQ#ping 10.255.255.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/9 ms

HQ#ping 10.255.255.6

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/10 ms

HQ#ping 10.255.255.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms

Task 2: Configure PPP with CHAP and PAP Authentication
Step 1. Configure the WAN link from HQ to ISP using PPP encapsulation and CHAP authentication.
The CHAP password is ciscochap.

HQ
HQ(config)#username ISP password ciscochap
HQ(config)#int s0/1/0
HQ(config-if)#ip address 209.165.201.1 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication chap
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#

Step 2. Configure the WAN link from HQ to NewB using PPP encapsulation and PAP authentication.
You need to connect a cable to the correct interfaces. HQ is the DCE side of the link. You choose the clock rate. The PAP password is ciscopap.

HQ
HQ(config)#username NewB password ciscopap
HQ(config)#int s0/0/1
HQ(config-if)#clock rate 64000
HQ(config-if)#ip address 10.255.255.253 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication pap
HQ(config-if)#no sh
HQ(config-if)#ppp pap sent-username HQ password ciscopap
HQ(config-if)#exit
HQ(config)#

Step 3. Verify that HQ can ping ISP and NewB.

HQ#ping 209.165.201.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/6 ms

HQ#ping 10.255.255.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms

Task 3: Configure Static and Dynamic NAT on HQ
Step 1. Configure NAT.
Use the following requirements:
Allow all addresses for the 10.0.0.0/8 address space to be translated.
XYZ Corporation owns the 209.165.200.240/29 address space. The pool, XYZCORP, uses addresses .241 through .245 with a /29 mask.
The www.xyzcorp.com website at 10.0.1.2 is registered with the public DNS system at IP address 209.165.200.246.

HQ
HQ(config)#int s0/1/0
HQ(config-if)#ip nat out
HQ(config-if)#int f0/0
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/1
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/0.41
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.42
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.43
HQ(config-subif)#ip nat in
HQ(config-subif)#exit
HQ(config)#
HQ(config)#ip access-list standard NAT_LIST
HQ(config-std-nacl)#permit 10.0.0.0 0.255.255.255
HQ(config-std-nacl)#exit
HQ(config)#ip nat pool XYZCORP 209.165.200.241 209.165.200.245 net 255.255.255.248
HQ(config)#ip nat inside source list NAT_LIST pool XYZCORP overload
HQ(config)#ip nat inside source static 10.0.1.2 209.165.200.246
HQ(config)#

Step 2. Verify NAT is operating by using extended ping.
From HQ, ping the serial 0/0/0 interface on ISP using the HQ LAN interface as the source address. This ping should succeed.
Verify that NAT translated the ping with the show ip nat translations command.

HQ#ping
Protocol [ip]:
Target IP address: 209.165.201.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: fastethernet0/0
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
Packet sent with a source address of 10.0.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms

HQ#sh ip nat translations
Pro  Inside global     Inside local       Outside local      Outside global
icmp 209.165.200.241:7110.0.1.1:71        209.165.201.2:71   209.165.201.2:71
icmp 209.165.200.241:7210.0.1.1:72        209.165.201.2:72   209.165.201.2:72
icmp 209.165.200.241:7310.0.1.1:73        209.165.201.2:73   209.165.201.2:73
icmp 209.165.200.241:7410.0.1.1:74        209.165.201.2:74   209.165.201.2:74
icmp 209.165.200.241:7510.0.1.1:75        209.165.201.2:75   209.165.201.2:75
—  209.165.200.246   10.0.1.2           —                —

Task 4: Configure Static and Default Routing
Step 1. Configure HQ with a default route to ISP and a static route to the NewB LAN.
Use the exit interface as an argument.

HQ(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0
HQ(config)#ip route 10.4.5.0 255.255.255.0 s0/0/1

Step 2. Configure the Branch routers with a default route to HQ.
Use the next-hop IP address as an argument.

B1
B1(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.1

B2
B2(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.5

B3
B3(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.9

Step 3. Verify connectivity beyond ISP.
All three NewB PCs and the NetAdmin PC should be able to ping the www.cisco.com web server.

NewB-PC1>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Request timed out.
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=21ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125

NewB-PC2>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

NewB-PC3>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

NetAdmin-PC>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

Task 5: Configure Inter-VLAN Routing
Step 1. Configure each Branch router for inter-VLAN routing.
Using the addressing table for Branch routers, configure and activate the LAN interface for inter-VLAN routing. VLAN 99 is the native VLAN.

B1(config)#interface f0/0
B1(config-if)#no sh
B1(config-if)#exit
B1(config)#int f0/0.10
B1(config-subif)#encapsulation dot1Q 10
B1(config-subif)#ip address 10.1.10.1 255.255.255.0
B1(config-subif)#int f0/0.20
B1(config-subif)#encapsulation dot1Q 20
B1(config-subif)#ip address 10.1.20.1 255.255.255.0
B1(config-subif)#int f0/0.30
B1(config-subif)#encapsulation dot1Q 30
B1(config-subif)#ip address 10.1.30.1 255.255.255.0
B1(config-subif)#int f0/0.88
B1(config-subif)#encapsulation dot1Q 88
B1(config-subif)#ip address 10.1.88.1 255.255.255.0
B1(config-subif)#int f0/0.99
B1(config-subif)#encapsulation dot1Q 99 native
B1(config-subif)#ip address 10.1.99.1 255.255.255.0
B1(config-subif)#exit
B1(config)#

B2(config)#interface f0/0
B2(config-if)#no sh
B2(config-if)#exit
B2(config)#int f0/0.10
B2(config-subif)#encapsulation dot1Q 10
B2(config-subif)#ip address 10.2.10.1 255.255.255.0
B2(config-subif)#int f0/0.20
B2(config-subif)#encapsulation dot1Q 20
B2(config-subif)#ip address 10.2.20.1 255.255.255.0
B2(config-subif)#int f0/0.30
B2(config-subif)#encapsulation dot1Q 30
B2(config-subif)#ip address 10.2.30.1 255.255.255.0
B2(config-subif)#int f0/0.88
B2(config-subif)#encapsulation dot1Q 88
B2(config-subif)#ip address 10.2.88.1 255.255.255.0
B2(config-subif)#int f0/0.99
B2(config-subif)#encapsulation dot1Q 99 native
B2(config-subif)#ip address 10.2.99.1 255.255.255.0
B2(config-subif)#exit
B2(config)#

B3(config)#interface f0/0
B3(config-if)#no sh
B3(config-if)#exit
B3(config)#int f0/0.10
B3(config-subif)#encapsulation dot1Q 10
B3(config-subif)#ip address 10.3.10.1 255.255.255.0
B3(config-subif)#int f0/0.20
B3(config-subif)#encapsulation dot1Q 20
B3(config-subif)#ip address 10.3.20.1 255.255.255.0
B3(config-subif)#int f0/0.30
B3(config-subif)#encapsulation dot1Q 30
B3(config-subif)#ip address 10.3.30.1 255.255.255.0
B3(config-subif)#int f0/0.88
B3(config-subif)#encapsulation dot1Q 88
B3(config-subif)#ip address 10.3.88.1 255.255.255.0
B3(config-subif)#int f0/0.99
B3(config-subif)#encapsulation dot1Q 99 native
B3(config-subif)#ip address 10.3.99.1 255.255.255.0
B3(config-subif)#exit
B3(config)#

Step 2. Verify routing tables.
Each Branch router should now have six directly connected networks and one static default route.

B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
       i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
       * – candidate default, U – per-user static route, o – ODR
       P – periodic downloaded static route

Gateway of last resort is 10.255.255.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C       10.1.10.0/24 is directly connected, FastEthernet0/0.10
C       10.1.20.0/24 is directly connected, FastEthernet0/0.20
C       10.1.30.0/24 is directly connected, FastEthernet0/0.30
C       10.1.88.0/24 is directly connected, FastEthernet0/0.88
C       10.1.99.0/24 is directly connected, FastEthernet0/0.99
C       10.255.255.0/30 is directly connected, Serial0/0/0
S*   0.0.0.0/0 [1/0] via 10.255.255.1
B1#

Task 6: Configure and Optimize EIGRP Routing
Step 1. Configure HQ, B1, B2, and B3 with EIGRP.
Use AS 100.
Disable EIGRP updates on appropriate interfaces.
Manually summarize EIGRP routes so that each Branch router only advertises the 10.X.0.0/16 address space to HQ.
Note: Packet Tracer does not accurately simulate the benefit of EIGRP summary routes. Routing tables will still show all subnets, even though you correctly configured the manual summary.

HQ
HQ(config)#router eigrp 100
HQ(config-router)#passive-interface s0/1/0
HQ(config-router)#passive-interface s0/0/1
HQ(config-router)#passive-interface fa0/0
HQ(config-router)#network 10.0.0.0
HQ(config-router)# no auto-summary

B1
B1(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B1(config-router)#network 10.0.0.0
B1(config-router)# no auto-summary
B1(config-router)#int s0/0/0
B1(config-if)#ip summary-address eigrp 100 10.1.0.0 255.255.0.0

B2
B2(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B2(config-router)#network 10.0.0.0
B2(config-router)#no auto-summary
B2(config-router)#int s0/0/0
B2(config-if)#ip summary-address eigrp 100 10.2.0.0 255.255.0.0

B3
B3(config)#router eigrp 100
B3(config-router)#passive-interface fa0/0.10
B3(config-router)#passive-interface fa0/0.20
B3(config-router)#passive-interface fa0/0.30
B3(config-router)#passive-interface fa0/0.99
B3(config-router)#network 10.0.0.0
B3(config-router)#no auto-summary
B3(config-router)#int s0/0/0
B3(config-if)#ip summary-address eigrp 100 10.3.0.0 255.255.0.0

Step 2. Verify routing tables and connectivity.
HQ and the Branch routers should now have complete routing tables.
The NetAdmin PC should now be able to ping each VLAN subinterface on each Branch router.

B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
       i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
       * – candidate default, U – per-user static route, o – ODR
       P – periodic downloaded static route

Gateway of last resort is 10.255.255.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 14 subnets, 3 masks
D       10.0.1.0/24 [90/2172416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.1.0.0/16 is a summary, 00:09:24, Null0
C       10.1.10.0/24 is directly connected, FastEthernet0/0.10
C       10.1.20.0/24 is directly connected, FastEthernet0/0.20
C       10.1.30.0/24 is directly connected, FastEthernet0/0.30
C       10.1.88.0/24 is directly connected, FastEthernet0/0.88
C       10.1.99.0/24 is directly connected, FastEthernet0/0.99
D       10.2.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.3.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.4.5.0/24 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
C       10.255.255.0/30 is directly connected, Serial0/0/0
D       10.255.255.4/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.255.255.8/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.255.255.252/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
S*   0.0.0.0/0 [1/0] via 10.255.255.1
B1#

NetAdmin-PC>ping 10.3.10.1

Pinging 10.3.10.1 with 32 bytes of data:

Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254
Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254

Ping statistics for 10.3.10.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 18ms, Average = 17ms

NetAdmin-PC>ping 10.3.20.1

Pinging 10.3.20.1 with 32 bytes of data:

Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=18ms TTL=254
Reply from 10.3.20.1: bytes=32 time=16ms TTL=254

Ping statistics for 10.3.20.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 15ms, Maximum = 18ms, Average = 16ms

NetAdmin-PC>ping 10.3.30.1

Pinging 10.3.30.1 with 32 bytes of data:

Reply from 10.3.30.1: bytes=32 time=18ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=18ms TTL=254

Ping statistics for 10.3.30.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 18ms, Average = 17ms

NetAdmin-PC>ping 10.3.88.1

Pinging 10.3.88.1 with 32 bytes of data:

Reply from 10.3.88.1: bytes=32 time=20ms TTL=254
Reply from 10.3.88.1: bytes=32 time=17ms TTL=254
Reply from 10.3.88.1: bytes=32 time=16ms TTL=254
Reply from 10.3.88.1: bytes=32 time=20ms TTL=254

Ping statistics for 10.3.88.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 16ms, Maximum = 20ms, Average = 18ms

NetAdmin-PC>ping 10.3.99.1

Pinging 10.3.99.1 with 32 bytes of data:

Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=16ms TTL=254

Ping statistics for 10.3.99.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 14ms, Maximum = 16ms, Average = 14ms

Task 7: Configure VTP, Trunking, the VLAN Interface, and VLANs
The following requirements apply to all three Branches. Configure one set of three switches. Then use the scripts for those switches on the other two sets of switches.
Step 1. Configure Branch switches with VTP.
BX-S1 is the VTP server. BX-S2 and BX-S3 are VTP clients.
The domain name is XYZCORP.  <– mistake all is lower character xyzcorp
The password is xyzvtp.

B1-S1
Switch>en
Switch#conf t
Switch(config)#hostname B1-S1
B1-S1(config)#vtp mode server
Device mode already VTP SERVER.
B1-S1(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B1-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S1(config)#

B1-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B1-S2
B1-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S2(config)#

B1-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B1-S3
B1-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S3(config)#

B2-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B2-S1
B2-S1(config)#vtp mode server
Device mode already VTP SERVER.
B2-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S1(config)#

B2-S2
Switch>en
Switch#conf t
Switch(config)#hostname B2-S2
B2-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S2(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B2-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S2(config)#

B2-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B2-S3
B2-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S3(config)#

B3-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S1
B3-S1(config)#vtp mode server
Device mode already VTP SERVER.
B3-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S1(config)#

B3-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S2
B3-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S2(config)#

B3-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S3
B3-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S3(config)#

Step 2. Configure trunking on BX-S1, BX-S2, and BX-S3.
Configure the appropriate interfaces in trunking mode and assign VLAN 99 as the native VLAN.

B1-S1
B1-S1(config)#int range fa0/1-5
B1-S1(config-if-range)#switchport trunk native vlan 99
B1-S1(config-if-range)#switchport mode trunk

B1-S2
B1-S2(config)#int range fa0/1-4
B1-S2(config-if-range)#switchport trunk native vlan 99
B1-S2(config-if-range)#switchport mode trunk

B1-S3
B1-S3(config)#int range fa0/1-4
B1-S3(config-if-range)#switchport trunk native vlan 99
B1-S3(config-if-range)#switchport mode trunk

B2-S1
B2-S1(config)#int range fa0/1-5
B2-S1(config-if-range)#switchport trunk native vlan 99
B2-S1(config-if-range)#switchport mode trunk

B2-S2
B2-S2(config)#int range fa0/1-4
B2-S2(config-if-range)#switchport trunk native vlan 99
B2-S2(config-if-range)#switchport mode trunk

B2-S3
B2-S3(config)#int range fa0/1-4
B2-S3(config-if-range)#switchport trunk native vlan 99
B2-S3(config-if-range)#switchport mode trunk

B3-S1
B3-S1(config)#int range fa0/1-5
B3-S1(config-if-range)#switchport trunk native vlan 99
B3-S1(config-if-range)#switchport mode trunk

B3-S2
B3-S2(config)#int range fa0/1-4
B3-S2(config-if-range)#switchport trunk native vlan 99
B3-S2(config-if-range)#switchport mode trunk

B3-S3
B3-S3(config)#int range fa0/1-4
B3-S3(config-if-range)#switchport trunk native vlan 99
B3-S3(config-if-range)#switchport mode trunk

Step 3. Configure the VLAN interface and default gateway on BX-S1, BX-S2, and BX-S3.

B1-S1(config)#ip default-gateway 10.1.99.1
B1-S2(config)#ip default-gateway 10.1.99.1
B1-S3(config)#ip default-gateway 10.1.99.1
B2-S1(config)#ip default-gateway 10.2.99.1
B2-S2(config)#ip default-gateway 10.2.99.1
B2-S3(config)#ip default-gateway 10.2.99.1
B3-S1(config)#ip default-gateway 10.3.99.1
B3-S2(config)#ip default-gateway 10.3.99.1
B3-S3(config)#ip default-gateway 10.3.99.1

B1-S1
B1-S1(config)#int vlan 99
B1-S1(config-if)#ip addr 10.1.99.21 255.255.255.0
B1-S1(config-if)#no shutdown

B1-S2
B1-S2(config)#int vlan 99
B1-S2(config-if)#ip addr 10.1.99.22 255.255.255.0
B1-S2(config-if)#no shutdown

B1-S3
B1-S3(config)#int vlan 99
B1-S3(config-if)#ip addr 10.1.99.23 255.255.255.0
B1-S3(config-if)#no shutdown

B2-S1
B2-S1(config)#int vlan 99
B2-S1(config-if)#ip addr 10.2.99.21 255.255.255.0
B2-S1(config-if)#no shutdown

B2-S2
B2-S2(config)#int vlan 99
B2-S2(config-if)#ip addr 10.2.99.22 255.255.255.0
B2-S2(config-if)#no shutdown

B2-S3
B2-S3(config)#int vlan 99
B2-S3(config-if)#ip addr 10.2.99.23 255.255.255.0
B2-S3(config-if)#no shutdown

B3-S1
B3-S1(config)#int vlan 99
B3-S1(config-if)#ip addr 10.3.99.21 255.255.255.0
B3-S1(config-if)#no shutdown

B3-S2
B3-S2(config)#int vlan 99
B3-S2(config-if)#ip addr 10.3.99.22 255.255.255.0
B3-S2(config-if)#no shutdown

B3-S3
B3-S3(config)#int vlan 99
B3-S3(config-if)#ip addr 10.3.99.23 255.255.255.0
B3-S3(config-if)#no shutdown

Step 4. Create the VLANs on BX-S1.
Create and name the VLANs listed in the VLAN Configuration and Port Mappings table on BX-S1 only. VTP advertises the new VLANs to BX-S1 and BX-S2.

B1-S1
B1-S1(config)#vlan 10
B1-S1(config-vlan)#name Admin
B1-S1(config-vlan)#vlan 20
B1-S1(config-vlan)#name Sales
B1-S1(config-vlan)#vlan 30
B1-S1(config-vlan)#name Production
B1-S1(config-vlan)#vlan 88
B1-S1(config-vlan)#name Wireless
B1-S1(config-vlan)#vlan 99
B1-S1(config-vlan)#name Mgmt&Native
B1-S1(config-vlan)#exit
B1-S1(config)#

B2-S1
B2-S1(config)#vlan 10
B2-S1(config-vlan)#name Admin
B2-S1(config-vlan)#vlan 20
B2-S1(config-vlan)#name Sales
B2-S1(config-vlan)#vlan 30
B2-S1(config-vlan)#name Production
B2-S1(config-vlan)#vlan 88
B2-S1(config-vlan)#name Wireless
B2-S1(config-vlan)#vlan 99
B2-S1(config-vlan)#name Mgmt&Native
B2-S1(config-vlan)#exit
B2-S1(config)#

B3-S1
B3-S1(config)#vlan 10
B3-S1(config-vlan)#name Admin
B3-S1(config-vlan)#vlan 20
B3-S1(config-vlan)#name Sales
B3-S1(config-vlan)#vlan 30
B3-S1(config-vlan)#name Production
B3-S1(config-vlan)#vlan 88
B3-S1(config-vlan)#name Wireless
B3-S1(config-vlan)#vlan 99
B3-S1(config-vlan)#name Mg&Native
B3-S1(config-vlan)#exit
B3-S1(config)#

Step 5. Verify that VLANs have been sent to BX-S2 and BX-S3.
Use the appropriate commands to verify that S2 and S3 now have the VLANs you created on S1. It may take a few minutes for Packet Tracer to simulate the VTP advertisements. A quick way to force the sending of VTP advertisements is to change one of the client switches to transparent mode and then back to client mode.

B1-S2#sh vtp passw
VTP Password: xyzvtp

B1-S2#sh vtp status
VTP Version                     : 2
Configuration Revision          : 10
Maximum VLANs supported locally : 255
Number of existing VLANs        : 10
VTP Operating Mode              : Client
VTP Domain Name                 : xyzcorp
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xE1 0xB3 0x4C 0x9C 0x8E 0×80 0x7E 0×28
Configuration last modified by 10.1.99.21 at 3-1-93 05:47:41

B1-S2#sh vlan

VLAN Name                             Status    Ports
—- ——————————– ——— ——————————-
1    default                          active    Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24
                                                Gig1/1, Gig1/2
10   Admin                            active    
20   Sales                            active    
30   Production                       active    
88   Wireless                         active    
99   Mgmt&Native                      active    
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

B1-S2# sh interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Fa0/1       on           802.1q         trunking      99
Fa0/2       on           802.1q         trunking      99
Fa0/3       on           802.1q         trunking      99
Fa0/4       on           802.1q         trunking      99

Port        Vlans allowed on trunk
Fa0/1       1-1005
Fa0/2       1-1005
Fa0/3       1-1005
Fa0/4       1-1005

Port        Vlans allowed and active in management domain
Fa0/1       1,10,20,30,88,99
Fa0/2       1,10,20,30,88,99
Fa0/3       1,10,20,30,88,99
Fa0/4       1,10,20,30,88,99

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/1       1,10,20,30,88,99
Fa0/2       1,10,20,30,88,99
Fa0/3       1,10,20,30,88,99
Fa0/4       1,10,20,30,88,99
B1-S2#

NetAdmin-PC>ping 10.3.99.23

Pinging 10.3.99.23 with 32 bytes of data:

Request timed out.
Request timed out.
Reply from 10.3.99.23: bytes=32 time=23ms TTL=253
Reply from 10.3.99.23: bytes=32 time=21ms TTL=253

Task 8: Assign VLANs and Configure Port Security

Step 1. Assign VLANs to access ports.
Use the VLAN Configuration and Port Mappings table to complete the following requirements:
Configure access ports
Assign VLANs to the access ports

B1-S2
B1-S2(config)#int f0/6
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#int fa 0/16
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 30

B2-S2
B2-S2(config)#int f0/6
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#int fa 0/16
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#

B3-S2
B3-S2(config)#int f0/6
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#int fa 0/16
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 30

B1-S3
B1-S3(config)#int fa 0/7
B1-S3(config-if)#switchport mode access
B1-S3(config-if)#switchport access vlan 88

B2-S3
B2-S3(config)#int fa 0/7
B2-S3(config-if)#switchport mode access
B2-S3(config-if)#switchport access vlan 88

B3-S3
B3-S3(config)#int fa 0/7
B3-S3(config-if)#switchport mode access
B3-S3(config-if)#switchport access vlan 88

Step 2. Configure port security.
Use the following policy to establish port security on the BX-S2 access ports:
Allow only one MAC address
Configure the first learned MAC address to "stick" to the configuration
Set the port to shut down if there is a security violation

B1-S2
B1-S2(config)#int fa0/6
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/16
B1-S2(config-if)#switchport access vlan 30
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown

B2-S2
B2-S2(config)#int fa0/6
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/16
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown

B3-S2
B3-S2(config)#int fa0/6
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/16
B3-S2(config-if)#switchport access vlan 30
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown

Step 3. Verify VLAN assignments and port security.
Use the appropriate commands to verify that access VLANs are correctly assigned and that the port security policy has been enabled.

B1-S2#show port-security interface f0/6
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 0
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0000.0000.0000:0
Security Violation Count   : 0

Task 9: Configure STP
Step 1. Configure BX-S1 as the root bridge.
Set the priority level to 4096 on BX-S1 so that these switches are always the root bridge for all VLANs.

B1-S1(config)#spanning-tree vlan 1-1001 priority 4096
B2-S1(config)#spanning-tree vlan 1-1001 priority 4096
B3-S1(config)#spanning-tree vlan 1-1001 priority 4096

Step 2. Configure BX-S3 as the backup root bridge.
Set the priority level to 8192 on BX-S3 so that these switches are always the backup root bridge for all VLANs.

B1-S3(config)#spanning-tree vlan 1-1001 priority 8192
B2-S3(config)#spanning-tree vlan 1-1001 priority 8192
B3-S3(config)#spanning-tree vlan 1-1001 priority 8192

Step 3. Verify that BX-S1 is the root bridge.

B1-S1#sh spanning-tree
VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    4097
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4097  (priority 4096 sys-id-ext 1)
             Address     00D0.BA3D.2C94
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
—————- —- — ——— ——– ——————————–
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p
Fa0/3            Desg FWD 19        128.3    P2p
Fa0/4            Desg FWD 19        128.4    P2p
Fa0/5            Desg FWD 19        128.5    P2p

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    4106
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0020
  Spanning tree enabled protocol ieee
  Root ID    Priority    4116
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0030
  Spanning tree enabled protocol ieee
  Root ID    Priority    4126
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0088
  Spanning tree enabled protocol ieee
  Root ID    Priority    4184
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0099
  Spanning tree enabled protocol ieee
  Root ID    Priority    4195
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…

Task 10: Configure DHCP
Step 1. Configure DHCP pools for each VLAN.
On the Branch routers, configure DHCP pools for each VLAN using the following requirements:
Exclude the first 10 IP addresses in each pool for the LANs.
Exclude the first 24 IP addresses in each pool for the wireless LANs.
The pool name is BX_VLAN## where X is the router number and ## is the VLAN number.
Include the DNS server attached to the HQ server farm as part of the DHCP configuration.

B1
B1(config)#ip dhcp excluded-address 10.1.10.1 10.1.10.10
B1(config)#ip dhcp excluded-address 10.1.20.1 10.1.20.10
B1(config)#ip dhcp excluded-address 10.1.30.1 10.1.30.10
B1(config)#ip dhcp excluded-address 10.1.88.1 10.1.88.24

B2
B2(config)#ip dhcp excluded-address 10.2.10.1 10.2.10.10
B2(config)#ip dhcp excluded-address 10.2.20.1 10.2.20.10
B2(config)#ip dhcp excluded-address 10.2.30.1 10.2.30.10
B2(config)#ip dhcp excluded-address 10.2.88.1 10.2.88.24

B3
B3(config)#ip dhcp excluded-address 10.3.10.1 10.3.10.10
B3(config)#ip dhcp excluded-address 10.3.20.1 10.3.20.10
B3(config)#ip dhcp excluded-address 10.3.30.1 10.3.30.10
B3(config)#ip dhcp excluded-address 10.3.88.1 10.3.88.24

B1
B1(config)#ip dhcp pool B1_VLAN10
B1(dhcp-config)#network 10.1.10.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.10.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN20
B1(dhcp-config)#network 10.1.20.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.20.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN30
B1(dhcp-config)#network 10.1.30.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.30.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN88
B1(dhcp-config)#network 10.1.88.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.88.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#

B2
B2(config)#ip dhcp pool B2_VLAN10
B2(dhcp-config)#network 10.2.10.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.10.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN20
B2(dhcp-config)#network 10.2.20.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.20.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN30
B2(dhcp-config)#network 10.2.30.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.30.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN88
B2(dhcp-config)#network 10.2.88.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.88.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#

B3
B3(config)#ip dhcp pool B3_VLAN10
B3(dhcp-config)#network 10.3.10.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.10.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN20
B3(dhcp-config)#network 10.3.20.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.20.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN30
B3(dhcp-config)#network 10.3.30.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.30.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN88
B3(dhcp-config)#network 10.3.88.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.88.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#

Step 2. Configure the PCs to use DHCP.
Currently, the PCs are configured to use static IP addresses. Change this configuration to DHCP.

Step 3. Verify that the PCs and wireless routers have an IP address.
Step 4. Verify connectivity.
All PCs physically attached to the network should be able to ping the www.cisco.com web server.

B3-PC1>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Request timed out.
Reply from 209.165.202.134: bytes=32 time=29ms TTL=125
Reply from 209.165.202.134: bytes=32 time=31ms TTL=125
Reply from 209.165.202.134: bytes=32 time=23ms TTL=125

Task 11: Configure a Firewall ACL
Step 1. Verify connectivity from Outside Host.
The Outside Host PC should be able to ping the server at www.xyzcorp.com.

Outside host PC>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=9ms TTL=127
Reply from 209.165.202.134: bytes=32 time=7ms TTL=127
Reply from 209.165.202.134: bytes=32 time=6ms TTL=127
Reply from 209.165.202.134: bytes=32 time=8ms TTL=127

Step 2. Implement a basic firewall ACL.
Because ISP represents connectivity to the Internet, configure a named ACL called FIREWALL in the following order:
Allow inbound HTTP requests to the www.xyzcorp.com server.
Allow only established TCP sessions from ISP and any source beyond ISP.
Allow only inbound ping replies from ISP and any source beyond ISP.
Explicitly block all other inbound access from ISP and any source beyond ISP.

HQ
HQ(config)#ip access-list extended FIREWALL
HQ(config-ext-nacl)#permit tcp any host 209.165.200.244 eq www
HQ(config-ext-nacl)#permit tcp any any established
HQ(config-ext-nacl)#permit icmp any any echo-reply
HQ(config-ext-nacl)#deny ip any any
HQ(config-ext-nacl)#exit
HQ(config)#int s0/1/0
HQ(config-if)#ip access-group FIREWALL in
HQ(config-if)#exit
HQ(config)#

Outside host PC>ping www.xyzcorp.com

Pinging 209.165.200.246 with 32 bytes of data:

Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.

Task 12: Configure Wireless Connectivity
Step 1. Verify the DHCP configuration.
Each BX-WRS router should already have IP addressing from the DHCP of the BX router for VLAN 88.

B1-WRS ip address 10.1.40.1 (click save settings)
B2-WRS ip address 10.2.40.1 (click save settings)
B2-WRS ip address 10.3.40.1 (click save settings)

Step 3. Configure the wireless network settings.
The SSIDs for the routers are BX-WRS_LAN where the X is the Branch router number.
The WEP key is 12345ABCDE

Wireless > Wireless security > security mode: WEP and key1: 12345ABCDE for all 3 routers
(click save settings)

Step 4. Configure the wireless routers for remote access.
Configure the administration password as cisco123 and enable remote management.

Step 5. Configure the BX-PC4 PCs to access the wireless network using DHCP.

Step 6. Verify connectivity and remote management capability.
Each wireless PC should be able to access the www.cisco.com web server.
Verify remote management capability by accessing the wireless router through the web browser.

From NetAdmin open Browser
access: http://10.1.88.25/
user: admin
password: cisco123

SSH and SCP without password

August 18, 2013 - 17:14 GNU/Linux no comments

This is the procedure to connect through ssh or run scp between serverA and serverB without a password.

Notice:
I am not responsible for any kind of damage. You choose to follow this guide at your own risk.

ServerA
First of all, you need to generate public and private keys.
WARNING! Make sure that you do not already have the keys, otherwise they will be replaced with the new ones. Check their presence in /root/.ssh/

Generation of the key:

root@kali:~# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): (press enter)
Enter same passphrase again: (press enter)
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
77:c2:b2:59:7e:48:e1:bd:a9:c8:24:eb:ec:9a:18:2e root@kali
The key's randomart image is:
+–[ RSA 2048]—-+
|                 |
|                 |
|          .      |
|         o o     |
|        S B o    |
|         O + o   |
|  .   . + o +    |
|E. o o = . o     |
| .o o+= o .      |
+—————–+

The RSA public key is contained in the file /root/.ssh/id_rsa.pub

root@kali:~# cat /root/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCRlQnl7KMpOviNWRf9ckQWeCx59nUpc3kiZMkd9aaAMRZaVmA8BYs3UvZRvLr7fcxKAyZPWLvSEbV5YiQqkwq7/mgpnG7UsVLjxG5q00UF/QrqT97Mzo4w1WX+6kTtPIaJwqyjXRb+dn3E8NhKuAGwyTVz5CB3zoa7NiWBG/f+c8gtAeJXreABAn3biv3FJkCFVfQLBFWT90a/C3Da9qoRhqUlYqwn06NCrlsG1zzDy0ag5V7cxIkrRrEFiLTS/fsdSqEqmBCZGI2enSZYhmaCG11p5n0HMnjizPC3BxVEcD7UrZn5CizkVw0FqXCe54b4WLtFPfjR4Mu2th1hyCr root@kali

Copy the key in the clipboard.

ServerB
Login to the serverB as root and add the serverA RSA public key to /root/.ssh/authorized_keys file.

root@serverB:~# vi /root/.ssh/authorized_keys
Paste the public key inside this file. If there is another key file, just add it in the next line.

Here is an example of how authorized_keys should look like:
root@serverB:~# cat /root/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCRlQnl7KMpOviNWRf9ckQWeCx59nUpc3kiZMkd9aaAMRZaVmA8BYs3UvZRvLr7fcxKAyZPWLvSEbV5YiQqkwq7/mgpnG7UsVLjxG5q00UF/QrqT97Mzo4w1WX+6kTtPIaJwqyjXRb+dn3E8NhKuAGwyTVz5CB3zoa7NiWBG/f+c8gtAeJXreABAn3biv3FJkCFVfQLBFWT90a/C3Da9qoRhqUlYqwn06NCrlsG1zzDy0ag5V7cxIkrRrEFiLTS/fsdSqEqmBCZGI2enSZYhmaCG11p5n0HMnjizPC3BxVEcD7UrZn5CizkVw0FqXCe54b4WLtFPfjR4Mu2th1hyCr root@kali
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwWtdgN2UAgYC54h6z+g1fMeKMjQug5G27FfNtzS4Dw++Awf6hOh6QNfkMjPsGMzq4wg3l7fkz+9Baux83eT9x1Go/t0g0gi2tpssem1Vskvqqn3zwpktWPSTrZMWobK690h9RUVmdirMcLAB+iS47JQMapm+dI9AsD5tX6B4uSrZGAvXhYApj/CZrRcrrTYrdRE2WC9tFTC3XrzibxNqMqWXXkD+tqdnJSnMg/Zhbq3EyB8wPdCNd2e+QqdS3LRhYdW02Z1IskwxZp8SA6xbA5FGjCdxYyXcyijtqEAi2m+oAA1wrFtwnXWc+SGh6z32bZPFa1Fu38r4cSI7F0Cu9 root@debian

As you can see, there are 2 Public keys. It means that 2 servers can connect to ServerB without a password.

If you don't see .ssh in your root directory just create it with this command:
root@serverB:~# mkdir -p /root/.ssh/

If you don't see authorized_keys in your .ssh directory just create the one and paste the public key:
root@serverB:~# vi /root/.ssh/authorized_keys

Now it's time to test connection.
On serverA try to ssh in ServerB

root@kali:~# ssh root@serverB (or root@ip_Address)
root@serverB:~#     (this is the serverB prompt)

Mini AirSniff: portable access point packet sniffer

May 14, 2013 - 01:25 GNU/Linux 2 comments

Mini AirSniff is a portable traffic analyzer and penetration testing box.

Notice:
I am not responsible for any kind of damage. You choose to follow this guide at your own risk.
This guide is made for educational purposes only.

Mini Airsniff works this way: A PC can connect via wifi to the TL-MR3020 and can surf on internet. By using software like Tcpdump all traffic can be captured.

The distribution used for performing all the operations was Debian Testing.

Hardware required:
Tp-Link TL-MR3020
USB flash drive 4Gb (the Cruzer Fit is recommended for small size)

Repartition the USB flash drive as follows:
Partition 1: Linux Swap Device
Partition 2: ext4

Insert the USB stick into the router

Download the OpenWrt image for the TP-Link MR3020 from
http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/

Download the files:
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

Download airsniff.tar from this link:
http://www.hangelot.eu/immagini/airsniff.tar

You should already have an OpenWrt installed and an active ssh enabling the system password with command passwd.

connect via SSH to the system
ssh root@192.168.1.1

in OpenWrt terminal go to the tmp directory:
cd /tmp

Open a new terminal and go to the directory from where you downloaded the files

Execute this command:
rcp openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin root@192.168.1.1:/tmp/

Now flash the ROM:
mtd -r write /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware

After restart reconnect to the router using the following command:
telnet 192.168.1.1

enable ssh assigning a new password:
passwd

Now copy sysupgrade into openwrt:
rcp openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/

Execute sysupgrade:
sysupgrade -v /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

Wait until router's reboot and then reconnect via ssh:
ssh root@192.168.1.1

Copy airsniff.tar on /usr/share
From a new terminal go to the computer's directory where the airsniff.tar file is located.
Execute this command:
rcp  airsniff.tar root@192.168.1.1:/usr/share

From OpenWrt terminal type:
cd /usr/share
tar -xf airsniff.tar

Copy the MAC ADDRESS of the wireless card in order to be able to put in the new configuration file In order to do this it is necessary to enable wifi option from the file /etc/config/wireless
vi /etc/config/wireless

 Find this line:
# REMOVE THIS LINE TO ENABLE WIFI
option disabled 1

Insert the # as shown here:
# REMOVE THIS LINE TO ENABLE WIFI
# option disabled 1

Save with :wq! and press enter.
Execute these commands:
wifi
ifconfig wlan0

Copy the mac ADDRESS in a text file.

Execute these commands:
cd /usr/share/airsniff
cp -f /etc/config/dhcp /etc/config/dhcp.orig
cp -f /etc/config/firewall /etc/config/firewall.orig
cp -f /etc/config/fstab /etc/config/fstab.orig
cp -f /etc/config/network /etc/config/network.orig
cp -f /etc/opkg.conf /etc/opkg.conf.orig
cp -f /etc/profile /etc/profile.orig
cp -f /etc/config/wireless /etc/config/wireless.orig
cp -f ./dhcp.0 /etc/config/dhcp
cp -f ./firewall.0 /etc/config/firewall
cp -f ./fstab.0 /etc/config/fstab
cp -f ./network.0 /etc/config/network
cp -f ./opkg.conf.0 /etc/opkg.conf
cp -f ./profile.0 /etc/profile
cp -f ./wireless.0 /etc/config/wireless

Edit the file /etc/config/wireless
vi /etc/config/wireless

Insert the MAC address in the line:
option macaddr 'insert your mac here'

Save with :wq! and press enter.

Check that wlan0 has an assigned IP address executing these commands:
wifi
ifconfig wlan0

Now turnoff the router, connect the ethernet cable into the LAN and turn it on.

The wifi newtork is now 192.168.20.0/24
Connect to the router in wifi mode and connect via SSH:
ssh root@192.168.20.1

Execute these commands:
cd /usr/share/airsniff
opkg update
opkg install kernel
opkg install kmod-usb-storage
opkg install kmod-fs-ext4
opkg install block-mount
mkdir /mnt/usb
/etc/init.d/fstab enable
/etc/init.d/fstab start
ls /mnt/usb

Check that the USB stick is mounted by "mount" or "df"

Execute these commands:
cd /usr/share/airsniff
ln -s /mnt/usb /opt
ln -s /etc /mnt/usb/etc
opkg update
opkg install netcat
opkg -dest usb install tar
opkg -dest usb install openssh-sftp-client
opkg -dest usb install nmap
opkg -dest usb install tcpdump
opkg -dest usb install aircrack-ng
opkg -dest usb install kismet-client
opkg -dest usb install kismet-server
opkg -dest usb install perl
opkg -dest usb install openvpn
opkg -dest usb install nbtscan
opkg -dest usb install snort
opkg -dest usb install karma
opkg -dest usb install samba36-client
opkg -dest usb install elinks
opkg -dest usb install yafc
ln -s /mnt/usb/usr/share/nmap /usr/share/nmap

Now mini AirSniff is ready for use.