Nagios, Nconf e Nrpe su Debian/Ubuntu parte 1/3

novembre 8, 2013 - 01:43 GNU/Linux no comments

Environment:
Unico requisito per questa guida è avere una debian oppure ubuntu

Installare i pacchetti necessari:
apt-get install wget build-essential apache2 php5-gd wget libgd2-xpm libgd2-xpm-dev libapache2-mod-php5

scaricare nagios e plugin:

wget http://sourceforge.net/projects/nagios/files/nagios-4.x/nagios-4.0.1/nagios-4.0.1.tar.gz
# wget https://www.nagios-plugins.org/download/nagios-plugins-1.5.tar.gz

cd nagios-4.0.1
useradd nagios
groupadd nagcmd
usermod -a -G nagcmd nagios

tar zxvf nagios-4.0.1.tar.gz

attenzione: questa versione di nagios (4.0.1) ha un bug nella sezione map (statusmap.c). Per risolverlo scaricare la seguente patch e installarla

prima di inziare l'intallazione di nagios.

Scaricare la patch da questo link:
http://tracker.nagios.org/view.php?id=470

prelevare il file: nagios-4-statusmap-2.patch

Per applicare la patch eseguire questo comando:

patch -p0 --verbose < nome_patch

la patch corregge 2 files:
directory_nagios/cgi/statusmap.c
directory_nagios/common/objects.c

Anche se la patch è per la versione 4.0.0, funziona anche per la 4.0.1.
Quando si riceve un errore di percorso, inserite manualmente il path dei sorgenti di nagios.

Dopo applicata la patch provvediamo alla configurazione e installazione di nagios:

cd nagios-4.0.1

./configure --with-nagios-group=nagios --with-command-group=nagcmd --with-mail=/usr/bin/sendmail

make all
make install
make install-init
make install-config
make install-commandmode
make install-webconf

cp -R contrib/eventhandlers/ /usr/local/nagios/libexec/
chown -R nagios:nagios /usr/local/nagios/libexec/eventhandlers
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Altro bug in nagios e precisamente in /etc/init.d/nagios
bisogna cambiare tutto il file con un codice "hack".
scaricate il codice da questo sito e copiatelo al posto di /etc/init.d/nagios
http://support.nagios.com/forum/viewtopic.php?f=7&t=12038&start=20#p64091

Installare daemon
apt-get install daemon

ora è possibile avviare nagios

/etc/init.d/nagios start

ora creiamo l'user per nagios:

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

Passiamo al plugin:

apt-get install libssl-dev

tar zxvf nagios-plugins-1.5.tar.gz

cd nagios-plugins-1.5

./configure --with-nagios-user=nagios --with-nagios-group=nagios
# make
# make install

ln -s /etc/init.d/nagios /etc/rcS.d/S99nagios

Ora se tutto è andato bene dovreste avere il vostro nagios funzionante sul browser:

http://<your.nagios.server.ip>/nagios


Soluzione PT Activity 8.6.1: Packet Tracer Skills Integration Challenge

agosto 25, 2013 - 18:22 Cisco 1 comment

Considerazioni:
1) Task 3: Il pool name non è specificato ma deve essere impostato come NAT_LIST altrimenti non sarà possibile avere il 100%
2) Task 7: Il  VTP domain isi chiama XYZCORP (tutto maiuscolo) ma il corretto è xyzcorp (tutto minuscolo)
3) Task 11 firewall ACL: Il server xyzcorp è 209.165.200.246 e per permettere l'accesso web il codice è "permit tcp any host 209.165.200.246 eq www" tuttavia per avere il 100% il codice deve essere "permit tcp any host 209.165.200.244 eq www" ma è completamente sbagliato e quindi non è possibile avere accesso al web server.

1: Configure Frame Relay in a Hub-and-Spoke Topology
Step 1. Configure the Frame Relay core.
Use the addressing tables and the following requirements.
HQ is the hub router. B1, B2, and B3 are the spokes.
HQ uses a point-to-point subinterface for each of the Branch routers.
B3 must be manually configured to use IETF encapsulation.
The LMI type must be manually configured as q933a for HQ, B1, and B2. B3 uses ANSI.

HQ
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname HQ
HQ(config)#int s0/0/0
HQ(config-if)#encapsulation frame-relay
HQ(config-if)#frame-relay lmi-type q933a
HQ(config-if)#no sh
HQ(config-if)#int s0/0/0.41 point-to-point
HQ(config-subif)#ip address 10.255.255.1 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 41
HQ(config-subif)#int s0/0/0.42 point-to-point
HQ(config-subif)#ip address 10.255.255.5 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 42
HQ(config-subif)#int s0/0/0.43 point-to-point
HQ(config-subif)#ip address 10.255.255.9 255.255.255.252
HQ(config-subif)#frame-relay interface-dlci 43
HQ(config-subif)#exit
HQ(config)#

B1
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B1
B1(config)#int s0/0/0
B1(config-if)#ip address 10.255.255.2 255.255.255.252
B1(config-if)#no sh
B1(config-if)#encapsulation frame-relay
B1(config-if)#frame-relay lmi-type q933a
B1(config-if)#exit
B1(config)#

B2
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B2
B2(config)#int s0/0/0
B2(config-if)#ip address 10.255.255.6 255.255.255.252
B2(config-if)#no sh
B2(config-if)#encapsulation frame-relay
B2(config-if)#frame-relay lmi-type q933a
B2(config-if)#exit
B2(config)#

B3
Router>en
Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname B3
B3(config)#int s0/0/0
B3(config-if)#ip address 10.255.255.10 255.255.255.252
B3(config-if)#no sh
B3(config-if)#encapsulation frame
B3(config-if)#encapsulation frame-relay ietf
B3(config-if)#frame-relay lmi-type ansi
B3(config-if)#exit
B3(config)#

Step 2. Configure the LAN interface on HQ.

HQ
HQ(config)#int f0/0
HQ(config-if)#ip address 10.0.1.1 255.255.255.0
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#

Step 3. Verify that HQ can ping each of the Branch routers.

HQ#ping 10.255.255.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/9 ms

HQ#ping 10.255.255.6

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/10 ms

HQ#ping 10.255.255.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms

Task 2: Configure PPP with CHAP and PAP Authentication
Step 1. Configure the WAN link from HQ to ISP using PPP encapsulation and CHAP authentication.
The CHAP password is ciscochap.

HQ
HQ(config)#username ISP password ciscochap
HQ(config)#int s0/1/0
HQ(config-if)#ip address 209.165.201.1 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication chap
HQ(config-if)#no sh
HQ(config-if)#exit
HQ(config)#

Step 2. Configure the WAN link from HQ to NewB using PPP encapsulation and PAP authentication.
You need to connect a cable to the correct interfaces. HQ is the DCE side of the link. You choose the clock rate. The PAP password is ciscopap.

HQ
HQ(config)#username NewB password ciscopap
HQ(config)#int s0/0/1
HQ(config-if)#clock rate 64000
HQ(config-if)#ip address 10.255.255.253 255.255.255.252
HQ(config-if)#encapsulation ppp
HQ(config-if)#pp authentication pap
HQ(config-if)#no sh
HQ(config-if)#ppp pap sent-username HQ password ciscopap
HQ(config-if)#exit
HQ(config)#

Step 3. Verify that HQ can ping ISP and NewB.

HQ#ping 209.165.201.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/6 ms

HQ#ping 10.255.255.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.255.255.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms

Task 3: Configure Static and Dynamic NAT on HQ
Step 1. Configure NAT.
Use the following requirements:
Allow all addresses for the 10.0.0.0/8 address space to be translated.
XYZ Corporation owns the 209.165.200.240/29 address space. The pool, XYZCORP, uses addresses .241 through .245 with a /29 mask.
The www.xyzcorp.com website at 10.0.1.2 is registered with the public DNS system at IP address 209.165.200.246.

HQ
HQ(config)#int s0/1/0
HQ(config-if)#ip nat out
HQ(config-if)#int f0/0
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/1
HQ(config-if)#ip nat in
HQ(config-if)#int s0/0/0.41
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.42
HQ(config-subif)#ip nat in
HQ(config-subif)#int s0/0/0.43
HQ(config-subif)#ip nat in
HQ(config-subif)#exit
HQ(config)#
HQ(config)#ip access-list standard NAT_LIST
HQ(config-std-nacl)#permit 10.0.0.0 0.255.255.255
HQ(config-std-nacl)#exit
HQ(config)#ip nat pool XYZCORP 209.165.200.241 209.165.200.245 net 255.255.255.248
HQ(config)#ip nat inside source list NAT_LIST pool XYZCORP overload
HQ(config)#ip nat inside source static 10.0.1.2 209.165.200.246
HQ(config)#

Step 2. Verify NAT is operating by using extended ping.
From HQ, ping the serial 0/0/0 interface on ISP using the HQ LAN interface as the source address. This ping should succeed.
Verify that NAT translated the ping with the show ip nat translations command.

HQ#ping
Protocol [ip]:
Target IP address: 209.165.201.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: fastethernet0/0
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 209.165.201.2, timeout is 2 seconds:
Packet sent with a source address of 10.0.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms

HQ#sh ip nat translations
Pro  Inside global     Inside local       Outside local      Outside global
icmp 209.165.200.241:7110.0.1.1:71        209.165.201.2:71   209.165.201.2:71
icmp 209.165.200.241:7210.0.1.1:72        209.165.201.2:72   209.165.201.2:72
icmp 209.165.200.241:7310.0.1.1:73        209.165.201.2:73   209.165.201.2:73
icmp 209.165.200.241:7410.0.1.1:74        209.165.201.2:74   209.165.201.2:74
icmp 209.165.200.241:7510.0.1.1:75        209.165.201.2:75   209.165.201.2:75
—  209.165.200.246   10.0.1.2           —                —

Task 4: Configure Static and Default Routing
Step 1. Configure HQ with a default route to ISP and a static route to the NewB LAN.
Use the exit interface as an argument.

HQ(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0
HQ(config)#ip route 10.4.5.0 255.255.255.0 s0/0/1

Step 2. Configure the Branch routers with a default route to HQ.
Use the next-hop IP address as an argument.

B1
B1(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.1

B2
B2(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.5

B3
B3(config)#ip route 0.0.0.0 0.0.0.0 10.255.255.9

Step 3. Verify connectivity beyond ISP.
All three NewB PCs and the NetAdmin PC should be able to ping the www.cisco.com web server.

NewB-PC1>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Request timed out.
Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=21ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125

NewB-PC2>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

NewB-PC3>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

NetAdmin-PC>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=20ms TTL=125
Reply from 209.165.202.134: bytes=32 time=19ms TTL=125
Reply from 209.165.202.134: bytes=32 time=17ms TTL=125
Reply from 209.165.202.134: bytes=32 time=22ms TTL=125

Task 5: Configure Inter-VLAN Routing
Step 1. Configure each Branch router for inter-VLAN routing.
Using the addressing table for Branch routers, configure and activate the LAN interface for inter-VLAN routing. VLAN 99 is the native VLAN.

B1(config)#interface f0/0
B1(config-if)#no sh
B1(config-if)#exit
B1(config)#int f0/0.10
B1(config-subif)#encapsulation dot1Q 10
B1(config-subif)#ip address 10.1.10.1 255.255.255.0
B1(config-subif)#int f0/0.20
B1(config-subif)#encapsulation dot1Q 20
B1(config-subif)#ip address 10.1.20.1 255.255.255.0
B1(config-subif)#int f0/0.30
B1(config-subif)#encapsulation dot1Q 30
B1(config-subif)#ip address 10.1.30.1 255.255.255.0
B1(config-subif)#int f0/0.88
B1(config-subif)#encapsulation dot1Q 88
B1(config-subif)#ip address 10.1.88.1 255.255.255.0
B1(config-subif)#int f0/0.99
B1(config-subif)#encapsulation dot1Q 99 native
B1(config-subif)#ip address 10.1.99.1 255.255.255.0
B1(config-subif)#exit
B1(config)#

B2(config)#interface f0/0
B2(config-if)#no sh
B2(config-if)#exit
B2(config)#int f0/0.10
B2(config-subif)#encapsulation dot1Q 10
B2(config-subif)#ip address 10.2.10.1 255.255.255.0
B2(config-subif)#int f0/0.20
B2(config-subif)#encapsulation dot1Q 20
B2(config-subif)#ip address 10.2.20.1 255.255.255.0
B2(config-subif)#int f0/0.30
B2(config-subif)#encapsulation dot1Q 30
B2(config-subif)#ip address 10.2.30.1 255.255.255.0
B2(config-subif)#int f0/0.88
B2(config-subif)#encapsulation dot1Q 88
B2(config-subif)#ip address 10.2.88.1 255.255.255.0
B2(config-subif)#int f0/0.99
B2(config-subif)#encapsulation dot1Q 99 native
B2(config-subif)#ip address 10.2.99.1 255.255.255.0
B2(config-subif)#exit
B2(config)#

B3(config)#interface f0/0
B3(config-if)#no sh
B3(config-if)#exit
B3(config)#int f0/0.10
B3(config-subif)#encapsulation dot1Q 10
B3(config-subif)#ip address 10.3.10.1 255.255.255.0
B3(config-subif)#int f0/0.20
B3(config-subif)#encapsulation dot1Q 20
B3(config-subif)#ip address 10.3.20.1 255.255.255.0
B3(config-subif)#int f0/0.30
B3(config-subif)#encapsulation dot1Q 30
B3(config-subif)#ip address 10.3.30.1 255.255.255.0
B3(config-subif)#int f0/0.88
B3(config-subif)#encapsulation dot1Q 88
B3(config-subif)#ip address 10.3.88.1 255.255.255.0
B3(config-subif)#int f0/0.99
B3(config-subif)#encapsulation dot1Q 99 native
B3(config-subif)#ip address 10.3.99.1 255.255.255.0
B3(config-subif)#exit
B3(config)#

Step 2. Verify routing tables.
Each Branch router should now have six directly connected networks and one static default route.

B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
       i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
       * – candidate default, U – per-user static route, o – ODR
       P – periodic downloaded static route

Gateway of last resort is 10.255.255.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C       10.1.10.0/24 is directly connected, FastEthernet0/0.10
C       10.1.20.0/24 is directly connected, FastEthernet0/0.20
C       10.1.30.0/24 is directly connected, FastEthernet0/0.30
C       10.1.88.0/24 is directly connected, FastEthernet0/0.88
C       10.1.99.0/24 is directly connected, FastEthernet0/0.99
C       10.255.255.0/30 is directly connected, Serial0/0/0
S*   0.0.0.0/0 [1/0] via 10.255.255.1
B1#

Task 6: Configure and Optimize EIGRP Routing
Step 1. Configure HQ, B1, B2, and B3 with EIGRP.
Use AS 100.
Disable EIGRP updates on appropriate interfaces.
Manually summarize EIGRP routes so that each Branch router only advertises the 10.X.0.0/16 address space to HQ.
Note: Packet Tracer does not accurately simulate the benefit of EIGRP summary routes. Routing tables will still show all subnets, even though you correctly configured the manual summary.

HQ
HQ(config)#router eigrp 100
HQ(config-router)#passive-interface s0/1/0
HQ(config-router)#passive-interface s0/0/1
HQ(config-router)#passive-interface fa0/0
HQ(config-router)#network 10.0.0.0
HQ(config-router)# no auto-summary

B1
B1(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B1(config-router)#network 10.0.0.0
B1(config-router)# no auto-summary
B1(config-router)#int s0/0/0
B1(config-if)#ip summary-address eigrp 100 10.1.0.0 255.255.0.0

B2
B2(config)#router eigrp 100
B2(config-router)#passive-interface fa0/0.10
B2(config-router)#passive-interface fa0/0.20
B2(config-router)#passive-interface fa0/0.30
B2(config-router)#passive-interface fa0/0.99
B2(config-router)#network 10.0.0.0
B2(config-router)#no auto-summary
B2(config-router)#int s0/0/0
B2(config-if)#ip summary-address eigrp 100 10.2.0.0 255.255.0.0

B3
B3(config)#router eigrp 100
B3(config-router)#passive-interface fa0/0.10
B3(config-router)#passive-interface fa0/0.20
B3(config-router)#passive-interface fa0/0.30
B3(config-router)#passive-interface fa0/0.99
B3(config-router)#network 10.0.0.0
B3(config-router)#no auto-summary
B3(config-router)#int s0/0/0
B3(config-if)#ip summary-address eigrp 100 10.3.0.0 255.255.0.0

Step 2. Verify routing tables and connectivity.
HQ and the Branch routers should now have complete routing tables.
The NetAdmin PC should now be able to ping each VLAN subinterface on each Branch router.

B1#sh ip route
Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP
       i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area
       * – candidate default, U – per-user static route, o – ODR
       P – periodic downloaded static route

Gateway of last resort is 10.255.255.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 14 subnets, 3 masks
D       10.0.1.0/24 [90/2172416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.1.0.0/16 is a summary, 00:09:24, Null0
C       10.1.10.0/24 is directly connected, FastEthernet0/0.10
C       10.1.20.0/24 is directly connected, FastEthernet0/0.20
C       10.1.30.0/24 is directly connected, FastEthernet0/0.30
C       10.1.88.0/24 is directly connected, FastEthernet0/0.88
C       10.1.99.0/24 is directly connected, FastEthernet0/0.99
D       10.2.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.3.0.0/16 [90/2684416] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.4.5.0/24 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
C       10.255.255.0/30 is directly connected, Serial0/0/0
D       10.255.255.4/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.255.255.8/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
D       10.255.255.252/30 [90/2681856] via 10.255.255.1, 00:09:20, Serial0/0/0
S*   0.0.0.0/0 [1/0] via 10.255.255.1
B1#

NetAdmin-PC>ping 10.3.10.1

Pinging 10.3.10.1 with 32 bytes of data:

Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254
Reply from 10.3.10.1: bytes=32 time=18ms TTL=254
Reply from 10.3.10.1: bytes=32 time=17ms TTL=254

Ping statistics for 10.3.10.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 18ms, Average = 17ms

NetAdmin-PC>ping 10.3.20.1

Pinging 10.3.20.1 with 32 bytes of data:

Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=15ms TTL=254
Reply from 10.3.20.1: bytes=32 time=18ms TTL=254
Reply from 10.3.20.1: bytes=32 time=16ms TTL=254

Ping statistics for 10.3.20.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 15ms, Maximum = 18ms, Average = 16ms

NetAdmin-PC>ping 10.3.30.1

Pinging 10.3.30.1 with 32 bytes of data:

Reply from 10.3.30.1: bytes=32 time=18ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=17ms TTL=254
Reply from 10.3.30.1: bytes=32 time=18ms TTL=254

Ping statistics for 10.3.30.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 18ms, Average = 17ms

NetAdmin-PC>ping 10.3.88.1

Pinging 10.3.88.1 with 32 bytes of data:

Reply from 10.3.88.1: bytes=32 time=20ms TTL=254
Reply from 10.3.88.1: bytes=32 time=17ms TTL=254
Reply from 10.3.88.1: bytes=32 time=16ms TTL=254
Reply from 10.3.88.1: bytes=32 time=20ms TTL=254

Ping statistics for 10.3.88.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 16ms, Maximum = 20ms, Average = 18ms

NetAdmin-PC>ping 10.3.99.1

Pinging 10.3.99.1 with 32 bytes of data:

Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=14ms TTL=254
Reply from 10.3.99.1: bytes=32 time=16ms TTL=254

Ping statistics for 10.3.99.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 14ms, Maximum = 16ms, Average = 14ms

Task 7: Configure VTP, Trunking, the VLAN Interface, and VLANs
The following requirements apply to all three Branches. Configure one set of three switches. Then use the scripts for those switches on the other two sets of switches.
Step 1. Configure Branch switches with VTP.
BX-S1 is the VTP server. BX-S2 and BX-S3 are VTP clients.
The domain name is XYZCORP.  <– mistake all is lower character xyzcorp
The password is xyzvtp.

B1-S1
Switch>en
Switch#conf t
Switch(config)#hostname B1-S1
B1-S1(config)#vtp mode server
Device mode already VTP SERVER.
B1-S1(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B1-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S1(config)#

B1-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B1-S2
B1-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S2(config)#

B1-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B1-S3
B1-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B1-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B1-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B1-S3(config)#

B2-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B2-S1
B2-S1(config)#vtp mode server
Device mode already VTP SERVER.
B2-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S1(config)#

B2-S2
Switch>en
Switch#conf t
Switch(config)#hostname B2-S2
B2-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S2(config)#vtp domain xyzcorp
Changing VTP domain name from xyzcorp<br> to xyzcorp
B2-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S2(config)#

B2-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B2-S3
B2-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B2-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B2-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B2-S3(config)#

B3-S1
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S1
B3-S1(config)#vtp mode server
Device mode already VTP SERVER.
B3-S1(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S1(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S1(config)#

B3-S2
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S2
B3-S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S2(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S2(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S2(config)#

B3-S3
Switch>en
Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname B3-S3
B3-S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
B3-S3(config)#vtp domain xyzcorp
Changing VTP domain name from NULL to xyzcorp
B3-S3(config)#vtp password xyzvtp
Setting device VLAN database password to xyzvtp
B3-S3(config)#

Step 2. Configure trunking on BX-S1, BX-S2, and BX-S3.
Configure the appropriate interfaces in trunking mode and assign VLAN 99 as the native VLAN.

B1-S1
B1-S1(config)#int range fa0/1-5
B1-S1(config-if-range)#switchport trunk native vlan 99
B1-S1(config-if-range)#switchport mode trunk

B1-S2
B1-S2(config)#int range fa0/1-4
B1-S2(config-if-range)#switchport trunk native vlan 99
B1-S2(config-if-range)#switchport mode trunk

B1-S3
B1-S3(config)#int range fa0/1-4
B1-S3(config-if-range)#switchport trunk native vlan 99
B1-S3(config-if-range)#switchport mode trunk

B2-S1
B2-S1(config)#int range fa0/1-5
B2-S1(config-if-range)#switchport trunk native vlan 99
B2-S1(config-if-range)#switchport mode trunk

B2-S2
B2-S2(config)#int range fa0/1-4
B2-S2(config-if-range)#switchport trunk native vlan 99
B2-S2(config-if-range)#switchport mode trunk

B2-S3
B2-S3(config)#int range fa0/1-4
B2-S3(config-if-range)#switchport trunk native vlan 99
B2-S3(config-if-range)#switchport mode trunk

B3-S1
B3-S1(config)#int range fa0/1-5
B3-S1(config-if-range)#switchport trunk native vlan 99
B3-S1(config-if-range)#switchport mode trunk

B3-S2
B3-S2(config)#int range fa0/1-4
B3-S2(config-if-range)#switchport trunk native vlan 99
B3-S2(config-if-range)#switchport mode trunk

B3-S3
B3-S3(config)#int range fa0/1-4
B3-S3(config-if-range)#switchport trunk native vlan 99
B3-S3(config-if-range)#switchport mode trunk

Step 3. Configure the VLAN interface and default gateway on BX-S1, BX-S2, and BX-S3.

B1-S1(config)#ip default-gateway 10.1.99.1
B1-S2(config)#ip default-gateway 10.1.99.1
B1-S3(config)#ip default-gateway 10.1.99.1
B2-S1(config)#ip default-gateway 10.2.99.1
B2-S2(config)#ip default-gateway 10.2.99.1
B2-S3(config)#ip default-gateway 10.2.99.1
B3-S1(config)#ip default-gateway 10.3.99.1
B3-S2(config)#ip default-gateway 10.3.99.1
B3-S3(config)#ip default-gateway 10.3.99.1

B1-S1
B1-S1(config)#int vlan 99
B1-S1(config-if)#ip addr 10.1.99.21 255.255.255.0
B1-S1(config-if)#no shutdown

B1-S2
B1-S2(config)#int vlan 99
B1-S2(config-if)#ip addr 10.1.99.22 255.255.255.0
B1-S2(config-if)#no shutdown

B1-S3
B1-S3(config)#int vlan 99
B1-S3(config-if)#ip addr 10.1.99.23 255.255.255.0
B1-S3(config-if)#no shutdown

B2-S1
B2-S1(config)#int vlan 99
B2-S1(config-if)#ip addr 10.2.99.21 255.255.255.0
B2-S1(config-if)#no shutdown

B2-S2
B2-S2(config)#int vlan 99
B2-S2(config-if)#ip addr 10.2.99.22 255.255.255.0
B2-S2(config-if)#no shutdown

B2-S3
B2-S3(config)#int vlan 99
B2-S3(config-if)#ip addr 10.2.99.23 255.255.255.0
B2-S3(config-if)#no shutdown

B3-S1
B3-S1(config)#int vlan 99
B3-S1(config-if)#ip addr 10.3.99.21 255.255.255.0
B3-S1(config-if)#no shutdown

B3-S2
B3-S2(config)#int vlan 99
B3-S2(config-if)#ip addr 10.3.99.22 255.255.255.0
B3-S2(config-if)#no shutdown

B3-S3
B3-S3(config)#int vlan 99
B3-S3(config-if)#ip addr 10.3.99.23 255.255.255.0
B3-S3(config-if)#no shutdown

Step 4. Create the VLANs on BX-S1.
Create and name the VLANs listed in the VLAN Configuration and Port Mappings table on BX-S1 only. VTP advertises the new VLANs to BX-S1 and BX-S2.

B1-S1
B1-S1(config)#vlan 10
B1-S1(config-vlan)#name Admin
B1-S1(config-vlan)#vlan 20
B1-S1(config-vlan)#name Sales
B1-S1(config-vlan)#vlan 30
B1-S1(config-vlan)#name Production
B1-S1(config-vlan)#vlan 88
B1-S1(config-vlan)#name Wireless
B1-S1(config-vlan)#vlan 99
B1-S1(config-vlan)#name Mgmt&Native
B1-S1(config-vlan)#exit
B1-S1(config)#

B2-S1
B2-S1(config)#vlan 10
B2-S1(config-vlan)#name Admin
B2-S1(config-vlan)#vlan 20
B2-S1(config-vlan)#name Sales
B2-S1(config-vlan)#vlan 30
B2-S1(config-vlan)#name Production
B2-S1(config-vlan)#vlan 88
B2-S1(config-vlan)#name Wireless
B2-S1(config-vlan)#vlan 99
B2-S1(config-vlan)#name Mgmt&Native
B2-S1(config-vlan)#exit
B2-S1(config)#

B3-S1
B3-S1(config)#vlan 10
B3-S1(config-vlan)#name Admin
B3-S1(config-vlan)#vlan 20
B3-S1(config-vlan)#name Sales
B3-S1(config-vlan)#vlan 30
B3-S1(config-vlan)#name Production
B3-S1(config-vlan)#vlan 88
B3-S1(config-vlan)#name Wireless
B3-S1(config-vlan)#vlan 99
B3-S1(config-vlan)#name Mg&Native
B3-S1(config-vlan)#exit
B3-S1(config)#

Step 5. Verify that VLANs have been sent to BX-S2 and BX-S3.
Use the appropriate commands to verify that S2 and S3 now have the VLANs you created on S1. It may take a few minutes for Packet Tracer to simulate the VTP advertisements. A quick way to force the sending of VTP advertisements is to change one of the client switches to transparent mode and then back to client mode.

B1-S2#sh vtp passw
VTP Password: xyzvtp

B1-S2#sh vtp status
VTP Version                     : 2
Configuration Revision          : 10
Maximum VLANs supported locally : 255
Number of existing VLANs        : 10
VTP Operating Mode              : Client
VTP Domain Name                 : xyzcorp
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xE1 0xB3 0x4C 0x9C 0x8E 0×80 0x7E 0×28
Configuration last modified by 10.1.99.21 at 3-1-93 05:47:41

B1-S2#sh vlan

VLAN Name                             Status    Ports
—- ——————————– ——— ——————————-
1    default                          active    Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24
                                                Gig1/1, Gig1/2
10   Admin                            active    
20   Sales                            active    
30   Production                       active    
88   Wireless                         active    
99   Mgmt&Native                      active    
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

B1-S2# sh interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Fa0/1       on           802.1q         trunking      99
Fa0/2       on           802.1q         trunking      99
Fa0/3       on           802.1q         trunking      99
Fa0/4       on           802.1q         trunking      99

Port        Vlans allowed on trunk
Fa0/1       1-1005
Fa0/2       1-1005
Fa0/3       1-1005
Fa0/4       1-1005

Port        Vlans allowed and active in management domain
Fa0/1       1,10,20,30,88,99
Fa0/2       1,10,20,30,88,99
Fa0/3       1,10,20,30,88,99
Fa0/4       1,10,20,30,88,99

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/1       1,10,20,30,88,99
Fa0/2       1,10,20,30,88,99
Fa0/3       1,10,20,30,88,99
Fa0/4       1,10,20,30,88,99
B1-S2#

NetAdmin-PC>ping 10.3.99.23

Pinging 10.3.99.23 with 32 bytes of data:

Request timed out.
Request timed out.
Reply from 10.3.99.23: bytes=32 time=23ms TTL=253
Reply from 10.3.99.23: bytes=32 time=21ms TTL=253

Task 8: Assign VLANs and Configure Port Security

Step 1. Assign VLANs to access ports.
Use the VLAN Configuration and Port Mappings table to complete the following requirements:
Configure access ports
Assign VLANs to the access ports

B1-S2
B1-S2(config)#int f0/6
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#int fa 0/16
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport access vlan 30

B2-S2
B2-S2(config)#int f0/6
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#int fa 0/16
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#

B3-S2
B3-S2(config)#int f0/6
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#int fa 0/16
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport access vlan 30

B1-S3
B1-S3(config)#int fa 0/7
B1-S3(config-if)#switchport mode access
B1-S3(config-if)#switchport access vlan 88

B2-S3
B2-S3(config)#int fa 0/7
B2-S3(config-if)#switchport mode access
B2-S3(config-if)#switchport access vlan 88

B3-S3
B3-S3(config)#int fa 0/7
B3-S3(config-if)#switchport mode access
B3-S3(config-if)#switchport access vlan 88

Step 2. Configure port security.
Use the following policy to establish port security on the BX-S2 access ports:
Allow only one MAC address
Configure the first learned MAC address to "stick" to the configuration
Set the port to shut down if there is a security violation

B1-S2
B1-S2(config)#int fa0/6
B1-S2(config-if)#switchport access vlan 10
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/11
B1-S2(config-if)#switchport access vlan 20
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown
B1-S2(config-if)#int fa0/16
B1-S2(config-if)#switchport access vlan 30
B1-S2(config-if)#switchport mode access
B1-S2(config-if)#switchport port-security
B1-S2(config-if)#switchport port-security maximum 1
B1-S2(config-if)#switchport port-security mac-address sticky
B1-S2(config-if)#switchport port-security violation shutdown

B2-S2
B2-S2(config)#int fa0/6
B2-S2(config-if)#switchport access vlan 10
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/11
B2-S2(config-if)#switchport access vlan 20
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown
B2-S2(config-if)#int fa0/16
B2-S2(config-if)#switchport access vlan 30
B2-S2(config-if)#switchport mode access
B2-S2(config-if)#switchport port-security
B2-S2(config-if)#switchport port-security maximum 1
B2-S2(config-if)#switchport port-security mac-address sticky
B2-S2(config-if)#switchport port-security violation shutdown

B3-S2
B3-S2(config)#int fa0/6
B3-S2(config-if)#switchport access vlan 10
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/11
B3-S2(config-if)#switchport access vlan 20
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown
B3-S2(config-if)#int fa0/16
B3-S2(config-if)#switchport access vlan 30
B3-S2(config-if)#switchport mode access
B3-S2(config-if)#switchport port-security
B3-S2(config-if)#switchport port-security maximum 1
B3-S2(config-if)#switchport port-security mac-address sticky
B3-S2(config-if)#switchport port-security violation shutdown

Step 3. Verify VLAN assignments and port security.
Use the appropriate commands to verify that access VLANs are correctly assigned and that the port security policy has been enabled.

B1-S2#show port-security interface f0/6
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 0
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0000.0000.0000:0
Security Violation Count   : 0

Task 9: Configure STP
Step 1. Configure BX-S1 as the root bridge.
Set the priority level to 4096 on BX-S1 so that these switches are always the root bridge for all VLANs.

B1-S1(config)#spanning-tree vlan 1-1001 priority 4096
B2-S1(config)#spanning-tree vlan 1-1001 priority 4096
B3-S1(config)#spanning-tree vlan 1-1001 priority 4096

Step 2. Configure BX-S3 as the backup root bridge.
Set the priority level to 8192 on BX-S3 so that these switches are always the backup root bridge for all VLANs.

B1-S3(config)#spanning-tree vlan 1-1001 priority 8192
B2-S3(config)#spanning-tree vlan 1-1001 priority 8192
B3-S3(config)#spanning-tree vlan 1-1001 priority 8192

Step 3. Verify that BX-S1 is the root bridge.

B1-S1#sh spanning-tree
VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    4097
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4097  (priority 4096 sys-id-ext 1)
             Address     00D0.BA3D.2C94
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
—————- —- — ——— ——– ——————————–
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p
Fa0/3            Desg FWD 19        128.3    P2p
Fa0/4            Desg FWD 19        128.4    P2p
Fa0/5            Desg FWD 19        128.5    P2p

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    4106
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0020
  Spanning tree enabled protocol ieee
  Root ID    Priority    4116
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0030
  Spanning tree enabled protocol ieee
  Root ID    Priority    4126
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0088
  Spanning tree enabled protocol ieee
  Root ID    Priority    4184
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…
VLAN0099
  Spanning tree enabled protocol ieee
  Root ID    Priority    4195
             Address     00D0.BA3D.2C94
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
…

Task 10: Configure DHCP
Step 1. Configure DHCP pools for each VLAN.
On the Branch routers, configure DHCP pools for each VLAN using the following requirements:
Exclude the first 10 IP addresses in each pool for the LANs.
Exclude the first 24 IP addresses in each pool for the wireless LANs.
The pool name is BX_VLAN## where X is the router number and ## is the VLAN number.
Include the DNS server attached to the HQ server farm as part of the DHCP configuration.

B1
B1(config)#ip dhcp excluded-address 10.1.10.1 10.1.10.10
B1(config)#ip dhcp excluded-address 10.1.20.1 10.1.20.10
B1(config)#ip dhcp excluded-address 10.1.30.1 10.1.30.10
B1(config)#ip dhcp excluded-address 10.1.88.1 10.1.88.24

B2
B2(config)#ip dhcp excluded-address 10.2.10.1 10.2.10.10
B2(config)#ip dhcp excluded-address 10.2.20.1 10.2.20.10
B2(config)#ip dhcp excluded-address 10.2.30.1 10.2.30.10
B2(config)#ip dhcp excluded-address 10.2.88.1 10.2.88.24

B3
B3(config)#ip dhcp excluded-address 10.3.10.1 10.3.10.10
B3(config)#ip dhcp excluded-address 10.3.20.1 10.3.20.10
B3(config)#ip dhcp excluded-address 10.3.30.1 10.3.30.10
B3(config)#ip dhcp excluded-address 10.3.88.1 10.3.88.24

B1
B1(config)#ip dhcp pool B1_VLAN10
B1(dhcp-config)#network 10.1.10.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.10.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN20
B1(dhcp-config)#network 10.1.20.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.20.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN30
B1(dhcp-config)#network 10.1.30.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.30.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#ip dhcp pool B1_VLAN88
B1(dhcp-config)#network 10.1.88.0 255.255.255.0
B1(dhcp-config)#default-router 10.1.88.1
B1(dhcp-config)#dns-server 10.0.1.4
B1(dhcp-config)#exit
B1(config)#

B2
B2(config)#ip dhcp pool B2_VLAN10
B2(dhcp-config)#network 10.2.10.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.10.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN20
B2(dhcp-config)#network 10.2.20.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.20.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN30
B2(dhcp-config)#network 10.2.30.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.30.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#ip dhcp pool B2_VLAN88
B2(dhcp-config)#network 10.2.88.0 255.255.255.0
B2(dhcp-config)#default-router 10.2.88.1
B2(dhcp-config)#dns-server 10.0.1.4
B2(dhcp-config)#exit
B2(config)#

B3
B3(config)#ip dhcp pool B3_VLAN10
B3(dhcp-config)#network 10.3.10.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.10.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN20
B3(dhcp-config)#network 10.3.20.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.20.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN30
B3(dhcp-config)#network 10.3.30.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.30.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#ip dhcp pool B3_VLAN88
B3(dhcp-config)#network 10.3.88.0 255.255.255.0
B3(dhcp-config)#default-router 10.3.88.1
B3(dhcp-config)#dns-server 10.0.1.4
B3(dhcp-config)#exit
B3(config)#

Step 2. Configure the PCs to use DHCP.
Currently, the PCs are configured to use static IP addresses. Change this configuration to DHCP.

Step 3. Verify that the PCs and wireless routers have an IP address.
Step 4. Verify connectivity.
All PCs physically attached to the network should be able to ping the www.cisco.com web server.

B3-PC1>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Request timed out.
Reply from 209.165.202.134: bytes=32 time=29ms TTL=125
Reply from 209.165.202.134: bytes=32 time=31ms TTL=125
Reply from 209.165.202.134: bytes=32 time=23ms TTL=125

Task 11: Configure a Firewall ACL
Step 1. Verify connectivity from Outside Host.
The Outside Host PC should be able to ping the server at www.xyzcorp.com.

Outside host PC>ping www.cisco.com

Pinging 209.165.202.134 with 32 bytes of data:

Reply from 209.165.202.134: bytes=32 time=9ms TTL=127
Reply from 209.165.202.134: bytes=32 time=7ms TTL=127
Reply from 209.165.202.134: bytes=32 time=6ms TTL=127
Reply from 209.165.202.134: bytes=32 time=8ms TTL=127

Step 2. Implement a basic firewall ACL.
Because ISP represents connectivity to the Internet, configure a named ACL called FIREWALL in the following order:
Allow inbound HTTP requests to the www.xyzcorp.com server.
Allow only established TCP sessions from ISP and any source beyond ISP.
Allow only inbound ping replies from ISP and any source beyond ISP.
Explicitly block all other inbound access from ISP and any source beyond ISP.

HQ
HQ(config)#ip access-list extended FIREWALL
HQ(config-ext-nacl)#permit tcp any host 209.165.200.244 eq www
HQ(config-ext-nacl)#permit tcp any any established
HQ(config-ext-nacl)#permit icmp any any echo-reply
HQ(config-ext-nacl)#deny ip any any
HQ(config-ext-nacl)#exit
HQ(config)#int s0/1/0
HQ(config-if)#ip access-group FIREWALL in
HQ(config-if)#exit
HQ(config)#

Outside host PC>ping www.xyzcorp.com

Pinging 209.165.200.246 with 32 bytes of data:

Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.
Reply from 209.165.201.1: Destination host unreachable.

Task 12: Configure Wireless Connectivity
Step 1. Verify the DHCP configuration.
Each BX-WRS router should already have IP addressing from the DHCP of the BX router for VLAN 88.

B1-WRS ip address 10.1.40.1 (click save settings)
B2-WRS ip address 10.2.40.1 (click save settings)
B2-WRS ip address 10.3.40.1 (click save settings)

Step 3. Configure the wireless network settings.
The SSIDs for the routers are BX-WRS_LAN where the X is the Branch router number.
The WEP key is 12345ABCDE

Wireless > Wireless security > security mode: WEP and key1: 12345ABCDE for all 3 routers
(click save settings)

Step 4. Configure the wireless routers for remote access.
Configure the administration password as cisco123 and enable remote management.

Step 5. Configure the BX-PC4 PCs to access the wireless network using DHCP.

Step 6. Verify connectivity and remote management capability.
Each wireless PC should be able to access the www.cisco.com web server.
Verify remote management capability by accessing the wireless router through the web browser.

From NetAdmin open Browser
access: http://10.1.88.25/
user: admin
password: cisco123

SSH e SCP senza password

agosto 18, 2013 - 17:10 GNU/Linux no comments

Questa è la procedura da eseguire per connettere via ssh o eseguire scp serverA e serverB senza inserire la password

Avviso:
Non sono responsabile di danneggiamenti di alcun genere. Se seguite questa guida è a vostro rischio e pericolo.

ServerA
Per prima cosa bisogna generare le chiavi pubbliche e private
ATTENZIONE! Assicurarsi di non avere già le chiavi altrimenti verranno sostituite con quelle nuove. Controllare la loro presenza in /root/.ssh/

Generazione della chiave:

root@kali:~# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): (premere invio)
Enter same passphrase again: (premere invio)
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
77:c2:b2:59:7e:48:e1:bd:a9:c8:24:eb:ec:9a:18:2e root@kali
The key's randomart image is:
+–[ RSA 2048]—-+
|                 |
|                 |
|          .      |
|         o o     |
|        S B o    |
|         O + o   |
|  .   . + o +    |
|E. o o = . o     |
| .o o+= o .      |
+—————–+

La chiave pubblica RSA è contenuta nel file /root/.ssh/id_rsa.pub

root@kali:~# cat /root/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCRlQnl7KMpOviNWRf9ckQWeCx59nUpc3kiZMkd9aaAMRZaVmA8BYs3UvZRvLr7fcxKAyZPWLvSEbV5YiQqkwq7/mgpnG7UsVLjxG5q00UF/QrqT97Mzo4w1WX+6kTtPIaJwqyjXRb+dn3E8NhKuAGwyTVz5CB3zoa7NiWBG/f+c8gtAeJXreABAn3biv3FJkCFVfQLBFWT90a/C3Da9qoRhqUlYqwn06NCrlsG1zzDy0ag5V7cxIkrRrEFiLTS/fsdSqEqmBCZGI2enSZYhmaCG11p5n0HMnjizPC3BxVEcD7UrZn5CizkVw0FqXCe54b4WLtFPfjR4Mu2th1hyCr root@kali

copiare la chiave begli appunti.

ServerB
Loggarsi al ServerB come root e copiare la chiave pubblica RSA del ServerA nel file /root/.ssh/authorized_keys del serverB.

root@serverB:~# vi /root/.ssh/authorized_keys
incollare la chiave pubblica in questo file. Se esiste un'altra chiave allora copiatela nella linea successiva.

Questo è un esempio di come il file authorized_keys dovrebbe essere:
root@serverB:~# cat /root/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCRlQnl7KMpOviNWRf9ckQWeCx59nUpc3kiZMkd9aaAMRZaVmA8BYs3UvZRvLr7fcxKAyZPWLvSEbV5YiQqkwq7/mgpnG7UsVLjxG5q00UF/QrqT97Mzo4w1WX+6kTtPIaJwqyjXRb+dn3E8NhKuAGwyTVz5CB3zoa7NiWBG/f+c8gtAeJXreABAn3biv3FJkCFVfQLBFWT90a/C3Da9qoRhqUlYqwn06NCrlsG1zzDy0ag5V7cxIkrRrEFiLTS/fsdSqEqmBCZGI2enSZYhmaCG11p5n0HMnjizPC3BxVEcD7UrZn5CizkVw0FqXCe54b4WLtFPfjR4Mu2th1hyCr root@kali
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwWtdgN2UAgYC54h6z+g1fMeKMjQug5G27FfNtzS4Dw++Awf6hOh6QNfkMjPsGMzq4wg3l7fkz+9Baux83eT9x1Go/t0g0gi2tpssem1Vskvqqn3zwpktWPSTrZMWobK690h9RUVmdirMcLAB+iS47JQMapm+dI9AsD5tX6B4uSrZGAvXhYApj/CZrRcrrTYrdRE2WC9tFTC3XrzibxNqMqWXXkD+tqdnJSnMg/Zhbq3EyB8wPdCNd2e+QqdS3LRhYdW02Z1IskwxZp8SA6xbA5FGjCdxYyXcyijtqEAi2m+oAA1wrFtwnXWc+SGh6z32bZPFa1Fu38r4cSI7F0Cu9 root@debian

Come è possibile vedere ci sono 2 chiavi pubbliche. Significa che 2 servers possono connettersi via ssh o scp senza password al ServerB.

Se nella directory root non è presente .ssh allora è possibile crearla con il seguente comando:
root@serverB:~# mkdir -p /root/.ssh/

Se non è presente authorized_keys nella directory .ssh allora è possibile crearla per poi copiare la chiave pubblica:
root@serverB:~# vi /root/.ssh/authorized_keys

Ora è possibile provare la connessione:
On serverA try to ssh in ServerB

root@kali:~# ssh root@serverB (o root@indirizzo_ip)
root@serverB:~#     (questo è il prompt del ServerB)

Mini AirSniff: portable access point packet sniffer

maggio 14, 2013 - 01:20 GNU/Linux no comments

Mini AirSniff è un analizzatore di traffico portatile e penetration testing box.

Avviso:
Non sono responsabile di danneggiamenti di alcun genere. Se seguite questa guida è a vostro rischio e pericolo.
Questa guida è solo a scopo di studio.

Questo metodo si basa sul fatto di permettere ad un PC di connettersi al TL-MR3020 tramite wifi, di poter usare internet e tramite opportuni software tipo tcpdump catturare tutto il traffico generato.

La distrubuzione usata per eseguire tutte le operazioni è stata Debian Testing.

Hardware necessario:
Tp-Link TL-MR3020
USB flash drive 4Gb (è consigliato il Cruzer Fit per le dimensioni ridotte)

Ripartiziona la USB flash drive come segue:
Partizione 1: Linux Swap Device
Partizione 2: ext4

Inserisci la USB stick nel router

Scarica l'immagine OpenWrt per il TP-Link MR3020 da
http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/

Preleva i files:
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

Scarica i file necessari per la configurazione di airsniff:
http://www.hangelot.eu/immagini/airsniff.tar

La premessa è che abbiate già una qualsiasi versione di openwrt già installata e che abbiate attivo ssh abilitando la password di sistema con passwd.

connettetevi via ssh al sistema:
ssh root@192.168.1.1

nel terminale di OpenWrt andare nella directory tmp:
cd /tmp

Aprire un nuovo terminale e spostarsi nella directory dove sono stati scaricati i files

eseguire questo comando:
rcp openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin root@192.168.1.1:/tmp/

ora flashare la rom:
mtd -r write /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware

al riavvio connettersi nuovamente al sistema:
telnet 192.168.1.1

abilitare ssh assegnando una nuova password:
passwd

ora copiare il sysupgrade su openwrt:
rcp openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/

avviare il sysupgrade:
sysupgrade -v /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-sysupgrade.bin

Attendere il riavvio del sistema e poi riconnettersi tramite ssh.
ssh root@192.168.1.1

Copiare airsniff.tar su /usr/share
Da un nuovo terminale posizionarsi nella directory del pc dove si trova il file airsniff.tar.
Eseguire questo comando:
rcp  airsniff.tar root@192.168.1.1:/usr/share

Dal terminale Openwrt digitare:
cd /usr/share
tar -xf airsniff.tar

Copiare il MAC ADDRESS della scheda wireless per poterlo inserire nel nuovo file di configurazione
per fare ciò abilitiamo l'opzione wifi dal file /etc/config/wireless
vi /etc/config/wireless

troverete una linea con scritto:
# REMOVE THIS LINE TO ENABLE WIFI
option disabled 1

Inserire il # come mostrato qui:
# REMOVE THIS LINE TO ENABLE WIFI
# option disabled 1

Salvate con :wq! e premete invio.
Eseguire questi comandi:
wifi
ifconfig wlan0

Copiate il mac Address su un file di testo.

Eseguire questi comandi:
cd /usr/share/airsniff
cp -f /etc/config/dhcp /etc/config/dhcp.orig
cp -f /etc/config/firewall /etc/config/firewall.orig
cp -f /etc/config/fstab /etc/config/fstab.orig
cp -f /etc/config/network /etc/config/network.orig
cp -f /etc/opkg.conf /etc/opkg.conf.orig
cp -f /etc/profile /etc/profile.orig
cp -f /etc/config/wireless /etc/config/wireless.orig
cp -f ./dhcp.0 /etc/config/dhcp
cp -f ./firewall.0 /etc/config/firewall
cp -f ./fstab.0 /etc/config/fstab
cp -f ./network.0 /etc/config/network
cp -f ./opkg.conf.0 /etc/opkg.conf
cp -f ./profile.0 /etc/profile
cp -f ./wireless.0 /etc/config/wireless

Editare il file /etc/config/wireless
vi /etc/config/wireless

Inserire il MAC address nella linea:
option macaddr 'insert your mac here'

Salvare con :wq! e premere invio.

Controllare che la wlan0 abbia l'indirizzo IP assegnato eseguendo questi comandi:
wifi
ifconfig wlan0

adesso spegnere il router, connettere il cavo alla rete locale e avviarlo nuovamente.

la rete wifi è ora 192.168.20.0/24
Connettersi al router tramite wifi, dalla shell digitate il comando:
ssh root@192.168.20.1

Ora eseguire questi comandi:
cd /usr/share/airsniff
opkg update
opkg install kernel
opkg install kmod-usb-storage
opkg install kmod-fs-ext4
opkg install block-mount
mkdir /mnt/usb
/etc/init.d/fstab enable
/etc/init.d/fstab start
ls /mnt/usb

controllare che la usb stick sia montata tramite "mount" oppure "df"

Eseguire questi comandi:
cd /usr/share/airsniff
ln -s /mnt/usb /opt
ln -s /etc /mnt/usb/etc
opkg update
opkg install netcat
opkg -dest usb install tar
opkg -dest usb install openssh-sftp-client
opkg -dest usb install nmap
opkg -dest usb install tcpdump
opkg -dest usb install aircrack-ng
opkg -dest usb install kismet-client
opkg -dest usb install kismet-server
opkg -dest usb install perl
opkg -dest usb install openvpn
opkg -dest usb install nbtscan
opkg -dest usb install snort
opkg -dest usb install karma
opkg -dest usb install samba36-client
opkg -dest usb install elinks
opkg -dest usb install yafc
ln -s /mnt/usb/usr/share/nmap /usr/share/nmap

Ora il mini AirSniff è pronto all'uso.