Competitor fills in. Expert fills in. Time: 5:00h 39 - IT Network Systems Administration Chief-Experts: Danny Meier, Florian Meier, Tobias Meier

Size: px

Start display at page:

Download "Competitor fills in. Expert fills in. Time: 5:00h 39 - IT Network Systems Administration Chief-Experts: Danny Meier, Florian Meier, Tobias Meier"

Giles Allen
5 years ago
Views:

1 1/20 Time: 5:00h Trade: 39 - IT Network Systems Administration Chief-Experts: Danny Meier, Florian Meier, Tobias Meier Competitor fills in Name Date Signature Expert fills in Points

2 2/20 Overview 1 EXAM CONTENTS INTRODUCTION INSTRUCTION TO THE COMPETITOR DESCRIPTION OF PROJECT AND TASKS Client Server Network IMPORTANT HINTS PART 1 HEADQUATER ESXi server on PC1 (hypervisor02) VM Debian Linux (web01) VM Sophos Firewall (fw01) Hyper-V server on PC1 (hypervisor01) VM Domain Controller (ad01) VM Debian Linux (dns01) Router1 (rt01) Switch (sw01) Access Point (ap01) PART 2 BRANCH OFFICE Windows 10 on PC3 (client01) Router2 (rt02) APPENDIX Physical Network Diagram Logical Network Diagram Equipment, Machinery, Installations and Materials required... 20

3 3/20 1 EXAM 1.1 CONTENTS This Exam Project proposal consists of the following document/file: 1. Exam sheet (this document) 2. Task confirmation sheet 1.2 INTRODUCTION The competition has a fixed start and finish time. You have to decide by yourself how to allocate your available time. You have to confirm each task of your doings on a separate sheet. This means if you have processed the task, check the appropriate checkbox. Otherwise, this task will not be assessed and you will not get points. If you mark any task as done but you haven t done anything you will lose these points! Use the default configuration if you are not given the details. 1.3 INSTRUCTION TO THE COMPETITOR Do not bring any materials with you to the competition. Mobile phones must not to be used. Do not disclose any competition material / information to any person during each day s competition. Read the whole competition script prior you start with your work tasks. 1.4 DESCRIPTION OF PROJECT AND TASKS AI Computing Inc. is a fast growing startup company. The board of management have made the decision to reorganize the IT architecture to enable scalability and the integration of branch offices. In order to accomplish the strategy, a virtual server infrastructure must be built. Branch offices should be connected to the headquarter, if ever possible with dynamic routing. Visiting guests can use the provided WiFi connection to access the internet that is logically separated from the internal network. A brief overview of the upcoming changes is available in the network diagrams. Please consider the logical and the physical diagram Client The client (PC3) is located in the branch office, which is the designated workplace for employees. You don t have to setup this computer. Just apply the configuration as mentioned in the tasks Server To reduce hardware and maintaining costs the servers are virtualized Network AI Computing Inc. uses a modern and reliable cisco network infrastructure.

4 4/ IMPORTANT HINTS On some difficult tasks there are hints which gives you some advice how to configure. A hint is written in italic and begins with: Hint: If you re not familiar If you are not familiar with the configuration of network devices Cisco and trunking/routing, try to use a flat network design. You will only lose points for the network tasks. All Cisco devices could be configured with the light blue rollover cable and putty (on Tools USB stick) The tasks will be judged by functionality. Maybe there are different ways to achieve the solution requested by the script. Your solutions must be reproducible by the experts by using an appropriate level of documentation. If the administrator or root password isn t set to the given defaults and it isn t documented somewhere, the judges will not be able to mark your work and you will lose points.

5 5/ PART 1 HEADQUATER ESXi server on PC1 (hypervisor02) Use PC2 as the ESXi machine. The operating system VMWare ESXi is already installed on PC2. You can use this preconfigured installation. Before you start with the configuration, check the following settings in the BIOS (use F10 to enter the BIOS). BIOS settings: Set timezone (UTC +1) and date / time correctly Enable VTx (Security -> System Security) Enable VTd (Security -> System Security) ESXi settings: Set timezone (UTC +1) and date / time correctly Root password: Skills2016 (already given) Configure the network as specified in the network diagram Default gateway: DNS server: , DNS suffix: ai-computing.com Configure hostname: hypervisor02 Rename datastore1 to esx.vms Network settings: Create a new vswitch with name: vswitch1 Create a new port group called Internet on vswitch1 ESXi server are configured by vsphere Client. You will find it on the USB stick. Use a computer installed with windows to configure ESXi.

6 6/ VM Debian Linux (web01) Install Debian 8 as virtual machine on hypervisor02. Virtual machine settings: VM HW version: 11 Operating system: Debian 8 CPU: 2 Cores, 2GB RAM Disk: 40 GB, Thin provisioning Virtual machine name: web01 Make sure the time/date on the Hypervisor is correctly set before install the VM! Operating system installation: Use iso image on the USB stick to install Debian 8 Use swiss german keyboard layout Use network settings given in the network diagram Default gateway: DNS server: , Hostname: web01 Domain name: ai-computing.com Root password: Skills2016 Install open-vm-tools Install follow services Web server MySQL Configure the web server for listening on port 80 and configure the following virtual hosts o o The virtual host www shows your name The virtual host web01 shows default apache2 website It works On virtual host web01 enable basic authentication and create a user web with password web Use password Skills2016 Create database: ai_computing Create table: algorithms o Create column name type varchar(100) Add a row with value MD5 SSH server Install a SSH server Enable root login

7 7/ VM Sophos Firewall (fw01) Install Sophos UTM as virtual machine on hypervisor02. Virtual machine settings: VM HW version: 11 Operating system: Other Linux (64bit) CPU: 2 Cores, 2GB RAM Disk: 40 GB, Thin provisioning Virtual machine name: fw01 Add second network card with port group Internet Operating system installation: Use the Sophos image located on the USB stick to install Sophos UTM Timezone: Europe/Zurich Keyboard layout: German Webadmin: eth0 Configure IP addresses as specified in the network diagram Use 64bit kernel The Sophos Management web interface is reachable under System settings: Hostname: fw01 Company: AI Computing Admin password: Skills2016 Admin account trade39@ai-computing.com Add network interface called Internet configure IP address specified in the appendix Configure default gateway on Internet interface: Firewall configuration: OSPF o Router ID: o Configure area o Configure internal interface for OSPF with MD5 o Authentication: MD5 with password secret o OSPF should work together with Cisco router OSPF If OSPF does not work with Cisco router add a static route for network /24 reachable under NAT o ACLs o o o Enable outbound NAT for all Intern clients to interface Internet (Masquerading) Allow any protocol from Internal to network /24 and vice versa Allow any protocol from Internal to Internet Deny any other access

8 8/20 o o Ping settings: Gateway is ping visible, ping from gateway, gateway forwards pings Traceroute settings: Gateway is traceroute visible, gateway forwards traceroute

9 9/ Hyper-V server on PC1 (hypervisor01) Use PC1 as the Hyper-V machine. The operating system Windows Server 2012 r2 is already installed on PC1. You can use this preconfigured installation. Before begin you have to check the following settings in BIOS (use F10 to enter the BIOS). BIOS settings: Set timezone (UTC +1) and date / time correctly Enable VTx (Security -> System Security) Enable VTd (Security -> System Security) For login to preinstalled machine use username administrator with password Skills2016 System settings: Set timezone (UTC +1) and date / time correctly keyboard layout: swiss german Hostname: hypervisor01 Install network card driver located on the usb stick Configure the network as specified in the network diagram DNS suffix: ai-computing.com Default gateway: Deactivate IE-ESC for users and admins (Internet Explorer Enhanced Security) Disable Windows firewall Hyper-V: Install the Hyper-V role Use Ethernet as network connection

10 10/ VM Domain Controller (ad01) Install Windows Server 2012 R2 as virtual machine on hypervisor01. Virtual machine settings: VM generation 2 Operating system: Windows Server 2012 r2 CPU: 2 Cores, 3GB RAM Disk: 60 GB, Thin provisioning Virtual machine name: ad01 Make sure the time/date on the Hypervisor is correctly set before install the VM! Operating system installation: Use iso image on the USB stick to install windows server 2012 r2 System configuration: Hostname: ad01 Administrator password: Skills2016 Deactivate IE-ESC for Users and Admins (Internet Explorer Enhanced Security) Use network settings given in the network diagram Hostname: ad01 Default gateway: Disable Windows Firewall Enable RDP Install the following services Active Directory Services: DNS Server: DHCP Server: Domain name (AD): ai-computing.com Netbios: ai-computing Use for active directory recovery password (DSRM): Skills2016 Save Active Directory unattended installation script under C:\ad-install.ps1 Configure reverse lookup zone for the /24 network Configure the forward zone ai-computing.com o Configure the following A records: dns01.ai-computing.com web01.ai-computing.com o Configure the following CNAME records: web01.ai-computing.com Enable DHCP service for /24 network o range: o default GW: o DNS: , Other tasks:

11 11/20 Rename the Administrator to Admin Install WinSCP located on the USB stick Copy putty on the desktop of the administrator (also located on the USB stick) Create following organisation units on top-level (ai-computing.com): AI-COMPUTING Create following organisation units under AI-COMPUTING OU: MARKETING MOBILE IT GROUPS Create following security groups in OU GROUPS: Create security group sg_marketing (Domain local) Create security group sg_mobileuser (Domain local) Create security group sg_it (Domain local) Create the following users: Use a scripting language Name Username Password Organisation Unit Group membership mobileuser1... mobileuser120 mobileuser{1..120} Skills2016 MOBILE sg_mobileuser marketing1... marketing15 marketing{1..15} Skills2016 MARKETING sg_marketing it1 it1 Skills2016 IT sg_it Shares: Create a folder C:\Share Share the folder Make sure that sg_marketing and sg_it have full rights, sg_mobileuser have read rights Group Policy For Domain controller ad01 (Default Domain Controller Policy): Allow logon locally for domain users Group Policy - for all users Create a new policy object on top level named all_users Map the SMB share \\ad01.ai-computing.com\share to X:\ Disable first sign-in animation for Microsoft windows

12 12/20 Group policy - for users in IT OU: Create a new policy object named it Should automatically be included in the local administrators group Group policy - for users in MARKETING OU: Create a new policy object named marketing Are not allowed to access the CMD.exe Application Group policy - for users in MOBILE OU: Create a new policy object named mobile Set the default homepage (only Internet Explorer, not for Edge) to web01.ai-computing.com The default homepage setting must not be changeable Restrict use of USB Storage Devices Group policy - for client01: Create a new policy object named client01 At logon on this computer, users should see this message before logging in: For authorized usage only. Unauthorized usage is strictly prohibited.

13 13/ VM Debian Linux (dns01) Install Debian 8 as virtual machine on hypervisor01. Virtual machine settings: VM generation 2 Operating system: Debian CPU: 2 Cores, 2GB RAM Disk: 60 GB, Thin provisioning Virtual machine name: dns01 Make sure the time/date on the Hypervisor is correctly set before install the VM! Operating system installation: Use iso image on the USB stick to install Debian 8 Use swiss german keyboard layout Use network settings given in the network diagram Default gateway: DNS server: , Hostname: dns01 Domain name: ai-computing.com Root password: Skills2016 Install open-vm-tools Backup DNS: TFTP: Use this server as backup DNS server for the DNS zone ai-computing.com Make sure that tftp directory is writable Copy running-config from rt01 to the tftp server. Filename: rt01.cfg

14 14/ Router1 (rt01) Connect interface GE0/1 to rt02 and GE0/2 to swi01 port01 Configuration: Execute write erase to start with a clean configuration Activate security module on the router with the following command: o configure terminal o license boot module c2900 technology-package securityk9 Write configuration to flash and reboot Set enable password Skills2016 Configure the physical ports on rt01 as specified in the network diagram Configure IP addresses as specified in the network diagram Configure the hostname as specified in the network diagram Configure domain name: ai-computing.com Enable SSH v2 remote management services o Create user cisco with password cisco for SSH login Enable OSPF routing protocol o Propagate the networks: /28, /24 with area ID o Enable MD5 authentication. Use secret as key Configure ACLs to meet the flowing requirements Source Destination Protocol Access Intern Branch Office IP Allow Branch Office Intern IP Allow Intern Internet IP Allow Internet Intern IP Deny

15 15/ Switch (sw01) Configuration: Execute write erase to start with a clean configuration Set enable password Skills2016 Configure the physical ports on sw01 as specified in the table below Configure the hostname as specified in the network diagram Configure VLANs and IP addresses as specified in the network diagram Configure default gateway: Enable spanning-tree portfast by default Configure domain name: ai-computing.com Enable SSH v2 remote management services o Create user cisco with password cisco for SSH login PORT CONNECT TO MODE 01 rt01 GE0/2 access (VLAN 10) 02 PC1 hypervisor01 access (VLAN 10) 03 PC2 hypervisor02 access (VLAN 10) 04 ap01 trunk 05 empty access (VLAN 10) 06 empty access (VLAN 10) 07 empty access (VLAN 30) 08 empty access (VLAN 30) 11-END empty shutdown Access Point (ap01) Connect ap01 to swi01 port 04 AP01 was already pre configure by a colleague. Unfortunately he did not finish his work. The access point is only accessible over SSH with IP address specified in the network diagram (use putty on the USB stick). Do not change IP or SSH configuration otherwise you will lose all points of this task. The username for SSH access is cisco with password Skills2016 Enable password: Skills2016 Please let the network radio interfaces disabled! Otherwise you will be penalised (and you allow strangers to access your infrastructure) guest SSID is already properly configured Configuration: Configure SSID int with WPA2 pre shared key Skills2016 Configure both radio interfaces but do not activate them

16 16/ PART 2 BRANCH OFFICE Windows 10 on PC3 (client01) Use PC3 as the Windows 10 client. The operating system Windows 10 is already installed on PC3. You can use this preconfigured installation. Before begin you have to check the following settings in BIOS (use F10 to enter the BIOS). BIOS settings: Set timezone (UTC +1) and date / time correctly For login to preinstalled machine use username trade39 with password Skills2016 System settings: Hostname is client01 Enable local Administrator with password Skills2016 Delete any other user Join the client to the domain Configure network settings as specified in the network diagram Turn off the Windows firewall Applications: Install.NET Framework 3.5 with the usb stick use the following command: dism.exe /online /enable-feature /featurename:netfx3 /all /source:e:\sources\sxs /limitaccess Install the ciscorollovercable.exe (Driver) for using the cisco configuration cable located on the USB Stick Install VMWare vsphere Client located on the USB Stick Put WinSCP and Putty on the desktop Make sure that a shortcut of VMWare vsphere Client is located on the desktop

17 17/ Router2 (rt02) Connect interface GE0/1 to rt01 and GE0/2 to PC3 Configuration: Execute write erase to start with a clean configuration Activate security module on the router with the following command: o configure terminal o license boot module c2900 technology-package securityk9 Write configuration to flash and reboot Set enable password Skills2016 Configure the physical ports on rt02 as specified in the network diagram Configure IP addresses as specified in the network diagram Configure the hostname as specified in the network diagram Configure domain name: remote.ai-computing.com Enable SSH v2 remote management services o Create user cisco with password cisco for SSH login Enable OSPF routing protocol o Propagate the networks: /28, /24 with area ID o Enable MD5 authentication. Use secret as key Enable DHCP service for /24 network o range: o default GW: o DNS: ,

18 18/20 2 APPENDIX 2.1 Physical Network Diagram

19 19/ Logical Network Diagram

20 20/ Equipment, Machinery, Installations and Materials required Computers: Network: PC (3x) Display (2x) Keyboard (2x) Mouse (2x) Additional software: Additional equipment: Cisco Switch 2960s series (1x) Cisco Router 2911 series (2x) Cisco Wireless CAP2702 (1x) Tools USB Stick including: o Drivers Cisco USB Rollover Intel NIC for Windows Server 2012 R2 o Operating Systems Debian 8.5 (DVD 1 3) Windows Server 2012 R2 Sophos ASG 9 o Sources (sxs) Windows.NET 3.x o Tools Notepad++ Cisco Packet Tracer 6 Putty VMware vsphere Client WinSCP Power cables 8x Rollover cables (Console cable for cisco devices) Miscellaneous patch cable 6x (2-4 m)

Day 1 IT Network Systems Administration Trade 39 WSC 2011 London

1/9 worldskills 2011 trade 39 - day1 Day 1 IT Network Systems Administration Trade 39 WSC 2011 London 2/9 worldskills 2011 trade 39 - day1 Overview 1 EXAM...3 1.1 CONTENTS...3 1.2 INTRODUCTION...3 1.3