Your partner for Success. CCIE Security v5 Lab Access Guide

Transcription

1 Your partner for Success CCIE Security v5 Lab Access Guide Version 1.9 Author: Cloudmylab Support

2 Contents Introduction... 4 Audience... 4 Disclaimer... 4 Legal Liability... 4 Topology... 4 Devices Used... 7 Physical Devices... 7 Virtual Devices... 7 Getting Access to the POD... 8 DEVICE ACCESS... 9 How to access the devices... 9 Guest Machine Reload... 9 Retrieve Snapshots Setup WLC and WSA for Lab Setup ISE for Lab Setting up Routers and ASAs for the lab Accessing the Devices console Device List Devices CLI Credentials Quick Device access Virtual Device Access Example Method 1 for Virtual Devices with CLI access Example Method 2 for Virtual Devices with CLI Access Accessing Windows Based machines Example Method 1 for windows based Device: Example Method 2 for windows based Device LAB Devices IP Details Physical Connectivity FIREWALLS Switches IP And VLAN MAP Virtualization Logic Lab Shortcuts... 27

3

4 Introduction Cloudmylab offers a platform to run any lab topology. CCIE Security v5 lab has been adopted from various vendors and is built on the topology and configuration provided by them. We have designed this lab with customers and online forum feedback. The Lab topology mentioned below is mostly virtual and it aligns with Cisco s CCIE V5 blueprint. Audience This lab guide is intended for the students who are preparing for CCIE Security V5 and wish to use our platform for practicing the CCIE labs. Disclaimer These labs have been designed and built by topology provided by vendors selling CCIE workbooks and online student forums. Cloudmylab is not responsible for the accuracy of the labs or workbooks. Cloudmylab does not endorse any CCIE workbook vendor or company. We have designed our platform per Cisco s blueprint and it can be used for any lab scenario. Students will be responsible for loading any pre-configuration. Cloudmylab does not sell any workbooks or CCIE topology. Legal Liability Cloudmylab is an IAAS (Infrastructure as a service), PAAS (Platform as a service) and LAAS (LAB as a service) provider. Cloudmylab either owns or lease the equipment used in the certification labs or proof of concept labs. Cloudmylab uses all genuine software either procured or evaluation from the manufacturer. Cloudmylab encourages its users to use their own licensing and/or lease it from Cloudmylab. Cloudmylab doesn t resell hardware, software or licensing. Cloudmylab has no liability for software and licensing used by the customer in their purchased service instance. Cloudmylab doesn t endorse any Cisco Certification labs workbook Vendors. Cloudmylab doesn t endorse any Juniper Certification labs workbook Vendors. Cloudmylab doesn t endorse any Microsoft Certification labs workbook Vendors. Cloudmylab doesn t endorse any VMware Certification labs workbook Vendors. Topology The following topology has been adopted from CCIE University, this is a topology available on online forums and vendors page. Cloudmylab offers a platform to run topologies and in no way own or endorse any vendor topology.

5 Figure 1

6 Figure 2 Figure 3

7 Devices Used Physical Devices This section details physical devices and software version in the topology. Virtual Devices Device Name Device Model Software Version ASA1 ASA5515X ASA2 ASA5515X ASA3 ASA5512X ASA4 ASA5512X SW1 C3750X (SE) SW2 C3560X (SE) Table 1 This section details virtual devices and the software version used in the topology. Device Name Device Model Software Version R1 CSR1000v S R2 CSR1000v S R3 CSR1000v S R4 CSR1000v S R5 CSR1000v S R6 CSR1000v S R7 CSR1000v S R8 CSR1000v S R9 CSR1000v S R10 CSR1000v S R11 CSR1000v S R12 CSR1000v S R13 CSR1000v S R14 CSR1000v S R15 CSR1000v S R16 CSR1000v S R17 CSR1000v S R18 CSR1000v S ASAv1 ASAv ASAv11 ASAv ASAv2 ASAv ASAv22 ASAv ISE ISE-VM-K9 2.1 vwlc WLC-VM 8.5 WSA WSA-VM NGIPS FP-NGIPS 6.1 FMC FP-FMC 6.1 AMP FP-AMP 6.1 Table 2

8 Getting Access to the POD 1. There are two methods you can get access to the access detail as mentioned below: a.) Check for the URL and Port Number in the from Figure 4 b.) You can alternatively log in to your account and under my account > Rack access, you will see the details Figure 5

9 2. Please login with the credentials provided. Figure 6 3. After logging in successfully, you will see a customized Desktop from where you can access all the devices. DEVICE ACCESS This section details how to access the physical and virtual devices. How to access the devices Starting the lab environment: (Needs updating) Guest Machine Reload 1. Once you get the access to the Guest Desktop Environment, A.) Open the VMware vsphere client and login with the details in table below: Rack Rack-1 Rack-2 IP Address/hostname Username ccisesec ccisesec Password Ccie123! Ccie123! Table 3

10 Figure 7 2. Reload the Guest Virtual Machines in the table below using the VMware vsphere Client before you start your lab. Windows machine Wireless-PC MS-AD MAB-CLIENT DOT1X-PC Table 4 The steps below explain how to reload a Virtual Machine: Step 1: After your successful login to ESX host, select the guest machine. Figure 8

11 Step 2: Right Click on the guest machine, click on power and select Power Off. Figure 9 Step 3: Wait for VM to power off, then right click on the guest machine, click on power and select Power On Figure 10

12 Retrieve Snapshots 1. Retrieve the snapshot for the Guest Virtual Machines in the table below using the VMware vsphere Client before you start your lab. Virtual Machines NGIPS FMC AMP Table 5 Step1: Right Click on the machine - Snapshot snapshot manager Figure 11 Step2: Under Snapshot Manager Click on the BASE-CONF - GO To Figure 12

13 Setup WLC and WSA for Lab Simply restart both WLC and WSA to reset the configuration. Step1: Right Click on the machine - Power Power Off Step2: Right Click on the machine - Power Power On Setup ISE for Lab This section defines how to setup ISE for the lab use. Please follow the steps carefully. 1. Go to Administration > Backup & Restore. 2. Select FTP from the drop-down menu for History for Repository. 3. Select the lab you want to restore to. When prompted for encryption key, type ISEisC00L and select Restore ADE-OS configuration.

14 Figure 13 Note: You will have to again join the AD and re-generate the CA certificates. Setting up Routers and ASAs for the lab Step 1: Open Secure CRT, close any tabs if already open. Step 2: Under Erase folder, double click the device that you want to reset.

15 Accessing the Devices console A.) Device Access All the devices are pre-setup for console access and follow the screenshots for a quick access. Device List The table below contains the list of devices and their console access details. Terminal Server is a server which host the console connections, do not confuse this with actual device IP. Device Name Rack-1 Rack-2 Port No Terminal IP address Port No IP address R R R R R R R R R R R R R R R R R R SW SW ASA ASA ASA ASA AP Terminal Server ASAv ASAv ASAv ASAv ASAv ISE vwlc WSA NGIPS FMC AMP Table 6

16 Devices CLI Credentials Table below contains the credentials to access CLI for the undermentioned devices: Device Name Username Password R1 cisco cisco R2 cisco cisco R3 cisco cisco R4 cisco cisco R5 cisco cisco R6 cisco cisco R7 cisco cisco R8 cisco cisco R9 cisco cisco R10 cisco cisco R11 cisco cisco R12 cisco cisco R13 cisco cisco R14 cisco cisco R15 cisco cisco R16 cisco cisco R17 cisco cisco R18 cisco cisco SW1 cisco cisco SW2 cisco cisco ASA1 cisco cisco ASA2 cisco cisco ASA3 cisco cisco ASA4 cisco cisco AP1 Cisco Cisco Terminal Server cisco cisco ASAv1 cisco cisco ASAv11 cisco cisco ASAv2 cisco cisco ASAv22 cisco cisco ASAv1 cisco cisco ISE admin Ccie123 vwlc admin Ccie123 WSA admin ironport NGIPS admin Ccie123 FMC admin Ccie123 AMP admin Ccie123 CUCM administrator cciecollab Table 7

17 Quick Device access This section details on how to access the devices via CLI: 1. Click on SecureCRT. Virtual Device Access Virtual devices can be accessed using two methods: Figure Using Secure CRT CLI. Its strongly recommended to use terminal emulator to access all the Virtual Routers and Firewall. 2. Using the vsphere Console

18 Example Method 1 for Virtual Devices with CLI access Open SecureCRT >> Click on the Plus Sign against Virtual Device >> Select the relevant device Figure 15

19 Example Method 2 for Virtual Devices with CLI Access Open Vmware Vsphere Client >> right click on the relevant machine >> click open console Figure 16 Accessing Windows Based machines There are 4 Windows Based machines as follows: Machine Rack-1 MGMT IP Rack-2 MGMT IP Username Password Wireless-PC admin Ccie123 Windows Server admin Ccie123 Dot1x PC admin Ccie123 MAB-PC admin Ccie123 Table 8 Example Method 1 for windows based Device: Click on the remote desktop shortcut on the desktop, you will see 4 shortcuts and named appropriately. Enter the username and password when prompted

20 Figure 17

21 Example Method 2 for windows based Device Open Vmware Vsphere Client >> right click on the relevant machine >> click open console LAB Devices IP Details Figure 18 This section details the management IP assigned to the following virtual machines in the table below. Please do refer to the topology as well. IP Address Device Name AD Candidate PC Wireless PC NGIPS FMC ISE WSA vwlc CUCM AMP AMP Table 9

22 Physical Connectivity This Section explains the physical Connectivity FIREWALLS Switches PHYSICAL FIREWALL CONNECTIONS From interface To interface ASA3 Management0/0 SW2 GigabitEthernet0/3 ASA3 GigabitEthernet0/1 SW2 GigabitEthernet0/1 ASA3 GigabitEthernet0/0 SW2 GigabitEthernet0/2 ASA4 Management0/0 SW2 GigabitEthernet0/6 ASA4 GigabitEthernet0/1 SW2 GigabitEthernet0/4 ASA4 GigabitEthernet0/0 SW2 GigabitEthernet0/5 ASA1 GigabitEthernet0/0 SW1 GigabitEthernet 1/0/1 ASA1 GigabitEthernet0/1 SW1 GigabitEthernet 1/0/2 ASA1 GigabitEthernet0/2 SW1 GigabitEthernet 1/0/3 ASA1 GigabitEthernet0/3 SW1 GigabitEthernet 1/0/4 ASA2 GigabitEthernet0/0 SW1 GigabitEthernet 1/0/5 ASA2 GigabitEthernet0/1 SW1 GigabitEthernet 1/0/6 ASA2 GigabitEthernet0/2 SW1 GigabitEthernet 1/0/7 ASA2 GigabitEthernet0/3 SW1 GigabitEthernet 1/0/8 Table 10 PHYSICAL SWITCHES From interface To interface SW1 GigabitEthernet1/0/12 ESX Server 0 SW1 GigabitEthernet1/0/10 SW2 GigabitEthernet0/10 SW2 GigabitEthernet0/7 AP G0 SW2 GigabitEthernet0/9 IP PHONE GigabitEthernet0 Table 11

23 IP And VLAN MAP R1 GigabitEthernet ASA1_V GigabitEthernet0/1 GigabitEthernet ASA2_V GigabitEthernet0/1 GigabitEthernet VSWITCH-MGMT NA GigabitEthernet NGIPS GigabitEthernet0/1 R2 GigabitEthernet VSWITCH-MGMT NA GigabitEthernet NGIPS GigabitEthernet0/0 GigabitEthernet R3 GigabitEthernet2 R3 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet R2 GigabitEthernet3 GigabitEthernet SW1_V GigabitEthernet1/0/9 GigabitEthernet R6 GigabitEthernet4 GigabitEthernet R13 GigabitEthernet1 R4 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet3 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet R5 GigabitEthernet3.100 GigabitEthernet R5 GigabitEthernet3.200 GigabitEthernet R5 GigabitEthernet3.20 R5 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet3 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet R4 GigabitEthernet3.100 GigabitEthernet R4 GigabitEthernet3.200 GigabitEthernet R4 GigabitEthernet3.20 R6

24 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet3 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet ASA1 GigabitEthernet0/1 GigabitEthernet ASA2 GigabitEthernet0/2 GigabitEthernet R3 GigabitEthernet4 R7 GigabitEthernet VSWITCH-MGMT R8 GigabitEthernet VSWITCH-MGMT NA R9 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet3 TRUNK NA SW1_V GigabitEthernet0/1 GigabitEthernet ASA1 GigabitEthernet ASA2 GigabitEthernet R12 GigabitEthernet3 R10 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet R12 GigabitEthernet4 GigabitEthernet4 150 NA VSWITCH-MGMT NA R11 GigabitEthernet1 150 NA VSWITCH-MGMT NA GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet R12 GigabitEthernet1 R12 GigabitEthernet R11 GigabitEthernet3

25 GigabitEthernet2 150 GigabitEthernet R9 GigabitEthernet4 GigabitEthernet R10 GigabitEthernet3 R13 GigabitEthernet R3 GigabitEthernet5 GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet ASA4 GigabitEthernet0/1 GigabitEthernet4 150 NA VSWITCH-MGMT NA R14 GigabitEthernet ASA4 GigabitEthernet0/1 GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet3 150 NA VSWITCH-MGMT NA R15 GigabitEthernet VSWITCH-MGMT NA GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet ASA4 GigabitEthernet0/1 GigabitEthernet R18 GigabitEthernet3 R16 GigabitEthernet VSWITCH-MGMT NA GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet R18 GigabitEthernet4 R17 GigabitEthernet VSWITCH-MGMT NA GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet R18 GigabitEthernet1 R18 GigabitEthernet R17 GigabitEthernet1 GigabitEthernet2 150 NA VSWITCH-MGMT NA GigabitEthernet R15 GigabitEthernet4 GigabitEthernet R16 GigabitEthernet3 Table 12

26 Virtualization Logic The diagram explains how the devices are connected virtually and physically. ESX server is connected over a trunk and that is how all logical devices are logically connected to the switch Example: Follow the red dotted line for the Traffic Flow. If I was sending a Packet from R13 to ASA 4, here is how the packet will get to the ASA 1. VSWITCH will add a tag of VLAN 1008 and forward it to the SWITCH 2. Switch 1 will Forward it to the trunk based on the ARP info to SW2 3. SW2 will look for ARP and forward it to the Firewall. 4. Now based on the Firewall Rules, Firewall will allow or drop the packet

27 Lab Shortcuts 1. Starting a lab with Specific configuration: Open the physical device console > login > dir flash: #copy flash:base-config startup Reload Check out the video: 2. Clearing console line to get access: Under SecureCRT click on the plus sign against Clear line and Select relevant device to clear Vlan 3. Reloading the devices: All the devices are connected to managed power PDU and you can use the shortcut to boot the devices To get support open a ticket on Support Page or send an to support@cloudmylab.com. Please check the documentation and FAQs beforehand END OF Document