Lab #4 TECH 4281 Spring 2015

Transcription

1 Lab #4 TECH 4281 Spring 2015 If you have not done so yet, install GNS3 from When starting GNS3, please name the project Lab3_Yourname. For this lab, we will be using the Cisco.bin file c3640 jk9s mz rar that can be found at ik9s mz rar. Download the file. Move it to the desktop and then decompress the.rar file to the.image file using your favorite rar utility (eg 7 zip, WinRar). The image file is really the.bin file containing the Cisco IOS operating system for the C3640 router. To use the.image file above, open GNS3. Then go to Edit Preferences and select Dynamips IOS Routers in the box on the left side of the screen. Then click on the NEW button on the bottom of the window. Browse to the.image file and then click on the NEXT button. You can just click NEXT in the window (leaving the defaults). You can also leave the default Ram and click NEXT again. The next screen asks you for Network Adapters. The Cisco C3640 series has various plug in modules, call Wan Interface Cards (WIC) that can interface to various media, some with multiple connections. We will select a 4 port Ethernet WIC (the NM 4E) for slot 0, then select NEXT. The next screen is the Idle PC window. Just click FINISH on this screen to complete the install of the C3640 Router. Now draw the following network:

2 Using the Virtual PC Simulator (VPCS) for PC1 3, a standard switch and the C3640 Router we just configured. Draw the connections show. It does not matter what port you use on the switch. On the router use Ethernet 0/0. Once you have drawn the network, start the simulation with the icon (which will turn on ALL devices) and then click on the icon to open a terminal for each device (except SW1, which is non configurable). At this point, it is suggested but not required, to run the Idel PC test. To run the test, right click on the Router and select IDLE PC from the menu. This will run a test on the computer to determine how much processing time can be devoted to the Cisco IOS. This does help the simulation run better and prevent lockups. Objective #1 Configure a static network with the following specifications: PC (gateway of ) PC (gateway of ) PC (gateway of ) R on Ethernet 0/0. [HINT do not forget to bring the interface up on R1!] Test and verify that all devices can ping one another. Demo to instructor and have him sign off. Objective #2 Setup a Loopback Adapter on your PC and connect it to R1 on Ethernet 0/3: Using the instructions found at gns3 realnetworks.html, add a loopback adapter to your PC. For steps 4 and 5, make the IP address of the new adapter with a netmask of with a gateway of and connect the Cloud to your current GNS3 simulation connecting it to R1 Ethernet 0/3. Configure the R1 interface for the IP address of Turn off the PC s firewall. Then verify you can ping to and from every device and interface. You should discover that one device cannot ping the routers far interface or beyond. Which device is it? Speculate why this is the case?

3 Now do a trace or tracerout from that device to a device on the far side of the router. Does this give you a hint? Now speculate what is happening and why? Demo to instructor and have him sign off. Objective #3 Setup remote access to the router. Lets add the ability to telnet into the router instead of having to be connected to the console port. To accomplish this, you need to do the following Router (config)# line vty 0 4 Router (config line)# password yourpass Router (config line)# login Now Verify that you can login via a TELNET session from the pc. You should have to enter yourpass to gain access to the router. You should have EXEC access to the router. But now try to do an enable. You will be told % no password set. Now add: Router (config)# enable secret passseccret and try to enable. This time you should be asked for a passedword. Type in the passseccret from the above. There is one last issue that becomes obvious when you look at the running configuration. You will see that yourpass under the line vty 04 is visible in the clear in the configuration. Although this is not a problem, since you have to be in Privileged Exec mode to see the configuration, what if someone is looking over your shoulder. For a minimal level of security, you can do a: Router (config)# service password encryption after doing this command you should see the MD7 hash of the password in the configuration. Note that MD7 hash is easily decrypted (just look at but it does offer some little bit of security. The issue of TELNET being insecure still remains. Try the following:

4 Set up a capture between the cloud and the router (to do this right click on the connection between the two, and select start capture). Then on the PC telnet into the router and log in and also go into Privileged Exec Mode. Take a look at the wireshark packets. Look at the subsequent TELNET Packets from to The last character in the packet is the key pressed. In a future lab we will look at setting up SSH Telnet instead..just remember that TELNET IS INSECURE! Some cisco devices have a web interface as well. To turn on this interface, you do have to have an enable password set, which we already have done above, then the following configuration has to be done: Router (config)# ip http server now open a browser on the PC and try to go to the webpage at You should get a Cisco Systems Webpage. Demo a telnet and http connection to the instructor and have him sign off. Objective #4 Save your GNS3 project (all of the project) Note that GNS3 s Save Project command only saves the diagram of the network, but NOT the router configurations or VPCS configurations. To make sure these are saved with the project do the following before doing a Save Project 1. In each VPCS console enter the command save 2. In each router, do a copy running config to startup config 3. after steps 1 and 2 are completed, then do a Save Project in GNS3 Do the above, and then shut down GNS3 and all associated windows (wireshark, terminals etc). Demo to the instructor that the above was done successfully by opening the project, proving the configuration is correct and have him sign off. Now create a text file with the enable secret and vty password. Save the file to the path c:/users/username/gns3/projects/lab3_yourname/passwords.txt. Zip the entire project (ie the c:/users/username/gns3/projects/lab3_yourname directory and all sub directories) and submit the file via the online submission system. Other Helpful Hints: 1. While doing this exercise, did you ever get a Translating domain server ( ) where the was a mistyped command. According to Cisco Why "Translating... domain server ( )" Messages Occur

5 By default, when a command in user or enable mode is entered into a router and this command is not recognized, the router believes that this is the host name of a device that the user is attempting to reach using telnet. Therefore, the router tries to resolve the unrecognized command into an IP address by doing an IP domain lookup. If no specific domain server has been configured on the router, the router will issue a broadcast for the command to be translated into an IP address. It can take several seconds for the router prompt to return while the router waits for a response to its Domain Name System (DNS) broadcast. To stop this from occurring, use the no ip domain lookup command to turn this off. 2. Were you typing and all of the sudden a message appeared in the middle of the line you were typing? This can be very annoying on cisco equipment. To solve this issue, add the line: Router (config line)# logging sync to each line interface you use (con, aux or vty). This will still print the message, but then reprint what you have typed thus far. It does help!