Chapter 6: Infrastructure Services

Size: px

Start display at page:

Download "Chapter 6: Infrastructure Services"

Gwen Webb
5 years ago
Views:

1 Chapter 6: Infrastructure Services Network Time Protocol There are many things involved in the securing of a network such as security logs along with an accurate date and timestamp. Secondly, when an attack is encountered on a network, it is important to identify when the attack is occurred and the order in which a specified attack encountered on a network. Log messages can be accurately time stamped by the synchronization of clocks on hosts and network devices manually as well as using Network Time Protocol. Typically, the date and time settings on the router can be set using one of two methods: Manually set the date and time Configure the Network Time Protocol (NTP) The figure below shows an example of manually updating the clock. As a network grows, it becomes difficult to ensure and verify that all infrastructure devices within a network are operating with synchronized time. Even in a smaller network environment, the manual method is not ideal. For example, if a router reboots, how will it get an accurate date and timestamp? A better solution to prevent manual configuration of time and date in a network is to configure the Network Time Protocol (NTP) on the network. This protocol allows networking devices on the network to synchronize their time and date with an NTP server device. This is a better way that a group of NTP clients obtain time and date information from a single source has more consistent time settings. When NTP is configured in the network, it can synchronize to a NTP server, which is publicly available, or it can be synchronize to a private master clock. NTP uses UDP port 123 and is documented in RFC Here is an example to set manually Time and Date on a device. R1#clock set 11:00:00 12 may 2017 // To set time 11 hr 00 min 00 sec and date 12 th May 2017 R1#show clock // To check the Time and date running on the device IPSpecialist.net 185

NTP Authentication NTP version 3 (NTPv3), and later versions, supports a cryptographic authentication technique between NTP peers. This authentication can be used to mitigate an attack.

2 NTP Authentication NTP version 3 (NTPv3), and later versions, supports a cryptographic authentication technique between NTP peers. This authentication can be used to mitigate an attack. Three commands are used on the NTP master and the NTP client: ntp authenticate ntp authentication-key key-number md5 key-value ntp trusted-key key-number Without NTP Authentication configuration, Network time information still exchange between server and clients but the difference is these NTP clients do not authenticate the NTP server as a secure source such as what if the legitimate NTP server goes down and Fake NTP server overtake the real NTP server. Use the show ntp associations detail command to confirm that the server is an authenticated source. IPSpecialist.net 186

3 Use the show ntp status command to confirm that the server and Client is synchronised IPSpecialist.net 187

Syslog In a network where a certain event occurs, networking devices have a trusted technique to inform or notify the network administrator by detailed system messages.

4 Syslog In a network where a certain event occurs, networking devices have a trusted technique to inform or notify the network administrator by detailed system messages. These messages may be either non-critical or significant. Network administrators have a number of options for storing, interpreting, and viewing these messages, and for being alerted to those messages that could have the greatest impact on the network infrastructure. One of the most common methods to access system messages that devices provide is by using protocol called syslog. Syslog is a system logging protocol, which keeps monitoring the event running on the system, and store the message to the desired location. It was developed for UNIX based systems in the 1980s, but was first documented in 2001 as RFC 3164 by IETF. Syslog uses port 514 (UDP) to send event notification messages over IP networks. Many of the networking devices support syslog, routers, switches, servers, firewalls, and other network appliances. The syslog allows the networking devices to send their system logging messages across the network to syslog servers. It is possible to build a special out-of-band (OOB) network for this purpose. There are several different types of syslog server software packages for Windows and UNIX. Many of them are freeware. IPSpecialist.net 188

The syslog logging service provides three primary functions: The ability to collect logging messages for monitoring and troubleshooting The ability to select the specific type of logging information

5 The syslog logging service provides three primary functions: The ability to collect logging messages for monitoring and troubleshooting The ability to select the specific type of logging information that is captured The ability to specify the destinations to store the captured syslog messages Simple Network Management (SNMP) SNMP protocol was developed to allow the manageability of devices by the administrator, such as servers, routers, switches, workstations on an IP network. It allows the network administrators to manage network performance of a network, find, troubleshoot and solve network problems, design and plan for network growth. SNMP is an application layer protocol. It provides communication between managers and agents. The SNMP system is consist of three elements: SNMP manager SNMP agents (managed node) Management Information Base (MIB) To configure the SNMP on a networking device, initially, it is necessary to define the relationship between the SNMP manager and the SNMP agent. The SNMP manager runs SNMP management software on its device. The SNMP manager can collect information from SNMP agents. By using the get action it can collect the information and can change configurations on an agent device using the set action. SNMP agents can also forward information directly to an Network Management System (NMS) using traps. IPSpecialist.net 189

6 SNMP uses port number 162, UDP port, to retrieve and send information. Lab 6-1: SNMP, Logging and NTP Case Study: In this Lab, Router 2 is considered as NTP server to synchronize the time with its clients. NTP authentication is set to md5. Router 1 is acting as a NTP client to receive time updates from NTP server. Win PC with SNMP agent is used for monitoring the traffic as well as logging server. Topology: Configuration: NTP-Client(config)#int eth 0/1 NTP-Client(config-if)#ip add NTP-Client(config-if)#no sh *Mar 1 00:00:55.355: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up IPSpecialist.net 190

7 *Mar 1 00:00:56.355: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up NTP-Client(config)#int eth 0/0 NTP-Client(config-if)#ip add NTP-Client(config-if)#no sh *Mar 1 00:01:11.387: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:01:12.387: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed st NTP-Client(config)#snmp-server group Mygroup v3 auth read Myview NTP-Client(config)#snmp-server user MyUser Mygroup v3 auth md5 P@$$word:10 NTP-Client(config)# *Mar 1 00:19:43.803: Configuring snmpv3 USM user, persisting snmpengineboots. Please Wait... NTP-Client(config)#do show snmp engineid Local SNMP engineid: C2030DAD0000 Remote Engine ID IP-addr Port NTP-Client(config)#snmp-server engineid remote NTP-Client# *Mar 1 00:21:10.575: %SYS-5-CONFIG_I: Configured from console by consoleconfig t Enter configuration commands, one per line. End with CNTL/Z. NTP-Client(config)#snmp-server engineid remote C2030DAD0000 NTP-Client(config)#ntp authenticate NTP-Client(config)#ntp authentication-key 1 md5 P@$$word:10 NTP-Client(config)#ntp trusted-key 1 NTP-Client(config)#ntp server NTP-Client(config)#end NTP-Client#show *Mar 1 00:27:47.019: %SYS-5-CONFIG_I: Configured from console by console clock *00:27: UTC Fri Mar NTP-Client (config)#ntp update-calendar NTP-Client#show ntp status Clock is synchronized, stratum 11, reference is nominal freq is Hz, actual freq is Hz, precision is 2**18 reference time is DCA7F5D4.FA7567B1 (03:56: UTC Mon Apr ) clock offset is msec, root delay is msec root dispersion is msec, peer dispersion is msec NTP-Client(config)#logging IPSpecialist.net 191

NTP-Client(config)#logging trap debugging NTP-Client(config)#service timestamps debug datetime msec NTP-Client(config)#service timestamps log datetime msec NTP-Server NTP-Server#clock set 03:52:00

8 NTP-Client(config)#logging trap debugging NTP-Client(config)#service timestamps debug datetime msec NTP-Client(config)#service timestamps log datetime msec NTP-Server NTP-Server#clock set 03:52:00 apr *Apr 24 03:52:00.000: %SYS-6-CLOCKUPDATE: System clock has been updated from 00:22:26 UTC Fri Mar to 03:52:00 UTC Mon Apr , configured from console by console. NTP-Server#show clock 03:52: UTC Mon Apr NTP-Server(config)#int eth 0/1 NTP-Server(config-if)#ip add NTP-Server(config-if)#no sh NTP-Server(config)#ntp master 10 NTP-Server(config)#ntp authentication-key 1 md5 P@$$word:10 SNMP verification: Click Manage Engine pinned to task bar of provided VMware image of windows-7. Following windows will open. Click first time user to enter. IPSpecialist.net 192

Enter the out-of-band management address range as shown below: By

9 Discovery gives user ability to find devices on IP address range defined by user. Enter the out-of-band management address range as shown below: By clicking on next, a web page will be prompted for user credentials we defined on R1 and R2 router. IPSpecialist.net 193

10 Goto Add Credentials Enter the credentials of SNMPv3 AuthNoPriv model. Select MD5 as hashing algorithm as it has to match with R1 s configuration. IPSpecialist.net 194

11 Select MyUser and Click Next Next IPSpecialist.net 195

12 Select Interfaces and Click Next Configure Schedule and Click Next After clicking on finish, OPManager will responding to incoming SNMP traffic. IPSpecialist.net 196

13 OPManager must identify router R1 after completing discovery process as shown below: By double clicking on R1.IPSpecialist.net, it is clear that OP Manager has identified router category and its model number along with interfaces and other features. IPSpecialist.net 197

Importance of securing such important information

14 After adding every device from discovery process, Dashboard can be used to view important information. Importance of securing such important information displayed by SNMP should be clear at this stage. IPSpecialist.net 198

Syslog Verification: Open source 3CDaemon server used in this lab contains Syslog server along with FTP and other servers. Click on 3CD icon on start menu to start it and view its operations.

15 Syslog Verification: Open source 3CDaemon server used in this lab contains Syslog server along with FTP and other servers. Click on 3CD icon on start menu to start it and view its operations. As OP Manager is also installed on same management station. We may need to stop manage engine service before starting syslog server. To stop manage engine service, type services.msc in start menu and stop the Manage Engine OPManager service. Following figure shows few logs received by Syslog server. In order to use SCP for file transfer anywhere inside IOS of cisco devices, we need to enable SCP server option on cisco devices. Following command is used to make device an SCP server. SSH needs to be enabled first for SCP to work as SCP based sessions use SSH encrypted flow of data. R2(config)#ip scp server enable. Any scp supported software can be used from workstation to access any location within cisco IOS. NTP Verification NTP-Client>en NTP-Client#config t Enter configuration commands, one per line. End with CNTL/Z. IPSpecialist.net 199

16 NTP-Client(config)#ntp update-calendar NTP-Client(config)#end May 12 06:16:56.468: %SYS-5-CONFIG_I: Configured from console by console NTP-Client#show ntp status IPSpecialist.net 200

Lab 6-2: DHCPv6 Case Study: In this Lab, A DHCPv6 is explained. A router enabled with IPv6 as acting as a DHCPv6 Server assigning IP addresses to the client dynamically.

17 Lab 6-2: DHCPv6 Case Study: In this Lab, A DHCPv6 is explained. A router enabled with IPv6 as acting as a DHCPv6 Server assigning IP addresses to the client dynamically. Consider a DHCPv6 Router and a Client Topology: Configuration: Router(config)#ipv6 unicast-routing Router(config)#ipv6 dhcp pool DHCPv6_Pool Router(config)#ipv6 local pool IPv6-pool AAA::/48 64 Router(config)#ipv6 dhcp pool DHCPv6_Pool Router(config-dhcp)#prefix-delegation pool IPv6-pool Router(config-dhcp)#ex Router(config)#int eth 0/0 Router(config-if)#ipv6 add AAAA::1/64 Router(config-if)#ipv6 nd other-config-flag Router(config-if)#ipv6 nd managed-config-flag Router(config-if)#ipv6 dhcp server DHCPv6_Pool rapid-commit Router(config-if)#ipv6 enable Router(config-if)#no sh Router(config-if)#ex Router(config)# *Mar 1 00:14:21.451: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:14:22.451: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up IPSpecialist.net 201

18 Verification: Run ipconfig command on cmd of the PC to check Dynamically Assigned IPv6 address Ping the Router interface AAA::1 from PC IPSpecialist.net 202

19 Lab 6-3: NAT-Static Case Study: In this lab, Host is map on to hide internal network. Static Network Address Translation is configured to map to (Outside) and Resolve the return traffic from to (Inside). Topology: Configuration: Router(config)#int eth 0/0 Router(config-if)#ip add Router(config-if)#no sh %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up Router(config)#int eth0/1 Router(config-if)#ip add Router(config-if)#no sh %LINK-5-CHANGED: Interface FastEthernet1/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to up Router(config)#ip nat inside source static Router(config)#int eth0/1 Router(config-if)#ip nat out Router(config)#int eth 0/0 Router(config-if)#ip nat in IPSpecialist.net 203

Verification Ping from host 10.0.0.10 to the destination 11.

20 Verification Ping from host to the destination Router# show ip nat translation IPSpecialist.net 204

21 Lab 6-4: NAT-Dynamic Case Study: In this Lab, host ranging from to are allowed by using Access-list to be mapped with the Addresses in the pool ranging from to Topology: Configuration Router 1: Router(config)#hostname R1 R1(config)#int eth 0/1 R1(config-if)#ip add R1(config-if)#no sh *Mar 1 00:00:47.987: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:00:48.987: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R1(config)#int eth 0/0 R1(config-if)#ip add R1(config-if)#no sh *Mar 1 00:01:20.571: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up *Mar 1 00:01:21.571: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up R1(config)#int eth 0/1 R1(config-if)#ip nat inside R1(config)#int eth 0/0 R1(config-if)#ip nat outside R1(config)#access-list 1 permit R1(config)#ip nat pool Dynamic-NAT netmask R1(config)#ip nat inside source list 1 pool Dynamic-NAT IPSpecialist.net 205

22 R1(config)#ip route Router 2 R2(config)#int eth 0/0 R2(config-if)#ip add R2(config-if)#no sh R2(config-if)#ex *Mar 1 00:06:27.403: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:06:28.403: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R2(config)#int lo 0 *Mar 1 00:06:34.319: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up R2(config-if)#ip add R2(config-if)#no sh R2(config-if)#ex Verification: Ping from PC 1 to Lo interface Ping from PC 2 to Lo interface IPSpecialist.net 206

23 Ping from PC 3 to Lo interface R1#Show ip nat translations IPSpecialist.net 207

Port Address Translation Port Address Translation (PAT), is an extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be mapped to a single

24 Port Address Translation Port Address Translation (PAT), is an extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be mapped to a single public IP address. The goal of PAT is to conserve IP addresses. Case Study: Consider the same topology as for Dynamic NAT. In this lab we are assigning the pool of address be mapped with Port address for Port address translation by using Accesslist. Hosts ranging from /8 to /8 are allowed to be mapped on the to pool. Topology: Configuration: Router(config)#hostname R1 R1(config)#int eth 0/1 R1(config-if)#ip add R1(config-if)#no sh R1(config-if)#ex *Mar 1 00:00:47.987: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:00:48.987: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R1(config)#int eth 0/0 R1(config-if)#ip add R1(config-if)#no sh R1(config-if)#ex *Mar 1 00:01:20.571: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up *Mar 1 00:01:21.571: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up R1(config)#int eth 0/0 R1(config-if)#ip nat outside R1(config)#int eth 0/1 R1(config-if)#ip nat inside IPSpecialist.net 208

25 R1(config)#access-list 1 permit R1(config)#ip nat pool Dynamic-NAT netmask R1(config)#ip nat inside source list 1 pool Dynamic-NAT overload R1(config)#ip route Router 2: R2(config)#int eth 0/0 R2(config-if)#ip add R2(config-if)#no sh R2(config-if)#ex *Mar 1 00:06:27.403: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:06:28.403: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R2(config)#int lo 0 *Mar 1 00:06:34.319: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up R2(config-if)#ip add R2(config-if)#no sh R2(config-if)#ex R2(config)#ip route Verification Ping from PC 1 to Lo interface Ping from PC 2 to Lo interface IPSpecialist.net 209

26 Ping from PC 3 to Lo interface R1#Show ip nat translations IPSpecialist.net 210

IPv6 NAT NAT-64 NAT64 is the process of translating an IPv6 address to IPv4 address for communication and vice versa. NAT-64 requires an ipv4 address and Ipv6 address prefix having 32-bit space.

27 IPv6 NAT NAT-64 NAT64 is the process of translating an IPv6 address to IPv4 address for communication and vice versa. NAT-64 requires an ipv4 address and Ipv6 address prefix having 32-bit space. When a IPv6 client send a packet, IPv6 header with ipv4 address embedded in the 32 bit space forwarded to the NAT-64 translator. The translator map the embedded ipv6 address to the IPv4 address Figure 26. NAT-64 NTPv6 Network Prefix Translation for IPv6 allows the feature to translate IPv6 header to IPv6 header and Vice Versa. This process is used to translate the internal Network to the outside network and vice versa. The router translating the address is known as NPTv6 Translator. It does not interfere with encryption of payload. VRF, NAT64 (on same interface) features are not supported by NPTv6. Multicasting, Firewall, ALG (application level gateway), HSL (High Speed Logging) and Syslog are supported with NPTv6. As far as IPv6 Prefix format is concerned, first 48 bits represents prefix. NPT translator makes sure that internal and External addresses are of the same prefix, if not, it uses padding. SLA Cisco IP SLA (Service Level Agreement) allows you to monitor Services in order to increase performance, productivity, lowering the network outage frequency. IP SLA monitors the traffic on runtime (Active Traffic Monitoring) to check continuity and IPSpecialist.net 211

reliability to measure performance of the network. It can perform assessment of the network as well as QOS, helps in troubleshooting the network.

28 reliability to measure performance of the network. It can perform assessment of the network as well as QOS, helps in troubleshooting the network. Benefits Monitoring, Agreement, and Measurement Provides Service Level Agreement. Network performance Monitoring/ Measurement. Jitter, latency, or packet loss Monitoring Continuous, Reliable, and Predictable measurements. Network health assessment Verification for new IP services. End-to-end network availability monitoring Provides proactive verification and connectivity testing. Troubleshooting (VoIP) Voice over IP performance monitoring MPLS, VPN performance monitoring and network verification IP SLAs Operation Types Domain Name System Dynamic Host Control Protocol File Transfer Protocol Hypertext Transfer Protocol ICMP echo&jitter ICMP path echo&path jitter Transmission Control Protocol (TCP) connect UDP echo and jitter UDP jitter for VoIP& more Figure 26. IP SLA IPSpecialist.net 212

Tracking Tracking an object is differentiated by a unique number that is specified commandline interface (CLI) while configuring Tracking. Processes use this number to track object.

29 Tracking Tracking an object is differentiated by a unique number that is specified commandline interface (CLI) while configuring Tracking. Processes use this number to track object. The tracking process polls the tracked object for value changes and sends any changes periodically, either immediately or after a delay. Lab 6-5: Tracking Case Study: In this Lab, we are tracking the status of Loopback interface of Router 2 ( /30) from Router 1. By tracking the status, we can observe up and down time of the interface, we can also change the route in case of delay and use other features of tracking. Topology Diagram: R1 Configuration: R1(config)#int eth0/1 R1(config-if)#ip add R1(config-if)#no sh R1(config-if)#ex *Mar 1 00:00:55.355: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up *Mar 1 00:00:56.355: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up R1(config)#int eth 0/0 R1(config-if)#ip add R1(config-if)#no sh R1(config-if)#ex *Mar 1 00:01:11.387: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up *Mar 1 00:01:12.387: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up R1(config)#ip sla 1 R1(config-ip-sla)#icmp-echo source-ip R1(config-ip-sla-echo)#threshold 200 R1(config-ip-sla-echo)#ex R1(config)#ip sla schedule 1 life forever start-time now R1(config)#track 1 rtr 1 reachability or R1(config)#track 1 ip sla 1 reachability R1(config-track)#delay down 10 up 10 R1(config-track)#ex IPSpecialist.net 213

R1(config)#ip route 0.0.0.0 0.0.0.0 1.0.0.2 R1(config)#ex R1(config)#end R1# *Mar 1 00:07:00.

30 R1(config)#ip route R1(config)#ex R1(config)#end R1# *Mar 1 00:07:00.923: %SYS-5-CONFIG_I: Configured from console by console Router 2: R2(config)#int eth 0/0 R2(config-if)#ip add R2(config-if)#no sh R2(config-if)#ex *Mar 1 00:01:22.007: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up *Mar 1 00:01:23.007: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up R2(config)#int lo 0 R2(config-if)#ip add R2(config-if)#ex Verification: R2#show ip int br R1# show track 1 R1# show ip sla statistics IPSpecialist.net 214

NetFlow Net Flow allows administrators to identify applications causing network congestion, diagnose slow performance, and verify that an application receives the appropriate amount of bandwidth

31 NetFlow Net Flow allows administrators to identify applications causing network congestion, diagnose slow performance, and verify that an application receives the appropriate amount of bandwidth based on its class of service (CoS). Benefits include network, application, and user monitoring; network planning; and accounting/billing. Minimally, a flow must contain a source IP address, a destination IP address, and an ingress interface. Traffic is considered in the same flow if the packets contain the same IP addressing, port numbers, and layer 3-protocol information. Sending flow information to a collector can be CPU-intensive. One concern with a collector is the number of devices and amount of flow information the collector will receive. Version 5 is the most common implementation of Net Flow. Flow monitors are Net Flow components that allow you to globally define Net Flow parameters, like the cache size and the number of unique flow records to collect. This configuration is then applied to a respective interface. The show ip cache flow command visualizes the general Net Flow data captured by an IOS device. Net Flow Configuration Figure 9 NetFlow configuration example To configure NetFlow, you must perform the following four tasks: IPSpecialist.net 215

32 1. Enable data capturing on an interface: ingress is incoming and egress is outgoing. 2. Define the IP address and UDP port of the NetFlow collector. 3. Optionally identify the version of NetFlow to export the flow information. 4. Verify the NetFlow configuration, operation, and statistics. The following commands show how to enable NetFlow from the CLI and how to export the information to a NetFlow collector: Lab 6.6 Configuration of NetFlow Exporter on Cisco Routers. As explained in previous section of NetFlow, one of the components of NetFlow i.e. exporter needs to be configured on a device whose interface traffic needs to be analysed. Exporter will send this traffic back to the management station where dedicated NetFlow Analyzer software is running. Commercially available NetFlow softwares have their own requirements. For example, the software used in this lab discovers the NetFlow devices via SNMP. So previously, configure SNMP lab must be implemented before starting this lab. NetFlow exporter will be configured on R1 and Firewall in this lab and then different types of traffic will be generated from management station to analyse the behaviour of NetFlow. R1 R1(config)# snmp-server view MyView iso included R1#sho snmp engineid Local SNMP engineid: C2061B R1(config)#snmp-server engineid remote C2061B R1(config)#snmp-server group MyGroup v3 auth read MyView access SNMP-ACL R1(config)#IP access-list standard SNMP-ACL R1(config-std-nacl)#permit host R1(config)# snmp-server user MyUser MyGroup v3 auth md5 P@$$word:10 Above commands configure SNMPv3 on Route R1 with read access to management station! ( ) only. R1(config)# flow exporter EXPORT-1 R1(config-flow-exporter)# destination R1(config-flow-exporter)#transport udp 9996 R1(config-flow-exporter)#source fastethernet 0/0 Above commands create an exporter object with name EXPORT-1. UDP port number 9996! is configured for NetFlow. As of our lab scenario, all traffic from management station hits! fastethernet 0/0 of R1. So FastEthernet 0/0 is configured as source interface for capturing! NetFlow statistics. R1(config)#flow monitor MONITOR-1 R1(config-flow-monitor)#record netflow ipv4 original-input R1(config-flow-monitor)#exporter EXPORT-1 IPSpecialist.net 216

Above commands define the record type i.e. the type if data collected by NetFlow instance. This information will be exported to management station for NetFlow Analyzer by EXPORT-1.

33 Above commands define the record type i.e. the type if data collected by NetFlow instance. This information will be exported to management station for NetFlow Analyzer by EXPORT-1. In the final step, go to the desired interface and apply the monitor instance in! desired direction. R1(config)#interface fastethernet 0/0 R1(config-if)#IP flow monitor MONITOR-1 input Verification Open Solarwinds real-time NetFlow Analyzer from start menu of managementstation. The following screen would appear.!! Click button to define the SNMPv3 credentials for R1.! IPSpecialist.net 217

Change the port to 9996, select the FastEthernet0/0 interface of R1 and click to show! NetFlow statistics.

34 !!! After defining the SNMPv3 credentials, click test button for verification! After clicking OK, R1 should appear in main window of NetFlow Analyzer. Change the port to 9996, select the FastEthernet0/0 interface of R1 and click to show! NetFlow statistics. In order to observe some meaningful results, make multiple SSH/TELNET sessions to R1 and multiple PING sessions with multiple devices from management and END-USER LAN. IPSpecialist.net 218

35 Showing Traffic in and Traffic Out over interfaces in bps R1# show flow export EXPORT-1 R1# show flow monitor MONITOR-1 IPSpecialist.net 219

36 IPSpecialist.net 220

CCNA 4 PRAKTISK PRØVE NOTER

CCNA 4 PRAKTISK PRØVE NOTER Af Adam Andersen TEC CISCO Indhold PPP with Authentication... 2 Configure PPP PAP / CHAP Authentication... 2 Multi link... 2 Debug serial / PPP... 2 Configure Static/Dynamic