Lab 8.5.3 Configuring the PIX Security Appliance as a DHCP Server Objective Scenario Topology Estimated Time: 15 minutes Number of Team Members: Two teams with four students per team. In this lab, students will learn the following objectives: Configure a DHCP address pool and domain name Verify DHCP Server settings on a PIX Security Appliance Verify DHCP operation on a PC Configure DHCP Server using PDM A small company has deployed several remote offices and do not have any onsite IT support. To minimize the support cost when adding new devices, the IT administrator will configure the DHCP feature on the PIX Security Appliance. A PIX Security Appliance can provide DHCP services for hosts located on the trusted network, allowing it to automatically assign IP addresses to machines that are configured for dynamic addressing. This figure illustrates the lab network environment. 1-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
Preparation Verify the starting configuration is on the pod firewall and test the connectivity. Access the PIX console port using the terminal emulator on the student PC. If desired, save the configuration to a text file for later analysis. Refer back to the Student Lab Orientation if more help is needed. Tools and Resources In order to complete the lab, the following is required: Standard PIX Security Appliance lab topology Console cable HyperTerminal Additional materials Further information about the objectives covered in this lab can be found at, http://www.cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_book0918 6a0080104234.html http://www.cisco.com/en/us/products/sw/netmgtsw/ps2032/products_user_guide_list.html Command list In this lab exercise, the following commands will be used. Refer to this list if assistance or help is needed during the lab exercise. Command dhcpd address ip1[-ip2] [if_name] dhcpd domain domain_name dhcpd lease lease_length show dhcpd [binding statistics] Description This command defines the IP pool address range. The size of the pool is limited to 32 addresses with a 10-user license and 128 addresses with a 50-user license on the PIX 501. All other PIX Security Appliance platforms support 256 addresses. This command defines the DNS domain name. For example, example.com. This command defines the length of the lease, in seconds, granted to DHCP client from the DHCP server. The lease indicates how long the client can use the assigned IP address. The default is 3600 seconds. The minimum lease length is 300 seconds, and the maximum lease length is 2,147,483,647 seconds. Displays the binding and statistics information associated with the dhcpd commands. 2-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
Step 1 Verify the PIX Security Appliance Inside IP Address Complete the following steps to verify the PIX Security Appliance inside IP address: a. Display the currently configured IP addresses: PixP(config)# show ip address b. Ensure that the IP address on the inside interface is 10.0.P.1. c. Ensure that the IP address on the outside interface is 192.168.P.2 Establish a connection to the RBB web server at 172.26.26.150 by completing the following substeps: d. Open a web browser on the student PC. e. Use the web browser to access RBB by entering http://172.26.26.150. f. When prompted for a username and password, use cisco and cisco. Step 2 Configure the PIX Security Appliance DHCP Server Feature Complete the following steps to configure the PIX Security Appliance DHCP server feature: a. In order to configure the PIX as a DHCP server, the inside interface is required to be configured with an IP address. This IP address is required to be on the same subnet as the pool of dynamically assigned DHCP addresses. To configure the DHCP address pool use the dhcpd address command in the Global Configuration mode. The PIX Security Appliance will assign the client one of the addresses from this pool to use for a given length of time. The default is the inside interface. Specify a range of addresses for the DHCP server to distribute: PixP (config)# dhcpd address 10.0.P.32-10.0.P.253 inside b. Specify the IP address of the Domain Name System (DNS) server the client will use: PixP (config)# dhcpd dns 10.0.P.10 1. What is the maximum number of DNS servers that can be entered? c. Specify the IP address of the WINS server the client will use: PixP (config)# dhcpd wins 10.0.P.10 d. Specify the lease length to be granted to the client. This lease equals the amount of time in seconds the client can use its allocated IP address before the lease expires. The default value is 3600 seconds. Specify the lease length to grant the client as 3000: PixP (config)# dhcpd lease 3000 f. Configure the domain name the client will use: PixP (config)# dhcpd domain cisco.com g. Enable the DHCP daemon within the PIX Security Appliance to listen for DHCP client requests on the enabled interface: 3-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
PixP (config)# dhcpd enable inside h. Display the DHCP configuration and binding: PixP (config)# show dhcpd dhcpd address 10.0.P.32-10.0.P.253 inside dhcpd dns 10.0.P.10 dhcpd wins 10.0.P.10 dhcpd lease 3000 dhcpd ping_timeout 750 dhcpd domain cisco.com dhcpd enable inside i. Save the DHCP configuration: PixP (config)# write memory Step 3 Test the PIX Security Appliance DHCP Server Feature Complete the following steps to test the PIX Security Appliance DHCP server feature: a. Reconfigure the student PC to obtain IP and DNS addresses from a DHCP server. b. Open a Windows 2000 command prompt, and release and renew the IP address: C:\> ipconfig /release C:\> ipconfig /renew c. Verify that the PIX Security Appliance assigned an IP address, subnet mask, DNS address, WINS address, and domain name to the student PC by opening a Windows 2000 command prompt and viewing the IP configuration: C:\> ipconfig /all 2. Fill in the information below: Connection-specific DNS suffix IP Address Subnet Mask Default Gateway If you are not using Windows 2000, please ask your instructor for the commands and instructions to check the DHCP configurations. d. Establish a connection to the RBB web server at 172.26.26.150 by completing the following substeps: e. From the Student PC, ping 172.26.26.150. f. Open a web browser and access the web server by entering http://172.26.26.150. Step 4 Disable the PIX Security Appliance DHCP Server Feature Complete the following steps to disable the PIX Security Appliance DHCP server feature: a. Save the current configuration to a text file if desired. b. Clear all dhcpd commands, binding, and statistics information: 4-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
PixP (config)# clear dhcpd c. Verify that the DHCP feature has been disabled: PixP (config)# show dhcpd d. Reconfigure the IP addressing information for the Student PC. IP address: 10.0.P.11 Subnet mask: 255.255.255.0 Default gateway: 10.0.P.1 (Where P = pod number) Step 5 Configure DCHP Server using PDM Using PDM, configure the DHCP server feature. a. Open a browser and access PDM at https://10.0.p.1 b. Click on the Configuration button c. Click on System Properties tab. d. Click on DHCP Services>DHCP Server. e. Highlight the inside interface on which to configure DHCP. f. Click Edit. 5-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
g. Select the Enable DHCP check box. h. Enter the range of IP addresses, from lowest to highest, that the DHCP server will use in the DHCP Range: 10.0.P.32 to 10.0.P.253 The range of IP addresses must be on the same subnet as the interface on which the DHCP server is configured, but must not include the IP address of the DHCP server interface itself. i. Click OK. j. (Optional) Enter the optional settings. Dns / wins: 10.0.P.10 Lease: 3000 Ping timeout: 750 domain: k. Click Apply. cisco.com l. If the Preview CLI Commands window appears, click the Send button to continue. m. Click on the Advanced button below the ping timeout field What are these settings for? Answer: Point to TFTP Server IP address if running IP Telephony phone system. Step 6 Test the PIX Security Appliance DHCP Server Feature Complete the following steps to test the PIX Security Appliance DHCP server feature: a. Reconfigure the student PC to obtain IP and DNS addresses from a DHCP server. b. Open a Windows 2000 command prompt, and release and renew the IP address: C:\> ipconfig /release C:\> ipconfig /renew d. Verify that the PIX Security Appliance assigned an IP address, subnet mask, DNS address, WINS address, and domain name to the student PC by opening a Windows 2000 command prompt and viewing the IP configuration: C:\> ipconfig /all e. From the Student PC, ping 172.26.26.150. f. Open a web browser and access RBB by entering http://172.26.26.150. 6-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.
Step 7 Disable the DHCP on the Student PC Complete the following steps to reset the student PC: a. Disable DHCP on the student PC. Manually enter the following parameters: IP Address- 10.0.P.11 / Subnet Mask - 255.255.255.0 / Default Gateway - 10.0.P.1 c. At a command prompt, verify that the configuration supplied by the PIX Security Appliance DHCP server has been removed, and that the following IP configuration exists on the Student PC: C:\> ipconfig /all Hostname - StudentPCP DNS Server -(blank) DHCP Enabled -no IP Address - 10.0.P.11 Subnet Mask - 255.255.255.0 Default Gateway - 10.0.P.1 7-7 Fundamentals of Network Security v 1.2 - Lab 8.5.3 Copyright 2004, Cisco Systems, Inc.