4.4.7 Lab - CIsco Answer
4.4.7 Lab - CIsco Answer
Topology
Addressing Table
Device Interface IP Address Subnet Mask Default Gateway Switch Port
R2
G0/0/1 10.2.2.2 255.255.255.252 N/A N/A
R3 G0/0/0 10.2.2.1 255.255.255.252 N/A N/A
R3
G0/0/1 192.168.3.1 255.255.255.0 N/A S3 F0/5
PC-A NIC 192.168.1.3 255.255.255.0 192.168.1.1 S1 F0/6
PC-C NIC 192.168.3.3 255.255.255.0 192.168.3.1 S3 F0/18
Blank Line, No additional information
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 1 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
Objectives
Part 1: Configure Basic Device Settings
Cable the network as shown in the topology.
Configure basic IP addressing for routers and PCs.
Configure OSPF routing.
Configure PC hosts.
Verify connectivity between hosts and routers.
Part 2: Configure and Encrypt Passwords on Routers R1 and R3
Configure encrypted password for console, auxiliary port, and virtual access lines.
Encrypt clear text passwords
Configure a warning message banner
Part 3: Configure Enhanced Username Password Security on Routers R1 and R3
Create new user accounts
Log in using the user accounts
Part 4: Configure the SSH Server on Routers R1 and R3
Configure a domain name
Generate RSA encryption key
Configure and verify SSH configurations
Background / Scenario
The router is a critical component in any network. It controls the movement of data into and out of the network
and between devices within the network. It is particularly important to protect network routers because the
failure of a routing device could make sections of the network, or the entire network, inaccessible. Controlling
access to routers and enabling reporting on routers is critical to network security and should be part of a
comprehensive security policy.
In this lab, you will build a multi-router network and configure the routers and hosts. Use various CLI tools to
secure local and remote access to the routers, analyze potential vulnerabilities, and take steps to mitigate
them. Enable management reporting to monitor router configuration changes.
Note: The routers used with hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.6 (universalk9
image). The switches used in the labs are Cisco Catalyst 2960+ with Cisco IOS Release 15.2(7) (lanbasek9
image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco
IOS version, the commands available and the output produced might vary from what is shown in the labs.
Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.
Note: Before you begin, ensure that the routers and the switches have been erased and have no startup
configurations.
Required Resources
3 Routers (Cisco 4221 with Cisco XE Release 16.9.6 universal image or comparable with a Security
Technology Package license)
2 Switches (Cisco 2960+ with Cisco IOS Release 15.2(7) lanbasek9 image or comparable)
2 PCs (Windows OS with a terminal emulation program, such as PuTTY or Tera Term installed)
Console cables to configure Cisco networking devices
Ethernet cables as shown in the topology
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 2 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
Instructions
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 3 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
b.Issue the show ip route command to verify that all networks display in the routing table on all routers.
R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 4 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
show run, show ip ospf neighbor, and show ip route commands to help identify routing protocol-related
problems.
a.Configure the enable secret encrypted password on both routers. Use the type 9 (SCRYPT) hashing
algorithm.
R1(config)# enable algorithm-type scrypt secret cisco12345
NOTE:
“algorithm-type scrypt” command is not supported by the IOS of 4321 router
in the Packet Tracer.
Question:
How does configuring an enable secret password help to protect a router from being compromised by an
attack?
Answer: Enable secret password encrypts a password that cannot be decrypted to its original form.
Type your answers here.
b.Use the security passwords command to set a minimum password length of 10 characters.
R1(config)# security passwords min-length 10
Step 2: Configure basic console, auxiliary port, and virtual access lines.
Note: Passwords in this task are set to a minimum of 10 characters but are relatively simple for the benefit of
performing the lab. More complex passwords are recommended in a production network.
a.Configure a console password and enable login for routers. For additional security, the exec-timeout
command causes the line to log out after 5 minutes of inactivity. The logging synchronous command
prevents console messages from interrupting command entry.
Note: To avoid repetitive logins during this lab, the exec-timeout command can be set to 0 0, which
prevents it from expiring. However, this is not considered a good security practice.
R1(config)# line console 0
R1(config-line)# password ciscocon
R1(config-line)# exec-timeout 5 0
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 5 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
R1(config-line)# login
R1(config-line)# logging synchronous
Question:
When you configured the password for the console line, what message was displayed?
Ans: Password too short - must be at least 10 characters. Password configuration failed
swers here.
b.Configure a new password of ciscoconpass for the console.
c.Configure a password for the AUX port for router R1.
R1(config)# line aux 0
R1(config-line)# password ciscoauxpass
R1(config-line)# exec-timeout 5 0
R1(config-line)# login
d.Telnet from R2 to R1.
R2> telnet 10.1.1.1
Questions:
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 6 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
Questions:
Can you read the console, aux, and vty passwords? Explain. No, the command above encrypted all
passwords.
Type your answers here.
At what level (number) is the default enable secret password encrypted? 5
Type your answers here.
At what level (number) are the other passwords encrypted? 7
Type your answers here.
Which level of encryption is harder to crack. Explain. 7, because the higher the level of encryption, the
more complex the encryption algorithm would be.
Type your answers here.
NOTE:
“algorithm-type” command is not supported by the IOS of 4321 router in the
Packet Tracer.
Question:
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 7 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
NOTE:
“algorithm-type” command is not supported by the IOS of 4321 router in the
Packet Tracer.
What is the difference between logging in at the console now and previously? Now, the user01
credentials need to be put in.
Type your answers here.
d.After logging in, issue the show run command.
Question:
Were you able to issue the command? Explain. No, because user01 does not have the privileged access.
Type your answers here.
e.Enter privileged EXEC mode using the enable command.
Question:
Were you prompted for a password? Explain. Yes. Console password has been set as ‘secret’.
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 8 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
Step 2: Configure a privileged user for login from the SSH client.
a.Use the username command to create the user ID with the highest possible privilege level and a secret
password.
R1(config)# username admin privilege 15 algorithm-type scrypt secret
cisco12345
NOTE:
“algorithm-type scrypt” command is not supported by the IOS of 4321 router
in the Packet Tracer.
What was the router prompt after you entered the password? ‘#’
Type your answers here.
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 9 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
Note: If you add the keyword telnet to the transport input command, users can log in using Telnet as well as
SSH, however, the router will be less secure. If only SSH is specified, the connecting host must have an SSH
client installed.
Step 5: Generate the RSA encryption key pair for the router.
The router uses the RSA key pair for authentication and encryption of transmitted SSH data.
a.Configure the RSA keys with 1024 for the number of modulus bits. The default is 512, and the range is from
360 to 2048.
R1(config)# crypto key generate rsa general-keys modulus 1024
The name for the keys will be: R1.netsec.com
R1(config)#
*Dec 16 21:24:16.175: %SSH-5-ENABLED: SSH 1.99 has been enabled
a. Issue the ip ssh version 2 command to force the use of SSH version 2.
R1(config)# ip ssh version 2
R1(config)# exit
Note: The details of encryption methods are covered in later module.
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 10 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
NOTE:
Packet Tracer users should use “Telnet/SSH Client” icon within the “Desktop” tab as seen below:
a.From PC-A, SSH into router R1 using the terminal emulation software by selecting the SSH option and
providing the IP address of R1. Confirm that you will trust the host (R1) when prompted in the security
alert.
b.Enter the admin username and password cisco12345 when prompted.
c.At the R1 privileged EXEC prompt, enter the show users command.
R1# show users
Question:
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 11 of 12 www.netacad.com
Lab - Configure Secure Administrative Access
NOTE:
Within Packet Tracer simulator, we do not need to use PuTTY SSH application at all.
Reflection
1. Explain the importance of securing router access and monitoring network devices.
Type your answers here.
2. What advantages does SSH have over Telnet?
Type your answers here.
Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many
interfaces the router has. There is no way to effectively list all the combinations of configurations for each router
class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An example
of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in
Cisco IOS commands to represent the interface.
end of document
2015 - 2022 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 12 of 12 www.netacad.com