En Security SBA Student Training Ans Key

CCNA Security

Skills-Based Assessment Academy Student Training – Training – Answer Key Topology

IP Addressing Table Device R1

R2

R3

Interface FA0/0 S0/0/0 (DCE) Loopback 1

IP Address 209.165.200.233

Subnet Mask 255.255.255.248

Default Gateway N/A

Switc Port ASA E0/0

10.10.10.1

255.255.255.252

N/A

N/A

172.20.1.1

255.255.255.0

N/A

N/.A

S0/0/0 S0/0/1 (DCE) FA0/1

10.10.10.2

255.255.255.252

N/A

N/A

10.20.20.2

255.255.255.252

N/A

N/A

172.30.3.1

255.255.255.0

N/A

S3 FA0/5

All co!"!# a$" Cop%$&'! Cop%$&'!  1992*2012 C&#co S%#!"+#, S%#!"+#, -c. All $&'!# $"#"$". &# oc+"! &# C&#co C&#co bl&c -o$+a!&o.

a'" 1 o 43

Trusted by over 1 million members

Try Scribd FREE for 30 days to access over 125 million titles without ads or interruptions! Start Free Trial Cancel Anytime.













CCNA Security

Device

Interface S0/0/1

IP Address 10.20.20.1

Subnet Mask 255.255.255.252

Default Gateway N/A

Switc Port N/A

S1

LAN 1

192.168.10.11

255.255.255.0

192.168.10.1

N/A

S2

LAN 1

192.168.10.12

255.255.255.0

192.168.10.1

N/A

S3

172.30.3.11

255.255.255.0

172.30.3.1

N/A

192.168.10.1

255.255.255.0

NA

S2 FA0/24

209.165.200.234

255.255.255.248

NA

R1 FA0/0

CA

LAN 1 LAN 1 (E0/1) LAN 2 (E0/0) N-C

192.168.10.2

255.255.255.0

192.168.10.1

S1 FA0/6

C

N-C

192.168.10.3

255.255.255.0

192.168.10.1

S2 FA0/18

CC

N-C

172.30.3.3

255.255.255.0

172.30.3.1

S3 FA0/18

ASA ASA

!b"ectives Part #$ Configure %asic Device Settings &done by instructor in preparation for e'a() Part *$ Configure Secure +outer Ad(inistrative Access •

Co&'$" "c$%p!" pa##o$# a a lo'& ba"$.

•

Co&'$" EEC !&+"o! o co#ol" a  l&"#.

•

Co&'$" lo'& a&l$" $a!"# a  lo'& "ac"+"!#.

•

Co&'$" SS: acc"## a &#abl" "l"!.

•

Co&'$" local AAA a!"!&ca!&o.

Part ,$ Configure a Site-to-Site .PN between IS+s •

Co&'$" a -#"c #&!"!o#&!" N b"!"" R1 a R3 #&' CC.

Part /$ Configure an IS+ firewall and Intrusion Prevention Syste( •

Co&'$" a ;o"ba#" pol&c% (<F) &$"all o a -SR #&' CC.

•

Co&'$" a -!$#&o $""!&o S%#!"+ (-S) o a -SR #&' CC.

Part 0$ Secure Network Switces •

Co&'$" pa##o$# a a lo'& ba"$.

•

Co&'$" +aa'"+"! LAN acc"##.

•

S"c$" !$k po$!#.

•

S"c$" acc"## po$!#.

•

$o!"c! a'a&#! S a!!ack#. Co&'$" po$! #"c$&!% a &#abl" #" po$!#.















CCNA Security •

Co&'$" a D:C #"$"$ o$ !" &#&" "!o$k.

•

Co&'$" a+&&#!$a!&" acc"## &a "l"! a SS:.

•

Co&'$" a #!a!&c "al! $o!" o$ !" ASA.

•

Co&'$" Local AAA #"$ a!"!&ca!&o.

•

"$&% a$"## !$a#la!&o a &$"all c!&oal&!%

Part 3$ Configure ASA Clientless SS4 .PN +e(ote Access •

Co&'$" a $"+o!" acc"## SSL N #&' ASD=.

•

"$&% SSL N acc"## !o !" po$!al.

5'a( !verview &# #k&ll#ba#" a##"##+"! &# !" &al p$ac!&cal ">a+ o #!"! !$a&&' o$ !" CCNA S"c$&!% co$#". -! &# #&+&la$ !o !" &#!$c!o$ "$#&o, b! &"$# & !" - a$"##&' a o !" "&c"# a$" co&'$". " ">a+ &# &&" &!o #"" pa$!#. " pa$!# #ol b" co+pl"!" #"?"!&all%. - a$! 1 %o "$&% !a! !" ba#&c "&c" #"!!&'# a" b"" p$"co&'$" b% !" &#!$c!o$. - a$! 2, %o #"c$" a "!o$k $o!"$ #&' !" CL- !o co&'$" a$&o# -@S "a!$"# &cl&' AAA a SS:. - a$! 3 %o co&'$" a #&!"!o#&!" N b"!"" R1 a R3 !$o' !" -S $o!"$ (R2). - a$! 4 %o co&'$" a <F &$"all a -S o a -SR. a$! 5 co&'$"# "!o$k #&!c #&' !" CL-. - a$!# 6 a 7 %o co&'$" !" ASA &$"all c!&oal&!% c!&oal&!% a cl&"!l"## SSL N $"+o!" acc"##. Instructor Note$ Tis S%A answer key provides e'plicit step-by-step instructions in eac part and task6 to serve as a reference for te Instructor7 In te actual e'a( &non-answer key)6 tese instructions instructio ns are re(oved and only re8uire(ent re8uire(ents s are specified7 Instructor Note$ o Note$ o pa## !" ">a+, !" #!"! &# ">p"c!" !o #cc"##ll% co+pl"!" all po$!&o# o !" ">a+ & !" !&+"$a+" allo!!" b% !" -#!$c!o$. Instructor Note$ 9it te student version of te S%A6 te topology is pre-built by te instructor7 In te interest of ti(e te instructor sould also pre-configure basic device settings suc as ost na(e6 IP addresses and static routing6 to allow te student to focus on te security related e'a( ob"ectives7 Multiple sets of e8uip(ent are re8uired6 depending on te nu(ber of si(ultaneous e'a(s being conducted7

Note$ " Note$ " $o!"$ co++a# a CC o!p! & !&# SA a$" $o+ C&#co 1841 $o!"$# &! C&#co -@S R"l"a#" 12.4(20) (Aac" - &+a'"). " #&!c co++a# a o!p! a $" $o+ C&#co SC296024 L #&!c"# &! C&#co -@S R"l"a#" 12.2(46)SE (C2960LANASEB9= &+a'"). " ASA &# a 5505 &! @S "$#&o 8.4(2) a ASD= "$#&o 6.4(5). @!"$ $o!"$#, #&!c"#, a C&#co -@S "$#&o# +a% b" #". S"" !" Ro!"$ -!"$ac" S++a$% !abl" a! !" " o !" SA !o "!"$+&" &c &!"$ac" &"!&&"$# !o #" ba#" o !" "?&p+"! & !" SA. D"p"&' o !" $o!"$ o$ #&!c +o"l a C&#co -@S "$#&o, !" co++a# aa&labl" a o!p! p$oc" +&'! a$% $o+ a! &# #o & !&# SA. Note$ =ak" #$" !a! !" $o!"$# a #&!c"# a" b"" "$a#" a a" o #!a$!p co&'$a!&o#. -#!$c!&o# o$ "$a#&' a $"loa&' !" ASA co&'$a!&o a$" &cl" & !&# SA.















CCNA Security •

•

•

•

1 ASA 5505 (@S "$#&o 8.4(2) a ASD= "$#&o 6.4(5) a a#" l&c"#" o$ co+pa$abl") CA &o# , &#!a, o$ &o# 7 &! CC, % SS: cl&"! ("b a F #"$"$ op!&oal) (la# $&" op!&oal) C &o# , &#!a, o$ &o# 7 &! % SS: cl&"! a aa "$#&o 6.> o$ &'"$ (ASD= loa" o !" C &# op!&oal) CC &o# , &#!a, o$ &o# 7 &! CC, % SS: cl&"!, F #"$"$ a -S &l"#. (la# $&" op!&oal)

•

S"$&al a E!"$"! cabl"# a# #o & !" !opolo'%

•

Rollo"$ cabl"# !o co&'$" !" $o!"$#, #&!c"# a ASA &a !" co#ol"

Instructor Notes$ +outer +esource +e8uire(ents$ Note$ " ollo&' $"?&$"+"!# a$" c$&!&cal !o #cc"##l co+pl"!&o o !&# SA. •

•

•

•

•

" $o!"$ !a! $# -S (R3) $"?&$"# a +&&++ o 192= DRA= a a! l"a#! 2= $"" la# +"+o$%. "% +#! al#o b" $&' $a& C&#co -@S R"l"a#" 12.4(11)1 o$ la!"$ (p$""$abl% 12.4(20) o$ la!"$) !o #ppo$! !" "$#&o 5.> o$+a! #&'a!$" packa'". &# SA #"# !" ""$ "$#&o 5.> #&'a!$" &l"#, &c a$" &"p""! o !" C&#co -@S #o!a$". $&o$ !o C&#co -@S $"l"a#" 12.4(11), C&#co -@S -S a 132 b&l!& #&'a!$"# aa&labl" & !" C&#co -@S #o!a$" &+a'". " b&l!& #&'a!$"# a$" a$co" &!o !" C&#co -@S #o!a$" &+a'" o$ backa$ co+pa!&b&l&!%. S!a$!&' &! C&#co -@S $"l"a#" 12.4(11), !"$" a$" o b&l!& (a$co") #&'a!$"# &!& C&#co -@S #o!a$". Sppo$! o$ #&'a!$"# a #&'a!$" "&&!&o &l"# (SDF#) & C&#co -S "$#&o 4.> &# &#co!&" & 12.4(11)1 a $!"$ C&#co -@S $a& #o!a$" $"l"a#"#. o co&'$" -@S -S o$ 12.4(11) a la!"$, a #&'a!$" packa'" & C&#co -S "$#&o 5.> o$+a! &# $"?&$" !o loa #&'a!$"# o a -SR. C&#co p$o&"# a "$#&o 5.> o$+a! #&'a!$" packa'" o$ CL#"$#. o oloa !" la!"#! -S S&'a!$" packa'" a pbl&c c$%p!o k"% &l"#, %o "" a al& CC@ (C&#co.co+) lo'& #"$a+" a pa##o$ a a c$$"! C&#co S"$&c" Co!$ac!. Doloa !" #&'a!$" packa'" (-@SS>>>CL-. (-@SS>>>CL-.pk') pk') $o+ !!p//.c&#co.co+/c&#co/#o !!p// .c&#co.co+/c&#co/#o!a$"/!%p".!+ !a$"/!%p".!+l+&281442967Gca!& l+&281442967Gca!&268438162 268438162 Note$ -! &# $"co++"" !o #" !" la!"#! #&'a!$" &l" aa&labl". :o""$, & !" a+o! o $o!"$ Note$ -! la# +"+o$% &# a &##", co#&"$ oloa&' a ol"$ "$#&o 5.> #&'a!$" &l", &c $"?&$"# l"## +"+o$%. " S364 &l" &# #" &! !&# SA, al!o' ""$ "$#&o# a$" aa&labl". Co#l! CC@ !o "!"$+&" !" la!"#! "$#&o o$ #" & a p$oc!&o p $oc!&o "&$o+"!.

•

C$"a!" !" ollo&' pbl&c c$%p!o k"% &l" a a+" &! real(-cisco7pub7key7t't real(-cisco7pub7key7t't,, o$ #" &! -@S -S

crypto key pubkey-chain rsa named-key realm-cisco.pub key-string 30820122 300D0609 2A86886 !"0D0101 010#0003 82010!00 3082010A 02820101 00$19%93 A8A!12A D6$$"A2 #09"A9"# 206&%3A2 06!&A13! 6!12$&#& %1!16 1"%630D# $02A$2#2 912&%2"! 3"!DD9$8 11!$"A!" D$DD81D9 3$DA&$3 600"D128















CCNA Security

'uit Note$ Te signature package file sould be in te T2TP default directory for PC-C7 Te public key file sould be available on te desktop or oter known location7 R""$ !o Capter 0 4ab A$ Configuring an Intrusion Prevention Syste( &IPS) :sing te C4I and CCP o$ a&!&oal "!a&l# o -S $"?&$"+"!#. I(portant CCP Notes$ •

•

•

R""$ !o Cp 00 Lab A o$ &#!$c!&o# o  o !o &#!all CC. :a$a$"/#o!a$" $"co++"a!&o# $"co++"a!&o# o$ CC &cl" &o# , &#!a, o$ &o# 7 &! aa "$#&o 1.6.0H11 p !o 1.6.0H21, -!"$"! E>plo$"$ 6.0 o$ abo" a Fla# la%"$ "$#&o 10.0.12.36 a la!"$. - !" C o &c CC &# &#!all" &# $&' &o# &#!a o$ &o# 7, &! +a% b" "c"##a$% !o $&'!cl&ck o !" CC &co o$ +" &!"+, a coo#" +un as ad(inistrator . - o$"$ !o $ CC, &! +a% b" "c"##a$% !o !"+po$a$&l% &#abl" a!&&$# p$o'$a+# a @/S &$"all#. =ak" #$" !a! all popp block"$# a$" !$" o & !" b$o#"$.

+outer and Switc Preparation E$a#" !" $o!"$ a #&!c #!a$!p co&'$a!&o#. " #$" !o "l"!" !" vlan7dat vlan7dat &l" &l" $o+ "ac #&!c a "#$" !a! !" #&!c &# o! co"c!" !o ao!"$ #&!c " !&# &# o", o !"$&#" LAN &o$+a!&o $o+ o" #&!c +a% b" !$a#"$$" !o !" o!"$ &a . Fo$ $o!"$ R3, !" -S #&'a!$" (.>+l) &l"# & !" flas$;ipsdir; &$"c!o$%, & p$"#"!, #ol b" "l"!" a !" &$"c!o$% $"+o" p$&o$ !o #!a$!&' !" SA. " &l"# +#! b"  "l"!" $o+ !" &$"c!o$% & o$"$ !o $"+o" &!. I#" !" ollo&' p$oc"$".

(3#show flash -)- --length-1 6389"60 2 93180 3 1821  1#9#6 # 1#0#280 6 11260 " 1038 8 3"08132 20.1.bin 9 #2"89 10 #12000 11 0 12 230621 13 10613 1 6632 1# 28282 16 2#" 1" 91

18

-----date*time-----Dec 1" 2008 20+38+32 Dec 1" 2008 20+#3+26 ,ar 1# 200" 0"+33+3 Dec 1" 2008 20+#3+0 Dec 1" 2008 20+#3+#6 Dec 1" 2008 20+#+1 Dec 1" 2008 20+#+30 Dec 1" 2008 20+0#+32

path sdm.tar es.tar sdmconig-18.cg sslclient-/in-1.1..1"6.pkg common.tar home.tar home.shtml c181-adipsericesk9-m.12c181-adipsericesk9-m.12 -

Dec Dec 4an ,ay ,ay ,ay ,ay ,ay ,ay

128,&.sd dgsdm.tar ipsdir ipsdir*(1-sigde-deault.ml ipsdir*(1-sigde-delta.ml ipsdir*(1-sigde-typede.ml ipsdir*(1-sigde-category.ml ipsdir*(1-sigde-category.m l ipsdir*(1-seap-delta.ml ipsdir*(1 -seap-typedef.xml

1" 1" 0# 11 11 11 11 11 11

2008 2008 2009 2009 2009 2009 2009 2009 2009

20+#"+02 21+3"+8 20+30+26 1"+33+2 1"+3#+10 1"+31+30 1"+31+32 1"+31+16 1"+31+16

1697952 Dec 17 2008 20:46:06 sec!edes"top-os-3.1.1.45-" sec!edes"top-os-3.1.1.45-"9.p"$ 9.p"$

14475264 %ytes a&ala%le '49520640 %ytes sed(















CCNA Security

(3#d! Directory o lash+*ipsdir* 12 13 1

-r/-r/-r/-

230621 10613 6632

!eb 18 2009 12+02+36 500+00 !eb 18 2009 12+0+32 500+00 !eb 18 2009 12+00+0 500+00

(1-sigde-deault.ml (1-sigde-delta.ml (1 -s$def-typedef.xml

15

-!w-

28282

)e% 18 2009 12:00:44 *00:00

16 1"

-r/-r/-

2#" 91

!eb 18 2009 12+00+12 500+00 !eb 18 2009 12+00+12 500+00

+1-s$def-cate$o!y.xml ( 1-seap-delta.xml (1-seap-typede.ml

(3#del ,.xml Delete ilename *ipsdir*7.ml Delete Delete Delete Delete Delete Delete

lash+*ipsdir*(1-sigde-deault.ml conirm lash+*ipsdir*(1-sigde-delta.ml conirm lash+*ipsdir*(1-sigde-typede.ml conirm lash+*ipsdir*(1-sigde-category.ml conirm lash+*ipsdir*(1-seap-delta.ml conirm lash+*ipsdir*(1-seap-delta.ml cof!m/

(3#cd .. (3#pwd lash+ (3#!md! psd! (emoe directory ilename ipsdir Delete lash+ipsdir conirm

















CCNA Security

Part #$ Configure %asic Settings to Create te Test 5nviron(ent Instructor Note$ - !" &!"$"#! o !&+" !" &#!$c!o$ #ol p$"co&'$" !" ba#&c "&c" #"!!&'# &"!&&" & a$! 1, !o allo a llo !" #!"! !o oc# o !" #"c$&!% $"la!" ">a+ obJ"c!&"#. a$! 1 o !" #!"! ">a+ (oa#"$ k"%) o"# o! &cl" !"#" ">ac! #!"p# b! o"# &#!$c! !" #!"! !o "$&% !a! !" ba#&c "&c" #"!!&'# a" b"" p$"co&'$" b% !" &#!$c!o$.

Step #$ Cable te network as sown in te topology7 A!!ac !" "&c"# "&c"# #o & !" !opolo'% !opolo'% &a'$a+, a cabl" cabl" a# "c"##a$%.

Step *$ Configure basic settings for all routers7 a. Co&' Co&'$" $" o#! o#! a+"# a+"# a# #o #o  & !" !opol !opolo'% o'%.. b. Co&'$" Co&'$" !" !" &!"$ac" &!"$ac" - a$"# a$"##"# #"# a# #o #o & !" !" - a$"##& a$"##&' ' !abl". !abl". c.

Co&'$" Co&'$" a #"$&al #"$&al &!"$ac" &!"$ac" DCE DCE clock $a!" $a!" o 128000 o$ !" !" $o!"$#, $o!"$#, & #&' #&' $o!"$# $o!"$# o!"$ !a !a !o#" !o#" #p"c&&" &! !&# SA.

Instructor Note$ " Note$ " C&#co -SR 1841 -@S a -C# #" & !&# SA &ll a!oco&'$" !" clock $a!" o #"$&al DCE &!"$ac"# a #"! &! !o 2000000. . D&#abl D&#abl" " DNS DNS look lookp p o o "ac "ac $o!"$ $o!"$..

(1:conig;) o p doma-loo"p

Step ,$ Configure static default routes on routers +# and +,7 Co&'$" a #!a!&c "al! $o!" $o+ R1 !o R2 a $o+ R3 !o R2.

(1:conig;) p !ote 0.0.0.0 0.0.0.0 s000 (3:conig;) p !ote 0.0.0.0 0.0.0.0 s001

Step /$ Configure static routes on router +*7 Co&'$" #!a!&c $o!"# $o+ R2 !o !" R1 #&+la!" LAN (Loopback 1), !" R1 Fa0/0!oASA #b"!, a !" R3 LAN.

(2:conig;) p !ote 172.20.1.0 255.255.255.0 s000 (2:conig;) p !ote 172.30.3.0 255.255.255.0 s001 (2:conig;) p !ote 209.165.200.232 255.255.255.248 s000

















CCNA Security

c.

Co&'$" Co&'$" !" !" - "al "al!! 'a!"a% 'a!"a% o$ "ac "ac o !" !" !$"" !$"" #&!c"# #&!c"#..

<1:conig;) p defalt-$ateway 192.168.10.1 <2:conig;) p defalt-$ateway 192.168.10.1 <3:conig;) p defalt-$ateway 172.30.3.1 . D&#abl D&#abl" " DNS DNS look lookp p o o "ac "ac #&! #&!c. c.

<1:conig;) o p doma-loo"p

Step 1$ Configure PC ost IP settings7 Co&'$" a #!a!&c - a$"##, #b"! +a#k, a "al! 'a!"a% o$ "ac C, a# #o & !" - a$"##&' !abl".

Step 3$ .erify connectivity between PC-C and +# 4o# and 2a<;<7 =$-$+>? p$ 172.20.1.1 172.20.1.1 =$-$+>? p$ 209.165.200 209.165.200.233 .233

Step =$ Save te basic running configuration for eac router and switc7

Part *$ Configure Secure +outer Ad(inistrative Access - a$! 2, %o #" !" CL- !o co&'$" pa##o$# a "&c" acc"## $"#!$&c!&o#. Instructor Note$ - Note$ - !" &!"$"#! o !&+", #"c$&!% "a!$"# co&'$" #&' !" CL- a$" ol% co&'$" o R1, ">c"p! "$" o!". S"c$&!% "a!$"# co&'$" #&' CC (<F a -S) a$" ol% co&'$" o R3. Note$ a$! Note$ a$! 2 oc#"# p$&+a$&l% o co&'$&' acc"## #"c$&!% o$ R1. - a p$oc!&o "!o$k !"#" "a!$"# #ol b" co&'$" o all $o!"$#.

Task #$ Configure Settings for +# and +*7 Step #$ Configure a (ini(u( password lengt of #< caracters on +#7

















CCNA Security

(1:conig-line;) lo$ (1:conig-line;) lo$$$ sych!oos Note$ " Note$ " !% l&"# o$ R1 a$" co&'$" o$ SS: & a#k 3.

Step 0$ Configure a login warning banner on +#7 Co&'$" a a$&' !o a!o$&;" #"$# &! a +"##a'"o!"a% (=@D) ba"$ !a! #a%# KIa!o$&;" access st!ctly p!oh%ted ad p!osected to the fll extet of the

law. (1:conig;) %ae! motd motd @nauthoried access strictly prohibited and prosecuted to the ull etent o the la/ 

Step 1$ Configure te vty lines and enable password on +*7 a. Co&' Co&'$" $" !" !" pa## pa##o$ o$ o$ o$ !% !% l&"# l&"# !o b" b" ciscovtypa00 a ciscovtypa00 a "abl" lo'&. S"! !" ">"c!&+"o! #o a #"##&o &# lo''" o! a!"$ 15 +&!"# o &ac!&&!%.

(2:conig;) le &ty 0 4 (2:conig-line;) passwo!d csco&typa55 csco&typa55 (2:conig-line;) exec-tmeot 15 0 (2:conig-line;) lo$ b. I#" a "ab "abl" l" #"c$"! #"c$"! pa## pa##o$ o$ o ciscoenapa00. ciscoenapa00.

(2:conig;) ea%le sec!et cscoeapa55

Step 3$ 5nable >TTP access on router +*7 Eabl" !" : #"$"$ o R2 !o #&+la!" a -!"$"! !a$'"! o$ la!"$ !"#!&'.

(2:conig;) p http se!&e!

Task *$ Configure 4ocal Autentication wit AAA on +#7 Step #$ Configure te local user database7 C$"a!" a local #"$ acco! o Ad(in<# &! Ad(in<# &! a #"c$"! pa##o$ o Ad(in<#pa00 a Ad(in<#pa00 a a p$&&l"'" l""l o #0. #0.

(1:conig;) se!ame dm01 p!&le$e 15 sec!et dm01pa55

















CCNA Security

Task ,$ Configure te SS> Server on +outer +#7 Step #$ Configure te do(ain na(e7 Co&'$" a o+a& a+" o ccnasecurity7co(. ccnasecurity7co(.

(1:conig;) p doma-ame ccasec!ty.com

Step *$ Configure te inco(ing vty lines7 Sp"c&% !a! !" $o!"$ !% l&"# &ll acc"p! ol% SS: co"c!&o#.

(1:conig;) le &ty 0 4 (1:conig-line;) t!aspo!t pt ssh (1:conig-line;) ext

Step ,$ Generate te +SA encryption key pair7 Co&'$" !" RSA k"%# &! #<*/ a# #<*/ a# !" +b"$ o +ol# b&!#.

(1:conig;) c!ypto "ey $ee!ate !sa $ee!al-"eys modls 1024 he name or the keys /ill be+ (1.ccnasecurity.com B he key modulus sie is 102 bits B Cenerating 102 bit (
Step /$ Configure te SS> version7 Sp"c&% !a! !" $o!"$ acc"p! ol% SS: "$#&o 2 co"c!&o#.

(1:conig;) p ssh &e!so 2

Step 0$ .erify SS> connectivity to +# fro( PC-C7 Lac !" SS: cl&"! ("$a"$+ o$ ) o CC, "!"$ !" R1 S0/0/0 - a$"## ( #<7#<7#<7#) #<7#<7#<7#) a lo'& & a# Ad(in<# &! Ad(in<# &! !" pa##o$ Ad(in<#pa00. Ad(in<#pa00 . - p$o+p!" b% !" SS: cl&"! &! a #"c$&!% al"$! $"'a$&' !" #"$"$# o#! k"%, cl&ck ?es cl&ck ?es..

Task /$ Secure against login attacks on +#7

















CCNA Security

Task #$ Configure te site-to-site .PN between +# and +,7 Step #$ Configure te enable secret password and >TTP access on +, prior to starting CCP7 a. F$o+ !" CL-, CL-, co&'$" co&'$" a "abl" "abl" #"c$"! #"c$"! pa##o$ pa##o$  o ciscoenapa00 o$ ciscoenapa00 o$ #" &! CC o R3.

(3:conig;) ea%le sec!et cscoeapa55 b. Eab Eabl" l" !" !" : :  #"$ #"$"$ "$ o R3. R3.

(3:conig;) p http se!&e! c.

A #" dm01 $ dm01 to the local database /ith a pass/ord o dm01pa55 dm01pa55.

(3:conig;) se!ame dm01 p!&le$e 15 sec!et dm01pa55 . Co& o&' '$$" !" !" local data%ase to athetcate  sessos.

(3:conig;) p http athetcato local

Step *$ Access CCP and discover +,7 a. S!a$! S!a$! CC o CC. CC. - !" !" =aa'" =aa'" D"&c"# D"&c"# &o &o,, a R1 - - a$"## a$"## #3*7,<7,7# & #3*7,<7,7# & !" &$#! - a$"## &"l. E!"$ Ad(in<# & Ad(in<# & !" I#"$a+" &"l, a Ad(in<#pa00 & Ad(in<#pa00 & !" a##o$ &"l. b. A! !" CC CC Da# Da#boa boa$, $, cl&ck cl&ck !" !" Discover b!!o b!!o !o &#co"$ a co"c! !o R3.

Step ,$ :se te CCP .PN wi@ard to configure +,7 a. Cl&ck ! !" Configure b!!o Configure b!!o a! !" !op o !" CC #c$"", a coo#" Security  .PN  Site-to-Site .PN. .PN. b. I#" !" Buick Setup op!&o Setup op!&o !o co&'$" !" R3 #&" o !" #&!"!o#&!" N.

Step /$ Configure basic .PN connection infor(ation settings7 a. @ !" !" N Co"c!&o Co"c!&o  -o$+a! -o$+a!&o &o #c$"" #c$"",, #"l"c! #"l"c! !" !" R3 S<;<;# a# S<;<;# a# !" &!"$ac" o$ !" co"c!&o. b. - !" ""$ ""$ -"!& -"!&!% !% #"c!&o, #"c!&o, #p"c&% #p"c&% R1 &!"$ &!"$ac" ac" S0/0/0 S0/0/0 (#<7#<7#<7# (#<7#<7#<7#)) a# !" $"+o!" p""$ #!a!&c - a$"##. c.

- !" A!" A!"!&ca !&ca!&o !&o #"c!& #"c!&o, o, #p"c&% #p"c&% !" p$"#a$ p$"#a$" " N k"% cisco#*,/0. cisco#*,/0.

. - !" $a& $a&c c !o "c$%p! "c$%p! #"c!& #"c!&o, o, #p"c&% #p"c&% !" R3 #o$c" #o$c" &!"$ac" &!"$ac" 2a<;# a 2a<;# a !" "#!&a!&o - a$"## o !" R1 Loopback 1 "!o$k (#3*7*<7#7<;*/ (#3*7*<7#7<;*/). ).



















CCNA Security

Task *$ Test te Site-to-Site IPsec .PN using CCP a. @ R3 (CC), (CC), #" #" CC !o !"#! !"#! !" -#"c -#"c N !"l !"l b"!"" b"!"" !" !o !o $o!"$#. $o!"$#. S"l"c! S"l"c! Configure  Security .PN  Site-to-Site .PN a .PN a cl&ck !" 5dit Site-to-Site .PN !ab. .PN !ab. b. F$o+ !" 5dit Site to Site .PN !ab, #"l"c! !" N a cl&ck Test Tunnel. Tunnel . c.

" !" !" N N $obl" $obl"#oo! #oo!&' &' &o &o &#pla%#, &#pla%#, cl&ck cl&ck !" !" Start b!!o Start b!!o !o a" CC #!a$! !$obl"#oo!&' !" !"l.

. " !" CC a$&' a$&' &o &o &#pla%# &#pla%# &&ca!& &&ca!&' ' !a! CC &ll &ll "abl" "abl" $o!"$ "b'# "b'# a '""$a!" '""$a!" #o+" !"l !$a&c, cl&ck ?es cl&ck ?es !o !o co!&". ". - !" ">! N N $obl"# $obl"#oo!& oo!&' ' &o, &o, !" - a$"## a$"## o !" !" R3 Fa0/1 Fa0/1 &!"$ac" &!"$ac" & !" #o$c" #o$c" "!o$k &# &#pla%" b% "al! (172.30.3.1). E!"$ !" - a$"## o !" R1 Loopback 1 &!"$ac" & !" D"#!&a!&o N"!o$k &"l (#3*7*<7#7# ( #3*7*<7#7#)) a cl&ck Continue !o Continue !o b"'& !" "b''&' p$oc"##. .

- !" "b' "b' &# #cc"##l #cc"##l,, %o #ol #ol #"" a -o$+a!& -o$+a!&o o &o &o &&ca!& &&ca!&' ' !a! !$obl"# !$obl"#oo!& oo!&' ' a# #cc"##l a !" !"l &# p.

'. &' $o+ $o+ CC CC !o !" R1 Lo1 &!"$ac &!"$ac" " a! 172.20.1.1 172.20.1.1 !o '""$a! '""$a!" " #o+" &!"$"#!& &!"$"#!&' ' !$a&c. !$a&c. . -##" !" show c!ypto sa"mp sa co++a o R3 !o &" !" #"c$&!% a##oc&a!&o c$"a!".

(3) show c!ypto sa"mp sa J= $rypto J
state K,JDI%

conn-id slot status 1001 0 A$JL%

-##" !" show c!ypto psec sa co++a o R1 !o #"" o +a% p ack"!# a" b"" $"c"&" $o+ R3 a "c$%p!" b% R1

(1) show c!ypto psec sa



















CCNA Security

Part /$ Configure an IS+ 2irewall and Intrusion Prevention Syste( - a$! 4, %o co&'$" a ;o"ba#" pol&c% &$"all a -S o R3 #&' CC.

Task #$ Configure a P2 2irewall on +, using CCP7 Step #$ Access CCP and discover +, &if re8uired)7 a. S!a$! S!a$! CC o CC. CC. - !" !" =aa'" =aa'" D"&c"# D"&c"# &o &o,, a R1 - - a$"## a$"## (#3*7,<7,7# (#3*7,<7,7#)) & !" &$#! - a$"## &"l. E!"$ Ad(in<# & Ad(in<# & !" I#"$a+" &"l, a Ad(in<#pa00 & Ad(in<#pa00 & !" a##o$ &"l. b. A! !" CC CC Da# Da#boa boa$, $, cl&ck cl&ck !" !" Discover b!!o b!!o !o &#co"$ a co"c! !o R3.

Step *$ :se te CCP 2irewall wi@ard to configure a @one-based firewall7 a. Cl&ck Configure  Security  2irewall  2irewall . b. Coo#" %asic 2irewall a 2irewall a cl&ck !" 4aunc te selected task b!!o. task b!!o. c.

Sp"c&% 2a<;# &!"$ac" 2a<;# &!"$ac" a# !" -#&" (!$#!") &!"$ac" a S<;<;# a# S<;<;# a# !" @!#&" (!$#!") &!"$ac".

. Cl&ck ! " ! " !" a$&' &# &#pla%" &o$+&' %o !a! %o cao! lac CC $o+ !" S0/0/1 &!"$ac" a!"$ !" F&$"all &;a$ co+pl"!"#. ". S"l"c! 4ow Security, Security, a co+pl"!" !" F&$"all &;a$. .

D"l& D"l&"$ "$ !" !" co&' co&'$a $a!&o !&o  !o !" $o!" $o!"$. $.



















CCNA Security

Task *$ Configure IPS on +, :sing CCP7 Step #$ Prepare router +, and te T2TP server7 o co&'$" C&#co -@S -S 5.>, !" -@S -S #&'a!$" packa'" &l" a pbl&c c$%p!o k"% &l"# +#! b" aa&labl" o !" C &! !" F #"$"$ &#!all". R3 #"# CC a# !" F #"$"$. C"ck &! %o$ &#!$c!o$ & !"#" &l"# a$" o! o !" C. a. "$& "$&% % !a! !a! !" !" I!S-S'''-C4I7pkg #&'a!$" packa'" &l" &# & !" "al! F ol"$. " xxx &# &# !" "$#&o +b"$ a a$&"# "p"&' o &c &l" a# oloa" $o+ C&#co.co+. b. "$& "$&% % !a! !a! !" !" real(-cisco7pub7key7t't real(-cisco7pub7key7t't &l" &l" &# aa&labl" a o!" &!# loca!&o o CC. &# &# !" pbl&c c$%p!o k"% #" b% C&#co -@S -S. c.

"$&% "$&% o$ c$"a c$"a!" !" !" !" -S -S &$" &$"c!o c!o$% $%,, ipsdir , & $o!"$ la# o R3. F$o+ !" R3 CL-, &#pla% !" co!"! o la# +"+o$% a c"ck !o #"" & !" ipsdir &$"c!o$% &$"c!o$% ">&#!#.

Note$ Fo$ Note$ Fo$ $o!"$ R3, !" -S #&'a!$" (.>+l) &l"# & !" flas$;ipsdir; &$"c!o$% #ol a" b"" "l"!" a !" &$"c!o$% $"+o" p$&o$ !o #!a$!&' !" SA. " &l"# +#! b"  "l"!" $o+ !" &$"c!o$% & o$"$ !o $"+o" &!. (3) show flash . - !" ipsdir &$"c!o$% &$"c!o$% &# o! l&#!", c$"a!" &! & p$&&l"'" EEC +o", #&' !" m"d! co++a.

(3# m"d! psd! $reate directory ilename ipsdir $reated dir lash+ipsdir Note$ J the psd! directory is listed and there are iles in it contact your instructor. his directory must be empty beore coniguring J=<. =f

the!e a!e o fles  t yo may p!oceed to cof$!e =.



















CCNA Security . - !" S&'a!$ S&'a!$" " F&l" a bl&c bl&c B"% &o &o,, #p"c&% #p"c&% !" #&'a!$" #&'a!$" &l" &l" &! &! a IRL a #" F F !o $"!$&"" !" &l" $o+ CC. E!"$ !" - a$"## o !" CC F #"$"$ a !" &l"a+". ". - !" S&'a! S&'a!$" $" F&l" F&l" a bl&c bl&c B"% &o, &o, "!"$ "!"$ !" a+" a+" o !" pbl&c pbl&c k"% k"% &l" real(-cisco7pub. real(-cisco7pub. .

@ CC CC,, op" op" !" !" pbl pbl&c &c k"% k"% &l &l" " a a cop% cop% OCtrlEC OCtrlECQQ !" !">! !a! &# b"!"" !" p$a#" Kk"%#!$&' a !" o$ K?&!. a#!" OCtrlE. OCtrlE.QQ !" !">! &!o !" B"% &"l & !" Co&'$" bl&c B"% #"c!&o.

'. - !" !" Co&' Co&' Loca!& Loca!&o o a Ca!"'o$% Ca!"'o$% &o &o,, #p"c&% #p"c&% !" !" flas$;ipsdir; &$"c!o$% a+" a# !" loca!&o !o #!o$" !" #&'a!$" &o$+a!&o. . - !" Coo#" Coo#" Ca!"'o$% Ca!"'o$% &"l &"l o !" !" Co&' Co&' Loca!&o Loca!&o a a Ca!"'o$% Ca!"'o$% &o, &o, coo#" coo#" basic. basic. &.

Cl&ck Ne't !o Ne't !o &#pla% !" S++a$% &o, a cl&ck 2inis !o 2inis !o "l&"$ !" co++a# !o !" $o!"$.

Note$ Allo Note$ Allo !" #&'a!$" co&'$a!&o p$oc"## !o co+pl"!". &# ca !ak" #""$al +&!"#.

Part 0$ Secure Network Switces Note$ No! all #"c$&!% "a!$"# & !&# pa $! o !" ">a+ &ll b" co&'$" o all #&!c"#, al!o' !"% o$+all% ol b" & a p$oc!&o "!o$k. Instructor Note$ - Note$ - !" &!"$"#! o !&+", !" #"c$&!% "a!$"# a$" co&'$" o J#! S1, ">c"p! "$" o!".

Task #$ Configure Passwords and a 4ogin %anner7 Step #$ Configure te enable secret password7 I#" a "abl" #"c$"! pa##o$ o ciscoenapa00. ciscoenapa00.

<1:conig;) ea%le sec!et cscoeapa55



















CCNA Security

<1:conig;) %ae! motd >atho! >atho!
p!osected p!osected to the the fll extet of of the law law <1:conig;) ext

Step 0$ Disable >TTP access7 : acc"## !o !" #&!c &# "abl" b% "al!. o p$""! : acc"##, &#abl" !" : #"$"$ a : #"c$" #"$"$.

<1:conig;) o p http se!&e! <1:conig;) o p http sec!e-se!&e!

Task *$ Secure Trunk and Access Ports on S# and S*7 Step #$ Configure trunk ports on S# and S*7 a. Co&' Co&'$" $" po$! po$! Fa0/ Fa0/1 1 o S1 a# a# a !$k !$k po$!. po$!.

<1:conig;) te!face )ast?the!et 01 <1:conig-i;) swtchpo!t mode t!" Note$ o &ll '"! a "$$o$ o a 3560 o$ 3550 #&!c. o a" !o &$#! co&'$" o!1? "cap#la!&o. $ommand reRected+ An interace /hose trunk encapsulation is SAutoS cannot be conigured to StrunkS mode.S b. Co&' Co&'$" $" po$! po$! Fa0/ Fa0/1 1 o S2 a# a# a !$k !$k po$!. po$!.

<2:conig;) te!face )ast?the!et 01 <2:conig-i;) swtchpo!t mode t!"





















CCNA Security

Step ,$ Prevent te use of DTP on S# and S* trunk ports7 S"! !" !$k po$!# o S1 a S2 #o !a! !"% o o! "'o!&a!" b% !$&' o !" '""$a!&o o D $a+"#.

<1:conig;) te!face )a01 <1:conig-i;) swtchpo!t oe$otate <2:conig;) te!face )a01 <2:conig-i;) swtchpo!t oe$otate

Step /$ .erify te trunking configuration on S# and S*7 <1) show te!face fa01 t!" =ort !a0*1

,ode on

%ncapsulation 802.1'

Gatie lan 99



















CCNA Security

Step 0$ 5nable stor( control for broadcasts7 Eabl" #!o$+ co!$ol o$ b$oaca#!# o !" S1 a S2 !$k po$!# &! a 50 p"$c"! $&#&' #pp$"##&o l""l.

<1:conig;) te!face )ast?the!et 01 <1:conig-i;) sto!m-cot!ol %!oadcast le&el 50

Step 1$ Disable trunking on S# access ports tat are in use7 @ S1, co&'$" po$! F0/6 a# acc"## +o" ol%.

<1:conig;) te!face )ast?the!et 06 <1:conig-i;) swtchpo!t mode access

Step 3$ 5nable Port2ast on S# access ports tat are in use7



















CCNA Security

<1:conig-i-range;) shtdow <1:conig-i-range;) te!face !a$e $$a%tethe!et01 - 2 <1:conig-i-range;) shtdow

Step ,$ Save te running-config to te startup-config for eac switc7

Part 1$ Configure ASA %asic Settings and 2irewall Task #$ Prepare te ASA for ASDM access Step #$ Clear te previous ASA configuration settings7 e!ase co++a !o $"+o" !" startup-config &l" $o+ la# +"+o$%. a. I#" !" w!te e!ase ciscoasa) w!te e!ase e!ase %rase coniguration in lash memory conirm EF



















CCNA Security

%thernet0* %thernet0*# %thernet0*6 %thernet0*" Jnternal-Data0*0 Jnternal-Data0*1 Llan1 Lirtual0

.

unassigned unassigned unassigned unassigned unassigned unassigned 192.168.10.1 12".0.0.1

P%< P%< P%< P%< P%< P%< P%< P%<

unset unset unset unset unset unset manual unset

administratiely administratiely administratiely administratiely up up up up

do/n do/n do/n do/n

do/n do/n do/n do/n up up up up

$" $"co co &' &'$ $" " &!" &!"$ $ac ac" " .4AN * a * a a+" &! Koutside K outside, , a p%#&cal &!"$ac" 5<;< !o 5<;< !o LAN 2, a b$&' p !" E0/0 &!"$ac". o &ll a##&' !" - a$"## #&' ASD=.

ciscoasa:conig;) te!face &la 2 ciscoasa:conig-i;) amef otsde JG!E+


















CCNA Security c.

@ !" !" S!a$ S!a$!p !p &;a$ &;a$ S!"p S!"p 5 #c$ #c$"" "" * Interface IP Address Configuration , "!"$ a @!#&" - a$"## o *
Step /$ Configure D>CP6 address translation and ad(inistrative access7 a. @ !" S!a$!p S!a$!p &;a$ &;a$ S!"p S!"p 6 #c$"" * D:C D:C S"$"$, S"$"$, "abl" "abl" !" D:C D:C #"$"$ #"$"$ o !" -#&" -#&" -!"$ac" a #p"c&% a #!a$!&' - a$"## o #F*7#1=7#<70 a #F*7#1=7#<70 a "&' - a$"## o #F*7#1=7#<7,<. #F*7#1=7#<7,<. E!"$ !" DNS Server # a$"## # a$"## o #<7,7,7, a #<7,7,7, a o+a& Na+" ccnasecurity7co(. ccnasecurity7co(. Do N!T c"ck N!T c"ck !" bo> !o "abl" A!oco&'$a!&o $o+ -!"$ac". b. @ !" S!a$!p S!a$!p &;a$ &;a$ S!"p 7 #c$"" * A$"## A$"## $a#la!& $a#la!&o o (NA/A (NA/A), ), co&'$" co&'$" !" ASA !o use port address translation &PAT) #&' !" - a$"## o !" o!#&" &!"$ac". c. @ !" !" S!a$!p S!a$!p &;a$ &;a$ S!"p S!"p 8 #c$"" #c$"" * A+&&# A+&&#!$a! !$a!&" &" Acc"## Acc"##66 :S/ASD= :S/ASD= acc"## &# c$$"!l% co&'$" o$ o#!# o &#&" "!o$k 192.168.10.0/24. A Telnet acc"## Telnet acc"## !o !" ASA o$ !" &#&" "!o$k #F*7#1=7#<7< &! #F*7#1=7#<7< &! a #b"! +a#k o *007*007*007<. *007*007*007<. A SS> acc"## SS> acc"## !o !" ASA $o+ o#! #3*7,<7,7, o #3*7,<7,7, o !" o!#&" "!o$k. . F&&# F&&# !" !" &;a$ &;a$ a "l&"$ "l&"$ !" !" co++a# co++a# !o !" !" ASA. ASA.





















CCNA Security Note$ " Note$ " ">! ac!&o %o a!!"+p! &!& ASD= &ll $"?&$" %o !o lo'& a# ad(in &! ad(in &! pa##o$ cisco#*,. cisco#*,. c.

F$o+ CC, op" a SS: cl&"! #c a#  a a!!"+p! !o acc"## !" ASA o!#&" &!"$ac" a!

*


















CCNA Security

+outer Interface Su((ary Table +outer Interface Su((ary



















CCNA Security

aaa session-id common dot11 syslog ip source-route   



















CCNA Security

speed auto  interace


















CCNA Security

(1)





















































































































































































































En Security SBA Student Training Ans Key

Recommend Documents