Click the Scan button to being scanning R1. To see the protocols available, enter the ip inspect name name command in global config mode,
b. Click the Scan button to being scanning R1.
CCNA Security All contents are Copyright © 1992 –2012 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 17 of 43 Now that the R1 CBAC firewall is in place, what services are available on R1 and what is the status of R1 from the perspective of external PC-C? No services are detected. Nmap, run from PC-C, reports the status of host R1 10.1.1.1 as down. Task 3: Review the AutoSecure CBAC Configuration Step 1: Review the commands that were delivered to router R1. a. Display the running configuration for R1. The AutoSecure output should look similar to that shown in Task 2, Step 1. b. What is the most common command issued that is related to CBAC? ip inspect name autosec_inspect c. CBAC creates rules to track TCP and UDP flows using the ip inspect name name protocol command. To what interface is the autosec_inspect name applied and in what direction? Serial000 interface in the outbound direction. Step 2: Display the protocols available with the ip inspect command.a. To see the protocols available, enter the ip inspect name name command in global config mode,
followed by a question mark ?. CCNA Security All contents are Copyright © 1992 –2012 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 18 of 43 Note: Most of the protocols listed are application layer protocols. Newer Cisco IOS versions have more protocols listed. R1config ip inspect name autosec_inspect ? 802-11-iapp IEEE 802.11 WLANs WG IAPP ace-svr ACE ServerPropagation appfw Application Firewall appleqtc Apple QuickTime bgp Border Gateway Protocol biff Bliff mail notification bittorrent bittorrent Output Omitted b. How many protocols can be configured for inspection? Over one hundred. c. Refer to the running configuration output or the AutoSecure output in Task 2, Step 1. Which protocols did AutoSecure configure to be inspected as they leave the S000 interface? Cuseeme, FTP, HTTP, RCMD, Realaudio, SMTP, TFTP, UDP AND TCP. d. To which interface is the ACL autosec_firewall_acl applied and in which direction? S000 inbound. e. What is the purpose of the ACL autosec_firewall_acl? It allows bootp traffic to enter the S000 interface and blocks all other non-established connections from outside R1. Task 4: Verify CBAC Functionality For the protocols identified to be inspected, the CBAC firewall allows return traffic for connections initiated from the inside, but blocks all other connections from the outside. Step 1: From PC-A, ping the R1 internal LAN interface. a. From PC-A, ping R1 interface Fa01 at IP address 192.168.1.1. C:\ ping 192.168.1.1 b. Were the pings successful? Why or why not? Yes. The PC-A IP address and the R1 Fa01 IP address are on the same internal network, and the firewall does not come into play. The R1 Fa01 IP address is the default gateway of PC-A. Step 2: From PC-A, ping the R2 external WAN interface. a. From PC-A, ping the R2 interface S000 at IP address 10.1.1.2. C:\ ping 10.1.1.2 b. Were the pings successful? Why or why not? No. The ICMP protocol was not included in the autosec_inspect list, so the pings that PC-A sends are blocked from returning. Step 3: Add ICMP to the autosec_inspect list. From global config mode, configure R1 to inspect ICMP and allow ICMP echo replies from outside hosts. R1config ip inspect name autosec_inspect icmp timeout 5 Step 4: From PC-A, ping the R2 external WAN interface. a. From PC-A, ping the R2 interface S000 at IP address 10.1.1.2. C:\ ping 10.1.1.2 b. Were the pings successful? Why or why not? Yes. ICMP is now included in the autosec_inspect list, so the ICMP replies for ICMP requests originating from within the R1 LAN are allowed to return. c. Remove ICMP from the inspect list. This restores the CBAC configuration to the one generated by AutoSecure. CCNA Security All contents are Copyright © 1992 –2012 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 19 of 43 R1config no ip inspect name autosec_inspect icmp timeout 5 Step 5: Test Telnet access from R2 to R1. a. From external router R2, telnet to R1 at IP address 10.1.1.1. R2 telnet 10.1.1.1 Trying 10.1.1.1 ... Connection timed out; remote host not responding b. Was the telnetting successful? Why or why not? No. The connection was initiated from outside and was blocked by the firewall ACL. Step 6: Configure R1 to allow Telnet access from external hosts.a. Display the Extended ACL named autosec_firewall_acl that is applied to S000 inbound.
Parts
» CCNA Security 1.1 Instructor Lab Manual
» Lab A: Researching Network Attacks and Security Audit Tools
» Lab A: Securing the Router for Administrative Access
» Use the username command to create the user ID with the highest possible privilege level and a
» Issue the undebug all or the no debug ntp all command to turn off debugging.
» Click OK in the Commands Delivery Status window.
» Use the show logging command to see the type and level of logging enabled.
» Save the running config to the startup config using the copy run start command.
» Lab A: Securing Administrative Access Using AAA and RADIUS
» Click Send and you should see a Send Access_Request message indicating the server at
» Clear the log on the WinRadius server by choosing Log Clear from the main menu.
» Lab A: Configuring CBAC and Zone-Based Firewalls
» Issue the show run command to review the current basic configuration on R1.
» Display the Extended ACL named autosec_firewall_acl, which is applied to S000 inbound.
» Display the Extended ACL named autosec_firewall_acl that is applied to S000 inbound.
» Click Finish to complete the Firewall wizard.
» Lab A: Configuring an Intrusion Prevention System IPS Using the CLI and CCP
» From the R1 CLI, verify that the directory is present using the dir flash: or dir flash:ipsdir
» Apply the IPS rule to an interface with the ip ips name direction command in interface
» Verify connectivity between R1 and PC-A, the TFTP server, using the ping command.
» Use the show ip ips all command to see an IPS configuration status summary. To which
» For Protocol, select tftp from the drop-down menu. Enter the IP address of the PC-C TFTP server
» Lab A: Securing Layer 2 Switches Instructor Version
» From the router R1 CLI, use the show interface command and record the MAC address of the
» Set the SPAN source interface using the monitor session command in global configuration mode.
» Lab A: Exploring Encryption Methods Instructor
» Lab A: Configuring a Site-to-Site VPN Using Cisco IOS and CCP
» Verify the IKE policy with the show crypto isakmp policy command.
» Save the running config to the startup config for R1 and R3 using the copy run start command.
» Click the Launch the selected task button to begin the CCP Site-to-Site VPN wizard.
» Lab B: Configuring a Remote Access VPN Server and Client
» In the Command Delivery Status window, click OK. How many commands are delivered? 103 with
» Lab C Optional: Configuring a Remote Access VPN Server and Client
» Lab A: Security Policy Development and Implementation
» Verify that R1 and R3 have made an association with R2 using the show ntp associations
» Choose FastEthernet 01 as the Inside Trusted interface and Serial 001 as the Outside Untrusted
» From PC-A, Telnet to R2 at IP address 10.1.1.2 using the vty line password ciscovtypass.
» If the ipsdir directory is not listed, create it.
» Secure the router running configuration and securely archive it in persistent storage flash.
» Lab A: Configuring ASA Basic Settings and Firewall Using CLI
» Display the ASA file system using the show file system command to determine what prefixes are
» Display the current running configuration using the show running-config command.
» You can configure the ASA to accept HTTPS connections using the http command. This allows
» Issue the show route command to display the ASA routing table and the static default route just
» Save the RSA keys to persistent flash memory using either the copy run start or write mem
» Lab B: Configuring ASA Basic Settings and Firewall Using ASDM
» View this Access Rule in ASDM by choosing Configuration Firewall Access Rules. It appears
» Lab C: Configuring Clientless and AnyConnect Remote Access SSL VPNs Using ASDM
» Enable HTTP access to R1 using the ip http server command in global config mode. Also set
» From the Add Bookmark List window, click Add to open the Add Bookmark window. Enter Web Mail as
» Lab D: Configuring a Site-to-Site IPsec VPN Using CCP and ASDM
» Use the reload command to restart the ASA. This will cause the ASA to come up in CLI Setup
» In the Peer Identity section, select Peer with static IP address and enter the IP address of the
Show more