This lab involves using software network analyzers to ...

  • Doc File 1,577.50KByte



ECE 4110 Internetwork Programming

Lab 6: Setting up Burdell Inc. Network Using Multiple Switches and Access Control Lists

Group Number: ________

Member Names: _________________________ _________________________

Date Issued: October 13, 2008

Date Due: October 22, 2008

NOTICE: Because there are only three setups, each group will need to sign up for timeslots on the sheets attached to the lab door. You can only sign up for a total of 2 hours (4 slots) at a time, AND YOU MUST USE THE SAME SETUP FOR THE ENTIRE LAB. These can either be in a row or spread out, but no group can have more than 4 slots reserved at any one time. Once one of your slots has expired, you can sign up for another one. See Appendix C for instructions on how to save and reload your work if you need to leave and continue later.

PLAYSTATION #: ________________

Lab Goals

← Set up a network using multiple routers and switches

← Learn about trunk ports and trunking

← Learn about access control lists and use them to control information flow

PART I

You have recently graduated from Georgia Tech and you are now working for a company called Burdell Inc as a network engineer. You are presented with the following scenario:

Burdell Inc occupies a two floor office building and is made up of three departments, Administration, Accounting, and Information Technology (IT). The Administrative department is currently in need of 100 workstations and is forecasted to grow by an additional 100 machines in the foreseeable future. The Accounting department needs 1000 workstations and is not expected to grow beyond its present size. The IT department is constantly growing. IT presently needs 900 workstations and is expected to grow to twice that size.

In an effort to promote company unity and spirit, the management at Burdell Inc has decided to have members of all three departments work on both floors, i.e. no one department is physically isolated. Both floors accommodate workers form Accounting, Administration, and IT. Each department has its own VLAN and all workers on each floor and between floors should be able to communicate with each other. Figure 1, below, shows the network topology.

This lab requires two switches, one router, and six end station PCs. However we will not use six end station PCs, we will instead emulate the six PCs using the ping capability of Cisco 1760 interfaces and use two more Cisco 1760s to emulate the PCs. This saves us from having to dedicate six PCs for this lab assignment. We will need one PC which we will use to test our setup. Thus the equipment required will be two switches, three routers, and one end station PC. We will use this equipment to emulate the network in Figure 1.

Section I: Logging into the Routers/Switches

All of the routers and switches are accessible from the console manager ports. See Table 1.

Table 1. Console manager port assignments

|Part |Name |Console Manger Port Assignment |

|Playstation1 |

|Cisco 3550 Switch |floor1_switch |5 |

|Cisco 3550 Switch |floor2_switch |6 |

|Cisco 1760 Router |floor1_router |7 |

|Cisco 1760 Router |floor1_computers |8 |

|Cisco 1760 Router |floor2_computers |9 |

|Playstation2 |

|Cisco 3550 Switch |floor1_switch |14 |

|Cisco 3550 Switch |floor2_switch |15 |

|Cisco 1760 Router |floor1_router |16 |

|Cisco 1760 Router |floor1_computers |17 |

|Cisco 1760 Router |floor2_computers |18 |

|Playstation3 |

|Cisco 3550 Switch |floor1_switch |23 |

|Cisco 3500 Switch |floor2_switch |24 |

|Cisco 1760 Router |floor1_router |25 |

|Cisco 1760 Router |floor1_computers |26 |

|Cisco 1760 Router |floor2_computers |27 |

The enable password for all of these machines is owen.

In order to connect to the console manager you need to set up your network card to access its network:

# ifconfig eth0:0 192.168.254.

So group 1 is 192.168.254.101, and so forth. You will need to do this every time you power off your machine. What this does is set up a virtual interface, so you have two IP addresses on one network card. This allows you access to two networks with only one interface card.

To connect to the CM32:

#ssh playstationX@192.168.254.2

If it comes up, Type yes to the RSA question.

password: playstationX

You will be using a series of scripts to help you set up the routers and save your work. These scripts are described in detail in Appendix C. These should still be installed from Lab 6. If not, go to Appendix C and install the scripts according to the directions. Once this is done, MAKE SURE NO ONE ELSE IS USING THE PLAYSTATION YOU WANT TO USE. This is very important, as you are about to reset the configuration and all of their work will be lost.

Now that you are sure no one else is using the playstation, reset your chosen playstation by running the reset_pX script in the mnet_tools_v1.5 directory. Several windows should pop up. DO NOT CLOSE THEM UNTIL IT IS SAFE TO DO SO. If you are on playstation 1 or 2, you will get an error in one of the windows about VPN or Firewall processing not being enabled; ignore this for now. Once all of the other windows say it is safe to close them, do so. Now run the download_pX script to save the current configuration. From now on, you’ll run the download_pX script to save your work, and the upload_pX to restore the configuration of the playstation to the last saved state. Before running the upload script, MAKE SURE NO ONE ELSE IS USING THE PLAYSTATION.

Log into each of the machines and change its name to match Table 1. From global configuration mode:

Machine(config)#hostname

To go back to the console manager screen, hit and then hit x.

Section II: Switch Configuration

Refer to Appendix A for a list of switch configuration commands and their descriptions.

While in Privileged EXEC-Mode, you can view the running configuration by typing show running-config. This contains information about all the interfaces and vlans you’ve set up.

Table 2 lists the different VLANs assigned to each department in our company.

Table 2. Department VLANs

|VLAN |DEPARTMENT |

|2 |Administration |

|3 |Accounting |

|4 |InformationTechnology |

Note: In Figure 1, the Administration VLAN is labeled as VLAN 1, Account as VLAN 2, etc. THIS IS INCORRECT. Use the VLAN numbers in Table 2 for the entirety of this lab.

One switch is placed on each office floor. Three switch ports (on each switch) are configured, one for each VLAN as illustrated by Table 2. Use the switch interface numbers shown in Figure 1 and the vlan names and numbers from Table 2 (note that in Figure 1 the VLANs are listed 1-3, and in Table 2 2-4).

To create VLANs inside the switch, follow these simple steps:

SwitchA# vlan database

SwitchA(vlan)# vlan name

SwitchA(vlan)# exit

Do this for each of the vlans in Table 2. Now configure the interfaces to access those vlans:

SwitchA# configure terminal

SwitchA(config)# interface fastethernet

SwitchA(config-if)# switchport mode access

SwitchA(config-if)# switchport access vlan

In the next command, depends on the router interface connected to it. Because IT is setting up this entire network, they decide to give themselves the higher speed connections. Therefore, the FastEthernet ports on floor1_computers and floor2_computers will be assigned VLAN 4. Now, assign the correct operation speed to the interface: = 10 for Ethernet interfaces and 100 for FastEthernet. SwitchA(config-if)# speed

SwitchA(config-if)# duplex full

SwitchA(config-if)# no shutdown

SwitchA(config-if)# end

Use the above configuration procedure to configure each of the used switch interfaces for each switch. (Do this on the switch, not on the routers). Once you are done, it is a good idea to download your configuration so you do not lose it.

Note: VLAN 1 (one) is used for the management VLAN, so any VLANs created should be numbered 2 to 1000.

Section III: Trunking Switch Ports

For VLAN information to be passed between the two switches, trunking must be configured between the switches. VLAN trunking allows a port to pass traffic from multiple VLANs between the two switches. Frames traveling over a trunk are tagged to identify which VLAN the frames belong to. When implementing trunking between switches, the ports at either end of the connection must be set up for trunk mode and the trunk encapsulation mode must match. Trunk encapsulation dictates the manner that frames are identified (tagged) on a trunk and defines the VLAN services available. There are four types of trunking encapsulations: 1) Inter-Switch Link Protocol (ISL) Cisco proprietary trunking protocol; 2) IEEE 802.1Q (dot1q) Industry standard trunking protocol; 3) LAN Emulation (LANE) Used for trunking VLANs over ATM links; and 4) IEEE 802.10 (dot10q) Cisco proprietary method for transporting VLAN information inside standard FDDI frames.

To setup trunking between two switches, use the following commands:

SwitchA(config)# interface fastethernet

SwitchA(config-if)# no switchport mode dynamic desirable

SwitchA(config-if)# switchport trunk encapsulation dot1q

SwitchA(config-if)# switchport mode trunk

SwitchA(config-if)# end

Then, go to the other switch, and repeat these commands on the respective interface. This is important, otherwise the switches will not be able to communicate to each other.

To limit which VLANs will be allowed to pass information on the port you can use the following commands:

SwitchA(config)# interface fastethernet

SwitchA(config-if)# switchport trunk allowed vlan remove 1-4094

SwitchA(config-if)# switchport trunk allowed vlan add 1-4

Then, you will have to repeat these commands on the other switch. The previous commands remove the default of all VLANs, and adds back support for VLANs 1-4.

Note: On one of the switches one additional port has to be trunked. This additional trunk port is used to connect a router to the switch. The use of the router will be explained in the following section. Set-up the trunking in the switch on floor one for the router on floor one now (see Figure 1 for the port number). The switch port will be connected to the router’s FastEthernet port (SPEED = 100).

Section IV: Router Configuration

Refer to Appendix B for a list of router configuration commands and their descriptions.

Hosts on one VLAN cannot communicate with hosts on another VLAN since VLANs form separate broadcast domains. As a result, a router needs to be used to route packets from one VLAN to another VLAN. The router will be connected to the additional trunk port created on the switch above. The router port also needs to be trunked since the router port will be passing packets from multiple VLANs.

Before configuring the router, the subnets, the assignable machine address ranges, and the required network prefixes for each department have to be determined. Lets use the following assignments in table 3. Notice the subnets are not all the same length.

Table 3. Department subnets and subnet workstation capacity

|Department |Current Size |Future Size |Subnet |Subnet Capacity (Workstations) |

| |(Workstations) |(Workstations) | | |

|Administration |100 |200 |10.1.10.0/24 |2(32-24) – 2 = 28 – 2 = 254 |

|Accounting |1000 |1000 |192.168.148.0/22 |2(32-22) – 2 = 210 – 2 = 1022 |

|Information Technology |900 |1800 |172.16.152.0/21 |2(32-21) – 2 = 211 – 2 = 2046 |

Log into the router and use the following commands to configure the Fastethernet0/0 port as the trunk port that will be connected to the additional trunk port on the switch.

Router(config)# interface FastEthernet 0/0

Router(config-if)# no ip address

Router(config-if)# no ip mroute-cache

Router(config-if)# speed auto

Router(config-if)# full-duplex

Router(config-if)# no shutdown

Router(config-if)# interface FastEthernet 0/0.1

Router(config-subif)# encapsulation dot1Q

Router(config-subif)# ip address 10.1.10.1 255.255.255.0

Router(config-subif)# no shutdown

Router(config-subif)# interface FastEthernet 0/0.2

Router(config-subif)# encapsulation dot1Q

Router(config-subif)# ip address 192.168.148.1 255.255.252.0

Router(config-subif)# no shutdown

Router(config-subif)# interface FastEthernet 0/0.3

Router(config-subif)# encapsulation dot1Q

Router(config-subif)# ip address 172.16.152.1 255.255.248.0

Router(config-subif)# no shutdown

Router(config-subif)# end

You will have to replace with the corresponding vlan as shown in the network diagram.

Section V: Testing Network Connectivity

Table 3. Workstation configurations

|Workstation |One example IP address on|One example IP address |Subnet Mask |Default Gateway |

| |floor1 |on floor2 | | |

|A (VLAN 2) |10.1.10.2 |10.1.10.3 |255.255.255.0 |10.1.10.1 |

|B (VLAN 3) |192.168.148.2 |192.168.148.3 |255.255.252.0 |192.168.148.1 |

|C (VLAN 4) |172.16.152.2 |172.16.152.3 |255.255.248.0 |172.16.152.1 |

IF we were to use six PCs as workstations in this lab we would configure the six workstations using the above example IP addresses. We would have used the following commands on each of the six PCs to set their individual IP addresses (example for one machine):

Prompt> ifconfig eth0 10.1.10.2 netmask 255.255.255.0

Prompt> route add default gw 10.1.10.1

However, we are not going to do it this way. Instead we are going to use another router with three interfaces to act as three machines (three different IP addresses) for the machines on floor two and again another router for three machines on floor1.

For the computers on floor1 use:

Router(config)# interface Ethernet 0/0

Router(config-if)# ip addresss 10.1.10.2 255.255.255.0

Router(config-if)# full-duplex

Router(config-if)# no shutdown

Router(config-if)# interface ethernet 1/0

Router(config-if)# ip address 192.168.148.2 255.255.252.0

Router(config-if)# full-duplex

Router(config-if)# no shutdown

Router(config-if)# interface Fastethernet 0/0

Router(config-if)# ip address 172.16.152.2 255.255.248.0

Router(config-if)# full-duplex

Router(config-if)# speed auto

Router(config-if)# no shutdown

Router(config-if)# end

You will need to use the same approach for the computers on floor2.

Connect the wiring and fill in the diagram at the end of the lab to show your connections. Note that to connect a switch to a switch you need to use a crossover cable!!! You will need to get one from a TA and turn it in after completion of part II of the lab. After completing the wiring you should be able to ping from any interface on one network to another interface on ant other network.

Part 1 Check-off point: show the lab TA your working network.

See turn in sheet at the back of this handout.

PART II

You have recently graduated from Ga. Tech and you are now working for a company called Burdell Inc. as a network engineer. You have successfully setup the network described in Part I, but you have been given some additional network requirements that need to be implemented and they are as follows:

1. Administration: The IT subnet should have unlimited access to the Administration subnet. The Accounting subnet should only be able to access the print-server (10.1.10.3) on the Administration subnet.

2. Accounting: IT should not have any access to the Accounting sub-network. Only the print server (10.1.10.3) should be able to access the Accounting sub-network from the Administration sub-network.

3. Information Technology: Users on the Administration should have unlimited access to the IT subnet. Users on the Accounting sub-network should have no access to the IT subnet.

4. Users on each of the three subnets should have unlimited access to their own subnet.

5. Users from any of the three subnets should be able to send icmp echo (ping) messages to and receive icmp echo-reply messages from subnets that they have access to.

Section I: Access Control Lists

In order to meet the requirements stated above Access Control Lists (ACL) will be used to permit and deny access to sub-networks where necessary. This process is called IP filtering. The packet filtering capabilities of the Cisco IOS software performs packet filtering based on the following criteria:

• Source IP address

• Source and destination IP address

• IP protocol types, including TCP, UDP, and ICMP

• Source and destination TCP protocol services, such as send mail and Telnet

• Source and destination UDP protocol services, such as bootp and NetBIOS datagram

• ICMP protocol services, such as ICMP echo and ICMP port unreachable

The network administrator has a lot of flexibility when creating IP access lists and determining what is filtered and how the filters are applied. Access list criteria is defined through the use of the access-list and ip access-list commands. Next, the filtering criteria is applied to the desired interface using the ip access-group command.

The access list’s filtering criteria are defined in a list of permit and deny statements. The list is evaluated in sequence, one line at a time, from top to bottom. The list is compared against the IP addresses and other information in the data packet until a match occurs. When a match occurs the list is exited. This process makes access lists extremely order-dependent.

By using the access-list command numbered access lists can be created. In this lab we will create named access lists using the ip access-list command. Named and numbered access lists fall into one of two categories, standard or extended. A standard ip access list evaluates only the source IP address of a packet, while the extended access list can evaluate the source and destination IP address, the IP protocol type, and the source and destination transport layer ports.

Note:

Access lists employ a concept known as the wildcard or don’t care mask. This wildcard mask is just the inverse of a network mask. A netmask of 255.255.252.0 generates a wildcard mask of 0.0.3.255, which means that the last 2 bits of octet 3 and all of octet 4 are don’t care bits (can be either 1 or 0).

Section II: Defining ADMIN ACL

Administration: The IT subnet should have unlimited access to the Administration subnet. The Accounting subnet should only be able to access the print-server (10.1.10.3) on the Administration subnet.

First, the access list that is going to be assigned to the router interface used to access the Administration subnet will be called ADMIN. The access lists applied to the other router interfaces will be called ACCT and IT respectively.

Type the following commands while in the Global Configuration mode on the floor1_router.

The following access list is an extended access list in which we will evaluate first the source IP address as well as (second on the same line) the destination IP address.

Router(config)#ip access-list extended ADMIN

Router(config-ext-nacl)# permit ip 172.16.152.0 0.0.7.255 10.1.10.0 0.0.0.255

Router(config-ext-nacl)#permit ip 192.168.148.0 0.0.3.255 host 10.1.10.3

Router(config-ext-nacl)# permit ip 10.1.10.0 0.0.0.255 10.1.10.0 0.0.0.255

Router(config-ext-nacl)# deny ip any any log

Router(config-ext-nacl)# exit

When this list is applied to the out going packets on the floor1_router interface going to the administration subnet, the above list permits access (to the Administration subnet) from all users on the 172.16.152.0/21 (IT) subnet. It also permits users on the Accounting subnet access to 10.1.10.3. The third rule gives users on the administration subnet access to their own subnet. Think about why the wildcard masks (the second and fourth sets of numbers on the 2nd, 3rd, and 4th lines) are what they are; you’ll need to compute your own for Part III. The last line of the list has an explicit deny. This means that any packet failing to match the filtering criteria of one of the lines of the access list is denied. All access lists have an implicit deny so that the last line does not have to be included but it is recommended that you include it. The keyword log causes all packets that fail to match the list to have the violation logged to the screen.

Section III: Defining ACCT ACL

Accounting: IT should not have any access to the Accounting sub-network. Only the print server (10.1.10.3) should be able to access the Accounting sub-network from the Administration sub-network.

The following access list is an extended list in which we will evaluate first the source IP address as well as (second on the same line) the destination IP address. Type the following commands to create a list named ACCT:

Router(config)# ip access-list extended ACCT

Router(config-ext-nacl)# deny ip 172.16.152.0 0.0.7.255 192.168.148.0 0.0.3.255

Router(config-ext-nacl)# permit ip host 10.1.10.3 192.168.148.0 0.0.3.255

Router(config-ext-nacl)# permit ip 192.168.148.0 0.0.3.255 192.168.148.0 0.0.3.255

Router(config-ext-nacl)# deny ip any any log

Router(config-ext-nacl)# exit

When this list is applied to the out going packets on the floor1_router interface going to the accounting subnet, the above list denies access from the IT subnetwork to the accounting subnetwork. It also allows access from the print-server (10.1.10.3) and the accounting subnets to the accounting subnet.

Section IV: Defining IT ACL

Information Technology: Users on the Administration should have unlimited access to the IT subnet. Users on the Accounting sub-network should have no access to the IT subnet.

The following list is a standard access list. Type the following commands to create the standard access list called IT:

Router(config)# ip access-list standard IT

Router(config-std-nacl)# permit 10.1.10.0 0.0.0.255

Router(config-std-nacl)# deny 192.168.148.0 0.0.3.255

Router(config-std-nacl)# permit 172.16.152.0 0.0.7.255

Router(config-std-nacl)# deny any log

Router(config-std-nacl)# exit

The above list when applied to the out going packets on the router interface connected to the IT subnetwork will allow access from administration to the subnet, and deny all access from the accounting subnet. It also allows any IT hosts access to the IT subnet. Because of the nature of the permissions, it is enough to filter on the source address of the packets; therefore, we use a standard access control list.

Section IV: Applying the ACLs

Now that the ACLs have been defined, they must be applied to one or more interfaces so that packets can be filtered. The access list is applied in either and inbound or an outbound direction on the interface. Packets traveling in the inbound direction come into the router form the interface. When they travel in the outbound direction, the packets leave the router and then go onto the interface. The command ip access-group is used to apply the access list to the interface. The command takes the keyword in or out as a parameter. If no parameter is provided, the out keyword is presumed. The following commands are used to apply the access list to the router interfaces used to access each respective subnet.

Router(config)#interface fastethernet0/0.1

Router(config-if)#ip access-group ADMIN out

Router(config-if)#interface fastethernet0/0.2

Router(config-if)#ip access-group ACCT out

Router(config-if)#interface fastethernet0/0.3

Router(config-if)#ip access-group IT out

Router(config-if)#end

Use the show running-configuration command to view the router configuration that contains the ACL definitions.

Before attempting to ping, go to the back of this lab and fill in the Access Control List Summary Table using what you know about the rules implemented in the summary lists.

Now ping each workstation from another and ensure that inter-switch and intra-switch communication are permitted or denied according to the specifications outlined and implemented using the access lists. Confirm that your table is correct. Do this by unplugging one interface of floor1_computers from the floor1_switch and plugging in one PC.

Before you go unplugging cables, however, there’s one more detail to take care of. Assume that you unplug interface Ethernet 0/0 (10.1.10.2) from floor1_computers and set R3 to be 10.1.10.2. Now imagine a ping packet traveling from R3 to FastEthernet 0/0 on floor1_computers (172.16.152.2). The packet leaves R3, goes to the default gateway (10.1.10.1) enters floor1_router, gets sent out the proper subinterface (172.16.152.1) and arrives at 172.16.152.2. Now, for the return trip, floor1_computers consults its routing table, sees that it is directly connected to 10.1.10.0/24 through 10.1.10.2, and sends the packet out that interface. But we just unplugged that cable, so the packet vanishes into the ether and never gets back to R3. To avoid this, we need to define a default gateway for floor1_computers:

floor1_computers(config)# ip route 0.0.0.0 0.0.0.0 172.16.152.1

The PC you will be using is R3, located on the left-most rack by the door. To the right of it you will see a monitor with a pull-out keyboard. This is the terminal you will use to access R3. Above the monitor is a KVM, which is used to share one monitor, keyboard, and mouse among many PCs. Push the button labeled R3 to access the PC.

If there is no console window, click on the K on the start bar, then KNOPPIX > Root Shell. This opens up a shell with root as the user, which is the permission level we need to change the network configuration. Type ifconfig at the prompt; if eth0 does not show up in the listing, type ifconfig eth0 up to activate it.

The network cable from R3 has been run to port 32 of the patch panel at the top of the right-most rack. Coming out of the port labeled 32 should be a long Ethernet cable; this cable is connected to R3’s network card, and is what you will plug into the switch in place of the Ethernet 0/0 interface of floor1_computers.

[Prompt]# ifconfig eth0 10.1.10.2 netmask 255.255.255.0

[Prompt]# route add default gw 10.1.10.1

[Prompt]# route –nv

Will show your PC’s routing table.

With a dashed line, draw the PC connected into the network on the wiring diagram when it is assuming the identity of 10.1.10.2. Show this connection in the wiring diagram.

Save your configuration and demonstrate to the TA your PC acting as 10.1.10.2 with working ACLs.

Part 2 Check-off point: show the lab TA a PC acting as 10.1.10.2 with working ACLs.

See turn in sheet at the back of this handout.

PART III

Assume that you are now to add a fourth subnetwork to the company network: the Marketing subnetwork. Details are as follows:

1. The marketing department will be assigned addresses on the 48.15.224.0 network.

2. There need to be enough addresses on the subnetwork to account for 2500 machines.

3. Accounting should have full access to all machines on the network.

4. IT and Administration should not be able to access any machines on this network.

5. Marketing should be able to access its own subnet.

Using this information and the preceding lab, fill out the calculation sheet at the back of the turn-in packet and turn it in with your lab. You don’t have to actually implement this addition.

Appendix A: Basic Cisco Switch Commands

About this document

The purpose of this document is to give you a quick overview of how the switch user interface works, so you can have a quick start for lab setups and troubleshooting. Also, a VLAN tutorial is included in this document.

Similarities between routers and switches

Switches share many commands with routers; in other words, you can use many of the router commands to interact with switches and the results will be the same. For examples, Switch# show running-config will have the same effect on both devices. Therefore, make sure that you read ‘Basic Cisco Router Commands.doc’ before you continue reading this document.

VLANS in the MiniNet Network

Vlan configuration is typically easy; however, there are a few things that you need to know to be successful. Cisco defines a VLAN as a broadcast domain within a switched network. VLANs allow you to segment your switched network so that broadcast domains are smaller, leaving more bandwidth for your end nodes. Devices that are in one VLAN do not received broadcasts from devices in another VLAN. For devices on different VLANs to communicate, a layer 3 devices (usually a router) must be used.

How to create vlans follow these simple steps:

SwitchA# vlan database

SwitchA(vlan)# vlan name

SwitchA(vlan)# exit

SwitchA# configure terminal

SwitchA(config)# interface fastethernet

SwitchA(config-if)# switchport mode access

SwitchA(config-if)# switchport access vlan 2

SwitchA(config-if)# end

Note: VLAN 1 (one) is used for the management VLAN, so any VLANs created should be numbered 2 to 1000.

For VLAN information to be passed between switches, trunking must be configured between switches. VLAN trunking allows a port to pass traffic from multiple VLANs between the two switches. Frames traveling over a trunk are tagged to identify which VLAN the frames belong to. When implementing trunking between switches, the ports at either end of the connection must be set up for trunk mode and the trunk encapsulation mode must match. Trunk encapsulation dictates the manner that frames are identified (tagged) on a trunk and defines the VLAN services available. There are four types of trunking encapsulations: 1) Inter-Switch Link Protocol (ISL) Cisco proprietary trunking protocol; 2) IEEE 802.1Q (dot1q) Industry standard trunking protocol; 3) LAN Emulation (LANE) Used for trunking VLANs over ATM links; and 4) IEEE 802.10 (dot10q) Cisco proprietary method for transporting VLAN information inside standard FDDI frames.

To setup trunking between two switches, use the following commands:

SwitchA(config)# interface fastethernet

SwitchA(config-if)# switchport mode trunk

SwitchA(config-if)# switchport trunk encapsulation dot1q

SwitchA(config-if)# end

Then, go to the other switch, and repeat these commands on the respective interface. This is important, otherwise, both switches will not be able to communicate to each other.

To limit which VLANs will be allowed to pass information on the port you can use the following commands:

SwitchA(config)# interface fastethernet

SwitchA(config-if)# switchport trunk allowed vlan remove 1-1005

SwitchA(config-if)# switchport trunk allowed vlan add 1-3

Then, you will have to repeat these commands on the other switch.

The previous commands remove the default of all VLANs, and adds back support for VLANs 1-3.

Finally, to avoid having to reconfigure your VLANs in case the switches are rebooted, type the following:

RouterA# copy running-config startup-config

Appendix B: Basic Cisco Router Commands

References on the www and hardcopy



Cisco Router Configuration, 2nd Edition, A practical Introduction to Cisco IOS Software configuration.

About this document

The purpose of this document is to give you a quick overview of how the router interface works, so you can have a quick start for lab setups and troubleshooting.

Configuring a Router from Scratch

If the router is turned on for the first time or if the router has a missing startup-config file, then, you will see a message that says:

Would you like to enter the initial configuration dialog? [yes/no]:

At this message just type no and press the key.

You will see the router prompt as ‘Router>’. This means that the default running configuration was loaded; in other words, the router is not configured. To configure it, you will have to type ‘enable’ followed by pressing the ‘’ key. It will not ask you for a password since it has not been set up since starting from scratch. Now you will see the router prompt as ‘Router#’.

Editing Commands

The following command or key-strokes are used to move around the command line inside the router.

|Command |Description |

|+A |Moves to the beginning of the command line |

|+B |Moves back one word |

|+B or |Moves back one character |

|Left Arrow key | |

|+E |Moves to the end of the command line |

|+F or |Moves forward one character |

|Right Arrow key | |

|+F |Moves forward one word |

|+k |Deletes all characters from the cursor until the end of the line |

|+p or |Recalls last (previous) command |

|Up Arrow key | |

|+n or |Recalls most recent command |

|Down Arrow key | |

|>show history or |Shows command buffer |

|#show history | |

| |Command completion – completes a partial command name |

|? |Displays all available commands or command parameters |

Three command modes used in routers are EXEC-Mode, Privileged EXEC-Mode, and Global Configuration Mode. There other command modes, but these are the main ones.

EXEC-Mode Commands

Provides a limited subset of commands. The first time you connect to a router, this is the mode that you will be in. The command prompt has the form ‘Router>’

To get a list of commands type ‘?’. If you see --More--, that means that the screen can be advanced by pressing either key, scrolls one line up, or , scrolls one page up.

Privileged EXEC-Mode Commands

Provides access to all commands in the router. To enter Privileged EXEC-Mode from EXEC-Mode, type enable. If a password has been setup for Privileged EXEC-Mode, you will be asked for it. It is assumed that the router has been reset to its default settings, and that it does not have any passwords setup.

Some of the commands that you will need to use are shown in the following table.

|Command |Description |

|configure terminal |Enters Global Configuration Mode. |

|copy |Copies configuration or image data |

|copy running-config startup-config |Stores the current configuration in RAM into NVRAM |

|copy running-config |Copies the current configuration in RAM into located in flash: |

| |device |

|dir [device] |List the files on a given device, use dir ? for a list of possible |

| |parameters for device |

|disable |Turns off privileged commands |

|enable password |Sets a local password to control access to various privileged levels |

|enable secret |Specifies an additional layer or security over the enable password command |

|erase startup-config |Erases the content of NVRAM |

|erase |Erases Flash or configuration memory |

|exit |Exits any configuration mode, or closes an active terminal session and |

| |terminates the EXEC |

|reload |Halts and performs a cold return; reloads the operating system. It will also|

| |reload the startup-config file if available. |

|ping |Sends an echo request; diagnoses basic network connectivity |

|show [options] |This is a very important command since you can display a great variety of |

| |router information. Type ‘show ?’ to display all your possible options. |

|show running-config |Displays the current configuration in RAM |

|show interfaces |Displays statistics for all interfaces configured on the router |

|show ip interface |Displays the status and global parameters associated with an interface |

|show ip protocols |Displays the parameters and current state of the active routing protocol |

| |process |

|show startup-config |Displays the saved configuration, which is the contents of NVRAM |

|more |Displays the contents of a file |

|setup |Enters the setup command facility |

|? |Displays all available commands or command parameters |

Global Configuration Mode

This mode allows you to make changes to the running configuration. You will need to know more about this mode that anything else. From here you can configure routing protocols, interfaces, sub-interfaces, and more. To enter Global Configuration Mode, you will need to be in Privileged ECEX-Mode. Then, type ‘configure terminal ’.

From this mode, you can have access to two sub-modes: the Interface Configuration mode and the Sub-interface Configuration mode. To enter either of these modes, you will need to type the interface command followed by a interface or a subinterface.

Notice that some routers have three physical interface, but other routers have only one physical interface. In the case of routers with only one interface, subinterfaces are created on top of the physical interface(more details on this are given later on). In addition, interfaces are named as either EthernetX/Y or FastEthernetX/Y where X will normally take numbers between 0-1, and Y will normally take values like 0,1,2,3,0.1,0.2, or 0.3 (the values for X and Y given here apply to our lab setup only; they could be different in other network setups). Also, routers have a mixture of Ethernet and FastEthernet interfaces whereas switches (in our lab network) have FastEthernet interfaces. Take a look at the ‘ece4110-2004-02-Fall-labs-7-and-8-LabSetup.xls’ file to get familiar with the router interface names.

The following table shows some commands and subcommands that you can use in Global Configuration mode.

|Command |Description |

|interface |Configures an interface type and enters configuration mode. |

|ip address |Assigns and address and a subnet mask and starts IP processing on an interface |

|ip default-network |Establishes a default route |

|ip host |Makes a static name-to-address entry in the router’s configuration file |

|ip route |Establishes static routes |

|line |Identifies a specific line for configuration and starts the line configuration command collection |

| |mode. |

|login |Logs in as a particular user. Enables password checking at login |

|network |Assigns a Network Information Center-based address to which the router is directly connected. |

|no shutdown |Restarts a disabled interface |

|router |Starts a routing process by first defining an IP routing protocol. For example, router rip selects |

| |RIP as the routing protocol |

|encapsulation |Set encapsulation type for an interface This is used to attach a sub-interface to a specific vlan. |

|full-duplex |Configure full-duplex operational mode |

|half-duplex |Configure half-duplex and related commands |

|? |Displays all available commands or command parameters |

Configuration Examples

To configure router with interfaces Ethernet0, Ethernet1, and FastEthernet0 to route packes between subnetworks 10.1.1.0, 10.1.2.0, and 10.1.3.0, you will have to use the following command sequences from Global Configuration mode.

Router(config)# interface Ethernet0

Router(config-if)#ip address 10.1.1.1 255.255.255.0

Router(config-if)full-duplex

Router(config-if) no shutdown

# It is optional to type exit after you have configured one interface and before

# configuring the next one

Router(config-if)interface Ethernet1

Router(config-if)ip address 10.1.2.1 255.255.255.0

Router(config-if)full-duplex

Router(config-if) no shutdown

Router(config-if)interface FastEthernet0

Router(config-if)ip address 10.1.3.1 255.255.255.0

Router(config-if)speed auto

Router(config-if)full-duplex

Router(config-if) no shutdown

Router(config-if) end

To configure a router with interfaces Ethernet0/0, Ethernet1/0, and FastEthernet0/0 to route packes between subnetworks 10.1.1.0, 10.1.2.0, and 10.1.3.0, you will have to replace the respective interface names on the command lines shown above.

To configure a router with interface with only one physical interface FastEthernet0/0 to route packets between subnetworks 10.1.1.0, 10.1.2.0, and 10.1.3.0, you will have to use the following command sequences from Global Configuration mode.

Router(config)interface FastEthernet0/0

Router(config-if)no ip address

Router(config-if)no ip mroute-cache

Router(config-if)speed auto

Router(config-if)full-duplex

Router(config-if) no shutdown

Router(config-if)interface FastEthernet0/0.1

Router(config-if)encapsulation dot1Q

Router(config-if)ip address 10.1.1.1 255.255.255.0

Router(config-if) no shutdown

Router(config-if)interface FastEthernet0/0.2

Router(config-if)encapsulation dot1Q

Router(config-if)ip address 10.1.2.1 255.255.255.0

Router(config-if) no shutdown

Router(config-if)interface FastEthernet0/0.3

Router(config-if)encapsulation dot1Q

Router(config-if)ip address 10.1.3.1 255.255.255.0

Router(config-if) no shutdown

Router(config-if) end

# you will have to replace with the corresponding VLAN

Appendix C: Saving and restoring your configurations

The scripts for uploading and downloading configurations are located on the NAS in the Lab6 directory. They are in a tarball named mnet_tools_v1.5.tar. Copy this file to your /root directory, and unpack it using:

# tar –xf mnet_tools_v1.5.tar

# cd mnet_tools_v1.5

Before these scripts will work, the following two perl modules must be installed:

IO-Tty-1.02.tar.gz

Expect-1.15.tar.gz

Here's how to install the modules:

First install IO-Tty-1.02.tar.gz

# tar -zxvf IO-Tty-1.02.tar.gz

# cd IO-Tty-1.02

# perl Makefile.PL

# make

# make install

Then install Expect-1.15.tar.gz

# tar -zxvf Expect-1.15.tar.gz

# cd Expect-1.15

# perl Makefile.PL

# make

# make install

Now you can run minictrl.pl to make sure it is working correctly. The program should output it's usage and exit.

# ./minictrl.pl

Now, some notes on the actual scripts:

Extension "p1", "p2", and "p3" on scripts below refer to playstation #1, playstation #2, and playstation #3 respectively. Each group of files is described below.

Download and upload of configurations is based on a perl Expect module. The nature of this module is complex and finicky. Therefore, sometimes it is necessary to run an upload or download script multiple times in order to successfully upload or download. Currently, three tries are given for each upload and download. Therefore, you may see errors in the download or upload process. However, at the end of the script, you should see a successful message printed indicating that one of the three tries was successful.

download_reset_p1

download_reset_p2

download_reset_p3

These scripts are used to download reset configuations. The network devices should be configured to their reset configuation before running these scripts. Then, these scripts can be executed to store a "reset" configuration. YOU NEVER NEED TO RUN THIS SCRIPT. The reset configurations are included in the tarball: reset1, reset2, and reset3.

reset_p1

reset_p2

reset_p3

These scripts return the playstations to a "reset" configuration, which must be downloaded using the download_reset scripts above first.

download_p1

download_p2

download_p3

These scripts are used to download all network device configurations for the devices in the give playstation. The configurations are stored in files in a subfolder called playstation1, playstation2, and playstation3 respectively. Download time can vary from 30-60 seconds

upload_p1

upload_p2

upload_p3

These scripts are used to restore device configurations. They can only be executed after succesfully downloading configurations using the download scripts. Upload time can vary from 3-5 minutes because the network devices must be reloaded, which takes several minutes.

CM_Library.pm

Library used by minictrl to download, upload, and connect to digi.

minictrl.pl

Tool that does the downloading and uploading of configurations.

single_cmd

Internal wrapper tool.

ECE 4110 Internetwork Programming

Turn in sheet

Lab 7: Setting up Burdell Inc. Network Using Multiple Switches and Access Control Lists

Group Number: ________

Member Names: _________________________ _________________________

Date: _____________________

Part 1 Check-off point: show the lab TA your working network.

TA Signature _______________________ DATE ______________________

Part 2 Check-off point: show the lab TA a PC acting as 192.168.148.2 with working ACLs.

TA Signature _______________________ DATE ______________________

Turn-in List

1. The turn in sheet from the back of the lab

2. Physical Cabling Diagram

3. Access Control List Summary Table

4. Marketing Network Setup Sheet

Group Number____________________ Names:______________________________

Date:_________________________

Playstation #:____________________

[pic]

Group Number____________________ Names:______________________________

Date:_________________________

Access Control List Summary Table:

From: To: Allowed (YES or NO)?

10.1.10.2 10.1.10.3

10.1.10.2 192.168.148.3

10.1.10.2 172.16.152.3

192.168.148.2 10.1.10.3

192.168.148.2 10.1.10.2

192.168.148.2 192.168.148.3

192.168.148.2 172.16.152.3

172.16.152.2 10.1.10.3

172.16.152.2 192.168.148.3

172.16.152.2 172.16.152.3

Group Number____________________ Names:______________________________

Date:_________________________

Part III: Marketing Network Setup

Need: 2500 machines

Network address: 48.15.224.0 / ____

Netmask: ____.____.____.____

Wildcard Mask: ____.____.____.____

Calculations:

ACL Setup:

Fill in the commands you would use to set up the MKTING access control list

Router(config)#ip access-list standard MKTING

Router(config-std-nacl)#

Router(config-std-nacl)#

Router(config-std-nacl)#

Router(config-std-nacl)#

Router(config-std-nacl)# deny any log

-----------------------

0/1

0/2

0/3

0/5

0/4

0/4

0/3

0/2

0/1

[pic]

Figure 1. Burdell Inc’s network topology diagram

[pic]

Figure 1. Burdell Inc’s network topology diagram

ACL

Ethernet 0/0

Ethernet 1/0

PC (for Part II of Lab)

Floor2_computers Digi #___

Floor1_computers Digi #___

Floor1_router Digi #___

Floor2_switch Digi #___

Floor1_switch Digi #___

Fast Ethernet 0/0

Ethernet 1/0

Ethernet 0/0

[pic]

Fast Ethernet 0/0

Ethernet 0/1

Ethernet 0/0

[pic]

Ethernet 0/0

Fast Ethernet 0/0

Ethernet 1/0

Ethernet 0/0

Fast Ethernet 0/0

Ethernet 0/1

Ethernet 0/0

Fast Ethernet 0/0

Ethernet 1/0

Ethernet 0/0

[pic]

Fast Ethernet 0/0

Ethernet 0/1

Ethernet 0/0

[pic]

Fast Ethernet 0/0

Ethernet 1/0

Ethernet 0/0

Fast Ethernet 0/0

Ethernet 0/1

Ethernet 0/0

Fast Ethernet 0/0

[pic]

Fast Ethernet 0/0

Ethernet 0/1

Ethernet 0/0

[pic]

................
................

Online Preview   Download