CCNA Security configuration

PACKET TRACER
RAFAT KHANDAKER
05/12/2016
SECURITY
.
ABSTRACT
In this lab I am going to simulate a situation where security is configured in order to
restrict or permit connection to network resources. Port sticky, static, dynamic mac configuration
will be used. I am also going to configure a network with an access list & group list to allow
connection to a server.
INTRODUCTION
Security is a largely contributed topic by cisco, especially due to the rise in cyber crimes.
Cisco switches and routers have quite a few features that allow them to be great and secure
network devices. Many protocols in cisco ios can prevent unauthorized connection to network
resources. Cisco has implemented layer 2 and layer 3 security within their devices.
At layer two, mac address can be statically assigned to individual ports in order to
prevent un-authorized devices to access the network. Cisco, also have other variation of
protocols to ease the job of a network administrator. Mac address can be dynamically learned on
a switchport, also can be configured with a limited number of devices. Mac-sticky is a protocol
that can allow an address to be dynamically learned without having to manually configure each
device on each port. other configurations can be made, such as setting an mac table aging timer,
which can allow one device to access the network at a time.
At layer 3, we can configure packet filtering, which is similar to a firewall of the cisco
device router or switch. An access-list can be configured to permit or deny certain IP address to
resources on the network and even port forward can be configured.

In this network each interface on switch will be configured to use port security as designated on
the diagram.
Configuration for fa1/1 on switch 0
Show run from switch 0 : fa1/1

No port security will be configured for the labtop connection. In this lab, I plan to simulate the
labtop connecting into a remote server with an access list.
Switch 1
show run from switch 1 :
Fa0/1 was configured with mac-sticky, dynamically learnt.
Fa0/2 was configured with static because it is connected to a server, more appropriate for the
network. security is set to shutdown because the server may play an important role in the
network and if the link was shut down, it would be easier to find the fault. Security is also a
concern because shutting down the port will allow network admins to view the configuration
setting as soon as a breach is made at this port.
ACCESS LIST CONFIGURATION ON ROUTER
The plan is to allow the laptop to connect into the server through the web but no other device can
be allowed to do that.
According to cisco's documentation, access lists have two types of configuration; standard and
Extended. Standard access lists only examine the packet's source address to permit or deny
traffic. Extended access lists allow the router to permit or deny traffic based on the packet's
source and destination IP address, along with specific ports and protocol. Access configuration
use source address and source Wildcard mask or inverse subnet.
Standard ACL ( 1 - 99 )
Extended ACL ( 100-199 )
Access Group command :

For this lab, I am going to configure the access list for the router to allow the laptop as the only
device to access the servers web address. The Fa1/0 interface will be configured to allow packets
into it's port. The fa0/0 interface will be configured to allow packets from the laptop to the
server..
as we can see here, access list is configured to allow the laptop's ip address to access the server's
ip on it's web port. All other hosts are denied access to the web server on port 80.
here is the final diagram:
To test the configuration:
Trial 1 : i failed consistently to get a connection into the router after configuring the access-list..

I troubleshooted the network to achieve layer 3 connectivity to the router and the server. I
failed..
I removed the access list from the router and successfully was able to ping the network.
I knew the problem was with the configuration of the access list, so i decided to research the
ACL issue.
I came across a documentation that states that access list configuration by defualt has an implicit
statement to deny all connection. So in other words... the access-list will go through all the rules
of the configuration settings, if all of the rules fail, then the implicit end statement will deny and
drop all connection to the router.
so to fix the configuration of my network i had to add these few commands to the access list:
the icmp tcp and udp protocols were irrelevant , matter of fact if i just used " ip" it would have
been enough. Just in-case, i permited those connections as well.
This is my full access-list config
TESTING WITH LAPTOP

connection to the router and server pings with success.

accessing the web server from the laptop also succeeds.
TESTING CONNECTIVITY WITH PC1

We can see here that the physical connectivity to the server succeeds, however, accessing the
webserver from the browser should fail due to the access list configuration.

attempting to access the server through the webserver fails due to packet filtering, ACL
configuration on the router.
CONCLUSION
I have successfuly configured this network with cisco security protocols. I was able to
troubleshoot all the problems found within this lab. I was able to enhance my knowledge about
ACL's. I learnt that ACL have a default implicit rule that was blocking my connection. I was able
to assign port security on each switch with ease.

CCNA Security configuration

Recommended

More Related Content

What's hot (20)

Viewers also liked (11)

Similar to CCNA Security configuration (20)

Recently uploaded (20)

CCNA Security configuration