Lab 2 - Basic Router Configuration
You need to turn in:
1.
your pre-lab at the beginning of your
session
2. your
completed Lab 2 handout at the end of your session
Each
group of 2 students will use the following equipment for this experiment.
2 computers with Microsoft Windows 2000 Professional |
1 Cisco Systems Catalyst 2900 Series Switch |
1 Cisco 2621 Router |
1
rollover cable (null modem) |
1
DB9m adapter |
3
Ethernet cables |
1
Ethernet crossover cable |
Every
two groups share an additional Ethernet crossover cable |
Recap &
Introduction: In Lab #1,
you learned how to construct a TCP/IP network of four hosts via switches by
assigning IP addresses and subnet masks to the hosts. You also learned how
subnetting affects a network.
In this lab, we will be implementing the network topology in Figure 1
on the last page where two networks in different subnets are physically
separated. There is no legend in the figure because you are required to add them in
the pre-lab exercise. Our goal is to connect these two
networks together. They could be
on different floors in the same building.
They could be in nearby buildings.
Or they could be in different cities. To this end, you will
first be introduced to the basics of the Cisco Internetwork Operating System
(IOS). You will, then, assign IP addresses to the
routers. The router acts as the gateway
to its own network. Then, you will use
an Ethernet crossover cable to simulate the “cloud.” Finally, you will set up static routing
tables in the gateways and test the connection.
Cisco Router
Configuration – Introduction to Cisco Internetwork Operating System (IOS)
Cisco routers are powered by the Cisco IOS which allows the routers to
be configured to perform specific tasks. Before you start configuration of a
Cisco Router, you must understand the two EXEC modes available on a router: user EXEC mode and privileged EXEC mode. User mode allows you to perform basic trouble
shooting tests, telnet to remote hosts, and list router system information. You
know that the router is in this mode if the prompt is the router name followed
by the greater than sign: RouterName>. Privileged mode, sometimes called
“enable mode”, allows for full router configuration and advanced troubleshooting.
“RouterName#” is an example of the privileged mode prompt. If you log into a
router via a console or telnet connection, you enter user mode. To enter
privileged mode requires that you issue the enable command. Before you actually configure a Cisco router, you
must understand the two main configuration modes: global configuration mode and interface
configuration mode.
Each of the routers we use has two Ethernet interfaces. Settings made in global configuration mode
affect overall router operations. You can use the command configure to enter this mode after you are in the privileged mode.
If you wish to configure a particular interface, you must use interface
configuration mode. To enter this mode, you need to be in the global
configuration mode. You then enter the interface
command followed by the name and number of the interface you wish to enter.
If the router is in global configuration mode, the prompt will be RouterName
(config)# while in interface configuration mode it will be
RouterName(config-if)#.
The BIG
Picture: Task 1 is the
groundwork. In task 2 and 3, group A
will configure LAN A and Group B will configure LAN B. Task 4 will require the two groups work
together to interconnect the two LANs.
This lab
requires two groups of two to work together as a team. For each group, there
will be one designated router and switch. The routers provided are Cisco 2621
models. Cisco 12.0(7) IOS is loaded on them. The switch is a Cisco 2900 model
with 12 ports.
Initial Setup
Task 1 – Log on to the router using
HyperTerminal
We will use a
Windows program called HyperTerminal to log on to your router from one of your
PCs.
You will now need to configure
HyperTerminal so that it communicates with the router on COM1.
Bits Per Second: |
9600 |
Data Bits: |
8 |
Parity: |
None |
Stop Bits: |
1 |
Flow Control: |
Xon/Xoff |
MAC address |
Speed |
MTU |
|
|
|
|
|
|
Enable |
|
Show |
|
Traceroute |
|
|
|
TIP: You can type the ? command at any time
to receive context sensitive help.
Task 2 – Clear router configuration
Because
we are unsure of the validity of the current configuration, we need to
re-configure it by ourselves. First we need to clear the current
configuration. To this end, we must be
in Privileged EXEC Mode.
TIP: One of the nice things about the Cisco
IOS is that it does auto complete of commands, if you type a significant part
of the command and press tab, the rest of the command will be added
automatically. Another feature is the ability to abbreviate commands. Yet
another and most useful feature is the ability to query for command syntax. For
example if you don’t know what arguments are accepted for the show command,
type show ? and a list of possible arguments is printed. Feel free to explore
this command.
Task 3 – Configure an IP address to the
router
Once
the router has finished booting up, the previous configuration will be erased
and the IOS will be in the System Configuration Dialog.
Task
3A – Configure FastInterface0/0 (i.e. the
Router’s “LAN” interface) Using the System Configuration Dialog
|
Group A |
Group B |
Subnet Mask Address |
FastEtherernet0/0 |
192.168.0.1 |
192.168.50.1 |
255.255.255.0 |
FastEthernet0/1 |
192.168.100.1 |
192.168.100.2 |
255.255.255.0 |
Task 3B – Configure FastInterface0/1 (i.e. the Router’s
“WAN” interface) Manually
Group A |
IP Address: |
Subnet Mask Address: |
Gateway: |
Computer1 |
192.168.0.2 |
255.255.255.0 |
192.168.0.1 |
Computer2 |
192.168.0.3 |
255.255.255.0 |
192.168.0.1 |
Group B |
IP Address: |
Subnet Mask Address: |
Gateway: |
Computer1 |
192.168.50.2 |
255.255.255.0 |
192.168.50.1 |
Computer2 |
192.168.50.3 |
255.255.255.0 |
192.168.50.1 |
Task 4 – Setting up static routing
tables
This
task requires Group A and Group B to work together. If you are ahead of your
partner group, feel free to explore other commands available on router.
Now that each network has its gateway configured, we are ready to connect these
two networks together. The remainder of
the router configuration will be done across the network that you just built.
We
will now set up a static routing table in each of the two routers. The idea is
for the table to indicate that the other group's network can be reached via the
0/1 interfaces of both routers. To create a static entry in the routing table
of the router, you must be in Configuration Mode.
|
|
|
Extra Tasks –Access Lists (Firewall
Packet Filtering)
I.
Introduction: The Access
list is one of the most important control mechanisms to control access to both
the internal and external network. Access lists consist of permit or deny
statements that filter traffic based on the source address/port, destination
address/port, and protocol type of the packet. In this lab, you have a chance to
set up a Cisco router access list from scratch.
Access-list
format
access-list [list #] [permit | deny] [source address] [source wildcard mask]
[source port] [destination address] [destination wildcard] [destination port]
[precedence precedence#] [tos tos] [log] [established]
where
[list #] : Standard IP access-lists are represented by a number in range 1-99
[permit | deny]: Either allow or deny access to certain source
[source address]: The IP address of the source
[source wildcard mask]: A wildcard mask, or inverse mask, applied to determine
which bits of the source are significant..
Unlike subnet masks,
0’s are placed in bit positions deemed significant, and 1’s are placed in
positions that are not significant.
Wildcard mask
examples.
172.22.5.2 |
0.0.0.0 |
All bit positions
must match exactly. Access list will be applied only to the host 172.22.5.2 |
172.22.5.0 |
0.0.0.255 |
Bit positions in
the first three octets must match exactly, but the last octet can be any
valid number. The access list will apply to all hosts in the 172.22.5.0
subnet. |
One of the most
common problems with access list is the lack of planning. Since an access list
is searched from top to bottom, the configuration and order of each entry must
be precise to work correctly.
Ex: The following
access list is not correctly configured.
Access-list 1 deny
any
Access-list 1 permit 168.243.32.0 0.0.0.255
Access-list 1 permit any
According to the
access-list above, none of the computers on the network will be able to get
access to the router. This is because when a condition is satisfied by a rule
in access-list, router will NOT continue to check any of remaining rules.
Task 1 – Reset Access List
1. Make sure
you are in privileged mode.
2. Type configure terminal.
3. Verify that
the router is able to communicate with both computers by using the ping command
with the IP address of a machine in your group and one in the other group.
Task 2 – Create new Access List
Here you are going to configure the router so that one of the machines
from the other
group can talk with you, while the other cannot.
1. Verify that
there are no access lists using show
access-lists
2. access-list 1 deny 192.168.50.3 (GroupB use
192.168.0.2)
3. access-list 1 permit 192.168.50.2 (GroupB use
192.168.0.3)
Task 3 – Applying Access List to Interfaces
1. Enter the
interface configuration mode to configure the 0/0 interface. Type
2. interface FastEthernet 0/0
3. Apply the
above list (list 1) to the out side of the interface: ip access-group 1 out
4. Verify that
the list has been entered, this time use the command show run.
5. And verify
that the router correctly filters packets. Use ping from both hosts to verify.
6. Fill out the
following table with the results of your verification.
|
|
Pinged |
|||
|
Success (Yes/No) |
192.168.0.2 |
192.168.0.3 |
192.168.50.2 |
192.168.50.3 |
Pinging |
192.168.0.2 |
|
|
|
|
192.168.0.3 |
|
|
|
|
|
192.168.50.2 |
|
|
|
|
|
192.168.50.3 |
|
|
|
|