Lab Cisco Packet Tracer i634y

Lab 1 - Basic switch setup Introduction A new switch just purchased from Cisco contains no default configuration in it. You need to configure the switch with setup mode using the setup mode or from scratch using the command line interface (CLI) before connecting it in your network environment. As a Cisco certified technician, it is very important to know the basic Cisco switch configuration commands to improve the performances and the security of your internetwork.

Lab instructions This lab will test your ability to configure basic settings on a cisco switch. 1. Use the local laptop connect to the switch console. 2. Configure Switch hostname as LOCAL-SWITCH 3. Configure the message of the day as "Unauthorized access is forbidden" 4. Configure the for privileged mode access as "cisco". The must be md5 encrypted 5. Configure encryption on the switch using the global configuration command 6. Configure CONSOLE access with the following settings : - enabled - : ciscoconsole - History size : 15 commands - Timeout : 6'45'' - Synchronous logging 6. Configure TELNET access with the following settings : - enabled - : ciscotelnet - History size : 15 commands - Timeout : 8'20'' - Synchronous logging 7. Configure the IP address of the switch as 192.168.1.2/24 and it's default gateway IP (192.168.1.1). 8. Test telnet connectivity from the Remote Laptop using the telnet client.

Network diagram

Solution Configure Switch hostname as LOCAL-SWITCH hostname LOCAL-SWITCH

Configure the message of the day as "Unauthorized access is forbidden" banner motd # Unauthorized access is forbidden#

Configure the for privileged mode access as "cisco". The must be md5 encrypted enable secret cisco

Configure encryption on the switch using the global configuration command service -encryption

Configure CONSOLE access [...] line con 0 ciscoconsole logging synchronous history size 15 exec-timeout 6 45

Configure TELNET access [...] line vty 0 15 exec-timeout 8 20 ciscotelnet logging synchronous history size 15

Configure the IP address of the switch as 192.168.1.2/24 and it's default gateway IP (192.168.1.1). interface Vlan1 ip address 192.168.1.2 255.255.255.0 ip default-gateway 192.168.1.1

Lab 2 - Switch interfaces configuration Lab instructions This lab will test your ability to configure speed, duplex, and vlan settings on a cisco switch interfaces. 1. Connect to Switch0 using console interface and configure each Switch0 fastethernet switchport for operation. Correct settings are : - Port type : access port - Speed : 100 Mbit/s - Duplex mode : Full Duplex - Autonegotiation disabled

2. PC "192.168.1.4" seems to be unable to ping other PCs in the network. Check switch configuration. TIP : How many broadcast domains are there in this network ?

3. Choose the right cable to connect : - Switch0 gigabitethernet 1/1 to Switch1 gigabitethernet 1/1 - Switch1 gigabitethernet 1/2 to Switch2 gigabitethernet 1/2

4. Configure those two links as trunk lines without using trunk negotiation between switches

Network diagram

Solution Connect to Switch0 using console interface and configure each Switch0 fastethernet switchport for operation. Switch(config)#interface FastEthernet0/1 switchport mode access duplex full speed 100 Switch(config)#interface FastEthernet0/2 switchport mode access duplex full speed 100

Switch(config)#interface FastEthernet0/3 switchport mode access duplex full speed 100 Switch(config)#interface FastEthernet0/4 switchport mode access duplex full speed 100

PC "192.168.1.4" seems to be unable to ping other PCs in the network. Check switch configuration. Switch(config)#interface FastEthernet0/4 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 1

Choose the right cable to connect : - Switch0 gigabitethernet 1/1 to Switch1 gigabitethernet 1/1 - Switch1 gigabitethernet 1/2 to Switch2 gigabitethernet 1/2

Configure those two links as trunk lines without using trunk negotiation between switches On every interface that has to be configured for trunk operation, configure the following settings Switch(config)#interface GigabitEthernet1/X Switch(config-if)#switchport mode trunk

interface operational mode using the "show interface GigabitEthernet1/X switchport command" :

Name: Gig1/2 Switchport: Enabled istrative Mode: trunk Operational Mode: trunk istrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Voice VLAN: none Another usefull ios command is "show interfaces trunk" : Switch#sh interfaces trunk Port Mode Encapsulation Status Gig1/2 on 802.1q trunking

Native vlan 1

Port Vlans allowed on trunk Gig1/2 1-1005 Port Vlans allowed and active in management domain Gig1/2 1 Port Vlans in spanning tree forwarding state and not pruned Gig1/2 1

Lab 3 - VLAN and VTP configuration Lab instructions The aim of this lab is to check your ability to configure VTP and VLAN on a small network of four switches. This lab will help you to prepare your ICND1 exam. 1.Configure the VTP-SERVER switch as a VTP server 2.Connect to the 3 other switches and configure them as VTP clients. All links between swiches must be configured as trunk lines. 3.Configure VTP domain name as "TESTDOMAIN" and VTP as "cisco" 4.Configure VLAN 10 with name "STUDENTS" and VLAN 50 with name "SERVERS" 5. Check propagation on all switches of the VTP domain.

Network diagram

Solution Configure the VTP-SERVER switch as a VTP server VTP-SERVER(config)#vtp mode server the VTP configuration using the "show vtp status command"

VTP-SERVER#show vtp status VTP Version :2 Configuration Revision :4 Maximum VLANs ed locally : 255 Number of existing VLANs :7 VTP Operating Mode : Server VTP Domain Name : TESTDOMAIN VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0xAE 0x4F 0x3F 0xC5 0xD3 0x41 0x9C 0x11 Configuration last modified by 192.168.1.1 at 3-1-93 00:27:41 Local updater ID is 192.168.1.1 on interface Vl1 (lowest numbered VLAN interface found)

Connect to the 3 other switches and configure them as VTP clients. All links between swiches must be configured as trunk lines. VTP-CLIENT3(config)#vtp mode client the VTP configuration using the "show vtp status command" VTP-CLIENT3#sh vtp status VTP Version :2 Configuration Revision :4 Maximum VLANs ed locally : 255 Number of existing VLANs :7 VTP Operating Mode : Client VTP Domain Name : TESTDOMAIN VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0xAE 0x4F 0x3F 0xC5 0xD3 0x41 0x9C 0x11 Configuration last modified by 192.168.1.1 at 3-1-93 00:27:41

Configure VTP domain name as "TESTDOMAIN" and VTP as "cisco" 1. Configure each link between switches as a trunk line interface GigabitEthernet1/1 switchport mode trunk interface GigabitEthernet1/2 switchport mode trunk

2.On the server : VTP-SERVER(config)#vtp domain TESTDOMAIN VTP-SERVER(config)#vtp cisco

3.On each client : VTP-CLIENT1(config)#vtp cisco VTP-CLIENT1(config)#vtp domain TESTDOMAIN

Configure VLAN 10 with name "STUDENTS" and VLAN 50 with name "SERVERS" On the VTP server switch, configure the following commands VTP-SERVER(config)#vlan 10 VTP-SERVER(config-vlan)#name STUDENTS VTP-SERVER(config)#vlan 50 VTP-SERVER(config-vlan)#name SERVERS

Check propagation on all switches of the VTP domain. Use the "show vlan brief" on each switch to check propagation of the 2 VLANS. VTP-SERVER#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4, [...] 10 STUDENTS active 50 SERVERS active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active

Lab 4 - Port security Introduction A growing challenge for network s is to be able to control who is allowed - and who isn't - to access the organization's internal network. This access control is mandatory for critical infrastructure protection in your network. It is not on public parts of the network where guest s should be able to connect. Port security is a Cisco feature implemented in Catalyst switches which will help network engineers in implementing network security on network boundaries. In its most basic form, the Port Security feature writes the MAC address of the device connected to the switch edge port and allows only that MAC address to be active on that port. If any other MAC address is detected on that port, port security feature shutdown the switch port. The switch can be configured to send a SNMP trap to a network monitoring solution to alert that the port is disabled for security reasons.

Lab instructions This lab will test your ability to configure port security on CiscoTM 2960 switch interfaces. 1. Configure port security on interface Fa 0/1 of the switch with the following settings : - Port security enabled - Mode : restrict - Allowed mac addresses : 3 - Dynamic mac address learning.

2. Configure port security on interface Fa 0/2 of the switch with the following settings : - Port security enabled - Mode : shutdown - Allowed mac addresses : 3 - Dynamic mac address learning.

3. Configure port security on interface Fa 0/3 of the switch with the following settings :

- Port security enabled - Mode : protect - Static mac address entry : 00E0.A3CE.3236

4. From LAPTOP 1 : Try to ping 192.168.1.2 and 192.168.1.3. It should work. Try to ping 192.168.1.4 and 192.168.1.5. It should work.

5. Connect ROGUE laptop to the hub. Try to ping 192.168.1.1. It should work. Try to ping 192.168.1.4. It should fail.

Network diagram

Packet Tracer 5.3 - Setting up and managing a DH server Introduction DH service is a key component of your network infrastructure by allowing centralized ip address management on a single pool of servers. DH configuration is also part of CCNA and CCNP Switch certification exams curricula. This skill can be tested in lab environnement during exams ans it's important for students to get used to DH configuration before taking the exam. Packet Tracer 5.3 implements two methods for setting up a DH server in your network :  

Configuration of DH pools on Cisco routers or multlayer switches. Configuration of a standalone DH server appliance on the network and usage of the "ip helper-address" command on network devices for DH traffic forwarding outside each local broadcast domain. This tutorial will describe this method for implementing DH service in your network.

Tutorial description This tutorial will show you how to configure dynamic IP address assignment on multiple VLAN with a unique DH server appliance on the network. Two VLANs are configured on Switch0 with Router0 as default gateway :  

VLAN 10 - Nework : 192.168.10.0/24 - Gateway : 192.168.10.1 (FA 0/0.10) VLAN 20 - Network : 192.168.20.0/24 - Gateway : 192.168.20.1 (FA 0/0.20)

The unique DH server is located on a remote subnet with IP 172.16.24.2.

Learning DH : recommended books

DH configuration Declare IP address pools on the DH management tab of the server like on the picture below. One pool has to be declared for each VLAN. Don't forget to configure the right network settings and default gateway (Router0 FA 0/0.10 and FA 0.0.20 IP address) for each VLAN.

Configure router0 for DH forwarding Router(config)# interface FastEthernet0/0.10 Router(config-subif)# encapsulation dot1Q 10 Router(config-subif)# ip address 192.168.10.1 255.255.255.0 Router(config-subif)# ip helper-address 172.16.24.2

Router(config)# interface FastEthernet0/0.20 Router(config-subif)# encapsulation dot1Q 20 Router(config-subif)# ip address 192.168.20.1 255.255.255.0 Router(config-subif)# ip helper-address 172.16.24.2