Traditionally, remote administrative access on routers was configured using Telnet on TCP port 23.
However, Telnet was developed in the days when security was not an issue. For this reason,
all Telnet traffic is forwarded in plain text.
SSH has replaced Telnet as the best practice for providing remote router administration with
connections that support strong privacy and session integrity. SSH uses port TCP 22.
It provides functionality that is similar to that of an outbound Telnet connection, except that the connection is encrypted.
With authentication and encryption, SSH allows for secure communications over an insecure network. In this configuration,
four routers are interconnected in a hub-and-spoke Frame Relay configuration. Router R1 is the hub, and routers R2, R3,
and R4 are the spokes. Dynamic routing has been configured using multiarea OSPF.
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
Read more "
..."
 |
||||||||||||||||||||||
|
Nov 14, 2009
Traditionally, remote administrative access on routers was configured using Telnet on TCP port 23.
However, Telnet was developed in the days when security was not an issue. For this reason,
all Telnet traffic is forwarded in plain text.
SSH has replaced Telnet as the best practice for providing remote router administration with
connections that support strong privacy and session integrity. SSH uses port TCP 22.
It provides functionality that is similar to that of an outbound Telnet connection, except that the connection is encrypted.
With authentication and encryption, SSH allows for secure communications over an insecure network. In this configuration,
four routers are interconnected in a hub-and-spoke Frame Relay configuration. Router R1 is the hub, and routers R2, R3,
and R4 are the spokes. Dynamic routing has been configured using multiarea OSPF.
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
Read more " ..."
However, Telnet was developed in the days when security was not an issue. For this reason,
all Telnet traffic is forwarded in plain text.
SSH has replaced Telnet as the best practice for providing remote router administration with
connections that support strong privacy and session integrity. SSH uses port TCP 22.
It provides functionality that is similar to that of an outbound Telnet connection, except that the connection is encrypted.
With authentication and encryption, SSH allows for secure communications over an insecure network. In this configuration,
four routers are interconnected in a hub-and-spoke Frame Relay configuration. Router R1 is the hub, and routers R2, R3,
and R4 are the spokes. Dynamic routing has been configured using multiarea OSPF.
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
Read more " ..."
configure router
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2.
Read more "configure router..."
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2.
Read more "configure router..."
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2. Read more " ..."
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2. Read more " ..."
Nov 7, 2009
Configuring SSH
Traditionally, remote administrative access on routers was configured using Telnet on TCP port 23. However, Telnet was developed in the days when security was not an issue. For this reason, all Telnet traffic is forwarded in plain text. SSH has replaced Telnet as the best practice for providing remote router administration with connections that support strong privacy and session integrity. SSH uses port TCP 22. It provides functionality that is similar to that of an outbound Telnet connection, except that the connection is encrypted. With authentication and encryption, SSH allows for secure communications over an insecure network. In this configuration, four routers are interconnected in a hub-and-spoke Frame Relay configuration. Router R1 is the hub, and routers R2, R3, and R4 are the spokes. Dynamic routing has been configured using multiarea OSPF.
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2. Read more "Configuring SSH..."
Task 1: View the Default Configuration.
Step 1. Verify the Frame Relay configuration on the routers.
a. On all four routers, enter user EXEC mode with the password cisco.
b. Enter privileged EXEC mode with the password cisco.
c. From privileged EXEC mode on all four routers, issue the show frame-relay map
command to verify Frame Relay connectivity.
Step 2. Verify the routing tables.
From privileged EXEC mode on all four routers, issue the show ip route command to verify the all network segments are being advertised.
Step 3. Verify connectivity between routers.
a. From R1, ping all LAN interfaces to verify connectivity.
b. Again from router R1, Telnet to R2 using it’s LAN interface IP address. Exit and repeat the step for routers R3 and R4.Ping other PCs on the same network.
Task 2: Configure SSH on the Hub Router (R1).
Step 1. Enable and configure SSH on R1.
To enable SSH on the router, the following parameters must be configured:
- Hostname
- Domain name
- Asymmetrical keys
- Local authentication
a. The hostname on R1 is pre-configured. Therefore configure the domain name cisco.com using the ip domain-name domain-name command.
b. The asymmetrical RSA keys must be generated on R1 using the crypto key generate rsa command. When prompted for a modulus size, specify a modulus of 1024 bits.
c. SSH will prompt for a username and password combination when enabled. Therefore, a local username database entry must be configured using the username name password password command. Create a local account for the user admin and password cisco.
d. Configure the SSH version using the ip ssh version command. In this lab, we will be configuring to use version 2.
e. Next, we need to disable Telnet and enable SSH communication to the VTY lines. To do so, enter the following commands on R1.
R1(config)# line vty 0 4
R1(config-line)# no transport input all
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end
f. Save the configuration.
Step 2. Check results.
Your completion percentage should be 25%. If not, click Check Results to see which required components are not yet completed.
Task 3: Configure SSH on the Spoke Routers R2, R3 and R4.
Step 1. Configure SSH on routers R2, R3, and R4.
Repeat the Steps from Task 2 on routers R2, R3 and R4.
Step 2. Check results.
Your completion percentage should be 100%. If not, click Check Results to see which required components are not yet completed.
Task 4: Verify SSH.
Step 1. Verify the SSH configuration.
After configuring SSH on all routers, verify the SSH configuration on R1.
a. Issue the show ip ssh command to verify which version of SSH is configured, and what the default settings are.
R1# sho ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
b. Next, issue the show ip ssh command to verify if SSH is currently running.
R1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Step 2. connect to R2.ext.
a. Now Telnet to router R2.ext, to issue the show ip ssh command to verify if SSH is currently running.
R1# telnet 10.20.20.1
Trying 10.20.20.1 ...
[Connection to 10.20.20.1 closed by foreign host]
Recall that Telnet was deactivated using the no transport input all command. Only SSH can be used to establish a remote connection.
b. Using R1 as the SSH client, SSH to router R2 using the ssh –l username ip-address command.
R1#ssh –l admin 10.20.20.1
Password:
c. When prompted for a password, enter cisco. You should now be connected to router R2. Read more "Configuring SSH..."
Nov 6, 2009
prosedure Instalation Wireless LAN
* Tools 1. Compass and topographic maps
2. A ruler and protractor
3. Pencils, erasers, stationery
4. GPS, altimeter, klinometer
5. Reflective glass and binoculars
6. Radio communication (HT)
7. Orinoco PC Card, Pigtail and PCI / ISA adapter
8. Multimeter, SWR, cable tester, solder, tin, wire cutting pliers
9. Climbing equipment, harness, Carabiner, Webbing, Cows tail, fitted
10.Kunci PULLEY, key rings, key english, pliers (cutting, crocodile, pins), screwdriver set, tie rap, insulating gel, TBA, power roll unibell
11.Kabel , UTP cables straight and cross, Crimping tools, RJ45 connectors
12.Software AP Manager, Orinoco Client, AP driver and Utility Planet, firmware and operating system (NT, W2K, W98 / ME, Linux, FreeBSD + utilitynya)
* Survey Location
1 . Determine the coordinates of the location of station position, the air space of the base stations with GPS and compass on the map
2. Note and mark the point of potential barrier (obstructure) along the path
3. Calculate the SOM, the path and Acessories loss, EIRP, freznel zone, elevation antenna
4. Note the position of another station, the possibility of potential hidden station, over-shoot and test noise and interference
5. Determine the ideal position of tower, elevation, length of cable and alternatives if there is difficulty in the installation
6. Plan a number of alternative methods of installation, removal position and connector installation tools
* 1. Skinned coaxial cable with a cross section, the specification is the minimum cable RG 8 9913 with losses calculated every 10 db 30 m
2. Do not let excessive scratching occurs because the propagation of microwave is on the surface of the cable 3. Place the connector carefully and fully consider neatness problem
4. Solder pin edge connector carefully and neatly, make sure that does not happen short
5. Note the order of assembly pins and locks so that the cable and connector holder are not easily shifted
6. Cover the surface of the connector with aluminum foil to prevent leakage and interference, the position must be attached to the surface of the connector
7. Cover connectors with aluminum foil and cover the entire surface of the plug connection with insulating TBA (used for installation of plumbing or electrical wire installation home)
8. Finally, cover the entire surface of the insulating rubber to prevent water
9. For treatment, replace all the protective layer once every 6 months
10. The best connector is a model without solderan hex and drat so slightly injuring the surface of the cable, installed by using Crimping tools, burning rubber with a protective rubber insulation replacement
* Making POE
1. Power over Ethernet is required for injection into the device power supply Wireless In A Box is mounted on the tower, POE useful reducing power losses (losses) due to the use of cables and connectors
2. POE uses 2 pair UTP cable unused, 1 pair for injection + (positive) power and 1 pair for injection - (negative) power, used pair cable (pair) to avoid a decrease in power loss due to cable
3. Note that the most crucial problems in the manufacture of POE is how to prevent the occurrence of short, because the power cord and plug a small and easy penampangnya shifted or attracted, or tetesi with insulating gel candles so that each connection point are protected from short
4. Before the first test used all the connections with the multimeter
* Installing Antenna
1. Install the pipe with a minimum stack method to altitudes 1st freznel zone obstructure passed to the nearest 2. Note the stability of the holder strenght pipe and wire, plug holder for climbing legs and tail Anker Cows
3. Check all cable connections and connectors, including a lightning rod if there is
4. Connect the antenna with a neat and correct, point by using a compass and GPS base stations according to the locus of the map
5. Connect the cable and trim while, not to heavy a burden on the cable connector connection and interfere with movement of the antenna pointing and the position
6. Consider installing a cable in a tower / pipeline, no bent position as potential accumulation of rain water, so the form of rain water falling down free
* Radio Equipment Installation
1. Install the PC Card and Orinoco correctly until recognized by the OS without conflict and make sure all drivers and utilities can work perfectly
2. Installing on W2K OS requires the latest drivers from the web site and in CD copy utility, not needed though PNP PCMCIA driver W2K do this it creates a conflict detection, dirver remove this from the Device Manager
3. Installation requires precision in the allocation of NT IO address, IRQ and DMA, the BIOS better turn off all devices (COM, LPT, etc..) And peripherals (sound card, mpeg, etc..) Is not required
4. All of these procedures can be completed in less than 30 minutes not including the installation of the OS, more than this time run immediately following the procedure
5. When trouble occurs continuously installation, for the sake of efficiency while doing the installation under OS Win98 / ME is much easier and less trouble
6. In the installation of radio devices Wireless In A Box (Mtech, Planet, Micronet dlll.), First update the firmware and the utility
7. Then test all the existing functions (AP, International Building, SAI Client, SAA2, SAA etc. ad hoc.) Including bridging and IP Addressing with helical antenna, make sure all functions work well and stable
8. Make sure that the device Power Over Ethernet (POE) runs perfectly
* Tests for Noise
1. When all has been running normally, install all the necessary utilities and start doing some testing noise / interference, use the default settings
2. Without notice if there is an antenna strenght a captured signal from another station nearby, if any, and achieve good (about 40% - 60%) or even more, it certainly exceeds the station was operating EIRP and potentially cause interference to the station we are awake, consider to negotiate with the operators of BTS /
3 the existing station. Notice how the noise level, when reached more than the radio sensitivity level (which is usually around - 83 dbm, read the radio specifications), for example - 100 dbm then at the station point interferensinya high enough, stay strenght whether the received signal can exceed the noise
4. Strenght signal standard calculation is 0% - 40% poor, 40% - 60% good, 60% - 100% excellent, if the signal is strenght received but 60% will reach 20% noisenya condition is poor then the connection (60% - 20 % - 40% poor), it is possible to strenght signal reaches 80%
5. Poor connection will usually result in PER (packet error rate - can be seen from the percentage of RTO in a continuous ping) above 3% - 7% (seen from the utility or Wave Rider Planet), good range from 1% - 3% and 1% excellent under , PER between the BTS and the client station must be balanced
6. The same calculations can be used to pay attention to the BTS station or our opponents, in principle strenght signal, noise levels, PER must be balanced to obtain the expected stability of the connection
7. Consider other alternatives if a number of scenarios above are not the problem can be overcome, for example by moving to another station, rotate the direction pointing to other nearby base stations or by the method of point 3 (repeaters), etc..
* Assembly Antena
1. Microwave antenna grid parabolic type and the loop and need to be assembled for yagi consists of several components, different types of patch panels, panel and omni directional sector
2. Raft the antenna according to the instructions (manual) and construction drawings are included
3. Tighten all nuts and bolts, including connectors and especially the reflector
4. Note that the microwave antenna is very sensitive to changes in focus, then the antenna assembly at the best possible attention focused on horn reflector (driven antenna), a shift in focus will result in broad changes such as gains (db) antenna
5. Several types of grid parabolic antenna has a rod extender that can change the location of the horn reflector focus can be set so that the required gain
* Pointing Antena
1. In general, antennas are fitted with horizontal polarization
2. Point the antenna in the direction shown compass and GPS, this way we consider the midpoint of the (center beam)
3. Slide the antenna with a fixed direction to the right or to left center beam, one by one at each stage of the calculation does not exceed ½ beam width antenna specifications for each side (left or right), for example 24 db antennas, typically has a beam width 12 degrees then , the maximum shift to the left or right of center beam is 6 degrees
4. Give a sign at each change of direction and set the score, the best determination is done by looking for the best average score, the main parameters that must be considered is strenght signal, noise and stability
5. Since most radio devices Wireless In A Box does not have a graphical utility to represent strenght signal, noise, etc. (except statistics and PER) will be more practical to use the pointing device is standard 802.11b radio that has a graphical utility such as the Orinoco, or use the Wave Rider
6. Next if necessary adjust the antenna elevation in meters according klino corner station antenna on the opposite, calculate the curvature of the earth based on calculations and compare with topographic contours on the map
7. When the direction and elevation are estimated to have best achieved it can be done if necessary the antenna polarization reversal from vertical to horizontal to the narrow beam width and increase the focus of transmission, the second condition points to use the same antenna (parabolic grid) and the second point must be the same antenna polarization ( means at the opposite side of the antenna polarization must also be reversed into vertical)
* Testing Connection Radio
1. Perform the test signal, similar to the noise test, only the current antenna and cables (including POE) is connected to the radio device
2. Adjust the channel and SSID name (Network Name) to the identity of the BTS / AP objectives, as well as encryption, authentication is used when the MAC Address of AP must be defined first such station MAC Address
3. When using Radius authentication, be sure to have appropriate settings and try first before you installed the mechanism
4. Note that most of the radio device is functioning as a bridge and work on the introduction of the MAC address, so the IP Address which is defined as an interface utility function based on SNMP protocol only, so do not need to be incorporated into the routing table
5. Routing tables are defined in (PC) router which installed a radio device, for Wireless In A Box is separate from the device (PC) router, then the device facing the radio device 1 also enter a single IP address subnet with IP addresses defined in radio devices, so that utilities can be installed in the router to recognize the radio 6. Do continuos ping to test the stability of the connection and knowing PER
7. If you have a stable and minimum strenght good signal (after the calculated noise) then do the test throughput by performing an FTP connection (with a FTP client software) to the FTP server near you (ideally at the server point of destination BTS), the average throughput under ideal conditions will be better balanced when downloading and up load, the maximum throughput on the radio connection is about 1 mbps and 600 kbps per TCP connection with MTU 1500 can achieve a maximum 40 kbps
8. Next use mass download manager software that supports TCP connection simultaneously (concurrent), make a connection to an FTP server near you in the hope of 5 kbps maximum throughput per TCP connection, it can be activated approximately 120 simultaneous sessions (concurrent), assumption 5 x 120 = 600
9 . Or a simpler way, use a smaller scale, with 12 concurrent connection trouhput per session 5 kbps, what the total throughput can reach 60 kbps (average)? if achieved then the stability of the connection should be guaranteed to be at a maximum level of
10. At each level of loading is gradual, consider whether the PRC ping increases, the number approached approximately 100 ms was considered normal
Read more "prosedure Instalation Wireless LAN..."
RouterBOARD for Access Point
RouterBOARD for Access Point:
RB/5AP MikroTik outdoor access point
RB/5AP2 MikroTik outdoor access point with two wireless cards
RB/5HS MikroTik Hotspot Access Point
RB/5LC3 RouterBOARD 532 Kit /w PoE
RB/5LC2 RouterBOARD 532 Kit
RB/5EX Multiport RouterBOARD kit
RB/5LD3 RouterBOARD 532 outdoor kit
Read more "RouterBOARD for Access Point..."
Unnumbered Interfaces
Unnumbered Interfaces
Description
Unnumbered interfaces can be used on serial point-to-point links, e.g., MOXA or Cyclades interfaces. A private address should be put on the interface with the network being the same as the address on the router on the other side of the p2p link (there may be no IP on that interface, but there is an ip for that router).
Example
[admin@MikroTik] ip address> add address=10.0.0.214/32 network=192.168.0.1 \
\... interface=pppsync
[admin@MikroTik] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 10.0.0.214/32 192.168.0.1 192.168.0.1 pppsync
[admin@MikroTik] ip address>
[admin@MikroTik] ip address> .. route print detail
Flags: X - disabled, I - invalid, D - dynamic, J - rejected,
C - connect, S - static, R - rip, O - ospf, B - bgp
0 S dst-address=0.0.0.0/0 preferred-source=0.0.0.0 gateway=192.168.0.1
gateway-state=reachable distance=1 interface=pppsync
1 DC dst-address=192.168.0.1/32 preferred-source=10.0.0.214
gateway=0.0.0.0 gateway-state=reachable distance=0 interface=pppsync
[admin@MikroTik] ip address>
As you can see, a dynamic connected route has been automatically added to the routes list. If you want the default gateway be the other router of the p2p link, just add a static route for it. It is shown as 0 in the example above.
Troubleshooting
Description
• Router shows that the IP address is invalid
Check whether the interface exists to which the IP address is assigned. Or maybe it is disabled. It is also possible that the system has crashed - reboot the router.
• Router shows that the ARP entry is invalid
Check whether the interface exists to which the ARP entry is assigned. Or maybe it is disabled. Check also for an IP address for the particular interface.
Read more "Unnumbered Interfaces..."
Description
Unnumbered interfaces can be used on serial point-to-point links, e.g., MOXA or Cyclades interfaces. A private address should be put on the interface with the network being the same as the address on the router on the other side of the p2p link (there may be no IP on that interface, but there is an ip for that router).
Example
[admin@MikroTik] ip address> add address=10.0.0.214/32 network=192.168.0.1 \
\... interface=pppsync
[admin@MikroTik] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 10.0.0.214/32 192.168.0.1 192.168.0.1 pppsync
[admin@MikroTik] ip address>
[admin@MikroTik] ip address> .. route print detail
Flags: X - disabled, I - invalid, D - dynamic, J - rejected,
C - connect, S - static, R - rip, O - ospf, B - bgp
0 S dst-address=0.0.0.0/0 preferred-source=0.0.0.0 gateway=192.168.0.1
gateway-state=reachable distance=1 interface=pppsync
1 DC dst-address=192.168.0.1/32 preferred-source=10.0.0.214
gateway=0.0.0.0 gateway-state=reachable distance=0 interface=pppsync
[admin@MikroTik] ip address>
As you can see, a dynamic connected route has been automatically added to the routes list. If you want the default gateway be the other router of the p2p link, just add a static route for it. It is shown as 0 in the example above.
Troubleshooting
Description
• Router shows that the IP address is invalid
Check whether the interface exists to which the IP address is assigned. Or maybe it is disabled. It is also possible that the system has crashed - reboot the router.
• Router shows that the ARP entry is invalid
Check whether the interface exists to which the ARP entry is assigned. Or maybe it is disabled. Check also for an IP address for the particular interface.
Read more "Unnumbered Interfaces..."
IP Addressing
IP Addressing
Description
IP addresses serve for a general host identification purposes in IP networks. Typical (IPv4) address consists of four octets. For proper addressing the router also needs the network mask value, id est which bits of the complete IP address refer to the address of the host, and which - to the address of the network. The network address value is calculated by binary AND operation from network mask and IP address values. It's also possible to specify IP address followed by slash "/" and amount of bits assigned to a network mask.In most cases, it is enough to specify the address, the netmask, and the interface arguments. The network prefix and the broadcast address are calculated automatically.
It is possible to add multiple IP addresses to an interface or to leave the interface without any addresses assigned to it. Leaving a physical interface without an IP address is not a must when the bridging between interfaces is used. In case of bridging, the IP address can be assigned to any interface in the bridge, but actually the address will belong to the bridge
interface. You can use /ip address print detail to see to which interface the address belongs to.
MikroTik RouterOS has following types of addresses:
- Static - manually assigned to the interface by a user
- Dynamic - automatically assigned to the interface by estabilished ppp, ppptp, or pppoe connections
Property Description
actual-interface (read-only: name) - only applicable to logical interfaces like bridges or tunnels. Holds the name of the actual hardware interface the logical one is bound to.
address (IP address) - IP address
broadcast (IP address; default: 255.255.255.255) - broadcasting IP address, calculated by default from an IP address and a network mask
disabled (yes | no; default: no) - specifies whether the address is disabled or not
interface (name) - interface name the IP address is assigned to
netmask (IP address; default: 0.0.0.0) - specifies network address part of an IP address
network (IP address; default: 0.0.0.0) - IP address for the network. For point-to-point links it should be the address of the remote end
Notes
You cannot have two different IP addresses from the same network assigned to the router. Exempli gratia, the combination of IP address 10.0.0.1/24 on the ether1 interface and IP address 10.0.0.132/24 on the ether2 interface is invalid, because both addresses belong to the same network 10.0.0.0/24. Use addresses from different networks on different interfaces, or enable proxy-arp on ether1 or ether2.Example
[admin@MikroTik] ip address> add address=10.10.10.1/24 interface=ether2[admin@MikroTik] ip address> printFlags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 2.2.2.1/24 2.2.2.0 2.2.2.255 ether2 1 10.5.7.244/24 10.5.7.0 10.5.7.255 ether1 2 10.10.10.1/24 10.10.10.0 10.10.10.255 ether2 [admin@MikroTik] ip address>Read more "IP Addressing..."
Subscribe to:
Posts (Atom)
