Domain 4 capstone: build and secure a small branch from the wall jack to the internet

Steps

1. Place the devices and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Give PC1, SRV1 and SRV2 their static addresses and gateways in Desktop > IP Configuration; set PC1's and SRV1's DNS Server to 192.168.10.53. Leave PC2 on static for now.
2. Configure ISP1. It has no route to the branch's private LAN, only to its own two networks:

Router> enable
Router# configure terminal
Router(config)# hostname ISP1
ISP1(config)# interface GigabitEthernet0/0/0
ISP1(config-if)# ip address 203.0.113.1 255.255.255.252
ISP1(config-if)# no shutdown
ISP1(config-if)# interface GigabitEthernet0/0/1
ISP1(config-if)# ip address 198.51.100.1 255.255.255.0
ISP1(config-if)# no shutdown
ISP1(config-if)# end

3. Configure R1's interfaces, its default route, and the DHCP pool for the staff, which hands out SRV1 as the DNS server. Addresses up to .99 are kept for static devices:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/1
R1(config-if)# ip address 203.0.113.2 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.99
R1(config)# ip dhcp pool STAFF
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.168.10.53
R1(dhcp-config)# end

4. On S1, put the access ports and the uplink in VLAN 10, then protect the VLAN with DHCP snooping. Trust only the uplink towards R1, and stop the switch inserting option 82, which R1's own DHCP server on this VLAN would otherwise reject:

Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# vlan 10
S1(config-vlan)# name STAFF
S1(config-vlan)# exit
S1(config)# interface range FastEthernet0/1 - 3
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 10
S1(config-if-range)# ip dhcp snooping limit rate 10
S1(config-if-range)# exit
S1(config)# interface GigabitEthernet0/1
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 10
S1(config-if)# ip dhcp snooping trust
S1(config-if)# exit
S1(config)# ip dhcp snooping
S1(config)# ip dhcp snooping vlan 10
S1(config)# no ip dhcp snooping information option

5. Lock the two desk ports with sticky port security, one MAC address each, and save so the learned addresses survive a reload later:

S1(config)# interface range FastEthernet0/1 - 2
S1(config-if-range)# switchport port-security
S1(config-if-range)# switchport port-security maximum 1
S1(config-if-range)# switchport port-security mac-address sticky
S1(config-if-range)# end

Now set PC2 to DHCP. It should get 192.168.10.100, gateway 192.168.10.1 and DNS server 192.168.10.53. Ping 192.168.10.1 from PC1 and PC2 so both ports learn their sticky address, then run S1# copy running-config startup-config. 6. Build SRV1's two services. In Services > DNS, set it On and add an A Record with Name www.example.com and Address 198.51.100.80. In Services > AAA, set it On; under Network Configuration add Client Name R1, Client IP 192.168.10.1, Secret lab-only-tackey, ServerType Tacacs; under User Setup add Username aaaadmin with Password lab-only-aaa. 7. Plant the first fault while configuring PAT on R1: the ACL names 192.168.1.0 instead of 192.168.10.0, a one-digit slip:

R1# configure terminal
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0/1 overload
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip nat inside
R1(config-if)# interface GigabitEthernet0/0/1
R1(config-if)# ip nat outside
R1(config-if)# end

On PC2, browse to http://www.example.com. The name resolves, because SRV1 is on the LAN, but the page never loads. 8. Find it. C:\> nslookup www.example.com on PC2 returns 198.51.100.80, so DNS is fine. On R1, R1# show ip nat translations is empty, R1# show ip nat statistics shows both interfaces marked correctly, and R1# show access-lists 1 shows the one entry, for 192.168.1.0, with no matches: no packet from the LAN ever matched it. Replace the list:

R1# configure terminal
R1(config)# no access-list 1
R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# end

Browse from PC2 again: SRV2's page loads, through PAT on 203.0.113.2. 9. Give R1 its own name resolution, then the SSH prerequisites from lesson 18 and two lab-only secrets. Packet Tracer accepts the older spelling ip domain-name:

R1# configure terminal
R1(config)# ip name-server 192.168.10.53
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa general-keys modulus 1024
R1(config)# ip ssh version 2
R1(config)# username netops privilege 15 secret lab-only-ops
R1(config)# enable secret lab-only-enable

10. Switch on AAA with the local account already in place: TACACS+ first with local as the fallback for SSH, local only for the console. Then let only PC1 reach the VTY lines with a standard ACL applied by access-class:

R1(config)# tacacs-server host 192.168.10.53
R1(config)# tacacs-server key lab-only-tackey
R1(config)# aaa new-model
R1(config)# aaa authentication login default group tacacs+ local
R1(config)# aaa authentication login CON local
R1(config)# access-list 10 permit host 192.168.10.10
R1(config)# line vty 0 4
R1(config-line)# login authentication default
R1(config-line)# transport input ssh
R1(config-line)# access-class 10 in
R1(config-line)# exit
R1(config)# line console 0
R1(config-line)# login authentication CON
R1(config-line)# end

11. Test management access. From PC1, C:\> ssh -l aaaadmin 192.168.10.1 with lab-only-aaa logs in through TACACS+ and lands at R1>. From PC2, the same command fails before any password prompt, because access-class 10 admits only 192.168.10.10. On R1's console, the CON list asks for a local account: log in as netops.
12. Plant the second fault: on SRV1, set the AAA service Off. From PC1, aaaadmin can no longer log in, because the server is silent and R1 has no local aaaadmin. Log in from PC1 as netops with lab-only-ops instead: after a pause, you land at R1#, because a server that does not answer is an error, and R1 moved on to local. Set SRV1's AAA service back On, and confirm aaaadmin logs in again.
13. Save R1's work, and then confirm the name works from R1 itself:

R1# copy running-config startup-config
R1# ping www.example.com

The Translating message names 192.168.10.53, and the pings go to 198.51.100.80. R1's own packets leave from 203.0.113.2, so they need no translation.