7.5.2 Lab
7.5.2 Lab
7.5.2 Lab
Addressing Table
Default Gateway Device Interface Fa0/1.1 Fa0/1.10 R1 Fa0/1.20 Fa0/1.88 Lo0 WRS2 WAN LAN/Wireless WAN LAN/Wireless IP Address 172.17.1.1 172.17.10.1 172.17.20.1 172.17.88.1 10.1.1.1 172.17.88.25 172.17.40.1 172.17.88.35 172.17.30.1 Subnet Mask 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.252 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 N/A N/A N/A N/A N/A 172.17.88.1 N/A 172.17.88.1 N/A
WRS3
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 1 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
PC1 PC2
NIC NIC
172.17.10.21 172.17.20.22
255.255.255.0 255.255.255.0
172.17.10.1 172.17.20.1
Learning Objectives
Upon completion of this lab, you will be able to: Configure switch port VLAN information and port security. Hard reset a Linksys WRT300N router. Connect and verify connectivity to a wireless router. Navigate to a Linksys WRT300Ns web utility page. Configure the IP settings of a Linksys WRT300N. Configure DHCP on a Linksys WRT300N. Configure static routes on both standard Cisco routers and on a WRT300N. Change the network mode and corresponding network channel on a WRT300N. Enable WEP encryption and disable SSID broadcast. Enable a wireless MAC filter. Configure access restrictions on a WRT300N. Configure router management password on a WRT300N. Enable logging on a WRT300N. Upgrade WRT300N firmware. Learn diagnosis, backup, restore, and confirmation mechanisms on a WRT300N.
Scenario
In this lab, you will configure a Linksys WRT300N, port security on a Cisco switch, and static routes on multiple devices. Make note of the procedures involved in connecting clients to a wireless network. Some configuration changes will cause clients to disconnect. These clients then have to reconnect after making changes to the configuration.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 2 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Vlans allowed on trunk 1-4094 1-4094 1-4094 1-4094 1-4094 Vlans allowed and active in management domain 1,10,20,88 1,10,20,88 1,10,20,88 1,10,20,88 1,10,20,88 Vlans in spanning tree forwarding state and not pruned Vlans in spanning tree forwarding state and not pruned 1,10,20,88 none -- blocked due to STP varies based on root 1,10,20,88 1,10,20,88 1,10,20,88>
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 3 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
S2#show vlan VLAN Name Status Ports ---- -------------------------------- --------- ----------------------------1 default active Fa0/5, Fa0/6, Fa0/8, Fa0/9 Fa0/10, Fa0/12, Fa0/13,Fa0/14 Fa0/15, Fa0/16, Fa0/17,Fa0/19 Fa0/20, Fa0/21, Fa0/22,Fa0/23 Fa0/24, Gi0/1, Gi0/2 10 VLAN0010 active Fa0/11 20 VLAN0020 active Fa0/18 88 VLAN0088 active Fa0/7 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup When you have finished, be sure to save the running configuration to the NVRAM of the router and switches. Step 3: Configure the Ethernet interfaces of PC1 and PC2. Configure the Ethernet interfaces of PC1 and PC2 with the IP addresses and default gateways according to the addressing table at the beginning of the lab. Step 4: Test the PC configuration. Ping the default gateway from the PC: 172.17.10.1 for PC1, and 172.17.20.1 from PC2. Go to Start->Run->cmd and type ping 172.17.x.x
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 4 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Locate the Wireless Network Connection icon in your taskbar, or go to Start > Control Panel > Network Connections. Right-click the icon and select View Available Wireless Networks. You are prompted with the following display. Note that the factory default SSID of the router is simply Linksys.
Step 2: Verify connectivity settings. Verify the connectivity settings by going to Start > Run and typing cmd. At the command prompt, type the command ipconfig to view your network device information. Notice which IP address is the default gateway. This is the default IP address of a Linksys WRT300N.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 5 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 2: Enter authentication information. You are prompted for a username and password. Enter the WRT300N factory default password of admin and leave the username field blank.
You should now be viewing the default page of the Linksys WRT300N web utility.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 6 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 2: Set the IP address settings for Internet Setup. Set the Internet IP Address to 172.17.88.35. Set the Subnet Mask to 255.255.255.0. Set the Default Gateway to 172.17.88.1 (the FastEthernet 0/1 VLAN 88 IP address of R1).
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 7 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 4: Save the settings. Click Save Settings. You are prompted to click Continue. Since you are connected wirelessly, you will not be redirected to the new URL of the web utility (http://172.17.30.1). In order for the new IP address changes to take place, the PC has to release its old IP address and dynamically acquire a new one from the 172.17.30.0/24 network. Step 5: Release the old Network Setup IP Address In command prompt, use the command ipconfig /release to release the current DHCP address. To get a new IP address in the new network, issue the command ipconfig /renew. A new IP address should be pulled from the 172.17.30.0/24 network. Step 6: View the PC IP configuration settings. Go to command prompt and use the command ipconfig. If the address has not been updated to the 172.17.30.0/24 network, it will be necessary to release and renew the IP address on the client.
Step 7: Go to the new URL and enter authentication information. In your favorite web browser, navigate to http://172.17.30.1 which is the new URL for the WRT300N. Enter the default username and password when you are prompted to do so.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 8 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
This gives PC6, the computer with a MAC address of 00:05:4E:49:64:F8, the same IP address, 172.17.30.100, whenever it requests an address through DHCP. This is only an example of a quick way to permanently bind a client to its current DHCP-given IP address. Now, you will assign PC6 the IP address in the topology diagram, not the one it received initially. Click Remove to assign a new address.
Step 2: Assign PC6 the 172.17.30.26 address. By entering the PC6 address under Manually Adding Client, whenever PC6 connects to the wireless router, it receives the IP address 172.17.30.26 via DHCP. Save your changes.
Step 3: Verify the static IP address change. Since we already have an IP address from DHCP we are not going to get the new address, 172.17.30.26, until we reconnect. We will wait and notice that later in Task 7, Step 6 and verify that this change has taken place. Step 4: Configure the DHCP server. Set the start address to 50, the maximum number of users to 25, and the lease time to 2 hours (or 120 minutes).
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 9 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
These settings give any PC that connects to this router wirelessly requesting an IP address through DHCP, an address between 172.17.30.5074. Only 25 clients at a time are able to get an IP address and can only have the IP address for two hours, after which time they must request a new one. Note: IP Address Range does not update until you click Save Settings. Step 5: Configure the router for the appropriate time zone. At the bottom of the Basic Setup page, change the time zone of the router to reflect your location.
Step 6: Save your settings! Click Save Settings. You are prompted to click Continue.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 10 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 3: Save Settings. Select the Save Settings link to save all changes. Click Continue to continue to the next task. Step 4: Verify that the SSID of the router is no longer being broadcast. Scan for wireless networks. Locate the Wireless Network Connection icon in your taskbar, or go to Start > Control Panel > Network Connections. Right-click the icon and select View Available Wireless Networks. Does the SSID of the wireless router appear? __________________________________________________________________________________ Step 5: Reconnect to the wireless network. Navigate to Start > Control Panel > Network Connections, right-click the Wireless Network Connection icon, and select Properties.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 11 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
In the Association tab, enter WRS3_[number] as the SSID, and set the Data Encryption to Disabled. Select OK, and then select OK again. Windows should now try to reconnect to the wireless router.
Step 6: Verify the settings. Now that you have reconnected to the network, you have the new DHCP settings that you configured in Task 6, Step 2. Verify this at the command prompt of PC6 with the ipconfig command.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 12 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 4: Enter a WEP key. A network is only as secure as its weakest point, and a wireless router is a very convenient place to start if someone wants to damage your network. By not broadcasting the SSID and requiring a WEP key to connect to the router, you are adding a few levels of security. Unfortunately, there are tools that can discover networks that are not even broadcasting their SSID, and there are even tools that can crack WEP key encryption. Add the WEP key 1234567890 as Key 1.
Step 5: Save your settings. Now that WRS3 has been configured with WEP security, and PC6 is not configured with WEP, you will be disconnected from the network.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 13 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 6: Configure Windows to use WEP authentication. Navigate to the Network Connections page again and right-click the Wireless Network Connection icon. In the Wireless Networks tab, locate the WRS3 network, and click Properties. Set Data Encryption to WEP. Uncheck This Key Is Provided For Me. Enter the network key of 1234567890, as configured before on the router. Click OK and OK.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 14 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
This prevents any client with the MAC address 00:05:4E:49:64:87 from accessing the wireless network.
Step 2: Click Wireless Client List. The Wireless Client List shows anyone currently connected to the router via a wireless connection. Also take note of the option Save to MAC filter list. Checking this option automatically adds the MAC address of that client to the list of MAC addresses to prevent or permit access to the wireless network. What is an extremely robust way of only allowing clients of your choosing to connect to the wireless network? __________________________________________________________________________________ __________________________________________________________________________________ __________________________________________________________________________________ Why is this not feasible in large networks? __________________________________________________________________________________ __________________________________________________________________________________ __________________________________________________________________________________ What is a convenient way of adding MAC addresses if everyone to whom you wanted to allow access was already connected to the wireless network? __________________________________________________________________________________ __________________________________________________________________________________ __________________________________________________________________________________
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 15 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Schedule Uncheck Everyday and recheck Monday through Friday Blocked Applications Add Telnet to Blocked List
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 16 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 2: Set the IP address range. Apply this configuration to anyone that is using a default DHCP address in the range of 172.17.30.50 74. Click the Edit List button at the top of the window and enter the IP address range. Save the settings.
Click the Save Settings button to save the access restriction settings. Click Close to close the window and continue with the next task.
Task 11: Managing and Securing the Web Utility of the Router
Step 1: Configure web access. Navigate to the Administration section. Change the router password to cisco. For Web Utility Access, select both HTTP and HTTPS. Selecting HTTPS access allows a network administrator to manage the router via https://172.17.30.1 with SSL, a more secure form of HTTP. If you choose to do this in the lab, you may have to accept certificates.
For Web Utility Access via Wireless, select Enabled. If you disabled this option, the Web Utility would not be available to clients connected wirelessly. Disabling access is another form of security, because it requires the user to be directly connected to the router before changing settings. However, in this lab scenario, you are configuring the router via wireless access, so disabling access would not be a good idea! Click the Save Settings option at the bottom of the page. You may be prompted for the configured password. Enter cisco for the password and reconnect. Now back up your configuration by clicking the Backup Configurations button. When prompted, save the file to your desktop.
Step 2: Restore your configuration. If your settings are accidentally or intentionally changed or erased, you can restore them from a working configuration using the Restore Configurations option located in the Backup and Restore section. Click the Restore Configuration button now. In the Restore Configurations window, browse to the previously saved configuration file. Click the Start to Restore button. Your previous settings should be successfully restored.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 17 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Step 3: Enable logging. Navigate to the Log tab of the Administration section and enable logging. You are now able to view the log of the router.
Step 2: Disable NAT. In the Setup page, click the Advanced Routing tab. Disable NAT. Dont forget to Save your settings.
Step 3: Connect to WRS2. Now that WRS3 has been configured, it no longer broadcasts the default SSID of linksys. Power up the WRS2 wireless router and perform similar configurations. Review previous steps to connect PC3 to WRS2 via a wireless connection. Set the IP address settings for Internet Setup.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 18 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Set the Internet IP address to 172.17.88.25. Set the Subnet Mask to 255.255.255.0.
Set the Default Gateway to the FastEthernet 0/1 VLAN 88 IP address of R1, 172.17.88.1. Configure the Network Setup IP address to 172.17.40.1. Statically bind the MAC address of PC3 to the DHCP address 172.17.40.23. Change the wireless SSID to WRS2_[number]. Step 4: Configure R1 with static routes to the 172.17.30.0 and 172.17.40.0 networks. R1(config)#ip route 172.17.30.0 255.255.255.0 172.17.88.35 R1(config)#ip route 172.17.40.0 255.255.255.0 172.17.88.25 Step 5: Repeat steps 1 and 2 above for WRS2. Disable the Filter anonymous Internet requests. Disable NAT. Step 6: Verify connectivity. Verify that R1 has routes to PC3 and PC6 and that it can successfully ping them. R1#sh ip route <output deleted> Gateway of last resort is not set 172.17.0.0/24 is subnetted, 5 subnets 172.17.40.0 [1/0] via 172.17.88.25 172.17.30.0 [1/0] via 172.17.88.35 172.17.20.0 is directly connected, FastEthernet0/1.20 172.17.10.0 is directly connected, FastEthernet0/1.10 172.17.88.0 is directly connected, FastEthernet0/1.88 10.0.0.0/30 is subnetted, 1 subnets 10.1.1.0 is directly connected, Loopback0
S S C C C C
R1#ping 172.17.30.26 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.17.30.26, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
R1#ping 172.17.40.23 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.17.40.23, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms Verify that PC3 and PC6 can ping the loopback of R1.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 19 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
Verify that PC3 and PC6 can ping each other. Verify that PC3 and PC6 can ping PC1 and PC2.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 20 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
If WRS2 knew that it could get to the 172.17.30.0 network from 172.17.88.35 it would just directly send it to that IP address. So lets tell it! Step 2: Configure a new route. On WRS2, on the Setup page, click the Advanced Routing tab. For Static Routing, enter the following settings: In the Route Name field, enter To WRS3 Clients. For Destination LAN IP, enter the network behind WRS3: 172.17.30.0. Enter a subnet mask of 255.255.255.0. Enter a gateway of 172.17.88.35. Set the interface to Internet (WAN). Save your settings.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 21 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
In the Diagnostics tab in the Administration section, re-enter the IP address of PC3 in the Traceroute Test field. Click Start to Traceroute to see the route.
Notice WRS2 goes straight to WRS3 and saves us the extra hop to R1! Do the same thing on WRS3 for the 172.17.40.0/24 network, pointing towards WRS2s WAN interface, 172.17.88.25.
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 22 of 23
CCNA Exploration LAN Switching and Wireless: Basic Wireless Concepts and Configuration
S2#show port-security interface FastEthernet 0/11 Port Security : Enabled Port Status : Secure-up Violation Mode : Shutdown Aging Time : 0 mins Aging Type : Absolute SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1 Total MAC Addresses : 1 Configured MAC Addresses : 0 Sticky MAC Addresses : 1 Last Source Address:Vlan : 0006.5b1e.33fa:10 Security Violation Count : 0
All contents are Copyright 19922007 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 23 of 23