Task 1:
For reference information on configuring hostnames, please refer to:
Lab 21 Configuration and Verification Task 1
Lab 35 Configuration and Verification Task 1
Task 2:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int s0/0
R1(config-if)#no shutdown
R1(config-if)#clock rate 768000
R1(config-if)#ip add 172.16.1.1 255.255.255.192
R1(config-if)#end
R1#
R3#config term
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/0
R3(config-if)#ip address 172.16.1.2 255.255.255.192
R3(config-if)#no shut
R3(config-if)#end
R3#
R1#ping 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1#
R3#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3#
Task 3:
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip route 0.0.0.0 0.0.0.0 serial0/0 172.16.1.2
R1(config-if)#end
R1#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#ip route 0.0.0.0 0.0.0.0 serial0/0 172.16.1.1
R3(config)#int loo 10
R3(config-if)#ip address 10.10.10.3 255.255.255.128
R3(config-if)#exit
R3(config)#int loo 20
R3(config-if)#ip address 10.20.20.3 255.255.255.240
R3(config-if)#exit
R3(config)#int loo 30
R3(config-if)#ip address 10.30.30.3 255.255.255.248
R3(config-if)#end
R3#
Task 4:
R3#ping 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
R3#ping 172.16.1.1 source loopback10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
R3#ping 172.16.1.2 source loopback20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3#ping 172.16.1.2 source loopback30
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.30.30.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
Task 5:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#enable secret CISCO
R1(config)#line vty 0 4
R1(config-line)#password CISCO
R1(config-line)#login
R1(config-line)#end
R1#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#enable secret CISCO
R3(config)#line vty 0 4
R3(config-line)#password CISCO
R3(config-line)#login
R3(config-line)#end
R3#
Task 6:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#access-list 150 remark ‘Allow Telnet For R3 Loopback10’
R1(config)#access-list 150 permit tcp 10.10.10.0 0.0.0.127 any eq telnet
R1(config)#access-list 150 remark ‘Deny Telnet For R3 Loopback20’
R1(config)#access-list 150 deny tcp 10.20.20.0 0.0.0.15 any eq telnet
R1(config)#access-list 150 remark ‘Allow Telnet For R3 Loopback30’
R1(config)#access-list 150 permit tcp 10.30.30.0 0.0.0.7 any eq telnet
R1(config)#access-list 150 remark ‘Allow PING For R3 Loopback20’
R1(config)#access-list 150 permit icmp 10.20.20.0 0.0.0.15 any echo
R1(config)#int s0/0
R1(config-if)#ip access-group 150 in
R1(config-if)#end
R1#
| NOTE: Extended ACLs have the capability to match on Layer 4 protocol information. This means that you must know your well-known TCP and UDP port numbers. Fortunately, instead of having TCP and UDP port numbers, Cisco IOS ACLs allow you to use keywords for common protocols. For example, you can use the keyword telnet instead of having to use port number 23 to configure an ACL to match on Telnet traffic. However, if you do decide to use a port number, Cisco IOS automatically converts it to the common name as illustrated below:
R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#access-list 100 permit tcp any any eq 23 R1(config)#access-list 100 permit tcp any any eq 80 R1(config)#access-list 100 permit tcp any any eq 179 R1(config)#access-list 100 permit udp any any eq 520 R1(config)#access-lis 100 permit 88 any any R1(config)#access-lis 100 permit 89 any any R1(config)#end R1# R1#show ip access-lists 100 Extended IP access list 100 10 permit tcp any any eq telnet 20 permit tcp any any eq www 30 permit tcp any any eq bgp 40 permit udp any any eq rip 50 permit eigrp any any 60 permit ospf any any
As can be seen, while we configured the ACL using port numbers, IOS converted it to common names. |
R3#telnet 172.16.1.1 /source-interface loopback10
Trying 172.16.1.1 … Open
User Access Verification
Password:
R1#
R3#telnet 172.16.1.1 /source-interface loopback20
Trying 172.16.1.1 …
% Destination unreachable; gateway or host down
R3#telnet 172.16.1.1 /source-interface loopback30
Trying 172.16.1.1 … Open
User Access Verification
Password:
R1#
R3#ping 172.16.1.1 source loopback 20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
| NOTE: When you see the message % Destination unreachable; gateway or host down when trying to Telnet to a host, it is typically because there is an ACL preventing Telnet to this device. Based on our configuration, everything works, and if we looked at the ACL configured on R1, we would see matches against it as follows:
R1#show ip access-lists 150 Extended IP access list 150 10 permit tcp 10.10.10.0 0.0.0.127 any eq telnet (66 matches) 20 deny tcp 10.20.20.0 0.0.0.15 any eq telnet (3 matches) 30 permit tcp 10.30.30.0 0.0.0.7 any eq telnet (465 matches) 40 permit icmp 10.20.20.0 0.0.0.15 any echo (15 matches) |