Professional Documents
Culture Documents
Addressing Table Device PC1 PC2 S1 Interface NIC NIC VLAN99 IP Address 172.17.99.21 172.17.99.22 172.17.99.11 Subnet Mask 255.255.255.0 255.255.255.0 255.255.255.0 Default Gateway 172.17.99.11 172.17.99.11 172.17.99.1
Learning Objectives
Clear an existing configuration on a switch. Verify the default switch configuration. Create a basic switch configuration. Manage the MAC address table. Configure port security.
Introduction
In this activity, you will examine and configure a standalone LAN switch. Although a switch performs basic functions in its default out-of-the-box condition, there are a number of parameters that a network administrator should modify to ensure a secure and optimized LAN. This activity introduces you to the basics of switch configuration.
Step 3
Switch#erase startup-config Erasing the nvram filesystem will remove all configuration files! Continue? [confirm] [OK] Erase of nvram: complete %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram Switch# Switch#show vlan
VLAN Name
Status Ports
---- -------------------------------- --------- ------------------------------1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4 Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12 Fa0/13, Fa0/14, Fa0/15, Fa0/16 Fa0/17, Fa0/18, Fa0/19, Fa0/20 Fa0/21, Fa0/22, Fa0/23, Fa0/24 Gig1/1, Gig1/2 10 VLAN10 30 VLAN30 1002 fddi-default 1003 token-ring-default 1004 fddinet-default 1005 trnet-default active active act/unsup act/unsup act/unsup act/unsup
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ -----1 enet 100001 1500 - 0 0
10 enet 100010 30 enet 100030 1002 fddi 101002 1003 tr 101003 1004 fdnet 101004 1005 trnet 101005
- - - - ieee ibm -
0 0 0 0
0 0 0 0 0 0 0 0
Ports
------- --------- ----------------- ----------------------------------------[OK] Erase of nvram: complete %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
Step 4 Switch#reload Proceed with reload? [confirm] C2960 Boot Loader (C2960-HBOOT-M) Version 12.2(25r)FX, RELEASE SOFTWARE (fc4) Cisco WS-C2960-24TT (RC32300) processor (revision C0) with 21039K bytes of memory. 2960-24TT starting... Base ethernet MAC Address: 0060.47AC.1EB8 Xmodem file system is available. Initializing Flash... flashfs[0]: 1 files, 0 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories flashfs[0]: Total bytes: 32514048 flashfs[0]: Bytes used: 4414921 flashfs[0]: Bytes available: 28099127 flashfs[0]: flashfs fsck took 1 seconds. ...done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3 Parameter Block Filesystem (pb:) installed, fsid: 4
Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1) Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Wed 12-Oct-05 22:05 by pt_team Image text-base: 0x80008098, data-base: 0x814129C4
Cisco WS-C2960-24TT (RC32300) processor (revision C0) with 21039K bytes of memory.
32768K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address Motherboard assembly number Power supply part number Motherboard serial number Power supply serial number Model revision number : 0060.47AC.1EB8 : 73-9832-06
Motherboard revision number Model number System serial number Top Assembly Part Number
: V02 : COM3K00BRA
SW Image
WS-C2960-24TT
C2960-LANBASE-M
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1) Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Wed 12-Oct-05 22:05 by pt_team
Current configuration : 1009 bytes ! version 12.2 no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption ! hostname Switch ! ! ! interface FastEthernet0/1 ! interface FastEthernet0/2 ! interface FastEthernet0/3 ! interface FastEthernet0/4 ! interface FastEthernet0/5 ! interface FastEthernet0/6 ! interface FastEthernet0/7 ! interface FastEthernet0/8
! interface FastEthernet0/9 ! interface FastEthernet0/10 ! interface FastEthernet0/11 ! interface FastEthernet0/12 ! interface FastEthernet0/13 ! interface FastEthernet0/14 ! interface FastEthernet0/15 ! interface FastEthernet0/16 ! interface FastEthernet0/17 ! interface FastEthernet0/18 ! interface FastEthernet0/19 ! interface FastEthernet0/20 ! interface FastEthernet0/21 !
interface FastEthernet0/22 ! interface FastEthernet0/23 ! interface FastEthernet0/24 ! interface GigabitEthernet1/1 ! interface GigabitEthernet1/2 ! interface Vlan1 no ip address shutdown ! ! line con 0 ! line vty 0 4 login line vty 5 15 login ! ! End
Examine the current running configuration by issuing the show running-config command. i. 24 How many Fast Ethernet interfaces does the switch have?
ii. 2 iii.
0-15
Examine the current contents of NVRAM by issuing the show startup-config command.
i.
Why does the switch give this response? Startup-config is not present
Examine the characteristics of the virtual interface VLAN1 by issuing the show interface vlan1 command.
Switch#show interface vlan1 Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0060.47ac.1eb8 (bia 0060.47ac.1eb8) MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set ARP type: ARPA, ARP Timeout 04:00:00 Last input 21:40:21, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast) 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets 0 output buffer failures, 0 output buffers swapped out
NO
2 What is the MAC address of this virtual switch interface?
i.
Switch#show ip interface vlan1 Vlan1 is administratively down, line protocol is down Internet protocol processing disabled
Switch#show version Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1) Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Wed 12-Oct-05 22:05 by pt_team
ROM: C2960 Boot Loader (C2960-HBOOT-M) Version 12.2(25r)FX, RELEASE SOFTWARE (fc4)
Cisco WS-C2960-24TT (RC32300) processor (revision C0) with 21039K bytes of memory.
32768K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address Motherboard assembly number Power supply part number Motherboard serial number Power supply serial number Model revision number Motherboard revision number Model number System serial number Top Assembly Part Number Top Assembly Revision Number Version ID CLEI Code Number : V02 : COM3K00BRA : 0060.47AC.1EB8 : 73-9832-06 : 341-0097-02 : FOC103248MJ : DCA102133JA : B0 : C0
SW Image
WS-C2960-24TT
C2960-LANBASE-M
Configuration register is 0xF 1 What is the Cisco IOS version that the switch is running?
C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1) 2 What is the system image filename? C2960-LANBASE-M 3 What is the base MAC address of this switch? 0060.47AC.1EB8
i.
ii.
iii.
iv.
What is the speed and duplex setting of the interface? 100 mb/s
VLAN Name
Status
Ports
---- -------------------------------- --------- ------------------------------1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12 Fa0/13, Fa0/14, Fa0/15, Fa0/16 Fa0/17, Fa0/18, Fa0/19, Fa0/20 Fa0/21, Fa0/22, Fa0/23, Fa0/24 Gig1/1, Gig1/2 1002 fddi-default 1003 token-ring-default 1004 fddinet-default 1005 trnet-default act/unsup act/unsup act/unsup act/unsup
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ -----1 enet 100001 1500 1500 0 0 0 0
1003 tr
101003
ieee ibm -
0 0 0
0 0 0
Ports
------- --------- ----------------- ---------------------------------------i. What is the name of VLAN 1? default ii. Which ports are in this VLAN? Fa0/1, Fa0/2, Fa0/3, Fa0/4,Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16 Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24 Gig1/1, Gig1/2 iii. Is VLAN 1 active? YES iv. What type of VLAN is the default VLAN? Primary secondary type
1 -rw-
4414921
32514048 bytes total (28099127 bytes free) i. Which files or directories are found? rwii. 4414921
Files have a file extension, such as .bin, at the end of the filename. Directories do not have a file extension. What is the name of the Cisco IOS image file? c2960-lanbase-mz.122-25.FX.bin
Switch#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#hostname kuldeepl kuldeep(config)#exit kuldeep# %SYS-5-CONFIG_I: Configured from console by console
kuldeep#
To save the contents of the running configuration file to non-volatile RAM (NVRAM), issue the copy running-config startup-config command. kuldeep#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] kuldeep#
kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. kuldeep(config)#hostname kuldeep kuldeep(config)#exit
kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. kuldeep(config)#line console 0 kuldeep(config-line)#password cisco kuldeepl(config-line)#login kuldeep(config-line)#line vty 0 15 kuldeep(config-line)#password cisco kuldeep(config-line)#login kuldeep(config-line)#exit kuldeep(config)#
kuldeep(config-if)#exit kuldeep(config)#
5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets 0 output buffer failures, 0 output buffers swapped out
What is the bandwidth on this interface? 100000 K/bit What is the queuing strategy? Fifo
Step 10. Configure the port speed and duplex settings for a Fast Ethernet interface.
Configure the duplex and speed settings on Fast Ethernet 0/18. Use the end command to return to privileged EXEC mode when finished. kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. kuldeep(config)#interface fastethernet 0/18 kuldeep(config-if)#speed 100 kuldeep(config-if)#duplex full
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/18, changed state to down kuldeep(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan99, changed state to down
kuldeep(config-if)#end
%SYS-5-CONFIG_I: Configured from console by console Notice how the link between PC1 and S1 went down. Remove the speed 100 and duplex full commands. Now verify the settings on the Fast Ethernet interface with the show interface fa0/18 command. kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. kuldeep(config)#interface fa0/18 kuldeep(config-if)#no speed 100 kuldeep(config-if)# no duplex full
kuldeep#show interface fastethernet 0/18 FastEthernet0/18 is up, line protocol is up (connected) Hardware is Lance, address is 0060.5c36.4412 (bia 0060.5c36.4412) BW 100000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set
Keepalive set (10 sec) Full-duplex, 100Mb/s input flow-control is off, output flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:08, output 00:00:05, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 956 packets input, 193351 bytes, 0 no buffer Received 956 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 2357 packets output, 263570 bytes, 0 underruns 0 output errors, 0 collisions, 10 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out
enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1 ! ! ! interface FastEthernet0/1 switchport access vlan 99 ! interface FastEthernet0/2 ! interface FastEthernet0/3 ! interface FastEthernet0/4 ! interface FastEthernet0/5 ! interface FastEthernet0/6 ! interface FastEthernet0/7 ! interface FastEthernet0/8 switchport access vlan 99 ! interface FastEthernet0/9 ! interface FastEthernet0/10 ! interface FastEthernet0/11 !
interface FastEthernet0/12 ! interface FastEthernet0/13 ! interface FastEthernet0/14 ! interface FastEthernet0/15 ! interface FastEthernet0/16 ! interface FastEthernet0/17 ! interface FastEthernet0/18 switchport access vlan 99 ! interface FastEthernet0/19 ! interface FastEthernet0/20 ! interface FastEthernet0/21 ! interface FastEthernet0/22 ! interface FastEthernet0/23 ! interface FastEthernet0/24 ! interface GigabitEthernet1/1
! interface GigabitEthernet1/2 ! interface Vlan1 no ip address shutdown ! interface Vlan99 ip address 172.17.99.11 255.255.255.0 ! ip default-gateway 172.17.99.1 ! ! line con 0 password cisco login ! line vty 0 4 password cisco login line vty 5 15 password cisco login ! ! end
Click the PC. Select the Desktop tab. Click Command Prompt. Type the ipconfig /all command.
Step 2. Determine the MAC addresses that the switch has learned.
Display the MAC addresses using the show mac-address-table command in privileged EXEC mode. If there are no MAC addresses, ping from PC1 to S1 then check again.
susheel#show mac-address-table dynamic Mac Address Table ------------------------------------------Vlan ---Mac Address ----------Type -------Ports -----
Vlan ----
Type -----
Ports
Vlan ----
Type -----
Ports
kuldeep#show mac-address-table Mac Address Table ------------------------------------------Vlan ---99 Mac Address ----------0002.16e8.c285 Type -------STATIC Ports ----Fa0/18
kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. kuldeep(config)#no mac-address-table static 0002.16E8.c285 vlan 99 interface fastethernet 0/18 kuldeep(config)#end kuldeep# %SYS-5-CONFIG_I: Configured from console by console
kuldeep#show mac-address-table static Mac Address Table ------------------------------------------Vlan ---Mac Address ----------Type -------Ports -----
Step 3. Determine which MAC addresses that the switch has learned.
Display the learned MAC addresses using the show mac-address-table command in privileged EXEC mode. kuldeep#show mac-address-table static Mac Address Table -------------------------------------------
Vlan ----
Type -----
Ports
Vlan ----
Type -----
Ports
99
0002.16e8.c285
DYNAMIC
Fa0/18
kuldeep#show port-security interface fa0/18 Port Security Port Status Violation Mode Aging Time Aging Type : Enabled : Secure-down : Shutdown : 0 mins : Absolute
SecureStatic Address Aging : Disabled Maximum MAC Addresses Total MAC Addresses :0 :2
Last Source Address:Vlan : 0000.0000.0000:0 Security Violation Count : 0 How many secure addresses are allowed on Fast Ethernet 0/18?
no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption ! hostname kuldeep ! enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1 ! ! ! interface FastEthernet0/1 switchport access vlan 99 ! interface FastEthernet0/2 ! interface FastEthernet0/3 ! interface FastEthernet0/4 ! interface FastEthernet0/5 ! interface FastEthernet0/6 ! interface FastEthernet0/7 ! interface FastEthernet0/8 switchport access vlan 99 !
interface FastEthernet0/9 ! interface FastEthernet0/10 ! interface FastEthernet0/11 ! interface FastEthernet0/12 ! interface FastEthernet0/13 ! interface FastEthernet0/14 ! interface FastEthernet0/15 ! interface FastEthernet0/16 ! interface FastEthernet0/17 ! interface FastEthernet0/18 switchport access vlan 99 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky ! interface FastEthernet0/19 ! interface FastEthernet0/20
! interface FastEthernet0/21 ! interface FastEthernet0/22 ! interface FastEthernet0/23 ! interface FastEthernet0/24 ! interface GigabitEthernet1/1 ! interface GigabitEthernet1/2 ! interface Vlan1 no ip address shutdown ! interface Vlan99 ip address 172.17.99.11 255.255.255.0 ! ip default-gateway 172.17.99.1 ! ! line con 0 password cisco login ! line vty 0 4
Are there statements listed that directly reflect the security implementation of the running configuration?
YES
SecureStatic Address Aging : Disabled Maximum MAC Addresses Total MAC Addresses :0 :1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan99, changed state to up Note: Convergence may take up to a minute. Switch between Simulation and Realtime mode to accelerate convergence.
kuldeep#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Kuldeep(config)#interface fastethernet 0/18 kuldeep(config-if)#no shutdown kuldeep(config-if)#end