Router Challenge 195

Outline: This challenge involves an analysis of SSH. Objectives: The objectives of this challenge are to explain SSH. The TELNET protocol is insecure as the text is passed as plain text. An improved method is to use SSH, which encrypts data. It requires that the domain-name and an RSA key pair:
# config t
Enter configuration commands, one per line. (config)# hostname ap End with CNTL/Z.

ap(config)# username fred password bert ap(config)# ip domain-name test.com ap(config)# crypto key generate rsa
How many bits in the modulus [512]: % Generating 512 bit RSA keys ...[OK]

ap # show crypto key mypubkey rsa

% Key pair was generated at: Key name: ap.test.com Usage: General Purpose Key Key is not exportable. Key Data: 305C300D 06092A86 4886F70D D28C19FD 3587872D ED4834F0 521A750B B9C09A7F E14275B9 % Key pair was generated at: Key name: ap.test.com.server Usage: Encryption Key Key is not exportable. Key Data: 307C300D 06092A86 4886F70D 26C2CE81 B264D2C0 9C52AD73 1D80B1E7 74E194B2 3F6C6EA8 78D60CFF 2B568C97 0CF21335 00:39:47 UTC Mar 1 2002

01010105 707B1D8F AA29B962 00:39:56

00034B00 30480241 00CE28A6 6697D889 944F665E 084DA46B 9D9C0BF4 E992059A BB0CCCAA 9FA30168 7B020301 0001 UTC Mar 1 2002

01010105 90731CF7 8D1505DB 0DE55420

00036B00 34D122BC 485AD29F BD7929AE

30680261 59CD560F A982AB04 763EDDB9

00D56417 9600714C 950DD4CA A1020301

15E52D1C E8DB3AA8 ED113E5F 0001

ap (config)# ip ssh ?
authentication-retries break-string port rsa source-interface time-out version <1-120> Specify number of authentication retries break-string Starting (or only) Port number to listen on Configure RSA keypair name for SSH Specify interface for source address in SSH connections Specify SSH time-out interval Specify protocol version to be supported

ap (config)# ip ssh time-out ? ap (config)# ip ssh time-out 60 ap (config)# ip ssh authentication-retries ? ap (config)# ip ssh authentication-retries 2 ap (config)# ip ssh version ? ap (config)# ip ssh version 2 ap (config)# line vty 0 4 ap (config-line)# transport ?
input output preferred all mop none Define which protocols to use when connecting to the terminal server Define which protocols to use for outgoing connections Specify the preferred protocol to use <1-2> Protocol version <0-5> Number of authentication retries SSH time-out interval (secs)

(config-line)# transport input ?

All protocols DEC MOP Remote Console Protocol No protocols

pad rlogin ssh telnet udptn v120

X.3 PAD Unix rlogin protocol TCP/IP SSH protocol TCP/IP Telnet protocol UDPTN async via UDP protocol Async over ISDN

ap (config-line)# transport input ssh ap (config-line)# login ?

local tacacs <cr> Local password checking Use tacacs server for password checking

ap (config-line)# login local

Cisco Router Challenge 196

Outline This challenge involves the configuration of services on the router. Objectives The objectives of this challenge are to:

Define encrypted passwords. Define timestamps. Disable TCP small services. Disable UDP small services. Disable CDP on an interface. Disable ICMP on an interface. Disable SNMP. Restrict Web access.

Example
> en # config t (config)# service ?
compress-config config dhcp disable-ip-fast-frag exec-callback exec-wait finger hide-telnet-addresses linenumber nagle old-slip-prompts pad password-encryption prompt pt-vty-logging sequence-numbers slave-log tcp-keepalives-in tcp-keepalives-out tcp-small-servers telnet-zeroidle timestamps Compress the configuration file TFTP load config files Enable DHCP server and relay agent Disable IP particle-based fast fragmentation Enable exec callback Delay EXEC startup on noisy lines Allow responses to finger requests Hide destination addresses in telnet command enable line number banner for each exec Enable Nagle's congestion control algorithm Allow old scripts to operate with slip/ppp Enable PAD commands Encrypt system passwords Enable mode specific prompt Log significant VTY-Async events Stamp logger messages with a sequence number Enable log capability of slave IPs Generate keepalives on idle incoming network connections Generate keepalives on idle outgoing network connections Enable small TCP servers (e.g., ECHO) Set TCP window 0 when connection is idle Timestamp debug/log messages

udp-small-servers debug log <cr>

Enable small UDP servers (e.g., ECHO)

(config)# service timestamps ?

Timestamp debug messages Timestamp log messages

(config)# service timestamps log ?

datetime uptime <cr> Timestamp with date and time Timestamp with system uptime

(config)# service timestamps log datetime (config)# sequence-numbers ?

compress-config config dhcp disable-ip-fast-frag exec-callback exec-wait finger hide-telnet-addresses linenumber nagle old-slip-prompts pad password-encryption prompt pt-vty-logging sequence-numbers slave-log tcp-keepalives-in tcp-keepalives-out tcp-small-servers telnet-zeroidle timestamps udp-small-servers Compress the configuration file TFTP load config files Enable DHCP server and relay agent Disable IP particle-based fast fragmentation Enable exec callback Delay EXEC startup on noisy lines Allow responses to finger requests Hide destination addresses in telnet command enable line number banner for each exec Enable Nagle's congestion control algorithm Allow old scripts to operate with slip/ppp Enable PAD commands Encrypt system passwords Enable mode specific prompt Log significant VTY-Async events Stamp logger messages with a sequence number Enable log capability of slave IPs Generate keepalives on idle incoming network connections Generate keepalives on idle outgoing network connections Enable small TCP servers (e.g., ECHO) Set TCP window 0 when connection is idle Timestamp debug/log messages Enable small UDP servers (e.g., ECHO)

(config)# service sequence-numbers (config)# service dhcp (config)# service finger (config)# no service tcp-small-servers (config)# no service udp-small-servers (config)# service password-encryption

To disable ping on the interface:

(config)# int e0 (config-if)# no ip ?
Interface IP configuration subcommands: access-group Specify access control for packets accounting Enable IP accounting on this interface address Set the IP address of an interface audit Apply IDS audit name auth-proxy Apply authenticaton proxy authentication authentication subcommands bandwidth-percent Set EIGRP bandwidth limit broadcast-address Set the broadcast address of an interface cef Cisco Express Fowarding interface commands cgmp Enable/disable CGMP dhcp Configure DHCP parameters for this interface directed-broadcast Enable forwarding of directed broadcasts dvmrp DVMRP interface commands flow NetFlow related commands header-compression IPHC options hello-interval Configures IP-EIGRP hello interval helper-address Specify a destination address for UDP broadcasts hold-time Configures IP-EIGRP hold time idle-group Specify interesting packets for idle-timer igmp IGMP interface commands information-reply Enable sending ICMP Information Reply messages inspect Apply inspect name

irdp load-sharing local-proxy-arp mask-reply mobile mrm mroute-cache mtu multicast nat nbar next-hop-self nhrp ospf pgm pim policy proxy-arp rarp-server redirects rgmp rip route-cache router rsvp rtp sap security split-horizon summary-address tcp unnumbered unreachables urd verify vrf wccp

ICMP Router Discovery Protocol Style of load sharing Enable local-proxy ARP Enable sending ICMP Mask Reply messages Mobile IP support Configure IP Multicast Routing Monitor tester Enable switching cache for incoming multicast packets Set IP Maximum Transmission Unit IP multicast interface commands NAT interface commands Network-Based Application Recognition Configures IP-EIGRP next-hop-self NHRP interface subcommands OSPF interface commands PGM Reliable Transport Protocol PIM interface commands Enable policy routing Enable proxy ARP Enable RARP server for static arp entries Enable sending ICMP Redirect messages Enable/disable RGMP Router Information Protocol Enable fast-switching cache for outgoing packets IP router interface commands RSVP Interface Commands RTP parameters Session Announcement Protocol interface commands DDN IP Security Option Perform split horizon Perform address summarization TCP header compression and other parameters Enable IP processing without an explicit address Enable sending ICMP Unreachable messages Configure URL Rendezvousing Enable per packet validation VPN Routing/Forwarding parameters on the interface WCCP interface commands

(config-if)# no ip redirects (config-if)# no ip unreachables (config-if)# no ip mask-reply

To disable multiroute-cache:
(config-if)# no ip mroute-cache (config-if)# exit

To setup Web access from only a single host:

(config)# access-list 5 permit host 192.168.1.1 (config)# ip http server access-class 5

And to disable SNMP:

(config)# no snmp-server

Cisco Router Challenge 197

Outline This challenge involves the configuration of RIP Version 2 with authenticated routing tables. Objectives The objectives of this challenge are to:

Setup a RIP Version 2.

Define authentication for RIP.

Example
> en # config t (config)# router (config-router)# (config-router)# (config-router)#

rip version 2 network 194.205.128.0 ?

Router configuration commands: address-family Enter Address Family command mode auto-summary Enable automatic network number summarization default Set a command to its defaults default-information Control distribution of default information default-metric Set metric of redistributed routes distance Define an administrative distance distribute-list Filter networks in routing updates exit Exit from routing protocol configuration mode flash-update-threshold Specify flash update threshold in second help Description of the interactive help system input-queue Specify input queue depth maximum-paths Forward packets over multiple paths neighbor Specify a neighbor router network Enable routing on an IP network no Negate a command or set its defaults offset-list Add or subtract offset from IGRP or RIP metrics output-delay Interpacket delay for RIP updates passive-interface Suppress routing updates on an interface redistribute Redistribute information from another routing protocol timers Adjust routing timers traffic-share How to compute traffic share over alternate paths validate-update-source Perform sanity checks against source address of routing updates version Set routing protocol version

(config-router)# exit (config)# key ? (config)# key chain ?

WORD Key-chain name chain config-key

Key-chain management Set a private configuration key

(config)# key chain martin (config-keychain)# ?

Key-chain configuration commands: default Set a command to its defaults exit Exit from key-chain configuration mode key Configure a key no Negate a command or set its defaults

(config-keychain)# key ? (config-keychain)# key 1 (config-keychain-key)# ?

<0-2147483647> Key identifier

Key-chain key configuration commands: accept-lifetime Set accept lifetime of key default Set a command to its defaults exit Exit from key-chain key configuration mode key-string Set key string no Negate a command or set its defaults send-lifetime Set send lifetime of key

(config-keychain-key)# key-string officer (config-keychain-key)# exit (config-keychain)# exit (config)# int e0 (config-if)# ip rip ?
advertise authentication receive send Specify update interval Authentication control advertisement reception advertisement transmission

v2-broadcast key-chain mode LINE

send ip broadcast v2 update

(config-if)# ip rip authentication ? (config-if)# ip rip authentication key-chain ?

name of key-chain Authentication key-chain Authentication mode

(config-if)# ip rip authentication key-chain martin (config-if)# ip rip authentication mode ?

md5 text Keyed message digest Clear text authentication

(config-if)# ip rip authentication mode md5

Cisco Router Challenge 197

Outline This challenge involves the configuration of RIP Version 2 with authenticated routing tables, and using a distribution-list with passive interfaces. Objectives The objectives of this challenge are to:

Setup a RIP Version 2. Define authentication for RIP. Define a routing filter to limit the transmission of routing information. Define a passive-interface for routing updates.

Example
> en # config t (config)# access-list 10 permit 10.0.0.0 0.0.0.255 (config)# router rip (config-router)# distribution-list 10 in fa0/1 (config-router)# passive-interface fa0/2 (config-router)# version 2 (config-router)# network 194.205.128.0 (config-router)# exit (config)# key chain martin (config-keychain)# key 1 (config-keychain-key)# key-string officer (config-keychain-key)# exit (config-keychain)# exit (config)# int fa0/1 (config-if)# ip rip authentication key-chain martin (config-if)# ip rip authentication mode md5

The passive-interface command stops the transmission of the routing tables on the specified interface.

Cisco PIX Challenge 1

Outline This challenge involves the configuration of basic PIX details.

Objectives The objectives of this challenge are to:

Setup the hostname. Define the domain name. Setup IP address of E0. Enable E0.

Example (Version 6.x)

# sh ip add
System IP Addresses: IP address outside 0.0.0.0 IP address inside 0.0.0.0 IP address inf2 0.0.0.0 Current IP Addresses: IP address outside 0.0.0.0 IP address inside 0.0.0.0 IP address inf2 0.0.0.0

# sh nameif # config t (config)# help hos

USAGE:

hostname <name> show hostname [fqdn] DESCRIPTION: hostname Change host name

(config)# hostname freds (config)# domain-name fred.com (config)# help domainUSAGE: [no] domain-name <name> clear configure domain-name DESCRIPTION: domain-name

(config)# ip address outside 192.168.1.1 255.255.255.0 (config)# interface e0 auto (config)# exit # show ip add # show running # sh int e0
Interface Ethernet0 outside, is up, line protocol is up Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.6585.77d9, MTU 1500 IP address 192.168.1.1, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1) Received 0 VLAN untagged packets, 0 bytes

Change domain name

Transmitted 1 VLAN untagged packets, 28 bytes Dropped 0 VLAN untagged packets

Example (Version 7.x)

# sh nameif # config t (config)# help hostname
USAGE: hostname <name> show hostname [fqdn] DESCRIPTION: hostname Change host name

(config)# help domainUSAGE: [no] domain-name <name> clear configure domain-name DESCRIPTION: domain-name Change domain name

(config)# hostname ?
configure mode commands/options: WORD < 64 char Host name for this system. A hostname must start and end with a letter or digit and have as interior characters only letters, digits, or a hyphen.

(config)# hostname freds (config)# domain-name?

configure mode commands/options: WORD Domain names must begin and end with a digit/letter, only letters, digits, and hyphen are allowed as internal characters, labels are separated by a dot. A maximum of 63 characters is allowed.

(config)# domain-name fred.com (config)# int e0 (config-if)# help ip

USAGE:

[no] ip address <ip_address> [<mask>] [standby <sby_ip_addr>] [no] ip address dhcp [setroute] [retry <4-16>] show ip address [<interface> | <if_name>] clear ip DESCRIPTION: ip SYNTAX: <ip_address> <mask> <sby_ip_addr> <4-16> <interface>: <if_name>: see also: Device's network interface address Netmask of ip_address Device failover peer's network interface address Number of retries performed by dhcp client, default is 4 Interface hardware name as used by 'interface' command. Composed of <type> <port>[/<subif_number>] or <type> <slot>/<port>[/<subif_number>] Interface name assigned by 'nameif' command nameif, security-level Set the ip address and mask for an interface

(config-if)# ip address outside 192.168.1.1 255.255.255.0 (config-if)# help shut

USAGE: [no] shutdown DESCRIPTION: shutdown Shutdown the selected interface

(config-if)# no shutdown (config-if)# exit (config)# exit # show ip add # sh ip add

System IP Addresses: IP address outside 192.168.1.1 IP address inside 0.0.0.0 IP address inf2 0.0.0.0 Current IP Addresses: IP address outside 0.0.0.0 IP address inside 0.0.0.0 IP address inf2 0.0.0.0

# show running myPIX # sh int e0

Interface Ethernet0 outside, is up, line protocol is up Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.6585.77d9, MTU 1500 IP address 192.168.1.1, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1) Received 0 VLAN untagged packets, 0 bytes Transmitted 1 VLAN untagged packets, 28 bytes Dropped 0 VLAN untagged packets

myPIX # sh int e1
Interface Ethernet1 inside, is down, line protocol is down Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.6585.77d9, MTU 1500 IP address 0.0.0.0, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1) Received 0 VLAN untagged packets, 0 bytes Transmitted 1 VLAN untagged packets, 28 bytes Dropped 0 VLAN untagged packets

Cisco PIX Challenge 2

Outline This challenge involves the configuration of basic PIX details (E1 and E2). Objectives The objectives of this challenge are to:

Define the IP address and subnet mask of E1. Define the IP address and subnet mask of E2.

Example (Ver 6.x)

> enable # nameif # config t (config)# ip address inf2 192.168.1.1 255.255.255.0 (config)# ip address inside 10.0.1.1 255.255.0.0 (config)# interface e1 auto (config)# interface e2 auto (config)# exit # show ip # show running # sh int e1
Interface Ethernet1 inside, is up, line protocol is up Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.6585.77d9, MTU 1500 IP address 192.168.1.1, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1) Received 0 VLAN untagged packets, 0 bytes Transmitted 1 VLAN untagged packets, 28 bytes Dropped 0 VLAN untagged packets

Example (Ver 7.x)

> enable # sh nameif # config t (config)# int e1 (config-if)# ip address outside 192.168.1.1 255.255.255.0 (config-if)# no shutdown (config-if)# exit (config)# int e2 (config-if)# ip address outside 192.168.2.1 255.255.255.0 (config-if)# no shutdown (config-if)# exit (config)# exit # show ip add # show running # sh int e1
Interface Ethernet1 inside, is up, line protocol is up Hardware is i82559, BW 100 Mbps Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 000d.6585.77d9, MTU 1500 IP address 192.168.1.1, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1)

Received 0 VLAN untagged packets, 0 bytes Transmitted 1 VLAN untagged packets, 28 bytes Dropped 0 VLAN untagged packets

Cisco PIX Challenge 3

Outline This challenge involves the configuration of basic PIX details (names of interfaces, security levels, and so on). Objectives The objectives of this challenge are to:

Define the name of each of the interfaces.

Example (Ver 6.x)

> enable # nameif # config t (config)# nameif e0 mars security0 (config)# nameif e1 pluto security100 (config)# nameif e2 jupiter security50 (config)# help username
USAGE: username <username> {nopassword|password <password> [encrypted]} [privilege <level>] no username <name> [no] username <name> attributes clear configure username [<name>] show running-config [all] username [<name> [attributes]] DESCRIPTION: username SYNTAX: <username> <nopassword> <password> encrypted <level> attributes The name of the user. A minimum of 4 characters is required. A maximum of 64 characters is allowed. Indicates that this user has no password The password for this user Indicate the <password> entered is encrypted The privilege level for this user Enter the attributes sub-command mode Configure user authentication local database

(config)# username fred password bert (config)# exit # show running

Example (Ver 7.x)

> enable # nameif # config t (config)# int e0 (config-if)# nameif mars (config-if)# security-level 0 (config-if)# exit (config)# int e1

(config-if)# nameif pluto (config-if)# security-level 100 (config-if)# exit (config)# int e2 (config-if)# help nameif
USAGE: nameif <if_name> no nameif [<if_name>] show running-config [all] nameif [<interface>] show nameif [<interface>] clear nameif DESCRIPTION: nameif SYNTAX: <if_name> <interface>: see also: A name by which this interface will be referred in all other commands Interface identifier as used in the 'interface' command. security-level, interface, static, global, nat Assign name to interface

(config-if)# nameif jupiter (config-if)# help security-level

USAGE: security-level <0-100> no security-level [<0-100>] DESCRIPTION: security-level SYNTAX: <0-100>

Specify security level of interface

The security level of this interface from 0 to 100. The relative security level between two interfaces determines the way the Adaptive Security Algorithm is applied. A lower security_level interface is outside relative to a higher level interface and equivalent interfaces are outside to each other. nameif

see also:

(config-if)# security-level 50 (config-if)# exit (config)# help username

USAGE: username <username> {nopassword|password <password> [encrypted]} [privilege <level>] no username <name> [no] username <name> attributes clear configure username [<name>] show running-config [all] username [<name> [attributes]] DESCRIPTION: username SYNTAX: <username> <nopassword> <password> encrypted <level> The name of the user. A minimum of 4 characters is required. A maximum of 64 characters is allowed. Indicates that this user has no password The password for this user Indicate the <password> entered is encrypted The privilege level for this user Configure user authentication local database

attributes

Enter the attributes sub-command mode

(config)# username fred password bert (config)# exit # show running # show running user

Cisco PIX Challenge 5

Outline This challenge involves the configuration of a static route, and some banners. Objectives The objectives of this challenge are to:

Define a static route. Define banners.

Example
mypix(config)# help route
USAGE: [no] route <if_name> <foreign_ip> <mask> <gateway> [<metric>|tunneled] clear configure route [<if_name>] clear route [<if_name>] show running-config route show route [<if_name>] DESCRIPTION: route SYNTAX: <if_name> <foreign_ip> <mask> <gateway> <metric> tunneled see also: The interface name, as specified by the 'nameif' command, for which the route will apply The foreign network for this route, 0 means default The netmask for the destined foreign network <foreign_ip> The address of the gateway by which <foreign_ip> is reached Distance metric for this route, default is 1 Specifies route as the default tunnel gateway for VPN traffic. rip, ping Enter a static route for an interface

pixfirewall(config)# route inside 10.0.0.0 ?

configure mode commands/options: A.B.C.D The netmask for the destined foreign network

pixfirewall(config)# route inside 10.0.0.0 255.255.0.0 ?

configure mode commands/options: Hostname or A.B.C.D The address of the gateway by which the foreign network is reached.

pixfirewall(config)# route inside 10.0.0.0 255.255.0.0 206.59.124.10 ?

configure mode commands/options: <1-255> Distance metric for this route, default is 1

tunneled

Enable the default tunnel gateway option, metric is set to 255

myPIX (config)# route outside 10.0.0.0 255.255.0.0 206.59.124.10 myPIX (config)# show route myPIX myPIX myPIX myPIX (config)# (config)# (config)# (config)# banner motd admin device banner login personal device banner exec main device show domain-name

myPIX (config)# domain-name dumfries.eu

Cisco PIX Challenge 6

Outline This challenge involves the configuration of Telnet, SSH and Console timeouts. Objectives The objectives of this challenge are to:

Setup the hostname. Define the domain name. Define the Telnet timeout. Define the SSH timeout. Define the Console timeout.

Example
myPIX (config)# hostname arizona arizona (config)# domain-name fife.nu arizona (config)# show domain-name myPIX (config)# help telnet
USAGE: [no] telnet <local_ip> <mask> <if_name> telnet timeout <number> no telnet timeout [<number>] DESCRIPTION: telnet SYNTAX: <local_ip> <mask> <if_name> <number> see also: The ip address of the host and/or network authorized to login to the device The IP netmask to apply to <local_ip>. Network interface name. Idle time in minutes after which a telnet session will be closed. Default is 5 minutes. ssh, password, aaa Add telnet access to device console and set idle timeout

arizona (config)# telnet timeout 8 arizona (config)# help ssh

USAGE: [no] ssh <local_ip> <mask> <if_name> [no] ssh timeout <number> [no] ssh version 1|2 [no] ssh scopy enable show ssh sessions [<client_ip>] ssh disconnect <session_id> DESCRIPTION: ssh Add SSH access to the Device console, set idle timeout, set version supported, enable Secure Copy as an SSH application, display a list of active SSH sessions, and terminate an SSH session.

SYNTAX: <local_ip> <mask> <if_name> <number> <client_ip> <session_id> see also: The IP address of the host and/or network authorized to login to the Device. The IP netmask to apply to <local_ip>. Network interface name. Idle time in minutes after which a SSH session will be closed. The IP address of the SSH client. Session ID as displayed by the 'show ssh sessions' command. telnet, password, enable, aaa

arizona (config)# ssh timeout 9 pixfirewall(config)# help console

USAGE: [no] console timeout <number> DESCRIPTION: console SYNTAX: <number> Valid range <0-60>. For <1..60>, console session will be closed after idle time of <1..60> minutes. console will never close for timeout <0> telnet, ssh, passwd, aaa Set idle timeout for the serial console of the PIX

see also:

arizona (config)# console timeout 9 arizona (config)# show telnet arizona (config)# show ssh arizona (config)# show console

Cisco PIX Challenge 7

Outline This challenge involves the configuration of the security levels on the interfaces. Objectives The objectives of this challenge are to:

Rename the interfaces, and define the security level on each interface.

Note: A port with the name of outside always has a security level of 0, while a port with the name of inside always has a security level of 100. Example (Ver 6.x)
myPIX (config)# nameif e0 strathclyde security24 myPIX (config)# nameif e1 orkney security61 myPIX (config)# nameif e2 rhodeisland security44

Example (Ver 7.x)

> enable # nameif # config t (config)# int e0 (config-if)# nameif strathclyde (config-if)# security-level 24 (config-if)# exit (config)# int e1 (config-if)# nameif orkney (config-if)# security-level 61 (config-if)# exit (config)# int e2 (config-if)# nameif rhodeisland (config-if)# security-level 44 (config-if)# exit (config)# exit # show running

Cisco PIX Challenge 8

Outline This challenge involves the configuration of a shutdown on the interfaces. Objectives The objectives of this challenge are to:

Define the names of the interfaces. Shutdown each of the interfaces.

Example (6.x)
myPIX myPIX myPIX myPIX myPIX myPIX myPIX myPIX myPIX myPIX myPIX (config)# (config)# (config)# (config)# (config)# (config)# (config)# (config)# (config)# (config)# (config)# nameif e0 gretna security0 nameif e1 alabama security100 nameif e2 uranus security50 show nameif interface e0 auto shut interface e1 auto shut interface e2 auto shut show int show int e0 show int e1 show int e2

Example (Ver 7.x)

> enable # nameif # config t (config)# int e0 (config-if)# nameif gretna (config-if)# security-level 0 (config-if)# shutdown (config-if)# exit (config)# int e1 (config-if)# nameif alabama (config-if)# security-level 100 (config-if)# shutdown (config-if)# exit (config)# int e2 (config-if)# nameif uranus (config-if)# security-level 50 (config-if)# shutdown (config-if)# exit (config)# exit # show running

Cisco PIX Challenge 9

Outline This challenge involves the configuration of interfaces for various settings, such as duplex, speed, and so on. Objectives The objectives of this challenge are to:

Define the names of the interfaces. Define the basic operation of the interfaces.

Example (Ver 6.x)

myPIX (config)# nameif e0 hawaii security0 myPIX (config)# nameif e1 alberta security100 myPIX (config)# nameif e2 orkney security50 myPIX (config)# interface e0 100full myPIX (config)# interface e1 100full myPIX (config)# interface e2 100full

Example (Ver 7.x)

> enable # nameif # config t (config)# help interface
USAGE: interface <type> <port> interface <type> <port>.<subif_number> no interface <type> <port>.<subif_number>

show running-config [default] interface {<type> <port>[.<subif_number>]} show interface {<type> <port>[.<subif_number>] | <if_name>} [detail|stats|ip brief] clear config interface {<type> <port>[.<subif_number>]} clear interface {<type> <port>[.<subif_number>]} DESCRIPTION: interface Set network interface parameters show/clear interface counters show brief summary of IP status and configuration

SYNTAX: <type> <port> <subif_number> <if_name> Type of interface to be configured Possible values: Ethernet, GigabitEthernet Port number. Refer to the appropriate hardware manual for port information Subinterface number in the range 1 to 4,294,967,293 Interface name assigned by 'nameif' command

WARNING! Using 'no' on a Subinterface will remove the interface from the system. Removing a Subinterface will delete all configuration rules applied to the interface. Exercise caution when using the 'no interface' command. see also: allocate-interface

(config)# int e0 (config-if)# nameif gretna (config-if)# security-level 0 (config-if)# help du

USAGE: duplex auto|full|half no duplex [auto|full|half] DESCRIPTION: duplex SYNTAX: auto full half see also: Enable AUTO duplex configuration Force full duplex operation Force half-duplex operation speed Configure duplex operation

(config-if)# duplex full (config-if)# help speed

USAGE: speed 10|100|1000|auto no speed [10|100|1000|auto] DESCRIPTION: speed SYNTAX: Possible Ethernet values are: 10 Force 10 Mbps operation 100 Force 100 Mbps operation auto Enable AUTO speed configuration Possible GigabitEthernet values are: 10 Force 10 Mbps operation 100 Force 100 Mbps operation 1000 Force 1000 Mbps operation auto Enable AUTO speed configuration Configure speed operation

see also:

duplex

(config-if)# speed 100 (config-if)# exit (config)# int e1 (config-if)# nameif alabama (config-if)# security-level 100 (config-if)# duplex full (config-if)# speed 100 (config-if)# exit (config)# int e2 (config-if)# nameif uranus (config-if)# security-level 50 (config-if)# duplex full (config-if)# speed 100 (config-if)# exit (config)# exit # show running

Cisco PIX Challenge 10

Outline This challenge involves the configuration of the DHCP server. Objectives The objectives of this challenge are to:

Enable the DHCP server. Define DHCP parameters. Show DHCP parameters.

Example
myPIX (config)# help dhcpd
USAGE: dhcpd dhcpd dhcpd dhcpd dhcpd dhcpd dhcpd address <ip1>[-<ip2>] <srv_ifc_name> dns <dnsip1> [<dnsip2>] wins <winsip1> [<winsip2>] lease <lease_length> ping_timeout <timeout> domain <domain_name> option <code> {ascii <string> | hex <hex_string> | ip <address_1> [<address_2>]} dhcpd enable <srv_ifc_name> dhcpd auto_config <clnt_if_name> show dhcpd [binding|statistics] clear dhcpd clear dhcpd [binding|statistics] DESCRIPTION: dhcpd SYNTAX: <ip1> <ip2> <dnsip> Start address of the DHCP address pool End address of the DHCP address pool DNS server IP address Configure DHCP Server

<winsip> <lease_length> <timeout> <domain_name> <code> <string> <hex_string> <address_1> <address_2> <srv_ifc_name> <clnt_if_name>

NetBios name server IP address DHCP lease length in seconds Ping timeout in milliseconds DNS domain name positive number representing the DHCP option code ASCII string without whitespace hexadecimal string without whitespace IP address IP address Interface to enable DHCP server Interface to retrieve DHCP client info

myPIX myPIX myPIX myPIX myPIX myPIX

(config)# (config)# (config)# (config)# (config)# (config)#

dhcpd enable dhcpd address 197.174.60.2-197.174.60.22 inside dhcpd wins 195.94.110.3 dhcpd lease 6 dhcpd domain athome.com show dhcpd

Cisco PIX Challenge 10

Outline This challenge involves the configuration of the DHCP server. Objectives The objectives of this challenge are to:

Enable the DHCP server. Define DHCP parameters. Show DHCP parameters.

Example
myPIX (config)# help dhcpd
USAGE: dhcpd dhcpd dhcpd dhcpd dhcpd dhcpd dhcpd address <ip1>[-<ip2>] <srv_ifc_name> dns <dnsip1> [<dnsip2>] wins <winsip1> [<winsip2>] lease <lease_length> ping_timeout <timeout> domain <domain_name> option <code> {ascii <string> | hex <hex_string> | ip <address_1> [<address_2>]} dhcpd enable <srv_ifc_name> dhcpd auto_config <clnt_if_name> show dhcpd [binding|statistics] clear dhcpd clear dhcpd [binding|statistics] DESCRIPTION: dhcpd SYNTAX: <ip1> <ip2> <dnsip> <winsip> <lease_length> <timeout> Start address of the DHCP address pool End address of the DHCP address pool DNS server IP address NetBios name server IP address DHCP lease length in seconds Ping timeout in milliseconds Configure DHCP Server

<domain_name> <code> <string> <hex_string> <address_1> <address_2> <srv_ifc_name> <clnt_if_name>

DNS domain name positive number representing the DHCP option code ASCII string without whitespace hexadecimal string without whitespace IP address IP address Interface to enable DHCP server Interface to retrieve DHCP client info

myPIX myPIX myPIX myPIX myPIX myPIX

(config)# (config)# (config)# (config)# (config)# (config)#

dhcpd enable dhcpd address 197.174.60.2-197.174.60.22 inside dhcpd wins 195.94.110.3 dhcpd lease 6 dhcpd domain athome.com show dhcpd

Cisco PIX Challenge 13

Outline This challenge involves the configuration of NAT. Objectives The objectives of this challenge are to:

Define inside address range. Define outside address range. Show NAT parameters. Show Global parameters.

Example (Ver 6.x)

myPIX (config)# help nat
USAGE: [no] nat (<if_name>) <nat_id> <local_ip> [<mask>] [dns] [outside] [[tcp] <max_conns> [<emb_limit> [<norandomseq>]]] [udp <udp_max_conns>] [no] nat (if_name) <nat_id> access-list <acl-name> [dns] [outside] [[tcp] <max_conns> [<emb_limit> [<norandomseq>]]] [udp <udp_max_conns>] DESCRIPTION: nat SYNTAX: <if_name> <nat_id> The name of the network interface, as specified by 'nameif', where the hosts/network designated by <local_ip> are accessed. The id of this group of hosts or networks. This id will be referenced by the 'global' command to associate a global pool with this command. The id '0' is reserved to indicate (i) no address translation with the access-list option or (ii) identity translation for the <real_ip> option. The maximum nat_id with access-list is 65535. The maximum nat_id without access-list is 2147483647. The hosts/networks in this <nat_id> group. '0' indicates all networks or the default <nat_id> group Associate a network with a pool of global IP addresses

<local_ip>

An IP address not found in a more explicit <nat_id> group will default to a less explicit or '0', the least explicit <mask> dns tcp udp <max_conns> The IP netmask to apply to <local_ip>. Use the created xlate to rewrite DNS address record. TCP connections. UDP connections. The maximum number of simultaneous connections. the <local_ip> hosts will each be allowed to use. Idle connections are closed after the time specified by the timeout conn command. The maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Disable TCP sequence number randomization. access-list name. access-list, apply, global

<emb_limit>

norandomseq <acl-name> see also:

myPIX (config)# nat ?

configure mode commands/options: ( Open parenthesis for the name of the network interface where the hosts/network designated by the local IP address are accessed

myPIX (config)# nat (inside) ?

configure mode commands/options: <0-2147483647> The <nat_id> of this group of hosts/networks. This <nat_id> will be referenced by the global command to associate a global pool with the local IP address. <nat_id> '0' is used to indicate no address translation for local IP. The limit is 65535 with access-lists

myPIX (config)# nat (inside) 1 ?

configure mode commands/options: Hostname or A.B.C.D The hosts/networks in this <nat_id> group, '0' indicates all networks or the default <nat_id> group access-list Specify access-list name after this keyword

myPIX (config)# nat (inside) 1 143.163.128.0 ?

configure mode commands/options: A.B.C.D IP netmask to apply to the local IP address <cr>

myPIX (config)# nat (inside) 1 143.163.128.0 255.255.192.0 myPIX (config)# help global
USAGE: [no] global (<ext_if_name>) <nat_id> {<global_ip>[-<global_ip>] [netmask <global_mask>]} | interface DESCRIPTION: global SYNTAX: <(ext_if_name)> The external network interface name <nat_id> <global_ip> The id of the nat group(from the nat command) that will draw from these global addresses The IP address, network or range of addresses that will dynamically be translated on an as needed basis to hosts in the nat group <nat_id>. If this <ext_if_name> is connected to the Internet, the Specify, delete or view global address pools, or designate a PAT(Port Address Translated) address

<global_ip> should be registered with the Network Information Center(NIC). These addresses should also be reverse resolvable(in-addr.arpa) on the outside DNS servers. An address specified singly will be used as a PAT address. When all of the non-PAT addresses of a global pool are in use and there is a PAT address, subsequent hosts from the nat group <nat_id> will share the single PAT address for up to the number of licensed connections. [netmask <global_mask>] The netmask of the global_ip. interface see also: IP address of <ext_if_name> overloaded for PAT. nat, alias, static

myPIX (config)# global ?

configure mode commands/options: ( Open parenthesis for the external network interface name

myPIX (config)# global (outside) 3 ?

configure mode commands/options: WORD Enter IP address or a range of IP addresses <start_ip>[-<end_ip>] interface Specifies PAT using the IP address at the interface

myPIX (config)# global (outside) 3 137.68.10.3-137.68.10.23 ?

configure mode commands/options: netmask Specify netmask for the IP address(es) after this keyword <cr>

myPIX (config)# global (outside) 3 1.2.3.4 net ?

configure mode commands/options: A.B.C.D Netmask for the IP address(es)

myPIX (config)# global (outside) 3 137.68.10.3-137.68.10.23 netmask 255.255.255.0 myPIX (config)# show nat myPIX (config)# show global

Example (Ver 7.x) As Ver 6.0, but replace show nat and show global with:
myPIX (config)# show running nat myPIX (config)# show running global

Cisco PIX Challenge 14

Outline This challenge involves the configuration of a static route. Objectives The objectives of this challenge are to:

Define the IP address and subnet mask of the interfaces. Define a static mapping.

Example (Ver 6.x)

myPIX (config)# ip address outside 84.120.11.5 255.128.0.0 myPIX (config)# ip address inside 10.10.0.1 255.128.0.0 myPIX (config)# ip address inf 172.16.0.1 255.128.0.0

myPIX (config)# show ip address myPIX (config)# static (inside, outside) 84.120.11.15 211.204.152.13 myPIX (config)# show static

Example (Ver 7.x)

myPIX (config)# int e0 myPIX (config-if)# ip address 84.120.11.5 255.128.0.0 myPIX (config-if)# nameif outside myPIX (config-if)# int e1 myPIX (config-if)# ip address 10.10.0.1 255.128.0.0 myPIX (config-if)# nameif inside myPIX myPIX myPIX myPIX (config-if)# (config-if)# (config-if)# (config-if)# int e2 ip address 172.16.0.1 255.128.0.0 nameif inf2 exit

myPIX (config)# show ip address myPIX (config)# help static

USAGE: [no] static [(real_ifc, mapped_ifc)] {<mapped_ip>|interface} {<real_ip> [netmask <mask>]} | {access-list <acl_name>} [dns] [[tcp] <max_conns> [<emb_lim> [<norandomseq> [nailed]]]] [udp <max_conns>] [no] static [(real_ifc, mapped_ifc)] {tcp|udp} {<mapped_ip>|interface} <mapped_port> {<real_ip> <real_port> [netmask <mask>]} | {access-list <acl_name>} [dns] [[tcp] <max_conns> [<emb_lim> [<norandomseq> [nailed]]]] [udp <max_conns>] DESCRIPTION: static SYNTAX: <real_ifc> Name of the network interface, as specified by 'nameif', where the hosts or networks designated by <real_ip> or sources in access-list are accessed. Name of the network interface, as specified by 'nameif', where the <real_ip> or by the source in access-list are translated into <mapped_ip>. TCP static PAT. UDP static PAT. Address as configured at the actual host. Port as viewed from the actual host. Masquerade address of the <real_ip> or of the source address in access-list. The IP netmask to apply to <real_ip>. Masquerade port of the <real_port> or of the source port in access-list. Configure one-to-one address translation rule

<mapped_ifc>

tcp udp <real_ip> <real_port> <mapped_ip> <mask> <mapped_port>

interface <mapped_port> <acl_name>

Address taken from <mapped_ifc>. Masquerade port of the <real_port> or of the source port in access-list. The access-list name with the source fields defining the real address and real port, if applicable, before translation. Rewrite DNS address record. Disable TCP sequence number randomization. Allow TCP sessions for asymmetrically routed traffic The maximum number of simultaneous TCP connections that each <real_ip> hosts will each be allowed to use. Idle connections are closed after the time specified by the timeout conn command. Maximum number of embryonic connections per host. An embryonic connection is a connection request that has not completed TCP 3-way handshake between source and destination. nat, global

dns norandomseq nailed <max_conn>

<emb_limit>

see also:

myPIX (config)# static ?

configure mode commands/options: ( Open parenthesis for (<internal_if_name>,<external_if_name>) pair where <internal_if_name> is the Internal or prenat interface and <external_if_name> is the External or postnat interface

myPIX (config)# static (inside, outside) 84.120.11.15 211.204.152.13 myPIX (config)# show running static

Cisco PIX Challenge 15

Outline This challenge involves the configuration of the activation key. Objectives The objectives of this challenge are to:

Configure the activation key. Show the activation key.

Example
myPIX # help activation-key
USAGE: activation-key <activation-key-four-or-five-tuple> show activation-key DESCRIPTION: activation-key SYNTAX: <activation-key-four-or-five-tuple> a four or five element hexadecimal string. Modify activation-key.

myPIX (config)# activation-key 1aa3aaab abfbcef1 133445ee ee56f6b0

myPIX (config)# show activation-key

Cisco PIX Challenge 16

Outline This challenge involves the configuration of an access-list. Objectives The objectives of this challenge are to:

Define a named access-list. Apply the access-list onto an interface.

Example
myPIX (config)# help access-l
USAGE: Extended access list: Use this to configure policy for IP traffic through the firewall [no] access-list <id> [line <line_num>] [extended] {deny | permit} {<protocol> | object-group <protocol_obj_grp_id>} {host <sip> | <sip> <smask> | object-group <network_obj_grp_id>} [<operator> <port> [<port>] | object-group <service_obj_grp_id>] {<dip> <dmask> | object-group <network_obj_grp_id>} [<operator> <port> [<port>] | object-group <service_obj_grp_id>] [log [disable] | [<level>] | [default] [interval <secs>]] [no] access-list <id> [line <line_num>] {deny | permit} icmp {host <sip> | <sip> <smask> | object-group <network_obj_grp_id>} {<dip> <dmask> | object-group <network_obj_grp_id>} [<icmp_type> | object-group <icmp_type_obj_grp_id>] [log [disable] | [<level>] | [default] [interval <secs>]] [no] access-list <id> webtype {deny|permit} url {<url-string>|any} [log {disable | default | level} [interval <seconds>]] [time-range <name>] [inactive] [no] access-list <id> webtype {deny | permit> tcp {host <host-addr> | <dest-addr> <dest-mask> | any} [{{EQ | NEQ | LT | GT} <port> | RANGE <port> <port>}] [log {disable | default | <level>} [interval <seconds>]] [time-range <name> ] [ inactive ] [no] access-list <id> [line <line_num>] remark <text> access-list deny-flow-max <n> access-list alert-interval <secs> Standard access list: Use this to configure policy having destination host or network only [no] access-list <id> standard {deny|permit} {any | <ip> <mask> | host <ip>} [no] access-list <id> remark <text> Generic Commands: show access-list [<id>] show running-config access-list [alert-interval | deny-flow-max | <id>] clear configure access-list [<id>] clear access-list [<id> [counters]]

DESCRIPTION: access-list SYNTAX: <id> <line_num> <webtype> deny permit object-group obj_grp_id remark <protocol> <sip> <smask> <dip> <dmask> <operator> Access list number Specify line number at which ACE should be entered Use this to configure Web related policy Denies access if the conditions are matched. Permits access if the conditions are matched. Keyword for specifying an object group. Identifier of an existing object group. Specify a comment (remark) The IP protocol name or number that will be open udp is 17, tcp is 6, egp is 47, etc. Source IP address Mask to be applied to <sip> Destination IP address Mask to be applied to <dip> Compares <sip> or <dip> ports. Possible operands include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). The decimal number or name of a TCP or UDP port comment (remark) Keyword for enabling log option on this ACL element. Keyword for disabling log option on this ACL element. Keyword for set log option on this ACL element to default values. Optional syslog level (0-7); default level is 6. Keyword for specifying log interval. Optional log interval value (1-600); default is 300. 0 echo-reply, 3 unreachable, 4 source-quench, 5 redirect, 6 alternate-address, 8 echo, 9 router-advertisement, 10 router-solicitation, 11 time-exceeded, 12 parameter-problem, 13 timestamp-request, 14 timestamp-reply, 15 information-request, 16 information-reply, 17 address-mask-request, 18 address-mask-reply, 31 conversion-error or 32 mobile-redirect access-group, object-group Add an access list

<port> <text> log disable default <level> interval <secs> <icmp_type>

see also:

myPIX (config)# access-list uranus permit ip host 26.32.188.8 host 129.67.195.1 myPIX (config)# access-list uranus deny ip host 201.122.28.7 host 209.215.90.6 myPIX (config)# help access-g
USAGE: [no] access-group <access-list> <in|out> interface <if_name> [per-user-override] DESCRIPTION: access-group SYNTAX: <access-list> <in|out> <if_name> per-user-override see also: Extended access list number Inbound or Outbund access list Name of the interface Allow AAA downloaded per-user ACL to override Bind an extended access-list to an interface to filter inbound traffic

myPIX (config)# access-group uranus in interface outside

access-list, object-group