Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 13 views

    21bce2676 VL2023240503020 Ast03

    Uploaded by

    sudheshna palle

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    21bce2676 VL2023240503020 Ast03

    Uploaded by

    sudheshna palle
    13 views10 pages

    Original Title

    21BCE2676_VL2023240503020_AST03

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    13 views10 pages

    21bce2676 VL2023240503020 Ast03

    Uploaded by

    sudheshna palle

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 10

    Name : Palle Sudheshna

    Registration number:21BCE2676

    Course name: Information


    Security Management Course
    Code: BCSE354E Slot : L15+L16
    LAB ASSIGNMENT-3

    Zone based firewall.


    Design:

    1. Enable the Security

    Router>en
    Router#conf t
    Enter configuration commands, one per line. End with CNTL/Z.
    Router(config)#license boot module c2900 technology-package securityk9
    ^
    % Invalid input detected at '^' marker.

    Router(config)#exit
    Router#
    %SYS-5-CONFIG_I: Configured from console by console
    reload
    System configuration has been modified. Save? [yes/no]:yes
    Building configuration...
    [OK]
    Proceed with reload? [confirm]
    System Bootstrap, Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 2010 by cisco Systems, Inc.
    Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
    CISCO1941/K9 platform with 524288 Kbytes of main memory
    Main memory is configured to 64/-1(On-board/DIMM0) bit mode with ECC disabled

    Readonly ROMMON initialized

    program load complete, entry point: 0x80803000, size: 0x1b340


    program load complete, entry point: 0x80803000, size: 0x1b340
    IOS Image Load Test

    Digitally Signed Release Software


    program load complete, entry point: 0x81000000, size: 0x2bb1c58
    Self decompressing the image :
    ########################################################################## [OK]
    Smart Init is enabled
    smart init is sizing iomem
    TYPE MEMORY_REQ
    Onboard devices &
    buffer pools 0x01E8F000
    -----------------------------------------------
    TOTAL: 0x01E8F000
    Rounded IOMEM up to: 32Mb.
    Using 6 percent iomem. [32Mb/512Mb]

    Restricted Rights Legend


    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
    cisco Systems, Inc.
    170 West Tasman Drive
    San Jose, California 95134-1706

    Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE


    SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Thurs 5-Jan-12 15:41 by pt_team
    Image text-base: 0x2100F918, data-base: 0x24729040

    This product contains cryptographic features and is subject to United


    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.

    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

    If you require further assistance please contact us by sending email to


    export@cisco.com.

    Cisco CISCO1941/K9 (revision 1.0) with 491520K/32768K bytes of memory.


    Processor board ID FTX152400KS
    2 Gigabit Ethernet interfaces
    DRAM configuration is 64 bits wide with parity disabled.
    255K bytes of non-volatile configuration memory.
    249856K bytes of ATA System CompactFlash 0 (Read/Write)

    Press RETURN to get started!

    %IP-4-DUPADDR: Duplicate address 192.168.4.1 on GigabitEthernet0/0, sourced by


    0010.112C.0A02
    2. Configure the ZONES

    Router(config)#zone security IN-ZONE'


    Router(config-sec-zone)#exit
    Router(config)#zone security OUT-ZONE
    Router(config-sec-zone)#exit
    Router(config)#

    3. Create an access list

    Router(config)#access-list 101 permit ip 192.168.1.1 255.255.255.0 any


    4. Identify a traffic using class-map

    Router(config)#class-map type inspect match-all IN-NET-CLASS-MAP


    Router(config-cmap)#match access-group 101
    Router(config-cmap)#

    5. Specify firewall policies

    Router(config)#policy-map type inspect IN-TO-OUT


    Router(config-pmap)#class type inspect IN-NET-CLASS-MAP
    Router(config-pmap-c)#exit
    Router(config-pmap)#exit
    Router(config)#

    6. Apply firewall policies

    Router(config)#zone-pair security IN-TO-OUT-ZPAIR source IN-ZONE destination OUT-ZONE


    % Source security zone name IN-ZONE not defined
    Router(config)#service policy type inspect IN-TO-OUT

    7. Assign the interfaces to the correct zone

    Router(config)#int g0/1
    Router(config-if)#zone-member security IN-ZONE
    % Security zone name IN-ZONE not defined
    Router(config-if)#exit
    Router(config)#intg0/0
    ^
    % Invalid input detected at '^' marker.

    Router(config)#intg0/2
    ^
    % Invalid input detected at '^' marker.
    Router(config)#int g0/2
    %Invalid interface type and number
    Router(config)#zone-member security OUT-ZONE

    Cli all step combined :


    System Bootstrap, Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 2010 by cisco Systems, Inc.
    Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
    CISCO1941/K9 platform with 524288 Kbytes of main memory
    Main memory is configured to 64/-1(On-board/DIMM0) bit mode with ECC disabled

    Readonly ROMMON initialized

    program load complete, entry point: 0x80803000, size: 0x1b340


    program load complete, entry point: 0x80803000, size: 0x1b340

    IOS Image Load Test

    Digitally Signed Release Software


    program load complete, entry point: 0x81000000, size: 0x2bb1c58
    Self decompressing the image :
    ######################### [OK]
    Smart Init is enabled
    smart init is sizing iomem
    TYPE MEMORY_REQ
    Onboard devices &
    buffer pools 0x01E8F000
    -----------------------------------------------
    TOTAL: 0x01E8F000
    Rounded IOMEM up to: 32Mb.
    Using 6 percent iomem. [32Mb/512Mb]

    Restricted Rights Legend


    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
    cisco Systems, Inc.
    170 West Tasman Drive
    San Jose, California 95134-1706

    Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE


    SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Thurs 5-Jan-12 15:41 by pt_team
    Image text-base: 0x2100F918, data-base: 0x24729040

    This product contains cryptographic features and is subject to United


    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.

    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

    If you require further assistance please contact us by sending email to


    export@cisco.com.

    Cisco CISCO1941/K9 (revision 1.0) with 491520K/32768K bytes of memory.


    Processor board ID FTX152400KS
    2 Gigabit Ethernet interfaces
    DRAM configuration is 64 bits wide with parity disabled.
    255K bytes of non-volatile configuration memory.
    249856K bytes of ATA System CompactFlash 0 (Read/Write)

    Press RETURN to get started!

    *Mar 01, 00:00:00.000: %IPS-6-ENGINE_BUILDS_STARTED: 00:00:00 UTC Mar 01 1993


    *Mar 01, 00:00:00.000: %IPS-6-ENGINE_BUILDING: atomic-ip - 3 signatures - 1 of 13 engines
    *Mar 01, 00:00:00.000: %IPS-6-ENGINE_READY: atomic-ip - build time 8 ms - packets for this
    engine will be scanned
    *Mar 01, 00:00:00.000: %IPS-6-ALL_ENGINE_BUILDS_COMPLETE: elapsed time 8 ms
    *Mar 01, 00:00:00.000: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.1.50
    port 514 started - CLI initiated
    *Mar 01, 00:00:00.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0,
    changed state to up
    *Mar 01, 00:00:00.000: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1,
    changed state to up
    *Mar 01, 00:00:00.000: IP-4-DUPADDR: Duplicate address 192.168.2.1 on GigabitEthernet0/1,
    sourced by 0010.112C.0A01
    *Mar 01, 00:00:00.000: IP-4-DUPADDR: Duplicate address 192.168.2.1 on
    GigabitEthernet0/1,sourced by 0010.112C.0A01

    Router>
    en
    Router#c
    onf t
    Enter configuration commands, one per line. End with CNTL/Z.
    Router(config)#licence boot module c2900 technology-package securityk9
    ^
    % Invalid input detected at '^' marker.

    Router(config)#zone security
    IN-ZONE' Router(config-sec-
    zone)#exit
    Router(config)#zone security
    OUT-ZONERouter(config-sec-
    zone)#exit
    Router(config)#access-list 101 permit ip 192.168.1.1
    255.255.255.0 anyRouter(config)#class-map type inspect
    match-all IN-NET-CLASS-MAP Router(config-cmap)#match
    access-group 101
    Router(config-cmap)#exit
    Router(config)#policy-map type inspect IN-TO-OUT
    Router(config-pmap)#class type inspect IN-NET-
    CLASS-MAPRouter(config-pmap-c)#exit
    Router(config-pmap)#exit
    Router(config)#zone-pair security IN-TO-OUT-ZPAIR source IN-ZONE destination OUT-
    ZONE
    % Source security zone name IN-ZONE not defined
    Router(config)#service policy type inspect IN-TO-
    OUT
    ^
    % Invalid input detected at '^' marker.

    Router(config)#int g0/1
    Router(config-if)#zone-member security IN-ZONE
    % Security zone name IN-ZONE
    not definedRouter(config-if)#exit
    Router(config)#intg0/0
    ^
    % Invalid input detected at '^' marker.

    Router(config)#intg0/2
    ^
    % Invalid input detected at '^' marker.

    Router(config)#int g0/2
    %Invalid interface type and number
    Router(config)#zone-member security OUT-ZONE

    You might also like