This is an old revision of the document!
Lab 5 - AAA and Advanced ACLs (not final version)
Topology
Interfaces
Device | Interface | IP Address | Subnet Mask |
Ping | Lo0 | 12.1.1.1 | 255.255.255.0 |
Ping | Fa0/0 | 10.0.0.1 | 255.255.255.0 |
Qing | Fa0/0 | 10.0.0.2 | 255.255.255.0 |
Qing | Fa1/0 | 192.168.1.2 | 255.255.255.0 |
Ring | Fa0/0 | 192.168.1.1 | 255.255.255.0 |
Ring | Fa1/0 | 192.168.0.1 | 255.255.255.0 |
Sing | Fa0/0 | 192.168.0.2 | 255.255.255.0 |
Sing | Lo0 | 80.1.1.1 | 255.255.255.0 |
Tasks
Open the Open the Lab5_CNS_Topology.net file.
Important! Writing answers:
[0p, sorry!] Before starting the lab, edit the .net file in order to connect one Ethernet interface on the Sing router to the local network.
[1p] Ensure connectivity between all devices using the addressing scheme printed above. Use a routing protocol.
[+1.5p = 2.5p] Radius again! Configure Radius authentication on Sing the vty lines. Use the Radius server available on the network. Ask the assistant for the server’s IP address and a valid user account.
[+1.5p = 4p] Create a dynamic
ACL for ping traffic going from Qing to Ping’s loopback. Allow ping for 8 minutes after a successful authentication, deny everything else.
[+1.5p = 5.5p] Create a reflexive
ACL for all the traffic going from Sing to Qing, configured on Ring. Consider Sing the be „inside” and Qing to be „outside”. Test using ping or telnet.
[+1.5p = 7p] Manually set the correct time and date on router Ring and configure it to run an NTP server. Configure Sing as an NTP client, in order to obtain its time from Ring.
[+1.5p = 8.5p] Create a time-based
ACL on Sing to allow telnet on its Loopback0 interface only during the lab time. Test.
Hint: dont’t forget that Sing is an NTP client; it must still be able to sync with Ring through this
ACL.
[+1,5p = 10p] BONUS: Without removing or modifying any previous configuration, configure Qing to obtain its time from Ring, too, using NTP.