Implement network security on edge routers and lan

Question

Scenario

UKSports is a supplier of Taekwondo sparring equipment to TKD schools in the UK and Europe. The company has recently acquired new administration premises in London and you have been asked to implement network security on their edge routers and LAN switches  and provide evidence that it is secure.

IP Addressing Table

Device	Interface	IP Address	Subnet Mask	Default Gateway	Switch Port
LONDON	Fa0/0	10.10.20.1	255.255.255.0	NIA	SL Gig 1/1
	SO/0/0	192.168.1.1	255.255.255.252	N/A	N/A
ISP	S0/0/0 (DCE)	192.168.1.2	255.255.255.252	N/A	N/A
	S0/0/1 (DCE)	192.168.1.6	255.255.255.252	N/A	N/A
GERMANY	Fa0/0	10.10.30.1	255.255.255.0	N/A	SG Gig 1/1
	SO/0/1	192.168.1.5	255.255.255.252	N/A	N/A
SL1	VLAN 100	10.10.20.2	255.255.255.0	10.10.20.1	SL2 Gig1/2-11
SL2	VLAN 100	10.10.20.3	255.255.255.0	10.10.20.1	SL1 Gig1/2
SG	VLAN 100	10.10.30.2	255.255.255.0	10.10.30.1	N/A
PC-L	NIC	10.10.20.15	255.255.255.0	10.10.20.1	SL1 Fa0/1
HTTP Server	NIC	10.10.20.16	255.255.255.0	10.10.20.1	SL2 Fa0/10
PC-G	NIC	10.10.30.10	255.255.255.0	10.10.30.1	SG Fa0/21

You have been given a detailed security plan for UKSports and have been specifically asked to undertake the following implementation tasks:

Part 1 - Basic network device configuration

Step 1 - Basic router configuration

• Configure router hostnames (as specified in the scenario)
• Configure IP addresses as described in the IP Addressing Table
• Configure a clock rate of 64000 in the appropriate serial interfaces

Step 2 - Static Routes

• Configure a static default route on edge routers LONDON and GERMANY
• Configure a static route on the ISP router, from GERMANY to the LONDON's LAN and from LONDON to the GERMANY's LAN, specify an interface as the exit parameter.

Step 3 - PC Configuration

• Configure appropriate IP addresses, subnet masks and default gateways for each PC

Question 1. In your report, include several screenshots showing that there is communication between the routers and the PCs.

Part 2 - Secure Network Routers

Step 1 - Configure Passwords and login banner

• Define a minimum length of 8 for all passwords
• Encrypt all plain text passwords
• Configure the password class123 as the privileged password and cisco123 on the console line
• Configure the warning banner: Unauthorised access prohibited

Step 2 - Configure Local Authentication using AAA on edge routers (LONDON and GERMANY)

• Create a local user account of UKAdmin01 with a secret password of UKAdmin01pa55 and a the highest privilege level
• Enable AAA services
• Create a default login authentication method list using local authentication as the first option and the enable password as the backup option

Question 2. In your report, provide evidence that the local database and the default login method is working correctly.

Step 3 - Configure SSH Server on the edge routers (LONDON and GERMANY)

• Configure the domain name UKSPORTS.com
• Configure all the incoming vty lines to specify that Level 15 users will default to privilege exec mode when accessing the VTY lines. All other users will default to exec mode. Specify that only SSH connections will be allowed
• Configure the RSA keys with 1024 bits

Question 3. In your report, provide evidence that SSH is working correctly.

Step 4 - Secure against login attacks on LONDON and GERMANY

• Set blocking period when login attack detected to 60 seconds
• Maximum login failures with the device to 2
• Maximum time period for crossing the failed login attempts to 30 seconds
• Log all failed login attempts

Step 5 - Configure a Zone-based policy firewall on LONDON

• Create two security zones named: INTERNAL_ZONE and EXTERNAL_ZONE

• Create access list 150 that permits all IP traffic from LONDON's LAN to any destination

• Create the INTERNAL_CMAP class map of type inspect that matches all statements of the class map, inside the class map define the match to access list 150

• Define the IN_2_OUT_PMAP policy map, and define it to use the INTERNAL_CMAP class map and to inspect

• Define the IN_2_OUT_ZP zone pair with INTERNAL_ZONE as the source and EXTERNAL_ZONE as the destination, the policy of the pair should be to inspect the IN_2_OUT_PMAP

• Define the interface S0/0/0 as part of the EXTERNAL_ZONE and interface Fa0/0 as part of the INTERNAL_ZONE

Question 4. In your report, explain the purpose of this configuration. Provide evidence that the firewall is working correctly, which devices should be able to communicate between them, which shouldn't and why?

Step 6 - Configure IPS on GERMANY

• Create a directory in flash named IPSDIR
• Configure the IPS signature storage location to the new directory
• Create an IPS roule named IOSIPS
• Configure the IPS so only the basic category is used
• Apply the rule to the outbound direction of interface S0/0/1
• Un-retire the echo request signature (signature 2004, subsig ID 0), enable it and change the signature action to alert, and drop

Question 5. In your report, explain the purpose of this configuration. Provide evidence that the IPS is working correctly, which devices should be able to communicate between them, which shouldn't and why?

Part 3 - Configure a Site-to-Site VPN between LONDON and GERMANY

• Configure the following VPN settings:

Parameter	Value
Policy number	10
Key distribution method	ISAKMP
Encryption algorithm	AES
Hash algorithm	SHA-1
Authentication method	Pre-share
Key Exchange	DH 2
IKE SA Lifetime	86400 seconds
ISAKMP key	uksportsvpnpa55

o Set the VPN to be from LONDON's int s0/0/0 to GERMANY's int s0/0/0
o Use the following parameters for ISAKMP Phase 1 policy

Parameter	LONDON	GERMANY
Transform set	VPN1	VPN1
Algorithms	esp-3des esp-sha-hmac	esp-3des esp-sha-hmac
Peer hostname	GERMANY	LONDON
Crypto Map name	VPN-MAP1 Policy 10	VPN-MAP1 Policy 10
SA Establishment	ipsec-isakmp	ipsec-isakmp

o The interesting traffic in LONDON is the IP traffic from its LAN to GERMANY's LAN, and the interesting traffic in GERMANY is the IP traffic
from its LAN to LONDON's LAN
o Use the following parameters for IPSEC Phase 2 policy

Question 6. In your report, explain the purpose of this configuration. Provide evidence that the VPN is working correctly, which devices should be able to use the VPN, which shouldn't and why?

Part 4 -Secure Network Switches

Step 1 - Configure IP address to the management VLAN

• Make VLAN 100 the management VLAN and assign the IP address. It is not necessary to configure a name to VLAN 100
• Configure the default gateway in all switches

Step 2 - Configure Passwords and a login Banner on Switches

• Configure the hostname of all switches
• Configure the enable secret password of class
• Configure the console line with a password of cisco
• Configure the vty ports with a password of cisco with an exec-timeout of 5 minutes
• Configure a the login banner: Unauthorised access prohibited

Step 3 - Secure Trunk Ports

• Configure port Gig1/2 on SL1 as a trunk port
• Configure port Gig1/2 on SL2 as a trunk port
• Configure the native vlan to be 99. It is not necessary to configure a name to VLAN 99
• Prevent the use of DTP on the trunking ports of SL1 and SL2
• Enable storm control for broadcasts with a 50% suppression level in all trunking ports

Question 7. In your report, provide evidence that the trunking ports are working correctly and that trunking is enabled.

Step 4 - Secure Access Ports

• On SL1, configure ports Fa0/1 and Gig1/1 as access mode for VLAN 100
• On SL2, configure ports Fa0/10 as access mode for VLAN 100
• On SG, configure ports Gig1/1 and Fa0/21 as access mode for VLAN 100

Question 8. In your report, show that there is internal connectivity between the devices of each LAN.

Step 5 - Protect against STP Attacks

• Enable PortFast on all ports that have been defined as access ports
• Enable BPDU guard

Step 6 - Configure Port Security and Disable Unused Ports

• Configure basic port security on all ports that have been defined as access ports: set maximum MAC addresses to 1 and on violation shutdown the interface, the switch must learn the MAC address of the device that is already connected in that port
• Disable unused ports on all switches

Question 9. In your report, provide evidence that port security is working correctly. Explain how would you test the correct functionality of port security.