Network Security Packet Tracer Activity Chapter 2 Answer

network security packet tracer activity chapter 2

This post is solution or answer for Packet Tracer Activity Chapter 2 Network Security. This  packet tracer activity is about configure cisco router for syslog, NTP (Network Time Protocol) and SSH Operations. The purpose of Syslog is to provide message logging. Network Time Protocol (NTP) allows routers on the network to synchronize their time settings with an NTP server while SSH is a network protocol which establishes a secure terminal emulation connection to networking device. This post will describe step by step how to configure SSH, NTP and Syslog on Cisco router. 

network security packet tracer activity chapter 2

 

Configure Router as NTP client

Step 1 – Test Connectivity

Ping from PC-C to R3.
Ping from R2 to R3.
Telnet from PC-C to R3. Exit the Telnet session.
Telnet from R2 to R3. Exit the Telnet Session.

 

Step 2 – Configure R1, R2 and R3 as NTP clients.

Answer:

R1(config)#ntp server 192.168.1.5

Configure for R2 and R3 too

Verify client configuration using the command show ntp status.

 

Step 3 – Configure routers to update hardware clock.

Configure R1, R2 and R3 to periodically update the hardware clock with the time learned from NTP.

Answer:

R1(config)#ntp update-calendar

Configure for R2 and R3 too

Verify that the hardware clock was updated using the command show clock.

 

Step 4 – Configure routers to timestamp log messages.

Configure timestamp service for logging on the routers.

Answer:

R1(config)#service timestamps log datetime msec

Configure for R2 and R3 too

 

Configure routers to log messages to the Syslog Server.

Step 1. Configure the routers to identify the remote host (Syslog Server) that will receive logging messages.

R1(config)#logging host 192.168.1.6

Configure for R2 and R3 too

The router console will display a message that logging has started.

 

Step 2. Verify logging configuration using the command show logging.

 

Step 3. Examine logs of the Syslog server.

From the Config tab of the Syslog server’s dialogue box, select the Syslog services button. Observe the logging messages received from the routers.

Note: Log messages can be generated on the server by executing commands on the router. For example, entering and exiting global configuration mode will generate an informational configuration message.

 

Configure Router SSH Connection.

Step 1. Configure a domain name.

Configure a domain name of ccnasecurity.com on R3.

R3(config)#ip domain name ccnasecurity.com

 

Step 2. Configure users for login from the SSH client on R3.

Create a user ID of SSHadmin with the highest possible privilege level and a secret password of ciscosshpa55.

R3(config)#username SSHadmin privilege 15 secret ciscosshpa55

 

Step 3. Configure the incoming VTY lines on R3.

Use the local user accounts for mandatory login and validation. Accept only SSH connections.

R3(config)#line vty 0 4
R3(config-line)#privilege level 15
R3(config-line)#login local
R3(config-line)#transport input ssh

 

Step 4. Erase existing key pairs on R3.

Any existing RSA key pairs should be erased on the router.

R3(config)#crypto key zeroize rsa

Note: If no keys exist, you might receive this message: % No Signature RSA Keys found in configuration.

 

Step 5. Generate the RSA encryption key pair for R3.

The router uses the RSA key pair for authentication and encryption of transmitted SSH data. Configure the RSA keys with a modulus of 1024. The default is 512, and the range is from 360 to 2048.

R3(config)# crypto key generate rsa [Enter]
The name for the keys will be: R3.ccnasecurity.com
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]:1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

Note: The command to generate RSA encryption key pairs for R3 in Packet Tracer differs from those used in the lab.

 

Step 6. Verify the SSH configuration.

Use the show ip ssh command to see the current settings. Verify that the authentication timeout and retries are at their default values of 120 and 3.

 

Step 7. Configure SSH timeouts and authentication parameters.

The default SSH timeouts and authentication parameters can be altered to be more restrictive. Set the timeout to 90 seconds, the number of authentication retries to 2, and the version to 2.

R3(config)#ip ssh time-out 90
R3(config)#ip ssh authentication-retries 2
R3(config)#ip ssh version 2

Issue the show ip ssh command again to confirm that the values have been changed.

R3#show ip ssh
SSH Enabled – version 2.0
Authentication timeout: 90 secs; Authentication retries: 2

 

Step 8. Attempt to connect to R3 via Telnet from PC-C.

Open the Desktop of PC-C. Select the Command Prompt icon. From PC-C, enter the command to connect to R3 via Telnet.

PC> telnet 192.168.3.1
This connection should fail, since R3 has been configured to accept only SSH connections on the virtual terminal lines.

 

Step 9. Connect to R3 using SSH on PC-C.

Open the Desktop of PC-C. Select the Command Prompt icon. From PC-C, enter the command to connect to R3 via SSH. When prompted for the password, enter the password configured for the administrator ciscosshpa55.

PC> ssh –l SSHadmin 192.168.3.1

 

Step 10. Connect to R3 using SSH on R2.

In order to troubleshoot and maintain the R3 router, the administrator at the ISP must use SSH to access the router CLI. From the CLI of R2, enter the command to connect to R3 via SSH version 2 using the SSHadmin user account. When prompted for the password, enter the password configured for the administrator: ciscosshpa55.

R2# ssh –v 2 –l SSHadmin 10.2.2.1

 

Step 11. Check results.

Your completion percentage should be 100%. Click Check Results to see feedback and verification of which required components have been completed.

 

If you want to try this packet tracer activity, you can download it here.

If you want this packet tracer activity answer 100%, download it here.

Thank You.

 

Sharing is Caring

4 thoughts on “Network Security Packet Tracer Activity Chapter 2 Answer”

Leave a Reply

Your email address will not be published. Required fields are marked *