Layer 2 VLAN Security Answers

Packet Tracer - Layer 2 VLAN Security Topology Cisco Packet Tracer-DACCNA Security 20 Packet-Tracer-Activity-Source-Files 6.3.1.3 Packet Tracer-Layer 2 VLAN Security pla Logical ? Root) Flew Cutter ve Conch Set Tiled Blackground Viewport Environment: 03:00:00 Cloud-FT Cloudo 095UT-24 Central onnection Gigabit Connection 7-24 FC-PT C1 Management VLAN20 C2 VLANIO VLANIO C4 VLANS 01 VLANS VLANS 629 03 VLANS D4 VLAN10 PX T: 00:00:04 Power Cycle Devices Fast Forward Time Realtime Objectives Connect a new redundant link between SW-1 and SW-2. Enable trunking and configure security on the new trunk link between SW-1 and SW-2. Create a new management VLAN (VLAN 20) and attach a management PC to that VLAN. Implement an ACL to prevent outside users from accessing the management VLAN. Background/Scenario A company's network is currently set up using two separate VLANs: VLAN 5 and VLAN 10. In addition, all trunk ports are configured with native VLAN 15. A network administrator wants to add a redundant link between switch SW-1 and SW-2. The link must have trunking enabled and all security requirements should be in place. In addition, the network administrator wants to connect a management PC to switch SW-A. The administrator would like to enable the management PC to connect to all switches and the router, but does not want any other devices to connect to the management PC or the switches. The administrator would like to create a new VLAN 20 for management purposes. All devices have been preconfigured with: Enable secret password: ciscoenpa55 Console password: ciscoconpa55 SSH username and password: SSHadmin / ciscosshpa55 Part 1: Verify Connectivity Step 1: Verify connectivity between C2 (VLAN 10) and C3 (VLAN 10). Step 2: Verify connectivity between C2 (VLAN 10) and D1 (VLAN 5). Note: If using the simple PDU GUI packet, be sure to ping twice to allow for ARP. Part 2: Create a Redundant Link Between SW-1 and SW-2 Step 1: Connect SW-1 and SW-2 Using a crossover cable, connect port F0/23 on SW-1 to port F0/23 on SW-2. Step 2: Enable trunking, including all trunk security mechanisms on the link between SW-1 and SW-2. Trunking has already been configured on all pre-existing trunk interfaces. The new link must be configured for trunking, including all trunk security mechanisms. On both SW-1 and SW-2, set the port to trunk, assign native VLAN 15 to the trunk port, and disable auto-negotiation. SW-1 (config)# interface f0/23 SW-1 (config-if)# switchport mode trunk SW-1 (config-if)# switchport trunk native vlan 15 SW-1(config-if)# switchport nonegotiate SW-1 (config-if)# no shutdown SW-2 (config)# interface f0/23 SW-2 (config-if)# switchport mode trunk SW-2 (config-if)# switchport trunk native vlan 15 SW-2 (config-if)# switchport nonegotiate SW-2 (config-if)# no shutdown Part 3: Enable VLAN 20 as a Management VLAN The network administrator wants to access all switch and routing devices using a management PC. For security purposes, the administrator wants to ensure that all managed devices are on a separate VLAN. Step 1: Enable a management VLAN (VLAN 20) on SW-A. a. Enable VLAN 20 on SW-A. SW-A (config)# vlan 20 SW-A (config-vlan)# exit b. Create an interface VLAN 20 and assign an IP address within the 192.168.20.0/24 network. SW-A (config)# interface vlan 20 SW-A (config-if)# ip address 192.168.20.1 255.255.255.0 Step 2: Enable the same management VLAN on all other switches. a. Create the management VLAN on all switches: SW-B, SW-1, SW-2, and Central. SW-B (config)# vlan 20 SW-B (config-vlan)# exit SW-1(config)# vlan 20 SW-1(config-vlan)# exit SW-2 (config)# vlan 20 SW-2 (config-vlan)# exit Central (config) vlan 20 Central (config-vlan)# exit b. Create an interface VLAN 20 on all switches and assign an IP address within the 192.168.20.0/24 network. SW-B (config)# interface vlan 20 SW-B (config-if)# ip address 192.168.20.2 255.255.255.0 SW-1(config)# interface vlan 20 SW-1 (config-if)# ip address 192.168.20.3 255.255.255.0 SW-2 (config)# interface vlan 20 SW-2 (config-if)# ip address 192.168.20.4 255.255.255.0 Central (config)# interface vlan 20 Central (config-if)# ip address 192.168.20.5 255.255.255.0 Step 3: Connect and configure the management PC. Connect the management PC to SW-A port F0/1 and ensure that it is assigned an available IP address within the 192.168.20.0/24 network. Step fi: On SW-A, ensure the management PC is part of VLAN 20. Interface F0/1 must be part of VLAN 20. SW-A(config)# interface f0/1 SW-A (config-if)# switchport access vlan 20 SW-A (config-if)# no shutdown Step 5: Verify connectivity of the management PC to all switches. The management PC should be able to ping SW-A, SW-B, SW-1, SW-2, and Central. Part fi: Enable the Management PC to Access Router R1 Step 1: Enable a new subinterface on router R1. a. Create subinterface g0/0.3 and set encapsulation to dot1q 20 to account for VLAN 20. R1(config)# interface g0/0.3 R1 (config-subif)# encapsulation dotlq 20 b. Assign an IP address within the 192.168.20.0/24 network. R1 (config)# interface g0/0.3 R1 (config-subif)# ip address 192.168.20.100 255.255.255.0 Step 2: Verify connectivity between the management PC and R1. Be sure to configure the default gateway on the management PC to allow for connectivity. Step 3: Enable security. While the management PC must be able to access the router, no other PC should be able to access the management VLAN.