By this time, you should already have the Packet Tracer download and have it installed on your computer. Open the program and select the router from the lower left-hand corner, and drag it into the center of the sandbox screen as seen below. (Click for larger picture)

We will be setting up a very basic network that allows two computers to communicate, so the next step is to select end devices from the bottom left-hand corner and drag it to the sandbox screen. Do this twice to make two computers appear below the router.

Now select connections from the same bottom left-hand corner. When you connect like-devices(Such as a router and computer)  you use a crossover cable, so you should select copper cross-over cable from the second menu to the immediate right. Click on Router0, and connect the cable via FastEthernet0/0 as seen below:

Now click the PC0 and select FastEthernet. You will notice that although a link is established, it is not functional. You can tell by the red dots that are present on both ends of the connection. Once the router is configured correctly, the red dots will turn green to indicate the devices are able to communicate.

Do the same operation to PC1, only this time connect the cable to FastEthernet0/1 since FastEthernet0/0 is already taken by PC0. Your network should be similar to the one below at this point:

Configuring The Router In Packet Tracer

A router that is turned off doesn’t work very well! Click on your router to bring up the configuration menu and verify that it is turned on.When on, there will be a small green light below the switch as seen in the diagram.

Next we have to open the Ethernet ports to allow communication. Although they are physically connected, they are in a state that is known as being in administrative shut down. Now click on the CLI tab to access the configuration menu. If you’ve used the Cisco IOS before, you will notice it looks and acts the same way.

1. Press RETURN to start the session

2. Type enable to get to privileged mode (this gives you more options in configuring the router)

3. Type config terminal (or config t for short) to access the configuration menu.

4. Type interface fastethernet0/0 to access Ethernet0/0

5. Type ip address 192.168.10.1  255.255.255.0 to assign an IP address and subnet mask to the interface.

6. Type no shutdown to open the interface up for business.

That’s it! You should now see a message similar to the following:

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

Now we have to do the same thing for fastethernet0/1. If you don’t, there still won’t be a connection to PC1! Make sure to enter the IP address carefully as seen below:

1. Press Ctrl + Z to go back to the previous mode.

1. Type interface fastethernet0/1

2. Type ip address 192.168.20.1  255.255.255.0

3. Type no shutdown

At this point our router is configured properly. If you test out a ping, you will notice that the computers still don’t communicate, however!

Configuring The Gateway In Packet Tracer

Our last step is to configure the gateway on each desktop computer. The gateway is the address we assigned to the Ethernet port that the desktop is connected to. It will allow the computer to interface with another network, so our ping won’t work without it!

Click on PC0 to bring up the configuration menu. Under global settings you will find a field for the gateway. Enter the corresponding IP address of the router’s interface, which is 192.168.10.1. Then click the FastEthernet tab on the left column to set the actual computer’s IP address to be on the network. Use 192.168.10.2 for the IP address, and 255.255.255.0 for the subnet mask.

Do the same thing for PC1, only use 192.168.20.1 for the gateway address, 192.168.20.2 for the IP address, and 255.255.255.0 for the subnet mask. You can confirm that your network works by sending out a packet of information from PC0 to PC1, and vice versa. Click the packet icon on the right menu as seen below:

Click on PC0 and then click PC1. On the lower right of the screen you will see a message box that says “Successful.” If it doesn’t, you may have had a syntax error when putting in an IP address or router configuration command. Review your work or ask for help among the community if you are stuck.

Closing Comments

Congratulations! You have a small working network. A real-world application of this very network would be to have two computers connected to the Internet, whereas the router would then be connected to your telecommunications company. (Or what we would call the “cloud”)

More advanced devices and topologies won’t be so easy, but you’re now on the right path to becoming qualified for the CCNA certification exam.

Enable Password – The Most Basic Of Security Features

The two most basic of passwords a Cisco router can provide support for is the enable password and enable secret commands. Depending on the IOS version, administrators will likely only need to setup the enable secret command.

For Cisco routers running IOS versions before version 10.3, enable password is going to be used. It is the outdated version of the two, and we’ll see why it isn’t used in average applications after we enable it. You can enable this basic password following the commands seen below.

Router> enable

Router# config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# enable password mypassword

In this example, mypassword is the new password that is going to be set on the router. Try typing exit and navigate to the privileged mode, as seen below.

Router> enable

Password:

You’ll notice that before we can get into privileged mode, we have to enter the password we set earlier. If you followed the above example, you should be able to input mypassword and press Enter. You are now authenticated for privileged mode!

So why don’t we use the enable password command in most cases? The answer is simple: it’s an outdated format that anyone can have ample opportunity to take advantage of. Try following the below steps and note what you see.

Router# show running-config

Building configuration…

Current configuration : 162 bytes

!

version 12.2

no service password-encryption

!

hostname Router

!

!

enable password mypassword

!

As you can see, anyone can see the password in plain view. This is because it is stored as plain text- no encryption is being used! To help cover this vast security hole, Cisco created the enable secret command. As you can probably guess, it makes use of encryption this time around.

Enable Secret – An Evolved Form Of The Previous Example

Encryption can be a tough subject to tackle. But Cisco has made the process of enabling an encrypted password just as easy as the previous example. In fact, we are only changing one word in the process!

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#enable secret mypassword

Note that many routers will alert the user at this point if they have made the enable secret and the enable password values the same in terms of the password. Although the message that results is just a warning, and administrators can indeed set both to the same thing (although this is not recommended as it will almost defeat the purpose of the enable secret command).

Now let’s go back to the very beginning, and try logging back into privileged mode once more. We’ll take a look at the running configuration in the below example.

Router# show running-config

Building configuration…

Current configuration : 209 bytes

!

version 12.2

no service password-encryption

!

hostname Router

!

!

enable secret 5 $1$mERr$7sOd0mgRuXYhHwfWsV4QZ/

enable password mypassword

!

Notice how the enable secret password is unreadable, while the outdated command enable password is being displayed in plain view! Obviously, it comes as to no surprise that Cisco decided to do away with the command in order to improve network security.

Closing Comments

We’ve discussed only two of the five different passwords that Cisco allows network administrators to take advantage of. If you’d like to take security a step further, be sure to check out the next section that discusses subjects such as Telnet passwords, console passwords, and even auxiliary passwords!

How a Smurf Attack Works

Smurf attacks are a type of denial of service attack, in which the Internet Control Message Protocol (ICMP) and broadcasts are being exploited. Normal ICMP requests (commonly referred to as pings) are used to verify network connectivity. But since they require a response from the target machine, they can maliciously be used to consume network resources if many are sent at once.

Broadcasts come into the equation, however, since they give capability to send requests to every computer on a network. Obviously if a broadcast were to be sent multiple times, the traffic would slow down the network. Imagine 100 computers sending back an ICMP request at the same time- network performance would take a huge dip.

It should be noted that smurf attacks work via an attacker spoofing the IP address of the broadcast. The IP address is actually the IP address of the victim the attacker chooses. When every computer on the network responds to the ICMP request, all of these requests go to the computer the attacker borrowed the IP address from. In this instance, the network only acts as an amplifier to the attack, not necessarily the victim.

Unfortunately, smurf attacks leave little room for victims to recover from an attack. Instead, the attack must be staved off at the network level via filtering. We can do this specifically through the no ip directed-broadcast command in Cisco routers.

No IP Directed-Broadcast

An IP Directed-Broadcast is simply an IP packet, of which has a destination address of a particular IP subnet. The broadcast in this instance is sent from a different network, as one could probably guess from the command name. (The broadcast is being directed via IP, not a unicast address.)

Keep in mind that if you are running a Cisco IOS version 12.0 or above, you do not need to follow these steps. No IP Directed-Broadcast was enabled by default after IOS 12.0. It is strongly recommended that No IP Directed-Broadcast be enabled if your IOS version is below 12.0. If you aren’t sure which version you have, simply type in the following commands from user exec mode:

As you can tell in the above example, the version number is higher than 12.0. In this instance, we would not need to take further action. If the number happens to be below 12.0, then you will need to apply the No IP Directed-Broadcast command. First, you should find out the naming convention for your router’s interfaces, as show below.

Now that we know our interface naming convention, FastEthernet 0/0, we can modify it. You may wish to write this down, since this will be what you will always refer to your interfaces to from now on. You may now proceed to apply the command to the interface, as seen below.

Note that we only applied this to a single interface (FastEthernet 0/0).It should be applied to all interfaces for maximum protection.

Closing Comments

Very few IP applications will make use of the IP directed broadcast, so it is almost always perfectly fine to leave it off. You can, however, configure access lists to permit or deny IP Directed-Broadcasts. This is usually only feasible with smaller networks, since access lists can be quite tedious to maintain on all but the smallest networks.

All you need to get started is a Cisco router with a console port, a rollover cable, and console port on the PC being used to program the router. Note that you’ll most likely need an RJ-45 to DB-9 adapter if your PC’s console port won’t fit an Ethernet cable.

Connecting to the Cisco Internetwork Operating System (IOS)

The Cisco Internetwork Operating System, referred to as the IOS, is the operating system of the router. It is a proprietary kernel that performs the routing, switching, internetworking, and other telecommunication features.

Keep in mind that there are many different Cisco routers that have been developed. With each release, there are updates to how the router functions and accepts commands. You should note that some commands will differ from router model to router model- but we’ll get more into this later. The differences aren’t too great, so there shouldn’t be too many troubles with this aspect.

Actually connecting to the IOS via our desktop requires special software. What we will use in these examples is HyperTerminal. It is very likely you already have it. Windows users, for instance, will find it in their Accessories folder under the Start Menu. (From there it may be listed under a communications folder.) Note that Windows Vista users did not get blessed with HyperTerminal, and so thus it must be downloaded (for free) here.

Start up HyperTerminal, and enter any connection name in the window that appears, then press OK.

Now in the resulting screen, make sure the COM port is selected next to the “Connect Using:” label. Press OK to go to the next screen. Also make sure all checkboxes are unchecked.

Now when you press OK, you will be presented with a new dialog. Be sure that you click “Restore defaults” or else the wrong configuration may be loaded. The final result in each textbox should mimic the textboxes in the following screenshot.

Now press OK. Now to show the power-on self test, or POST, power your router off and power it back on- if the screen begins cluttered with information, you’ll know everything was a success. If nothing happens, check to see if your physical configuration is right. (A rollover cable from your PC console port to the router console port- which may require a RJ-45 to DB-9 adapter.) Also check to see if you followed the HyperTerminal instructions correctly. Lastly, make sure you powered your router off and back on correctly.

What you should be seeing is the power-on self test, or POST. This is a set of tests and checks to make sure your router is configured correctly and is running without problem. It can be a few minutes before it is complete, so have patience.

Note that if you are asked to enter a setup configuration, type NO and press RETURN. Eventually you will see a “Press RETURN to get started!” prompt. Simply press enter and you’re done- you have successfully connected to a router via the console port. Now the fun part begins: configuring the router!

In the next section we will take a look at some basic router configuration commands. We will be creating passwords, modifying running configuration settings, and starting an introduction into the wonderful world or router configuration.