HOW TO INSTALL AND CONFIGURE CISCO ASA 8.4 WITH ASDM ON GNS3

 CISCO ASA 8.4 WITH ASDM ON GNS3;

This guide shows you how to install ASDM for cisco ASA Firewall on GNS3. You will establish ASDM session from your machine to GNS3. So you will be building connection/bridge between GNS3 and PC. Note: First you will have to copy ASDM via TFTP to Firewall

Step 1:

Add a loopback adapter to Windows 7, Windows XP
To manually install the Microsoft Loopback adapter in Windows XP, follow these steps:

• 1. Click Start, and then click Control Panel.
• 2. If you are in Classic view, click Switch to Category View under Control Panel in the left pane.
• 3. Double-click Printers and Other Hardware, and then click Next.
• 4. Under See Also in the left pane, click Add Hardware, and then click Next.
• 5. Click Yes, I have already connected the hardware, and then click Next.
• 6. At the bottom of the list, click Add a new hardware device, and then click Next.
• 7. Click Install the hardware that I manually select from a list, and then click Next.
• 8. Click Network adapters, and then click Next.
• 9. In the Manufacturer box, click Microsoft.
• 10. In the Network Adapter box, click Microsoft Loopback Adapter, and then click Next.
• 11. Click Finish.

To manually install the Microsoft Loopback adapter in Windows 7, follow these steps:
The key step I was missing was how to find the Hardware Wizard:

• 1. Click the Start menu.
• 2. Search for “cmd“.
• 3. Right-click on “cmd” and select “Run as Administrator”
• 4. Enter “hdwwiz.exe”

From that point on it’s the same approach as under Vista, i.e.:

• 1. In the “Welcome to the Add Hardware Wizard“, click Next.
• 2. Select “Install the hardware that I manually select from a list (Advanced)” and clickNext.
• 3. Scroll down and select “Network adapters” and click Next.
• 4. Select under Manufacturer “Microsoft” and then under Network Adapter “Microsoft Loopback Adapter” and click Next.

Step 2:
Restart your PC.

Step 3:
Following this guide about how to configure cisco ASA 8.4 firewall on GNS3.
Start a new Porject in GNS3 and drag/drop a ASA (8.4) firewall to the topology.

• 1. Drag/Drop Cloud Object from Panel on the Left to the topology and right click it. Select ‘Configure‘. Select ‘C1‘ or whatever name of the object.
• 2. Now as per following diagram. Select the loopback adapter that you added in step 1.

•  diagram. Select the loopback adapter that you added in step 1.
• 3. Add the adapter as per following after selecting and press OK.
  
• 4. Drop an ethernet switch to the topology. If you don’t do this and try drawing a direct connection between Firewall and Cloud it will come up with error saying ‘Devices does not support this type of NIO. Use an ETHSW to bridge the connection to the NIO Instead.
  5. Connect both Cloud and Firewall to the Switch as picture below:
  
• 6. Now start all devices in GNS and use following commands on the firewall to give it an IP address.

ciscoasa# config t
ciscoasa(config)# int gi
ciscoasa(config)# int gigabitEthernet 0
ciscoasa(config-if)# ip address 172.30.1.1 255.255.255.0
ciscoasa(config-if)# nameif management
ciscoasa(config-if)# no shut

• 7. Now, go back to Windows 7 and open ‘Network and Sharing Centre‘, Click on Change adapter settings and Change the IP Address of the Loopback adapater as following

• 8. You will have to turn off your PC firewall. Because you will be copying ASDM to ASA firewall. If you don’t know this, stop studying networking or stop the Windows Firewall Service or if that doesn’t work then Base Filtering Service.
• 9. Now you PC is ready to talk to firewall, lets try.

ciscoasa# ping 172.30.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.30.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/20 ms
ciscoasa#

Step 4:

• 1. OK, Now the next step is to copy ASDM to Firewall. If you already have TFTP Server installed, cool otherwise Download and start this TFTP Application from following website: http://tftpd32.jounin.net/tftpd32_download.html
• 2. Download ASDM from Cisco website or any other source you have. I have ASDM 6.47Download Here:
• 3. On the TFTP application browse to the folder where you have downloaded ASDM.
• 4. On the firewall use following command to download TFTP Image.

ciscoasa# copy tftp flash
Address or name of remote host []? 172.30.1.2
Source filename []? asdm-647.bin
Destination filename [asdm-647.bin]?
Accessing tftp://172.30.1.2/asdm-647.bin.!!!!!!!
Writing current ASDM file disk0:/asdm-647.bin
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
17902288 bytes copied in 55.470 secs (325496 bytes/sec)
ciscoasa# config t
ciscoasa(config)# asdm image flash:asdm-647.bin
ciscoasa(config)# http server enable
ciscoasa(config)# http 172.30.1.2 255.255.255.255 management
ciscoasa(config)# username cisco password cisco privilege 15

• 5. Using ‘wr‘ command and then reload the firewall using ‘reload‘ command

Step 5:

• 1. Launch your browser and go to https://172.30.1.1 (Disable Proxy if you are using any)
• 2. Download and Install ASDM App from website you browsed to.
• 3. Launch the ASDM. Login username and password. Done!

How to Configure VLAN

How to Configure VLAN, STP, DTP:

• Configure Access or Trunk links
• Create VLAN
• Assign VLAN membership
• Configure Intra VLAN routing
• Configure VTP Server
• Make VTP Clients
• Show STP Static
• Configure DTP port

To complete these lab either create a topology as shown in figure:--



PC configurations :-

Devices	IP Address	VLAN	Connected With
PC0	10.0.0.2	VLAN10	Switch1 on F0/1
PC1	20.0.0.2	VLAN20	Switch1 on F0/2
PC2	10.0.0.3	VLAN10	Switch2 on F0/1
PC3	20.0.0.3	VLAN20	Switch2 on F0/2
PC4	10.0.0.4	VLAN10	Switch3 on F0/1
PC5	20.0.0.4	VLAN20	Switch3 on F0/2

2960 – 24 TTL Switch 1 Configuration:-

Port Connected to	VLAN	LINK	STATUS
F0/1 With PC0	VLAN10	Access	OK
F0/2 With PC1	VLAN20	Access	OK
Gig1/1 With Router	VLAN 10,20	Trunk	OK
Gig 1/2 With Switch2	VLAN 10,20	Trunk	OK
F0/24 Witch Switch2	VLAN 10,20	Trunk	OK

2960 – 24 TTL Switch 2 Configuration:-

F0/1 With PC0	VLAN10	Access	OK
F0/2 With PC1	VLAN20	Access	OK
Gig 1/2 With Switch1	VLAN 10,20	Trunk	OK
Gig 1/1 With Switch3	VLAN 10,20	Trunk	OK
F0/24 Witch Switch1	VLAN 10,20	Trunk	Blocked
F0/23 Witch Switch3	VLAN 10,20	Trunk	OK

2960 – 24 TTL Switch 3 Configuration:-

F0/1 With PC0	VLAN10	Access	OK
F0/2 With PC1	VLAN20	Access	OK
Gig 1/1 With Switch2	VLAN 10,20	Trunk	OK
F0/24 Witch Switch1	VLAN 10,20	Trunk	Blocked

Task

You are the administrator at ComputerNetworkingNotes.com. company have two department sales and management. You have given three pc for sales and three pc in management. You created two VLAN. VLAN 10 for sales and VLAN20 for management. For backup purpose you have interconnected switch with one extra connection. You have one router for intera VLAN communications.

Let's start configuration first assign IP address to all pc's
To assign IP address double click on pc and select ip configurations from desktop tab and give ip address as shown in table given above

VLAN Trunking Protocol

Configure VTP Server

We will first create a VTP Server so it can automatically propagate VLAN information to other switch. Double click on Switch1 and select CLI. Set hostname to S1 and create VTP domain name example and set password to vinita ( Remember password is case sensitive ).

 Switch 1:-

Switch>enable
Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname S1
S1(config)#vtp mode server
Device mode already VTP SERVER.
S1(config)#vtp domain example
Changing VTP domain name from NULL to example
S1(config)#vtp password Ranjith
Setting device VLAN database password to Ranjith

Configure VTP clients:-

Once you have created a VTP domain. Configure remaining Switch to Client mode.

Switch 2:-

Switch>enable
Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname S2
S2(config)#vtp mode client
Setting device to VTP CLIENT mode.
S2(config)#vtp domain example
Changing VTP domain name from NULL to example
S2(config)#vtp password Ranjith
Setting device VLAN database password to Ranjith
S2(config)#

Switch 3:-

Switch>enable
Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname S3
S3(config)#vtp mode client
Setting device to VTP CLIENT mode.
S3(config)#vtp domain example
Changing VTP domain name from NULL to example
S3(config)#vtp password Ranjith
Setting device VLAN database password to Ranjith
S3(config)#

Dynamic Trunking Protocol:-

Configure DTP port

All Switch ports remain by default in access mode. Access port can not transfer the trunk frame. Change mode to trunk on all the port those are used to interconnect the switches

Switch 1 :-

S1(config)#interface fastEthernet 0/24
S1(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/24,
changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/24,
changed state to up
S1(config-if)#exit
S1(config)#interface gigabitEthernet 1/1
S1(config-if)#switchport mode trunk
S1(config-if)#exit
S1(config)#interface gigabitEthernet 1/2
S1(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/2,
changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/2,
changed state to up
S1(config-if)#exit
S1(config)#

Switch 2:-

S2(config)#interface gigabitEthernet 1/1
S2(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/1,
changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/1,
changed state to up
S2(config-if)#exit
S2(config)#interface gigabitEthernet 1/2
S2(config-if)#switchport mode trunk
S2(config-if)#exit
S2(config)#interface fastEthernet 0/23
S2(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23,
changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23,
changed state to up
S2(config-if)#exit
S2(config)#interface fastEthernet 0/24
S2(config-if)#switchport mode trunk
S2(config-if)#exit 

 Switch 3:-

S3(config)#interface fastEthernet 0/24
S3(config-if)#switchport mode trunk
S3(config-if)#exit
S3(config)#interface gigabitEthernet 1/1
S3(config-if)#switchport mode trunk
S3(config-if)#exit

Virtual LAN (VLAN)

Create VLAN

After VTP server configuration its time to organize VLAN. We need only to create VLAN on VTP server and reset will be done by VTP Server automatically.

Switch 1 :-

S1(config)#vlan 10
S1(config-vlan)#exit
S1(config)#vlan 20
S1(config-vlan)#exit
S1(config)#

As we have already configure VTP server in our network so we don't need 
to create VLAN on S2 or S3. We need only to associate VLAN with port.

Assign VLAN membership

Switch 1:-

S1(config)#interface fastEthernet 0/1
S1(config-if)#switchport access vlan 10
S1(config-if)#interface fastEthernet 0/2
S1(config-if)#switchport access vlan 20

Switch 2:-

S2(config)#interface fastEthernet 0/1
S2(config-if)#switchport access vlan 10
S2(config-if)#interface fastEthernet 0/2
S2(config-if)#switchport access vlan 20

Switch 3:-

S3(config)#interface fastEthernet 0/1
S3(config-if)#switchport access vlan 10
S3(config-if)#interface fastEthernet 0/2
S3(config-if)#switchport access vlan 20 

Now we have two working vlan. To test connectivity do ping form 10.0.0.2 to 10.0.0.3 and 10.0.0.4. if you get successfully replay then you have successfully created VLAN and VTP server.

Spanning-Tree Protocol

In this configuration STP will block these ports F0/24 of S1 , F0/23 and F0/24 of S2 and F0/24 of S3 to avoid loop at layer to two. Verify those ports blocked due to STP functions 

Verify STP ports

 Switch 2:-

 S2#show spanning-tree active
VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     0002.174D.7794
             Cost        4
             Port        26(GigabitEthernet1/2)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     00D0.FF08.82E1
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- ---------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Fa0/2            Desg FWD 19        128.2    P2p
Fa0/23           Desg FWD 19        128.23   P2p
Fa0/24           Altn BLK 19        128.24   P2p
Gi1/1            Desg FWD 4         128.25   P2p
Gi1/2            Root FWD 4         128.26   P2p
[Output is omitted]
S2#

You can test STP protocols status on S1 and S3 also with
  show spanning-tree active command

Router on Stick

At this point of configuration you have two successfully running VLAN but they will not connect each other. To make intra VLAN communications we need to configure router . To do this double click on router and select CLI.

Configure intra VLAN:-

Router:-

Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#no ip address
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 0/0.10
Router(config-subif)#encapsulation dot1Q 10
Router(config-subif)#ip address 10.0.0.1 255.0.0.0
Router(config-subif)#exit
Router(config)#interface fastEthernet 0/0.20
Router(config-subif)#encapsulation dot1Q 20
Router(config-subif)#ip address 20.0.0.1 255.0.0.0
Router(config-subif)#exit

To test connectivity between different vlan do ping form any pc to all 
reaming pc. it should be ping successfully. If you have error download 
this configured topology and cross check that where you have committed 
mistake. 

 Configured VLAN VTP STP topology

VLAN VTP Server STP DTP command reference sheet

Switch(config)#vlan 10	Creates VLAN 10 and enters VLAN configuration mode for further definitions.
Switch(config-vlan)#name Sales	Assigns a name to the VLAN. The length of the name can be from 1 to 32 characters.
Switch(config-vlan)#exit	Applies changes, increases the revision number by 1, and returns to global configuration mode.
Switch(config)#interface fastethernet 0/1	Moves to interface configuration mode
Switch(config-if)#switchport mode access	Sets the port to access mode
Switch(config-if)#switchport access vlan 10	Assigns this port to VLAN 10
Switch#show vlan	Displays VLAN information
Switch#show vlan brief	Displays VLAN information in brief
Switch#show vlan id 10	Displays information about VLAN 10 only
Switch#show vlan name sales	Displays information about VLAN named sales only
Switch#show interfaces vlan x	Displays interface characteristics for the specified VLAN
Switch#delete flash:vlan.dat Delete filename [vlan.dat]? Delete flash:vlan.dat? [confirm] Switch#	Removes the entire VLAN database from flash. Make sure there is no space between the colon (:) and the characters vlan.dat. You can potentially erase the entire contents of the flash with this command if the syntax is not correct. Make sure you read the output from the switch. If you need to cancel, press ctrl+c to escape back to privileged mode:
Switch(config)#interface fastethernet 0/5	Moves to interface configuration mode.
Switch(config-if)#no switchport access vlan 5	Removes port from VLAN 5 and reassigns it to VLAN 1—the default VLAN.
Switch(config-if)#exit	Moves to global configuration mode.
Switch(config)#no vlan 5	Removes VLAN 5 from the VLAN database.
Switch#copy running-config startupconfig	Saves the configuration in NVRAM
Switch(config-if) #switchport mode trunk	Puts the interface into permanent trunking mode and negotiates to convert the link into a trunk link.
Switch(config)#vtp mode server	Changes the switch to VTP server mode.
Switch(config)#vtp mode client	Changes the switch to VTP client mode.
Switch(config)#vtp mode transparent	Changes the switch to VTP transparent mode.
Switch(config)#no vtp mode	Returns the switch to the default VTP server mode.
Switch(config)#vtp domain domain-name	Configures the VTP domain name. The name can be from 1 to 32 characters long.
Switch(config)#vtp password password	Configures a VTP password .
Switch(config)#vtp pruning	Enables VTP pruning
Switch#show vtp status	Displays general information about VTP configuration
Switch#show vtp counters	Displays the VTP counters for the switch

 

 

  

How To Remove GPO From System

Instructions:

 1. Click on "Start," type "regedit" in the search box and press "Enter." Once the registry opens, right-click on "Computer" at the top and select "Export." Depending on how many registry keys you have this may take a few minutes.

 2. Save the backup that you created to a removable storage device in the event that you need to access it. Click on "Start," type "regedit" in the search box and press "Enter." Click the arrow next to the primary registry key labeled "HKEY_LOCAL_MACHINE" to expand the registry key
Moves all your apps and files to new PC, Windows 7!  

3.Navigate to the "Software" folder and click on the arrow next to the folder to expand the contents. Click on the arrow next to the "Policies" folder. Scroll down to the "Microsoft" folder under "Policies," click on the folder to highlight the folder and press the "Delete" key on your keyboard. 

4.Click on the arrow next to the "HKEY_LOCAL_MACHINE" to collapse the folders. Navigate registry key folder labeled "HKEY_CURRENT_USER" and click on the arrow to expand the folder. Locate the "Software" folder and click the arrow to expand it. Double-click the "Policies" folder, click to highlight the folder labeled "Microsoft" and delete the folder.

 5.Click the arrow to expand the "Microsoft" folder located in the "Software" folder of the "HKEY_CURRENT_USER" registry folder. Click the arrow to expand the "Windows" folder. Double-click the "CurrentVersion" folder to show "Group Policy Objects" and "Policies." Delete both of these folders.

 6.Exit the Registry Editor and restart the computer. After the computer restarts, the Domain Group Policy will no longer be in effect.


Read more: How to Remove the Domain Group Policy From a Machine | eHow.com http://www.ehow.com/how_7824176_remove-domain-group-policy-machine.html#ixzz2DmuakdQs




       

Cisco Basic Switch configurations commands

User vs. Privileged Mode

User mode is indicated with the > next to the switch name. You can look at settings but can not make changes from user mode. In Privilege mode, indicated by the #, you can do anything. To get into privilege mode the keyword is enable.

HELP

To view all commands available from this mode type:?This will give you the list of all available commands for the switch in your current mode. You can also use the question mark after you have started typing a command. For example if you want to use a show command but you do not remember which one it is, use the ? as this will output all commands that you can use with the show command.

Configuration Mode

From privilege mode you can enter configuration mode by typing config term command you can exit configuration mode type type end or <CTL>+z

Configuration of Cisco 2960 Switch

To practically implement these command either create a simple topology on packet tracer or download this topology.
Ddownload Topology


Now click on any switch and configure it as given below
To know all available command on user exec mode type ? and press enter

In Cisco Terminal

Switch>?
Exec commands:
    [1-99]         Session number to resume
    connect        Open a terminal connection
    disconnect     Disconnect an existing network connection
    enable         Turn on privileged commands
    exit           Exit from the EXEC
    logout         Exit from the EXEC
    ping           Send echo messages

[Output is omitted]

Three command can be used to logout from terminal. 

Switch>enable
Switch#disable
Switch>exit

Switch con0 is now available

Press RETURN to get started.

show version Command will display  the device platform, detected interface, ios name 

Switch>enable
Switch#show version
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version
12.2(25)FX, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Wed 12-Oct-05 22:05 by pt_team
ROM: C2960 Boot Loader (C2960-HBOOT-M) Version 12.2(25r)FX,
RELEASE SOFTWARE (fc4)
System returned to ROM by power-on
Cisco WS-C2960-24TT (RC32300) processor (revision C0) with
21039K bytes of memory.
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)

[Output is omitted]

show mac address Command will show all detected mac address dynamically and manually 

Switch#show mac-address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

   1    0001.643a.5501    DYNAMIC     Gig1/1

To view run time configuration of RAM use show running-config command

Switch#show running-config
Building configuration...
Current configuration : 925 bytes
version 12.2
no service password-encryption
!
hostname Switch

[Output is omitted]

To view startup configuration [ Stored in NVRAM] use show startup-config command 

Switch#show startup-config
Current configuration : 925 bytes
version 12.2
no service password-encryption
!
hostname Switch

[Output is omitted]

To get information about VLAN configuration use show vlan command 

Switch#show vlan

VLAN Name                      Status    Ports
---- -------------------------------- --------- -----------------------
1    default                   active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                         Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                         Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                         Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                         Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                         Fa0/21, Fa0/22, Fa0/23, Fa0/24
[Output is omitted] 

show interface command will show all detected interface with their hardware description and configuration

Switch#show interfaces
FastEthernet0/1 is up, line protocol is up (connected)
  Hardware is Lance, address is 0060.2f9d.9101 (bia 0060.2f9d.9101)
  MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
[Output is omitted] 

interface vlan 1 is used to assign ip address and default gateway to switch. Show interface vlan 1 will give a over view of vlan1.

Switch#show interface vlan1
Vlan1 is administratively down, line protocol is down
  Hardware is CPU Interface, address is 0060.5c23.82ae
   (bia 0060.5c23.82ae)
  MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00

[Output is omitted] 

delete command is used to delete all vlan configuration 
from switch Don’t add space between flash and vlan.dat Run this exactly 
shown here adding a space could erase flash entirely leaving switch 
blank 

Switch#delete flash:vlan.dat
Delete filename [vlan.dat]?
Delete flash:/vlan.dat? [confirm]
%deleting flash:/vlan.dat 

Startup configuration can be removed by erase commands

Switch#erase startup-config
Erasing the nvram filesystem will remove all configuration files!
Continue? [confirm]
[OK]
Erase of nvram: complete
%SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram 

Basic Switch Configuration Step by Step:

use configure terminal command to go in global configuration mode 

Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.

Now change default switch name to switch 1 

Switch(config)#hostname Switch1

Set enable password to Ranjith and secret to Thulasi

Switch1(config)#enable password Ranjith
Switch1(config)#enable secret Thulasi

Set console password to vinita and enable it by login command.
Order of command is important. Set password before you enable it.

Switch1(config)#line console 0
Switch1(config-line)#password vinita
Switch1(config-line)#login
Switch1(config-line)#exit 

Enable 5 telnet session [ vty0 - vty4] for router and set their password to Ranjith

Switch1(config)#line vty 0 4
Switch1(config-line)#password vinita
Switch1(config-line)#login
Switch1(config-line)#exit 

Now set switch ip address to 192.168.0.10 255.255.255.0 and default gateway to 192.168.0.5 

Switch1(config)#interface vlan1
Switch1(config-if)#ip address 192.168.0.10 255.255.255.0
Switch1(config-if)#exit
Switch1(config)#ip default-gateway 192.168.0.5 

Set a description finance VLAN to interface fast Ethernet 1 

Switch1(config)#interface fastEthernet 0/1
Switch1(config-if)#description finance VLAN 

By default switch automatically negotiate speed and duplex but you can adjust it manually 

Switch1(config-if)#duplex full
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
 changed state to downSwitch1
(config-if)#duplex auto
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
Switch1(config-if)#duplex half
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
changed state to down
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
Switch1(config-if)#duplex auto
Switch1(config-if)#speed 10
Switch1(config-if)#speed 100
Switch1(config-if)#speed auto
Switch1(config-if)#exit
Switch1(config)#exit

mac address table can be wiped out by clear commands 

Switch1#show
Switch1#show mac-address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

   1    0001.643a.5501    DYNAMIC     Gig1/1
Switch1#clear mac-address-table
Switch1#clear mac-address-table ?
  dynamic  dynamic entry type
Switch1#clear mac-address-table dynamic 

To restart switch use reload command [ running configuration will be erased so copy it first to startup configuration ] 

Switch1#reload
Proceed with reload? [confirm]
Switch con0 is now available
Press RETURN to get started. 

 

How to configure samba server in Linux

 samba server in Linux

Most Linux systems are the part of networks that also run Windows systems. Using Linux Samba servers, your Linux and Windows systems can share directories and printers. This is most use full situation where your clients are window native and you want to use the linux security features.

Exam question There are mixed lots of System running on Linux and Windows OS. Some users are working on Windows Operating System. There is a /data directory on linux server should make available on windows to only vinita should have right to connect with samba server . Configure to make available.

Configure samba server

In this example we will configure a samba server and will transfer files from client side.For this example we are using two systems one linux server one window clients.
per quest of samba server

• A linux server with ip address 192.168.0.254 and hostname Server
• A window client with ip address 192.168.0.2 and hostname Client2
• Updated /etc/hosts file on linux system
• Running portmap and xinetd services
• Firewall should be off on server

We have configured all these steps in our pervious article.
We suggest you to review that article before start configuration of samba server. Once you have completed the necessary steps follow this guide.

samba rpm is required to configure samba server. check them if not found then install


Now check smb, portmap, xinetd service in system service it should be on

 #setup Select  System service from list
 [*]portmap
 [*]xinetd
 [*]smb

Now restart  xinetd and  portmap and  smb service
  

To keep on these services after reboot on then via  chkconfig command
 
 After reboot verify their status. It must be in running condition
 

Create a normal user named vinita

now create /data directory and grant it full permission

open /etc/samba/smb.conf main samba configuration files

By default name of workgroup is MYGROUP in smb.conf file. you can change it with desire name

our task is to share data folder for vinita user so go in the end of file and do editing as shown here in this image

save file with :wq and exit
Now add vinita user to samba user

we have made necessary change now on smb service and check it status

if you already have on this service then restart it with service smb restart commands.

Client configuration for samba server

Go on windows system and ping samba server, change computer name to client2 and workgroup name to MYGROUP

reboot system after changing workgroup name
After reboot open my network place here you can see samba server [ if not see then click on view workgroup computer in right pane, if still not see then use search button from tool bar and search computer samba server form ip ]

First try to login from user nikita she will not successes as nikita have not permission to login

Now login from user vinita [ give the password which you set with smbpasswd command ]

As you can see in image user vinita gets the /data folder which we share from samba server

Copy some window files in data folder

Check status on samba server

on samba server you can check runtime status of samba server to check it run smbstatus command

in output you see that one samba shared directory is used on window system

How to Start Networking in Backtrack

This is always a huge topic and it seems simple to many of us but the fact of the matter is we have a lot of "new" people so we need to be clear about this sort of thing. (Note all commands should be run as root or with sudo)

1. To start networking in Backtrack 4 final issue the following command.

/etc/init.d/networking start

This will attempt to start all the interfaces in the /etc/network/interfaces file.

root@bt:~# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto eth1
iface eth1 inet dhcp

auto eth2
iface eth2 inet dhcp

auto ath0
iface ath0 inet dhcp

auto wlan0
iface wlan0 inet dhcp

If you don't have or don't want some of these interfaces then simply remove the from this file and they will not start.

If you need to set a static IP just set the variables in the /etc/network/interfaces file

auto eth0
iface eth0 inet static
address 192.168.0.100
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1

You will also need to make sure you set a nameserver in /etc/resolv.conf

root@bt:~# cat /etc/resolv.conf
nameserver 192.168.0.1

So for example if all you have is eth0 and wlan0 on your system and you want them both to get a adress via DHCP then remove every thing else for the file with the exception of the lo interface. Here is a example.

root@bt:~# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto wlan0
iface wlan0 inet dhcp


Now if are lazy and want all this to start at boot you can simply issue this command as root

update-rc.d networking defaults

This will create all the proper sym-links

What about ssh?

So while I am on the subject I may as well go over ssh. In order to use ssh on backtrack 4 final you need to generate the keys first.

sshd-generate

after that you can start ssh like this:

/etc/init.d/ssh start

or you can add it to the boot sequence like this:

update-rc.d ssh defaults

Well thats enough to get up and running. I hope this was somewhat helpful to any one just getting started with backtrack.

Web Content Filtering with DansGuardian

 "Learn how to setup a parental blocker to protect yourself and your network from potentially harmful sites."

Requirements:

• A Linux distro
• Internet Access
• Administrative Privileges*

*If you are not logged in as root, you may need to type "sudo" prior to any command - this runs the command as the administrator. A password will need to be provided the first time it's used

DansGuardian:

DansGuardian is software that has "smart" web content filtering. It looks at all of the text in a web page and has different "weights" for specific words. For example: "Breast Cancer". The word "Breast" may have a weight of (+5), and "Cancer" may have a weight of (-10). Combined, the weight is (-5). If the weight of the page exceeds a particular amount, the page is blocked. Together with the proxy server Squid, we can direct ALL HTTP traffic to Dans Guardian for filtering. Normally it would be easy for the user to just reconfigure the proxy settings in their web browser to work around it, but we'll show you how that wouldn't have any effect on our filter.

Step 1: Install "dansguardian"

You can use your package manager to find, download, and install "dansguardian". Using "apt-get" or "yum" would work for most distros. Dansguardian should be in most major repositories (Ubuntu contains it for sure).
If you would like to download the package yourself, you can download it from the DansGuardian download page.

Step 2: Install "squid"

Just as the previous step, look for "squid" in your package manager and download/install it. It should definitely be in your repositories. Otherwise you can download it from their download page.

Step 3: Configure Squid

Next we need to make sure squid is configured properly. We want squid to run "transparently" in the background, so we need to modify its configuration file. To do so, run the following command in the terminal:

 username@localhost:$ sudo gedit /etc/squid/squid.conf

Now search for the line that has "http_port" in it. Ther will be a few in the commented sections, but we're looking for the one that has its default port listed. It should be something like "http_port 3128".
Once you have found this line, add the word "transparent" right after it:
"http_port 3128 transparent"
Make sure you save, then exit. This is all we needed to do to configure Squid.

Step 4: Configure DansGuardian

DansGuardian allows us to make precise configurations in order to make the slightest changes to details according to our needs. We can change a whole ton of things in the configuration file. Here I will take you through the simplest ways in order to just get it running. Later, I'll show you how to change the "Access Denial" page to customize it in anyway you wish (optional, of course). But for now, we need to open up the configuration file by typing the following command:

username@localhost:$ sudo gedit /etc/dansguardian/dansguardian.conf

The first thing we want to do is find the line that tells DansGuardian which port to look for our Squid proxy server that we had just setup. We need to find the line that says "proxyport = ". By default, it may already have the proper port "3128". Make sure it does, and also make sure our "filterport=" is set to "8080": 

"proxyport = 3128"
"filterport = 8080"

The last line we need to edit is the "UNCONFIGURED" line. This line is up near the top of the file, and says something like: "UNCONFIGURED - Please remove this line after configuration". This is DansGuardian's way of knowing that we have setup the configuration file and are ready for it to start using our configurations. You can either remove this line entirely, or comment it out by placing a "#" in front of it.

Once completed, save the file and exit. 

Step 5: Restart Squid and DansGuardian

You can restart Squid and DansGuardian by rebooting your computer, or typing the following lines, in order:

 username@localhost:$ sudo /etc/init.d/squid restart

username@localhost:$ sudo dansguardian -q

username@localhost:$ sudo dansguardian

Now, if you try to go to our "BAD" test page, you should still get through. This is because we need to setup our web browser to follow the proxy server settings.

Step 6: Setup Web Browser's Proxy Server Settings

Each web browser has their settings in a different location - but most are within a "Preferences" or "Options" menu. Locate the settings window and change the settings to the following:

Manual Proxy Settings
HTTP Proxy - "localhost:8080"

This will tell the browser to use the proxy server instead of directly connecting to the internet. Once completed, close out and try accessing this page again. At this point, you should see a denial page from DansGuardian. The question is, if it's that easy to change proxy settings, why can't they just change it back? That's what the next step will take care of...

Step 7: Direct All HTTP Traffic Through Squid

We really want to make sure that all of the HTTP (port 8080) traffic is sent through Squid, and therefore, through DansGuardian. To test this, we can run the following command:

username@localhost:$ iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080

This tells the system that for ANY HTTP traffic (any "port 80", including port "8080") should be redirected to port "8080", which is where Squid resides. This way, whether the browsers are set to listen to the proxy, or are told to connect directly to the internet, it will ALWAYS be redirected to our proxy. This is technically modifying iptables, so if you have a separate firewall installed, you may need to configure it. Ubuntu users from a fresh-install (no firewalls added) - this will work just fine as is.

Now you can reconfigure your browser to NOT listen to the proxy (connect directly to the internet) - and try accessng this page again. You should still see the rejection page.

This command will stay in effect until the system is rebooted. So to make it always run upon startup, we need to place an executable script in "/etc/init.d/" with that command in it. Let's call it "tproxy":

username@localhost:$ sudo gedit /etc/init.d/tproxy

This will create that file and bring up gedit. So just paste the above command ("iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080") into the file. Save and exit gedit.

Now we need to make it executable. You can do that by running this command:

username@localhost:$ sudo chmod a+x /etc/init.d/tproxy

Lastly, we need to tell the system to run this script at startup. Do this by running the command:

username@localhost:$ sudo update-rc.d tproxy defaults

Now the iptable redirection will occur at every starup. Because Squid and DansGuardian also run at startup, you will constantly have web filtering on your machine - reguardless of what other users may attempt to do. Of course, this is all based on the assumption that the other users don't have the root password!

Step 8: Customizing Rejection Page (Optional).

You can easily customize the rejection page of DansGuardian simply by replacing the one they have by default. The default location of this file is in the following (assuming English version was downloaded):

"/etc/dansguardian/languages/ukenglish/template.html"

You can replace it with something like my example page.

One neat thing about DansGuardian is you can place variable names within your HTML page, and when DansGuardian retrieves the HTML page, it replaces those variables with actual text. Let's take a look at what variables we have:

       

-URL-                                gives the URL the user was trying to access

-REASONGIVEN-            gives the "nice" reason (i.e. not quoting the banned phrase)

REASONLOGGED-         gives the reason that gets logged including full details

-USER-                              gives the username (if known)

-IP-                                     gives the originating IP address   

-HOST-                               gives the originating host name (if known)    

-RAWFILTERGROUP-     gives the group number

-FILTERGROUP-              gives the group name

-SERVERIP-                      gives the IP address on which the filter is running

-BYPASS-                          gives a URL which allows temporary bypass of denied page

-CATEGORIES-                gives the categories assigned to the banned content

Note that all of these "variables" have dashes on either side of them "-variable-". This tells DansGuardian that it's a variable and not plain text.
With these in hand, you can whip up a pretty slick-looking denail page if you know a little HTML. Otherwise you can use the default page, or my page and save it as "template.html" in the language directory. 

Step 9: View Log of Denials (Optional)

So you have all of this setup and everything, but how to we see who was denied what and when? Of course DansGuardian logs everything, and does a pretty good job of it too. And of course, you can specify where it writes the logs to in the configuration file.
By default, it keeps the log file here:

"/var/log/dansguardian/access.log"

To change this, open up the "dansguardian.conf" file as root and find where it says "loglocation = ", and specify where you want it. You even have different options for log file format! You can leave it as default, or you can change that as well (search for "logfileformat = ") and changing it to something like option 4. You can also change WHAT it logs. By default, it logs everything. This can be space-consuming, and make it harder to see what denials have occured. I changed my setting ("loglevel = ") to 1 - which is "just denied".

Once we have this updated, we need to reload the configuration files. We can do this by running the following command:

username@localhost:$ sudo dansguardian -r

 

Step 10: Allowing Blocked Sites/Denying Allowed Sites (Optional)

Ok so DansGuardian does a really good job of blocking sites, sometimes TOO good. We may want to access sites that are blocked, but for reasons that aren't that relavent to us.

DansGuardian has a bunch of various lists that we can use. Depending on what we want to do, there will be a list for it. Keep in mind that in order to modify all lists, we need to have root access (makes sense, huh?)

Here are the lists and what they are used for:

Banned Lists (/etc/dansguardian/lists/)

bannedextensionlist          denies any file with an extension in this list

bannediplist                       denies access to any IP address in this list

bannedmimetypelist          denies access to certain MIME types

bannedphraselist                denies access to a page that contains any phrase in this list

bannedregexpheaderlist     bands certain outgoing HTTP headers in list

bannedregexpurllist           bands regular expression URLs

bannedsitelist                     denies access to particular websites - includes some in blacklists folder

bannedurllist                     denies access to certain pages of a website - such as   

                                             "example.com/badpart/"    where        

                                               "example.com" would still be allowed

Exception Lists (/etc/dansguardian/lists/) 

exceptionextensionlist               allows any file with an extension in this list

exceptioniplist                           allows access to any IP address in this list

exceptionmimetypelist              allows access to certain MIME types

exceptionphraselist                    allows access to a page that contains any phrase in this list

exceptionregexpheaderlist         allows certain outgoing HTTP headers in list

exceptionregexpurllist               allows regular expression URLs

exceptionsitelist                         allows access to particular websites

exceptionurllist                          allows access to certain pages of a website - such as    

                                                   "bad.com/goodpart/"

                                                    where the rest of "bad.com" would still be blocked

                  

There are a handful of more lists in this directory that you may explore for yourself...............