Posted on Leave a comment

Enable SSH on Cisco Routers and Switches

In this howto, we will see how to enable SSH on Cisco Routers and Switches. Imagine you are a network administrator in a large organization with number of switches and routers. To configure a switch or router on a far off location, there are two choices. One is to go near the switch or router to configure it. This is good but imagine how much trouble it is  to go near each and every device to configure it. The second and easy option is the remote configuration of the switch or router.

Remote configuration of a switch/router can be done using telnet or SSH protocols. But using telnet has a disadvantage. It sends data in plain text. So if you happen to type a username ad password for authentication with the switch from a remote location, it will be passed in plain text and anyone sniffing on the network can easily find out your login credentials. This is a big security risk. To overcome this problem, we should use SSH protocol for remote configuration of the switch or router.  SSH protocol is as same as telnet but it uses encryption during the communication. This makes it difficult for hackers to detect the credentials. Let’s see how to enable SSH on cisco routers and switches using IOS. Here I am using a router.

The command “conf t” enables global configuration mode of the switch or router. The “hostname R1″ command changes the default name of router to R1. The name of the router is used to generate names for the keys  by the SSH protocol. So it is necessary to change the default name of the router. The “ip domain-name shunya.com” command sets the domain name for the router. The domain name is also needed for setting name for encryption keys. ( Shunya.com is a fictional domain name I used. you can use your own domain name ).  It’s  time to set login credentials on the router. The “username admin password 123456″ command sets the username and password to admin and 123456 respectively. The “line vty 0 15″ command selects the vty lines from 0 to 15 for line configuration. The “login local” command sets the login to local router. The “exit” command takes us out of the line configuration mode to global configuration mode. it’s time to generate SSH keys.

The “crypto key generate rsa” command generates the cryptographic keys using Rivest Shamir Adlemann algorithm. You will be prompted to enter the number of bits in the modulus. Setting it too low will be too easy to crack. Setting it too high will be time consuming. I set it to 1024.

Let’s see the information about SSH protocol we enabled on the router.

The “show ip ssh” command does this. The reason for prepending this command with “do” is that the “show ip ssh”  is a privileged exec mode command and cannot be executed in global configuration mode. We can also see from the information displayed that the authentication timeout has been set to 120 secs and authentication retries are set to three. Let’s change them. The command “ip ssh time-out 60″ command changes authentication time-out  to 60 secs.  The command “ip ssh authentication-retries” command is used to change the authentication retries.

Finally we will have to set SSH as input transport protocol on vty access lines.

The “line vty 0 15″ command selects all the vty lines. The “transport input ssh” command sets SSH as a input transport protocol.  The “exit” command as already said takes us out of the line configuration mode. We have successfully enabled SSH protocol on our router.

Let’s once again see the information about the SSH we just enabled using “do show ip ssh”.

Posted on 4 Comments

Encrypt passwords on Cisco routers and switches

We have seen how to set passwords on cisco switches or routers here. Of course setting passwords does add to the security of the device but there is small problem. The password is stored in plain text.  Anyone who gets access to the switch can easily see all the passwords by typing command “show running-config or show startup-config”. Today we will see how to encrypt passwords on Cisco routers and switches.

Encrypting passwords can further enhance the security of the device. Privileged password can be encrypted by using the command “enable secret” instead of “enable password”. This command should be set from privileged global configuration mode.

Lets see what can we see  when we use the command “show running-config”.

We can see that the password we set has been encrypted. but what about other passwords. The  console, auxiliary and vty lines passwords cannot be encrypted even if we use “enable secret” command. To encrypt those passwords, we have to use another command “service password-encryption” as shown below.

This command will encrypt all the passwords stored in plain text on the device. Want to learn advanced practical hacking? Have a look at our Hacking Magazine. Just don’t trust our word. Download your FREE COPY using discount code fq47p4tq 

This is how you can encrypt passwords on Cisco routers and switches.

Posted on 2 Comments

How to configure passwords on Cisco routers and switches

Good evening friends, Today we will see how to configure passwords on Cisco routers and switches. Cisco devices have four types of passwords.

  • Console password : Used to set password for the console access.
  • Auxiliary password : It is used to set password to auxiliary port ( if the switch has one.)
  • VTY lines password : Used to set password for  for telnet and SSH access.
  • Privileged password : Used to set password for privileged access to the switch.

I am not going to show you how to set up auxiliary password here. To see how to set up console password and VTY lines password, go here.

Privileged mode of a Cisco device has some advanced IOS commands that can have disastrous consequences if used by wrong hands. So it is very important to set up a password to access privileged commands. Use the following commands

The “enable” command takes us into privileged mode. The “conf t” mode takes us into global configuration mode which pertains to the configuration settings of the whole switch. The “enable password”  sets a password for the privileged mode. ‘123456’ is the password. The “exit”  command takes us out of the privileged mode. To see if a password has been set for the privileged mode, try entering into privileged mode by typing “en” command. We can see that it prompts us for the password.

Posted on Leave a comment

How to subnet a network

Understanding subnetting is very important not only for those preparing for CCNA exam but also network administrators. Today, I am going to teach you how to create a subnet in a network. For this, I will use Packet Tracer software. To know what is subnetting and why we need it go here. So let’s start.

Imagine I formed a small software company named shunya whose network looks like below. I hired one Java developer, one software tester, one HR and one network administrator. I have been assigned the IP address range from 192.168.10.1 to 192.168.10.255.

I have enabled DHCP on my router as below.

After one year, imagine my company has received Abrahamic blessings from GOD and has seen rapid growth. Now the company has three Java developers, three software testers and  a dedicated HR team. Not only that, my company now has moved into Remote Infrastructure Management(RIM) and has a Network Operation Center(NOC) and Security Operation Center(SOC).  Total I have 15 computers in my network which looks like below.

Now see the image below. Here the machine “JD1″ sends a packet to machine “Testing3″. We can see here that for communication between machines “JD1: and “Testing3″ other machines have also been disturbed.

So for this reason, I decided to subnet the network. I decide to divide the network into three subnets as shown below.

To create a subnet, first we need to have proper planning as to how many subnets we need and how many we may need in the future. Presently, I need three subnets. The number of subnets should always be calculated in the powers of 2.

2 to the power of 1 = 2

This doesn’t satisfy our requirement as we need three subnets.

2 to the power of 2 = 4

This satisfies our requirement. So we need to take two bits from the host portion of the IP address. 192.168.10.1 to 192.168.10.255 is the address range available to us with subnet mask 255.255.255.0,  Writing the subnet mask in the binary notation, it is

11111111 11111111 11111111 00000000

 255            255          255             0  

The first 24 bits are network bits and the last eight bits are host bits. To create three subnets, we need to take two bits from the host portion of the address as explained above.

11111111 111111111 11111111 11000000

   255              255            255         192

Four subnets which can be created from the above subnet mask are,

192.168.10.0 to 192.168.10.63 ( with host bits 00000000 )

192.168.10.64 to 192.168.10.127 ( with host bits 01000000 )

192.168.10.128 to 192.168.10.191 ( with host bits 10000000 )

192.168.10.192 to 192.168.10.255 ( with host bits 11000000 )

Since we require only three subnets, we will create the first three subnets. The first subnet ( 192.168.10.1 to 192.168.10.63 ) comprises of Java Developers and Software testers. The commands are as below on the interface.

If you go to any machine on this subnet and look at its IP address, it will be like below.

Now the subnet for the Human Resource Department ( 192.168.10.128 to 192.168.10.191 ) . This will be like below.

The third subnet ( 192.168.10.64 to 192.168.10.127 ) comprises of NOC and SOC.

Now our network has been successfully sub netted into three subnets and we still have another subnet to use for future use.

Hope this was helpful. If you have any doubts regarding this article please comment below. Thank you.

Posted on 8 Comments

Install Packet Tracer in Windows and Linux

Cisco Certified Network Associate certification has become must for anybody who wishes to start  a career in networking. This certification validates that you have the ability to install, configure and troubleshoot a network. You need  lot of practice for achieving success in this exam. Apart from the labs where you are getting trained for CCNA what if you had a chance to practice at home. Or what if you want to self learn for CCNA? Well for both of the questions above, Cisco Packet Tracer is the perfect answer. To quote from Cisco’s official website, Packet tracer is

“a powerful network simulation program that allows students to experiment with network behavior and ask “what if” questions.”

It further says,

“The simulation-based learning environment helps students develop 21st century skills such as decision making, creative and critical thinking, and problem solving. Packet Tracer complements the Networking Academy curricula, allowing instructors to easily teach and demonstrate complex technical concepts and networking systems design.”

Nothing could have defined that better. This software is available for free from Cisco’s website provided you are a registered Networking Academy student, alumni, instructor, or administrator. Even if you are not one among the above you could still get hold of this software, just google it.

Now I’m gonna show you how to install packet tracer in Windows and Linux.

1.Windows

Any installation in Windows is just clicks and mouse and the same applies to Packet tracer. Click on the exe file downloaded. The below screen appears. Select “I accept the agreement” and click on “Next”.

Setup will show the folder in which the program’s shortcuts will be created. If you want to change the folder, you can change it. Click on “Next”.

Then the program will ask whether to create a Desktop icon and create a Quick Launch icon. Make your own choice and click on “Next”.

Then the summary of the settings we selected is displayed. Click on “Install”.

The installation starts as shown below.

In seconds, installation gets completed and the below screen is shown. Click on “Finish”.

Then the below popup appears asking you to close or restart your computer. Click on “OK”.

As we selected Launch option, Packet tracer is automatically launched.

2. Linux

To install Packet Tracer in Linux, we need a .deb package of Packet tracer which can be downloaded from here. Now I am going to install it in Ubuntu Precise Pangolin (12.04). Download the above file to the desktop.

Start the terminal and see your current working directory by typing “pwd”. If the current directory is not desktop move to the Desktop directory using “cd”. After reaching the Desktop directory, type “ls” to see if the packet tracer binary is there.

Left click on the packet tracer .bin file displayed after typing “ls” above, the entire word will be selected. Then right click and select copy. Now type “chmod +x” and then hit “CTRL+SHIFT+V “to paste the text we copied above. Our command should look like this.

                       chmod +x  PacketTracer533_i386_installer-deb.bin

What chmod +x command does is that it gives all users permission to execute.

Then type “./PacketTracer533_i386_installer-deb.bin” in the terminal. This will start extracting the binary package.

Then terminal prompts us to hit Enter to read the End User License Agreement.  Enter.

After displaying a rather long EULA, terminal asks us if we accept the terms of EULA. Type “Y”.

Then system asks us for the sudo password. Type the password and hit Enter.

When the installation is finished, close the terminal, go to Dashboard, if packet tracer is not seen, type ‘pac’ in the search box. When Packet Tracer is shown, click on it.

A message box shows up saying that we are starting packet tracer for the first time and our files will be stored in a specific folder. Click on “OK”.

Another message box pops up. Click on OK”.

Packet tracer is started.