Cisco: How to configure NAT - Network Address Translation

This brief tutorial will let you configure NAT overload, or how to enable Internet access to multiple PCs of your LAN using only 1 public IP address. This type of NAT can easily be used at home when you have a Cisco 800 series xDSL router.

The first step is to define the addresses that will need to be NAT’d, this is done using a standard access-list:

access-list 1 permit your_lan_address_range
example: access-list 1 permit 192.168.1.0

Now that we defined the addresses that are allowed to use the NAT address we enable the actual NAT:
ip nat inside source list access-list number interface overload
example: ip nat inside source list 1 dialer0 overload

This command states that it will use the addresses from the access-list we defined in step 1 and NAT it to the Public IP address on the interface, e.g. serial 0, dialer 0, ethernet 1,… The overload keyword specifies that multiple LAN addresses can be NAT’d to that address. The router uses the TCP and UDP ports of the hosts [LAN addresses] to translate the public IP address back to the originating local host address.

The last steps we need to configure is to tell the router which our inside and outside addresses. This is achieved using the following commands:
- for the inside
conf t
interface ethernet | fastethernet number
ip nat inside

- for the outside, assume we are dealing with an xDSL router
conf t
interface dialer0
ip nat outside

Now that NAT is configured we can check to see which addresses are being used by using the show ip nat translations commands.

Read more ...

Configuring DHCP to work with Cisco Manager

In this case from a Windows Server 2000 or 2003 system, with Cisco Call Manager (CCM). When introducing CCM into environments with an exsiting DHCP infrastructure, problems may occur because Cisco IP phones require additional information from the DHCP server when they startup.

Following the steps of DHCP server on the CCM hardware :

1) Start the DHCP server software that is already installed on your server (it comes with Server 2000 or Server 2003) buy clicking on “Start” then “Setting” then “Control Panel”. After the Control Panel open click on the “Administrative Tools” icon, and then the “DHCP” icon.

2) After the DHCP management console opens click on “Action” then select “New Scope…” then “OK” to the “New Scope Wizard”, then type in the name of your scope, this can be almost anything you would like, I named mine “voip_scope”, you can also give it a description if you like, I did not.

3) Then click “Next” and enter a start IP address and a end IP address, then use the up and down arrow buttons to increases or decrees the length of your sub-net mask, (just keep clicking the arrow buttons till you see the sub-net mask you what to use) and then click “Next”.

4) Next you will be asked to enter any address you do not want issue out be the DHCP server, maybe you are saving some static addresses for you router and/or servers. You can enter in just one address by entering the same address in the start and end boxes, or a range of addresses be putting the first or lowest in the start box, and the last or highest in the end box, then click “Next”.

5) You will be asked how long you want the lease to be good for; I leave it to the default and click “Next”.

6) Next you are asked if you want to set up the DHCP options now, these are the options the DHCP server will pass along to the requesting client with it’s new IP address, I select “Yes” and enter the “Router (Default Gateway) IP address, and click “Add” and then click “Next”.

7) Next you can enter and any Domain information you have and then click “Add” then “Next”.

8) You can now add and WINS information you have, I leave mind blank, and click “Next”. The lest question you are asked is if you want to active the scope now, I select “Yes” and click “Next” and then “Finish” to close the “New Scope Wizard”.

9) In the right hand plane of the DHCP management console windows double click on “Scope Options”, the click “Action” and select “Configure Options…” then in the “Scope Options” box click “066 Boot Server Host Name” to check that option, and in the “String value” box enter the IP address of your TFTP server, mine happens to be the same as my CCM, and click OK. Now when a client asked for a new IP address it will also get the TFTP server’s address, which the Cisco IP phones need to boot.

Read more ...

Learning Cisco CCNA with Simulators

Passing the CCNA is all about knowing the details of how things work, and knowing CSMA/CD theory and how to define collision domains is of the lots of details you have got to master. In the next part of this CCNA tutorial, we'll take a glance at broadcast domains, and how defining broadcast domains in the right places can dramatically cut down on unnecessary traffic on your network.

As you study for your CCNA and CCNP exams, if you are getting hands-on practice in your home lab or rack rental service, you are going to be sending lots of pings. As a CCNA or CCNP candidate, you know that exclamation points (!!) as a ping return indicates that you have IP connectivity to the remote location. periods (\.\...) indicates that you do not have that connectivity.

Students and Professionals that got their CCNA certification will normally finish up in one of categories. The 1st: guys and gals entering the IT world. The 2nd section: individuals who need to make the transition from Local Area Network to Wide Area Network. WAN engineers and administrators make the 3rd section. In the event that they got their CCNA certification, it is because they yearn to move up the ladder.
Keep learning & improving after your've earned your certification. It is simple to quickly forget what you don't use. Feel free to take off a couple days to reward yourself for all that hard work. Then, of work, it is time to strap back in & study. Keep reviewing your CCNA topics, & start on your first CCNP examination. Lots of folks who get that glorious CCNA certificate will basically forget the knowledge they obtained because they gave up studying one time the examination was over.
I give strong recommendation to video tutorials, Exams Testing Engines, Study Guides, Preparation Labs, Q & A for CCNA certification package. Indeed it is a actual worth to money. Here you can get configuration of cisco devices along with proper explanation but the disadvantage is it does not cover everything in examination so you need to go for CCNA CCNA exams training simulators.
Get practice check program

Cisco Simulators
There's free or paid cisco CCNA exams training simulators available on web. It is necessary to get your hands on these simulators so you get on hand experience in configuration cisco devices. In case you have budge you can also build your Cisco home lab.

Today plenty of companies sell practice exams that help to attempt CCNA CCNA examination training. You require to buy them & go for your first check. In the first attempt you may fail but don't get discouraged. Plenty of practice check program are the bank of questions, each divided in to four practice tests. You are necessary to attempt the practice tests four times. Finally you take final practice examination including the all the questions. At this point of time you are prepared to go for actual examination.

If your preparing for career alter & looking for CCNA Training the best online training provider that provide the all the & complete MCTS certification exams training in package, certkingdom self study training kits, save your money on bootcamps, training institutes, It is also save your travelling & time. All training materials are "Guaranteed" to pass your exams & get you certified on the fist attempt, due to best training they become no1 site 2009 & 2010.
In addition I recommend Certkindom.com is best and No1 site of 2008 which provide the complete Windows Server 2003 certified professionals training, Microsoft MCITP, Microsoft MCTS, Cisco CCNA, Cisco CCIE, CompTIA A+, IBM, Citrix, PMP, ISC, and lots more online training self study kits, saving your time and money on all those expensive bootcamps, conventional training institutes where you have take admission pay fees first and if you don't want to continue no refunds no transfer to any other training course, If you planed to take CCNA or specialization in MCSE 2003 all the process starts again; as for getting online training can be much beneficial and you don't need to take for fill any from to switch your training on any desire certification.

Read more ...

4 Tips to Use a CCNA Study Guide

Try to look for more CCNA study guides & CCNA books. This may help you understand things in over fashion. Reading a range of CCNA study guides about the same idea makes you understand it more & perhaps simple. Go to Amazon & buy CCNA study guides from different study authors as you can.

A CCNA study guide is tremendous gizmo to pass the CCNA Certification examination if used correctly. Regrettably, some CCNA students use CCNA study guides badly, & this leads to confusions related to the CCNA topics & decrease the CCNA candidate's chances to pass the CCNA check. In the upcoming paragraphs, you'll some tips on how to make use of CCNA study guides.

of the ways to benefit from you CCNA study guide is to make use of it as a checklist. all of CCNA study guide provide knowledge that you are supposed to know to pass the CCNA certification examination. In the coursework of your CCNA study journey, try to mark a check to each element in your CCNA study guide when you have comprehended it & configured its related commands. When you finish studying, review you CCNA study guide to see in case you have left or more items unchecked. If yes, use other CCNA books & other networking books on the item or items you still don't understand. You may also do a research on Google & find lots of useful knowledge, document, & even some free CCNA study guides.

Finally, try to build your own CCNA study guide by assembling all the notes you have made as you were studying. In addition, try to share your CCNA study guide with other people studying for the CCNA examination.

Do not make the error of relying on CCNA study guide alone. As historicallyin the past mentioned, CCNA study guides are in no way complete, & you must not treat it as the single source of knowledge to help you pass your CCNA examination. In case you are enrolled in a CCNA boot camp, pay attention in the coursework of your CCNA study activities in the boot camp to help you benefit the most out of your CCNA study guide.

Read more: http://www.articlesbase.com/computers-articles/4-tips-to-use-a-ccna-study-guide-perfectly-4305027.html#ixzz1VsdoxfZE
Under Creative Commons License: Attribution No Derivatives

Read more ...

Classful IP Subnet Calculations

1. IP Addressing

At this point you should know that IP, the Internet Protocol, is a network layer (OSI layer 3) protocol, used to route packets between hosts on different networks. To suit this purpose, IP must define an addressing scheme, so that a packet's intended destination can be indicated.

An IP address is composed of 32 bits. These 32 bits are divided into 4 octets of 8 bits each. You may have seen an IP address represented like this: 172.68.15.24. We must remember, however, that the computer understands this number only in binary, so we must often deal with them in binary. Many people are intimidated by this initially, but soon find that it is not difficult. If you do not allow yourself to be flustered, you can master this topic.

IP addresses are assigned to orginazations in blocks. Each block belongs to one of three classes: class A, class B, or class C. You can tell what class an IP address is by the value in its first octet.

Class A	1-126
Class B	128-191
Class C	192 -->

An IP address consists of two fields. The first field identifies the network, and the second field identifies the node on the network. Which bits of the address are in the network field and which bits are in the host field is determined by the subnet mask.

When a class A IP license is granted, you are assigned something like this: 99.0.0.0. Only the value of the bits in the first octet are assigned. This means you are free to assign any values you wish in the second, third and fourth octets.

The defualt subnet mask for a class A network is 255.0.0.0. High bits, ones, indicate the bits that are part of the network field of the IP address. The default subnet mask does not create subnets. Therefor, a class A network with the default subnet mask is one network. The three octets that are unassigned and unmasked are part of the host field of the address. There is a total of 24 bits in those three octets. Each bit can be in one of two states. Therefor, 2^24 is the number of host addresses that can be assigned on that network, almost. Two addresses are reserved on every network, x.x.x.0 and x.x.x.255. So the total number of hosts possible on this network is 2^24. 2^24-2=16,777,214 hosts for a class A IP network.

When a class B license is granted, the first two octets are assigned. For example, 172.198.x.x. The default subnet mask for a class B is 255.255.0.0. One network, two octets free, 16 bits for the host address field. 2^16-2=65,534 possible host addresses on a class B IP network.

When a class C license is granted, the first three octets are assigned, for example: 193.52.16.0. The default subnet mask for a class C is 255.255.255.0. Once octet makes up the host address field. 2^8-2=254 host addresses possible on a class C network.

2. Reason for Subnetting

We said that the default subnet mask for a class A IP network is 255.0.0.0. Once octet only of a class A network address identifies the network, with this subnet mask. This leaves three octets of 8 bits each, or 24 bits, to identify the host on that one network. 2^24=16,777,216 addresses. Two addresses are reserved, x.x.x.0 and x.x.x.255. 16,777,214 nodes can be assigned an IP address on this network.

It is highly unlikely that any organization would want one network of 16,777,214 nodes. They might want that many devices connected in a wide area network (WAN), thus capablee of communicating when neccessary, but they will want to subdivide this huge network into mostly self-contained subnetworks of nodes that communicate with each other often. This is called subnetting.

To understand why, consider what would happen in either a broadcast or a token passing network that consisted of over 16,000,000 nodes. Nothing would happen. It simply would not work. Though the problem is not as drastic, class B and class C IP networks are often subnetted, also.

The subnet mask is used to subdivide an IP network into subnets. This is a division that takes place in OSI layer 3, so it is a logical division that is created by the addressing scheme. This logical division is usually combined with a physical division. Many subnets are physically isolated from the rest of the network by a device such as a router or a switch. This aspect of subnetting is discussed in Unit 3--Data Link Layer.

3. How Subnetting Works

The bits of an address that are masked by the subnet mask are the bits that make up the network field of the address. To subnet, the default subnet mask for a network is extended to cover bits of the address that would otherwise be part of the host field. Once these bits are masked, they become part of the network field, and are used to identify subnets of the larger network.

Here is where we begin dealing with both addresses and subnetmasks in binary. Get yourself a cold beverage, stretch, take a deep breath and don't worry. Once you get your brain around the concepts, it is not difficult. You just have to keep trying until the light goes on.

3.1 Translating Binary to Decimal

Both IP addresses and subnet masks are composed of 32 bits divided into 4 octets of 8 bits each. Here is how a single octet translates from binary to decimal. Consider an octet of all ones: 11111111.

128 64 32 16 8 4 2 1 ---  --  --  --  -  -  -  - 1  1  1  1  1  1  1  1  128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255 

Here's another: 10111001

128 64 32 16 8 4 2 1 ---  --  --  --  -  -  -  - 1  0  1  1  1  0  0  1 128 +  0 + 32  +16 + 8 + 0 + 0 + 1 = 185 

and 00000000

128 64   32   16   8   4   2   1 ---   --   --   --   -   -   -   -  0     0    0    0   0   0   0   0  0  +  0 +  0 +  0 + 0 + 0 + 0 + 0 = 0 

3.2 Converting Decimal to Binary

Converting decimal to binary is similar. Consider 175:

128 64  32   16   8   4   2   1 ---   --   --   --   -   -   -   -  1     0    1    0   1   1   1   1 128 +  0 + 32 +  0 + 8 + 4 + 2 + 1 = 175 

175=10101111

3.3 Simple Subnetting

The simpliest way to subnet is to take the octet in the subnet mask that covers the first unassigned octet in the IP address block, and make all its bits high. Remember, a high bit, a 1, in the subnet mask indicates that that corresponding bit in the IP address is part of the network field. So, if you have a class B network 172.160.0.0, with the subnet mask 255.255.0.0, you have one network with 65, 534 possible addresses. If you take that subnet mask and make all the bits in the third octet high

128 64   32   16   8   4   2   1 ---   --   --   --   -   -   -   -  1     1    1    1   1   1   1   1 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255 

you get the subnet mask 255.255.255.0.

172.60.  0. 0 255.255.255.0 

Now the third octet of all the addresses on this network are part of the network field instead of the host field. That is one octet, or eight bits, that can be manipulated to create subnets. 2^8=256 possible subnets now on this class B network.

One octet is left for the host field. 2^8-2=254 possible host addressed on each subnet.

3.4 Advanced Subnetting

That is the simplist way to subnet, but it may not be the most desirable. You might not want 256 subnets on your class B network. Instead, you might use a subnet mask like 255.255.224.0. How many subnets would this give you? The first step is to see how many bits are allocated to the network by this mask.

128 64   32   16   8   4   2   1 ---   --   --   --   -   -   -   -  1     1    1    0   0   0   0   0 128 + 64 + 32 +  0 + 0 + 0 + 0 + 0 = 224 

3 bits are allocated. 2^3=8 subnets.

How many hosts on each subnet? Well, 5 bits from this octet are left for the host field, and 8 bits in the fourth octet, for a total of 13 bits in the host field. 2^13-2=8190 possible hosts on each subnet.

The subnet mask is always extended by masking off the next bit in the address, from left to right. Thus, the last octet in the subnet mask will always be one of these: 128, 192, 224, 240, 248, 252, 254 or 255.

Given the IP address of a host and the subnet address for the network, you need to be able to calculate which subnet that host is on. To do this we compare the binary representation of the pertinent octet of the subnet mask witht he binary representation of the corresponding octet in the IP address. Example:

IP address=172.60.50.2 subnet mask=255.255.224.0  50= 00110010 224=11100000 

We perform a logical AND on these two numbers. We will be left with only the bits where there is a one in both octets.

00110010 11100000 -------- 00100000=32 

This host is on subnet 172.60.32.0.

We also need to be able to find the range of assignable IP addresses on this subnet. To do this, we take the binary that tells us the subnet address, in this case 00100000, and compare it with the subnet mask.

00100000 11100000 

The bits convered by the mask we will leave as they are. The rest of the bits we make high. So

00100000 11100000 -------- 0011111=63 

The range of assignable IP addresses on the subnet 172.60.32.0 is 172.60.32.1-172.60.63.254.

On every network and subnet, two addresses are reserved. At the low end of the range of addresses for the network or subnet, in this case 172.60.32.0, is the address for the network or subnet itself. The address at the high end of the range of addresses, in this case 172.60.63.255, is the broadcast address. Any message sent to the broadcast address will be received by every host on the network.

4. Sample Problem

Here is a sample problem for you to calculate. When you are done, you can check your answers using an online subnet calcualtor at SubnetOnline.com.

IP address:  154.16.52.16 subnet mask:  255.255.240.0  Find: Number of subnets possible on this network: Number of hosts possible on each subnet: Which subnet this address is on: Range of addresses on that subnet: 

Read more ...

Configure your Cisco Router

If you have just turned on the router, it will be completely unconfigured. If it is already configured, you may want to view its current configuration. Even if it has not been previously configured, you should familiarize yourself with the show commands before beginning to configure the router. Enter privileged mode by issuing the command enable, then issue several show commands to see what they display. Remember, the command show ? will display all the showcommands aavailable in the current mode. Definately try out the following commands:

Router#show interfaces
Router#show ip protocols
Router#show ipv6 protocols
Router#show ip route
Router#show ipv6 route
Router#show ip arp
Router#show ipv6 neighbors

When you enter privileged mode by using the command enable, you are in the top-level mode of privileged mode, also known in this document as "parent mode." It is in this top-level or parent mode that you can display most of the information about the router. As you now know, you do this with the show commands. Here you can learn the configuration of interfaces and whether they are up or down. You can display what IP protocols are in use, such as dynamic routing protocols. You can view the route and ARP tables, and these are just a few of the more important options.

As you configure the router, you will enter various sub-modes to set options, then return to the parent mode to display the results of your commands. You also return to the parent mode to enter other sub-modes. To return to the parent mode, you hit ctrl-z. This puts any commands you have just issued into affect, and returns you to parent mode.

- a.

Global configuration (config)

To configure any feature of the router, you must enter configuration mode. This is the first sub-mode of the parent mode. In the parent mode, you issue the command config.

Router#config
Router(config)#

As demonstrated above, the prompt changes to indicate the mode that you are now in.

In connfiguration mode you can set options that apply system-wide, also refered to as "global configurations." For instance, it is a good idea to name your router so that you can easily identify it. You do this in configuration mode with the hostname command.

Router(config)#hostname ExampleName
ExampleName(config)#

As demonstrated above, when you set the name of the host with the hostname command, the prompt immediately changes by replacing Router with ExampleName. (Note: It is a good idea to name your routers with an organized naming scheme.)

Another useful command issued from config mode is the command to designate the DNS server to be used by the router:

ExampleName(config)#ip name-server aa.bb.cc.dd
ExampleName(config)#ctrl-Z
ExampleName#

This is also where you set the password for privileged mode.

ExampleName(config)#enable secret examplepassword
ExampleName(config)#ctrl-Z
ExampleName#

Until you hit ctrl-Z (or type exit until you reach parent mode) your command has not been put into affect. You can enter config mode, issue several different commands, then hit ctrl-Z to activate them all. Each time you hit ctrl-Z you return to parent mode and the prompt:

ExampleName#

Here you use show commands to verify the results of the commands you issued in config mode. To verify the results of the ip name-server command, issue the command show host.

Configuring Cisco router interfaces

Cisco interface naming is straightforward. Individual interfaces are referred to by this convention:

media type slot#/port#

"Media type" refers to the type of media that the port is an interface for, such as Ethernet, Token Ring, FDDI, serial, etc. Slot numbers are only applicable for routers that provide slots into which you can install modules. These modules contain several ports for a given media. The 7200 series is an example. These modules are even hot-swapable. You can remove a module from a slot and replace it with a different module, without interrupting service provided by the other modules installed in the router. These slots are numbered on the router.

Port number refers to the port in reference to the other ports in that module. Numbering is left-to-right, and all numbering starts at 0, not at one.

For example, a Cisco 7206 is a 7200 series router with six slots. To refer to an interface that is the third port of an Ethernet module installed in the sixth slot, it would be interface ethernet 6/2. Therefor, to display the configuration of that interface you use the command:

ExampleName#show interface ethernet 6/2

If your router does not have slots, like a 1600, then the interface name consists only of:

media type port#

For example:

ExampleName#show interface serial 0

Here is an example of configuring a serial port with an IP address:

ExampleName#config
ExampleName(config)#interface serial 1/1
ExampleName(config-if)#ip address 192.168.155.2 255.255.255.0
ExampleName(config-if)#ipv6 address fe80::230:1bff:fe80:b8ea/64
ExampleName(config-if)#ipv6 enable
ExampleName(config-if)#no shutdown
ExampleName(config-if)#ctrl-Z
ExampleName#

Then to verify configuration:

ExampleName#show interface serial 1/1

Note the no shutdown command. An interface may be correctly configured and physically connected, yet be "administratively down." In this state it will not function. The command for causing an interface to be administratively down is shutdown.

ExampleName(config)#interface serial 1/1
ExampleName(config-if)#shutdown
ExampleName(config-if)#ctrl-Z
ExampleName#show interface serial 1/1

In the Cisco IOS, the way to reverse or delete the results of any command is to simply put no infront of it. For instance, if we wanted to unassign the IP address we had assigned to interface serial 1/1:

ExampleName(config)#interface serail 1/1
ExampleName(config-if)#no ip address 192.168.155.2 255.255.255.0
ExampleName(config-if)ctrl-Z
ExampleName#show interface serial 1/1

Configuring most interfaces for LAN connections might consist only of assigning a network layer address and making sure the interface is not administratively shutdown. It is usually not necessary to stipulate data-link layer encapsulation. Note that it is often necessary to stipulate the appropriate data-link layer encapsulation for WAN connections, such as frame-relay and ATM. Serial interfaces default to using HDLC. A discussion of data-link protocols is outside the scope of this document. You will need to look up the IOS command encapsulation for more details.

Configuring Cisco Routing

IP routing is automatically enabled on Cisco routers. If it has been previously disabled on your router, you turn it back on in config mode with the command ip routing.

ExampleName(config)#ip routing
ExampleName(config)#ctrl-Z

To enable IPv6 routing, use the command ipv6 unicast-routing.

ExampleName(config)#ipv6 unicast-routing
ExampleName(config)#ctrl-Z

There are two main ways a router knows where to send packets. The administrator can assign static routes, or the router can learn routes by employing a dynamic routing protocol.

Static routes are generally used in very simple networks or in particular cases that necessitate their use. To create a static route, the administrator tells the router operating system that any network traffic destined for a specified network layer address should be forwarded to a similiarly specified network layer address. In the Cisco IOS this is done with the ip route and ipv6 route commands.

ExampleName#config
ExampleName(config)#ip route 172.16.0.0 255.255.255.0 192.168.150.1
ExampleName(config)#ctrl-Z
ExampleName#show ip route
ExampleName#config
ExampleName(config)#ipv6 route fe80::230:1bff:fe80::/64 fe80::230:1bff:fe80::1
ExampleName(config)#ctrl-Z
ExampleName#show ipv6 route

Two things to be said about this example. First, the packet destination address must include the subnet mask for that destination network. Second, the address it is to be forwarded to is the specified addres of the next router along the path to the destination. This is the most common way of setting up a static route, and the only one this document covers. Be aware, however, that there are other methods.

Dynamic routing protocols, running on connected routers, enable those routers to share routing information. This enables routers to learn the routes available to them. The advantage of this method is that routers are able to adjust to changes in network topologies. If a route is physically removed, or a neighbor router goes down, the routing protocol searches for a new route. Routing protocols can even dynamically choose between possible routes based on variables such as network congestion or network reliability.

There are many different routing protocols, and they all use different variables, known as "metrics," to decide upon appropriate routes. Unfortunately, a router needs to be running the same routing protocols as its neighbors. Many routers can, however, run mutliple protocols. Also, many protocols are designed to be able to pass routing information to other routing protocols. This is called "redistribution."

Routing protocols are a complex topic and this document contains only this superficial description of them. There is much to learn about them, and there are many sources of information about them available. An excelent source of information on this topic is Cisco's website, http://www.cisco.com.

IPv6 configuration with IOS

This is a seperate section because IPv6 is new to most people, and they will be looking specifically for information about configuring IPv6. Examples of configuring IPv6 are included throughout the document, however, alongside IPv4. That is a more accurate reflection of how you will work with IPv6 on a day-to-day basis. Once the newness of IPv6 passes, it will be one more piece in the familiar puzzle.

The important concept to understand when configuring IPv6 is that IPv4 and IPv6 exist in parrallel. One is not a replacement for the other, at least not in the way it is treated by the operating system. A term for this is dual stack. An interface can have an IPv4 address and no IPv6 address. Or an IPv6 address and no IPv4 address. Or both an IPv4 address and an IPv6 address. Examples:

IPv4 only

!
interface FastEthernet0/0
ip address 192.168.1.138 255.255.255.0
!

IPv6 only

!
interface FastEthernet0/0
ipv6 address fe80::230:1bff:fe80::/64
ipv6 enable
!

IPv4 and IPv6

!
interface FastEthernet0/0
ip address 192.168.1.138 255.255.255.0
ipv6 address fe80::230:1bff:fe80::/64
ipv6 enable
!

Notice that there are seperate but similiar commands for IPv4 and IPv6. To assign an IPv4 address,

ExampleName(config-if)#ip address 192.168.1.138 255.255.255.0

To assign an IPv6 address,

ExampleName(config-if)#ipv6 address fe80::230:1bff:fe80::/64

There are some bigger differences between IPv4 and IPv6 IOS commands. For example, the IPv6 equivilant of show ip arp, is show ipv6 neighbors.

3.5 Saving your Cisco Router configuration

Once you have configured routing on the router, and you have configured individual interfaces, your router should be capable of routing traffic. Give it a few moments to talk to its neighbors, then issue the commands show ip route and show ip arp. There should now be entries in these tables learned from the routing protocol.

If you turned the router off right now, and turned it on again, you would have to start configuration over again. Your running configuration is not saved to any perminent storage media. You can see this configuration with the command show running-config.

ExampleName#show running-config

You do want to save your successful running configuration. Issue the command copy running-config startup-config.

ExampleName#copy running-config startup-config

Your configuration is now saved to non-volatile RAM (NVRAM). Issue the command show startup-config.

ExampleName#show startup-config

Now any time you need to return your router to that configuration, issue the command copy startup-config running-config.

ExampleName#copy startup-config running-config

Example Cisco Router configuration

1. Router>enable
2. Router#config
3. Router(config)#hostname N115-7206
4. N115-7206(config)#interface serial 1/1
5. N115-7206(config-if)ip address 192.168.155.2 255.255.255.0
6. N115-7206(config-if)ipv6 address fe80::230:1bff:fe80:b8ea/64
7. N115-7206(config-if)ipv6 enable
8. N115-7206(config-if)no shutdown
9. N115-7206(config-if)ctrl-z
10. N115-7206#show interface serial 1/1
11. N115-7206#config
12. N115-7206(config)#interface ethernet 2/3
13. N115-7206(config-if)#ip address 192.168.150.90 255.255.255.0
14. N115-7206(config-if)#no shutdown
15. N115-7206(config-if)#ctrl-z
16. N115-7206#show interface ethernet 2/3
17. N115-7206#config
18. N115-7206(config)#ip name-server 172.16.0.10
19. N115-7206(config)#ctrl-z
20. N115-7206#ping archie.au
21. N115-7206#config
22. N115-7206(config)#enable secret password
23. N115-7206(config)#ctrl-z
24. N115-7206#copy running-config startup-config
25. N115-7206#exit

-

Read more ...

Started with Cisco

Initially you will probably configure your router from a terminal. If the router is already configured and at least one port is configured with an IP address, and it has a physical connection to the network, you might be able to telnet to the router and configure it across the network. If it is not already configured, then you will have to directly connect to it with a terminal and a serial cable. With any Windows box you can use Hyperterminal to easily connect to the router. Plug a serial cable into a serial (COM) port on the PC and the other end into the console port on the Cisco router. Start Hyperterminal, tell it which COM port to use and click OK. Set the speed of the connection to 9600 baud and click OK. If the router is not on, turn it on.

If you wish to configure the router from a Linux box, either Seyon or Minicom should work. At least one of them, and maybe both, will come with your Linux distribution.

Often you will need to hit the Enter key to see the prompt from the router. If it is unconfigured it will look like this:

Router>

If it has been previously configured with a hostname, it will look like this:

hostname of router>

If you have just turned on the router, after it boots it will ask you if you wish to begin initial configuration. Say no. If you say yes, it will put you in the menu interface. Say no.

- The Cisco IOS command-line interface is organized around the idea of modes. You move in and out of several different modes while configuring a router, and which mode you are in determines what commands you can use. Each mode has a set of commands available in that mode, and some of these commands are only available in that mode। In any mode, typing a question mark will display a list of the commands available in that mode.

When you first connect to the router and provide the password (if necessary), you enter EXEC mode, the first mode in which you can issue commands from the command-line. From here you can use such unprivileged commands as ping, telnet, and rlogin. You can also use some of the show commands to obtain information about the system. In unprivileged mode you use commands like, show version to display the version of the IOS the router is running. Typing show ? will diplay all the show commands available in the mode you are presently in.

Router>show ?

You must enter privileged mode to configure the router. You do this by using the command enable. Privileged mode will usually be password protected unless the router is unconfigured. You have the option of not password protecting privileged mode, but it is HIGHLY recommended that you do. When you issue the command enable and provide the password, you will enter privileged mode.

To help the user keep track of what mode they are in, the command-line prompt changes each time you enter a different mode. When you switch from unprivileged mode to privileged mode, the prompt changes from:

Router>

to

Router#

This would probably not be a big deal if there were just two modes. There are, in fact, numerous modes, and this feature is probably indispensable. Pay close attention to the prompt at all times.

Within privileged mode there are many sub-modes. In this document I do not closely follow Cisco terminology for this hierarchy of modes. I think that my explanation is clearer, frankly. Cisco describes two modes, unprivileged and privileged, and then a hierarchy of commands used in privileged mode. I reason that it is much clearer to understand if you just consider there to be many sub-modes of privileged mode, which I will also call parent mode. Once you enter privileged mode (parent mode) the prompt ends with a pound sign (#). There are numerous modes you can enter only after entering privileged mode. Each of these modes has a prompt of the form:

Router(arguments)#

They still all end with the pound sign. They are subsumed within privileged mode. Many of these modes have sub-modes of their own. Once you enter priliged mode, you have access to all the configuration information and options the IOS provides, either directly from the parent mode, or from one of its submodes.

-

Read more ...

Bridging Access Point to Access Point

Hotspot saat ini bukan lagi merupakan hal yang istimewa dan menherankan bagi para penggemar dunia maya. Cafe, warung internet bahkan rumahan pun saat ini telah menyediakan fasilitas tersebut sebagai salah satu sarana untuk memperlaris atau memudahkan untuk akses internet.
Bridge berasal dari bahasa Inggris, dan sesuai dengan terjemahannya yang berarti jembatan. Metode bridge dalam aplikasi komputer adalah suatu metode yang menjembatani/ menghubungkan dua jaringan LAN kabel menjadi satu sehingga dapat saling berhubungan seperti dalam satu jaringan lan kabel.

Contoh aplikasi sederhana dari metode bridge ini yaitu misalnya kita ingin menghubungkan jaringan LAN di kantor di Gedung A dengan jaringan LAN di gedung B dimana kondisi tidak memungkinkan untuk memasang kabel, maka solusinya hanya menggunakan jaringan radio atau wireless. Pemilihan menggunakan teknologi WIFI ini tidak selamanya mahal karena saat ini sudah banyak produk wireless murah namun berkualitas untuk rumahan atau kantor kecil. Apalagi jika metode ini ingin di terapkan pada lembaga-lembaga non profit seperti gedung-gedung sekolah atau kampus yang tidak mungkin harus mengeluarkan biaya yang sangat besar.

Langkah-langkah sederhana untuk aplikasi yang harus di perhatikan, yaitu :
1. Jarak antar gedung
2. Kondisi sekitar antar gedung apakah terhalang oleh pepohonan atau gedung lain atau tidak.
3. Kondisi alam apakah rawan bahaya petir atau tidak.

Contoh kasus sederhana penerapan aplikasi sederhana point to point pada sebuah gedung sekolah atau kampus. Kondisinya:
1. Gedung A berjarak sekitar 50 s/d 100 meter dengan Gedung B
2. Antar gedung tersebut tidak terhalang oleh pepohonan atau gedung.
3. Kondisi alam sekitar tidak rawan petir.

Pihak sekolah ingin jaringan lan di Gedung A dapat terhubung dengan Gedung B sehingga aplikasi-aplikasi jaringan di dua LAN tersebut dapat di manfaatkan secara optimal bersama-sama.

Maka di pasang dua buah perangkat Akses Point (AP), AP1 di tempatkan di Gedung A dan AP2 di tempatkan di Gedung B. Pemasangan dua AP yang akan di hubungkan tersebutkan di letakan di tempat pada tempat yang saling berhadapan dan di kondisikan tidak ada yang merintangi, misalnya kedua AP tersebut diletakan di langit-langit luar kedua gedung yang saling berhadapan dimana masing-masing AP tersebut terhubung dengan kabel UTP yang menghubungkan dengan masing-masing jaringan LAN.

Garis besar konfigurasi yang harus dilakukan di masing-masing AP yang akan di perlakukan sebagai sarana jembatan koneksi dua LAN tersebut :
1. Pilih konfigurasi mode WAP yaitu sebagai bridge atau point to point
2. Masukan MAC address AP1 di AP2 pada kolom isian MAC AP pasangan, begitu pula sebaliknya MAC address AP2 di masukan ke AP1 kolom isian MAC AP pasang, masing-masing harus di isi MAC address pasangannya.
3. Konfigurasi AP1 dan AP2 sama-sama menggunakan channel radio wireless yang sama, konfigurasi mode keamanan yang sama, seperti jika menggunakan mode keamanan menggunakan WPA PSK atau WPA2PSK masing-masing harus menggunakan konfigurasi dan keyword yang sama.
4. Sesudah dipastikan semua konfigurasi ini sama , cek dan pastikan apakah LAN1 di Gedung A dapat terhubung dengan LAN2 di Gedung B, jika terhubung seharusnya kedua lan ini dapat saling berkomunikasi untuk saling berbagi resource seperti sharing folder, printer , koneksi internet, komputer di LAN1 dapat berhubungan dengan komputer di LAN2. (LAN1 dan LAN2 memiliki subnet mask yang sama meski beda segment)

Jika kondisi antar Gedung terdapat beberapa penghalang seperti daun pepohonan atau jarak yang relative lumayan jauh yang mengurangi kemampuan daya jangkau sinyal AP, maka dapat di lakukan dengan menambahkan antenna high gain directional ke masing-masing AP menggantikan antenna omni bawaan yang kita pasang bahkan adakalanya cukup salah satu AP yang dipasang antenna tersebut (kemampuan antenna dapat dilihat dari DB antenna). Hal lain yang dapat memperkuat sinyal adalah dengan memasang sebuah repeater di tempat antara AP1 dan AP2, biasanya perlakuan ini dilakukan jika kondisi antar gedung penuh dengan penghalang atau inteferensi gangguan sinyal radio lain, maka kita tinggal memilih channel yang cocok untuk bridge kita.

WAP yang umum dijual biasanya transmisi b dan G menggunakan sinyal 2,4 Mhz yang juga di gunakan alat-alat wireless lainnya, namun ada juga WAP yang menyediakan teknologi extended transmisi 2x to 3x eXtended Range dan 108M Super G, serta transmisi N. Juga teknologi transmisi a yang menggunakan sinyal 5 Mhz. Kita tinggal menyesuaikan dengan kondisi yang kita hadapi. Sepasang AP dalam koneksi point to point dapat juga juga dikonfigurasi sebagai Akses Point seperti pada WAP TP-Link TL-WA601G 108M, sehingga pengguna komputer wireless terkoneksi dengan jaringan meski AP tersebut digunakan untuk koneksi point to point, langkah penghematan sederhana.

Read more ...

Filter MAC Address Mikrotik

Banyaknya user yang terkadang mengganti-ganti IP Address pada suatu jaringan yg telah ditetapkan alamat IP ny masing-masing. Untuk mengatasi hal ini ada salah satu solusi yang mungkin bisa meminimalisir hal ini, dimana dalam pembahasan kali mengunci MAC hanya dan untuk bisa digunakan oleh IP yang menjadi pasangannya.


MAC filter sendiri metode yang digunakan untuk mengunci MAC address + IP address. Pada contoh kasus sekarang kita akan mengunci :

1. MAC : 00:1D:72:20:E8:1E ke IP : 192.168.5.7
2. MAC : 00:1D:72:C6:AA:F7 ke IP : 192.168.5.8
3. MAC : 00:1F:D0:1E:AB:93 ke IP : 192.168.5.9

Pada contoh kasus di atas digunakan 3 PC dimana masing2 IP telah ditetapkan sesuai MAC nya.

Caranya :
1. Buka WINBOX
2. Masuk ke bagian IP terus klik ARP
3. Step no. 2 digunakan untuk membantu mencari target MAC dan alamat IP-nya ,anda tinggal masuk ke new terminal di winbox anda , kemudian ketik script berikut

/ip firewall filter

Setelah itu ...

Untuk mengunci MAC : 00:1D:72:20:E8:1E ke IP : 192.168.5.7

add chain=forward src-address=192.168.5.7 src-mac-address=!00:1D:72:20:E8:1E action=drop comment=”kunci 192.168.5.7 ke 00:1D:72:20:E8:1E”

add chain=forward src-address=!192.168.5.7 src-mac-address=00:1D:72:20:E8:1E action=drop comment=”kunci 192.168.5.7 ke 00:1D:72:20:E8:1E”


Untuk mengunci MAC : 00:1D:72:C6:AA:F7 ke IP : 192.168.5.8

add chain=forward src-address=192.168.5.8 src-mac-address=!00:1D:72:C6:AA:F7 action=drop comment=”kunci 192.168.5.8 ke 00:1D:72:20:E8:1E”

add chain=forward src-address=!192.168.5.8 src-mac-address=00:1D:72:C6:AA:F7 action=drop comment=”kunci 192.168.5.8 ke 00:1D:72:C6:AA:F7?

Kemudian yang terakhir

Untuk mengunci MAC : 00:1F : D0 : 1E:AB:93 ke IP : 192.168.5.9

add chain=forward src-address=192.168.5.9 src-mac-address=!00:1F:D0:1E:AB:93 action=drop comment=”kunci 192.168.5.9 ke 00:1F:D0:1E:AB:93?

add chain=forward src-address=!192.168.5.9 src-mac-address=00:1F:D0:1E:AB:93 action=drop comment=”kunci 192.168.5.9 ke 00:1F:D0:1E:AB:93?

Setelah langkah-langkah diatas selesai, maka pemilik IP dan MAC yang bersangkutan tidak akan bisa ganti-ganti IP, bahkan menggunakan MAC Clone ato mac address changer sekalipun, karena MAC dan IP-nya terkunci.

Read more ...

Apa itu Cisco router?

Cisco router adalah peralatan utama yang banyak digunakan pada Jaringan Area Luas atau Wide Area Network (WAN). Dengan cisco router, informasi dapat diteruskan ke alamat-alamat yang berjauhan dan berada di jaringan computer yang berlainan. Untuk dapat meneruskan paket data dari suatu LAN ke LAN lainnya, Cisco router menggunakan tabel dan protocol routing yang berfungsi untuk mengatur lalu lintas data. Paket data yang tiba di router diperiksa dan diteruskan ke alamat yang dituju. Agar paket data yang diterima dapat sampai ke tujuannya dengan cepat, router harus memproses data tersebut dengan sangat tepat.
Untuk itu, Cisco Router menggunakan Central Processing Unit (CPU) seperti yangdigunakan di dalam komputer untuk memproses lalu lintas data tersebut dengan cepat. Seperti komputer, cisco router juga mempunyai sejumlah jenis memori yaitu ROM, RAM, NVRAM dan FLASH, yang berguna untuk membantu kerjanya CPU. Selain itu dilengkapi pula dengan sejumlah interface untuk berhubungan dengan dunia luar dan keluar masuk data. Sistem operasi yang digunakan oleh cisco router adalah Internetwork Operating System (IOS). Memori yang digunakan oleh cisco router masing-masing mempunyai kegunaan sendiri-sendiri sebagai berikut :
• ROM berguna untuk menyimpan sistem bootstrap yang berfungsi untuk mengatur proses boot dan menjalankan Power On Self Test (POST) dan IOS image.
• RAM berguna untuk menyimpan running configuration dan dan sistem operasi IOS yang aktif.
• NVRAM berguna untuk menyimpan konfigurasi awal (start-up configuration)
• FLASH berguna untuk menyimpan IOS image. Dengan menggunakan FLASH, IOS versi baru dapat diperoleh dari TFTP server tanpa harus mengganti komponen dalam router.


Macam-macam Cisco router
Perusahaan cisco membuat router dengan berbagai seri dan model untuk berbagai kelas
atau tingkat penggunaan, seperti :
1. CISCO ROUTER TIPE FIXED TINGKAT AKSES
• Cisco router 700 series
• Cisco router 801-804
• Cisco router 805
• Cisco router 811 dan 813
• Cisco router 827
• Cisco router 1000 series
• Cisco router 2000 series
• Cisco router 2500 series
• Cisco router 3000 series
2. CISCO ROUTER TIPE MODULAR TINGKAT AKSES
• Cisco router 1600 series
• Cisco router 1720 dan 1750
• Cisco router 2500 series
• Cisco router 2600 series
• Cisco router 3600 series
• Cisco router 4000 series
3. CISCO ROUTER TIPE MODULAR TINGKAT INTI
• Cisco router 7000 series, untuk enterprise
• Cisco router 10000 dan 12000 series, untuk enterprise
Umumnya perusahaan cisco memberikan nomor model dengan angka kecil seperti cisco router model 700 untuk jaringan WAN sederhana untuk dipakai oleh perusahaan kecil. Sedangkan nomor dengan angka yang besar seperti cisco router model 12000 digunakan
untuk jaringan WAN kompleks yang dipakai oleh perusahaan besar. Cisco router tipe fixed mempunyai interface tetap yang tidak dapat diganti-ganti sesuai dengan kebutuhan pemakai. Umumnya cisco router jenis modular harganya jauh lebih mahal, tetapi lebih fleksibel dalam penggunaanya. Cisco router 2500 series tersedia dalam
bentuk tipe fixed maupun modular.
Setiap router biasanya mempunyai dua Synchronous Serial port DB-60 (Serial0 dan Serial1) untuk hubungan WAN, satu ethernet port DB-15 (AUI) untuk hubungan LAN, satu Console port RJ-45 untuk akses langsung ke sistem router dan satu Auxiliary Port RJ-45 (AUX) untuk akses ke sistem router dengan modem.

Read more ...

Wide Area Network (WAN) dan Router

Kontribusi Dari Wasi Tri Prasetya
Wednesday, 10 September 2008
Pemutakhiran Terakhir Wednesday, 10 September 2008


Alamat komputer tidak punya network ID yang sama karena berada pada subnet yang berbeda, sehingga untuk mengirimkan paket data tidak bisa menggunakan koneksi hub atau switch. Router dibutuhkan untuk meneruskan paket dari sub-net ke sub-net yang berbeda.


Karakteristik utama WAN

- Menghubungkan peralatan pada tempat yang berjauhan (area luas)
- Menggunakan layanan dengan menyewa, seperti: RBOCs (Perusahan opeasi regional Bell – Regional Bell Operating Company’s), Sprint, MCI, and VPM Internet Services Inc., untuk membangun koneksi antar situs
- Menggunakan koneksi serial dari berbagai jenis untuk mengakses pita lebar dalam lokasi yang berjauhan (luas).
- Bekerja pada layer fisik dan layer datalink dari OSI model
- Melakukan pertukaran paket data dan frames antara ruter dan switch dan LAN yang telah dibangun.

Komponen yang digunakan WAN

- Router dengan beberapa layanan, termasuk interkoneksi dan port-port perantara WAN.
- Modem termasuk perantara layanan voice-grade, unit layanan canel/unit layanan digital (CSU/DSUs), dengan layanan terminal 1/Ethernet 1 (T1/E1), Adapter terminal/terminasi jaringan 1 (TA/NT1s) dengan perantara layanan jaringan digital
terintegrasi (ISDN).
- Server komunikasi pusat dengan dial in and dial out komunikasi antar user

ROUTER

Router adalah jenis khusus dari komputer, yang secara dasar mempunyai komponen yang sama seperti: CPU, memory(ROM, RAM, NVRAM, FLASH), system bus, dan berbagai perantara input/output. Namun router didesain untuk fungsi khusus yang tidak ada di dalam PC, seperti ruter dapat menghubungkan dan menentukan jalur terbaik untuk pengiriman data dalam jaringan.

Seperti juga PC, Router memerlukan sistem operasi untuk menjalankan program aplikasi, router menggunakan Internetwork Operating System (IOS) untuk menjalankan file konfigurasi. File ini berisi instruksi dan parameter yang mengontrol alur lalu lintas data melalui router.

Router menggunakan table dan protokol routing untuk meneruskan paket. File konfigurasi menetapkan seluruh informasi untuk kepastian setup dan menggunakan routing dan routed protocols yang tersedia.

Komponen internal yang utama dari ruter adalah RAM, NVRAM, FLASH MEMORY, ROM dan INTERFACE.

RAM.

- Menyimpan konfigurasi yang sedang berjalan dan sistem ios yang aktif.
- Menyimpan ARP cache (Address Resolution Protocol)
- Menyimpan fast-switching cache
- Menyimpan buffer paket
- Memelihara antrian paket
- Menyimpan memori sementara untuk file konfigurasi ruter selama ruter hidup
- Akan terhapus bila ruter di matikan atau re-start

NVRAM

- Menyimpan file konfigurasi start-up (awal)
- Menyimpan file walau ruter dimatikan atau di re-start.

FLASH MEMORY

- Menyimpan IOS image
- Memungkinkan update software tanpa menghapus dan mengganti chips pada prosesor.
- Menyimpan file walau router dimatikan atau di re-start
- Menyimpan lebih dari satu versi software IOS
- Merupakan alat elektrik yang ROM yang bisa dihapus dan diprogram kembali (EEPROM)

ROM

- Melakukan diagnosa untuk power-on self test (POST)
- Menyimpan program boot dan software sistem operasi dasar
- Untuk upgrade software diperlukan mengganti chips pada motherboard

INTERFACE

- Menghubungkan router ke jaringan untuk meneruskan paket.
- Dapat terpasang pada motherboard ataupun modul terpisah.

Read more ...

Keamanan Sistem Internet

Untuk melihat keamanan sistem Internet perlu diketahui cara kerja sistem Internet. Antara lain, yang perlu diperhatikan adalah hubungan antara komputer di Internet, dan protokol yang digunakan. Internet merupakan jalan raya yang dapat digunakan oleh semua orang (public). Untuk mencapai server tujuan, paket informasi harus melalui beberapa sistem (router, gateway, hosts, atau perangkat-perangkat komunikasi lainnya) yang kemungkinan besar berada di luar kontrol dari kita. Setiap titik yang dilalui memiliki potensi untuk dibobol, disadap, dipalsukan [22].
Kelemahan sebuat sistem terletak kepada komponen yang paling lemah. Asal usul Internet kurang memperhatikan masalah keamanan. Ini mungkin dikarenakan unsur kental dari perguruan tinggi dan lembaga penelitian yang membangun Internet. Sebagai contoh, IP versi 4 yang digunakan di Internet banyak memiliki kelemahan. Hal ini dicoba diperbaiki dengan IP Secure dan IP versi 6.

Read more ...

Intrussion Detection System

Jaringan atau dalam bahasa inggrisnya network saat ini merupakan salah satu teknologi yang sanagt penting dalam perkembangan IT. Bill Gates dalam bukunya yang berjudul "Speed of Throught" membahas tentang dunia baru yang disebut dengan dunia web, yang menurutnya akan menjadi hal yang sangat penting dan menjadi saraf dalam perkembangan IT.

Jaringan memudahkan user untuk mampu berkomunikasi dalam jarak yang tak terbatas. Antara Indonesia dan Inggris dapat dicapai dengan hitungan detik tanpa kita harus naik pesawat dan berkunjung bertemu dengan Ratu Elisabeth untuk tahu seluk beluk negara Inggris.

perkembangan terknologi ini merupakan akibat dari perkembangan teknolog jaringan yang sudahsnagat pesat saat ini. Mulai dari LAN, MAN, dan WAN yang merupakan spesifikasi jaringan berdasar jarak jangkauan area. Seiring dengan hal ini juga, tingkat keamanan sebuah jaringan menjadi hal yang sangat penting. Keamanan jaringan menjadi hal yang perlu sangat diperhatikan.

Dalam jaringan ada banyak hal yang terkait baik itu dari segi hardware maupun software. pada kesempatan kali ini, saya akan sedikit berbagi tentang apa yang disebut IDS(Intrussion Detection System). IDS merupakan salah satu hal yang menjadi sangat penting mengingat apa yang disebut dengan firewall.

Firewall merupakan pengaman system jaringan dengan prinsip menjaga dan mengamankan jaringan dari kejahatan maupun kejahilan diluar jaringan. Firewall mampu melakukan filtrasi terhadap hal yang tidak dizinkan memasuki jaringan dengan ketentuan-ketentuan tertentu. Hal ini tentunya sungguha akan sangat membantu para ADmin jaringan untuk memantau dan maintenance jaringan.

Tetapi ternyata kejahatn terhadap jaringan bukan hnaya berasal dari luar jaringan saja, tapi juga ancaman dari dalam jaringan itu sendiri. Intrusion detection system (IDS) merupakan penghambat atas semua serangan yang akan menggangu sebuah jaringan. IDS memberi peringatan kepada administrator server saat terjadi sebuah aktivitas tertentu yang tidak diinginkan administrator sebagai penanggung jawab sebuah sistem. Selain memberikan peringatan, IDS juga mampu melacak jenis aktivitas yang merugikan sebuah sistem. Suatu IDS akan melakukan pengamatan (monitoring) terhadap paket-paket yang melewati jaringan dan berusaha menemukan apakah terdapat paket-paket yang berisi aktivitas yang mencurigakan sekaligus melakukan tindak lanjut pencegahan. Pada dasarnya terdapat dua macam IDS, yaitu Host – Based dan Network Based.

IDS host-based bekerja pada host yang akan dilindungi. IDS jenis itu dapat melakukan berbagai macam tugas untuk mendeteksi serangan-serangan yang dilakukan pada host tersebut. keunggulan IDS host-based adalah pada tugas-tugas yanga berhubungan dengan kemanan file, misalnya ada tidaknya file yang telah diubah atau ada tidaknya usaha untuk dapat akses ke file-file yang sensitive.

IDS network-based biasa berupa suatu mesin yang khusus dipergunakan untuk melakukan monitoring terhadap seluruh segmen dari jaringan.IDS network-based akan mengumpulkan paket-paket data yang terdapat pada jaringan dan kemudian menganalisisnya serta menentukan apakah paket-paket tersebut berupa suatu paket yang normal atau suatu serangan atau berupa aktivitas yanga mencurigakan.

Read more ...

Network Security part 2

Principles of Ciphers

Encryption transforms a message in such a way that it becomes unintelligible to any party that does not have the secret of how to reverse the transformation. The sender applies an encryption function to the original plaintext message, resulting in a ciphertext message that is sent over the network. The receiver applies a secret decryption function—the inverse of the encryption function—to recover the original plaintext. The ciphertext transmitted across the network is unintelligible to any eavesdropper, assuming she doesn’t know the decryption function. The transformation represented by an encryption function and its corresponding decryption function is called a cipher.
Cryptographers have been led to the principle, first stated in 1883, that encryption and decryption functions should be parameterized by a key, and furthermore that the functions should be considered public knowledge—only the key need be secret. Thus, the ciphertext produced for a given plaintext message depends on both the encryption function and the key. One reason for this principle is that if you depend on the cipher being kept secret, then you have to retire the cipher (not just the keys) when you believe it is no longer secret. This means potentially frequent changes of cipher, which is problematic since it takes a lot of work to develop a new cipher. Also, one of the best ways to know that a cipher is secure is to use it for a long time—if no one breaks it, it’s probably secure. (Fortunately, there are plenty of people who will try to break ciphers and who will let it be widely known when they have succeeded, so no news is generally good news.)
Thus, there is considerable cost and risk in deploying a new cipher. Finally, parameterizing a cipher with keys provides us with what is in effect a very large family of ciphers; by switching keys we essentially switch ciphers, thereby limiting
the amount of data that a cryptanalyst (code-breaker) can use to try to break our
key/cipher, and the amount she can read if she succeeds.
The basic requirement for an encryption algorithm is that it turns plaintext
into ciphertext in such a way that only the intended recipient—the holder of the
decryption key—can recover the plaintext. What this means is that encrypted
messages cannot be read by people who do not hold the key.
It is important to realize that when a potential attacker receives a piece of
ciphertext, he may have more information at his disposal than just the ciphertext
itself. For example, he may know that the plaintext was written in English, which
means that the letter e occurs more often in the plaintext that any other letter; the
frequency of many other letters and common letter combinations can also be predicted.
This information can greatly simplify the task of fi nding the key. Similarly,
he may know something about the likely contents of the message; for example,
the word “ login ” is likely to occur at the start of a remote login session. This may enable a known plaintext attack, which has a much higher chance of success
than a ciphertext only attack. Even better is a chosen plaintext attack, which may
be enabled by feeding some information to the sender that you know the sender
is likely to transmit—such things have happened in wartime, for example.
The best cryptographic algorithms, therefore, can prevent the attacker from
deducing the key even when the individual knows both the plaintext and the
ciphertext. This leaves the attacker with no choice but to try all the possible
keys—exhaustive, “ brute-force ” search. If keys have n bits, then there are 2 n possible values for a key (each of the n bits could be either a zero or a one). An attacker could be so lucky as to try the correct value immediately, or so unlucky as to try every incorrect value before fi nally trying the correct value of the key, therefore, she would have tried all 2 n possible values; the average number of guesses to discover the correct value is halfway between those extremes, 2 n /2. This can be made computationally impractical by choosing a suffi ciently large key space and by making the operation of checking a key reasonably costly. What makes this diffi cult is that computing speeds keep increasing, making formerly infeasible computations feasible. Furthermore, although we are concentrating on the security of data as it moves through the network—that is, the data is sometimes vulnerable for only a short period of time—in general, security people have to consider the vulnerability of data that needs to be stored in archives for tens of years. This argues for a generously large key size. On the other hand, larger keys make encryption and decryption slower Most ciphers are block ciphers : they are defi ned to take as input a plaintext block of a certain fi xed size, typically 64 to 128 bits. Using a block cipher to encrypt each block independently—known as electronic codebook (ECB) mode encryption—has the weakness that a given plaintext block value will always result in the same ciphertext block. Hence recurring block values in the plaintext are recognizable as such in the ciphertext, making it much easier for a cryptanalyst to break the cipher.
To prevent this, block ciphers are always augmented to make the ciphertext for a block vary depending on context. Ways in which a block cipher may be augmented are called modes of operation . A common mode of operation is cipher block chaining (CBC), in which each plaintext block is XORed with the previous block’s ciphertext before being encrypted. The result is that each block’s ciphertext depends in part on the preceding blocks (i.e., on its context). Since the first plaintext block has no preceding block, it is XORed with a random number. That random number, called an initialization vector (IV) , is included with the series of ciphertext blocks so that the fi rst ciphertext block can be decrypted. This mode is illustrated in Figure 1.2 . Another mode of operation is counter mode , in which successive values of a counter (e.g., 1, 2, 3, . . .) are incorporated into the encryption of successive blocks of plaintext.
Reference to : Network Security, Know it All.

Read more ...

Network Security

Computer networks are typically a shared resource used by many applications representing different interests. The Internet is particularly widely shared, being used by competing businesses, mutually antagonistic governments, and opportunistic criminals. Unless security measures are taken, a network conversation or a distributed application may be compromised by an adversary.Consider some threats to secure use of, for example, the World Wide Web. Suppose you are a customer using a credit card to order an item from a website. An obvious threat is that an adversary would eavesdrop on your network communication, reading your messages to obtain your credit card information. How might that eavesdropping be accomplished? It is trivial on a broadcast network such as an Ethernet, where any node can be confi gured to receive all the message traffic on that network. Wireless communication can be monitored without any physical connection. More elaborate approaches include wiretapping and planting spy software on any of the chain of nodes involved. Only in the most extreme cases, such as national security, are serious measures taken to prevent such monitoring, and the Internet is not one of those cases. It is possible and practical, however, to encrypt messages so as to prevent an adversary from understanding the message contents. A protocol that does so is said to provide confi dentiality . Taking the concept a step further, concealing the quantity or destination of communication is called traffi c confi dentiality —because merely knowing how much communication is going where can be useful to an adversary in some situations.
Even with confi dentiality there still remain threats for the website customer. An adversary who can’t read the contents of your encrypted message might still be able to change a few bits in it, resulting in a valid order for, say, a completely different item or perhaps 1,000 units of the item. There are techniques to detect, if not prevent, such tampering. A protocol that detects such message tampering provides data integrity . The adversary could alternatively transmit an extra copy of your message in a replay attack . To the website, it would appear as though you had simply ordered another of the same item you ordered the fi rst time. A protocol that detects replays provides originality . Originality would not, however, preclude the adversary intercepting your order, waiting a while, then transmitting it—in effect, delaying your order. The adversary could thereby arrange for the item to arrive on your doorstep while you are away on vacation, when it can be easily snatched. A protocol that detects such delaying tactics is said to provide timeliness . Data integrity, originality, and timeliness are considered aspects of the more general property of integrity .
Another threat to the customer is unknowingly being directed to a false website. This can result from a DNS attack, in which false information is entered in a domain name server or the name service cache of the customer’s computer.
This leads to translating a correct URL into an incorrect IP address—the address of a false website. A protocol that ensures that you really are talking to whom you think you’re talking is said to provide authentication . Authentication entails integrity since it is meaningless to say that a message came from a certain participant if it is no longer the same message.
The owner of the website can be attacked as well. Some websites have been defaced; the fi les that make up the website content have been remotely accessed and modifi ed without authorization. That is an issue of access control : enforcing the rules regarding who is allowed to do what. Websites have also been subject to denial of service (DoS) attacks, during which would-be customers are unable to access the website because it is being overwhelmed by bogus requests. Ensuring a degree of access is called availability .
Finally, the customer and website face threats from each other. Each could unilaterally deny that a transaction occurred, or invent a nonexistent transaction. Nonrepudiation means that a bogus denial (repudiation) of a transaction can be disproved, and nonforgeability means that claims of a bogus (forged) transaction can be disproved.
Although these examples have been based on Web transactions, there are comparable security threats in almost every network context. Although the Internet was designed with the redundancy to survive physical attacks such as bombing, it was not originally designed to provide the kind of security we have been discussing. Internet security mechanisms have essentially been patches. If a comprehensive redesign of the Internet were to take place, integrating security would likely be the foremost driving factor. That possibility makes this chapter all the more pertinent.
The main tools for securing networked systems are cryptography and firewalls. The bulk of this chapter concerns cryptography-based security.
Reference to : Network Security, Know it All.

Read more ...

FreeBSD Directory Structures

Since FreeBSD uses its file systems to determine many fundamental system operations, the hierarchy of the file system is extremely important. Due to the fact that the hier(7) man page provides a complete description of the directory structure, it will not be duplicated here. Please read hier(7) for more information.
Of significant importance is the root of all directories, the / directory. This directory is the first directory mounted at boot time and it contains the base system necessary at boot time. The root directory also contains mount points for every other file system that you want to mount.
A mount point is a directory where additional file systems can be grafted onto the root file system.
Standard mount points include /usr,/var, /mnt, and /cdrom. These directories are usually referenced to entries in the file /etc/fstab. /etc/fstab is a table of various file systems and mount points for reference by the system. Most of the file systems in /etc/fstab are mounted automatically at boot time
from the script rc(8) unless they contain the noauto option. Consult the fstab(5) manual page for more information on the format of the /etc/fstab file and the options it contains.

Read more ...

Configuring Networking

If you are connecting your computer to an Ethernet LAN that has a DHCP server available, you probably don’t need to do anything to start up automatically on your LAN and even be connected to the Internet. However, if there is no DHCP server on your LAN and you have to configure your TCP/IP connection manually, here is the information you will probably be prompted for during Linux installation: IP address—If you set your own IP address, this is the our-part, dot-separated number that represents your computer to the network. It would take more than a few sentences to explain how IP addresses are formed and how you choose them (see Chapter 5 for a more complete description). An example of a private IP address is 192.168.0.1.

Netmask—The netmask is used to determine what part of an IP address represents the
network and what part represents a particular host computer. An example of a netmask
for a Class C network is 255.255.255.0. If you apply this netmask to an IP address of
192.168.0.1, for example, the network address would be 192.168.0 and the host address
1. Because 0 and 255 can’t be assigned to a particular host, that leaves valid host numbers
between 1 and 254 available for this local network.
Activate on boot—Some Linux install procedures ask you to indicate if you want the
network to start at boot time (you probably do if you have a LAN).
Set the host name—This is the name identifying your computer within your domain.
For example, if your computer were named “baskets” in the handsonhistory.com
domain, your full host name may be baskets.handsonhistory.com. You can either
280
Part III Choosing and Installing a Linux Distribution
set the domain name yourself (manually) or have it assigned automatically, if that information
is being assigned by a DHCP server (automatically via DHCP).
Gateway—This is the IP number of the computer that acts as a gateway to networks
outside your LAN. This typically represents a host computer or router that routes packets
between your LAN and the Internet.
Primary DNS—This is the IP address of the host that translates computer names you
request into IP addresses. It is referred to as a Domain Name System (DNS) server. You
may also have Secondary and Tertiary name servers in case the first one can’t be reached.
(Most ISPs will give you two DNS server addresses.)

Read more ...