Objectives
· Log in to a multi-function device and view security settings.
· Set up Internet access policies based on IP address and application.
· Set up a DMZ for an open access server with a static IP address.
· Set up port forwarding to limit port accessibility to only HTTP.
· Use the Linksys WRT300N Help features.
Background / Preparation
This lab provides instructions for configuring security settings for the Linksys WRT300N. The Linksys provides a software-based firewall to protect internal, local-network clients from attack by external hosts. Connections from internal hosts to external destinations can be filtered based on the IP address, destination website, and application. The Linksys can also be configured to create a demilitarized zone (DMZ) to control access to a server from external hosts. This lab is done in teams of two, and two teams can work together to test each other’s access restrictions and DMZ functionality. It is divided into 2 parts:
· Part 1 – Configuring access policies
· Part 2 – Configuring DMZ settings
The following resources are required:
· Linksys WRT300N or other multi-function device with the default configuration
· User ID and password for the Linksys device if different than the default
· Computer running Windows XP Professional to access the Linksys GUI
· Internal PC to act as a server in the DMZ with HTTP and Telnet servers installed (preconfigured or Discovery Live CD server)
· External server to represent the ISP and Internet (with preconfigured DHCP, HTTP, and Telnet servers running (real server with services installed or Discovery Live CD server)
· Cabling to connect the PC hosts, Linksys WRT300N or multi-function device, and switches
Part 1 – Configuring access policies
Step 1: Build the network and configure the hosts
a. Connect the host computers to switch ports on the multi-function device as shown in the topology diagram. Host-A is the console and is used to access the Linksys GUI. Host-B is initially a test machine but later becomes the DMZ server.
b. Configure the IP settings for both hosts using Windows XP Network Connections and TCP/IP properties. Verify that Host-A is configured as a DHCP client. Assign a static IP address to Host-B in the 192.168.1.x range with a subnet mask of 255.255.255.0. The default gateway should be the internal local network address of the Linksys device.
NOTE: If Host-B is already a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys Basic Setup screen.
c. Use the ipconfig command to display the IP address, subnet mask, and default gateway for Host-A and Host-B and record them in the table. Obtain the IP address and subnet mask of the external server from the instructor and record it in the table
Host IP Address Subnet Mask Default Gateway
Host A 192.168.10.1 255.255.255.0 192.168.10.1
Host B / DMZ server 192.168.20.1 255.255.255.0 192.168.20.1
Eksternal Server 192.168.30.1 255.255.255.0 192.168.30.1
Step 2: Log in to the user interface
a. To access the Linksys or multi-function device web-based GUI, open a browser and enter the default internal IP address for the device, normally 192.168.1.1.
b. Log in using the default user ID and password, or check with the instructor if they are different.
c. The multi-function device should be configured to obtain an IP address from the external DHCP server. The default screen after logging in to the multi-function device is Setup > Basic Setup. What is the Internet connection type?
Jawab
wireless internet connection
d. What is the default router (internal) IP address and subnet mask for the multi-function device?
Jawab:
· IP address : 192.168.1.1
· Subnet mask : 255.255.255.0
e. Verify that the multi-function device has received an external IP address from the DHCP server by clicking the Status > Router tab.
f. What is the external IP address and subnet mask assigned to the multi-function device?
Jawab:
· IP address : 192.168.2.1
· Subnet mask : 255.255.255.0
Step 3: View multi-function device firewall settings
a. The Linksys WRT300N provides a basic firewall that uses Network Address Translation (NAT). In addition, it provides additional firewall functionality using Stateful Packet Inspection (SPI) to detect and block unsolicited traffic from the Internet.
b. From the main screen, click the Security tab to view the Firewall and Internet Filter status. What is the status of SPI Firewall protection?
Jawab:
Status SPI firewall protection : enabled.
c. Which Internet Filter checkboxes are selected?
Jawab:
Internet filter yang digunakan : filter anonymous internet request, filter IDENT (port 113).
d. Click Help to learn more about these settings. What benefits does filtering IDENT provide?
Jawab:
Keuntungan memfilter IDENT Provide : mencegah penyusup dari luar menyerang router melalui internet.
Step 4: Set up Internet access restrictions based on IP address
In Lab 7.3.5, you saw that wireless security features can be used to control which wireless client computers can access the multi-function device, based on their MAC address. This prevents unauthorized external computers from connecting to the wireless access point (AP) and gaining access to the internal local network and the Internet.
The multi-function device can also control which internal users can get out to the Internet from the local network. You can create an Internet access policy to deny or allow specific internal computers access to the Internet based on the IP address, MAC address, and other criteria.
a. From the main multi-function device screen, click the Access Restrictions tab to define Access Policy 1.
b. Enter Block-IP as the policy name. Select Enabled to enable the policy, and then select Deny to prevent Internet access from a specified IP address.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. Click Save Settings to save Internet Access Policy 1 – Block IP.
d. Test the policy by attempting to access the external web server from Host-B. Open a browser and enter the IP address of the external server in the address area. Are you able to access the server?
Jawab:
Ya.
e. Change the status of the Block-IP Policy to Disabled and click Save Settings. Are you able to access the server now?
Jawab:
Tidak
f. What other ways can access policies be used to block Internet access?
Jawab:
Menggunakan proxy
Step 5: Set up an Internet access policy based on an application
You can create an Internet access policy to block specific computers from using certain Internet applications or protocols on the Internet.
a. From the main Linksys GUI screen, click the Access Restrictions tab to define an Internet Access Policy.
b. Enter Block-Telnet as the policy name. Select Enabled to enable the policy, and then click Allow to permit Internet access from a specified IP address as long as it is not one of the applications that is blocked.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. What other Internet applications and protocols can be blocked?
Jawab:
d. Select the Telnet application from the list of applications that can be blocked and then click the double right arrow to add it to the Blocked List. Click Save Settings.
e. Test the policy by opening a command prompt using Start > All Programs > Accessories > Command Prompt.
f. Ping the IP address of the external server from Host-B using the ping command. Are you able to ping the server?
Jawab:
Ya.
g. Telnet to the IP address of the external server from Host-B using the command telnet A.B.C.D (where A.B.C.D is the IP address of the server).
h. Are you able to telnet to the server?
Jawab:
Tidak.
NOTE: If you are not going to perform lab Part 2 at this time and others will be using the equipment after you, skip to Step 3 of Part 2 and restore the multi-function device to its default settings.
Part 2 – Configuring a DMZ on the multi-function device
Step 1: Set up a simple DMZ
It is sometimes necessary to allow access to a computer from the Internet while still protecting other internal local network computers. To accomplish this, you can set up a demilitarized zone (DMZ) that allows open access to any ports and services running on the specified server. Any requests made for services to the outside address of the multi-function device will be redirected to the server specified.
a. Host-B will act as the DMZ server and should be running HTTP and Telnet servers. Verify the Host-B has a static IP address or, if Host-B is a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys device Basic Setup screen.
b. From the main Linksys GUI screen, click the Applications & Gaming tab then click DMZ.
c. Click Help to learn more about the DMZ. For what other reasons might you want to set up a host in the DMZ?
Jawab:
Karena DMZ berguna untuk menambahkan lapisan keamanan untuk LAN.
d. The DMZ feature is disabled by default. Select Enabled to enable the DMZ. Leave the Source IP Address selected as Any IP Address, and enter the IP address of Host-B in the Destination IP address. Click Save Settings and click Continue when prompted.
e. Test basic access to the DMZ server by pinging from the external server to the outside address of the multi-function device. Use the ping –a command to verify that it is actually the DMZ server responding and not the multi-function device. Are you able to ping the DMZ server?
Jawab:
Ya.
f. Test HTTP access to the DMZ server by opening a browser on the external server and pointing to the external IP address of the multi-function device. Try the same thing from a browser on Host-A to Host-B using the internal addresses. Are you able to access the web page?
Jawab:
Ya.
g. Test Telnet access by opening a command prompt as described in Step 5. Telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak.
Step 2: Set up a host with single port forwarding
The basic DMZ hosting set up in Step 6 allows open access to all ports and services running on the server, such as HTTP, FTP, and Telnet,. If a host is to be used for a particular function, such as FTP or web services, access should be limited to the type of services provided. Single port forwarding can accomplish this and is more secure than the basic DMZ, because it only opens the ports needed. Before completing this step, disable the DMZ settings for step 1.
Host-B is the server to which ports are forwarded, but access is limited to only HTTP (web) protocol.
a. From the main screen, click the Applications & Gaming tab, and then click Single Port Forwarding to specify applications and port numbers.
b. Click the pull-down menu for the first entry under Application Name and select HTTP. This is the web server protocol port 80.
c. In the first To IP Address field, enter the IP address of Host-B and select Enabled. Click Save Settings.
d. Test HTTP access to the DMZ host by opening a browser the external server and pointing to the outside address of the multi-function device. Try the same thing from a browser on Host-A to Host-B. Are you able to access the web page?
Jawab:
Ya.
e. Test Telnet access by opening a command prompt as described in Step 5. Attempt to telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside IP address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak
Step 3: Restore the multi-function device to its default settings
a. To restore the Linksys to its factory default settings, click the Administration > Factory Defaults tab.
b. Click the Restore Factory Defaults button. Any entries or changes to settings will be lost.
NOTE: The current settings can be saved and restored at a later time using the Administration > Management tab and the Backup Configuration and Restore Configuration buttons.
Kamis, 11 November 2010
lab 8.4.2 configuring access policies and DMZ settings
Objectives
· Log in to a multi-function device and view security settings.
· Set up Internet access policies based on IP address and application.
· Set up a DMZ for an open access server with a static IP address.
· Set up port forwarding to limit port accessibility to only HTTP.
· Use the Linksys WRT300N Help features.
Background / Preparation
This lab provides instructions for configuring security settings for the Linksys WRT300N. The Linksys provides a software-based firewall to protect internal, local-network clients from attack by external hosts. Connections from internal hosts to external destinations can be filtered based on the IP address, destination website, and application. The Linksys can also be configured to create a demilitarized zone (DMZ) to control access to a server from external hosts. This lab is done in teams of two, and two teams can work together to test each other’s access restrictions and DMZ functionality. It is divided into 2 parts:
· Part 1 – Configuring access policies
· Part 2 – Configuring DMZ settings
The following resources are required:
· Linksys WRT300N or other multi-function device with the default configuration
· User ID and password for the Linksys device if different than the default
· Computer running Windows XP Professional to access the Linksys GUI
· Internal PC to act as a server in the DMZ with HTTP and Telnet servers installed (preconfigured or Discovery Live CD server)
· External server to represent the ISP and Internet (with preconfigured DHCP, HTTP, and Telnet servers running (real server with services installed or Discovery Live CD server)
· Cabling to connect the PC hosts, Linksys WRT300N or multi-function device, and switches
Part 1 – Configuring access policies
Step 1: Build the network and configure the hosts
a. Connect the host computers to switch ports on the multi-function device as shown in the topology diagram. Host-A is the console and is used to access the Linksys GUI. Host-B is initially a test machine but later becomes the DMZ server.
b. Configure the IP settings for both hosts using Windows XP Network Connections and TCP/IP properties. Verify that Host-A is configured as a DHCP client. Assign a static IP address to Host-B in the 192.168.1.x range with a subnet mask of 255.255.255.0. The default gateway should be the internal local network address of the Linksys device.
NOTE: If Host-B is already a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys Basic Setup screen.
c. Use the ipconfig command to display the IP address, subnet mask, and default gateway for Host-A and Host-B and record them in the table. Obtain the IP address and subnet mask of the external server from the instructor and record it in the table
Host IP Address Subnet Mask Default Gateway
Host A 192.168.10.1 255.255.255.0 192.168.10.1
Host B / DMZ server 192.168.20.1 255.255.255.0 192.168.20.1
Eksternal Server 192.168.30.1 255.255.255.0 192.168.30.1
Step 2: Log in to the user interface
a. To access the Linksys or multi-function device web-based GUI, open a browser and enter the default internal IP address for the device, normally 192.168.1.1.
b. Log in using the default user ID and password, or check with the instructor if they are different.
c. The multi-function device should be configured to obtain an IP address from the external DHCP server. The default screen after logging in to the multi-function device is Setup > Basic Setup. What is the Internet connection type?
Jawab
wireless internet connection
d. What is the default router (internal) IP address and subnet mask for the multi-function device?
Jawab:
· IP address : 192.168.1.1
· Subnet mask : 255.255.255.0
e. Verify that the multi-function device has received an external IP address from the DHCP server by clicking the Status > Router tab.
f. What is the external IP address and subnet mask assigned to the multi-function device?
Jawab:
· IP address : 192.168.2.1
· Subnet mask : 255.255.255.0
Step 3: View multi-function device firewall settings
a. The Linksys WRT300N provides a basic firewall that uses Network Address Translation (NAT). In addition, it provides additional firewall functionality using Stateful Packet Inspection (SPI) to detect and block unsolicited traffic from the Internet.
b. From the main screen, click the Security tab to view the Firewall and Internet Filter status. What is the status of SPI Firewall protection?
Jawab:
Status SPI firewall protection : enabled.
c. Which Internet Filter checkboxes are selected?
Jawab:
Internet filter yang digunakan : filter anonymous internet request, filter IDENT (port 113).
d. Click Help to learn more about these settings. What benefits does filtering IDENT provide?
Jawab:
Keuntungan memfilter IDENT Provide : mencegah penyusup dari luar menyerang router melalui internet.
Step 4: Set up Internet access restrictions based on IP address
In Lab 7.3.5, you saw that wireless security features can be used to control which wireless client computers can access the multi-function device, based on their MAC address. This prevents unauthorized external computers from connecting to the wireless access point (AP) and gaining access to the internal local network and the Internet.
The multi-function device can also control which internal users can get out to the Internet from the local network. You can create an Internet access policy to deny or allow specific internal computers access to the Internet based on the IP address, MAC address, and other criteria.
a. From the main multi-function device screen, click the Access Restrictions tab to define Access Policy 1.
b. Enter Block-IP as the policy name. Select Enabled to enable the policy, and then select Deny to prevent Internet access from a specified IP address.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. Click Save Settings to save Internet Access Policy 1 – Block IP.
d. Test the policy by attempting to access the external web server from Host-B. Open a browser and enter the IP address of the external server in the address area. Are you able to access the server?
Jawab:
Ya.
e. Change the status of the Block-IP Policy to Disabled and click Save Settings. Are you able to access the server now?
Jawab:
Tidak
f. What other ways can access policies be used to block Internet access?
Jawab:
Menggunakan proxy
Step 5: Set up an Internet access policy based on an application
You can create an Internet access policy to block specific computers from using certain Internet applications or protocols on the Internet.
a. From the main Linksys GUI screen, click the Access Restrictions tab to define an Internet Access Policy.
b. Enter Block-Telnet as the policy name. Select Enabled to enable the policy, and then click Allow to permit Internet access from a specified IP address as long as it is not one of the applications that is blocked.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. What other Internet applications and protocols can be blocked?
Jawab:
d. Select the Telnet application from the list of applications that can be blocked and then click the double right arrow to add it to the Blocked List. Click Save Settings.
e. Test the policy by opening a command prompt using Start > All Programs > Accessories > Command Prompt.
f. Ping the IP address of the external server from Host-B using the ping command. Are you able to ping the server?
Jawab:
Ya.
g. Telnet to the IP address of the external server from Host-B using the command telnet A.B.C.D (where A.B.C.D is the IP address of the server).
h. Are you able to telnet to the server?
Jawab:
Tidak.
NOTE: If you are not going to perform lab Part 2 at this time and others will be using the equipment after you, skip to Step 3 of Part 2 and restore the multi-function device to its default settings.
Part 2 – Configuring a DMZ on the multi-function device
Step 1: Set up a simple DMZ
It is sometimes necessary to allow access to a computer from the Internet while still protecting other internal local network computers. To accomplish this, you can set up a demilitarized zone (DMZ) that allows open access to any ports and services running on the specified server. Any requests made for services to the outside address of the multi-function device will be redirected to the server specified.
a. Host-B will act as the DMZ server and should be running HTTP and Telnet servers. Verify the Host-B has a static IP address or, if Host-B is a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys device Basic Setup screen.
b. From the main Linksys GUI screen, click the Applications & Gaming tab then click DMZ.
c. Click Help to learn more about the DMZ. For what other reasons might you want to set up a host in the DMZ?
Jawab:
Karena DMZ berguna untuk menambahkan lapisan keamanan untuk LAN.
d. The DMZ feature is disabled by default. Select Enabled to enable the DMZ. Leave the Source IP Address selected as Any IP Address, and enter the IP address of Host-B in the Destination IP address. Click Save Settings and click Continue when prompted.
e. Test basic access to the DMZ server by pinging from the external server to the outside address of the multi-function device. Use the ping –a command to verify that it is actually the DMZ server responding and not the multi-function device. Are you able to ping the DMZ server?
Jawab:
Ya.
f. Test HTTP access to the DMZ server by opening a browser on the external server and pointing to the external IP address of the multi-function device. Try the same thing from a browser on Host-A to Host-B using the internal addresses. Are you able to access the web page?
Jawab:
Ya.
g. Test Telnet access by opening a command prompt as described in Step 5. Telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak.
Step 2: Set up a host with single port forwarding
The basic DMZ hosting set up in Step 6 allows open access to all ports and services running on the server, such as HTTP, FTP, and Telnet,. If a host is to be used for a particular function, such as FTP or web services, access should be limited to the type of services provided. Single port forwarding can accomplish this and is more secure than the basic DMZ, because it only opens the ports needed. Before completing this step, disable the DMZ settings for step 1.
Host-B is the server to which ports are forwarded, but access is limited to only HTTP (web) protocol.
a. From the main screen, click the Applications & Gaming tab, and then click Single Port Forwarding to specify applications and port numbers.
b. Click the pull-down menu for the first entry under Application Name and select HTTP. This is the web server protocol port 80.
c. In the first To IP Address field, enter the IP address of Host-B and select Enabled. Click Save Settings.
d. Test HTTP access to the DMZ host by opening a browser the external server and pointing to the outside address of the multi-function device. Try the same thing from a browser on Host-A to Host-B. Are you able to access the web page?
Jawab:
Ya.
e. Test Telnet access by opening a command prompt as described in Step 5. Attempt to telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside IP address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak
Step 3: Restore the multi-function device to its default settings
a. To restore the Linksys to its factory default settings, click the Administration > Factory Defaults tab.
b. Click the Restore Factory Defaults button. Any entries or changes to settings will be lost.
NOTE: The current settings can be saved and restored at a later time using the Administration > Management tab and the Backup Configuration and Restore Configuration buttons.
· Log in to a multi-function device and view security settings.
· Set up Internet access policies based on IP address and application.
· Set up a DMZ for an open access server with a static IP address.
· Set up port forwarding to limit port accessibility to only HTTP.
· Use the Linksys WRT300N Help features.
Background / Preparation
This lab provides instructions for configuring security settings for the Linksys WRT300N. The Linksys provides a software-based firewall to protect internal, local-network clients from attack by external hosts. Connections from internal hosts to external destinations can be filtered based on the IP address, destination website, and application. The Linksys can also be configured to create a demilitarized zone (DMZ) to control access to a server from external hosts. This lab is done in teams of two, and two teams can work together to test each other’s access restrictions and DMZ functionality. It is divided into 2 parts:
· Part 1 – Configuring access policies
· Part 2 – Configuring DMZ settings
The following resources are required:
· Linksys WRT300N or other multi-function device with the default configuration
· User ID and password for the Linksys device if different than the default
· Computer running Windows XP Professional to access the Linksys GUI
· Internal PC to act as a server in the DMZ with HTTP and Telnet servers installed (preconfigured or Discovery Live CD server)
· External server to represent the ISP and Internet (with preconfigured DHCP, HTTP, and Telnet servers running (real server with services installed or Discovery Live CD server)
· Cabling to connect the PC hosts, Linksys WRT300N or multi-function device, and switches
Part 1 – Configuring access policies
Step 1: Build the network and configure the hosts
a. Connect the host computers to switch ports on the multi-function device as shown in the topology diagram. Host-A is the console and is used to access the Linksys GUI. Host-B is initially a test machine but later becomes the DMZ server.
b. Configure the IP settings for both hosts using Windows XP Network Connections and TCP/IP properties. Verify that Host-A is configured as a DHCP client. Assign a static IP address to Host-B in the 192.168.1.x range with a subnet mask of 255.255.255.0. The default gateway should be the internal local network address of the Linksys device.
NOTE: If Host-B is already a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys Basic Setup screen.
c. Use the ipconfig command to display the IP address, subnet mask, and default gateway for Host-A and Host-B and record them in the table. Obtain the IP address and subnet mask of the external server from the instructor and record it in the table
Host IP Address Subnet Mask Default Gateway
Host A 192.168.10.1 255.255.255.0 192.168.10.1
Host B / DMZ server 192.168.20.1 255.255.255.0 192.168.20.1
Eksternal Server 192.168.30.1 255.255.255.0 192.168.30.1
Step 2: Log in to the user interface
a. To access the Linksys or multi-function device web-based GUI, open a browser and enter the default internal IP address for the device, normally 192.168.1.1.
b. Log in using the default user ID and password, or check with the instructor if they are different.
c. The multi-function device should be configured to obtain an IP address from the external DHCP server. The default screen after logging in to the multi-function device is Setup > Basic Setup. What is the Internet connection type?
Jawab
wireless internet connection
d. What is the default router (internal) IP address and subnet mask for the multi-function device?
Jawab:
· IP address : 192.168.1.1
· Subnet mask : 255.255.255.0
e. Verify that the multi-function device has received an external IP address from the DHCP server by clicking the Status > Router tab.
f. What is the external IP address and subnet mask assigned to the multi-function device?
Jawab:
· IP address : 192.168.2.1
· Subnet mask : 255.255.255.0
Step 3: View multi-function device firewall settings
a. The Linksys WRT300N provides a basic firewall that uses Network Address Translation (NAT). In addition, it provides additional firewall functionality using Stateful Packet Inspection (SPI) to detect and block unsolicited traffic from the Internet.
b. From the main screen, click the Security tab to view the Firewall and Internet Filter status. What is the status of SPI Firewall protection?
Jawab:
Status SPI firewall protection : enabled.
c. Which Internet Filter checkboxes are selected?
Jawab:
Internet filter yang digunakan : filter anonymous internet request, filter IDENT (port 113).
d. Click Help to learn more about these settings. What benefits does filtering IDENT provide?
Jawab:
Keuntungan memfilter IDENT Provide : mencegah penyusup dari luar menyerang router melalui internet.
Step 4: Set up Internet access restrictions based on IP address
In Lab 7.3.5, you saw that wireless security features can be used to control which wireless client computers can access the multi-function device, based on their MAC address. This prevents unauthorized external computers from connecting to the wireless access point (AP) and gaining access to the internal local network and the Internet.
The multi-function device can also control which internal users can get out to the Internet from the local network. You can create an Internet access policy to deny or allow specific internal computers access to the Internet based on the IP address, MAC address, and other criteria.
a. From the main multi-function device screen, click the Access Restrictions tab to define Access Policy 1.
b. Enter Block-IP as the policy name. Select Enabled to enable the policy, and then select Deny to prevent Internet access from a specified IP address.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. Click Save Settings to save Internet Access Policy 1 – Block IP.
d. Test the policy by attempting to access the external web server from Host-B. Open a browser and enter the IP address of the external server in the address area. Are you able to access the server?
Jawab:
Ya.
e. Change the status of the Block-IP Policy to Disabled and click Save Settings. Are you able to access the server now?
Jawab:
Tidak
f. What other ways can access policies be used to block Internet access?
Jawab:
Menggunakan proxy
Step 5: Set up an Internet access policy based on an application
You can create an Internet access policy to block specific computers from using certain Internet applications or protocols on the Internet.
a. From the main Linksys GUI screen, click the Access Restrictions tab to define an Internet Access Policy.
b. Enter Block-Telnet as the policy name. Select Enabled to enable the policy, and then click Allow to permit Internet access from a specified IP address as long as it is not one of the applications that is blocked.
c. Click the Edit List button and enter the IP address of Host-B. Click Save Settings and then Close. What other Internet applications and protocols can be blocked?
Jawab:
d. Select the Telnet application from the list of applications that can be blocked and then click the double right arrow to add it to the Blocked List. Click Save Settings.
e. Test the policy by opening a command prompt using Start > All Programs > Accessories > Command Prompt.
f. Ping the IP address of the external server from Host-B using the ping command. Are you able to ping the server?
Jawab:
Ya.
g. Telnet to the IP address of the external server from Host-B using the command telnet A.B.C.D (where A.B.C.D is the IP address of the server).
h. Are you able to telnet to the server?
Jawab:
Tidak.
NOTE: If you are not going to perform lab Part 2 at this time and others will be using the equipment after you, skip to Step 3 of Part 2 and restore the multi-function device to its default settings.
Part 2 – Configuring a DMZ on the multi-function device
Step 1: Set up a simple DMZ
It is sometimes necessary to allow access to a computer from the Internet while still protecting other internal local network computers. To accomplish this, you can set up a demilitarized zone (DMZ) that allows open access to any ports and services running on the specified server. Any requests made for services to the outside address of the multi-function device will be redirected to the server specified.
a. Host-B will act as the DMZ server and should be running HTTP and Telnet servers. Verify the Host-B has a static IP address or, if Host-B is a DHCP client, you can reserve its current address and make it static using the DHCP Reservation feature on the Linksys device Basic Setup screen.
b. From the main Linksys GUI screen, click the Applications & Gaming tab then click DMZ.
c. Click Help to learn more about the DMZ. For what other reasons might you want to set up a host in the DMZ?
Jawab:
Karena DMZ berguna untuk menambahkan lapisan keamanan untuk LAN.
d. The DMZ feature is disabled by default. Select Enabled to enable the DMZ. Leave the Source IP Address selected as Any IP Address, and enter the IP address of Host-B in the Destination IP address. Click Save Settings and click Continue when prompted.
e. Test basic access to the DMZ server by pinging from the external server to the outside address of the multi-function device. Use the ping –a command to verify that it is actually the DMZ server responding and not the multi-function device. Are you able to ping the DMZ server?
Jawab:
Ya.
f. Test HTTP access to the DMZ server by opening a browser on the external server and pointing to the external IP address of the multi-function device. Try the same thing from a browser on Host-A to Host-B using the internal addresses. Are you able to access the web page?
Jawab:
Ya.
g. Test Telnet access by opening a command prompt as described in Step 5. Telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak.
Step 2: Set up a host with single port forwarding
The basic DMZ hosting set up in Step 6 allows open access to all ports and services running on the server, such as HTTP, FTP, and Telnet,. If a host is to be used for a particular function, such as FTP or web services, access should be limited to the type of services provided. Single port forwarding can accomplish this and is more secure than the basic DMZ, because it only opens the ports needed. Before completing this step, disable the DMZ settings for step 1.
Host-B is the server to which ports are forwarded, but access is limited to only HTTP (web) protocol.
a. From the main screen, click the Applications & Gaming tab, and then click Single Port Forwarding to specify applications and port numbers.
b. Click the pull-down menu for the first entry under Application Name and select HTTP. This is the web server protocol port 80.
c. In the first To IP Address field, enter the IP address of Host-B and select Enabled. Click Save Settings.
d. Test HTTP access to the DMZ host by opening a browser the external server and pointing to the outside address of the multi-function device. Try the same thing from a browser on Host-A to Host-B. Are you able to access the web page?
Jawab:
Ya.
e. Test Telnet access by opening a command prompt as described in Step 5. Attempt to telnet to the outside IP address of the multi-function device using the command telnet A.B.C.D (where A.B.C.D is the outside IP address of the multi-function device).
Are you able to telnet to the server?
Jawab:
Tidak
Step 3: Restore the multi-function device to its default settings
a. To restore the Linksys to its factory default settings, click the Administration > Factory Defaults tab.
b. Click the Restore Factory Defaults button. Any entries or changes to settings will be lost.
NOTE: The current settings can be saved and restored at a later time using the Administration > Management tab and the Backup Configuration and Restore Configuration buttons.
lab 8.4.3 performing a vulnerability analysis
CAUTION: This lab may violate legal and organizational security policies. The security analyzer downloaded in this lab should only be used for instructional purposes in a lab environment. Before using a security analyzer on a live network, check with your instructor and network administration staff regarding internal policies concerning the use of these tools.
Objectives
· Download and install security analyzer software.
· Test a host to determine potential security vulnerabilities.
Background / Preparation
Security analyzers are valuable tools used by network administrators and auditors to identify network and host vulnerabilities. There are many vulnerability analysis tools, also known as security scanners, available to test host and network security. In this lab, you will download and install the Microsoft Baseline Security Analyzer (MBSA). MBSA is designed to identify potential security issues related specifically to Microsoft operating systems, updates, and applications. It also identifies unnecessary services that may be running, as well as any open ports.
MBSA runs on Windows Server and Windows XP systems and scans for common security misconfigurations and missing security updates for the operating system as well as most versions of Internet Information Server (IIS), SQL Server, Internet Explorer (IE), and Office products. MBSA offers specific recommendations to correct potential problems.
This lab can be done individually or in teams of two.
The following resources are required:
· Computer running Windows XP Professional to act as the test station.
· High-speed Internet connection for downloading MBSA (unless pre-installed).
· Computer must be attached to the integrated router switch or a standalone hub or switch.
· Optionally, you can have a server running a combination of DHCP, HTTP, FTP, and Telnet (preconfigured).
Step 1: Download and install MBSA
a. Open a browser and go to the MBSA web page at: http://www.microsoft.com/technet/security/tools/mbsa2/default.mspx
b. What is the latest version of MBSA available?
Jawab;
MBSA 2.2
c. What are some of the features MBSA provides?
Jawab:
· Command-line and Graphical User Interface (GUI) options
· Scan local computer, remote computer, or groups of computer
· Scan against Microsoft's maintained list of updates (on Microsoft.com) or local server running Software Update Services 1.0
· Scan for common security configuration vulnerabilitie
· Scan for missing security updates
· View reports in MBSA Graphical User Interface or Command Line Interface
· Compatibility with SMS 2.0 and 2003 Software Update Services Feature Pack
· Support for single processor and multiprocessor configurations
· Localized to English, French, German, and Japanese although MBSA 1.2.1 can scan a machine of any local
d. Scroll down the page and select the desired language to begin the download process.
e. Click Continue to validate the copy of Microsoft Windows you are running.
f. Click Download Files below and select the file you want to download. (The English setup file is MBSASetup-EN.msi). Click the Download button on the right of this file. How many megabytes is the file to download?
Jawab:
11,5 MB
g. When the File Download – Security Warning dialog box displays, click Save and download the file to a specified folder or the desktop. You can also run it from the download website.
h. Once the download is complete, make sure all other applications are closed. Double-click the downloaded file. Click Run to start the Setup program, and then click Run if you are prompted with a Security Warning. Click Next on the MBSA Setup screen.
i. Select the radio button to accept the license agreement and click Next. Accept the defaults as the install progresses, and then click Finish. Click OK on the final MBSA Setup screen, and close the folder to return to the Windows desktop.
Step 2: Build the network and configure the hosts
a. Connect the host computer(s) to the integrated router, a hub, or a switch as shown in the topology diagram. Host-A is the test station where MBSA will be installed. The server is optional.
b. Set the IP configuration for the host(s) using Windows XP Network Connections and TCP/IP properties. If the host is connected to the integrated router, configure it as a DHCP client; otherwise go to Step 1d.
c. If the host is connected to a hub or switch and a DHCP server is not available, configure it manually by assigning a static IP address.
Which IP address and subnet mask does Host-A and the server (optional) have?
Jawab:
· IP address : 192.168.10.1
· Subnet mask : 255.255.255.0
Step 3: Run MBSA on a host
a. Double-click the desktop icon for MBSA or run it from Start > All Programs. When the main screen displays, which options are available?
Jawab:
· Pick a computer to scan
· Pick multiple computer to scan
· Pick a security report to view
· Help
· About
· Microsoft Security Web Site
Step 4: Select a computer to scan
a. On the left side of the screen, click Pick a computer to scan. The computer shown as the default is the one on which MBSA is installed.
b. What are the two ways to specify a computer to be scanned?
Jawab:
· Scan using assign Update Services servers only
· Scan using Microsoft Update only
c. Accept the default computer to be scanned. De-select Check for IIS and SQL administrative vulnerabilities, since these services are not likely to be installed on the computer being scanned. Click Start Scan.
Step 5: View security update scan results
a. View the security report. What are the results of the security update scan
Jawab:
Tidak ada terjadi masalah apa-apa
b. If there are any red or yellow Xs, click How to correct this. Which solution is recommended?
Jawab:
Tida ada terdapat red atau yellow Xs
Step 6: View Windows scan results in the security report
a. Scroll down to view the second section of the report that shows Windows Scan Results. Were there any administrative vulnerabilities identified?
Jawab:
Local Account Password Test, Automatic Update, Guest Account, File system.
b. On the Additional System Information section of the screen (below), in the Issue column forServices, click What was scanned, and click Result details under the Result column to get a description of the check that was run. What did you find? When finished, close both popup windows to return to the security report.
Step 7: View Desktop Application Scan Results in the Security report
a. Scroll down to view the last section of the report that shows Desktop Applications Scan Results. Were there any administrative vulnerabilities identified?
Jawab:
Macro security
b. How many Microsoft Office products are installed?
Jawab:
4
c. Were there any security issues with Macro Security for any of them?
Jawab:
Tidak
Step 8: Scan a server, if available
a. If a server with various services is available, click Pick a computer to scan from the main MBSA screen and enter the IP address of the server, and then click Start Scan. Which security vulnerabilities were identified?
Jawab:
b. Were there any potentially unnecessary services installed? Which port numbers were they on?
Jawab:
Step 9: Uninstall MBSA using Control Panel Add/Remove Programs
a. This step is optional, depending on whether the host will be automatically restored later by a network process.
b. To uninstall MBSA, click Start > Control Panel > Add/Remove Programs. Locate the MBSA application and uninstall it. It should be listed as Microsoft Baseline Security Analyzer 2.0.1. Click Remove, and then click Yes to confirm removal of the MBSA application. When finished, close all windows to return to the desktop.
Step 10: Reflection
a. The MBSA tool is designed to identify vulnerabilities for Windows-based computers. Search the Internet for other tools that might exist. List some of the tools discovered.
Jawab:
· Client versions of Windows, including Windows
· Windows Server, including Windows Server 2008
· SQL Server
· Internet Information Server (IIS)
· Internet Explorer
· Microsoft Office
b. Which tools might there be for non-Windows computers? Search the Internet for other tools that might exist and list some of them here.
Jawab:
SQL server
c. Which other steps could you take to help secure a computer against Internet attacks?
Jawab:
Step 8
Objectives
· Download and install security analyzer software.
· Test a host to determine potential security vulnerabilities.
Background / Preparation
Security analyzers are valuable tools used by network administrators and auditors to identify network and host vulnerabilities. There are many vulnerability analysis tools, also known as security scanners, available to test host and network security. In this lab, you will download and install the Microsoft Baseline Security Analyzer (MBSA). MBSA is designed to identify potential security issues related specifically to Microsoft operating systems, updates, and applications. It also identifies unnecessary services that may be running, as well as any open ports.
MBSA runs on Windows Server and Windows XP systems and scans for common security misconfigurations and missing security updates for the operating system as well as most versions of Internet Information Server (IIS), SQL Server, Internet Explorer (IE), and Office products. MBSA offers specific recommendations to correct potential problems.
This lab can be done individually or in teams of two.
The following resources are required:
· Computer running Windows XP Professional to act as the test station.
· High-speed Internet connection for downloading MBSA (unless pre-installed).
· Computer must be attached to the integrated router switch or a standalone hub or switch.
· Optionally, you can have a server running a combination of DHCP, HTTP, FTP, and Telnet (preconfigured).
Step 1: Download and install MBSA
a. Open a browser and go to the MBSA web page at: http://www.microsoft.com/technet/security/tools/mbsa2/default.mspx
b. What is the latest version of MBSA available?
Jawab;
MBSA 2.2
c. What are some of the features MBSA provides?
Jawab:
· Command-line and Graphical User Interface (GUI) options
· Scan local computer, remote computer, or groups of computer
· Scan against Microsoft's maintained list of updates (on Microsoft.com) or local server running Software Update Services 1.0
· Scan for common security configuration vulnerabilitie
· Scan for missing security updates
· View reports in MBSA Graphical User Interface or Command Line Interface
· Compatibility with SMS 2.0 and 2003 Software Update Services Feature Pack
· Support for single processor and multiprocessor configurations
· Localized to English, French, German, and Japanese although MBSA 1.2.1 can scan a machine of any local
d. Scroll down the page and select the desired language to begin the download process.
e. Click Continue to validate the copy of Microsoft Windows you are running.
f. Click Download Files below and select the file you want to download. (The English setup file is MBSASetup-EN.msi). Click the Download button on the right of this file. How many megabytes is the file to download?
Jawab:
11,5 MB
g. When the File Download – Security Warning dialog box displays, click Save and download the file to a specified folder or the desktop. You can also run it from the download website.
h. Once the download is complete, make sure all other applications are closed. Double-click the downloaded file. Click Run to start the Setup program, and then click Run if you are prompted with a Security Warning. Click Next on the MBSA Setup screen.
i. Select the radio button to accept the license agreement and click Next. Accept the defaults as the install progresses, and then click Finish. Click OK on the final MBSA Setup screen, and close the folder to return to the Windows desktop.
Step 2: Build the network and configure the hosts
a. Connect the host computer(s) to the integrated router, a hub, or a switch as shown in the topology diagram. Host-A is the test station where MBSA will be installed. The server is optional.
b. Set the IP configuration for the host(s) using Windows XP Network Connections and TCP/IP properties. If the host is connected to the integrated router, configure it as a DHCP client; otherwise go to Step 1d.
c. If the host is connected to a hub or switch and a DHCP server is not available, configure it manually by assigning a static IP address.
Which IP address and subnet mask does Host-A and the server (optional) have?
Jawab:
· IP address : 192.168.10.1
· Subnet mask : 255.255.255.0
Step 3: Run MBSA on a host
a. Double-click the desktop icon for MBSA or run it from Start > All Programs. When the main screen displays, which options are available?
Jawab:
· Pick a computer to scan
· Pick multiple computer to scan
· Pick a security report to view
· Help
· About
· Microsoft Security Web Site
Step 4: Select a computer to scan
a. On the left side of the screen, click Pick a computer to scan. The computer shown as the default is the one on which MBSA is installed.
b. What are the two ways to specify a computer to be scanned?
Jawab:
· Scan using assign Update Services servers only
· Scan using Microsoft Update only
c. Accept the default computer to be scanned. De-select Check for IIS and SQL administrative vulnerabilities, since these services are not likely to be installed on the computer being scanned. Click Start Scan.
Step 5: View security update scan results
a. View the security report. What are the results of the security update scan
Jawab:
Tidak ada terjadi masalah apa-apa
b. If there are any red or yellow Xs, click How to correct this. Which solution is recommended?
Jawab:
Tida ada terdapat red atau yellow Xs
Step 6: View Windows scan results in the security report
a. Scroll down to view the second section of the report that shows Windows Scan Results. Were there any administrative vulnerabilities identified?
Jawab:
Local Account Password Test, Automatic Update, Guest Account, File system.
b. On the Additional System Information section of the screen (below), in the Issue column forServices, click What was scanned, and click Result details under the Result column to get a description of the check that was run. What did you find? When finished, close both popup windows to return to the security report.
Step 7: View Desktop Application Scan Results in the Security report
a. Scroll down to view the last section of the report that shows Desktop Applications Scan Results. Were there any administrative vulnerabilities identified?
Jawab:
Macro security
b. How many Microsoft Office products are installed?
Jawab:
4
c. Were there any security issues with Macro Security for any of them?
Jawab:
Tidak
Step 8: Scan a server, if available
a. If a server with various services is available, click Pick a computer to scan from the main MBSA screen and enter the IP address of the server, and then click Start Scan. Which security vulnerabilities were identified?
Jawab:
b. Were there any potentially unnecessary services installed? Which port numbers were they on?
Jawab:
Step 9: Uninstall MBSA using Control Panel Add/Remove Programs
a. This step is optional, depending on whether the host will be automatically restored later by a network process.
b. To uninstall MBSA, click Start > Control Panel > Add/Remove Programs. Locate the MBSA application and uninstall it. It should be listed as Microsoft Baseline Security Analyzer 2.0.1. Click Remove, and then click Yes to confirm removal of the MBSA application. When finished, close all windows to return to the desktop.
Step 10: Reflection
a. The MBSA tool is designed to identify vulnerabilities for Windows-based computers. Search the Internet for other tools that might exist. List some of the tools discovered.
Jawab:
· Client versions of Windows, including Windows
· Windows Server, including Windows Server 2008
· SQL Server
· Internet Information Server (IIS)
· Internet Explorer
· Microsoft Office
b. Which tools might there be for non-Windows computers? Search the Internet for other tools that might exist and list some of them here.
Jawab:
SQL server
c. Which other steps could you take to help secure a computer against Internet attacks?
Jawab:
Step 8
CCNA discovery 2 module 1 exam answers version 4.0
1. Which two things can be determined by using the ping command? (Choose two.)
• the number of routers between the source and destination device
• the IP address of the router nearest the destination device
• the average time it takes a packet to reach the destination and for the response to return to the source
• whether or not the destination device is reachable through the network
• the average time it takes each router in the path between source and destination to respond
• the number of routers between the source and destination device
• the IP address of the router nearest the destination device
• the average time it takes a packet to reach the destination and for the response to return to the source
• whether or not the destination device is reachable through the network
• the average time it takes each router in the path between source and destination to respond
Jawab:
· the average time it takes a packet to reach the destination and for the response to return to the source
· whether or not the destination device is reachable through the network
• DSL
• cable modem
• Ethernet
• metro Ethernet
• T1
• T3
Jawab:
3. What is the maximum T1 transmission speed?
• 56 kbps
• 128 kbps
• 1.544 Mbps
• 2.4 Mbps
• 56 kbps
• 128 kbps
• 1.544 Mbps
• 2.4 Mbps
Jawab:
1.544 Mbps
4. Which of the following start the test of destination reachability?
• echo request issued by source
• echo reply issued by source
• echo request issued by destination
• echo reply issued by destination
• echo request issued by source
• echo reply issued by source
• echo request issued by destination
• echo reply issued by destination
Jawab:
echo request issued by destination
5. Which statement describes a function of a Tier 1 ISP?
• peers with other similarly sized ISPs to form the global Internet backbone
• uses the services of Tier 3 ISPs to connect to the global Internet backbone
• pays Tier 2 ISPs for transit services to connect across continents
• limits the offered services to small geographic areas
• peers with other similarly sized ISPs to form the global Internet backbone
• uses the services of Tier 3 ISPs to connect to the global Internet backbone
• pays Tier 2 ISPs for transit services to connect across continents
• limits the offered services to small geographic areas
Jawab:
peers with other similarly sized ISPs to form the global Internet backbone
6. At which point do individuals and small businesses connect directly to the ISP network to obtain Internet access?
• at a POP
• at an IXP
• at a Metro Ethernet link
• on the ISP extranet
Jawab:
• at a POP
• at an IXP
• at a Metro Ethernet link
• on the ISP extranet
Jawab:
at a POP
7. What information is contained in the numbered RFCs maintained by the IETF?
• the rules for acceptable use of websites and e-mail
• the descriptions of various hardware components that connect to the Internet
• the specifications and rules for how devices communicate over an IP network
• the standards for cabling and wiring for local Ethernet networks
Jawab:
• the rules for acceptable use of websites and e-mail
• the descriptions of various hardware components that connect to the Internet
• the specifications and rules for how devices communicate over an IP network
• the standards for cabling and wiring for local Ethernet networks
Jawab:
the specifications and rules for how devices communicate over an IP network
8. Which network support services team is responsible for testing a new customer connection and for monitoring the ongoing operation of the link?"
• customer service
• help desk
• network operations
• on-site installation
Jawab:
• customer service
• help desk
• network operations
• on-site installation
Jawab:
network operations
9. Which network support services team identifies whether the client site has existing network hardware and circuits installed?
• customer service
• help desk
• network operations
• planning and provisioning
Jawab:
• customer service
• help desk
• network operations
• planning and provisioning
Jawab:
planning and provisioning
10. Which ISP network support systems team will typically contact the customer once a new circuit is ready and guide the customer in setting up passwords and other account information?
• help desk
• customer service
• network operations center
• on-site installation team
• planning and provisioning
Jawab:
• help desk
• customer service
• network operations center
• on-site installation team
• planning and provisioning
Jawab:
help desk
11. What feature allows network devices to be scalable?
• a fixed number of interfaces
• ease of repair
• modularity
• low maintenance requirements
• low cost
Jawab:
• a fixed number of interfaces
• ease of repair
• modularity
• low maintenance requirements
• low cost
Jawab:
modularity
12. Which command generated this output?
• 1 12.0.0.2 4 msec 4 msec 4 msec
• 2 23.0.0.3 20 msec 16 msec 16 msec
• 3 34.0.0.4 16 msec 18 msec 16 msec
• Router# traceroute 34.0.0.4
• Router# nslookup 34.0.0.4
• Router# ping 34.0.0.4
• Router# telnet 34.0.0.4
Jawab:
• 1 12.0.0.2 4 msec 4 msec 4 msec
• 2 23.0.0.3 20 msec 16 msec 16 msec
• 3 34.0.0.4 16 msec 18 msec 16 msec
• Router# traceroute 34.0.0.4
• Router# nslookup 34.0.0.4
• Router# ping 34.0.0.4
• Router# telnet 34.0.0.4
Jawab:
Router# traceroute 34.0.0.4
13. Which network utility helps determine the location of network problems and identifies routers that packets travel across?
• ping
• ipconfig
• traceroute
• ixp
Jawab:
• ping
• ipconfig
• traceroute
• ixp
Jawab:
traceroute
14. What interconnects the Internet backbone?
• gateway routers
• IXPs
• POPs
• satellite dishes
Jawab:
• gateway routers
• IXPs
• POPs
• satellite dishes
Jawab:
IXPs
15. What units are used to measure Internet bandwidth?
• bits per second
• bytes per second
• hertz
• megabytes per second
• packets per second
jawab:
• bits per second
• bytes per second
• hertz
• megabytes per second
• packets per second
jawab:
bits per second
16. The IT manager of a medium-sized business wishes to house the company-owned web servers in a facility that offers round-the-clock controlled access, redundant power, and high-bandwidth Internet access. Which ISP service will fulfill this need?
• web hosting
• planning and provisioning
• application hosting
• equipment colocation
• Tier 1 ISP services
Jawab:
• web hosting
• planning and provisioning
• application hosting
• equipment colocation
• Tier 1 ISP services
Jawab:
equipment colocation
17. What is the purpose of an RFC?
• to provide the connection point for multiple ISPs to the Internet
• to document the development and approval of an Internet standard
• to connect a business to an ISP
• to provide data communication services to ISP customers
• to monitor network performance and connection status of ISP clients
Jawab:
• to provide the connection point for multiple ISPs to the Internet
• to document the development and approval of an Internet standard
• to connect a business to an ISP
• to provide data communication services to ISP customers
• to monitor network performance and connection status of ISP clients
Jawab:
to document the development and approval of an Internet standard
18. When did the Internet become available for use by businesses and consumers?
• 1979
• 1984
• 1991
• 1999
• 2000
Jawab:
• 1979
• 1984
• 1991
• 1999
• 2000
Jawab:
1991
19. What was the original purpose of the Internet?
• voice communication
• marketing
• research
• commerce
• voice communication
• marketing
• research
• commerce
Jawab:
Research
20. What three support service teams are commonly found within an ISP? (Choose three.)
• help desk
• computer support
• application readiness
• network operations center
• planning and provisioning
• implementation and documentation
• help desk
• computer support
• application readiness
• network operations center
• planning and provisioning
• implementation and documentation
Jawab:
· help desk
· network operations center
· planning and provisioning
CCNA discovery 2 module 2 exam
CCNA Discovery 2 Module 2 Exam Answers Version 4.0
1. Which two functions are provided by the upper layers of the OSI model? (Choose two.)
• initiating the network communication process
• encrypting and compressing data for transmission
2. Which is a function of the transport layer of the OSI model?
• formats and encodes data for transmission
3. Which common Layer 1 problem can cause a user to lose connectivity?
• loose network cable
4. Which three command line utilities are most commonly used to troubleshoot issues at Layer 3? (Choose three.)
• ping
• ipconfig
• Traceroute
5. Which address is used by the router to direct a packet between networks?
• destination IP address
6. What is the correct encapsulation order when data is passed from Layer 1 up to Layer 4 of the OSI model?
• bits, frames, packets, segments
7. What are two goals of the ISP help desk? (Choose two.)
• network optimization
• customer retention
8. In what two ways do Level 1 and Level 2 help desk technicians attempt to solve a customer's problems? (Choose three.)
• talking to the customer on the telephone
• using various web tools
• with remote desktop sharing applications
9. A customer calls the help desk about setting up a new PC and cable modem and being unable to access the Internet. What three questions would the technician ask if the bottom-up troubleshooting approach is used? (Choose three.)
• Is the NIC link light blinking?
• Is the network cable properly attached to the modem?
• Is the Category 5 cable properly connected to the network slot on the PC?
10. A customer calls to report a problem accessing an e-commerce web site. The help desk technician begins troubleshooting using a top-down approach. Which question would the technician ask the customer first?
• Can you access other web sites?
11. Which statement describes the process of escalating a help desk trouble ticket?
• When the problem is solved, all information is recorded on the trouble ticket for future reference.
12. What are two functions of the physical layer of the OSI model? (Choose two.)
• converting data to bits
• signal generation
13. A customer calls the ISP help desk after setting up a new PC with a cable modem but being unable to access the Internet. After the help desk technician has verified Layer 1 and Layer 2, what are three questions the help desk technician should ask the customer? (Choose three.)
• What is your subnet mask?
• What is your IP address?
• Can you ping the default gateway?
14. Which scenario represents a problem at Layer 4 of the OSI model?
.
• A firewall filtering traffic addressed to TCP port 25 on an email server.
15. What are two basic procedures of incident management? (Choose two.)
• opening a trouble ticket
• adhering to a problem-solving strategy
16. Which level of support is supplied by an ISP when providing managed services?
• Level 3
17. What is the first step that is used by a help desk technician in a systematic approach to helping a customer solve a problem?
• define the problem
18. A network technician has isolated a problem at the transport layer of the OSI model. Which question would provide further information about the problem?
• Do you have a firewall that is configured on your PC?
19. An ISP help desk technician receives a call from a customer who reports that no one at their business can reach any websites, or get their e-mail. After testing the communication line and finding everything fine, the technician instructs the customer to run nslookup from the command prompt. What does the technician suspect is causing the customer's problem?
• failure of DNS to resolve names to IP addresses
20. Which layers of the OSI model are commonly referred to as the upper layers?
• application, presentation, session
1. Which two functions are provided by the upper layers of the OSI model? (Choose two.)
• initiating the network communication process
• encrypting and compressing data for transmission
2. Which is a function of the transport layer of the OSI model?
• formats and encodes data for transmission
3. Which common Layer 1 problem can cause a user to lose connectivity?
• loose network cable
4. Which three command line utilities are most commonly used to troubleshoot issues at Layer 3? (Choose three.)
• ping
• ipconfig
• Traceroute
5. Which address is used by the router to direct a packet between networks?
• destination IP address
6. What is the correct encapsulation order when data is passed from Layer 1 up to Layer 4 of the OSI model?
• bits, frames, packets, segments
7. What are two goals of the ISP help desk? (Choose two.)
• network optimization
• customer retention
8. In what two ways do Level 1 and Level 2 help desk technicians attempt to solve a customer's problems? (Choose three.)
• talking to the customer on the telephone
• using various web tools
• with remote desktop sharing applications
9. A customer calls the help desk about setting up a new PC and cable modem and being unable to access the Internet. What three questions would the technician ask if the bottom-up troubleshooting approach is used? (Choose three.)
• Is the NIC link light blinking?
• Is the network cable properly attached to the modem?
• Is the Category 5 cable properly connected to the network slot on the PC?
10. A customer calls to report a problem accessing an e-commerce web site. The help desk technician begins troubleshooting using a top-down approach. Which question would the technician ask the customer first?
• Can you access other web sites?
11. Which statement describes the process of escalating a help desk trouble ticket?
• When the problem is solved, all information is recorded on the trouble ticket for future reference.
12. What are two functions of the physical layer of the OSI model? (Choose two.)
• converting data to bits
• signal generation
13. A customer calls the ISP help desk after setting up a new PC with a cable modem but being unable to access the Internet. After the help desk technician has verified Layer 1 and Layer 2, what are three questions the help desk technician should ask the customer? (Choose three.)
• What is your subnet mask?
• What is your IP address?
• Can you ping the default gateway?
14. Which scenario represents a problem at Layer 4 of the OSI model?
.
• A firewall filtering traffic addressed to TCP port 25 on an email server.
15. What are two basic procedures of incident management? (Choose two.)
• opening a trouble ticket
• adhering to a problem-solving strategy
16. Which level of support is supplied by an ISP when providing managed services?
• Level 3
17. What is the first step that is used by a help desk technician in a systematic approach to helping a customer solve a problem?
• define the problem
18. A network technician has isolated a problem at the transport layer of the OSI model. Which question would provide further information about the problem?
• Do you have a firewall that is configured on your PC?
19. An ISP help desk technician receives a call from a customer who reports that no one at their business can reach any websites, or get their e-mail. After testing the communication line and finding everything fine, the technician instructs the customer to run nslookup from the command prompt. What does the technician suspect is causing the customer's problem?
• failure of DNS to resolve names to IP addresses
20. Which layers of the OSI model are commonly referred to as the upper layers?
• application, presentation, session
CCNA discovery 2 module 3 exam
CCNA Discovery 2Module 3 Exam Answers Version 4.0
1. Which two benefits can be gained by locating network equipment in a telecommunications closet, rather than in a user area? (Choose two.)
• improved physical security
• centralized cable management
2. Which three issues should be noted on the technician's site survey report? (Choose three.)
• unlabeled cables
• poor physical security of network devices
• lack of UPS for critical devices
3. Which two types of cable are used for initial router configuration? (Choose two.)
• rollover cable
• console cable
4. In addition to the inventory sheet, what other information about the hosts and networking equipment should be documented by the on-site technician while performing the site survey?
• any planned growth anticipated in the near future
5.
1
Refer to the exhibit. What type of device is used to connect two networks?
• router
6. It is said that the goal for availability of a communications system is "five-9s". What is meant by this?
• A network needs to be available 99.999% of the time. \
7. What three things are included in a logical topology document? (Choose three.)
• the path that the data takes through a network
• the device names and Layer 3 addressing information
• the location of routing, network address translation, and firewall filtering
8. Which device has the ability to break up broadcast and collision domains?
• router
9. Why is it important to review the results of an on-site survey report with the customer before beginning the network design?
• to inform the customer of how much time the upgrade will take
• to discuss the implementation schedule for the new equipment
• to verify that the report accurately describes the current network and any plans for expansion
• to layout the new network design and discuss possible equipment upgrades and replacements
10. A client requires a networking device that is capable of expansion to suit growing network demands. What type of device will suit this requirement?
• a networking device with ports that can be activated and deactivated
• a networking device with a modular physical configuration
• a networking device with the ability to be turned off remotely
• a networking device with a cost per port that is as high as possible
11. What does the use of redundant network components supply to a network?
• reliability
12. What is the benefit for a company to use an ISR router?
• An ISR provides the functionality of a switch, router, and firewall in one device.
.
13. Which three items are typically found in an MDF? (Choose three.)
• user workstations
• switches and routers
• network equipment racks
• the point of presence
14. What are two advantages of having ISP-managed services? (Choose two.)
• can guarantee up to 99.999% availability
• increases availability of help desk services
15. A manufacturing company is in the process of a network upgrade. Which two statements are true about the phases of the upgrade process? (Choose two.)
• Phase 1 is used to determine network requirements.
• Phase 3 is based on an implementation schedule that allows extra time for unexpected events.
16. When designing a network upgrade, which two tasks should the onsite technician perform? (Choose two.)
• investigate and document the physical layout of the premises
• perform a site survey to document the existing network structure
17. What is the term for the location at the customer premise where the customer network physically connects to the Internet through a telecommunications service provider?
• point of presence
18.
2
to the exhibit. Which type of twisted pair cable is used between each device?
• A=console, B=straight, C=straight, D=crossover, E=crossover
19. In what two ways will entering into a managed service agreement with an ISP for a network upgrade affect the costs that are incurred by the customer? (Choose two.)
• Network upgrade and maintenance costs will become predictable.
• The company will not need to spend a large amount of money to purchase the equipment upfront.
20. Which type of cable has a solid copper core with several protective layers including PVC, braided wire shielding, and a plastic covering?
• coaxial
21. What must be added when a network expands beyond the coverage area of the current telecommunications room?
• IDF
1. Which two benefits can be gained by locating network equipment in a telecommunications closet, rather than in a user area? (Choose two.)
• improved physical security
• centralized cable management
2. Which three issues should be noted on the technician's site survey report? (Choose three.)
• unlabeled cables
• poor physical security of network devices
• lack of UPS for critical devices
3. Which two types of cable are used for initial router configuration? (Choose two.)
• rollover cable
• console cable
4. In addition to the inventory sheet, what other information about the hosts and networking equipment should be documented by the on-site technician while performing the site survey?
• any planned growth anticipated in the near future
5.
1
Refer to the exhibit. What type of device is used to connect two networks?
• router
6. It is said that the goal for availability of a communications system is "five-9s". What is meant by this?
• A network needs to be available 99.999% of the time. \
7. What three things are included in a logical topology document? (Choose three.)
• the path that the data takes through a network
• the device names and Layer 3 addressing information
• the location of routing, network address translation, and firewall filtering
8. Which device has the ability to break up broadcast and collision domains?
• router
9. Why is it important to review the results of an on-site survey report with the customer before beginning the network design?
• to inform the customer of how much time the upgrade will take
• to discuss the implementation schedule for the new equipment
• to verify that the report accurately describes the current network and any plans for expansion
• to layout the new network design and discuss possible equipment upgrades and replacements
10. A client requires a networking device that is capable of expansion to suit growing network demands. What type of device will suit this requirement?
• a networking device with ports that can be activated and deactivated
• a networking device with a modular physical configuration
• a networking device with the ability to be turned off remotely
• a networking device with a cost per port that is as high as possible
11. What does the use of redundant network components supply to a network?
• reliability
12. What is the benefit for a company to use an ISR router?
• An ISR provides the functionality of a switch, router, and firewall in one device.
.
13. Which three items are typically found in an MDF? (Choose three.)
• user workstations
• switches and routers
• network equipment racks
• the point of presence
14. What are two advantages of having ISP-managed services? (Choose two.)
• can guarantee up to 99.999% availability
• increases availability of help desk services
15. A manufacturing company is in the process of a network upgrade. Which two statements are true about the phases of the upgrade process? (Choose two.)
• Phase 1 is used to determine network requirements.
• Phase 3 is based on an implementation schedule that allows extra time for unexpected events.
16. When designing a network upgrade, which two tasks should the onsite technician perform? (Choose two.)
• investigate and document the physical layout of the premises
• perform a site survey to document the existing network structure
17. What is the term for the location at the customer premise where the customer network physically connects to the Internet through a telecommunications service provider?
• point of presence
18.
2
to the exhibit. Which type of twisted pair cable is used between each device?
• A=console, B=straight, C=straight, D=crossover, E=crossover
19. In what two ways will entering into a managed service agreement with an ISP for a network upgrade affect the costs that are incurred by the customer? (Choose two.)
• Network upgrade and maintenance costs will become predictable.
• The company will not need to spend a large amount of money to purchase the equipment upfront.
20. Which type of cable has a solid copper core with several protective layers including PVC, braided wire shielding, and a plastic covering?
• coaxial
21. What must be added when a network expands beyond the coverage area of the current telecommunications room?
• IDF
CCNA 2 labskill chapter 3
Lab 3.2.4.2 Evaluating a Cabling Upgrade Plan
Objectives
· Examine the existing floor plan of a customer.
· Propose a cable upgrade plan to accommodate extra floor space.
Background / Preparation
A medium sized company has existing space on the second floor of an office tower and has just acquired the rest of the second floor. They have asked you to examine their existing floor plan and assist the the placement of a new IDF, placement of cables to support all of the new office space, and to help determine if any new devices are required. This lab can be done individually or in groups. The following resources are required:
· Existing Floor Plan (provided)
Step 1: Examine the existing floor plan
a. From the information provided on the existing floor plan, label the following items:
1) POP –Point of Presence
2) MDF – Main Distribution Facility
3) IDF – Intermediate Distribution Facility
4) vertical/Backbone Cabling
5) Horizontal Cabling
b. What type of cabling could be used for the vertical/back bone cabling? Explain your answer
:: kabel yang digunakan ialah vertical backbone cable, alasannya karena jaringan yang akan dibangun terletak pada lantai dua dan jika dianalogikan posisi masing masing device kerja atau bagian kerja akan bersimpangan. Oleh karena itu kabel yang digunakan ialah vertical backbone cable dangan sambungan vertical patch panel.
Step 2 :Evaluate plan for new floor space.
Any Company has just merged with a small web design group and has acquired the remaining space on the second floor to accommodate the web design team . This new space is represented on the diagram as the floor space highlighted on the right side of the floor plan. It has been decided to add a second IDF to support the work stations in the new area.
a. Suggest a possible location for the new IDF . What room / location did you choose and explain why you think it is suitable?
:: ruangan / lokasi yang cocok untuk memasang IDF baru ialah pada telecommunication room . karena IDF sebagai fasilitas pendistribusi merupakan perangkat yang harus tersusun dengan perangkat server.
b. What type of cable would you suggest for the vertical cabling required to connect the new IDF to the existing MDF? Explain your reasons
:: jenis cable yang digunakan untuk menghubungkan IDF dan MDF adalah Horizontal Cabling, alasannya IDF dan MDF dihubungkan untuk langsung terkoneksi ke area kerja (work area) sehingga harus menggunakan cabel horizontal.
c. The new space contains mostly offices. Assume that each office will be provisioned with 2 data drops. Also plan for 2 drops in the auditorium to support Internet access for presentations and training sessions. How many additional data drops need to be ordered?
:: dibutuhkan dua data drops lagi.
d. You have been asked to determine the number of new 24 port switches required for the new IDF. Remember to plan on approximately 25% growth. How many new switches will Company ABC need to purchase?
:: banyaknya switch yang dibutuhkan dengan perkembangan perusahaan yang dianalisa 25% adalah 60 buah switch dengan perhitungan. Masing – masing lantai terdiri dari 24 switch dan perlutambahan untuk perkembangan sebanyak 6 buah = 24 x 2 =48
+ 12 =60 buah switch
+ 12 =60 buah switch
e. How many horizontal cables will terminate on patch panels in the new IDF?
:: sebanyak 32 buah kabel horizontal, termasuk pada telecommunications room.
Step3: Examine the floor space and wiring plan.
a. What equipment other than switches would you expect to find in the new IDF?
:: horizontal cable, switch,hub
b. What equipment other than switches would you expect to find in the MDF?
:: vertical cable,router.
c. Using existing cable runs, could you use UTP to connect the devices in room 2.20 or 2 .30 directly into a switch in the MDF?
:: ya bisa dapat langsung digunakan.
Step 4 . Reflection
a. Is it better to have an IDF in this floor space or should the company run the horizontal cables for each device directly back to the existing MDF?
:: lebih baik menggukan IDF dengan koneksi kabel horizontal untuk terhubung sebagai mediator untuk distribusi.
b. How many cables will be required from the MDF to the IDF to support the switches? Explain your answer
:: 3 buah kabel, alasannya setelah terkoneksi dengan router, dibutuhkan 3 lagi alat berupa repeater. Maka agar alat itu bisa digunakan dibutuhkan 3 lagi kabel horizontal.
Langganan:
Postingan (Atom)