So how did you do on the lab?
Hopefully did great and maybe you found some areas where you want to review the
videos or practice a few times.
I'm super happy if you had an opportunity to do the hands-on practice.
So in this video, I'd like to do a quick walkthrough of these tasks with you
together.
So with that being said, let's head over to the lab environment.
All right.
So here we are in the lab environment.
I took the opportunity to click on reset and took a moment to reset and then I
clicked on start.
So this is the lab starting up from its base configuration without any type of
control plane
policing or infrastructure or infrastructure ACLs present. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policing or infrastructure or infrastructure ACLs present.
So let me bring up the topology by double clicking here on the lab topology in
the lab.
There it is.
That looks good.
And let's go to our console prompts for the routers by going to server one.
So we'll double click here on server one and bring that up.
All right.
So server one is up here is multi tab putty and let's start with the
infrastructure ACLs here on router four.
So on router four, we'll do a config T and also do a do show access lists just
to make sure we don't have any IPV for access is already in place.
And then we'll begin our config. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll begin our config.
So it didn't tell us what we had to call the access control list.
So let's go ahead and use IP access list extended and we use 100.
So even though it's a number, still gives us the opportunity to do the
configuration as if it's a named access list, which will be less typing force.
So we want to deny traffic source from zero zero zero zero.
So we'll type in deny IP coming from host zero zero zero zero going anywhere.
Now that one we probably wanted to delete even if it's transit traffic because
we don't want that traffic going through our network either.
So press center and there's our first entry.
Then we'll do a deny of IP or traffic being sourced from one 27 dot zero zero WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we'll do a deny of IP or traffic being sourced from one 27 dot zero zero
zero from traffic from one 27 anything.
So for the wild card bits, we had zero dot two be five dot two five dot two
fifty five press center and what didn't like deny IPO going to anywhere.
Fantastic.
Let's do a do show access list and the name of our access list, which is 100
and we'll check our work as we go.
So so far so good.
So based on the lab tasks, we also want to deny IP traffic, bit sourced from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on the lab tasks, we also want to deny IP traffic, bit sourced from
one 72 16, the RFC 19 address range.
Now because that mask is a slash 12, we want to specify the appropriate wild
card mask.
So for the second octet, if we have 128 64 32 16 8 for two and one and we have
a 12 bit mass.
So the second octet here would end right there.
So our block size is 16. That means our wild card bits would be all these bits
on which we are block size minus one.
So for the wild card bits to be zero dot 15 and then to be five dot two to five WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the wild card bits to be zero dot 15 and then to be five dot two to five
.
So put that in a zero dot 15 dot two to five dot two to five.
That's the source going to anywhere press center and stay quick.
Check and make sure we're doing good so far and we are.
So we have three entries blocking on traffic that we don't want coming in.
In addition, if we had a block of addresses that we had internally, for example
, the 25 network that we did in the demonstrations, we also want to block
traffic that claimed it was coming from that source address as well.
However, for the lab, it only wanted us to identify those three entries, all z
eros 127 anything and the ones in two 16 address space from RFC 19 18. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
eros 127 anything and the ones in two 16 address space from RFC 19 18.
Next, we are supposed to deny fragments.
So we'll say deny, let's start with TCP going from anywhere to anywhere
fragments and we'll do the same thing for UDP and the same thing for ICMP.
Just like that and we'll check our work with a show and that looks good as well
.
Oh, oh, the lab task.
Let's take a look at it real quick.
The lab said traffic going to 2525 and I didn't include those on those entries.
So let's fix those because we may want some transit traffic that does that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's fix those because we may want some transit traffic that does that.
So we'll say no 40, no 50, no 60, then we'll do a quick show just to verify
that we're in good shape and let's put those back in.
So let the upper key a few times and let's do the TCP fragments, but instead of
saying any, we'll specify the management network address of 2525.25.0 with wild
car bits saying we care about the first reactants and then the keyword
fragments.
And we'll take out.
So we'll take out the part here that we don't need.
So tonight's TCP traffic source from anywhere destined to our management WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So tonight's TCP traffic source from anywhere destined to our management
address base of 252525 if there are fragments and that looks good.
And we'll repeat that for UDP and press enter and then we'll repeat that for IC
&P as well.
So upper key and replace UDP with IC&P just like that.
All right, then we'll do a quick show just to make sure we're on track and that
looks much better.
We want to match the lab tasks to get our ACLs correct.
Next, it wants us to permit BGP and SSH from 23/8 to the 2525 25 address space.
So the sound will be first will type in permit TCP sourced from 23 anything. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the sound will be first will type in permit TCP sourced from 23 anything.
So for the wild card bits to be zero meaning match on the first octet and don't
care what the second, third or fourth going to 25.25.25.0 if the destination
port equals BGP.
So the quick show here is what we have.
So as part of our infrastructure ACL, any device sourcing the traffic from 23
anything going to 252525.
If the destination port is the well known port for BGP, which is port 179 that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the destination port is the well known port for BGP, which is port 179 that
would be permitted.
And although the lab didn't ask for it, we could also flip that as well.
So if we had a BGP peer on 23 something trying to connect to one of our
infrastructure devices, this infrastructure ACL, which we're going to apply in
bound on gig 00 will allow that initial connection.
So let's take a look at what is next.
So we have BGP we also need SSH as well.
So we'll go ahead and permit TCP from 23 anything going to our address space of
25.25.25.0 care about matching on the first react is there for the destination. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
25.25.25.0 care about matching on the first react is there for the destination.
If the destination port equals 22, which is for SSH and we'll check our work.
So we'll do a show access list for access 100 and that looks good.
So even though the lab didn't ask for it, we'd also in a production environment
want to go in and deny the traffic for BGP and SSH from any other addresses
that are trying to go to our management space.
So for grins under that as well with a deny TCP any going to our address space.
If the destination port equals BGP and also if the destination port equals 22. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the destination port equals BGP and also if the destination port equals 22.
So now if we look at entry 70 and 80, we're printing BGP and 22 based on the
criteria.
But if it doesn't match that criteria, we're denying BGP and SSH with the next
two lines here for traffic trying to come into our management address space.
So again, the lab I didn't ask for those explicit denies just a reminder though
infrastructure ACLs are to protect our infrastructure devices by locking them
down and only allowing the required protocols that we want to use from the
addresses that we know.
Or from the range of addresses that we specify and then to make this effective, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or from the range of addresses that we specify and then to make this effective,
we need to apply this access control list.
So let's exit out of access list configuration mode go to interface gig zero
slash zero and use the command IP access group access list is 100 and we'll
apply that inbound on that interface.
And we are done. We do a show IP interface gig zero slash zero to verify that
it's applied and shows it right here with inbound access list 100 applied.
So the second part here is to configure control plane policing to limit the
impact of an ICMP fled to the router. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
impact of an ICMP fled to the router.
And by saying the threshold really, really low, it's super easy to verify that
as well.
So let's go to the right router when I go to our one.
And before we actually do the configuration for the control plane policing, let
's go to our two. So our two is right here.
And we should be able to ping our one at 10 dot zero dot 12 dot one. That's our
ones gig one slash zero interface. Let's verify that real quick.
So our two will do a ping to 10 dot zero dot 12 dot one. And that works.
And let's go ahead and do a ping and repeat it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go ahead and do a ping and repeat it.
Let's go ahead and repeat it say 10,000 times and we can break that if we need
to. So that's going to be saying those things effectively do a control shift
six.
In fact, let me clear that and then we go ahead and send it more. I'm going to
add a couple zeros on there.
And that way it'll give me time to go ahead and configure it. So press enter
and away it goes.
So what our one it's receiving and because that destination is our one, our one
is processing those ping requests and then responding back.
So let's go to our one and let's set up control plane policing. Let's do a show WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go to our one and let's set up control plane policing. Let's do a show
access list. There aren't any. So config T access list is create access list
111 and will permit.
I see him from anywhere anywhere and boom, there's our access list. Then we'll
create a class map and we'll call this C map and press center.
So do show class map press center. It defaults to a match all if you didn't
explicitly include matching your match all. So there's our class map. We're not
yet matching anything.
But what it is match access group and because the number of access control list WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But what it is match access group and because the number of access control list
, we'll go ahead and put that in, which is 111 and press center. So now if we
look at that class map, it's matching on access control list 111.
Next, we'll exit out and we'll create a policy map specifying what we want to
do. So we'll type in the command policy map. We'll call it P map.
Almost got it. So I go ahead and do a no on that because I want to name it
correctly. So a note policy map PM a open bracket and we want a policy map
called P map.
Let's do a do show policy map just to make sure we don't have any other policy
maps. And then in that policy map, we want to match on.
Last C map, which is looking for matching on access list 111, which is looking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Last C map, which is looking for matching on access list 111, which is looking
for ICMP traffic. And if we see that traffic, what do we want to do?
And what we want to do is go ahead and police it down. It's a little type in
police space. And I would say for the demo, let's go ahead and use 10,000 space
.
And then for the conform action, we'll go ahead and say transmit.
And for the exceed action, we'll say drop. And then for the violate action, let
's also say drop just like that. So we'll type in exit three times here to go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
's also say drop just like that. So we'll type in exit three times here to go
back to configuration mode.
Let's also do a do show policy map. And look at our work so far. So our policy
map called PMap is including the class map called C map, which is looking for
effectively ICMP traffic matching ACL 111.
And if it sees it, it's going to please it above 10,000 bits per second. And
the conform action is to transmit or process that traffic and the exceed and
violate action are to go ahead and drop.
Then the last step would be to apply this to the control plane. So type in
control plane press enter, and that puts us into control plane configuration WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
control plane press enter, and that puts us into control plane configuration
mode.
And from here, we're going to type in service policy, and then we'll specify
the direction. So we want this to be an input service policy for traffic coming
into the route processor into the route itself.
Space question mark, and then the name of our policy map, which is PMap. So I
'll copy paste that press enter and then to see our work, we'll go into a show
policy map.
And instead of just saying all the policy maps, we'll say show policy map
control plane, just like that.
So that in mind, let's go back to R2. And you notice here that R2, we have many WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that in mind, let's go back to R2. And you notice here that R2, we have many
of our pings that are making of it somewhere not.
And that's because we have our threshold for policing set at 10,000. So there's
a fail, there's a fail, there's a fail. And it's pretty consistent.
So if we go back to R1, and we hit the up arrow key here into a show policy map
control plane press enter, here we have our number of conformed packets, 261,
and then we have our exceeded packets, which are 17.
And if we hit the up arrow key again, that exceeded number should be growing.
So thanks for joining me in this set of videos regarding helping to protect our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So thanks for joining me in this set of videos regarding helping to protect our
infrastructure devices with two specific tools.
One is the infrastructure ACLs at the edge of our network, and then also
control plane policing, which we can apply directly to the control plane on
each of our routers.
So once again, thanks for joining me, and I look forward to seeing you, my
friend, in another set of videos very, very soon.
Until then, I hope this has been informative, and I'd like to thank you for
viewing.