Fin de la semaine 3
This commit is contained in:
gauvainboiche
609
Semaine_02/Jour_05_examen.md
Normal file
609
Semaine_02/Jour_05_examen.md
Normal file
@@ -0,0 +1,609 @@
|
||||
Emmanuel-Joyce NTSIA, Gauvain BOICHÉ, Joris STAVROULAKIS, Léo JARRY,
|
||||
|
||||
**Nous jurons sur l'honneur que les commandes entre `` sont tapées à la main à partir de nos notes de cours. (Elles sont réfléchies par nous en notre âme et conscience, on boycott openAI)**
|
||||
|
||||
*Pour rigoler on a passé une instruction "Génère moi une capture d'écran de Cisco Packet Tracer en pleine configuration d'un VLAN par la CLI" et voilà le résultat :*
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/54/546a8aa9001c2159072a7baec8264e1a2021d0150b46e9f3" data-crypto-key="cryptpad:SE/opt2PYh11RFDrv+FIqztrWEM8Tbs38Ym2vLUS/0c="></media-tag>
|
||||
|
||||
**Pour ne pas rigoler, ça devrait être illégal de nous mettre du 176 quand on est habitué au 172 en adresse**
|
||||
|
||||
# Mise en place de la Topologie physique:
|
||||
|
||||
Le client a présenté une topologie précise avec des modèles précis, nous avons décidé de garder la topologie d'origine pour des questions de négociations facilitées.
|
||||
|
||||
- Commutateurs 2960-24TT
|
||||
- Routeur ISR4331
|
||||
- Câbles droits pour liaisons routeurs & PC <-> commutateurs
|
||||
- Câbles croisés pour liaisons inter-commutateurs
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/f7/f78a72e3028ac51e664d595fc353f4f55ddd750a13a2ec12" data-crypto-key="cryptpad:cK6ON14fjHlmFIpvwrE4lflB2C0J66a8h0P8XgEm94A="></media-tag>
|
||||
|
||||
## Mise en place des adresses IP pour les pc
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/75/7531c9b9ffcad96cc9698387b13ff1f00d0d515bde067fbe" data-crypto-key="cryptpad:rAHhYAVWjTh1wLOLV7hRBJSv2uPOVEwGSZlNCnVpE2c="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e1/e167b987d500078f41d11dff37d706b87c83612d2e958640" data-crypto-key="cryptpad:BetJlmk4OBDHo6UKp7/MHjt3tw99MFo749gOOwRJyIU="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/2c/2c25e98d1f3fffd017c272cf71007eb3c86f6b794fad4faf" data-crypto-key="cryptpad:fQDX194rYklfps2SuGWY14GjlB2MGoQO0xkoLmc1mYQ="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/d5/d505baf4fab37899b026d171930b5720a7ce1ed3f13ce0dd" data-crypto-key="cryptpad:AUYlTQAfIQpLCTdjRIxH0JCBBkUb90YUDOwiPUatu24="></media-tag>
|
||||
|
||||
## Mise en place des VLAN
|
||||
|
||||
**À noter qu'à partir de maintenant, des write memory sont fait après chaque étape pour s'assurer que la configuration soit bien sauvegardée**
|
||||
|
||||
### Création des VLANS dans les switch
|
||||
|
||||
**À faire sur tous les Switchs**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
vlan 10
|
||||
name OSD
|
||||
exit
|
||||
vlan 20
|
||||
name MON-MGR
|
||||
exit
|
||||
vlan 30
|
||||
name Supervision
|
||||
exit
|
||||
vlan 40
|
||||
name Tests
|
||||
exit
|
||||
interface vlan 1
|
||||
no shutdown
|
||||
exit
|
||||
interface vlan 10
|
||||
no shutdown
|
||||
exit
|
||||
interface vlan 20
|
||||
no shutdown
|
||||
exit
|
||||
interface vlan 30
|
||||
no shutdown
|
||||
exit
|
||||
interface vlan 40
|
||||
no shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
<media-tag src="https://files.cryptpad.fr/blob/88/8894ff9fe3ee3c5d596f6b3d90115e31d75026fdc3edc85f" data-crypto-key="cryptpad:LcR3E2Cba1LW3U2/hybbdCFO1gpBFGD+mMu8kfCXvsw="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/6f/6f263259f02dfff0a5a5d47f4fcd7a3f37e583c1b4e4420b" data-crypto-key="cryptpad:Uqj9/FdG1R6mDppsvM6krb+gwiXu57KVirU9lBH2WRQ="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e6/e6ba75ea5f3203723da30ffa7d449c34a51efae5d8bff21c" data-crypto-key="cryptpad:Ke+JwlWqjOk5hlwUKTIWXALWjuDre5OGi2uTLSd3MBM="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/d1/d1d9973764a3dd22af9c23af7c8357851f1af75bc6b23a55" data-crypto-key="cryptpad:aPx4p+sK7AleLZVdHL0TfgJ61nwTE+d37GcKwraWS30="></media-tag>
|
||||
|
||||
### Mise en place des ports access Switch - PC
|
||||
|
||||
|
||||
**À faire sur tous les Switchs sauf S5 en adaptant le port et la vlan**
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/cb/cbb784c08055c1e65fa452a12a845285dd6f8873beb6b372" data-crypto-key="cryptpad:HUFx2xYyrtDhpblKPxBE1TlM00Mjegg4Jrv+45c8L24="></media-tag>
|
||||
|
||||
|
||||
### Mise en place du port trunk entre S5 et R1 (le routeur)
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/6f/6f4e5d053334f8f74dfec7ea9f2c3ec8d1dbcf3faa8bdf1e" data-crypto-key="cryptpad:FQo7teQskt8L2x2LTcWdnLjpcNArdymgQ44CGhKZ5Q4="></media-tag>
|
||||
|
||||
(Petit oubli) On rajoute le nonegotiate :
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/41/417fe4f0a146622e5f782c9ed0ed2282550eb56a4b83c559" data-crypto-key="cryptpad:azRX27aolDPvYJSSELsl01CgAzLIA5nyX4rNJMS82wA="></media-tag>
|
||||
|
||||
## Mise en place des LAGs
|
||||
|
||||
**Switch 1**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Fa0/2 - 4
|
||||
channel-group 1 mode active
|
||||
exit
|
||||
interface range Fa0/5 - 7
|
||||
channel-group 2 mode active
|
||||
exit
|
||||
interface port-channel 1
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 2
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
show interfaces Port-channel [1,2] ! Pour contrôler
|
||||
show interfaces trunk ! Pour contrôler
|
||||
show etherchannel summary ! Pour contrôler
|
||||
end
|
||||
write memory
|
||||
```
|
||||
### Création du LAG en LACP actif
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/81/81fb3e3b3a439b4bbba857d0a30ae130b278c412992fbaeb" data-crypto-key="cryptpad:o+CVdqOL3L0sV9KH/XeY2SfvrUNtxgWbc4Cx5XSwNTo="></media-tag>
|
||||
|
||||
**Il faut faire pareil sur S4 (le switch de l'autre côté des ports concernés) du coup aussi pour que ça fonctionne**
|
||||
|
||||
### Configuration du trunk sur les LAGs
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e8/e84f77050b2aab28cbd4688052976acaa3f9368178018315" data-crypto-key="cryptpad:d5Vhb8Hi1yXvjcvb0RDdLJKHU9UmgUCsyeAeNdGj12M="></media-tag>
|
||||
|
||||
(Petit oubli) On rajoute le nonegotiate :
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/68/6803b7c93fa4174b7cb1cc9a91ac48b4e310b1c57243b4e2" data-crypto-key="cryptpad:/QHmma0a0HXXtpgsUCRBS7d+NFZgZAGSW8SwW0moXr0="></media-tag>
|
||||
|
||||
**Ensuite il faut recommencer ces deux étapes (création du LAG et mise en place du trunk), sur tous les switchs en adaptant bien sûr les ports et en faisant bien attention de respecter les numéros de channel-group**
|
||||
|
||||
### Vérification du LAG et du trunk dessus
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/a9/a9b0ae6851b909314e12df72105c652d76a27705699b4225" data-crypto-key="cryptpad:ET7sByM10fWyoxFk9wMfpVnDoQ06ziOJjP6kOMvshG4="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/ad/ad485ff672e41bf34ad62b220e3f10b5306130a6efa55152" data-crypto-key="cryptpad:ipjEjM4dhGrcPVI9NzaT08IOrVvkazgkpM5/KsPOR2k="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/34/343a182e5e800bfa3fc53089ff7aa9303e1129dab85f0c72" data-crypto-key="cryptpad:6m1j7C0M3A89PwQ7cUY9SoOe5mrvUYkMJ0bFewG+cuE="></media-tag>
|
||||
|
||||
**Switch 2**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Fa0/2 - 4
|
||||
channel-group 3 mode active
|
||||
exit
|
||||
interface range Fa0/5 - 7
|
||||
channel-group 2 mode active
|
||||
exit
|
||||
interface range Fa0/8 - 10
|
||||
channel-group 1 mode active
|
||||
exit
|
||||
interface port-channel 1
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 2
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 3
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
show interfaces Port-channel [1,2,3]
|
||||
show interfaces trunk
|
||||
show etherchannel summary
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Switch 3**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Fa0/5 - 7
|
||||
channel-group 2 mode active
|
||||
exit
|
||||
interface range Fa0/8 - 10
|
||||
channel-group 1 mode active
|
||||
exit
|
||||
interface range Fa0/11 - 13
|
||||
channel-group 4 mode active
|
||||
exit
|
||||
interface port-channel 1
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 2
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 3
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
show interfaces Port-channel [1,2,3]
|
||||
show interfaces trunk
|
||||
show etherchannel summary
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
|
||||
**Switch 4**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Fa0/2 - 4
|
||||
channel-group 1 mode active
|
||||
exit
|
||||
interface range Fa0/5 - 7
|
||||
channel-group 2 mode active
|
||||
exit
|
||||
interface port-channel 1
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 2
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
show interfaces Port-channel [1,2,3]
|
||||
show interfaces trunk
|
||||
show etherchannel summary
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
|
||||
**Switch 5**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Fa0/2 - 4
|
||||
channel-group 3 mode active
|
||||
exit
|
||||
interface range Fa0/11 - 13
|
||||
channel-group 4 mode active
|
||||
exit
|
||||
interface port-channel 1
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
interface port-channel 2
|
||||
switchport mode trunk
|
||||
switchport trunk native vlan 1
|
||||
switchport trunk allowed vlan 1,10,20,30,40
|
||||
no shutdown
|
||||
exit
|
||||
show interfaces Port-channel [1,2,3]
|
||||
show interfaces trunk
|
||||
show etherchannel summary
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
## Mise en place du routage inter-vlan
|
||||
|
||||
**Routeur**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface Gig0/0/0
|
||||
no shutdown
|
||||
exit
|
||||
interface Gig0/0/0.1
|
||||
encapsulation dot1Q 1 native
|
||||
ip address 176.16.1.254 255.255.255.0
|
||||
no shutdown
|
||||
exit
|
||||
interface Gig0/0/0.10
|
||||
encapsulation dot1Q 10
|
||||
ip address 176.16.10.254 255.255.255.0
|
||||
no shutdown
|
||||
exit
|
||||
interface Gig0/0/0.20
|
||||
encapsulation dot1Q 20
|
||||
ip address 176.16.20.254 255.255.255.0
|
||||
no shutdown
|
||||
exit
|
||||
interface Gig0/0/0.30
|
||||
encapsulation dot1Q 30
|
||||
ip address 176.16.30.254 255.255.255.0
|
||||
no shutdown
|
||||
exit
|
||||
interface Gig0/0/0.40
|
||||
encapsulation dot1Q 40
|
||||
ip address 176.16.40.254 255.255.255.0
|
||||
no shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
### Interface physique
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/5a/5a56ebdd262aef1b824aa1f532992ad4ede02ff02782d095" data-crypto-key="cryptpad:+0CpOO5cDw/nD8JoR8h8yB3DK0Jqoq1NQ1/jSWsa48w="></media-tag>
|
||||
|
||||
### Interfaces virtuelles
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/2e/2ed9dd7897dfef103aa5155365dfb4a25f68390a89f82afc" data-crypto-key="cryptpad:B8ZapZI+2wsuGkC6Hb2lv4SdolP37dVIuObOI1d45dk="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/f6/f67b5e8972e8b1b11d0a084cdd6205b063292b689dfba9b6" data-crypto-key="cryptpad:fEakil02wX68FSgqtANnNP8BGGl8UCEhuNkzHnKAqMk="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/c3/c30a3872e9cae5ff921a4e421a4b0a11e27b70ccd3616f9b" data-crypto-key="cryptpad:Qf4olHJBX0N1803FkidN3ybBnCijMd5tDHQRqsdeIyc="></media-tag>
|
||||
|
||||
Depuis PC_OSD (vlan 10) :
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/f8/f8a6fc0c6e154b5278a57c42df58f0cfb79038c9ec5400be" data-crypto-key="cryptpad:E6XBGelcO8z3F852KVa0YLmeYejQS4j3s5XVM5czwOo="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/aa/aa081b9b255deb0cfabc6dd3502fb22ad39c23f74bd16e69" data-crypto-key="cryptpad:wcBCg8DG9YCkcZ7OGkSqRWEky3hpDAN6LBu/1UQnmjM="></media-tag>
|
||||
|
||||
**Puis on fait ça pour toutes les autres VLAN**
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/d0/d0a7c14956fc49c021310f8d5e376ea25d4f23c6c33cb8a7" data-crypto-key="cryptpad:0ZsNXijRJTj2oTUcL7nQMxlSVeolDTxzL4+6DRljSdo="></media-tag>
|
||||
|
||||
|
||||
## Sécurisation et accès à distance sur chaque appareil
|
||||
|
||||
### BPDU Guard
|
||||
|
||||
Sur les ports des switchs qui sont connectés aux pc/routeur on active le BPDU guard
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface Fa0/1
|
||||
spanning-tree bpduguard enable
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/de/de4ce762dbe97acecd2f35d72f7a5bbc9db533bc10126508" data-crypto-key="cryptpad:2bWPavKJoydJarCrup+BQCOoZ3caCFnsR0usDVf1QU8="></media-tag>
|
||||
|
||||
### Sécurisation du port console
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
line console 0
|
||||
password root
|
||||
login
|
||||
exit
|
||||
service password-encryption
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/af/afcbc673150c0d18c2a9361230ae530f81380d3792748969" data-crypto-key="cryptpad:4u4DjkTPkeVx4kUA6V05WVjECdeIXdeWHeRVIL96AD4="></media-tag>
|
||||
|
||||
Parce que c'est un exercice on va mettre le même mot de passe partout pour se simplifier la vie, bien sûr en vrai on mettrait des mots de passes forts et différents
|
||||
|
||||
Le service password-encryption servira à empêcher que le mot de passe soit accessible en clair dans la configuration
|
||||
|
||||
**On fait la même chose sur tous les switch et routeur**
|
||||
|
||||
### Activation à distance (ssh)
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
ip domain-name fuckssh.com
|
||||
username ssh secret root
|
||||
crypto key generate rsa general-keys modulus 2048
|
||||
line vty 0 15
|
||||
transport input ssh
|
||||
login local
|
||||
exit
|
||||
ip ssh version 2
|
||||
interface vlan 1
|
||||
ip address 176.16.1.1 255.255.255.0
|
||||
exit
|
||||
ip default-gateway 176.16.1.254
|
||||
end
|
||||
write memory
|
||||
```
|
||||
*Le code est adapté pour chaque Switch, donc l'adresse IP sera 176.16.1.[1-5]*
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e4/e4516c5b4e9d29e5c4eb646975508b04daac845db822c6e8" data-crypto-key="cryptpad:Wqn1O46/ucU/r9fia/XjFGzaCR3rzkIgBt6QUqceGgc="></media-tag>
|
||||
|
||||
**On oublie bien sûr pas d'ajouter une ip au switch dans le vlan 1 pour pouvoir s'y connecter ainsi que l'ip default-gateway**
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/41/416d332606f7a8857995f8037326ab857bffa5870fb7d502" data-crypto-key="cryptpad:loN+qfyLhMjcx4IwoJOlNAB6IHma22mmSzFO6AyRvXs="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/65/656b037fabf64be0b4925ec26bed04c41c4d027dc2233e0b" data-crypto-key="cryptpad:VRLakDpWCSPcpZaO8Ahc+C0YXYCAPYJyezTwSRH5BSs="></media-tag>
|
||||
|
||||
**On fait la même chose sur tous les switch et routeur**
|
||||
|
||||
### Sécurisation du mode enable
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
enable secret root
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/b1/b173291a2c5ad33f30b31ce7f278026490136416a640d883" data-crypto-key="cryptpad:WiOgi91Teu6fQkllF6/leGxRuczUvHGAb+nVV1SOuZU="></media-tag>
|
||||
|
||||
<br/>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/05/05a498fafcb76da3fb3d828e58d1dfa04627f08198877cb3" data-crypto-key="cryptpad:RtiXPcHtE1MQY7HjX/0esiHl4p3AD59e0KxByzHe2h4="></media-tag>
|
||||
|
||||
### Vérification accès à distance
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/d4/d4c17ecee3644837f8517197d9f68b92c6224eb6098447e0" data-crypto-key="cryptpad:aAZO8A4u++FP6txk9i1Hd22MtU2jTT6g1txDXcVPkiQ="></media-tag>
|
||||
|
||||
### MOTD + Sécurisation des interfaces inactives
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
banner motd # Personnel autorise seulement #
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**On fait la même chose sur tous les switch et routeur**
|
||||
|
||||
Puis on fait la sécurisation des interfaces inactives en les éteignant et en les mettant sur un vlan 44 créé exprès pour ça
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e5/e55c4ac8b9b677643da4364ce42aa0b0171d0acb447f8277" data-crypto-key="cryptpad:frkBBUIeRECZOr20nA24micUz2GqLZrWQuOLDfiygGM="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/9d/9d16630905283efe0d88bf62c29f420c9e0c2341316afeff" data-crypto-key="cryptpad:Hkd7WDLqcDkk5cKW2oTdC2AOeJnDQ/Lr+OGh8PjTtWo="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/d0/d08063a58ed877328789e741f6178d8bbebced047aaaadd7" data-crypto-key="cryptpad:x4lZdy9RmK3iMm1GNN+xynMB6xr0L+2Y5qUKbXVZxBE="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e3/e3b0fc80e8dce3c0bccd883b9012851641f5db7f8f096920" data-crypto-key="cryptpad:SPuLms2t/YNIB7JHpLda0QFlfvB4I4OO2DL0RqywI+k="></media-tag>
|
||||
|
||||
**Switch 1**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/1 - 2
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/8 - 24
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Switch 2**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/1 - 2
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/11 - 24
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Switch 3**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/1 - 2
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/2 - 4
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/14 - 24
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Switch 4**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/1 - 2
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/8 - 24
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Switch 5**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/1 - 2
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/5 - 10
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
exit
|
||||
interface range Fa0/14 - 24
|
||||
switchport mode access
|
||||
switchport access vlan 44
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
**Router**
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
interface range Gig0/0/1 - 2
|
||||
shutdown
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
## Mise en place des ACLs
|
||||
|
||||
Pour les ACLs on a décidé deux faire deux listes, une spécifiquement à l'entrée de la gateway du vlan 10 sur le routeur qui bloque uniquement les ports utilisés par les OSD avec les protocoles CEPH
|
||||
|
||||
Et une deuxième à l'entrée de la gateway du vlan 20 sur le routeur pour bloquer les ports utilisés par le monitor / manager de la même façon
|
||||
|
||||
On bloque donc les paquets qui viennent de ces deux vlan sur les ports utilisés par CEPH et qui sont en destination du réseau Tests (vlan 40)
|
||||
|
||||
Tout le reste du traffic est permis entre tous les vlans définis (icmp / ip, etc...)
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/20/20873674c55dab869fec0335d89010ae778864abc2a200ef" data-crypto-key="cryptpad:94ovIdglwHGQdU2B5869FcUHBKJndQi2F7zAUPwll6o="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e8/e816dec28d2acdfb0a4e5f95cf0b1606fdecd36c852b65b7" data-crypto-key="cryptpad:coqWs73UmRyv58pKl61d0EISuiBP5O4RP9/XI18TFWA="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/93/93d92019644a11a4adb44f0a7c3a1ec32309d7e946999ed5" data-crypto-key="cryptpad:6q3YGerOUSknC5cTG1mfEdh26yLagA6n+HH2/iMZ1ik="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/e2/e2b4da356ab75c565ad72e8cfc5537de129be51743cd008f" data-crypto-key="cryptpad:yhhFgwZqTHny2kjQATW4ajxtH8bwzFhJA3vaGbtB2R4="></media-tag>
|
||||
|
||||
<media-tag src="https://files.cryptpad.fr/blob/74/7456997263b569403b96c9624909567ff3216edf1c63514f" data-crypto-key="cryptpad:3ltGaqtgUXSzoNbYbzb/NlRBiH6w/CS9yZ6/gO0cXBk="></media-tag>
|
||||
|
||||
```
|
||||
enable
|
||||
conf t
|
||||
ip access-list extended CEPH_EXCLUDE_TESTS_VLAN10
|
||||
deny tcp 176.16.10.0 0.0.0.255 176.16.40.0 0.0.0.255 range 6800 7300
|
||||
permit icmp any any
|
||||
permit ip any any
|
||||
exit
|
||||
ip access-list extended CEPH_EXCLUDE_TESTS_VLAN20
|
||||
deny tcp 176.16.20.0 0.0.0.255 176.16.40.0 0.0.0.255 range 6800 7300
|
||||
deny tcp 176.16.20.0 0.0.0.255 176.16.40.0 0.0.0.255 eq 3300
|
||||
deny tcp 176.16.20.0 0.0.0.255 176.16.40.0 0.0.0.255 eq 6789
|
||||
permit icmp any any
|
||||
permit ip any any
|
||||
exit
|
||||
interface Gig0/0/0.10
|
||||
ip access-group CEPH_EXCLUDE_TESTS_VLAN10 in
|
||||
exit
|
||||
interface Gig0/0/0.20
|
||||
ip access-group CEPH_EXCLUDE_TESTS_VLAN20 in
|
||||
end
|
||||
write memory
|
||||
```
|
||||
|
||||
# FIN
|
||||
|
||||
Ps : moins de 20/20 on débarque chez toi Cédric (dans minecraft)
|
||||
Reference in New Issue
Block a user