207 lines
4.5 KiB
Markdown
207 lines
4.5 KiB
Markdown
# Sécurité en réseau
|
|
|
|
## Cours
|
|
|
|
### Travail dirigé
|
|
|
|
- Sécuriser le port console
|
|
- Sécuriser le passage au niveau 2 (*enable*)
|
|
- Sécuriser les ports réseau (*port-security*)
|
|
- Metter en place le SSH (*sur VLAN dédié*)
|
|
|
|
- BDPU Guard (*protéger le port d'un branchement à un autre switch*)
|
|
- ACLs (*standard et étendue*)
|
|
- Théorie des pare-feux
|
|
|
|
## Exercices
|
|
|
|
### Exercice 1
|
|
|
|
### Exercice 2
|
|
|
|
#### Partie 1
|
|
|
|
**Routeur**
|
|
```
|
|
enable
|
|
conf t
|
|
interface Gig0/1
|
|
ip address 192.168.0.1 255.255.255.0
|
|
no shutdown
|
|
ip default-gateway 192.168.0.1
|
|
interface Gig0/1
|
|
ip address 192.168.1.1 255.255.255.0
|
|
no shutdown
|
|
ip default-gateway 192.168.1.1
|
|
no ip domain-lookup
|
|
enable secret class
|
|
line console 0
|
|
password cisco
|
|
login
|
|
line vty 0 4
|
|
password cisco
|
|
login
|
|
transport input all
|
|
service password-encryption
|
|
banner motd # You shan't access this very device without permission #
|
|
end
|
|
write memory
|
|
```
|
|
|
|
**Switch**
|
|
```
|
|
enable
|
|
conf t
|
|
vlan 10
|
|
name VLAN10
|
|
exit
|
|
interface FastEthernet0/5
|
|
switchport mode access
|
|
switchport access vlan 99
|
|
spanning-tree portfast
|
|
interface FastEthernet0/6
|
|
switchport mode access
|
|
switchport access vlan 99
|
|
spanning-tree portfast
|
|
interface vlan 10
|
|
ip address 192.168.1.2 255.255.255.0
|
|
no shutdown
|
|
ip default-gateway 192.168.1.1
|
|
no ip domain-lookup
|
|
enable secret class
|
|
line console 0
|
|
password cisco
|
|
login
|
|
line vty 0 4
|
|
password cisco
|
|
login
|
|
transport input all
|
|
service password-encryption
|
|
banner motd # You shan't access this very device without permission #
|
|
end
|
|
write memory
|
|
```
|
|
|
|
### Exercice 3
|
|
|
|
#### Liste des commandes utiles
|
|
|
|
| Commandes | Descriptions |
|
|
|---------------------------------------------------------|------------------------------------------------------------------|
|
|
| conf t | Activate configuration from terminal |
|
|
| interface *interface* | Go in interface to configure it properly |
|
|
| ip access-group *ACL_name* **{in\|out}** | Activate and apply ACL to interface |
|
|
| **ip access-list extended** *ACL_name* | Define ACL and go into conf mode |
|
|
| **{permit\|deny}** {test conditions} | Defined apply policy for said ACL |
|
|
| **show access-lists** *ACL_name* | Display all ACLs content |
|
|
| **show ip interface** *interface-type interface number* | Display IP infos from specific interface, including applied ACLs |
|
|
|
|
####
|
|
|
|
```
|
|
router> enable
|
|
router# configure terminal
|
|
router(config)# access-list 10 deny 10.1.1.101 0.0.0.0
|
|
router(config)# access-list 10 permit any
|
|
router(config)# line vty 0 4
|
|
router(config-line)# access-class 10 in
|
|
router(config-line)# exit
|
|
router(config)# interface GigabitEthernet0/0
|
|
router(config-if)# ip access-group 10 in
|
|
router(config)# exit
|
|
router# write memory
|
|
```
|
|
|
|
### Exercice 4
|
|
|
|
#### Tâche 1
|
|
|
|
```
|
|
ping 172.16.1.100
|
|
traceroute 172.16.1.100
|
|
```
|
|
|
|
```
|
|
show interfaces Gig0/1
|
|
conf t
|
|
ip route 0.0.0.0 0.0.0.0 209.165.201.2
|
|
end
|
|
write memory
|
|
```
|
|
|
|
#### Tâche 2
|
|
|
|
```
|
|
telnet 172.16.1.100 23
|
|
telnet 172.16.1.100 80
|
|
```
|
|
|
|
### Exercice 5
|
|
|
|
**R1**
|
|
```
|
|
enable
|
|
conf t
|
|
interface Gig0/0
|
|
ip address 192.168.0.5 255.255.255.252
|
|
no shutdown
|
|
interface Gig0/1
|
|
ip address 192.168.0.2 255.255.255.252
|
|
no shutdown
|
|
router ospf 21
|
|
network 192.168.0.0 0.0.0.3 area 0
|
|
router ospf 13
|
|
network 192.168.0.4 0.0.0.3 area 0
|
|
no ip domain-lookup
|
|
end
|
|
write memory
|
|
```
|
|
|
|
**R2**
|
|
```
|
|
enable
|
|
conf t
|
|
interface Gig0/0
|
|
ip address 192.168.0.10 255.255.255.252
|
|
no shutdown
|
|
interface Gig0/1
|
|
ip address 192.168.0.6 255.255.255.252
|
|
no shutdown
|
|
interface Gig0/2
|
|
ip address 192.168.100.254 255.255.255.0
|
|
no shutdown
|
|
router ospf 32
|
|
network 192.168.0.8 0.0.0.3 area 0
|
|
router ospf 21
|
|
network 192.168.0.0 0.0.0.3 area 0
|
|
no ip domain-lookup
|
|
ip routing
|
|
end
|
|
write memory
|
|
```
|
|
|
|
**R3**
|
|
```
|
|
enable
|
|
conf t
|
|
interface Gig0/0
|
|
ip address 192.168.0.1 255.255.255.252
|
|
no shutdown
|
|
interface Gig0/1
|
|
ip address 192.168.0.9 255.255.255.252
|
|
no shutdown
|
|
interface Gig0/2
|
|
ip address 192.168.200.254 255.255.255.0
|
|
no shutdown
|
|
router ospf 13
|
|
network 192.168.0.4 0.0.0.3 area 0
|
|
router ospf 32
|
|
network 192.168.0.8 0.0.0.3 area 0
|
|
no ip domain-lookup
|
|
ip routing
|
|
end
|
|
write memory
|
|
```
|
|
|
|
|
|
### Exercice 6 |