WEBVTT

1
00:00.000 --> 00:01.700
So how did you do on the lab?

2
00:01.700 --> 00:04.920
Hopefully did great and maybe you found some areas where you want to review the

3
00:04.920 --> 00:07.100
videos or practice a few times.

4
00:07.100 --> 00:10.600
I'm super happy if you had an opportunity to do the hands-on practice.

5
00:10.600 --> 00:14.500
So in this video, I'd like to do a quick walkthrough of these tasks with you

6
00:14.500 --> 00:15.300
together.

7
00:15.300 --> 00:17.600
So with that being said, let's head over to the lab environment.

8
00:17.600 --> 00:18.300
All right.

9
00:18.300 --> 00:20.100
So here we are in the lab environment.

10
00:20.100 --> 00:23.800
I took the opportunity to click on reset and took a moment to reset and then I

11
00:23.800 --> 00:24.500
clicked on start.

12
00:24.500 --> 00:28.630
So this is the lab starting up from its base configuration without any type of

13
00:28.630 --> 00:29.300
control plane

14
00:29.300 --> 00:33.000
policing or infrastructure or infrastructure ACLs present.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.300 --> 00:33.000
policing or infrastructure or infrastructure ACLs present.

15
00:33.000 --> 00:36.420
So let me bring up the topology by double clicking here on the lab topology in

16
00:36.420 --> 00:37.000
the lab.

17
00:37.000 --> 00:37.500
There it is.

18
00:37.500 --> 00:38.500
That looks good.

19
00:38.500 --> 00:42.200
And let's go to our console prompts for the routers by going to server one.

20
00:42.200 --> 00:45.000
So we'll double click here on server one and bring that up.

21
00:45.000 --> 00:45.400
All right.

22
00:45.400 --> 00:48.800
So server one is up here is multi tab putty and let's start with the

23
00:48.800 --> 00:51.200
infrastructure ACLs here on router four.

24
00:51.200 --> 00:55.500
So on router four, we'll do a config T and also do a do show access lists just

25
00:55.500 --> 00:58.900
to make sure we don't have any IPV for access is already in place.

26
00:58.900 --> 01:00.200
And then we'll begin our config.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.900 --> 01:00.200
And then we'll begin our config.

27
01:00.200 --> 01:02.500
So it didn't tell us what we had to call the access control list.

28
01:02.500 --> 01:07.000
So let's go ahead and use IP access list extended and we use 100.

29
01:07.000 --> 01:09.610
So even though it's a number, still gives us the opportunity to do the

30
01:09.610 --> 01:13.700
configuration as if it's a named access list, which will be less typing force.

31
01:13.700 --> 01:16.900
So we want to deny traffic source from zero zero zero zero.

32
01:16.900 --> 01:22.500
So we'll type in deny IP coming from host zero zero zero zero going anywhere.

33
01:22.500 --> 01:25.700
Now that one we probably wanted to delete even if it's transit traffic because

34
01:25.700 --> 01:27.400
we don't want that traffic going through our network either.

35
01:27.400 --> 01:29.600
So press center and there's our first entry.

36
01:29.600 --> 01:36.400
Then we'll do a deny of IP or traffic being sourced from one 27 dot zero zero
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.600 --> 01:36.400
Then we'll do a deny of IP or traffic being sourced from one 27 dot zero zero

37
01:36.400 --> 01:39.000
zero from traffic from one 27 anything.

38
01:39.000 --> 01:42.520
So for the wild card bits, we had zero dot two be five dot two five dot two

39
01:42.520 --> 01:47.400
fifty five press center and what didn't like deny IPO going to anywhere.

40
01:47.400 --> 01:48.000
Fantastic.

41
01:48.000 --> 01:52.250
Let's do a do show access list and the name of our access list, which is 100

42
01:52.250 --> 01:53.600
and we'll check our work as we go.

43
01:53.600 --> 01:55.100
So so far so good.

44
01:55.100 --> 02:00.680
So based on the lab tasks, we also want to deny IP traffic, bit sourced from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:55.100 --> 02:00.680
So based on the lab tasks, we also want to deny IP traffic, bit sourced from

45
02:00.680 --> 02:03.800
one 72 16, the RFC 19 address range.

46
02:03.800 --> 02:07.320
Now because that mask is a slash 12, we want to specify the appropriate wild

47
02:07.320 --> 02:08.000
card mask.

48
02:08.000 --> 02:15.440
So for the second octet, if we have 128 64 32 16 8 for two and one and we have

49
02:15.440 --> 02:16.700
a 12 bit mass.

50
02:16.700 --> 02:18.700
So the second octet here would end right there.

51
02:18.700 --> 02:22.890
So our block size is 16. That means our wild card bits would be all these bits

52
02:22.890 --> 02:25.000
on which we are block size minus one.

53
02:25.000 --> 02:30.400
So for the wild card bits to be zero dot 15 and then to be five dot two to five
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:25.000 --> 02:30.400
So for the wild card bits to be zero dot 15 and then to be five dot two to five

54
02:30.400 --> 02:30.800
.

55
02:30.800 --> 02:34.500
So put that in a zero dot 15 dot two to five dot two to five.

56
02:34.500 --> 02:37.700
That's the source going to anywhere press center and stay quick.

57
02:37.700 --> 02:41.000
Check and make sure we're doing good so far and we are.

58
02:41.000 --> 02:44.400
So we have three entries blocking on traffic that we don't want coming in.

59
02:44.400 --> 02:48.260
In addition, if we had a block of addresses that we had internally, for example

60
02:48.260 --> 02:51.610
, the 25 network that we did in the demonstrations, we also want to block

61
02:51.610 --> 02:54.400
traffic that claimed it was coming from that source address as well.

62
02:54.400 --> 02:58.810
However, for the lab, it only wanted us to identify those three entries, all z

63
02:58.810 --> 03:03.400
eros 127 anything and the ones in two 16 address space from RFC 19 18.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:58.810 --> 03:03.400
eros 127 anything and the ones in two 16 address space from RFC 19 18.

64
03:03.400 --> 03:05.100
Next, we are supposed to deny fragments.

65
03:05.100 --> 03:09.270
So we'll say deny, let's start with TCP going from anywhere to anywhere

66
03:09.270 --> 03:13.600
fragments and we'll do the same thing for UDP and the same thing for ICMP.

67
03:13.600 --> 03:17.740
Just like that and we'll check our work with a show and that looks good as well

68
03:17.740 --> 03:18.000
.

69
03:18.000 --> 03:20.900
Oh, oh, the lab task.

70
03:20.900 --> 03:22.100
Let's take a look at it real quick.

71
03:22.100 --> 03:26.800
The lab said traffic going to 2525 and I didn't include those on those entries.

72
03:26.800 --> 03:30.200
So let's fix those because we may want some transit traffic that does that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:26.800 --> 03:30.200
So let's fix those because we may want some transit traffic that does that.

73
03:30.200 --> 03:35.550
So we'll say no 40, no 50, no 60, then we'll do a quick show just to verify

74
03:35.550 --> 03:38.000
that we're in good shape and let's put those back in.

75
03:38.000 --> 03:42.730
So let the upper key a few times and let's do the TCP fragments, but instead of

76
03:42.730 --> 03:48.960
saying any, we'll specify the management network address of 2525.25.0 with wild

77
03:48.960 --> 03:52.190
car bits saying we care about the first reactants and then the keyword

78
03:52.190 --> 03:52.800
fragments.

79
03:52.800 --> 03:54.300
And we'll take out.

80
03:54.300 --> 03:56.700
So we'll take out the part here that we don't need.

81
03:56.700 --> 04:00.510
So tonight's TCP traffic source from anywhere destined to our management
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:56.700 --> 04:00.510
So tonight's TCP traffic source from anywhere destined to our management

82
04:00.510 --> 04:04.900
address base of 252525 if there are fragments and that looks good.

83
04:04.900 --> 04:09.010
And we'll repeat that for UDP and press enter and then we'll repeat that for IC

84
04:09.010 --> 04:09.800
&P as well.

85
04:09.800 --> 04:15.000
So upper key and replace UDP with IC&P just like that.

86
04:15.000 --> 04:18.650
All right, then we'll do a quick show just to make sure we're on track and that

87
04:18.650 --> 04:19.900
looks much better.

88
04:19.900 --> 04:23.000
We want to match the lab tasks to get our ACLs correct.

89
04:23.000 --> 04:29.700
Next, it wants us to permit BGP and SSH from 23/8 to the 2525 25 address space.

90
04:29.700 --> 04:35.400
So the sound will be first will type in permit TCP sourced from 23 anything.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:29.700 --> 04:35.400
So the sound will be first will type in permit TCP sourced from 23 anything.

91
04:35.400 --> 04:38.660
So for the wild card bits to be zero meaning match on the first octet and don't

92
04:38.660 --> 04:46.030
care what the second, third or fourth going to 25.25.25.0 if the destination

93
04:46.030 --> 04:48.700
port equals BGP.

94
04:48.700 --> 04:50.700
So the quick show here is what we have.

95
04:50.700 --> 04:54.680
So as part of our infrastructure ACL, any device sourcing the traffic from 23

96
04:54.680 --> 04:56.700
anything going to 252525.

97
04:56.700 --> 05:01.900
If the destination port is the well known port for BGP, which is port 179 that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:56.700 --> 05:01.900
If the destination port is the well known port for BGP, which is port 179 that

98
05:01.900 --> 05:02.700
would be permitted.

99
05:02.700 --> 05:06.700
And although the lab didn't ask for it, we could also flip that as well.

100
05:06.700 --> 05:09.600
So if we had a BGP peer on 23 something trying to connect to one of our

101
05:09.600 --> 05:13.520
infrastructure devices, this infrastructure ACL, which we're going to apply in

102
05:13.520 --> 05:15.700
bound on gig 00 will allow that initial connection.

103
05:15.700 --> 05:17.700
So let's take a look at what is next.

104
05:17.700 --> 05:20.700
So we have BGP we also need SSH as well.

105
05:20.700 --> 05:24.940
So we'll go ahead and permit TCP from 23 anything going to our address space of

106
05:24.940 --> 05:30.700
25.25.25.0 care about matching on the first react is there for the destination.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:24.940 --> 05:30.700
25.25.25.0 care about matching on the first react is there for the destination.

107
05:30.700 --> 05:35.700
If the destination port equals 22, which is for SSH and we'll check our work.

108
05:35.700 --> 05:38.700
So we'll do a show access list for access 100 and that looks good.

109
05:38.700 --> 05:42.980
So even though the lab didn't ask for it, we'd also in a production environment

110
05:42.980 --> 05:46.860
want to go in and deny the traffic for BGP and SSH from any other addresses

111
05:46.860 --> 05:49.700
that are trying to go to our management space.

112
05:49.700 --> 05:55.700
So for grins under that as well with a deny TCP any going to our address space.

113
05:55.700 --> 06:01.700
If the destination port equals BGP and also if the destination port equals 22.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:55.700 --> 06:01.700
If the destination port equals BGP and also if the destination port equals 22.

114
06:01.700 --> 06:06.800
So now if we look at entry 70 and 80, we're printing BGP and 22 based on the

115
06:06.800 --> 06:07.700
criteria.

116
06:07.700 --> 06:12.130
But if it doesn't match that criteria, we're denying BGP and SSH with the next

117
06:12.130 --> 06:16.700
two lines here for traffic trying to come into our management address space.

118
06:16.700 --> 06:20.570
So again, the lab I didn't ask for those explicit denies just a reminder though

119
06:20.570 --> 06:24.540
infrastructure ACLs are to protect our infrastructure devices by locking them

120
06:24.540 --> 06:28.140
down and only allowing the required protocols that we want to use from the

121
06:28.140 --> 06:29.700
addresses that we know.

122
06:29.700 --> 06:33.700
Or from the range of addresses that we specify and then to make this effective,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
06:29.700 --> 06:33.700
Or from the range of addresses that we specify and then to make this effective,

123
06:33.700 --> 06:35.700
we need to apply this access control list.

124
06:35.700 --> 06:39.520
So let's exit out of access list configuration mode go to interface gig zero

125
06:39.520 --> 06:43.600
slash zero and use the command IP access group access list is 100 and we'll

126
06:43.600 --> 06:45.700
apply that inbound on that interface.

127
06:45.700 --> 06:50.300
And we are done. We do a show IP interface gig zero slash zero to verify that

128
06:50.300 --> 06:55.700
it's applied and shows it right here with inbound access list 100 applied.

129
06:55.700 --> 06:58.910
So the second part here is to configure control plane policing to limit the

130
06:58.910 --> 07:00.700
impact of an ICMP fled to the router.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
06:58.910 --> 07:00.700
impact of an ICMP fled to the router.

131
07:00.700 --> 07:04.140
And by saying the threshold really, really low, it's super easy to verify that

132
07:04.140 --> 07:04.700
as well.

133
07:04.700 --> 07:07.700
So let's go to the right router when I go to our one.

134
07:07.700 --> 07:11.780
And before we actually do the configuration for the control plane policing, let

135
07:11.780 --> 07:13.700
's go to our two. So our two is right here.

136
07:13.700 --> 07:19.360
And we should be able to ping our one at 10 dot zero dot 12 dot one. That's our

137
07:19.360 --> 07:22.700
ones gig one slash zero interface. Let's verify that real quick.

138
07:22.700 --> 07:27.700
So our two will do a ping to 10 dot zero dot 12 dot one. And that works.

139
07:27.700 --> 07:30.700
And let's go ahead and do a ping and repeat it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
07:27.700 --> 07:30.700
And let's go ahead and do a ping and repeat it.

140
07:30.700 --> 07:35.280
Let's go ahead and repeat it say 10,000 times and we can break that if we need

141
07:35.280 --> 07:38.340
to. So that's going to be saying those things effectively do a control shift

142
07:38.340 --> 07:38.700
six.

143
07:38.700 --> 07:41.380
In fact, let me clear that and then we go ahead and send it more. I'm going to

144
07:41.380 --> 07:42.700
add a couple zeros on there.

145
07:42.700 --> 07:47.060
And that way it'll give me time to go ahead and configure it. So press enter

146
07:47.060 --> 07:48.700
and away it goes.

147
07:48.700 --> 07:53.100
So what our one it's receiving and because that destination is our one, our one

148
07:53.100 --> 07:56.700
is processing those ping requests and then responding back.

149
07:56.700 --> 08:00.640
So let's go to our one and let's set up control plane policing. Let's do a show
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:56.700 --> 08:00.640
So let's go to our one and let's set up control plane policing. Let's do a show

150
08:00.640 --> 08:05.880
access list. There aren't any. So config T access list is create access list

151
08:05.880 --> 08:08.700
111 and will permit.

152
08:08.700 --> 08:13.420
I see him from anywhere anywhere and boom, there's our access list. Then we'll

153
08:13.420 --> 08:17.700
create a class map and we'll call this C map and press center.

154
08:17.700 --> 08:21.850
So do show class map press center. It defaults to a match all if you didn't

155
08:21.850 --> 08:26.220
explicitly include matching your match all. So there's our class map. We're not

156
08:26.220 --> 08:27.700
yet matching anything.

157
08:27.700 --> 08:30.790
But what it is match access group and because the number of access control list
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
08:27.700 --> 08:30.790
But what it is match access group and because the number of access control list

158
08:30.790 --> 08:34.290
, we'll go ahead and put that in, which is 111 and press center. So now if we

159
08:34.290 --> 08:38.700
look at that class map, it's matching on access control list 111.

160
08:38.700 --> 08:41.420
Next, we'll exit out and we'll create a policy map specifying what we want to

161
08:41.420 --> 08:44.700
do. So we'll type in the command policy map. We'll call it P map.

162
08:44.700 --> 08:47.080
Almost got it. So I go ahead and do a no on that because I want to name it

163
08:47.080 --> 08:51.680
correctly. So a note policy map PM a open bracket and we want a policy map

164
08:51.680 --> 08:52.700
called P map.

165
08:52.700 --> 08:56.200
Let's do a do show policy map just to make sure we don't have any other policy

166
08:56.200 --> 08:59.700
maps. And then in that policy map, we want to match on.

167
08:59.700 --> 09:04.460
Last C map, which is looking for matching on access list 111, which is looking
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
08:59.700 --> 09:04.460
Last C map, which is looking for matching on access list 111, which is looking

168
09:04.460 --> 09:07.700
for ICMP traffic. And if we see that traffic, what do we want to do?

169
09:07.700 --> 09:11.670
And what we want to do is go ahead and police it down. It's a little type in

170
09:11.670 --> 09:17.660
police space. And I would say for the demo, let's go ahead and use 10,000 space

171
09:17.660 --> 09:17.700
.

172
09:17.700 --> 09:22.700
And then for the conform action, we'll go ahead and say transmit.

173
09:22.700 --> 09:27.260
And for the exceed action, we'll say drop. And then for the violate action, let

174
09:27.260 --> 09:31.010
's also say drop just like that. So we'll type in exit three times here to go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
09:27.260 --> 09:31.010
's also say drop just like that. So we'll type in exit three times here to go

175
09:31.010 --> 09:32.700
back to configuration mode.

176
09:32.700 --> 09:38.440
Let's also do a do show policy map. And look at our work so far. So our policy

177
09:38.440 --> 09:43.130
map called PMap is including the class map called C map, which is looking for

178
09:43.130 --> 09:46.700
effectively ICMP traffic matching ACL 111.

179
09:46.700 --> 09:50.040
And if it sees it, it's going to please it above 10,000 bits per second. And

180
09:50.040 --> 09:53.840
the conform action is to transmit or process that traffic and the exceed and

181
09:53.840 --> 09:55.700
violate action are to go ahead and drop.

182
09:55.700 --> 09:58.820
Then the last step would be to apply this to the control plane. So type in

183
09:58.820 --> 10:02.230
control plane press enter, and that puts us into control plane configuration
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
09:58.820 --> 10:02.230
control plane press enter, and that puts us into control plane configuration

184
10:02.230 --> 10:02.700
mode.

185
10:02.700 --> 10:06.750
And from here, we're going to type in service policy, and then we'll specify

186
10:06.750 --> 10:10.390
the direction. So we want this to be an input service policy for traffic coming

187
10:10.390 --> 10:12.700
into the route processor into the route itself.

188
10:12.700 --> 10:17.000
Space question mark, and then the name of our policy map, which is PMap. So I

189
10:17.000 --> 10:20.950
'll copy paste that press enter and then to see our work, we'll go into a show

190
10:20.950 --> 10:21.700
policy map.

191
10:21.700 --> 10:25.020
And instead of just saying all the policy maps, we'll say show policy map

192
10:25.020 --> 10:26.700
control plane, just like that.

193
10:26.700 --> 10:30.960
So that in mind, let's go back to R2. And you notice here that R2, we have many
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
10:26.700 --> 10:30.960
So that in mind, let's go back to R2. And you notice here that R2, we have many

194
10:30.960 --> 10:33.700
of our pings that are making of it somewhere not.

195
10:33.700 --> 10:37.480
And that's because we have our threshold for policing set at 10,000. So there's

196
10:37.480 --> 10:41.700
a fail, there's a fail, there's a fail. And it's pretty consistent.

197
10:41.700 --> 10:45.890
So if we go back to R1, and we hit the up arrow key here into a show policy map

198
10:45.890 --> 10:49.700
control plane press enter, here we have our number of conformed packets, 261,

199
10:49.700 --> 10:52.700
and then we have our exceeded packets, which are 17.

200
10:52.700 --> 10:56.700
And if we hit the up arrow key again, that exceeded number should be growing.

201
10:56.700 --> 11:00.390
So thanks for joining me in this set of videos regarding helping to protect our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
10:56.700 --> 11:00.390
So thanks for joining me in this set of videos regarding helping to protect our

202
11:00.390 --> 11:02.700
infrastructure devices with two specific tools.

203
11:02.700 --> 11:06.370
One is the infrastructure ACLs at the edge of our network, and then also

204
11:06.370 --> 11:10.340
control plane policing, which we can apply directly to the control plane on

205
11:10.340 --> 11:11.700
each of our routers.

206
11:11.700 --> 11:15.130
So once again, thanks for joining me, and I look forward to seeing you, my

207
11:15.130 --> 11:17.700
friend, in another set of videos very, very soon.

208
11:17.700 --> 11:22.780
Until then, I hope this has been informative, and I'd like to thank you for

209
11:22.780 --> 11:23.700
viewing.