WEBVTT

00:00:01.000 --> 00:00:11.000
All right, so let's dive into the security now and we will not finish our entire security discussion today.

00:00:11.000 --> 00:00:13.000
It will roll over into our next session.

00:00:13.000 --> 00:00:19.000
Let's begin with device access, authentication, configuration, and verification, which is all about what?

00:00:19.000 --> 00:00:26.000
Two exam objectives. It's about configuring and verifying device access controls like line and password protection,

00:00:26.000 --> 00:00:29.000
authentication, authorization using things like AAA.

00:00:29.000 --> 00:00:33.000
So, we'll have another discussion on AAA. I've separated it out here in this case,

00:00:33.000 --> 00:00:37.000
so that way there we can focus a little bit more on AAA all by itself.

00:00:37.000 --> 00:00:42.000
So, the best way to have this discussion is just to jump into our live environment.

00:00:42.000 --> 00:00:46.000
There are slides that you can go back and review and read if you want to.

00:00:46.000 --> 00:00:52.000
That's part of my class slides, but it's a lot better for us just to hang out in the live environment

00:00:52.000 --> 00:00:56.000
and look at everything we need to look at from this perspective.

00:00:56.000 --> 00:01:00.000
So, the first thing I'm going to do here is show you that we're connected to R1 right now,

00:01:00.000 --> 00:01:04.000
and I'm connected to the console port at this particular point in time.

00:01:04.000 --> 00:01:10.000
So, as soon as I hit return to get started, you'll see that I'm immediately in user exec mode.

00:01:10.000 --> 00:01:13.000
That is bad. That is really bad. Why?

00:01:13.000 --> 00:01:19.000
Because that means anybody who can gain access to this console port, physically connect to it,

00:01:19.000 --> 00:01:21.000
will immediately get access to user exec mode.

00:01:21.000 --> 00:01:25.000
Now, remember that user exec mode, there's not really a whole lot of things you can do,

00:01:25.000 --> 00:01:31.000
but if you get yourself into user exec mode, you're one step closer to elevating your privileges

00:01:31.000 --> 00:01:34.000
and getting more privileged access to the device.

00:01:34.000 --> 00:01:39.000
In addition, there may be a few things in user exec mode that a criminal could access,

00:01:39.000 --> 00:01:45.000
which could give them an opportunity to potentially do something malicious anyways.

00:01:45.000 --> 00:01:48.000
So, it's better that they don't even have access to user exec mode.

00:01:48.000 --> 00:01:54.000
So, we're going to have to protect the movement or the connection, I should say, to the console port.

00:01:54.000 --> 00:02:00.000
Now, the command enable allows you to elevate your privileges, and when you type in enable,

00:02:00.000 --> 00:02:05.000
it gives you the highest level privileges possible on the device, and that is privilege level 15.

00:02:05.000 --> 00:02:11.000
So, I've gone from user exec mode, me having privilege level 1 access,

00:02:11.000 --> 00:02:15.000
so the minimum level of privileges I could possibly have, to going to privilege exec mode,

00:02:16.000 --> 00:02:19.000
having privilege level 15, the highest possible privileges I could have,

00:02:19.000 --> 00:02:28.000
without being questioned once about my authentication or requiring to provide any identity whatsoever.

00:02:28.000 --> 00:02:37.000
So, let's go ahead here and talk about how we can configure and verify access control parameters on our device.

00:02:37.000 --> 00:02:42.000
So, first, we'll start off with the basic, basic, basic local options on our device,

00:02:42.000 --> 00:02:45.000
and we'll move our way up to AAA in our discussion.

00:02:45.000 --> 00:02:51.000
So, first and foremost, let's take a look at show, run, pipe to section, line.

00:02:51.000 --> 00:02:55.000
So, if you forgot from your CCNA days, what is line? What is a line?

00:02:55.000 --> 00:03:06.000
Okay, always remember that a line is a method that we have available on our device, so we can manage our device.

00:03:06.000 --> 00:03:14.000
So, for example, with the console port, we have the opportunity to physically connect to this device

00:03:14.000 --> 00:03:20.000
through the console port using a serial cable and a terminal program on our device,

00:03:20.000 --> 00:03:26.000
our PC, laptop, I should say, and manage the actual device.

00:03:26.000 --> 00:03:29.000
Something like the aux port allows us to set up a modem,

00:03:29.000 --> 00:03:35.000
so that way I can dial into the device over a telephone line and manage it.

00:03:35.000 --> 00:03:41.000
We also have our VTY lines, which give us the opportunity to remotely manage our device

00:03:41.000 --> 00:03:47.000
using things like Telnet or SSH protocols in order to accomplish that.

00:03:47.000 --> 00:03:50.000
So, three different options that I want you to be aware of for the exam,

00:03:50.000 --> 00:03:58.000
any other options you don't have to worry about, the basics, line console zero, aux port, and your VTY lines.

00:03:58.000 --> 00:04:04.000
So, in this case, I have a total of 16 VTY lines that we could use for remote management connections

00:04:04.000 --> 00:04:11.000
with the default VTY lines being zero through four, so five default VTY lines on my device.

00:04:11.000 --> 00:04:13.000
All right, let's go back to the console port here.

00:04:13.000 --> 00:04:17.000
If we type in configure terminal and we type in line console zero,

00:04:17.000 --> 00:04:24.000
I have the opportunity to put a password on the console port by using, what, the password command.

00:04:24.000 --> 00:04:30.000
So, let's just use a password of Cisco today in order to make sure I don't forget my passwords that I'm using.

00:04:30.000 --> 00:04:37.000
So, now that I've done this on the console port, if we log out and we log back in,

00:04:37.000 --> 00:04:43.000
what we're going to see is that I am not asked for a password.

00:04:43.000 --> 00:04:44.000
Uh-oh.

00:04:44.000 --> 00:04:46.000
All right, so that's a problem.

00:04:46.000 --> 00:04:47.000
Why is that a problem?

00:04:47.000 --> 00:04:54.000
Because even though I applied a password, that password is not in effect.

00:04:54.000 --> 00:04:57.000
How do we enable that password?

00:04:57.000 --> 00:05:00.000
How do we enforce that password, folks?

00:05:00.000 --> 00:05:07.000
How do we tell the router, make sure you ask the user to supply the line password?

00:05:07.000 --> 00:05:08.000
How do we do that?

00:05:08.000 --> 00:05:10.000
Because right now, it's not doing it.

00:05:10.000 --> 00:05:12.000
How do we force that to happen?

00:05:12.000 --> 00:05:13.000
Does anybody know?

00:05:13.000 --> 00:05:16.000
It's going to be important for your exam success that you know this.

00:05:16.000 --> 00:05:21.000
So, if I want to force that line password to be utilized,

00:05:21.000 --> 00:05:29.000
what command do we need here on the console port in order to force that to be used?

00:05:29.000 --> 00:05:31.000
All right, it's going to be the login command.

00:05:31.000 --> 00:05:34.000
Login, L-O-G-I-N.

00:05:34.000 --> 00:05:37.000
So, we type in do show run, pipe the section line.

00:05:37.000 --> 00:05:45.000
We'll now see that we have line console zero, password, and login specified.

00:05:45.000 --> 00:05:52.000
So, now, if we turn around and exit back out and log back in,

00:05:52.000 --> 00:05:55.000
you'll see it's now asking me for a password.

00:05:55.000 --> 00:05:58.000
So, I'm going to put in the line password in this case.

00:05:58.000 --> 00:06:05.000
So, it's imperative that you recognize for the exam that when you see the login keyword,

00:06:05.000 --> 00:06:09.000
it means enforce this line password.

00:06:09.000 --> 00:06:15.000
Ask the user to supply the line password.

00:06:15.000 --> 00:06:18.000
That is what it's enforcing in this particular case.

00:06:22.000 --> 00:06:26.000
So, if you had a situation like this on the exam that you were looking at,

00:06:30.000 --> 00:06:34.000
then is the user required to provide a password?

00:06:34.000 --> 00:06:36.000
What's the answer to that question?

00:06:36.000 --> 00:06:41.000
Is the user required to provide a password on the console port, yes or no?

00:06:45.000 --> 00:06:46.000
Good answer.

00:06:46.000 --> 00:06:50.000
Yeah, no, right, because it doesn't say login.

00:06:50.000 --> 00:06:52.000
These are the things you need to be able to recognize.

00:06:52.000 --> 00:06:56.000
This is the type of stuff that Cisco is going to be testing you on.

00:06:56.000 --> 00:07:00.000
And so, remember, 20% of your exam is on security.

00:07:00.000 --> 00:07:06.000
Don't be surprised if you get four or five or six or even seven questions on this type of stuff

00:07:06.000 --> 00:07:09.000
that I'm covering here in this discussion.

00:07:11.000 --> 00:07:16.000
So, can you really understand how everything works and put it all together for a question?

00:07:18.000 --> 00:07:21.000
Let's go down to the VTY lines right now.

00:07:22.000 --> 00:07:27.000
So, if we go down to the VTY lines, the VTY lines are for what again?

00:07:27.000 --> 00:07:29.000
Remote management connections.

00:07:29.000 --> 00:07:33.000
So, telnet connections, SSH connections.

00:07:33.000 --> 00:07:38.000
And when you look at transport input all, that means all,

00:07:38.000 --> 00:07:44.000
all remote access connections that this device supports are allowed.

00:07:44.000 --> 00:07:50.000
So, if we go to line VTY 0 through 4, and we say transport input,

00:07:50.000 --> 00:07:54.000
you'll see here that it states that all means all protocols.

00:07:54.000 --> 00:07:56.000
So, what protocols?

00:07:56.000 --> 00:07:59.000
So, any ones that are listed here.

00:08:00.000 --> 00:08:03.000
Now, for this exam, you really only have to worry about telnet.

00:08:03.000 --> 00:08:06.000
You really only have to worry about SSH.

00:08:06.000 --> 00:08:13.000
So, in this case, if I want to ensure that only telnet is allowed or only SSH is allowed,

00:08:13.000 --> 00:08:16.000
then you would type in which one you want to allow.

00:08:16.000 --> 00:08:18.000
So, that one's only telnet.

00:08:18.000 --> 00:08:21.000
This one would be only SSH.

00:08:21.000 --> 00:08:25.000
If I want to allow both, I can type in, for example, telnet SSH.

00:08:25.000 --> 00:08:27.000
Or we could type in SSH telnet.

00:08:27.000 --> 00:08:28.000
The order doesn't matter.

00:08:28.000 --> 00:08:31.000
The order does not matter whatsoever.

00:08:34.000 --> 00:08:41.000
So, this is how you control what type of remote management protocols are allowed to connect to the VTY lines.

00:08:42.000 --> 00:08:47.000
Now, if you don't want to allow remote connections at all, then just type in none.

00:08:47.000 --> 00:08:50.000
And that essentially disables that VTY line.

00:08:50.000 --> 00:08:58.000
So, if you ever see none as an option in your output or you need to deny all protocols from being used,

00:08:58.000 --> 00:09:02.000
the simplest way to do that is transport input none on the VTY line.

00:09:04.000 --> 00:09:07.000
So, we're going to put in transport input telnet SSH, SSH telnet.

00:09:07.000 --> 00:09:08.000
It doesn't matter the order.

00:09:08.000 --> 00:09:10.000
Do, show, run, pipe the section line.

00:09:10.000 --> 00:09:15.000
And we'll see here that we're now only allowing telnet and SSH.

00:09:16.000 --> 00:09:18.000
Let's go over to DSW-1 right now.

00:09:18.000 --> 00:09:20.000
And on DSW-1, I'm going to type in telnet.

00:09:20.000 --> 00:09:23.000
And we're going to telnet to 10.40.12.1.

00:09:24.000 --> 00:09:25.000
That is R1.

00:09:31.000 --> 00:09:32.000
I believe it is.

00:09:32.000 --> 00:09:33.000
Let me just double check.

00:09:33.000 --> 00:09:34.000
No, it's not.

00:09:34.000 --> 00:09:35.000
It's not R1.

00:09:35.000 --> 00:09:36.000
What am I doing?

00:09:36.000 --> 00:09:37.000
What is R1?

00:09:39.000 --> 00:09:41.000
That's not the right address.

00:09:41.000 --> 00:09:44.000
10.40.23.1.

00:09:44.000 --> 00:09:45.000
All right.

00:09:45.000 --> 00:09:48.000
Let's go back to DSW-1 and put in the right IP address.

00:09:48.000 --> 00:09:52.000
Because right now, we are trying this, and it is not going to work.

00:09:53.000 --> 00:09:54.000
Why?

00:09:54.000 --> 00:10:02.000
Because 10.40.12.1 is actually the IP address on this device, interface VLAN 421.

00:10:02.000 --> 00:10:03.000
That's what that is.

00:10:03.000 --> 00:10:04.000
All right.

00:10:04.000 --> 00:10:06.000
So, let's do this instead, telnet.

00:10:09.000 --> 00:10:10.000
There we go.

00:10:10.000 --> 00:10:14.000
And you'll see that I have successfully connected to this device.

00:10:15.000 --> 00:10:18.000
Now, why did I successfully connect this device right now?

00:10:18.000 --> 00:10:23.000
Well, if we go back to R1, you notice how it says no login?

00:10:23.000 --> 00:10:25.000
What does no login mean?

00:10:25.000 --> 00:10:33.000
No login means do not ask the user to provide a password.

00:10:33.000 --> 00:10:39.000
So, no login does not mean do not allow them to connect.

00:10:39.000 --> 00:10:41.000
That's not what it means.

00:10:41.000 --> 00:10:44.000
So, on the exam, if you saw that, and you had to pick out of a lineup what that means,

00:10:44.000 --> 00:10:49.000
do not pick the one that says you are denied from VTY access.

00:10:49.000 --> 00:10:50.000
No, you're not.

00:10:50.000 --> 00:10:54.000
You are 100% allowed without providing a password.

00:10:54.000 --> 00:10:55.000
That's what it means.

00:10:55.000 --> 00:10:57.000
Now, that's not the default on your VTY lines, okay?

00:10:57.000 --> 00:11:06.000
The default on your VTY lines is actually going to be login.

00:11:06.000 --> 00:11:09.000
That is actually going to be your default.

00:11:09.000 --> 00:11:12.000
So, let me show you what the default actually looks like.

00:11:12.000 --> 00:11:17.000
So, the default is line VTY 0-4 and then login.

00:11:17.000 --> 00:11:25.000
So, by default, what you should get is an error message when somebody tries to telnet to your device.

00:11:25.000 --> 00:11:28.000
And that error message would be password required but none set.

00:11:28.000 --> 00:11:32.000
That's typically what you would see by default.

00:11:32.000 --> 00:11:33.000
And what does that mean?

00:11:33.000 --> 00:11:38.000
It means the login command is there, but no password has been specified.

00:11:38.000 --> 00:11:45.000
So, if we provide a password, for example, of like Cisco, now we look at our output,

00:11:45.000 --> 00:11:50.000
and we'll see that we have a password, we have login, we're allowing telnet.

00:11:50.000 --> 00:11:53.000
So, if we go back to DSW-1, we should see that now that works,

00:11:53.000 --> 00:11:55.000
and it's going to ask us for the what?

00:11:55.000 --> 00:12:01.000
The line password in this particular case.

00:12:02.000 --> 00:12:10.000
So, if you are on the exam and you see something like this, what does this mean?

00:12:10.000 --> 00:12:14.000
Well, like we talked about the console part, if it says no login,

00:12:14.000 --> 00:12:18.000
then that means you do not have to provide a password, even though the password is there.

00:12:18.000 --> 00:12:29.000
So, right now, folks, question is, what password is needed to log into the VTY lines?

00:12:29.000 --> 00:12:36.000
Your answer would be no password needed.

00:12:36.000 --> 00:12:39.000
So, let's go back to DSW-1, and we'll see that.

00:12:39.000 --> 00:12:42.000
There you go.

00:12:42.000 --> 00:12:43.000
Go back to R1.

00:12:43.000 --> 00:12:44.000
Let's change that.

00:12:44.000 --> 00:12:47.000
Login.

00:12:47.000 --> 00:12:52.000
What password is needed to log into the VTY lines?

00:12:52.000 --> 00:12:53.000
Cisco.

00:12:53.000 --> 00:12:55.000
Let's go back to DSW-1.

00:12:55.000 --> 00:12:56.000
Let's try telnet.

00:12:56.000 --> 00:12:57.000
Cisco.

00:12:57.000 --> 00:12:58.000
All right?

00:12:58.000 --> 00:12:59.000
So, this is important.

00:12:59.000 --> 00:13:01.000
It may seem so simple, right?

00:13:01.000 --> 00:13:02.000
It may seem so simple.

00:13:02.000 --> 00:13:04.000
You're like, oh, my gosh, I can't believe we're doing this.

00:13:04.000 --> 00:13:06.000
Okay, but here's the deal, right?

00:13:06.000 --> 00:13:12.000
If I gave you all of this in an exam question, and then I asked you questions about that,

00:13:12.000 --> 00:13:15.000
can you answer them based on just what you see?

00:13:15.000 --> 00:13:20.000
Like, what would happen if somebody tried to log in under this condition or that condition

00:13:20.000 --> 00:13:22.000
or so on and so forth?

00:13:22.000 --> 00:13:24.000
For example, what if I just showed you this?

00:13:24.000 --> 00:13:25.000
Let's go back up here.

00:13:25.000 --> 00:13:32.000
And what if I showed you this?

00:13:32.000 --> 00:13:37.000
And I say to you, and the question is, what is going to happen if somebody tries to connect

00:13:37.000 --> 00:13:40.000
via telnet?

00:13:40.000 --> 00:13:41.000
That's it.

00:13:41.000 --> 00:13:42.000
That's the question.

00:13:42.000 --> 00:13:44.000
And there's four options in a multiple choice question.

00:13:44.000 --> 00:13:48.000
What's going to happen if somebody tries to connect via telnet?

00:13:48.000 --> 00:13:53.000
Well, you look at all this output here, and you're like, okay, so telnet would be my VTY

00:13:53.000 --> 00:13:54.000
lines.

00:13:54.000 --> 00:13:57.000
So, VTY lines zero through four.

00:13:57.000 --> 00:14:01.000
And it says here, log in, but there's no password.

00:14:01.000 --> 00:14:04.000
So, the result would be what?

00:14:04.000 --> 00:14:07.000
Password required, but none set.

00:14:07.000 --> 00:14:08.000
Remember that?

00:14:08.000 --> 00:14:09.000
Password required, but none set.

00:14:09.000 --> 00:14:13.000
So, that would be the option that you would have to pick, password required, but none

00:14:13.000 --> 00:14:14.000
set.

00:14:14.000 --> 00:14:19.000
That's why I'm spending so much time on this, to make sure that you have every, possibly

00:14:19.000 --> 00:14:24.000
every possible scenario shown to you here as we talk about it, so that way you're not

00:14:24.000 --> 00:14:38.000
blindsided on a certification exam with some of this stuff.

00:14:38.000 --> 00:14:40.000
Okay.

00:14:40.000 --> 00:14:47.000
Now, what I've just shown you is what we call line password authentication.

00:14:48.000 --> 00:14:50.000
Line password authentication.

00:14:50.000 --> 00:14:57.000
What is the primary concern we have with line password authentication, folks?

00:14:57.000 --> 00:15:00.000
Meaning, why should we not use it?

00:15:00.000 --> 00:15:05.000
What's the risk that's involved with using line passwords?

00:15:05.000 --> 00:15:06.000
Okay.

00:15:06.000 --> 00:15:09.000
Conrad says scalability.

00:15:09.000 --> 00:15:11.000
Scalability.

00:15:11.000 --> 00:15:12.000
Okay.

00:15:12.000 --> 00:15:14.000
What does scalability mean?

00:15:14.000 --> 00:15:19.000
It means that, well, it's going to be tough for us to grow.

00:15:19.000 --> 00:15:20.000
What?

00:15:20.000 --> 00:15:24.000
Grow potentially the number of users, but wait a second.

00:15:24.000 --> 00:15:25.000
Let's look at what Casey said.

00:15:25.000 --> 00:15:26.000
Accountability.

00:15:26.000 --> 00:15:29.000
There is no accountability.

00:15:29.000 --> 00:15:38.000
Meaning that every administrator who uses this device via the console port or the line,

00:15:38.000 --> 00:15:40.000
V2I lines, is going to have to what?

00:15:40.000 --> 00:15:43.000
Use that same password.

00:15:43.000 --> 00:15:48.000
So, if I use the password, Casey uses the password, Conrad uses the password,

00:15:48.000 --> 00:15:51.000
Andrew uses the same password, we don't know who's logged in when.

00:15:51.000 --> 00:15:53.000
We don't know who's doing what when.

00:15:53.000 --> 00:15:55.000
There is no accountability.

00:15:55.000 --> 00:16:00.000
So, if I log in and I make a whole bunch of changes that are really dangerous for the device

00:16:00.000 --> 00:16:04.000
and it causes a security breach down the road, well, any one of us could be blamed,

00:16:04.000 --> 00:16:08.000
and I'll point the finger immediately at Andrew.

00:16:08.000 --> 00:16:11.000
Sorry, Andrew.

00:16:11.000 --> 00:16:16.000
But that's what I'm going to do to you.

00:16:16.000 --> 00:16:19.000
So, yes, password required but none set.

00:16:19.000 --> 00:16:20.000
Let's go back to that.

00:16:20.000 --> 00:16:23.000
Password required but none set would result in not connecting.

00:16:23.000 --> 00:16:24.000
Yes, that's right.

00:16:24.000 --> 00:16:28.000
So, if you get that error message, you can't connect because there is no password,

00:16:28.000 --> 00:16:33.000
yet the device requires a password because of how we have it configured.

00:16:33.000 --> 00:16:34.000
All right.

00:16:34.000 --> 00:16:35.000
So, accountability is a big deal here.

00:16:35.000 --> 00:16:36.000
All right.

00:16:36.000 --> 00:16:38.000
So, this is not all that great.

00:16:38.000 --> 00:16:41.000
But it is an option, and therefore you could be tested on it.

00:16:41.000 --> 00:16:47.000
What is a better option we have locally so that way there we do have accountability

00:16:47.000 --> 00:16:49.000
when it's all said and done?

00:16:49.000 --> 00:16:53.000
We have what is called a local username and password database.

00:16:53.000 --> 00:16:54.000
That's what we have.

00:16:54.000 --> 00:16:59.000
So, for example, I can type in username Raymond, and then I can type in password,

00:16:59.000 --> 00:17:02.000
and let's give Raymond a password.

00:17:02.000 --> 00:17:08.000
Let's also, for example, do username Conrad and give Conrad a password of Cisco.

00:17:08.000 --> 00:17:09.000
Again, why?

00:17:09.000 --> 00:17:11.000
I don't want to forget.

00:17:11.000 --> 00:17:18.000
So, now if we look at the able to do show run pipe to section line, we'll see here,

00:17:18.000 --> 00:17:22.000
pardon me, pipe to section username.

00:17:22.000 --> 00:17:26.000
You'll see here that I have some passwords stored in the local username

00:17:26.000 --> 00:17:28.000
and password database.

00:17:29.000 --> 00:17:33.000
But if you think about the lines right now, the line says what?

00:17:33.000 --> 00:17:36.000
Password Cisco.

00:17:36.000 --> 00:17:41.000
Login, meaning use the line password.

00:17:41.000 --> 00:17:44.000
Login means use the line password.

00:17:44.000 --> 00:17:49.000
So, what I want to do now is I want to change this so that way there we use the

00:17:49.000 --> 00:17:51.000
username and password database.

00:17:51.000 --> 00:17:53.000
So, I'm going to type in line console zero.

00:17:53.000 --> 00:17:55.000
I'm going to type in login.

00:17:55.000 --> 00:17:56.000
Now you type in local.

00:17:56.000 --> 00:17:57.000
That's right.

00:17:57.000 --> 00:17:58.000
Login local.

00:17:58.000 --> 00:17:59.000
Thank you for that.

00:17:59.000 --> 00:18:02.000
So, now if we type in do show run pipe to section line,

00:18:02.000 --> 00:18:05.000
we'll see that we're now using the local username and password database.

00:18:05.000 --> 00:18:12.000
So, question is, which password is going to be used to log into the console port?

00:18:12.000 --> 00:18:14.000
What if that same question was presented now?

00:18:14.000 --> 00:18:16.000
Well, it's not going to be the line password anymore.

00:18:16.000 --> 00:18:18.000
It's not password Cisco.

00:18:18.000 --> 00:18:24.000
The answer you would have to pick would be a username and password from the local

00:18:24.000 --> 00:18:26.000
username and password database.

00:18:26.000 --> 00:18:27.000
Any one of them.

00:18:27.000 --> 00:18:28.000
Any one of them would apply.

00:18:28.000 --> 00:18:32.000
So, if I type in do show run pipe to section username now, right,

00:18:32.000 --> 00:18:33.000
any one of these would work.

00:18:33.000 --> 00:18:34.000
Any one of these.

00:18:34.000 --> 00:18:40.000
So, the answer is what are you going to use to log into the console port?

00:18:40.000 --> 00:18:42.000
You're going to use any local username and password from the local username

00:18:42.000 --> 00:18:45.000
and password database.

00:18:45.000 --> 00:18:48.000
So, let's test this now.

00:18:48.000 --> 00:18:53.000
If I type in exit and I hit enter, it's asking for a username now.

00:18:53.000 --> 00:18:55.000
So, I'm going to type in Raymond.

00:18:55.000 --> 00:19:02.000
I'm going to type in my password, and away we go.

00:19:02.000 --> 00:19:07.000
So, it's important that you recognize that even though this password is here,

00:19:07.000 --> 00:19:11.000
it's null, it's void, it doesn't matter.

00:19:11.000 --> 00:19:12.000
Why?

00:19:12.000 --> 00:19:14.000
Because it says log in local.

00:19:14.000 --> 00:19:15.000
That's why.

00:19:15.000 --> 00:19:20.000
So, password Cisco is just sitting there doing nothing in this circumstance.

00:19:20.000 --> 00:19:24.000
All right, let's go to our VTY lines.

00:19:24.000 --> 00:19:27.000
If we go to our VTY lines, let's modify those.

00:19:27.000 --> 00:19:33.000
We'll type in log in local as well.

00:19:33.000 --> 00:19:37.000
And we'll see here that log in local is now specified.

00:19:37.000 --> 00:19:41.000
So, if we go back to DSW1 and we try to telnet,

00:19:41.000 --> 00:19:44.000
you'll see now it's asking for a username where before it didn't.

00:19:44.000 --> 00:19:51.000
So, I'm going to use Conrad, type in Cisco, and there you go.

00:19:51.000 --> 00:19:54.000
So, the password of Cisco is not the one on the line I'm using.

00:19:54.000 --> 00:19:56.000
That's not the one I'm using, right?

00:19:56.000 --> 00:20:02.000
We're using the usernames and passwords that are in the database.

00:20:02.000 --> 00:20:05.000
Remember, I'm only using the password of Cisco here,

00:20:05.000 --> 00:20:08.000
so I don't forget what the password is and lock myself out

00:20:08.000 --> 00:20:11.000
or mess up all my demonstrations.

00:20:11.000 --> 00:20:15.000
So, don't use Cisco in the real world, ever.

00:20:15.000 --> 00:20:17.000
All right.

00:20:17.000 --> 00:20:20.000
Now, I want to talk about the different options we have

00:20:20.000 --> 00:20:23.000
for the username and password command.

00:20:23.000 --> 00:20:27.000
So, the username and password command right here is username in plain text

00:20:27.000 --> 00:20:30.000
and password in plain text.

00:20:30.000 --> 00:20:34.000
The problem with that is that if anybody gets a hold of my running configuration

00:20:34.000 --> 00:20:40.000
or my startup configuration, whether it's by grabbing it out of the device

00:20:40.000 --> 00:20:45.000
or sniffing information out of the wire as I'm connected to it via like a telnet session,

00:20:45.000 --> 00:20:46.000
which I shouldn't be, by the way.

00:20:46.000 --> 00:20:48.000
We should be using SSH.

00:20:48.000 --> 00:20:53.000
But the idea is we want to store these passwords in our local username

00:20:53.000 --> 00:20:58.000
and password database in a more safe and secure format.

00:20:58.000 --> 00:21:03.000
We want to hash our passwords in our database.

00:21:03.000 --> 00:21:06.000
So, when we're using the username and password database,

00:21:06.000 --> 00:21:10.000
this is the non-recommended way of doing it.

00:21:10.000 --> 00:21:13.000
You can see up here that this is hashed.

00:21:13.000 --> 00:21:16.000
This is the recommended way of doing it.

00:21:16.000 --> 00:21:25.000
So, the easiest way to do that is when you're creating your usernames,

00:21:25.000 --> 00:21:36.000
you type in secret instead, and then you type in your password.

00:21:36.000 --> 00:21:39.000
Let's spell username properly.

00:21:39.000 --> 00:21:45.000
And now when we look at the output of that, we'll see that because we used the word secret,

00:21:45.000 --> 00:21:48.000
this password is no longer stored as Cisco.

00:21:48.000 --> 00:21:50.000
It's stored like this.

00:21:50.000 --> 00:21:52.000
So, what we have here is a hash.

00:21:52.000 --> 00:21:57.000
This is the actual hash, and this is what we call a salted hash.

00:21:57.000 --> 00:22:02.000
So, what the device does is it took the password of Cisco

00:22:02.000 --> 00:22:08.000
and 5 is referring to what we call level 5 encryption on our device,

00:22:08.000 --> 00:22:10.000
but we're not actually encrypting.

00:22:10.000 --> 00:22:16.000
We're actually hashing using the MD5 hashing algorithm.

00:22:16.000 --> 00:22:25.000
So, the MD5 hashing algorithm combined with a salt, combined with the word Cisco,

00:22:25.000 --> 00:22:29.000
has given me this result of this.

00:22:29.000 --> 00:22:37.000
So, now if anybody steals my database, they're going to have to figure out what this hash is.

00:22:37.000 --> 00:22:40.000
And if you don't know anything about hashes, let me give you a little rundown.

00:22:40.000 --> 00:22:44.000
A hash is something that is non-reversible.

00:22:44.000 --> 00:22:45.000
That's right.

00:22:45.000 --> 00:22:47.000
Where encryption is reversible.

00:22:47.000 --> 00:22:50.000
If I encrypt, then that can be decrypted.

00:22:50.000 --> 00:22:53.000
But with hashing, it's not something that's reversible.

00:22:53.000 --> 00:22:58.000
So, when you generate a hash of something, there's no way for me to take this value

00:22:58.000 --> 00:23:02.000
and use hashing algorithms and, like, reverse engineer it.

00:23:02.000 --> 00:23:04.000
So, what do we typically do with it?

00:23:04.000 --> 00:23:11.000
We would have to have something like a database of words and all the respective hashes,

00:23:11.000 --> 00:23:17.000
because when you take something and you hash it, if you take that thing again and hash it,

00:23:17.000 --> 00:23:19.000
it's going to produce the same result.

00:23:19.000 --> 00:23:22.000
Take it again later on, a month later, hash it, produces the same result,

00:23:22.000 --> 00:23:24.000
as long as it's the exact same thing.

00:23:24.000 --> 00:23:29.000
So, no matter what, every time I take the word Cisco and hash it, I'm going to get the same result.

00:23:29.000 --> 00:23:33.000
If you take the word Cisco and hash it, you're going to get the same result as me.

00:23:33.000 --> 00:23:35.000
We're all going to get the same result.

00:23:35.000 --> 00:23:37.000
And so, that's why we have salting as well.

00:23:37.000 --> 00:23:43.000
So, salting adds randomization to that, making it a little bit more stronger, safer, secure.

00:23:43.000 --> 00:23:47.000
So, that way, if a cyber criminal does get their hands on this,

00:23:47.000 --> 00:23:52.000
then they have to use the same hashing algorithm, the same salt,

00:23:52.000 --> 00:23:55.000
and they would have to know the word in order to figure it out.

00:23:55.000 --> 00:24:00.000
Or, to try and reverse that, it's impossible because you can't.

00:24:00.000 --> 00:24:04.000
But having even a table now becomes difficult because now you need to have every word

00:24:04.000 --> 00:24:10.000
with every single possible salt in existence, called a rainbow table, in order to get the job done.

00:24:10.000 --> 00:24:16.000
So, it makes it really hard for cyber criminals to get the job done.

00:24:16.000 --> 00:24:28.000
So, we definitely want to use secret in order to hash our passwords in our local user and password database.

00:24:28.000 --> 00:24:33.000
By default, when you use secret, remember this, by default, when you use secret, it uses MD5.

00:24:33.000 --> 00:24:38.000
But we have the opportunity to use other hashing algorithms today.

00:24:38.000 --> 00:24:42.000
So, let's go ahead and create an account for Andrew.

00:24:42.000 --> 00:24:45.000
And you'll see that I'm going to type an algorithm type now.

00:24:45.000 --> 00:24:47.000
And you'll see MD5 is the first one listed.

00:24:47.000 --> 00:24:49.000
That's the default.

00:24:49.000 --> 00:24:53.000
So, just by typing in secret, it automatically uses MD5.

00:24:53.000 --> 00:25:00.000
I'm going to use one of the other ones here, like if we want to use SHA-256, using a PBKDF2 hashing algorithm.

00:25:00.000 --> 00:25:02.000
Then I type in secret now.

00:25:02.000 --> 00:25:04.000
And then I type in Cisco.

00:25:04.000 --> 00:25:13.000
We'll see that Andrew has a much, much, much, much stronger hash of the word Cisco than Casey does.

00:25:13.000 --> 00:25:21.000
So, notice how the MD5 hashing algorithm produces a hash this big, where SHA-256 produces a hash this big instead.

00:25:21.000 --> 00:25:29.000
And it also uses a much larger salt that you can see between the dollar signs.

00:25:29.000 --> 00:25:31.000
So, the salt ends there.

00:25:31.000 --> 00:25:33.000
That dollar sign, the salt all the way over.

00:25:33.000 --> 00:25:38.000
That's significantly larger than just four characters that we have for MD5.

00:25:38.000 --> 00:25:51.000
So, by using a stronger algorithm type, if somebody did capture the information about the hash, it would be nearly impossible for them to ever figure it out.

00:25:51.000 --> 00:26:00.000
Unless they try every single possible combination by hashing plain text words and trying to ultimately figure out, is it the exact same one?

00:26:00.000 --> 00:26:02.000
But now they would also have to use what?

00:26:02.000 --> 00:26:06.000
They would have to use the same salt as well to get the job done.

00:26:06.000 --> 00:26:09.000
And to figure that salt out might be very difficult for them.

00:26:09.000 --> 00:26:15.000
Now, if they get the hash plus the salt, it makes it a little bit easier for them because they know the salt in that case.

00:26:15.000 --> 00:26:21.000
But if they just get the hash, it's pretty much impossible now for them to ever figure out your password if they've captured your hash.

00:26:21.000 --> 00:26:29.000
That's why it's important to always store your passwords in a database using a hashing algorithm.

00:26:29.000 --> 00:26:32.000
So, store the hash, not the plain text.

00:26:32.000 --> 00:26:42.000
Because if the hash is what is stored and not the plain text, if anybody compromises your database and steals all your usernames and passwords, then what do they have?

00:26:42.000 --> 00:26:45.000
They have all the usernames and all the hash passwords.

00:26:45.000 --> 00:26:55.000
The thing about that is that now they're going to have to try every single possible combination and figure out what all those hashes are.

00:26:55.000 --> 00:27:07.000
So, if people are using strong passwords and you are using strong hashing algorithms for your database storage, then in the end it's going to be impossible for them to figure out the passwords.

00:27:07.000 --> 00:27:09.000
The weak passwords, they'll figure out.

00:27:09.000 --> 00:27:11.000
The strong passwords, they won't.

00:27:11.000 --> 00:27:17.000
So, a compromised database is not as severe if you do hashing.

00:27:17.000 --> 00:27:19.000
That's why it's important that we do this.

00:27:19.000 --> 00:27:23.000
The other option you'll see here was what?

00:27:23.000 --> 00:27:25.000
The other algorithm type.

00:27:25.000 --> 00:27:33.000
So, let's go ahead and type in username, algorithm type, and it was script.

00:27:33.000 --> 00:27:36.000
We'll type in secret, and we'll also put in Cisco.

00:27:36.000 --> 00:27:39.000
So, you'll see the difference between all of them here.

00:27:39.000 --> 00:27:44.000
So, script is called level 9 encryption, but it still hashes.

00:27:44.000 --> 00:27:49.000
SHA-256 is called level 8 encryption, but it hashes.

00:27:49.000 --> 00:27:53.000
And MD-5 is level 5 encryption, and it hashes.

00:27:56.000 --> 00:27:58.000
And then we have our plain text.

00:28:07.000 --> 00:28:14.000
Now, we don't want plain text passwords to be plain text in our operating system.

00:28:14.000 --> 00:28:17.000
It doesn't make sense to do so.

00:28:18.000 --> 00:28:26.000
So, number one is if you have plain text passwords, but there is the ability to hash,

00:28:26.000 --> 00:28:29.000
then you should be doing the hashing like you see here.

00:28:31.000 --> 00:28:39.000
But if you don't have the ability to hash, then you need to actually encrypt those passwords at a minimum.

00:28:39.000 --> 00:28:41.000
You can't leave them as plain text.

00:28:41.000 --> 00:28:43.000
So, we have an example of that.

00:28:43.000 --> 00:28:46.000
If you type in do, show, run, pipe to section, line, what are we going to see here?

00:28:46.000 --> 00:28:49.000
We're going to see that this is in plain text.

00:28:49.000 --> 00:28:52.000
This is in plain text.

00:28:52.000 --> 00:28:59.000
But there is no hashing option for those ones.

00:28:59.000 --> 00:29:01.000
So, I cannot hash.

00:29:01.000 --> 00:29:05.000
So, since there's no hashing option for them, we have to do encryption.

00:29:05.000 --> 00:29:15.000
So, how do we encrypt all plain text passwords that exist in our configuration, folks?

00:29:15.000 --> 00:29:21.000
And any future passwords we create, how can we do that?

00:29:23.000 --> 00:29:27.000
The command is service, password, encryption.

00:29:27.000 --> 00:29:28.000
Exactly.

00:29:28.000 --> 00:29:31.000
Service, password, encryption.

00:29:31.000 --> 00:29:40.000
So, by typing this in now, if we look at the output, you'll see that password is now encrypted with level seven encryption.

00:29:41.000 --> 00:29:46.000
And notice that encryption produces different results.

00:29:46.000 --> 00:29:47.000
You see that?

00:29:47.000 --> 00:29:51.000
Whereas hashing always produces the same result if you're not using salting.

00:29:51.000 --> 00:29:55.000
So, hashing would always produce the same result if you're not using salting.

00:29:55.000 --> 00:29:58.000
But encryption produces a different result every single time.

00:29:58.000 --> 00:30:02.000
And that's important, because don't forget, with encryption, we can also decrypt.

00:30:02.000 --> 00:30:04.000
We can encrypt and decrypt.

00:30:04.000 --> 00:30:08.000
So, the end result here is that we are actually really encrypting here.

00:30:08.000 --> 00:30:10.000
We are not just what?

00:30:10.000 --> 00:30:11.000
We are not just...

00:30:13.000 --> 00:30:14.000
We're not hashing.

00:30:14.000 --> 00:30:16.000
We are actually encrypting.

00:30:16.000 --> 00:30:29.000
So, this, though, is not all that valuable of a solution anymore.

00:30:31.000 --> 00:30:32.000
Why is that?

00:30:32.000 --> 00:30:45.000
The reason why is because these passwords can easily be compromised using web-based tools.

00:30:45.000 --> 00:30:47.000
Legit web-based tools.

00:30:47.000 --> 00:30:49.000
So, let's just show this.

00:30:49.000 --> 00:30:52.000
I'm going to go ahead and take this encryption.

00:30:52.000 --> 00:30:55.000
I'm going to copy it.

00:30:55.000 --> 00:30:57.000
I'm going to get it off this device here.

00:30:57.000 --> 00:30:58.000
So, I'm going to go here.

00:30:58.000 --> 00:30:59.000
I'm going to go here.

00:30:59.000 --> 00:31:00.000
I'm going to go here.

00:31:00.000 --> 00:31:03.000
Then I should be able to grab it now.

00:31:03.000 --> 00:31:05.000
And let's paste it in.

00:31:05.000 --> 00:31:07.000
And let's click reverse.

00:31:07.000 --> 00:31:08.000
And boom!

00:31:08.000 --> 00:31:09.000
There you go.

00:31:09.000 --> 00:31:10.000
That quick.

00:31:10.000 --> 00:31:11.000
A website was able to...

00:31:11.000 --> 00:31:13.000
Now you might say, okay, come on, Ryan.

00:31:13.000 --> 00:31:15.000
Use the word Cisco.

00:31:15.000 --> 00:31:17.000
Give me something with more substance.

00:31:17.000 --> 00:31:19.000
That's a very bad demonstration.

00:31:19.000 --> 00:31:20.000
Okay, fine.

00:31:20.000 --> 00:31:22.000
I'll give you something with more substance.

00:31:22.000 --> 00:31:24.000
So, let's do this instead.

00:31:24.000 --> 00:31:27.000
Let's go to line VTY 0 through 4.

00:31:28.000 --> 00:31:31.000
And let's put in a password of what?

00:31:31.000 --> 00:31:33.000
Let's just totally randomize it.

00:31:33.000 --> 00:31:34.000
Just totally random.

00:31:34.000 --> 00:31:35.000
Garbage nonsense.

00:31:35.000 --> 00:31:36.000
Let's do that.

00:31:42.000 --> 00:31:43.000
All right.

00:31:43.000 --> 00:31:45.000
So, hit enter.

00:31:47.000 --> 00:31:49.000
Oops, show run pipe to section line.

00:31:51.000 --> 00:31:53.000
Wow, it's a lot longer.

00:31:53.000 --> 00:31:56.000
Now, I'm pretty sure it's not going to get this one.

00:31:56.000 --> 00:32:00.000
It's going to get close, but I don't think it's going to get this one.

00:32:02.000 --> 00:32:04.000
Because there's dashes in there and other things.

00:32:04.000 --> 00:32:08.000
So, I'm pretty confident that it's not going to get this one.

00:32:10.000 --> 00:32:11.000
Right, and it didn't.

00:32:11.000 --> 00:32:12.000
Okay, but look.

00:32:12.000 --> 00:32:13.000
It was close.

00:32:13.000 --> 00:32:14.000
So, think about this.

00:32:14.000 --> 00:32:15.000
How many more characters?

00:32:15.000 --> 00:32:17.000
1, 2, 3, 4, 5, 6, 7.

00:32:17.000 --> 00:32:19.000
Okay, and this was only what?

00:32:19.000 --> 00:32:20.000
This is a website.

00:32:20.000 --> 00:32:24.000
Imagine if I had a tool locally installed on my supercomputer.

00:32:24.000 --> 00:32:26.000
I would figure it out then.

00:32:26.000 --> 00:32:27.000
I would figure it out.

00:32:29.000 --> 00:32:37.000
So, this is just to show you that although this is encryption, it is

00:32:44.000 --> 00:32:46.000
not all that great.

00:32:46.000 --> 00:32:49.000
But it's better than not doing it.

00:32:49.000 --> 00:32:51.000
It's better than not doing it.

00:32:52.000 --> 00:32:57.000
So, Cisco says you're better off to do this than leave those passwords in plain text.

00:32:57.000 --> 00:33:00.000
So, at least they are not easily readable.

00:33:00.000 --> 00:33:03.000
Now, back in the day, awesome.

00:33:03.000 --> 00:33:04.000
Awesome solution.

00:33:04.000 --> 00:33:05.000
Service password encryption, awesome solution.

00:33:05.000 --> 00:33:06.000
Why?

00:33:06.000 --> 00:33:10.000
Because if you were looking over my shoulder and you saw something like this, there's no way you can memorize that.

00:33:10.000 --> 00:33:11.000
Everybody agree with that?

00:33:11.000 --> 00:33:17.000
There's no way you can memorize that if you were looking over my shoulder or you saw my screen or anything like that.

00:33:17.000 --> 00:33:19.000
Or even captured it.

00:33:19.000 --> 00:33:26.000
The odds of you being able to decrypt that back in the day when service password encryption was invented was next to none.

00:33:26.000 --> 00:33:30.000
But today, you've already seen how easy it can be.

00:33:30.000 --> 00:33:33.000
And also, could I just do this?

00:33:33.000 --> 00:33:40.000
Snap picture behind you or pretend I'm on the phone as I'm walking behind you.

00:33:40.000 --> 00:33:47.000
So, it just goes to show that we as administrators, from a security standpoint, we need to apply the Jedi principle.

00:33:47.000 --> 00:33:49.000
That's right, the Jedi principle.

00:33:49.000 --> 00:33:50.000
What's the Jedi principle, folks?

00:33:50.000 --> 00:33:51.000
Does anybody know it?

00:33:51.000 --> 00:33:53.000
What's the Jedi principle?

00:33:53.000 --> 00:33:56.000
One of them anyways.

00:33:56.000 --> 00:34:03.000
Be mindful of your surroundings, young Padawan.

00:34:03.000 --> 00:34:06.000
That's what you want to apply in your security career.

00:34:07.000 --> 00:34:11.000
Use that as one of your security rules.

00:34:11.000 --> 00:34:13.000
Be mindful of your surroundings.

00:34:13.000 --> 00:34:20.000
So, never, ever display configs or anything like that where people can see them from behind you.

00:34:20.000 --> 00:34:23.000
And it might be nice to have that corner office.

00:34:23.000 --> 00:34:32.000
But if you're responsible for highly mission critical sensitive information and you are in a corner office and your monitor faces out the windows,

00:34:32.000 --> 00:34:38.000
meaning people outside could see, even if you're on the 50th floor of a building, if there's other buildings around you,

00:34:38.000 --> 00:34:42.000
could people look in from those buildings into your building and see what's?

00:34:42.000 --> 00:34:43.000
Yes.

00:34:43.000 --> 00:34:45.000
And you might think, no, the odds of that happening are next to none.

00:34:45.000 --> 00:34:47.000
All it takes is once.

00:34:47.000 --> 00:34:48.000
And you're compromised.

00:34:48.000 --> 00:34:50.000
That's all it's going to take.

00:34:50.000 --> 00:34:54.000
And if somebody is really after your company, after your business for whatever reason,

00:34:54.000 --> 00:35:00.000
they'll spend the time to set up shop next door and have a telescope, binoculars, and see what's going on

00:35:00.000 --> 00:35:02.000
and use that information against you.

00:35:02.000 --> 00:35:06.000
I know it's the stuff that's in movies, but it actually happens in real life.

00:35:06.000 --> 00:35:10.000
So, be mindful of your surroundings.

00:35:10.000 --> 00:35:12.000
And this is better than nothing today.

00:35:12.000 --> 00:35:16.000
I'm going to protect you from, though, the eavesdropper over your shoulders.

00:35:16.000 --> 00:35:21.000
It's been another building because they'll just use a tool and crack it after the fact.

00:35:21.000 --> 00:35:22.000
All right.

00:35:22.000 --> 00:35:23.000
But you know all about that.

00:35:23.000 --> 00:35:25.000
Now, I've got to teach you about the reverse of this.

00:35:26.000 --> 00:35:31.000
So, if I type in no service password encryption, what does that do?

00:35:31.000 --> 00:35:33.000
I want you to remember this.

00:35:33.000 --> 00:35:36.000
If I type in no service password encryption, what does it do?

00:35:36.000 --> 00:35:44.000
It ensures that going forward, no plain text passwords will be encrypted.

00:35:44.000 --> 00:35:45.000
That's it.

00:35:45.000 --> 00:35:49.000
It will ensure going forward, no plain text passwords will be encrypted.

00:35:49.000 --> 00:35:51.000
But does it decrypt?

00:35:51.000 --> 00:35:52.000
Does it decrypt?

00:35:52.000 --> 00:35:54.000
And the answer to that is no, it doesn't.

00:35:54.000 --> 00:35:55.000
You see that?

00:35:55.000 --> 00:35:56.000
It does not decrypt.

00:35:56.000 --> 00:35:57.000
They're still encrypted.

00:35:57.000 --> 00:36:05.000
So, service password encryption encrypts all plain text passwords and any future plain text password you create.

00:36:05.000 --> 00:36:12.000
But if you shut off the feature, then all it does is stop encrypting passwords going forward.

00:36:13.000 --> 00:36:21.000
So, now if I go to, for example, line VTY zero through four, and I type in password Cisco,

00:36:31.000 --> 00:36:34.000
you're going to see that now the password's in plain text.

00:36:34.000 --> 00:36:35.000
Why?

00:36:35.000 --> 00:36:37.000
Because I shut off service password encryption.

00:36:37.000 --> 00:36:40.000
And then I created a new password, so it's not going to encrypt that password.

00:36:41.000 --> 00:36:44.000
Because I told it, do not encrypt any more passwords going forward.

00:36:51.000 --> 00:36:54.000
There's a lot of little things you've got to remember here for the certification exam.

00:36:54.000 --> 00:36:56.000
Any one of these can show up.

00:36:56.000 --> 00:36:57.000
All right.

00:36:57.000 --> 00:36:59.000
So, now let's back out of here.

00:36:59.000 --> 00:37:01.000
Let's remind ourselves.

00:37:01.000 --> 00:37:02.000
Hit return to get started.

00:37:02.000 --> 00:37:04.000
Type in my username.

00:37:04.000 --> 00:37:06.000
Type in my password.

00:37:07.000 --> 00:37:09.000
We are in user exec mode right now.

00:37:09.000 --> 00:37:14.000
So, I have to type in enable to go from user exec mode to privilege exec mode.

00:37:14.000 --> 00:37:19.000
So, I just elevated my privileges without having to what?

00:37:21.000 --> 00:37:24.000
Verify that I'm allowed to use privilege level 15.

00:37:25.000 --> 00:37:29.000
So, we need to protect this command, the enable command.

00:37:30.000 --> 00:37:32.000
How do we protect the enable command?

00:37:32.000 --> 00:37:34.000
How do we protect the enable command?

00:37:34.000 --> 00:37:37.000
We can apply a password to the enable command.

00:37:37.000 --> 00:37:39.000
So, let's type in configure terminal.

00:37:39.000 --> 00:37:41.000
We'll type in enable password.

00:37:44.000 --> 00:37:47.000
And we'll type in a password of Cisco, just so I don't forget.

00:37:47.000 --> 00:37:50.000
Do show run pipe to section enable.

00:37:50.000 --> 00:37:53.000
And you'll see here that we have an enable password of Cisco.

00:37:53.000 --> 00:37:55.000
So, if we log out of here now.

00:37:58.000 --> 00:37:59.000
And we type in enable.

00:37:59.000 --> 00:38:02.000
You'll see that it asks me for a password now as well.

00:38:02.000 --> 00:38:04.000
To go into privilege exec mode.

00:38:04.000 --> 00:38:12.000
However, this is in plain text.

00:38:12.000 --> 00:38:15.000
So, what is one of the ways that we can protect this?

00:38:15.000 --> 00:38:17.000
Well, we could use service password encryption.

00:38:18.000 --> 00:38:19.000
That's one way.

00:38:19.000 --> 00:38:21.000
What's another way?

00:38:21.000 --> 00:38:23.000
Well, we do have the enable secret option.

00:38:23.000 --> 00:38:28.000
So, enable secret allows us to hash that particular password.

00:38:28.000 --> 00:38:30.000
Notice that it says, hey, hey, hey, hey.

00:38:31.000 --> 00:38:36.000
The password you chose here, Raymond, for hashing is the same as the one that's in plain text.

00:38:36.000 --> 00:38:38.000
We recommend that you do not do this.

00:38:38.000 --> 00:38:39.000
We'll let you do it, but we recommend you don't do it.

00:38:39.000 --> 00:38:40.000
Why?

00:38:40.000 --> 00:38:42.000
Well, if we type in do show run.

00:38:45.000 --> 00:38:49.000
You'll see that the plain text password is still there.

00:38:49.000 --> 00:38:53.000
So, when you use enable secret, it doesn't replace your enable password.

00:38:53.000 --> 00:38:56.000
Now, is the enable password being used?

00:38:56.000 --> 00:38:57.000
The answer is no.

00:38:57.000 --> 00:38:59.000
The enable secret is being used now.

00:39:00.000 --> 00:39:05.000
But the problem in this case is that if my enable password is Cisco and somebody captures it and they try it, it's going to work.

00:39:06.000 --> 00:39:09.000
So, you never want to have these two passwords the exact same.

00:39:09.000 --> 00:39:13.000
In reality, if you're going to use enable secret, don't even use enable password because it doesn't matter.

00:39:13.000 --> 00:39:14.000
Get rid of it.

00:39:14.000 --> 00:39:15.000
Delete it.

00:39:16.000 --> 00:39:17.000
Make sure it's out of here.

00:39:17.000 --> 00:39:19.000
So, this is using MD5.

00:39:19.000 --> 00:39:20.000
Remember that.

00:39:20.000 --> 00:39:21.000
MD5.

00:39:21.000 --> 00:39:22.000
That's what five means.

00:39:22.000 --> 00:39:23.000
Right?

00:39:23.000 --> 00:39:25.000
But what about maybe changing a different algorithm?

00:39:25.000 --> 00:39:26.000
So, algorithm type.

00:39:27.000 --> 00:39:29.000
In this case, let's go with SHA-256.

00:39:30.000 --> 00:39:31.000
Let's then type in secret.

00:39:32.000 --> 00:39:33.000
Let's then type in our password.

00:39:34.000 --> 00:39:37.000
And if you look, it actually replaces.

00:39:37.000 --> 00:39:39.000
It replaces enable secret.

00:39:39.000 --> 00:39:40.000
So, you can only have one enable secret.

00:39:41.000 --> 00:39:45.000
And now that I'm using algorithm with SHA-256, you'll see it says eight.

00:39:45.000 --> 00:39:47.000
And we have a much bigger hash for that.

00:39:56.000 --> 00:39:59.000
Now, the problem with the enable password is that everybody's going to have to share it.

00:40:00.000 --> 00:40:01.000
So, right now, how many users do I have?

00:40:01.000 --> 00:40:03.000
Do, show, run, type a section, user name.

00:40:08.000 --> 00:40:11.000
So, Raymond, Conrad, Casey, Andrew, Alan.

00:40:11.000 --> 00:40:18.000
If we're all going to be administering this device, then we all need to know the enable password, which is not good.

00:40:19.000 --> 00:40:20.000
Which is not good.

00:40:20.000 --> 00:40:25.000
Because if we all need to know the enable password, then that is one password that we're sharing amongst ourselves.

00:40:28.000 --> 00:40:36.000
So, is there a greater chance that Raymond, Conrad, Casey, Andrew, or Alan could accidentally leak the enable password?

00:40:36.000 --> 00:40:37.000
Possibly.

00:40:39.000 --> 00:40:44.000
What is the typical rule of thumb when it comes to passwords?

00:40:44.000 --> 00:40:46.000
Well, one, you don't want to share them.

00:40:47.000 --> 00:40:51.000
And two, if there's some type of shared password, we want to limit access to it.

00:40:53.000 --> 00:40:58.000
Or ensure that nobody can use it if there's a way to get around that.

00:40:59.000 --> 00:41:03.000
So, for example, Raymond, Conrad, Casey, Andrew, and Alan all need to know the enable password.

00:41:03.000 --> 00:41:05.000
If that's what we're going to choose to do, that's what we're going to have to do.

00:41:06.000 --> 00:41:19.000
But, we can force, with our usernames and passwords, the ability to automatically be put into privilege exec mode.

00:41:19.000 --> 00:41:29.000
So that way, for example, when Raymond logs in, Raymond will automatically end up in privilege exec mode and not have to know the enable password.

00:41:30.000 --> 00:41:39.000
So, we can do that by typing in username Raymond, then you type in privilege level, and say privilege level 15.

00:41:40.000 --> 00:41:46.000
Then you can type in the password that you want, or secret or algorithm type and all that fun stuff.

00:41:47.000 --> 00:41:52.000
Now, if we look at Raymond, we're going to see here that Raymond says privilege level 15.

00:41:52.000 --> 00:41:59.000
So, if we exit out of here, when Raymond logs in now, watch what happens.

00:41:59.000 --> 00:42:01.000
Pay attention to the prompts.

00:42:02.000 --> 00:42:05.000
You'll see Raymond's already in privilege exec mode now.

00:42:05.000 --> 00:42:08.000
Raymond does not have to provide the enable password.

00:42:13.000 --> 00:42:15.000
What does that mean for you now?

00:42:16.000 --> 00:42:18.000
What does that mean for you now?

00:42:18.000 --> 00:42:22.000
It means that you could, let's say I was the ultimate administrator.

00:42:22.000 --> 00:42:24.000
I'm the enterprise level of min.

00:42:25.000 --> 00:42:33.000
I could create the enable password, and we could store it in a safe somewhere.

00:42:34.000 --> 00:42:39.000
Let's say in a safe that finance has access to only.

00:42:40.000 --> 00:42:42.000
They're the only ones who know it.

00:42:42.000 --> 00:42:50.000
If anybody wants access to that enable password, they're going to have to ask a specific person in finance,

00:42:50.000 --> 00:42:53.000
or two people in finance to get it.

00:42:53.000 --> 00:42:56.000
We'll have to sign off on it, and let's say it's in a sealed envelope.

00:42:59.000 --> 00:43:05.000
In that way there, it's not something that anybody knows, except for one person, and it's in the safe.

00:43:05.000 --> 00:43:11.000
So, if anybody ever compromises the enable password, well, then they're going to have to sign off on it.

00:43:11.000 --> 00:43:15.000
If it's the password, well, then there's only one person that's accountable for it, and that would be me in that case.

00:43:15.000 --> 00:43:17.000
Nobody else is.

00:43:18.000 --> 00:43:20.000
So, if it ever gets out, how did it get out?

00:43:22.000 --> 00:43:27.000
So, if we turn around now, and we give everybody, Conrad, Casey, Andrew, Alan, privilege level 15,

00:43:27.000 --> 00:43:30.000
then none of them need to know the enable password,

00:43:30.000 --> 00:43:35.000
and the enable password would be essentially protecting us from what?

00:43:35.000 --> 00:43:40.000
Let's say a cyber criminal somehow gets themselves into user exec mode,

00:43:40.000 --> 00:43:46.000
either through the VTY lines, or through the console port, or maybe through the aux port.

00:43:47.000 --> 00:43:52.000
If they do happen to get themselves into user exec mode, then now they need to know the enable password,

00:43:52.000 --> 00:43:55.000
and the only person who knew it was Raymond,

00:43:55.000 --> 00:43:59.000
and Raymond created a really strong, ridiculous enable password,

00:43:59.000 --> 00:44:03.000
wrote it down, put it in an envelope, put it in the finance safe.

00:44:03.000 --> 00:44:09.000
Well, I didn't, finance did, and we actually have a process for signing it out if we ever need it,

00:44:09.000 --> 00:44:13.000
and then maybe our rule is if we ever use it, then we're going to have to change it.

00:44:13.000 --> 00:44:15.000
So, it's like a one-time use kind of thing.

00:44:15.000 --> 00:44:18.000
Every time you use it, you got to change it to something else,

00:44:19.000 --> 00:44:23.000
and then put it in the envelope, and put it away in the safe.

00:44:23.000 --> 00:44:26.000
So, just things to keep in mind.

00:44:26.000 --> 00:44:29.000
You're not going to be really tested on like that aspect,

00:44:29.000 --> 00:44:34.000
but you'll see here that by using Privilege Level 15, you can bypass the enable password,

00:44:34.000 --> 00:44:37.000
and that might actually be a good thing for your security requirements,

00:44:37.000 --> 00:44:40.000
so not everybody has to share that enable password.

00:44:51.000 --> 00:44:55.000
Now, let's go ahead and talk about Telnet versus SSH.

00:44:56.000 --> 00:45:02.000
So, right now, we have Telnet access to our device.

00:45:08.000 --> 00:45:09.000
We don't have SSH access.

00:45:09.000 --> 00:45:13.000
So, if I type in SSH, well, actually, do I?

00:45:15.000 --> 00:45:20.000
I probably do because SSH would be on by default on that device because of previous configs I've done before.

00:45:20.000 --> 00:45:21.000
So, yeah.

00:45:21.000 --> 00:45:23.000
So, SSH would be allowed automatically here right now.

00:45:23.000 --> 00:45:26.000
So, let me type in Raymond.

00:45:26.000 --> 00:45:27.000
Let's put in the IP.

00:45:27.000 --> 00:45:28.000
It should be anyways.

00:45:28.000 --> 00:45:29.000
Let's check this out.

00:45:30.000 --> 00:45:31.000
Yeah, it is.

00:45:31.000 --> 00:45:32.000
All right.

00:45:32.000 --> 00:45:36.000
So, let's just talk about how we can set this up because right now, it is working.

00:45:36.000 --> 00:45:46.000
It is functioning, but we need to know for the certification exam how we would actually set up an SSH connection on our device so that it can work.

00:45:46.000 --> 00:45:49.000
So, basically, turn R1 into an SSH server when it's all said and done,

00:45:49.000 --> 00:45:55.000
and the reason why it's already working right now is because of previous configs I've done in the past that are still installed on this particular device.

00:45:57.000 --> 00:45:59.000
But first and foremost, what's the difference between Telnet and SSH?

00:45:59.000 --> 00:46:03.000
Can anybody tell me what's the difference between Telnet and SSH besides port numbers?

00:46:04.000 --> 00:46:06.000
Telnet is port 23.

00:46:06.000 --> 00:46:07.000
SSH is port 22.

00:46:07.000 --> 00:46:08.000
Telnet is port 22.

00:46:12.000 --> 00:46:14.000
On-red says Telnet is clear text.

00:46:14.000 --> 00:46:21.000
Telnet is plain text versus SSH, which is encrypted, encrypted communications.

00:46:23.000 --> 00:46:25.000
And so, you can kind of see that here, right?

00:46:25.000 --> 00:46:28.000
When I did my Telnet session, it was pretty snappy, wasn't it?

00:46:28.000 --> 00:46:29.000
It was pretty snappy.

00:46:29.000 --> 00:46:30.000
Boom, we're in.

00:46:31.000 --> 00:46:32.000
No, I don't want to log in.

00:46:32.000 --> 00:46:33.000
Leave me alone.

00:46:35.000 --> 00:46:37.000
Ah, typed in the wrong password.

00:46:39.000 --> 00:46:40.000
All right, good.

00:46:40.000 --> 00:46:44.000
All right, but if you do SSH, you see it's taking a little bit longer.

00:46:44.000 --> 00:46:48.000
It's taking a little bit longer in order to have.

00:46:48.000 --> 00:46:51.000
I know it's, like, minuscule, but there is a slight bit of a delay.

00:46:51.000 --> 00:46:52.000
Why?

00:46:52.000 --> 00:46:57.000
Because of encryption, because of establishing that SSH connection.

00:46:57.000 --> 00:47:01.000
Encryption, because of establishing that SSH session with encryption.

00:47:02.000 --> 00:47:07.000
So, what are the things we need to be aware of for the certification exam?

00:47:07.000 --> 00:47:11.000
So, first of all, when we're setting up SSH for the certification exam,

00:47:11.000 --> 00:47:16.000
we are doing it with local cryptographic keys that are locally generated on our device.

00:47:16.000 --> 00:47:20.000
So, we're not using any type of keys that were generated outside of the device,

00:47:20.000 --> 00:47:23.000
like on a hardware security module and imported onto our device,

00:47:23.000 --> 00:47:25.000
and we're not setting it up so that way there.

00:47:25.000 --> 00:47:29.000
If we want to use security keys, you know, we're using certificates or anything like that.

00:47:29.000 --> 00:47:33.000
We are straight up using local cryptographic keys for SSH.

00:47:33.000 --> 00:47:35.000
So, that's what our coverage is going to be today.

00:47:36.000 --> 00:47:39.000
So, when it comes to somebody like R1, how do we accomplish that?

00:47:39.000 --> 00:47:41.000
Well, first and foremost, you need a hostname.

00:47:41.000 --> 00:47:44.000
And we have a hostname by default on our device.

00:47:44.000 --> 00:47:46.000
Our hostname by default is router.

00:47:46.000 --> 00:47:47.000
It always is.

00:47:47.000 --> 00:47:56.000
And so, whatever you change your hostname to is going to be used as part of the cryptographic key generation.

00:47:56.000 --> 00:47:59.000
So, something to keep in mind, that on the certification exam,

00:47:59.000 --> 00:48:03.000
if they're telling you you want your cryptographic keys to be named a certain way,

00:48:03.000 --> 00:48:05.000
well then, that is based on your hostname.

00:48:05.000 --> 00:48:10.000
So, your hostname would have to match what you want your cryptographic keys to be named.

00:48:10.000 --> 00:48:15.000
So, if you ever need to change the hostname, it would be hostname, and then you put in the hostname.

00:48:15.000 --> 00:48:16.000
So, let's do Han Solo today.

00:48:18.000 --> 00:48:20.000
So, Han Solo now is our hostname.

00:48:22.000 --> 00:48:29.000
What we also need to generate our own local cryptographic keys is a domain name.

00:48:29.000 --> 00:48:32.000
Now, when we talk about domain name here, it could be a registered domain name,

00:48:32.000 --> 00:48:36.000
but it doesn't have to be because we're generating local cryptographic keys.

00:48:36.000 --> 00:48:41.000
So, that domain name is not something that needs to be reachable, accessible, registered, or anything like that.

00:48:41.000 --> 00:48:47.000
So, it's about coming up with a domain name that is going to be used for just this particular process,

00:48:47.000 --> 00:48:50.000
and whether it's just for this device or a multitude of devices, it's up to you.

00:48:50.000 --> 00:48:56.000
So, you would type an IP domain name, and then you would specify your domain name.

00:48:56.000 --> 00:48:59.000
So, let's say the falcon.local.

00:48:59.000 --> 00:49:00.000
So, not something that is registered.

00:49:00.000 --> 00:49:04.000
It's just something we came up with in our organization that we are going to use

00:49:04.000 --> 00:49:07.000
for locally generating cryptographic keys for Han Solo.

00:49:08.000 --> 00:49:10.000
So, now we've got a combination of a hostname and a domain name.

00:49:10.000 --> 00:49:13.000
Now, what we can do is we can generate our cryptographic keys.

00:49:13.000 --> 00:49:19.000
So, the command for that is crypto key generate, and we're going to use RSA keys.

00:49:19.000 --> 00:49:22.000
There's other types of keys you can use, but in this case, we're going to use RSA.

00:49:22.000 --> 00:49:24.000
That's what you've got to know for this certification exam.

00:49:24.000 --> 00:49:26.000
And then you've got to specify the modulus.

00:49:26.000 --> 00:49:28.000
The modulus just means the size of the key.

00:49:28.000 --> 00:49:30.000
So, what's the size of our key?

00:49:30.000 --> 00:49:34.000
So, the recommendation nowadays is nothing lower than 2048,

00:49:35.000 --> 00:49:39.000
but if they tell you on the certification exam, whatever they tell you, that's what they want you to do.

00:49:39.000 --> 00:49:41.000
So, if they say 1,000, then put 1,000 in.

00:49:41.000 --> 00:49:43.000
Just do what they say.

00:49:43.000 --> 00:49:46.000
So, my hostname, my domain name, and then generating my keys.

00:49:46.000 --> 00:49:50.000
And these are going to be non-exportable keys, meaning that they're only for this particular device.

00:49:50.000 --> 00:49:57.000
So, I'm going to hit enter here, and you'll see that they're naming the key HanSolo.theFalcon.local.

00:49:57.000 --> 00:50:02.000
So, if, for example, like on the exam, they say you want your cryptographic keys to be named da-da-da-da-da-da-da-da,

00:50:03.000 --> 00:50:04.000
well, then just think about it.

00:50:04.000 --> 00:50:07.000
Whatever comes in before the first dot is going to be the hostname.

00:50:07.000 --> 00:50:09.000
Whatever comes after that is the domain name.

00:50:09.000 --> 00:50:10.000
So, that's all you want to configure.

00:50:10.000 --> 00:50:13.000
Just configure the hostname based on this first parameter,

00:50:13.000 --> 00:50:15.000
and then configure the rest of it as what?

00:50:15.000 --> 00:50:16.000
As the domain name.

00:50:16.000 --> 00:50:19.000
That's how you're going to accomplish that.

00:50:19.000 --> 00:50:21.000
And then generate your keys.

00:50:21.000 --> 00:50:26.000
And you'll see that we've got some non-exportable cryptographic keys that are 2048 bits.

00:50:26.000 --> 00:50:34.000
Now, what I want you to realize is that once you have one cryptographic key on your device, SSH is automatically enabled.

00:50:34.000 --> 00:50:37.000
That means you don't have to turn on SSH.

00:50:37.000 --> 00:50:39.000
SSH automatically gets turned on.

00:50:39.000 --> 00:50:45.000
Now, SSH was already turned on on my device because I had a cryptographic key from the last time I did a demonstration on this device.

00:50:48.000 --> 00:50:52.000
But if you did not have any cryptographic keys on your device and you generated this key,

00:50:52.000 --> 00:50:55.000
as soon as this was done, it would say SSH enabled.

00:50:55.000 --> 00:51:00.000
It would actually show a syslog message that says SSH is enabled.

00:51:00.000 --> 00:51:04.000
Because SSH would have been turned on automatically on your device.

00:51:04.000 --> 00:51:10.000
So, as soon as you have one cryptographic key on your device, SSH automatically gets turned on for you.

00:51:10.000 --> 00:51:14.000
Take off your cryptographic keys, SSH would be shut off on you.

00:51:14.000 --> 00:51:21.000
So, if I type in do show ip ssh, you'll see that SSH is now enabled with version 1.99.

00:51:21.000 --> 00:51:27.000
So, version 1.99 means version 1 and version 2.0.

00:51:27.000 --> 00:51:31.000
It's actually something like version 1.5 and version 2.0.

00:51:31.000 --> 00:51:34.000
So, that's what 1.99 means.

00:51:34.000 --> 00:51:42.000
Now, this particular device, if I type in ip ssh, you'll see there's a version option down at the bottom.

00:51:42.000 --> 00:51:48.000
This one only lets me do both or version 2 by itself.

00:51:48.000 --> 00:51:52.000
I cannot revert down to version number 1 on this particular device.

00:51:52.000 --> 00:51:58.000
But if you could, it would say ip ssh version 1 or version 2 or both when it's all said and done.

00:51:58.000 --> 00:52:08.000
So, now that I'm using ip ssh version 2, you'll see that it actually says version number 2.

00:52:08.000 --> 00:52:12.000
Let's say on the exam you look at this output and it said version 1.5.

00:52:12.000 --> 00:52:15.000
Version 1.5 would mean version 1.

00:52:15.000 --> 00:52:19.000
Version 1.99 is version 1 and 2 support.

00:52:19.000 --> 00:52:22.000
Version 2 means just version 2.

00:52:22.000 --> 00:52:23.000
I don't make up the numbering scheme.

00:52:23.000 --> 00:52:31.000
That's what it is.

00:52:31.000 --> 00:52:32.000
All right.

00:52:32.000 --> 00:52:38.000
So, with that in mind, now that we have it set up, we have our cryptographic keys generated.

00:52:38.000 --> 00:52:40.000
What else must be done?

00:52:40.000 --> 00:52:43.000
So, we have our host name, our domain name, our cryptographic keys.

00:52:43.000 --> 00:52:46.000
I turned on SSH version number 2.

00:52:46.000 --> 00:52:47.000
What else?

00:52:47.000 --> 00:52:51.000
Well, our VTY lines because that's how we use SSH, through the VTY lines.

00:52:51.000 --> 00:52:54.000
Do, show, run, pipe to section line.

00:52:54.000 --> 00:52:59.000
We're going to see here that we have log in local, which is what we need.

00:52:59.000 --> 00:53:02.000
So, you cannot use the line password.

00:53:02.000 --> 00:53:07.000
You need at a minimum a password stored in the local username and password database.

00:53:07.000 --> 00:53:14.000
The other option is a username and password stored on a RADIUS server or a TACACS plus server,

00:53:14.000 --> 00:53:17.000
which would require AAA to be set up on your device.

00:53:17.000 --> 00:53:20.000
But right now, we're just using our local username and password database.

00:53:20.000 --> 00:53:22.000
So, log in local.

00:53:22.000 --> 00:53:23.000
That's what it means.

00:53:23.000 --> 00:53:25.000
That's perfect for this scenario.

00:53:25.000 --> 00:53:33.000
And then let's not forget about transport input and SSH being specified.

00:53:33.000 --> 00:53:41.000
Because we have to have SSH in that list or SSH would not be allowed as a connection method.

00:53:41.000 --> 00:53:42.000
All right.

00:53:42.000 --> 00:53:45.000
So, now that we have that done, let's go back to DSW1.

00:53:45.000 --> 00:53:48.000
Let's try our SSH connection.

00:53:48.000 --> 00:53:52.000
And I put in my name, Raymond, and now I can go ahead and put in my password.

00:53:52.000 --> 00:53:58.000
And I'm now connected to Han Solo using SSH.

00:53:58.000 --> 00:54:02.000
So, now I have an encrypted connection between the two devices.

00:54:02.000 --> 00:54:11.000
Now, something I want you to consider as well is securing your VTY lines with an access control list.

00:54:11.000 --> 00:54:12.000
So, let's go ahead and do this.

00:54:12.000 --> 00:54:21.000
Let's go ahead and create an access list.

00:54:21.000 --> 00:54:23.000
Let's go ahead and create a standard access list.

00:54:23.000 --> 00:54:25.000
So, access list, let's say number five.

00:54:25.000 --> 00:54:29.000
We'll say deny.

00:54:29.000 --> 00:54:32.000
Let's specifically deny who?

00:54:32.000 --> 00:54:34.000
Let's deny DSW2.

00:54:34.000 --> 00:54:40.000
So, if we go to DSW1 right now, this is the command we've been using.

00:54:40.000 --> 00:54:58.000
Let's go over to DSW2 and enter that command to show you that we do have the ability to SSH in.

00:54:58.000 --> 00:54:59.000
Okay.

00:54:59.000 --> 00:55:01.000
So, that worked for us.

00:55:01.000 --> 00:55:07.000
But let's go ahead and deny this device based on its IP address.

00:55:07.000 --> 00:55:12.000
So, let's type in do show IP interface brief.

00:55:12.000 --> 00:55:19.000
And let's go ahead and deny, for example, connections from this, not this IP address, pardon me.

00:55:19.000 --> 00:55:22.000
We'll go with this IP address right here.

00:55:22.000 --> 00:55:29.000
So, back over to R1, deny host, ma'am.

00:55:29.000 --> 00:55:35.000
Access list, five, permit, any.

00:55:35.000 --> 00:55:42.000
Then let's go back to our VTY lines.

00:55:42.000 --> 00:55:45.000
And the command is access class.

00:55:45.000 --> 00:55:49.000
Then you specify the access control list you created.

00:55:49.000 --> 00:55:51.000
And then you specify the direction.

00:55:51.000 --> 00:56:03.000
So, when we're making inbound connections to the VTY lines, I want to deny this host but allow everybody else.

00:56:03.000 --> 00:56:04.000
So, let's give this a try.

00:56:04.000 --> 00:56:08.000
Let's go over to DSW2 now and try that SSH command again.

00:56:08.000 --> 00:56:11.000
And you'll see it says connection refused by remote host.

00:56:11.000 --> 00:56:19.000
But if we go over to DSW1, you'll see that everything still works perfectly fine because of the permission.

00:56:19.000 --> 00:56:23.000
They're permitted based on that access control list, whereas DSW2 is denied.

00:56:23.000 --> 00:56:28.000
So, keep that in mind for the exam, that if you look at the output of show run pipe to section line,

00:56:28.000 --> 00:56:31.000
and you're looking at that VTY line and you see something like this,

00:56:31.000 --> 00:56:38.000
it means there's an access control list applied to those VTY lines that are going to control either inbound

00:56:38.000 --> 00:56:42.000
or outbound Telnet or SSH connections, so remote access connections.

00:56:42.000 --> 00:56:51.000
So, do show run or do show access hyphen list five, and you'll see that there you go.

00:56:51.000 --> 00:56:57.000
So, little things to keep in mind at this CCNP level.

00:56:57.000 --> 00:56:58.000
All right.

00:56:58.000 --> 00:57:02.000
Let me just take a quick peek at my notes really quickly here to see.

00:57:02.000 --> 00:57:03.000
Okay.

00:57:03.000 --> 00:57:04.000
We covered that.

00:57:04.000 --> 00:57:05.000
It's all good.

00:57:05.000 --> 00:57:07.000
We've covered all of that.

00:57:07.000 --> 00:57:09.000
We've taken care of all of that.

00:57:10.000 --> 00:57:11.000
Okay.

00:57:11.000 --> 00:57:14.000
A few little things here that I've got to do on the side for you.

00:57:14.000 --> 00:57:18.000
Commands like logging synchronous and exec timeout.

00:57:18.000 --> 00:57:27.000
So, right now, you'll see that there is no timeout value listed here for the console port or the VTY lines.

00:57:27.000 --> 00:57:30.000
But is that true?

00:57:30.000 --> 00:57:32.000
No, that's not true.

00:57:32.000 --> 00:57:34.000
There is a default timeout of 10 minutes.

00:57:34.000 --> 00:57:40.000
So, if I type in show line console zero, you'll see there's a default timeout of 10 minutes.

00:57:40.000 --> 00:57:41.000
Did I say 10 seconds?

00:57:41.000 --> 00:57:43.000
I meant 10 minutes if I said 10 seconds.

00:57:43.000 --> 00:57:45.000
So, 10 minutes is your default timeout.

00:57:45.000 --> 00:57:47.000
Same thing with your VTY lines.

00:57:47.000 --> 00:57:52.000
So, if we look at VTY line zero specifically, you'll see there's a default timeout of 10 seconds.

00:57:52.000 --> 00:57:53.000
What about one?

00:57:53.000 --> 00:57:56.000
Default timeout of 10 seconds and so on and so forth.

00:57:56.000 --> 00:57:58.000
So, how do we change that?

00:57:58.000 --> 00:57:59.000
Configure terminal.

00:57:59.000 --> 00:58:04.000
Type in line console zero or the VTY lines, whichever one you want to do.

00:58:04.000 --> 00:58:06.000
And the command is exec timeout.

00:58:06.000 --> 00:58:08.000
Exec timeout.

00:58:08.000 --> 00:58:10.000
And then it's minutes that you specify.

00:58:10.000 --> 00:58:12.000
So, for example, just put zero minutes right now.

00:58:12.000 --> 00:58:16.000
And then the number of seconds for it to timeout.

00:58:16.000 --> 00:58:18.000
So, we'll go with five seconds.

00:58:18.000 --> 00:58:23.000
Five, four, three, two, one.

00:58:23.000 --> 00:58:25.000
There you go.

00:58:25.000 --> 00:58:26.000
That's all it does.

00:58:26.000 --> 00:58:31.000
So, any inactivity now, you'll be timed out after five seconds.

00:58:31.000 --> 00:58:34.000
So, what are you going to choose for your own environment?

00:58:34.000 --> 00:58:42.000
You're going to choose whatever makes the most sense for your environment.

00:58:42.000 --> 00:58:51.000
So, whatever your policies are that you have set up for timeouts,

00:58:51.000 --> 00:58:55.000
then you're going to want to make sure you apply those timeouts on your device.

00:58:55.000 --> 00:58:58.000
So, 00 is not something you're going to do in a production environment.

00:58:58.000 --> 00:59:00.000
00 is for what?

00:59:00.000 --> 00:59:03.000
It's for environments where you never want it to timeout.

00:59:03.000 --> 00:59:05.000
So, 00 means never timeout.

00:59:05.000 --> 00:59:09.000
So, half decent for a lab environment if it's something that you're allowed to do.

00:59:09.000 --> 00:59:13.000
But keep in mind that that would be a no-no in a production environment.

00:59:13.000 --> 00:59:24.000
But I'm going to leave it at 00 here so I don't get timed out.

00:59:24.000 --> 00:59:30.000
And lastly here, while I'm still in this discussion, let's go ahead and hit end.

00:59:30.000 --> 00:59:33.000
And I'm going to start typing.

00:59:33.000 --> 00:59:35.000
How many of you have this problem right now?

00:59:35.000 --> 00:59:40.000
I always ask this question because it amazes me how many people don't know this little feature exists.

00:59:40.000 --> 00:59:45.000
So, how many of you have this problem where when you type,

00:59:45.000 --> 00:59:53.000
and all of a sudden you have a syslog message that appears, you end up continuing to type here?

00:59:53.000 --> 01:00:01.000
Anybody have that issue right now on your device?

01:00:01.000 --> 01:00:03.000
Nobody this time around?

01:00:03.000 --> 01:00:04.000
Nobody?

01:00:04.000 --> 01:00:05.000
Nobody?

01:00:05.000 --> 01:00:06.000
Excellent.

01:00:06.000 --> 01:00:07.000
Okay.

01:00:07.000 --> 01:00:11.000
So, two ways to overcome this.

01:00:11.000 --> 01:00:16.000
Method number one is just hit the tab key.

01:00:16.000 --> 01:00:19.000
Just hit the tab key.

01:00:19.000 --> 01:00:20.000
That's it.

01:00:20.000 --> 01:00:25.000
I'm going to hit the tab key, and you'll see what it does is it builds a new prompt

01:00:25.000 --> 01:00:28.000
and retypes everything out for me.

01:00:28.000 --> 01:00:30.000
So, any time you hit the tab key, that's what it does.

01:00:30.000 --> 01:00:32.000
Build a new prompt, retype everything.

01:00:32.000 --> 01:00:34.000
Build a new prompt, retype everything.

01:00:34.000 --> 01:00:39.000
That's just hitting the tab key, T-A-B, tab.

01:00:39.000 --> 01:00:43.000
But there is a feature that you can turn on in your device.

01:00:43.000 --> 01:00:46.000
If I type in configure terminal, line console zero.

01:00:46.000 --> 01:00:48.000
This is true for the VTY lines as well.

01:00:48.000 --> 01:00:51.000
It's called logging synchronous.

01:00:51.000 --> 01:00:53.000
Logging synchronous.

01:00:53.000 --> 01:00:59.000
You turn this on, and it does it automatically for you.

01:00:59.000 --> 01:01:01.000
So, let me show you this now.

01:01:01.000 --> 01:01:08.000
I'm going to start typing, and you'll see it automatically, when the syslog message arrived,

01:01:08.000 --> 01:01:15.000
gave me a new prompt, rewrote everything I already had, and allowed me to continue typing.

01:01:16.000 --> 01:01:19.000
You never know when that shows up on an Encore exam.

01:01:19.000 --> 01:01:20.000
It could.

01:01:20.000 --> 01:01:22.000
I am not kidding.

01:01:22.000 --> 01:01:28.000
But I'm basically asking you, how do you resolve something like this situation here?

01:01:28.000 --> 01:01:31.000
I said tab key or logging synchronous.

01:01:33.000 --> 01:01:35.000
Keep that in mind.

01:01:41.000 --> 01:01:44.000
So, we've covered that, got that, got that out of the way.

01:01:44.000 --> 01:01:45.000
Looking good, folks.

01:01:45.000 --> 01:01:48.000
This is all notes I have to make sure we're ready.

01:02:15.000 --> 01:02:18.000
There's another command I want you to remember for the username.

01:02:18.000 --> 01:02:25.000
So, if you build a username, look at auto command.

01:02:25.000 --> 01:02:26.000
Read that.

01:02:26.000 --> 01:02:27.000
What does it say?

01:02:27.000 --> 01:02:31.000
Automatically issues a command after the user logs in.

01:02:33.000 --> 01:02:34.000
So, here's the thing.

01:02:34.000 --> 01:02:38.000
Any type of situation or scenario in the real world on the certification exam that says,

01:02:39.000 --> 01:02:44.000
you need to create a user account that, once logged in,

01:02:44.000 --> 01:02:49.000
it automatically executes a command and then logs that user out.

01:02:49.000 --> 01:02:50.000
Meaning that's all it can do.

01:02:50.000 --> 01:02:52.000
It can't do anything else.

01:02:55.000 --> 01:03:01.000
Then you create the username with the auto command option.

01:03:01.000 --> 01:03:05.000
And therefore, if you connect with that username, you type in the username,

01:03:05.000 --> 01:03:07.000
if you connect with that username, you type in the username,

01:03:07.000 --> 01:03:10.000
you type in the password, then that command gets executed,

01:03:10.000 --> 01:03:12.000
then you get kicked out, and you get just the results,

01:03:12.000 --> 01:03:14.000
and you can't do anything else.

01:03:19.000 --> 01:03:21.000
Just in case you need to know that.

01:03:21.000 --> 01:03:22.000
That's why I'm bringing it up.

01:03:26.000 --> 01:03:27.000
All right.

01:03:27.000 --> 01:03:29.000
As you can see, there's a lot of other things that we're not going to cover

01:03:29.000 --> 01:03:32.000
that go along with usernames as well.

01:03:32.000 --> 01:03:35.000
But I'm just trying to stick to things that are possibly on the exam.

01:03:41.000 --> 01:03:42.000
All right.

01:03:42.000 --> 01:03:43.000
Notes are good.

01:03:43.000 --> 01:03:44.000
Notes are good.

01:03:44.000 --> 01:03:46.000
We covered Enable Secrets, No Service Password Encryption,

01:03:46.000 --> 01:03:48.000
Service Password Encryption.

01:03:48.000 --> 01:03:50.000
We nailed that stuff.

01:03:50.000 --> 01:03:51.000
Telnet versus SSH.

01:03:51.000 --> 01:03:54.000
We've got that covered.

01:03:54.000 --> 01:03:55.000
Let's see here.

01:03:55.000 --> 01:03:59.000
Access Class for SSH or just your VTY lines.

01:03:59.000 --> 01:04:01.000
That is, we've got you covered there too.

01:04:02.000 --> 01:04:03.000
And there we go, folks.

01:04:03.000 --> 01:04:06.000
That is the end of this discussion.

01:04:06.000 --> 01:04:09.000
So, so far, I've covered everything I wanted to cover in that particular

01:04:09.000 --> 01:04:14.000
section of the course to get you ready for the certification exam.

01:04:14.000 --> 01:04:16.000
As you can see, there was a lot that we covered there.

01:04:16.000 --> 01:04:18.000
But it was all about what?

01:04:18.000 --> 01:04:22.000
Device access and authentication from what perspective?

01:04:22.000 --> 01:04:26.000
Using the lines, using the local username and password database.

01:04:26.000 --> 01:04:30.000
We didn't do anything AAA in that discussion.

01:04:30.000 --> 01:04:32.000
So, what does that mean?

01:04:32.000 --> 01:04:36.000
It means that our next discussion is going to be about AAA

01:04:36.000 --> 01:04:41.000
and how we can use that for our authentication and device access.