Hands-On Labs 211

Hands-On Labs

This section will have you configure a Cisco 2600 router with IOS Firewall Authentication Proxy and IDS. If you don’t have a Cisco router, please check www.routersim.com for a SECUR router simulator.

The labs covered in this chapter include

Lab 6.1: Enabling the IOS Firewall Authentication Proxy

This lab will review the basic commands to set up the IOS Firewall Authentication Proxy. Please note that this lab assumes that you have the Secure ACS configured at 10.1.1.2 as outlined in the text.

1.Connect to your router and press Enter.

2.Type the command enable.

3.Type the following to enable the IOS firewall authentication proxy:

Lab_B#conf t

Lab_B(config)#aaa new-model

Lab_B(config)#aaa authentication login default group tacacs+

Lab_B(config)#aaa authorization auth-proxy default group tacacs+

Lab_B(config)#tacacs-server host 10.1.1.2

Lab_B(config)#tacacs-server key test

Lab_B(config)#access-list 155 permit tcp host 10.1.1.2 eq tacacs host

10.1.1.1

Lab_B(config)#access-list 155 deny ip any any

Lab_B(config)#ip http server

Lab_B(config)#ip http authentication aaa

Lab_B(config)#ip auth-proxy name aptest http

Lab_B(config)#int fast0/0

Lab_B(config-if)#ip access-group 155 in

Lab_B(config-if)#ip auth-proxy aptest

Lab_B(config-if)#^Z

Lab_B#

212 Chapter 6 Cisco IOS Firewall Authentication and Intrusion Detection

Lab 6.2: Enabling the IOS Firewall IDS

This lab will have you configure the IOS Firewall IDS. This lab assumes you have a Syslog server configured at 10.1.1.3.

1.Connect to your router and press Enter.

2.Type the command enable.

3.Type the following to enable the IOS firewall IDS:

Lab_B#conf t

Lab_B(config)#ip audit notify log

Lab_B(config)#logging 10.1.1.3

Lab_B(config)#ip audit info action alarm

Lab_B(config)#ip audit attack action alarm drop reset

Lab_B(config)#ip audit name idstest info action alarm

Lab_B(config)#ip audit name idstest attack action alarm drop reset

Lab_B(config)#ip audit po protected 10.1.1.1 to 10.255.255.255

Lab_B(config)#int fast0/1

Lab_B(config-if)#ip audit idstest in

Lab_B(config-if)#^Z

Lab_B#