The next few posts will be a series about the setup of a Cisco 800 Series router as a home router. I will detail everything from setting up the interfaces, users, DNS, DHCP, SSH, NAT and more.
Below is a diagram that illustrates the network layout for this series of posts.
- Lab Network - 10.0.1.0/24
- Test Network - 10.0.2.0/24
Part 1 - Initial ConfigurationIn this part I will configure my ports and apply some security to the router.
I name the router, apply an enable password and create a banner.
Router#configure terminalRouter(config)#hostname Router1Router1(config)#enable secret cisco123Router1(config)#banner motd % No Unauthorised Access %I create a local user.
Router1(config)#username bob secret cisco123Router1(config)#aaa new-modelRouter1(config)#aaa authentication login local_auth localI set the domain, create SSH keys and apply some SSH settings.
Router1(config)#ip domain-name walliford.local Router1(config)#crypto key generate rsa general-keys modulus 1024The name for the keys will be: Router1.walliford.local% The key modulus size is 1024 bits% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]Router1(config)#ip ssh time-out 120Router1(config)#ip ssh version 2Router1(config)#ip ssh authentication-retries 2I create an ACL which I will be applying to my telnet ports
Router1(config)#ip access-list standard ADMIN_ACCESSRouter1(config-std-nacl)#permit 10.0.1.0 0.0.0.255 logRouter1(config-std-nacl)#deny any logRouter1(config-std-nacl)#exitI configure the console port to use the local user account and apply some timeout values.
Router1(config)#line console 0Router1(config-line)#logging synchronousRouter1(config-line)#login authentication local_authRouter1(config-line)#exec-timeout 30 0Router1(config-line)#exitI apply several settings to the Aux port so it cannot be used.
Router1(config)#line aux 0Router1(config-line)#no passwordRouter1(config-line)#no execRouter1(config-line)#exec-timeout 0 0Router1(config-line)#transport input noneRouter1(config-line)#exitI configure my telnet ports to use SSH and telnet only and the local user account. I apply some timeout values and apply the ACL so only hosts from the Lab network can access the router.
Router1(config)#line vty 0 4Router1(config-line)#logging synchronousRouter1(config-line)#login authentication local_authRouter1(config-line)#transport input ssh telnet Router1(config-line)#exec-timeout 30 0Router1(config-line)#access-class ADMIN_ACCESS inRouter1(config-line)#endI prevent 3 of the 5 telnet ports from being used.
Router1(config)#line vty 2 4 Router1(config-line)#transport input noneRouter1(config-line)#exitI set the clock, timezone and daylight saving settings.
Router1(config)#clock timezone GMT 0Router1(config)#clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00Router1(config)#endRouter1#clock set 21:24:00 12 May 2010I apply timeout values to login attempts to prevent brute-force attacks.
Router1(config)#login block-for 20 attempts 3 within 20Router1(config)#login delay 2
