Lab Configuring the PIX Firewall as a DHCP Server

Transcription

1 Lab Configuring the PIX Firewall as a DHCP Server Objective Scenario Estimated Time: 15 minutes Number of Team Members: Two teams with four students per team. In this lab, students will learn the following objectives: Define a DHCP address pool Define a DHCP domain name Verify DHCP settings on a PIX Firewall Verify DHCP on a PC Dynamic Host Configuration Protocol (DHCP) is a method of automatically assigning a TCP/IP address from a pool of addresses to a requesting client. DHCP eliminates the need to manually assign static IP addresses. Implementing DHCP client and server features in the PIX significantly eases deployment into cable and digital subscriber line (DSL) broadband environments, where static IP addresses can be costly and cumbersome to maintain. A PIX Firewall can provide DHCP services for hosts located on the trusted network, allowing it to automatically assign IP addresses to machines that are configured for dynamic addressing. A DHCP server is simply a computer that provides configuration parameters to a DHCP client. A DHCP client is a computer or network device that uses DHCP to obtain network configuration parameters. Note: Version 5.2 or higher, the PIX Firewall DHCP server daemon can only be enabled on the inside interface, and does not support clients that are not directly connected to the inside interface. 1-6 Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.

2 Topology This figure illustrates the lab network environment. Preparation Verify the standard PIX configuration on the pod firewall and test the connectivity. Access the PIX console port using the terminal emulator on the student PC. If desired, save the configuration to a text file for later analysis. Refer back to the Student Lab Orientation if more help is needed. Tools and Resources In order to complete the lab, the standard lab topology is required: Two pod PIX Firewalls Two student PCs One SuperServer Additional materials Backbone switch and one backbone router Two console cables and HyperTerminal Further information about the objectives covered in this lab can be found at, 6a html 2-6 Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.

3 Command list In this lab exercise, the following commands will be used. Refer to this list if assistance or help is needed during the lab exercise. Command dhcpd address ip1[-ip2] [if_name] dhcpd domain domain_name dhcpd lease lease_length show dhcpd [binding statistics] Description This command defines the IP pool address range. The size of the pool is limited to 32 addresses with a 10- user license and 128 addresses with a 50-user license on the PIX 501. All other PIX Firewall platforms support 256 addresses. This command defines the DNS domain name. For example, example.com. This command defines the length of the lease, in seconds, granted to DHCP client from the DHCP server. The lease indicates how long the client can use the assigned IP address. The default is 3600 seconds. The minimum lease length is 300 seconds, and the maximum lease length is 2,147,483,647 seconds. Displays the binding and statistics information associated with the dhcpd commands. Step 1 Verify the PIX Firewall Inside IP Address Complete the following steps to verify the PIX Firewall inside IP address: a. Display the currently configured IP addresses: PixP(config)# show ip address b. Ensure that the IP address on the inside interface is 10.0.P.1. c. Establish a connection to the web server at by completing the following substeps: d. Open a web browser on the student PC. e. Use the web browser to access the web server by entering Step 2 Configure the PIX Firewall DHCP Server Feature Complete the following steps to configure the PIX Firewall DHCP server feature: a. In order to configure the PIX as a DHCP server, the inside interface is required to be configured with an IP address. This IP address is required to be on the same subnet as the pool of dynamically assigned DHCP addresses. To configure the DHCP address pool use the dhcpd address command in the Global Configuration mode. The PIX Firewall will assign the client one of the addresses from this pool to use for a given length of time. The default is the inside interface. Specify a range of addresses for the DHCP server to distribute: PixP (config)# dhcpd address 10.0.P P.60 inside 3-6 Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.

4 b. Specify the IP address of the Domain Name System (DNS) server the client will use: PixP (config)# dhcpd dns 10.0.P What is the maximum number of DNS servers that can be entered? c. Specify the IP address of the WINS server the client will use: PixP (config)# dhcpd wins 10.0.P.76 d. Specify the lease length to be granted to the client. This lease equals the amount of time in seconds the client can use its allocated IP address before the lease expires. To configure the DHCP lease length use the dhcpd lease (lease length) command. The default value is 3600 seconds. e. Specify the lease length to grant the client as 3000: PixP (config)# dhcpd lease 3000 f. Configure the domain name the client will use: PixP (config)# dhcpd domain cisco.com g. Enable the DHCP daemon within the PIX Firewall to listen for DHCP client requests on the enabled interface: PixP (config)# dhcpd enable inside h. Display the DHCP configuration and binding: PixP (config)# show dhcpd dhcpd address 10.0.P P.60 inside dhcpd dns 10.0.P.75 dhcpd wins 10.0.P.76 dhcpd lease 3000 dhcpd ping_timeout 750 dhcpd domain cisco.com dhcpd enable inside i. Save the DHCP configuration: PixP (config)# write memory Step 3 Test the PIX Firewall DHCP Server Feature Complete the following steps to test the PIX Firewall DHCP server feature: a. Reconfigure the student PC to obtain IP and DNS addresses from a DHCP server. b. Open a Windows 2000 command prompt, and release and renew the IP address: C:\> ipconfig /release C:\> ipconfig /renew 4-6 Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.

5 c. Verify that the PIX Firewall assigned an IP address, subnet mask, DNS address, WINS address, and domain name to the student PC by opening a Windows 2000 command prompt and viewing the IP configuration: C:\> ipconfig /all 2. Fill in the information below: Connection-specific DNS suffix IP Address Subnet Mask Default Gateway If you are not using Windows 2000, please ask your instructor for the commands and instructions to check the DHCP configurations. d. Establish a connection to the web server at by completing the following substeps: e. From the Student PC, ping f. Open a web browser and access the web server by entering Step 4 Disable the DHCP on the Student PC Complete the following steps to reset the student PC: a. Disable DHCP on the student PC. Manually enter the following parameters: IP Address P.11 Subnet Mask Default Gateway P.1 b. Restart the computer. c. Log back into the computer. d. At a command prompt, verify that the configuration supplied by the PIX Firewall DHCP server has been removed, and that the following IP configuration exists on the student PC: C:\> ipconfig /all Hostname - StudentPCP DNS Server -(blank) DHCP Enabled -no IP Address P.11 Subnet Mask Default Gateway P Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.

6 Step 5 Disable the PIX Firewall DHCP Server Feature Complete the following steps to disable the PIX Firewall DHCP server feature: a. Clear all dhcpd commands, binding, and statistics information: PixP (config)# clear dhcpd b. Verify that the DHCP feature has been disabled: PixP (config)# show dhcpd c. Save the current configuration: PixP(config)# write memory 6-6 Fundamentals of Network Security v Lab Copyright 2003, Cisco Systems, Inc.