TU ACCESS GUIDE. Cisco 360 CCIE Troubleshooting Lab Front End Remote Access Guide

Transcription

1 TU ACCESS GUIDE Cisco 360 CCIE Troubleshooting Lab Front End Remote Access Guide

2 Table of Contents Cisco 360 CCIE Troubleshooting Lab Front End Remote Access Guide... 1 Table of Contents... 2 Establishing a VPN Connection... 3 Method 1: Cisco AnyConnect VPN Client setup... 3 Method 2: Cisco IPSec VPN Client setup... 5 VPN Connection Test Run... 6 VPN Troubleshooting FAQ... 7 GUI Front End Lab Access... 9 Recommended PC Software and desktop setup... 9 Authentication Screen... 9 Lab Navigation Router-Telnet Association Incidents Panel Firefox configuration to prevent opening an empty tab POD Management Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

3 Establishing a VPN Connection The 360 virtual pods are accessible using a VPN client. You may use any VPN client supported by Cisco routers. Instructions below provide two methods for setting up secured VPN connection. One method provides overview of automated installation of Cisco AnyConnect VPN client. Another method uses manual installation of standalone Cisco IPSec VPN Client software package. Your registration includes the access instructions for your reservation. This information should look similar to: VPN Router IP Address VPN Group Name VPN Group Password VPN Username VPN Password 360TU cisco360 V-POD# FOR EXAMPLE ONLY Method 1: Cisco AnyConnect VPN Client setup The AnyConnect client supports Windows Vista, Windows XP and Windows 2000, Mac OS X (Version 10.4 or later) on either Intel or PowerPC, and Red Hat Linux (Version 9 or later). To connect to the pod, navigate your browser to the VPN Router IP address: You can get Untrusted Connection or Security certificate problems warning message. Accept the warning and safely continue to the website. For the Firefox browser, Add and confirm security exception Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 3

4 Once the browser connects to the VPN web interface the logon screen will display. Enter VPN Username and VPN Password in the provided fields and click on Logon button. If credentials are accepted, and the security appliance identifies your workstation as requiring the client, it loads the client that matches the operating system of your PC. In order to properly download and install the plug-in, be sure to click Yes on the Java security pop-up message: Answer Yes on another Certificated Issuer related Security Alert message: 4 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

5 After loading, the client installs and configures itself, establishing a secured SSL VPN connection. Method 2: Cisco IPSec VPN Client setup The Cisco IPSec VPN client supports Windows Vista, Windows XP and Windows 2000, Mac OS X. Download Cisco VPN client version for your operating system from Cisco 360 Learning portal (System: Profile->Downloads). Install the package and reload the workstation. To connect to the pod, create a new VPN client entry: Initiate the VPN connection by double-clicking on the 360TU connection entry and authenticate the VPN tunnel with provided credentials: Verify the VPN tunnel communication by pinging IP address 10.1.N.100, where N is the number of the server from the HTML file attachment in the TU lab instructions Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 5

6 VPN Connection Test Run Some sites do not allow VPN connection through firewall to the outside world. It is advised to verify Cisco AnyConnect or IPSec VPN tunnel setup and communication over the tunnel prior to the scheduled lab session. It will help identify local network security issues and resolve them if possible. Use the following information to configure the VPN client and establish the test run tunnel: VPN Router IP Address VPN Group Name VPN Group Password VPN Username VPN Password 360TU cisco360 V-POD199 cisco360 Verify obtained IPv4 address from /24 network with command prompt ipconfig command: Verify the VPN tunnel communication by pinging IP address : If the ping is successful then your test site supports IPSec VPN tunnel. If the ping is not successful then you need to troubleshoot your network setup. Verify web communication and Adobe Flash player plugin for Firefox: open Firefox browser, navigate the following URL: You should see Session Authentication window. Do not attempt to authenticate GUI interface at this point. Reference to GUI Front End Lab Access section of this document for more information about suggested set of applications. Disconnect your VPN session. 6 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

7 VPN Troubleshooting FAQ What level of rights is required for the AnyConnect VPN Client? For the first installation, you need administrative privileges. However, subsequent upgrades do not require the admin level privilege. Is a reboot required after AnyConnect is installed or upgraded? No. Unlike the IPSec VPN Client, a reboot is not required after an AnyConnect installation or upgrade. Does AnyConnect require Java and permissions? The AnyConnect VPN Client requires either ActiveX or Java to use the web-based connection/install. For ActiveX, the user needs to have permission to install into their web browser (or it can be preinstalled). If ActiveX is not supported or used, Java is attempted. The version can be 1.4.x or 1.5. The Java implementation is an applet and is browser-based: On the first connection, the ActiveX/Java is used to install the AnyConnect VPN Client software. This initial connection requires admin rights. Subsequent connections do not require admin rights (even for client upgrades). What is Cisco official AnyConnect VPN Client FAQ page? I do not have IPSec VPN client software. Where can I download a VPN client supported by Cisco routers? Cisco VPN client can be downloaded from Cisco 360 Learning portal (System: Profile->Downloads). Note Mac OS users must install Cisco VPN client. Native Mac OS IPSec client is not going to work! 2012 Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 7

8 I see the VPN Authentication screen, but my credentials are rejected. Why can I not login? If you see the authentication screen, it means your PC is able to communicate with the Pod. User credentials are activated 10 minutes prior to the scheduled lab time. This is done to prevent two students from accessing a pod at the same time. If you are trying to login during scheduled lab session and your credentials are rejected, please review the scheduling to verify you are accessing the correct pod and are using the correct credentials. If you have verified the starting time and credentials, and still cannot authenticate, reply to the lab instructions that you have received. When trying to establish the IPSec VPN session, I receive this error message: Why can I not connect using IPSec VPN client? This message indicates that your PC is not able to communicate with the Pod. The most common cause of this issue is a firewall or ACL that is blocking IPSec from your network. Authentication Headers (AH) and Encapsulating Security Payloads (ESP) protocols along with UDP 500 and UDP 4500 ports must be open for outbound traffic. Verify that your network security policy allows VPN sessions through firewall to the outside world. After you have verified that you are able to establish outbound VPN sessions, please reboot your PC. If you continue to have issues, please send an to 360-ciers-laboperations@external.cisco.com. Please include the V-POD # you were assigned and the start time for your scheduled lab. Also include screen captures showing your VPN configuration. Note Cisco office employees must use GuestNet to establish an outbound VPN Session. Refer to IT Policy for more information on GuestNet. Cisco TRC blocks outbound IPSec, so if you are doing the lab from a Cisco office you need to do it from GuestNet. You can create a GuestNet account for yourself by going to 8 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

9 GUI Front End Lab Access Recommended PC Software and desktop setup It is your responsibility to create an environment for GUI Front End. Cisco360 does not provide technical support for it. If you have difficulties with graphical front end interface, please use the lab PDF document and telnet access instructions provided in the to connect to equipment. Links to the recommended software are located in your Cisco 360 Learning portal (System: Profile->Downloads) Note Install Adobe Flash Player from Mozilla Firefox browser. It will automatically detect the right version. Authentication Screen Navigate to webpage, where N is the number of the server from the HTML file attachment in the TU lab instructions . Use Session Authentication dialog to log into the lab delivery portal Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 9

10 Enter POD name and Password as per access instructions (same as VPN username and VPN password). Lab Navigation Only the main diagram Lab IP Addressing and IGP Topology provides clickable router-telnet associations. The dashboard will be loaded and present the navigation bar on the left and workspace with the lab diagram on the right. The top line of the dashboard has the information about the candidate, the lab and the time left until the end of session. The navigation bar consists of three sections: 1) enumerated incidents, 2) lab objectives, instructions and rules, 3) lab diagrams. 10 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

11 Note Note Note All question and diagram windows are moveable, resizable and could be minimized and closed. Main network diagram could not be closed. To move the window - drag it by the title. If the full diagram does not fit in the provided window, it can be dragged by mouse. With the left mouse button down, use gesture action to shift the document naturally in any direction. If the size of the window with network diagram is smaller than provided browser window, it can be resized by mouse. Click on the bottom-right corner of the diagram window and move the mouse. Interactive Help in different places gives you the tips to enhance your learning experience and helps navigate the page Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 11

12 Router-Telnet Association Hover the mouse cursor over the device on the main diagram. The context help will indicate telnet IP address and port. Configure Firefox browser to start telnet application when telnet:// URL is called. Make association with your preferred telnet client (PuTTY). Note Do not associate telnet application with Windows Command Prompt utility. Its terminal emulation incorrectly handles some of the router special commands (like, ---More---) which results in partial show command output. Issue terminal length 0 command in the router enable mode to force full show command output on the console without breaks. 12 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

13 When Firefox is configured to launch telnet application on telnet:// URLs, clicking on the router will automatically open telnet session to it. Telnet session can also be opened from the right click menu for each router (see POD Management section). Incidents Panel Select an incident and click on Incident details to see full description of the question. A full description of the incident will open in a separate window on the workspace. Question can be marked to keep track of completed issues. Marking will not close the question and is just for information. It will not trigger any process. Question can be unmarked at any moment as needed. The diagram for each incident highlights the area of the troubleshooting interest to help identify the area of the problem Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 13

14 Pay particular attention to Restriction and Goals section of the lab. The list of restrictions creates a certain environment that guides toward problem solving solution. The lab diagrams are located under last section of the menu. Click on the diagram details to open diagram in a separate window. 14 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.

15 Firefox configuration to prevent opening an empty tab Default configuration of the Firefox browser has such behavior that when telnet session is initiated from the diagram by mouse click, new empty tab is created in the browser window. To prevent opening an empty tab, change the default setting of your Firefox browser using the following procedure: 1. Open Firefox browser. 2. Type about:config in the web site address area and press Enter. 3. Ignore the message about the warranty by pressing I ll be careful, I promise. 4. Find browser.link.open_newwindow and change a value to 1 (use Modify option). 5. The change should take effect immediately Cisco Systems, Inc. Cisco 360 CCIE Front End Remote Access Guide 15

16 POD Management Click POD Management button to show all devices of the lab and its status. Administrative management of each device also can be shown by hovering over router on the main diagram and clicking right-button of the mouse: The provided menu allows to Telnet to device, Clear line, Power Cycle and Reinitialize device. Note Exercise caution when operating with power control functions. Not saved configuration might be lost! Clear Line process clears telnet all session to specific device. Power cycle process is designed to restore access to the system lost due to excessive debugging output or lack of any console output on the router. Not saved configuration will be lost! Reinitialize process restores device configuration to its initial configuration state designed by a lab author. Any additional configuration will be lost! 16 Cisco 360 CCIE Front End Remote Access Guide 2012 Cisco Systems, Inc.