Dhaqdhaqaaqa Xirfadaha Adduunka waxaa loogu talagalay in kaqeybgalayaashu ay helaan xirfado wax ku ool ah oo looga baahan yahay suuqa shaqada ee casriga ah. Awoodda Maamulka Shabakadda iyo Nidaamku waxay ka kooban tahay saddex qaybood: Network, Windows, Linux. Hawluhu waxay ka beddelaan horyaalnimada ilaa horyaalnimada, shuruudaha tartanka ayaa isbeddelaya, laakiin qaabka hawlaha inta badan waa isku mid.
Jasiiradda Shabakadda ayaa noqon doonta tii ugu horreysay iyadoo ay ugu wacan tahay fududaanteeda marka loo eego jasiiradaha Linux iyo Windows.
Hawlaha soo socda ayaa lagu tixgalin doonaa maqaalka:
- Magacaabo DHAMMAAN aaladaha sida waafaqsan topology-ga
- U qoondee magaca domain wsrvuz19.ru qalabyada oo dhan
- Ku samee isticmaale wsrvuz19 DHAMMAAN aaladaha wata cisco erayga sirta ah
- Furaha isticmaalaha waa in lagu keydiyaa qaabeynta natiijada shaqada xashiishka.
- Isticmaaluhu waa inuu lahaadaa heerka mudnaanta ugu sarreeya.
- Dhammaan aaladaha, hirgeli qaabka AAA.
- Xaqiijinta console-ka fog waa in lagu sameeyaa iyadoo la isticmaalayo xogta deegaanka (marka laga reebo RTR1 iyo RTR2)
- Xaqiijinta si guul leh ka dib, marka laga soo galo konsole fog, isticmaaluhu waa inuu isla markiiba galaa qaabka heerka ugu sarreeya ee mudnaanta.
- Deji baahida xaqiijinta konsole-ka deegaanka
- Marka si guul leh loo xaqiijiyo console-ka deegaanka, isticmaaluhu waa inuu galaa habka ugu mudnaanta yar.
- On BR1, marka si guul leh loo xaqiijiyo konsole maxaliga ah, isticmaaluhu waa inuu galaa qaabka heerka ugu sarreeya ee mudnaanta
- Dhammaan aaladaha, deji furaha wsr si aad u gasho qaabka mudnaanta leh.
- Erayga sirta ah waa in lagu kaydiyaa qaabaynta MAAHA natiijada shaqada xashiishku.
- Deji qaabka ay dhammaan furayaasha sirta ah ee qaabaynta lagu kaydiyaa qaab qarsoodi ah.
Shabakadda topology ee lakabka jireed waxaa lagu soo bandhigay jaantuskan soo socda:
1. Magacaabi DHAMMAAN aaladaha sida waafaqsan topology-ga
Si loo dejiyo magaca aaladda (magaca martida), ka geli amarka qaabka qaabeynta caalamiga ah hostname SW1, halkee halkii SW1 waa inaad qortaa magaca qalabka lagu sheegay hawlaha.
Waxaad xitaa u eegi kartaa goobta muuqaal ahaan - halkii aad ka ahaan lahayd preset-ka Switch noqday SW1:
Switch(config)# hostname SW1
SW1(config)#
Hawsha ugu weyn ka dib samaynta habayn kasta waa in la badbaadiyo qaabeynta.
Tan waxaa laga samayn karaa habka qaabeynta caalamiga ah oo leh amarka do write:
SW1(config)# do write
Building configuration...
Compressed configuration from 2142 bytes to 1161 bytes[OK]
Ama laga bilaabo qaabka mudnaanta leh ee amarka write:
SW1# write
Building configuration...
Compressed configuration from 2142 bytes to 1161 bytes[OK]
2. U qoondee magaca domain wsrvuz19.ru qalabyada oo dhan
Waxaad u dejisan kartaa magaca domain wsrvuz19.ru si caadi ah oo ka yimid qaabka qaabeynta caalamiga ah ee leh amarka ip domain-name wsrvuz19.ru.
Jeegaga waxa sameeya amarka soo koobida ee show hosts ee qaabka qaabaynta caalamiga ah:
SW1(config)# ip domain-name wsrvuz19.ru
SW1(config)# do show hosts summary
Name lookup view: Global
Default domain is wsrvuz19.ru
...
3. Ku samee isticmaale wsrvuz19 DHAMMAAN qalabyada leh cisco password-ka
Waa lagama maarmaan in la abuuro isticmaale noocan oo kale ah si uu u yeesho heerka ugu sarreeya ee mudnaanta, iyo erayga sirta ah waxaa lagu kaydiyaa qaab shaqo xashiish ah. Dhammaan shuruudahan waxaa xisaabta ku darsaday kooxda username wsrvuz19 privilege 15 secret cisco.
Halkan:
username wsrvuz19 - Magaca isticmaalaha;
privilege 15 - heerka mudnaanta (0 - heerka ugu yar, 15 - heerka ugu sarreeya);
secret cisco - Kaydinta erayga sirta ah ee qaabka MD5 hash function.
show amar running-config Waxay kuu oggolaaneysaa inaad hubiso dejinta qaabeynta hadda, halkaas oo aad ka heli karto khadka isticmaale ku daray oo aad hubiso in erayga sirta ah lagu keydiyo qaab sir ah:
SW1(config)# username wsrvuz19 privilege 15 secret cisco
SW1(config)# do show running-config
...
username wsrvuz19 privilege 15 secret 5 $1$EFRK$RNvRqTPt5wbB9sCjlBaf4.
...
4. Dhammaan qalabyada, hirgeli qaabka AAA
Qaabka AAA waa nidaamka xaqiijinta, oggolaanshaha iyo xisaabinta dhacdooyinka. Si loo dhammeeyo hawshan, tallaabada ugu horreysa waa in la suurtogeliyo qaabka AAA oo la qeexo in xaqiijinta la samayn doono iyada oo la adeegsanayo xogta macluumaadka degaanka:
SW1(config)# aaa new-model
SW1(config)# aaa authentication login default local
a. Xaqiijinta console-ka fog waa in lagu sameeyaa iyadoo la isticmaalayo xogta deegaanka (marka laga reebo RTR1 iyo RTR2)
Shaqooyinku waxay qeexaan laba nooc oo consoles-ka ah: kuwa maxalliga ah iyo kuwa fog. Console-ka fog wuxuu kuu ogolaanayaa inaad hirgeliso isku xirka fogfog, tusaale ahaan, adoo adeegsanaya borotokoolka SSH ama Telnet.
Si aad hawshan u dhammaystirto, geli amarradan soo socda:
SW1(config)# line vty 0 4
SW1(config-line)# login authentication default
SW1(config-line)# exit
SW1(config)#
kooxda line vty 0 4 Waxay ku sii socotaa qaabaynta khadadka terminalka farsamada ee laga bilaabo 0 ilaa 4.
kooxda login authentication default daaraa habka aqoonsiga caadiga ah ee konsole dalwaddiinta, iyo qaabka caadiga ah waxaa la dejiyay shaqadii ugu dambeysay ee amarka aaa authentication login default local.
Ka bixitaanka habka qaabeynta konsole fog waxaa lagu sameeyaa iyadoo la isticmaalayo amarka exit.
Jeeg la isku hallayn karo ayaa noqon doona isku xidhka tijaabada ee borotokoolka Telnet hal qalab ilaa mid kale. Waa in maskaxda lagu hayaa in beddelka aasaasiga ah iyo ip-addressing ee qalabka la doortay ay tahay in loo habeeyo tan.
SW3#telnet 2001:100::10
User Access Verification
Username: wsrvuz19
Password:
SW1>
b. Xaqiijinta si guul leh ka dib, marka laga soo galo konsole fog, isticmaaluhu waa inuu isla markiiba galaa qaabka heerka ugu sarreeya ee mudnaanta
Si aad u xalliso dhibaatadan, waxaad u baahan tahay inaad dib ugu noqotid dejinta khadadka terminaalka casriga ah oo aad dejiso heerka mudnaanta ee amarka privilege level 15, halkaas oo 15 mar kale tahay heerka mudnaanta ugu sarreeya iyo 0 ay tahay heerka mudnaanta ugu yar:
SW1(config)# line vty 0 4
SW1(config-line)# privilege level 15
SW1(config-line)# exit
SW1(config)#
Tijaabadu waxay noqon doontaa xalka cutubka hoose ee hore - xidhiidhka fog ee Telnet:
SW3#telnet 2001:100::10
User Access Verification
Username: wsrvuz19
Password:
SW1#
Xaqiijinta ka dib, isticmaaluhu wuxuu isla markiiba galaa habka mudnaanta leh, isagoo ka gudbaya midka aan mudnaanta lahayn, taas oo macnaheedu yahay in hawshu si sax ah u dhammaatay.
cd Deji baahida console-ka deegaanka iyo marka si guul leh loo xaqiijiyo, isticmaaluhu waa inuu galaa habka mudnaanta ugu yar
Qaab dhismeedka taliska ee hawlahani waxa uu la mid yahay hawlihii hore loo xaliyay 4.a iyo 4.b. Kooxda line vty 0 4 waxaa bedelay console 0:
SW1(config)# line console 0
SW1(config-line)# login authentication default
SW1(config-line)# privilege level 0
SW1(config-line)# exit
SW1(config)#
Sida hore loo sheegay, heerka mudnaanta ugu yar waxaa lagu go'aamiyaa lambarka 0. Jeegga waxaa loo samayn karaa sida soo socota:
SW1# exit
User Access Verification
Username: wsrvuz19
Password:
SW1>
Xaqiijinta ka dib, isticmaaluhu wuxuu galayaa qaabka aan mudnaanta lahayn, sida lagu sheegay hawlaha.
e. On BR1, marka si guul leh loo xaqiijiyo konsole maxaliga ah, isticmaaluhu waa inuu galaa qaabka heerka ugu sarreeya ee mudnaanta
Dejinta console maxalli ah ee BR1 waxay u ekaan doontaa sidan:
BR1(config)# line console 0
BR1(config-line)# login authentication default
BR1(config-line)# privilege level 15
BR1(config-line)# exit
BR1(config)#
Jeegga waxaa loo fuliyaa si la mid ah sida ku xusan cutubka hore:
BR1# exit
User Access Verification
Username: wsrvuz19
Password:
BR1#
Xaqiijinta kadib, u gudubka qaabka mudnaanta ayaa dhacaya.
5. Qalabka oo dhan, dhig furaha wsr si aad u gasho qaabka mudnaanta leh
Shaqaaluhu waxay yiraahdaan erayga sirta ah ee habka mudnaanta leh waa in lagu kaydiyaa sida caadiga ah qoraal cad, laakiin qaabka sirta ah ee dhammaan ereyada sirta ah ayaa kuu ogolaanaya inaad aragto erayga sirta ah qoraal cad. Si aad u dejiso furaha sirta ah si aad u gashid qaabka mudnaanta leh, isticmaal amarka enable password wsr. Isticmaalka ereyga muhiimka ah password, ayaa go'aaminaya nooca erayga sirta ah lagu kaydin doono. Haddii erayga sirta ah ay tahay in la xafido marka la abuurayo isticmaale, markaa ereyga muhiimka ah wuxuu ahaa ereyga secret, iyo kaydinta qaab furan ayaa loo isticmaalaa password.
Waxaad ka eegi kartaa setinka muuqaalka qaabeynta hadda:
SW1(config)# enable password wsr
SW1(config)# do show running-config
...
enable password wsr
!
username wsrvuz19 privilege 15 secret 5 $1$5I66$TB48YmLoCk9be4jSAH85O0
...
Waxaa la arki karaa in erayga sirta ah ee isticmaalaha uu ku kaydsan yahay qaab qarsoodi ah, iyo erayga sirta ah ee lagu galo habka mudnaanta leh waxaa lagu kaydiyaa qoraal cad, sida lagu sheegay hawlaha.
Si dhammaan ereyada sirta ah loogu kaydiyo qaab qarsoodi ah, waa inaad isticmaashaa amarka service password-encryption. Daawashada qaabeynta hadda waxay u ekaan doontaa sidan:
SW1(config)# do show running-config
...
enable password 7 03134819
!
username wsrvuz19 privilege 15 secret 5 $1$5I66$TB48YmLoCk9be4jSAH85O0
...
Furaha sirta ah hadda lama arki karo si cad.
Source: www.habr.com