Chapter1 : Lab 1.4.6A Gaining Physical Access to the Network

Task 1: Access and Change the Router Passwords

Step 1: Attempt login to the router
NOTE: If the PC used in this lab is also connected to your Academy LAN or to the Internet, ensure that you
record the cable connections and TCP/IP settings so these can be restored at the conclusion of the lab.
a. Referring to the Topology 1, connect the host PC NIC Ethernet port to the router Fa0/0 Ethernet port
using a crossover cable. Ensure that power has been applied to both the host computer and router.

b. Using the given preconfigured topology, attempt to telnet to the router from the PC command line.
Which IP address is used to telnet to the router?
10.0.0.1
What does the message-of-the-day display?
ONLY AUTHORIZED ACCESS TO THIS DEVICE PERMITTED
Unauthorized access will be penalized in accordance with the relevant laws
How many login attempts are allowed?
3
What message is displayed to indicate failure of the login attempts?
% Bad passwords

c. When this attempt at remote login fails, establish a direct physical connection to the router by making
the necessary console connections between the PC and router. Then establish a terminal session
using HyperTerminal or TeraTerm.
What does the message-of-the-day display?
ONLY AUTHORIZED ACCESS TO THIS DEVICE PERMITTED
Unauthorized access will be penalized in accordance with the relevant laws
Attempt to log in by guessing the password.
How many login attempts are allowed?
3
What message is displayed to indicate failure of the log-in attempts?
% Bad passwords
The configuration register needs to be changed so that the startup-configuration is not loaded. Normally,
this is this done from the global configuration mode, but because you cannot log in at all, the boot process
must first be interrupted so that the change can be made in the ROM Monitor mode.

Step 2: Enter the ROM Monitor mode
ROM Monitor mode (ROMMON) is a limited command-line environment used for special purposes, such as low-level troubleshooting and debugging. ROMMON mode is invoked when a Break key sequence sent to the console port interrupts the router boot process. This can only be done via the physical console connection. The actual Break key sequence depends on the terminal program used:
• With HyperTerminal, the key combination is Ctrl+Break.
• For TeraTerm, it is Alt+b.
The list of standard break key sequences is available at http://www.cisco.com/warp/public/701/61.pdf
a. To enter ROM Monitor mode, turn the router off, wait a few seconds, and turn it back on.
b. When the router starts displaying “System Bootstrap, Version …” on the terminal screen, press the Ctrl key and the Break key together if using HyperTerminal, or the Alt key and the b key together if using TeraTerm. The router will boot in ROM monitor mode. Depending on the router hardware, one of several prompts such as "rommon 1 >" or simply “>” may show.
Output:
Router>System Bootstrap, Version 12.3(8r)T8, RELEASE SOFTWARE (fc1)
Cisco 1841 (revision 5.0) with 114688K/16384K bytes of memory.
Self decompressing the image :
####################################
monitor: command "boot" aborted due to user interrupt
rommon 1 >
Step 3: Examine the ROM Monitor mode help
Enter ? at the prompt. The output should be similar to this:
rommon 1 > ?
alias set and display aliases command
boot boot up an external process
break set/show/clear the breakpoint
confreg configuration register utility
context display the context of a loaded image
dev list the device table
dir list files in file system
dis display instruction stream
help monitor builtin command help
history monitor command history
meminfo main memory information
repeat repeat a monitor command
reset system reset
set display the monitor variables
sysret print out info from last system return
tftpdnld tftp image download
xmodem x/ymodem image download

Step 4: Change the configuration register setting to boot without loading configuration file
From the ROM Monitor mode, enter confreg 0x2142 to change the config-register.
rommon 2 > confreg 0x2142
NOTE: The ROMMON prompt increments when a command is issued – this is normal behavior. The
increment does not mean a change of mode. The same ROMMON commands are still available.
"0x" (zero- x) denotes that 2142 is a hexadecimal value. What is this value in binary?
0010 0001 0100 0010
Step 5: Restart router
a. From the ROM Monitor mode, enter reset, or power cycle the router.
rommon 3 > reset
Due to the new configuration register setting, the router will not load the configuration file. After
restarting, the system prompts:
"Would you like to enter the initial configuration dialog? [yes/no]:"
b. Enter no and press Enter.

Step 6: Enter Privileged EXEC mode and view and change passwords
The router is now running without a loaded configuration file.
a. At the user mode prompt Router>, enter enable and press Enter to go to the privileged mode
without a password.
b. Use the command copy startup-config running-config to restore the existing
configuration. Because the user is already in privileged EXEC, no password is needed.
c. Enter show running-config to display the configuration details. Note that all the passwords are
shown.
enable password different
line con 0 password unusual
line vty 0 4 password uncommon
What two measures could be taken to prevent the passwords from being readable?
service password encryption
enable secret somepassword
d. If the passwords were not readable, they can be changed. Enter configure terminal to enter
the global configuration mode.
e. In global configuration mode, use these commands to change the passwords:
FC-CPE-1(config)#enable password cisco
FC-CPE-1(config)#line console 0
FC-CPE-1(config-line)#password console
FC-CPE-1(config-line)#login
FC-CPE-1(config-line)#line vty 0 4
FC-CPE-1(config-line)#password telnet
FC-CPE-1(config-line)#login

Step 7: Change the configuration register setting to boot and load the configuration file
a. The instructor will provide you with the original configuration register value, most likely 0x2101. While
still in the global configuration mode, enter config-register 0x2101 (or the value provided by
your instructor). Press Enter.
FC-CPE-1(config)#config-register 0x2101
b. Use the Ctrl+z combination to return to the privileged EXEC mode.
c. Use the copy running-config startup-config command to save the new configuration.
d. Before restarting the router, verify the new configuration setting. From the privileged EXEC prompt,
enter the show version command and press Enter.
e. Verify that the last line of the output reads:
Configuration register is 0x2142 (will be 0x2101 at next reload).
f. Use the reload command to restart the router.

Step 8: Verify new password and configuration
a. When the router reloads, log in and change mode using the new passwords.
b. Issue the no shutdown command on the fa0/0 interface to bring it up to working status.
FC-CPE-1(config-if)# no shutdown
c. Save the running configuration to startup configuration
FC-CPE-1# copy run start
d. Disconnect the console cable and access the router using Telnet from the PC command line.
The newly configured passwords will allow a successful login.
Task 2: Access and Change the Switch Passwords

Step 1: Attempt login to the switch
NOTE: If the PC used in this lab is also connected to your Academy LAN or to the Internet, ensure that you record the cable connections and TCP/IP settings so these can be restored at the conclusion of the lab.
a. Referring to the Topology 2, connect the host PC NIC Ethernet port to the switch Fa0/1 Ethernet port
using a straight-through cable. Ensure that power has been applied to both the host computer and
switch.
b. Using the given preconfigured topology, attempt to telnet to the router from the PC command line.
Which IP address is used to telnet to the router?
10.0.0.2
What does the message-of-the-day display?
ONLY AUTHORIZED ACCESS TO THIS DEVICE PERMITTED
Unauthorized access will be penalized in accordance with the relevant laws
How many login attempts are allowed?
3
What message is displayed to indicate failure of the login attempts?
% Bad passwords
Connection to host lost.
c. When this attempt at remote login fails, establish a direct physical connection to the router by making
the necessary console connections between the PC and switch. Then establish a terminal session
using HyperTerminal or TeraTerm.
What does the message-of-the-day display?
ONLY AUTHORIZED ACCESS TO THIS DEVICE PERMITTED
Unauthorized access will be penalized in accordance with the relevant laws
Attempt to log in by guessing the password.
How many login attempts are allowed?
3
What message is displayed to indicate failure of the log-in attempts?
% Bad passwords
To prevent the configuration from loading, the config.txt file is renamed so that the switch IOS cannot
locate and load a valid configuration file. To rename the file, the boot process must be interrupted so that
the change can be made in the "switch:" mode.

Step 2: Enter the switch: mode
a. Power off the switch.
b. Locate the MODE button on the front of the switch.
c. Hold down the MODE button on the front of the switch while powering on the switch. Release the
MODE button after 10 seconds.
Output:
Base ethernet MAC Address: 00:0a:b7:72:2b:40
Xmodem file system is available.
The password-recovery mechanism is enabled.
The system has been interrupted prior to initializing the
flash files system. The following commands will initialize
the flash files system, and finish loading the operating
system software:
flash_init
load_helper
boot
switch:
d. To initialize the file system and finish loading the operating system, enter the following commands at
the switch: prompt:
switch: flash_init
switch: load_helper
e. To view the contents of flash memory, enter dir flash: at the switch: prompt.
switch: dir flash:
NOTE: Do not forget to type the colon (:) after the word “flash” in the command dir flash:
The file config.txt should be seen listed.
f. Enter rename flash:config.text flash:config.old to rename the configuration file. This
file contains the password definitions.
g. Enter dir flash: at the switch: prompt to view the name change.
switch: dir flash:

Step 3: Restart the switch
a. Enter boot to restart the switch.
switch: boot
The configuration file coinfig.txt cannot be located; therefore, the switch boots into Setup mode.
b. Would you like to terminate autoinstall? [Yes]: Y
c. Would you like to enter the initial configuration dialog? [yes/no] N
Switch>

Step 4: Enter Privileged EXEC mode and view and change passwords
The switch is now running without a loaded configuration file.
a. At the user mode prompt Router>, type enable and press Enter to go to the privileged mode
without a password.
b. Enter rename flash:config.old flash:config.text to rename the configuration file with its
original name.
Switch#rename flash:config.old flash:config.text
Destination filename [config.text]?
Press Enter to confirm file name change.
c. Copy the configuration file into RAM.
Switch#copy flash:config.text system:running-config
Destination filename [running-config]?
Press Enter to confirm file name.
d. Press Enter to accept the default file names.
Source filename [config.text]?
Destination filename [running-config]
The configuration file is now loaded.
e. Enter show running-config to display the configuration details. Note that all the passwords are
shown.
enable password different
line con 0 password unusual
line vty 0 4 password uncommon
What two measures could be taken to prevent the passwords from being readable?
service password encryption
enable secret somepassword
f. If the passwords were not readable they can be changed. Enter configure terminal to enter the
global configuration mode.
g. Change the unknown passwords.
FC-ASW-1#configure terminal
FC-ASW-1(config)#enable password cisco
FC-ASW-1(config)#line console 0
FC-ASW-1(config-line)#password console
FC-ASW-1(config-line)#line vty 0 15
FC-ASW-1(config-line)#password telnet
FC-ASW-1(config-line)#exit
FC-ASW-1(config)#exit

Step 5: Save the configuration file
Use the copy running-config startup-config command to save the new configuration.
FC-ASW-1#copy running-config startup-config
Destination filename [startup-config]?[enter]
Building configuration...
[OK]
FC-ASW-1#

Step 6: Verify new password and configuration
Power cycle the switch and verify that the passwords are now functional.

Step 7: Clean up
Erase the configurations and reload the switch. Disconnect and store the cabling. For PC hosts that are
normally connected to other networks (such as the school LAN or to the Internet), reconnect the appropriate
cabling and restore the TCP/IP settings.

Task 3: Reflection
Consider the different methods of securing physical access to networking devices such as routers and
switches. List how only those people who require access can be identified and how this security can be
implemented.
Keamanan fisik termasuk mengunci riangan dan lemari yang berisi switch dan router. Jaringan perangkat ruang umum berbagi dengan layanan lainnya, seperti panel daya listrik, harus tertutup dalam kabinet yang terpisah dan dikunci. Kunci dan kode akses seharusnya hanya diberikan kepada petugas yang berwenang.