!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Модуль1!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ПЕРЕИМЕНОВАНИЕ ХОСТОВ!!!!!!!!!!!!!!!!!!!!!!!!!!!!
ISP
hostnamectl set-hostname isp; exec bash
HQ-RTR
enable
configure terminal
hostname hq-rtr
ip domain-name au-team.irpo
write memory
BR-RTR
enable
configure terminal
hostname br-rtr
ip domain-name au-team.irpo
write memory
HQ-SRV
hostnamectl set-hostname hq-srv.au-team.irpo; exec bash
BR-SRV
hostnamectl set-hostname br-srv.au-team.irpo; exec bash
CLI
hostnamectl set-hostname hq-cli.au-team.irpo; exec bash
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Создание интерфейсов на роутерах!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-RTR
interface vl100
description "VLAN 100"
ip address 171.12.100.1/27
exit
interface vl200
description "VLAN 200"
ip address 171.12.200.1/24
exit
interface vl999
description "VLAN 999"
ip address 171.12.99.1/29
exit
write memory
На базе физического интерфейса te1 для каждого VLAN-а создаём service-instance
HQ-RTR
port te1
service-instance te1/vl100
encapsulation dot1q 100 exact
rewrite pop 1
connect ip interface vl100
exit
service-instance te1/vl200
encapsulation dot1q 200 exact
rewrite pop 1
connect ip interface vl200
exit
service-instance te1/vl999
encapsulation dot1q 999 exact
rewrite pop 1
connect ip interface vl999
exit
exit
write memory
BR-RTR
interface int1
description "BR-Net"
ip address 171.12.0.1/28
exit
port te1
service-instance te1/int1
encapsulation untagged
connect ip interface int1
exit
exit
write memory
HQ-RTR
enable
conf t
interface isp
description "ISP"
ip address 192.10.1.2/28
exit
ip route 0.0.0.0/0 192.10.1.1
port te0
service-instance te0/isp
encapsulation untagged
connect ip interface isp
exit
exit
write memory
BR-RTR:
enable
conf t
interface isp
description "ISP"
ip address 192.10.2.2/28
exit
ip route 0.0.0.0/0 192.10.2.1
port te0
service-instance te0/isp
encapsulation untagged
connect ip interface isp
exit
exit
write memory
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Создание интерфейсов на коммутаторах и ISP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-SRV
echo "BOOTPROTO=static" > /etc/net/ifaces/ens18/options
echo "TYPE=eth" >> /etc/net/ifaces/ens18/options
echo "171.12.100.2/27" > /etc/net/ifaces/ens18/ipv4address
echo "default via 171.12.100.1" > /etc/net/ifaces/ens18/ipv4route
echo "nameserver 77.88.8.8" > /etc/net/ifaces/ens18/resolv.conf
systemctl restart network
BR-SRV
echo "BOOTPROTO=static" > /etc/net/ifaces/ens18/options
echo "TYPE=eth" >> /etc/net/ifaces/ens18/options
echo "171.12.0.2/28" > /etc/net/ifaces/ens18/ipv4address
echo "default via 171.12.0.1" > /etc/net/ifaces/ens18/ipv4route
echo "nameserver 77.88.8.8" > /etc/net/ifaces/ens18/resolv.conf
systemctl restart network
ISP
mkdir /etc/net/ifaces/ens19
mkdir /etc/net/ifaces/ens20
echo "TYPE=eth" > /etc/net/ifaces/ens19/options
echo "BOOTPROTO=static" >> /etc/net/ifaces/ens19/options
cp /etc/net/ifaces/ens19/options /etc/net/ifaces/ens20/options
echo "192.10.1.1/28" > /etc/net/ifaces/ens19/ipv4address
echo "192.10.2.1/28" > /etc/net/ifaces/ens20/ipv4address
systemctl restart network
включаем forvarding
echo 'net.ipv4.ip_forward = 1' | tee -a /etc/net/sysctl.conf
systemctl restart network
Для динамической сетевой трансляции можно использовать iptables (включаем NAT)
apt-get update
apt-get install -y iptables
iptables -t nat -A POSTROUTING -s 192.10.1.0/28 -o ens18 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.10.2.0/28 -o ens18 -j MASQUERADE
iptables-save >> /etc/sysconfig/iptables
systemctl enable --now iptables
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Создание пользователя с явным указанием UID!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-SRV
useradd sshuser -u 2026
passwd sshuser
P@ssw0rd
usermod -aG wheel sshuser
echo "sshuser ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
BR-SRV
useradd sshuser -u 2026
passwd sshuser
P@ssw0rd
usermod -aG wheel sshuser
echo "sshuser ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
HQ-RTR и BR-RTR
username net_admin
password P@ssw0rd
role admin
exit
write memory
BR-SRV
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка безопасного удаленного доступа на серверах HQ-SRV и BR-SRV!!!!!!!!!!!!!!!!!!!!!
HQ-SRV
mcedit /etc/openssh/sshd_config
вносим следующие изменения
Port 2026
AllowUsers sshuser
MaxAuthTries 2
Banner /etc/openssh/banner
echo "Authorized access only" > /etc/openssh/banner
systemctl restart sshd
BR-SRV:
mcedit /etc/openssh/sshd_config
Вносим следующие изменения
Port 2026
AllowUsers sshuser
MaxAuthTries 2
Banner /etc/openssh/banner
echo "Authorized access only" > /etc/openssh/banner
systemctl restart sshd
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка ip туннеля между офисами HQ и BR, на маршрутизаторах HQ-RTR и BR-RTR!!!!!!!!!!!!!!!!!!!!
HQ-RTR:
interface tunnel.0
description "GRE"
ip address 110.20.20.1/30
ip tunnel 192.10.1.2 192.10.2.2 mode gre
exit
write memory
!!!BR-RTR:!!!
interface tunnel.0
description "GRE"
ip address 110.20.20.2/30
ip tunnel 192.10.2.2 192.10.1.2 mode gre
exit
write memory
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка динамической маршрутизации на маршрутизаторах HQ-RTR и BR-RTR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-RTR:
router ospf 1
ospf router-id 110.20.20.1
passive-interface default
no passive-interface tunnel.0
network 110.20.20.0/30 area 0
network 171.12.100.0/27 area 0
network 171.12.200.0/24 area 0
network 171.12.99.0/29 area 0
exit
interface tunnel.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
exit
write memory
BR-RTR:
router ospf 1
ospf router-id 110.20.20.2
passive-interface default
no passive-interface tunnel.0
network 171.12.0.0/28 area 0
network 110.20.20.0/30 area 0
exit
interface tunnel.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
exit
write memory
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка динамической трансляции адресов маршрутизаторах HQ-RTR и BR-RTR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-RTR:
interface isp
ip nat outside
exit
interface vl100
ip nat inside
exit
interface vl200
ip nat inside
exit
interface vl999
ip nat inside
exit
ip nat pool VLAN100 171.12.100.1-171.12.100.30
ip nat pool VLAN200 171.12.200.1-171.12.200.254
ip nat pool VLAN999 171.12.99.1-171.12.99.6
ip nat source dynamic inside-to-outside pool VLAN100 overload interface isp
ip nat source dynamic inside-to-outside pool VLAN200 overload interface isp
ip nat source dynamic inside-to-outside pool VLAN999 overload interface isp
write memory
BR-RTR:
interface isp
ip nat outside
exit
interface int1
ip nat inside
exit
ip nat pool BR-Net 171.12.0.1-171.12.0.14
ip nat source dynamic inside-to-outside pool BR-Net overload interface isp
exit
write memory
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Настройка протокола динамической конфигурации хостов для сети в сторону HQ-CLI!!!!!!!!!!!!!!!!!!!!
HQ-RTR:
ip pool VLAN200 171.12.200.2-171.12.200.254
dhcp-server 1
pool VLAN200 1
mask 24
gateway 171.12.200.1
dns 171.12.100.2
domain-name au-team.irpo
exit
exit
interface vl200
dhcp-server 1
exit
write memory
На хостах HQ-CLI необходимо настроить интерфейс для получения динамических настроек, через графический интерфейс ВМ
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка инфраструктуры разрешения доменных имён для офисов HQ и BR!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-SRV:
apt-get update && apt-get install bind bind-utils -y
mcedit /var/lib/bind/etc/options.conf
listen-on { 171.12.100.2; };
forwarders { 77.88.8.8; };
allow-query { any; };
cat > /var/lib/bind/etc/rfc1912.conf << 'EOF'
zone "au-team.irpo" {
type master;
file "au-team.irpo";
};
zone "100.12.171.in-addr.arpa" {
type master;
file "100.12.171.in-addr.arpa";
};
zone "200.12.171.in-addr.arpa" {
type master;
file "200.12.171.in-addr.arpa";
};
EOF
cp /var/lib/bind/etc/zone/empty /var/lib/bind/etc/zone/au-team.irpo
cp /var/lib/bind/etc/zone/empty /var/lib/bind/etc/zone/100.12.171.in-addr.arpa
cp /var/lib/bind/etc/zone/empty /var/lib/bind/etc/zone/200.12.171.in-addr.arpa
!!!Необходимо сконфигурировать файл au-team.irpo:!!!!
cat > /var/lib/bind/etc/zone/au-team.irpo << 'EOF'
$TTL 1D
@ IN SOA au-team.irpo. root.au-team.irpo. (
2025062300 ; serial
12H ; refresh
1H ; retry
1W ; expire
1H ; negative cache TTL
)
IN NS au-team.irpo.
IN A 171.12.100.2
hq-srv IN A 171.12.100.2
hq-cli IN A 171.12.200.2
hq-rtr IN A 171.12.100.1
hq-rtr IN A 171.12.200.1
hq-rtr IN A 171.12.99.1
docker IN A 192.10.1.1
web IN A 192.10.2.1
br-srv IN A 171.12.0.2
br-rtr IN A 171.12.0.1
EOF
!!!!Далее необходимо настроить обратную зону и привести файл 100.12.171.in-addr.arpa:!!!!
cat > /var/lib/bind/etc/zone/100.12.171.in-addr.arpa << 'EOF'
$TTL 1D
@ IN SOA au-team.irpo. root.au-team.irpo. (
2025062300 ; serial
12H ; refresh
1H ; retry
1W ; expire
1H ; ncache
)
IN NS au-team.irpo.
1 IN PTR hq-rtr.au-team.irpo.
2 IN PTR hq-srv.au-team.irpo.
EOF
!!!!!Далее необходимо настроить обратную зону и привести файл 200.12.171.in-addr.arpa:!!!!!
cat > /var/lib/bind/etc/zone/200.12.171.in-addr.arpa << 'EOF'
$TTL 1D
@ IN SOA au-team.irpo. root.au-team.irpo. (
2025062300 ; serial
12H ; refresh
1H ; retry
1W ; expire
1H ; ncache
)
IN NS au-team.irpo.
1 IN PTR hq-rtr.au-team.irpo.
2 IN PTR hq-cli.au-team.irpo.
EOF
named-checkconf
rndc-confgen > /var/lib/bind/etc/rndc.key
sed -i '6,$d' /var/lib/bind/etc/rndc.key
rndc-confgen > /etc/bind/rndc.key
sed -i '6,$d' /etc/bind/rndc.key
chown -R root:named /etc/bind/zone/*
systemctl enable --now bind.service
systemctl restart bind.service
systemctl status bind.service
Для всех хостов сети внести изменения в настройки resolv
mcedit /etc/net/ifaces/ens18/resolv.conf
au-team.irpo
nameserver 171.12.100.2
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройте часовой пояс на всех устройствах!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-RTR:
ntp timezone utc+3
write memory
BR-RTR:
ntp timezone utc+3
write memory
ISP | HQ-SRV | HQ-CLI | BR-SRV:
Настройте часовой пояс на всех устройствах, согласно месту проведения экзамена:
timedatectl set-timezone Europe/Moscow
На JeOS (ISP) возможно потребуется установка пакета tzdata
apt-get install -y tzdata