A lab environment comprises a group of computers that aren't subject to the same management and security standards as the rest of your infrastructure. Perhaps you need a lab environment for computers that aren't managed by corporate IT or for testing software before you deploy it on the corporate network. If you aren't afraid to get your hands dirty with the Cisco IOS command line, you might be able to set up a network for your lab environment without purchasing any additional network equipment. Using existing equipment also lets the lab access the Internet through your existing connection and lets users access the lab from their desktop on the corporate network.
In this article, I describe how to set up a lab network by using VLANs and ACLs—features common on both Cisco hardware and equipment from other vendors. Computers on the lab network will be able to access the Internet, and users will be able to use Remote Desktop Protocol (RDP) to access computers on the lab network. Furthermore, computers on the lab network will be unable to access computers on the corporate network, thereby protecting corporate assets from the unmanaged lab environment.
The Equipment
For the purpose of this article, I used a Cisco Catalyst 2950 switch and a Cisco 800 router. Most Cisco equipment supports VLANs and ACLs. Network equipment from other vendors might also support these features, but configuration commands vary from vendor to vendor. Chances are that your existing network equipment has everything you need to set up a solution similar to the one I describe here.
Cisco IOS Logon and Backup
If someone else configured your network equipment, you might be a bit rusty on how to access it. Most devices have a Web-based UI, but in this article, I use the Cisco IOS command line to access the device's full functionality. You'll need to know either the console or Telnet password, and the Enable password, the Cisco IOS equivalent of the Administrator or root password.
Start by connecting a rolled cable from the port labeled Console on the router or switch to a computer's serial port. Cisco equipment typically comes with a baby blue rolled cable that you can identify by the appropriate RJ-45 and 9-pin serial port connectors at either end. Next, use Microsoft HyperTerminal to connect to the device. You might also simply Telnet to the device's IP address if it's configured for Telnet access. Figure 1 shows the appropriate HyperTerminal settings.
The Cisco IOS command prompt is similar to the DOS command prompt or Microsoft's Netsh. For those who aren't command-line savvy, I'll describe the commands I use in this article in detail, but you can also look at the official documentation for all IOS commands on Cisco's Web site (http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/).
You should always back up the current configuration before making changes to a router or switch. One backup method is to simply copy the configuration to your computer. You'll need Trivial FTP (TFTP) server software. If you don't already have a TFTP server, Solarwinds (http://solarwinds.net/FreeTools.htm) provides one for free.
At the IOS command line, type
enable
to enter privileged mode. Privileged mode removes the IOS security restrictions from your session, letting you change the configuration. Enter the Enable password when the system prompts you to do so. You'll enter all this article's commands in privileged mode. You'll know you're in privileged mode when your IOS prompt ends with a number sign (#).
Next, use IOS's Copy command to back up the current configuration. Like its DOS counterpart, Copy in IOS takes two arguments: source and destination. Instead of filenames, the arguments IOS accepts are startup-config, running-config, and tftp. Startup-config is the configuration the device boots with, running-config is the device's current configuration, and tftp copies to or from a TFTP server.
To back up the current configuration, type
copy running-config tftp
The system will prompt you for the IP address of the machine running the TFTP server and a filename. After the upload is finished, ensure that the config file is now on your local computer by checking the folder you configured for your TFTP server. To restore this configuration to the router or switch, you can use the command
copy tftp running-config
Now that you have a backup and know how to restore it, you're ready to start modifying your configuration.
Logical Network Segregation with VLANs
Examine the network layout that Figure 2 shows. A corporate desktop (CorpBox) and a machine not supported by corporate IT (LabBox) share subnet 192.168.0.0/24 and can communicate freely. The subnet also contains a router that provides access to the Internet and other corporate subnets.
Our goal is to use VLANs to segregate LabBox from CorpBox so that devices running on the lab network can't interact with those running on the corporate network. A VLAN is a logical grouping of Ethernet ports on your switch. All devices connected to ports on the same VLAN can communicate, but the devices can't communicate with devices on other VLANs. Here are the steps we need to take to accomplish our goal.
- Issue the Configure Terminal command (or Config T for short). This command puts you in configuration mode, which lets you access commands that modify the switch's configuration. To show you that you're in configuration mode, IOS appends (config) to your prompt. You'll find the Configure Terminal command under Configuration Fundamentals in the IOS command reference.
- By default, all ports on your switch will reside on the first VLAN—VLAN1. You should give the name "Lab" to the second VLAN—VLAN2—to remind you what it's for. The Vlan command takes as an argument the number of the VLAN that you want to configure. The command Vlan 2 puts you in config-vlan mode for VLAN2. Note that the prompt changes again to reflect this mode. You'll find the Vlan command in the IOS command reference's LAN Switching section. Type
name Lab
from config-vlan mode to name the VLAN, then type
exit
to exit config-vlan mode.
- Configure the port on the switch to which LabBox is connected—FastEthernet 0/4—to access VLAN2. You'll use the Interface and Switchport access commands to accomplish this step. First, use the command
interface FastEthernet 0/4
to enter the interface configuration (config-if) mode for FastEthernet port 0/4. You'll find the Interface and Switchport commands in the IOS documentation's Interface and Hardware Component section.
Log on to the switch and enter the aforementioned commands by following the example that Figure 3 shows. After you exit config-if and config modes, you can use the command
show vlan brief
to check the results. At this point, you should also try to ping CorpBox from LabBox. This attempt will fail because the two machines now operate as if they're on separate switches.
Just as the VLAN configuration separates LabBox from CorpBox, it also separates LabBox from the router. Because the router provides Internet access, LabBox can no longer access the Internet. CorpBox and the router still share VLAN1, so CorpBox has Internet access.
Inter-VLAN Routing
Users will need to access the lab from the production network, so we'll have to assign the lab network a unique subnet and route traffic between the two subnets. First, connect an Ethernet cable to a free port on the router and the switch. I used Ethernet 1 on the router and FastEthernet 0/2 on the switch. On the switch, assign the port you just connected to the router to VLAN2, just as we did for LabBox. (For an alternative method, see the "Trunking" sidebar, page 47.)
Next, log on to the router and assign the IP address 192.168.1.1 to interface Ethernet 1. Using IOS on a router is similar to using IOS on a switch. The Enable, Config T, and Interface commands work the same way. Because a router is a Layer 3 device, you can assign its interfaces IP addresses from config-if mode by using the IP Address command, which you'll find in the IOS documentation's IP Addressing Services section. Interfaces on Cisco routers "administratively down" by default, which essentially means that IOS turns them off until you tell it otherwise. To enable the interface, issue the No Shutdown command. Figure 4 shows the exact commands.
Assign LabBox the IP address 192.168.1.2 and the default gateway 192.168.1.1. Your network should now look something like Figure 5. If the router isn't the only router on your network, you'll need to inform the other routers about the new subnet so that users can access the subnet from anywhere on your network. One common way to do so is to use a routing protocol. Routing protocols let routers automatically share information about the subnet each router can access. Figure 6 shows the commands you should issue to enable the Router Information Protocol (RIP) on your router for the new subnet. If your network uses another routing protocol, such as Interior Gateway Routing Protocol (IGRP), Enhanced IGRP (EIGRP), or Open Shortest Path First (OSPF), use that protocol instead. If your network doesn't use a routing protocol, you'll have to configure static routes to the 192.168.1.0 subnet on each router.
As you can see in Figure 6, I used the Router Rip command to enter the config-router mode for the RIP routing protocol. Next, I used the Network command to enable RIP routing for the new 192.168.1.0 subnet. Doing so tells the router to advertise the 192.168.1.0 subnet to other routers it communicates with by using RIP. You can find the Router Rip, Network, and similar commands for other routing protocols in the IOS documentation's IP Routing Protocols section.
Note that I didn't have to specify a subnet mask while configuring RIP. RIP uses classful routing, which means that it automatically determines that 192.168.1.0 is a class C subnet and is therefore valid for all IP addresses from 192.168.1.1 to 192.168.1.254. Some networks might use classless routing to make better use of their IP address space. If your network uses a more complicated, classless subnetting scheme, you might want to read up on Classless Interdomain Routing (CIDR) in Cisco's online document "IP Addressing and Subnetting for New Users" (http://www.cisco.com/warp/public/701/3.html).
Both CorpBox and LabBox should now be able to ping each other. LabBox should also be able to ping Internet hosts such as Google.com.
Previous
Register
