21 Static Networking Part 1

Up to this point, we have only used one router in our working environments.  However, you will rarely work on a network with only a single because the whole point of an enterprise network is to connect multiple LANs into a unified cohesive network.

In this lab, we will create and connect three LANs via routers. We introduce you to static routing solutions so you can become familiar with routing procedures.  Static routing is impractical mainly because it is very manpower intensive to maintain and prone to human error.

Estimated time for completion: 70 minutes

Learning objectives

• Successfully create two functional LANs:
  • Red (DHCP + 2 PCs)
  • Blue (DHCP + 2 PCs)
• Configure two routers to use static routing so all devices can communicate

Prerequisites

• Chapter 16 – Introduction to Routers
• Chapter 17 – IPv4 Addressing
• Chapter 18 – DHCP using Linux

Deliverables

• Screenshot of GNS3 workspace with labels
• Screenshot of Wireshark IMCP packets showing a Red device successfully pinging a Blue device

Resources

• MikroTik RouterOS Documentation – “IP Routing” – https://help.mikrotik.com/docs/display/ROS/IP+Routing

Contributors and Testers

• Dante Rocca, Cybersecurity Student, ERAU-Prescott
• Sawyer Hansen, Cybersecurity Student, ERAU-Prescott

1. Start GNS3
   1. Create a new project: LAB_07
2. Build the Red subnet with the following specifications:
   1. IP address space – 115.20.20.0/24
      
   2. Two client machines – VPCS
   3. One switch – Ethernet switch
   4. One DHCP server – Ubuntu Server VM (isc-dhcp-server)
   5. One router – MikroTik CHR
   6. Connect the server and PCs to their associated switch
   7. Connect the switch to the router’s ether1 interface
3. Configure the MikroTik router to act as Red’s gateway

   NOTE: Refer to Chapter 16, Phase II, Step 4 for more information.

   1. Set a new hostname to reflect its new purpose

      > system identity set name=RED-ROUTER

   2. Set ether1 with the IP address 115.20.20.250 for the Red network

      > ip address add address=115.20.20.250/24 interface=ether1

   3. Verify that it was taken

      > ip address print

      MikroTik Configuration Preface

      By default, MikroTik routers will have a DHCP client enabled on interface ether1, which will automatically request an IP address once the network’s DHCP server is online. To avoid unnecessary packet traffic (and troubleshooting headaches), disable this client as part of the router’s setup routine. You can identify interfaces with DHCP clients enabled via the “dynamic” (D) flag that appears next to its identification number.

      

      List all DHCP clients currently enabled on the device.

      > ip dhcp-client print

      

      Remove the DHCP client. When editing or deleting entries in RouterOS, you “select” a target row based on its number (#) in the first column. In this instance, we are removing entry zero.

      > ip dhcp-client remove 0

      

      Verify that all IP addresses are now static. Note that this method can also be used to remove or edit accidental interface IP assignements. Instead of ip dhcp-client remove #, the syntax would be ip address remove #, where # represents the row you wish to select.

      

4. Configure Ubuntu Server to act as Red’s DHCP server

   NOTE: Refer to Chapter 18, Phase II, Steps 2-7 for more information.

   1. Assign its Ethernet card with the static IP address of 115.20.20.254/24 and a default gateway of 115.20.20.250 (ether1 on the Red router)

      > sudo vi /etc/netplan/00-installer-config.yaml

      

   2. Apply the configuration

      > sudo netplan apply

   3. Configure the DHCP daemon with a host range of .10 to .150 in addition to a gateway address to ether1 on the Red MikroTik router

      > sudo vi /etc/dhcp/dhcpd.conf

      

      NOTE: Notice the addition of option routers in this configuration file. This will automatically assign a gateway address to DHCP clients.

5. Have each VPCS request a new IP address

   > ip dhcp

6. Ensure that all devices within the LAN can ping each other
7. Repeat steps 2 through 6 to build the Blue subnet
   1. Blue will have the IP address space of 68.110.45.0/24
   2. The Blue router’s IP on ether1 is 68.110.45.250
   3. The Blue DHCP server’s static IP is 68.110.45.254
   4. The Blue DHCP daemon will have the same specifications as Red
      

      

8. Label and organize your network as necessary
   

   

1. On the Red router, set ether2 with the static IP address 10.10.10.1/29 for the Backbone network

   > ip address add address=10.10.10.1/29 interface=ether2

   NOTE: A backbone is network IP space that is only used by routers to speak to each other.  In this example, we are using 10.10.10.0/29 which has a maximum of six host addresses. This while only two devices (router interfaces) are currently connected on this network, this leaves room for four more potential devices.

2. On the Blue router, set ether2 with the static backbone IP address 10.10.10.2/29
   

   > ip address add address=10.10.10.2/29 interface=ether2

3. Connect Red router’s ether2 interface with Blue router’s ether2 interface
   

   

1. Start two Wireshark data captures
   1. Red-Switch to Red-Router
   2. Red-Router to Blue-Router
2. Open PC1 and ping Red-Router

   > ping 115.20.20.250

   1. Observe the ICMP packets on the Red-switch to Red-Router Wireshark window
      

      

3. Now from PC1, ping Blue-Router

   > ping 10.10.10.2

   1. Observe the ICMP packets on the Red-Router to Blue-Router Wireshark Window
      

      

      What happened? What is the problem? Maybe we configured the routers wrong.

4. Open the Red-Router console and ping the Blue-Router by typing

   > ping 10.10.10.2

   1. Observe the ICMP packets on the Red-Router to Blue-Router Wireshark Window
      

      

      That worked, so what is the problem?

5. Open the PC1 console and ping the Blue Network DHCP server by typing ping 68.110.45.250

   > ping 68.110.45.254

   1. Observe the ICMP packets on both Wireshark data packet captures
      

      

      What do you see? What is happening?

Phase IV – Configure the Routers

Even though the routers know what networks are connected to them, they have no knowledge of the networks that are not connected to them.  Let’s look at our current network.

Ok, we are only concerned with one path, so let’s simplify our diagram to the essentials.

The switches are unmanaged, so we don’t even need them for this explanation.  So we’ll take those out, change our routers to use color symbols, add the IP addresses, and label the simplified links, which takes our diagram down to the essentials.

Remember what a ping packet (ICMP) does: It sends a request to a target interface and asks that interface to send it back to the originator.

When the Red PC pings the Red Router we can see the packets on Link A for both request and response.

Try it – Open a Wireshark capture for Link A.  Then from the PC 1 console type ping 115.20.20.250

The Red Router knows that network 115.20.20.0 is connected to ether1 and sends the response.

Now when Red Router pings Blue Router we can see the packets on Link B for both request and response.

Try it – Open a Wireshark capture for Link B.  Then from the Red Router console type ping 10.10.10.2

The Blue Router knows that network 10.10.10.0 is on ether2 and sends the response.

However, when Red PC pings the Blue Router, the Red Router forwards the packets to Blue Router, but when Blue Router tries to send the response packets back to Red PC, it has no idea what interface to use to send packets to network 115.20.20.0, so it never sends the responses.

Finally, when Red PC pings the Blue PC, it has no idea where to send the request packets, so it just throws up its arms and tells us, “Nope. I’m out.”

We are going to fix this problem.

1. Stop the Wireshark captures (this saves our host machine’s resources)
2. Configure a static routing table on the Red subnet’s router
   1. Open the Red-Router console
   2. Add a new static route to our Red-Router

      > ip route add dst-address=68.110.45.0/24 gateway=10.10.10.2

      Command	Purpose
      ip route add	Add a new IPv4 route
      dst-address=68.110.45.0/24	Any packet trying to go to the 68.110.45.0 network
      gateway=10.10.10.2	Forward the packet to this destination interface

3. Configure a static routing table on the Blue subnet’s routers
   1. Add a new static route to our Blue Router by navigating to the Blue Router Console and typing

      > ip route add dst-address=115.20.20.0/24 gateway=10.10.10.1

4. Now navigate to PC1 and try to ping the Blue router or any Blue end device
   

   

   Congratulations! You successfully implemented a basic network using static routing!

1. Create a Green LAN similar to our Red and Blue LANs
   1. Use a randomly generated IPv4 network address space
   2. Use a network address that minimizes wasted IPs for 35 hosts
   3. Ensure that it has two VPCS’s, one DHCP server, and one Ethernet switch
2. Connect the Green subnet to the Red router
3. Configure the Red Router so the Green and Red LANs can ping each other
4. Configure the Blue Router so the Green and Blue LANs can ping each other
5. Label and organize your network as necessary
   

   

End of Lab