Define internal and external

1. NET

SW1

Switch>enable
Switch#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#hostname SW1
SW1(config)#vlan 2
SW1(config-vlan)#exit
SW1(config)#interface f0/1
SW1(config-if)#switchport access vlan 2
SW1(config-if)#interface f0/2
SW1(config-if)#switchport access vlan 2
SW1(config)#interface f0/3
SW1(config-if)#switchport mode trunk
SW1#write

R1

Router>enable
Router#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R1
R1(config)#interface GigabitEthernet 0/0
R1(config-if)#ip address 115.3.6.12 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#interface GigabitEthernet 0/1
R1(config-if)#ip address 1.1.1.1 255.255.255.0
R1(config-if)#no shutdown
R1#write

R2

Router>enable
Router#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R2
R2(config)#interface GigabitEthernet 0/1
R2(config-if)#ip address 1.1.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#interface GigabitEthernet 0/0
R2(config-if)#ip address 2.2.2.1 255.255.255.0
R2(config-if)#no shutdown
R2#write

R3

Router>enable
Router#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R3
R3(config)#interface GigabitEthernet 0/1
R3(config-if)#ip address 2.2.2.2 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#interface GigabitEthernet 0/0
R3(config-if)#ip address 3.3.3.1 255.255.255.0
R3(config-if)#no shutdown
R3#write

R4

Router>enable
Router#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#hostname R4
R4(config)#interface GigabitEthernet 0/1
R4(config-if)#ip address 3.3.3.2 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#interface GigabitEthernet 0/0
R4(config-if)#ip address 10.20.3.254 255.255.255.0
R4(config-if)#no shutdown
R4#write

2. Routing

rip dynamic routing protocol

The rip protocol is enabled on the company's intranet
And declare all the routing entries carried by R2, R3 and R4 routers themselves.

R2(config)#router rip
R2(config-router)#version 2
R2(config-router)#network 1.1.1.0
R2(config-router)#network 2.2.2.0

R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#network 2.2.2.0
R3(config-router)#network 3.3.3.0

R4(config)#router rip
R4(config-router)#version 2
R4(config-router)#network 3.3.3.0
R4(config-router)#network 10.20.3.0

Define internal and external networks on the border router：

R2(config)#interface GigabitEthernet 0/0
R2(config-if)#ip nat outside
R2(config-if)#interface GigabitEthernet 0/1
R2(config-if)#ip nat inside

Decentralize defaults:

Enter the relevant routing protocol (i.e., the enabled routing protocol) on the border router, and drop the default route
(If static, all other routers must write a default route with an outgoing interface pointing to the outside network)

R2(config-if)#router rip
R2(config-router)#default-information originate

3. Port Mapping

Use port mapping to translate public network addresses to private network addresses

R2(config)#ip nat inside source list 1 interface GigabitEthernet 0/0 overload

4. Cicso Switch Models

SW1>enable
Password: 
SW1#disable
SW1>

SW1>enable
Password: 
SW1#config terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#^Z/end/exit/
SW1#
%SYS-5-CONFIG_I: Configured from console by console

SW1#config terminal
SW1(config)#interface GigabitEthernet 0/1
SW1(config-if)#^Z/end
SW1#

SW1(config)#interface GigabitEthernet 0/1
SW1(config-if)#exit

5. Authentication

5.1 Login & Login local

login is to enable remote login password authentication, login local not only requires a password, but also requires a username.

If both login and login local are set, login local is valid.

I. Setting the console password

Router(config)#line console 0
Router(config-line)#password 1234

II:Setting Global Password

Router(config)#enable secret 1234

III. Setting the remote login (telnet) password

Router(config)#line vty 0 4	// Set the number of remote connections, allowing five connections from 0 to 4.
Router(config-line)#password 1234
Router(config-line)#login	// Enable remote login password authentication.

login means to enable remote login (telnet) password authentication, if you don't use login, then the remote login is directly logged in, even if you have already set the remote login password, it will not ask for password authentication

IV. Setting the remote login (telnet) user name and password

Router(config)#enable password 123456
Router(config)#username xxx secret 123456
Router(config)#line vty 0 4
Router(config-line)#login local

V. set the user name and password remote (telnet) login directly after the special privileges

Router(config)#username xxx privilege 15 secret 123456
Router(config)#line vty 0 4
Router(config-line)#login local

6. Login

Ⅰ startup-config

Save the running configuration of the current device to flash so that the system can be restored to the current configuration after the next reboot.

Save the configured settings to the startup configuration file:

In the privileged execution mode of the switch, enter the following command to save the configured settings to the startup configuration file:

copy running-config startup-config

Ⅱ Authentication

Configure the password on the console, Telnet, and SSH lines, and enter password line configuration mode:

line [line-name]
password [password][encrypted]

The options are:

password - Specifies the password for the line. The length ranges from 0 to 159 characters.
encrypted - (Optional) Specifies that the password is encrypted and copied from another device configuration.

no password // Resets the line password to the default password.

When you configure a new enable password, that password is automatically encrypted and saved to the running configuration file. Regardless of how the password is entered, it is displayed in the running configuration file with the keywords encrypted and encrypted password.

To configure a local password for a specific user access level on the switch, enter the following command:

enable password [level privilege-level] [unencrypted-password | encrypted encrypted-password]

The options are:

level privilege-level - Specifies the level at which the password is applied. The level ranges from 1 to 15; if not specified, the level is set to the default value of 15.

The user levels are as follows:

• Read-only CLI access (1) - The user does not have access to the GUI and can only access CLI commands that do not change the device configuration.

• Read/Limited Write CLI Access (7) - The user does not have access to the GUI and can only access certain CLI commands that change the device configuration. For more information, see the CLI Reference Guide.

• read/write administrative access(15) - The user has access to the GUI and can configure the device.

unencrypted-password - The password for the username you are currently using. The length ranges from 0 to 159 characters.

enable password level Cisco123$

encrypted encrypted-password - Specifies that the password is encrypted. You can use this command to enter a password that has been encrypted from another profile on another device. This will allow you to configure both switches with the same password.

enable password encrypted 6f43205030a2f3a1e243873007370fab

no enable password // To restore the user password to the default password