Escenario de troubleshooting
de WiFi para CCNA3
Fecha: 6/6/2013
Escenario para Packet Tracer (disponible en ftp://ftp.vilarrasa.com.ar/ user y pass:
ccna archivo WiFi CCNA3.pka)
En este escenario se debe realizar un
troubleshooting tanto de WiFi, corrigiendo o ajustando canales,
nombres de SSID, claves WPA, etc, como problemas de
VLANs y varios mas de networking.
Configuración del AP de 2do piso: se configuró clave WPA-2,
canal 1 y SSID.
Configuración del AP de invitados en 2do piso:
Se configuró clave WPA-2, SSID y canal 6 (el otro AP
del piso es canal 1).
Configuración del AP de 1er piso:
Se configuró clave WPA-2, canal 11 y SSID
Configuración del AP de invitados en 1er piso:
Se configuró clave WPA-2, SSID y canal 6 (el otro AP
del piso es canal 11).
Configuración del AP de 1er piso:
Se configuró clave WPA-2, canal 1 y SSID (los AP mas
cercanos son canal 6 y 11)
Configuración de equipos
Switch#conf t
Switch(config)#hostname Sw_2doPiso
Sw_2doPiso(config)#int vlan 1
Sw_2doPiso(config-if)#no shut
Sw_2doPiso(config-if)#ip add 192.168.1.1
255.255.255.0
Sw_2doPiso(config-if)#desc IP administrativa
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#int vlan 10
Sw_2doPiso(config-if)#ip add 192.168.10.1
255.255.255.0
Sw_2doPiso(config-if)#desc WiFi PtaBaja
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#int vlan 50
Sw_2doPiso(config-if)#ip add 192.168.50.1
255.255.255.0
Sw_2doPiso(config-if)#desc WiFi Invitados
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#int vlan 100
Sw_2doPiso(config-if)#ip add 192.168.100.1
255.255.255.0
Sw_2doPiso(config-if)#desc WiFi 1erPiso
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#int vlan 200
Sw_2doPiso(config-if)#ip add 192.168.200.1
255.255.255.0
Sw_2doPiso(config-if)#desc WiFi 2doPiso
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#vlan 10
Sw_2doPiso(config-vlan)#name WiFiPB
Sw_2doPiso(config-vlan)#exit
Sw_2doPiso(config)#vlan 50
Sw_2doPiso(config-vlan)#name Invitados
Sw_2doPiso(config-vlan)#exit
Sw_2doPiso(config)#vlan 100
Sw_2doPiso(config-vlan)#name WiFi1P
Sw_2doPiso(config-vlan)#exit
Sw_2doPiso(config)#vlan 200
Sw_2doPiso(config-vlan)#name WiFi2P
Sw_2doPiso(config-vlan)#exit
Sw_2doPiso(config)#vtp domain WiFi
Changing VTP domain name from NULL to WiFi
Sw_2doPiso(config)#vtp pass WiFi
Setting device VLAN database password to WiFi
Sw_2doPiso(config)#int range Gi0/1-2
Sw_2doPiso(config-if-range)#switchport mode
access
Sw_2doPiso(config-if-range)#switchport mode trunk
Sw_2doPiso(config-if-range)#exit
Sw_2doPiso(config)#spanning-tree vlan
1,10,50,100,200 priority 4096
Sw_2doPiso(config)#spanning-tree mode rapid-pvst
Sw_2doPiso(config)#int fa0/4
Sw_2doPiso(config-if)#switchport mode access
Sw_2doPiso(config-if)#switchport access vlan 50
Sw_2doPiso(config-if)#spanning-tree portfast
Sw_2doPiso(config-if)#switchport port-security
Sw_2doPiso(config-if)#switchport port-security
maximum 10
Sw_2doPiso(config-if)#exit
Sw_2doPiso(config)#int fa0/11
Sw_2doPiso(config-if)#switchport mode access
Sw_2doPiso(config-if)#switchport access vlan 200
Sw_2doPiso(config-if)#switchport port-security
Sw_2doPiso(config-if)#switchport port-security
maximum 4
Sw_2doPiso(config-if)#switchport port-security
mac-address sticky
SW_1erPiso(config-if)#spanning-tree portfast
Sw_2doPiso(config-if)#end
Sw_2doPiso#
Switch#conf t
Switch(config)#host SW_1erPiso
SW_1erPiso(config)#int range gi1/1-2
SW_1erPiso(config-if-range)#sw mode trunk
SW_1erPiso(config-if-range)#exit
SW_1erPiso(config)#spanning-tree mode rapid-pvst
SW_1erPiso(config)#vtp mode client
Setting device to VTP CLIENT mode.
SW_1erPiso(config)#vtp domain WiFi
Domain name already set to WiFi.
SW_1erPiso(config)#vtp pass WiFi
Setting device VLAN database password to WiFi
SW_1erPiso(config)#int fa0/18
SW_1erPiso(config-if)#sw mode access
SW_1erPiso(config-if)#sw access vlan 50
SW_1erPiso(config-if)#spanning-tree portfast
SW_1erPiso(config-if)#sw port-security
SW_1erPiso(config-if)#sw port-security maximum 10
SW_1erPiso(config-if)#exit
SW_1erPiso(config)#int fa0/5
SW_1erPiso(config-if)#sw mode access
SW_1erPiso(config-if)#sw access vlan 100
SW_1erPiso(config-if)#sw port-security maximum 2
SW_1erPiso(config-if)#sw port-security
mac-address sticky
SW_1erPiso(config-if)#spanning-tree portfast
SW_1erPiso(config-if)#^Z
SW_1erPiso#
Switch#conf t
Switch (config)#hostname SW_PtaBaja
SW_PtaBaja(config)#int range gi1/1-2
SW_PtaBaja(config-if-range)#sw mode trunk
SW_PtaBaja(config-if-range)#exit
SW_PtaBaja(config)#spanning-tree mode rapid-pvst
SW_PtaBaja(config)#vtp mode client
Setting device to VTP CLIENT mode.
SW_PtaBaja(config)#vtp domain WiFi
Domain name already set to WiFi.
SW_PtaBaja(config)#vtp password WiFi
Setting device VLAN database password to WiFi
SW_PtaBaja(config)#int fa0/16
SW_PtaBaja(config-if)#sw mode access
SW_PtaBaja(config-if)#sw access vlan 10
SW_PtaBaja(config-if)#sw port-security
SW_PtaBaja(config-if)#sw port-security maximum 3
SW_PtaBaja(config-if)#sw port-security mac sticky
SW_PtaBaja(config-if)#spanning-tree portfast
SW_PtaBaja(config-if)#end
SW_PtaBaja#
Configuración de enrutamiento
Sw_2doPiso#conf t
Sw_2doPiso(config)#ip routing
Sw_2doPiso(config)#ip route 0.0.0.0 0.0.0.0
192.168.1.254
Sw_2doPiso(config)#end
Sw_2doPiso#
Gateway#conf t
Gateway(config)#ip route 192.168.0.0 255.255.0.0
192.168.1.1
Gateway(config)#^Z
Gateway#
Escenario terminado
Ahora cada PC se conecta al AP correspondiente, también
se verifica conectividad STP y routing.
Prueba en PC de 2do Piso
Prueba de PC de invitados en 2do Piso
Verificación de la VLAN invitados
PC>ipconfig
IP Address......................: 192.168.50.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.50.1
PC>ping 200.0.0.1
Pinging 200.0.0.1 with 32 bytes of data:
Reply from 200.0.0.1: bytes=32 time=205ms TTL=126
Reply from 200.0.0.1: bytes=32 time=188ms TTL=126
Reply from 200.0.0.1: bytes=32 time=185ms TTL=126
Reply from 200.0.0.1: bytes=32 time=172ms TTL=126
Ping statistics for 200.0.0.1:
Packets:
Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum =
172ms, Maximum = 205ms, Average = 187ms
PC>
Verificación de la VLAN PtaBaja
PC>ipconfig
IP Address......................: 192.168.10.3
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.10.1
PC>ping 200.0.0.1
Pinging 200.0.0.1 with 32 bytes of data:
Reply from 200.0.0.1: bytes=32 time=281ms TTL=126
Reply from 200.0.0.1: bytes=32 time=142ms TTL=126
Reply from 200.0.0.1: bytes=32 time=203ms TTL=126
Reply from 200.0.0.1: bytes=32 time=172ms TTL=126
Ping statistics for 200.0.0.1:
Packets:
Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum =
142ms, Maximum = 281ms, Average = 199ms
PC>tracert 200.0.0.1
Tracing route to 200.0.0.1 over a maximum of 30
hops:
1 125 ms
79 ms 94 ms 192.168.10.1
(SW layer 3)
2 141 ms
141 ms 127 ms 192.168.1.254
(Gateway)
3 204 ms
157 ms 187 ms 200.0.0.1
Trace complete.
PC>
Verificación del DHCP en SW layer 3
Sw_2doPiso#sh ip dhcp binding
IP address
Client-ID/ Lease
expiration Type
Hardware address
192.168.200.2
0001.97E8.93A9 -- Automatic (PC 2do Piso)
192.168.200.3
00D0.BC53.C38C -- Automatic (PC 2do Piso)
192.168.200.4
0001.6400.10A9 -- Automatic (PC 2do Piso)
192.168.200.5
00D0.BA62.15C5 -- Automatic (PC 2do Piso)
192.168.100.2
0001.6384.4D70 -- Automatic (PC 1er Piso)
192.168.100.3
0030.A3AB.3420 -- Automatic (PC 1er
Piso)
192.168.10.2
0060.5CC4.CC48 -- Automatic (PC PtaBaja)
192.168.10.3
0040.0B37.E60C -- Automatic (PC PtaBaja)
192.168.10.4
000A.F39E.6459 -- Automatic (PC
PtaBaja)
192.168.50.2
000C.CF22.4E0E -- Automatic (Invitados)
192.168.50.3
0001.64E0.0977 -- Automatic (Invitados)
Sw_2doPiso#
Verificación del Spanning Tree
Sw_2doPiso#sh spanning-tree
VLAN0001
Spanning
tree enabled protocol rstp
Root
ID Priority 4097
Address 000A.F37B.5A3C
This
bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
---resumido---
VLAN0010
Spanning
tree enabled protocol rstp
Root
ID Priority 4106
Address 000A.F37B.5A3C
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
---resumido---
VLAN0050
Spanning
tree enabled protocol rstp
Root
ID Priority 4146
Address 000A.F37B.5A3C
This
bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
---resumido---
VLAN0100
Spanning
tree enabled protocol rstp
Root
ID Priority 4196
Address 000A.F37B.5A3C
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
---resumido---
VLAN0200
Spanning tree
enabled protocol rstp
Root
ID Priority 4296
Address 000A.F37B.5A3C
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
---resumido---
Sw_2doPiso#
Verificación de seguridad en Pta Baja
SW_PtaBaja#sh port-security
Secure Port MaxSecureAddr CurrentAddr
SecurityViolation Security Action
(Count) (Count) (Count)
--------------------------------------------------------------------
Fa0/16 3 3 0
Shutdown
----------------------------------------------------------------------
SW_PtaBaja#sh runn
---resumido---
!
interface FastEthernet0/16
switchport
access vlan 10
switchport
mode access
switchport
port-security
switchport
port-security maximum 3
switchport
port-security mac-address sticky
switchport
port-security mac-address sticky 000A.F39E.6459
switchport
port-security mac-address sticky 0040.0B37.E60C
switchport
port-security mac-address sticky 0060.5CC4.CC48
spanning-tree portfast
!
---resumido---
SW_PtaBaja#
Verificación de seguridad en 1er Piso
SW_1erPiso#sh port-security
Secure Port MaxSecureAddr CurrentAddr
SecurityViolation Security Action
(Count) (Count) (Count)
--------------------------------------------------------------------
Fa0/5 2 2 0
Shutdown
Fa0/18 10 1 0
Shutdown
----------------------------------------------------------------------
SW_1erPiso#
Verificación de seguridad en 2do Piso
Sw_2doPiso#sh port-security (no soportado)
^
% Invalid input detected at '^' marker.
Sw_2doPiso#sh p?
parser policy-map power
privilege processes protocols
Sw_2doPiso#sh runn
---resumido---
!
interface FastEthernet0/11
switchport
access vlan 200
switchport
mode access
switchport
port-security (pero si soporta el comando)
switchport
port-security maximum 4
switchport
port-security mac-address sticky
switchport
port-security mac-address sticky 0001.6400.10A9
switchport
port-security mac-address sticky 0001.97E8.93A9
switchport port-security mac-address sticky
00D0.BA62.15C5
switchport
port-security mac-address sticky 00D0.BC53.C38C
!
---resumido---
Sw_2doPiso#
Sw_2doPiso#sh runn
---resumido---
!
interface FastEthernet0/11
switchport
access vlan 200
switchport
mode access
switchport
port-security
switchport
port-security maximum 4
switchport port-security
mac-address sticky
switchport
port-security mac-address sticky 0001.6400.10A9
switchport
port-security mac-address sticky 0001.97E8.93A9
switchport port-security mac-address sticky
00D0.BA5C.C9B0 (en fin...cosas locas de PT)
switchport
port-security mac-address sticky 00D0.BA62.15C5
switchport
port-security mac-address sticky 00D0.BC53.C38C
!
---resumido---
Sw_2doPiso#
(2013) Networking for lonely nights
Rosario, Argentina