Routing Switching and Security Technology

Cara konfigurasi PPTP VPN

2010-06-30T06:13:00.000-07:00

Sebelum mengkonfigurasi PPTP VPN anda harus meng-enabled kan dulu VPDN (virtual private dial-up networking) berhubung gue menggunakan modem CDMA Smart yang katanya sih udah EVDO malah Rev-A. berikut contohnya

Branch(config)#vpdn enable

Branch(config)#vpdn-group NYAMBUNG-VPN

Branch(config-vpdn)#accept-dialin

Branch(config-vpdn-acc-in)#protocol pptp

Branch(config-vpdn-acc-in)#virtual-template 1

Branch(config-vpdn-acc-in)#exit

Selanjutnya konfigurasi internat network kita atau IP Private trus jangan lupa konfigurasi outside network IP yang didapat dari Modem CDMA Smart biar jadi static IP setting default route disisi outside network interface

Branch(config)#ip route 0.0.0.0 0.0.0.0 interface s0/0

Dengan konfigurasi default route kita gak usah lagi gonta-ganti IP saat connect and disconnected Modem Smart.

Branch(config)#int f1/0

Branch(config-if)#ip address 10.10.10.254 255.255.255.0

Branch(config-if)#no sh

Branch(config-if)#int s0/0

Branch(config-if)#ip address 10.180.35.100 255.255.255.248

Branch(config-if)#no sh

Selanjutnya adalah buat virtual template yang akan diterapkan pada jaringan internal atau IP Private kita. Selain itu kita juga harus men-define IP Pool yang akan di bagikan/ distributed VPN Clients. Dan selanjutnya konfigurasi PPP dengan mekanisme enkripsi dan autentikasi supaya bias digunakan dengan Microsoft VPN Client.

Branch(config-if)#int virtual-template1

Branch(config-if)#ip unnumbered s0/0

Branch(config-if)#peer default ip address pool Smart-VPN

Branch(config-if)#ppp encrypt mppe auto required

Branch(config-if)#ppp authentication ms-chap ms-chap-v2

Terus selanjutnya konfigurasi nama IP Pool, and jangan didefine atau digunakan dlm jaringan internal network.

Branch(config-if)#ip local pool Smart-VPN 10.10.10.1 10.10.10.10

Selanjutnya buat user connection coz gue pake OS windows caranya simple buangeet and konfigurasi terakhir adalah konfigurasi autentikasi PPP bias menggunakan local database kayak di mikrotik atau pake Microsoft IAS Server atau jika menggunakan RADIUS Server arahkan ke database lokalnya.

Branch(config)#username smart password 0 62100055

Branch(config)#aaa new-model

Branch(config)#aaa authentication ppp default local

Good Luck and Better try than never

Note : Jika menggunakan Speedy gunakan ns (name server) dan Local gateway atau bisa menggunakan IP host max 10 host.

Dynamic Routing OSPF Single Area (in bahasa Indonesia)

2010-06-17T07:04:00.000-07:00

Dynamic routing adalah routing protocol yang dugunakan antar router untuk mementukan jalur terbaik ke remote network atau network tujuan dan menjaga (maintain) networknya dalam routing table networks. Dynamic routing OSPF adalah routing protocol link state berbeda dengan routing protocol yang distance vector seperti RIP yang dihitung per hop OSPF ditentukan oleh sebuah nilai cost, meski demikian RIP maupun OSPF adalah Routing protocol Open standard. OSPF menggunakan SPF algoritma. Read more . . .

PPP Authentication Protocol

2010-04-01T18:02:00.000-07:00

PPP defines an extensible LCP that allows negotiation of an authentication protocol for authenticating its peer before allowing Network layer protocols to transmit over the link. RFC 1334 defines two protocols for authentication, as shown in the figure. PAP is a very basic two-way process. There is no encryption-the username and password are sent in plain text. If it is accepted, the connection is allowed. CHAP is more secure than PAP. It involves a three-way exchange of a shared secret. The process is described later in this section. The authentication phase of a PPP session is optional. If used, you can authenticate the peer after the LCP establishes the link and choose the authentication protocol. If it is used, authentication takes place before the Network layer protocol configuration phase begins. The authentication options require that the calling side of the link enter authentication information. This helps to ensure that the user has the permission of the network administrator to make the call. Peer routers exchange authentication messages.

PPP Configuration Options

Authentication - Peer routers exchange authentication messages. Two authentication choices are Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP). Authentication is explained in the next section.
Compression - Increases the effective throughput on PPP connections by reducing the amount of data in the frame that must travel across the link. The protocol decompresses the frame at its destination. Two compression protocols available in Cisco routers are Stacker and Predictor.

Error detection - Identifies fault conditions. The Quality and Magic Number options help ensure a reliable, loop-free data link. The Magic Number field helps in detecting links that are in a looped-back condition. Until the Magic-Number Configuration Option has been successfully negotiated, the Magic-Number must be transmitted as zero. Magic numbers are generated randomly at each end of the connection.
Multilink - Cisco IOS Release 11.1 and later supports multilink PPP. This alternative provides load balancing over the router interfaces that PPP uses. Multilink PPP (also referred to as MP, MPPP, MLP, or Multilink) provides a method for spreading traffic across multiple physical WAN links while providing packet fragmentation and reassembly, proper sequencing, multivendor interoperability, and load balancing on inbound and outbound traffic. Multilink is not covered in this course.
PPP Callback - To enhance security, Cisco IOS Release 11.1 and later offers callback over PPP. With this LCP option, a Cisco router can act as a callback client or a callback server. The client makes the initial call, requests that the server call it back, and terminates its initial call. The callback router answers the initial call and makes the return call to the client based on its configuration statements. The command is ppp callback [accept | request].

IPIP Tunneling

2009-10-18T07:32:00.000-07:00

Tunneling adalah cara membungkus paket IP ke dalam paket IP yang lain. Atau koneksi antara private network yang dipisahkan oleh jarak dan letak geografis melalui jaringan intermediate atau ISP. Beberapa hal yang bisa kita lakukan pada jaringan dengan menggunakan IPIP Tunneling adalah :

- Untuk Tunneling Intranet melalui Internet.

- Untuk menggunakan IPIP Tunneling diperlukan source routing

- Kelemahannya adalah Tidak bisa digunakan untuk Bridging Network.

Dalam pembahasan tulisan ini akan dicontohkan konfigurasi IPIP Tunnel menggunakan Cisco Router 2800 Series, dalam topology network dicontohkan Router Brisbane seolah –olah terkoneksi langsung ke Router Jogja. Menggunakan private network IPIP Tunnel 10.10.10.0/24. Dalam simulasi ini dapat digunakan tool Network Simulator Packet tracer 5.2 dari Cisco. Dalam contoh ini router ISP/Cloud dikonfigurasi Dynamic Routing RIPv2 sebagai gateway Internet/Outside Network tiap router client (Brisbane dan Jogja) dialokasikan 1 IP public, sehingga kedua client router baik router Brisbane atau pun jogja akan menggunakan default routing untuk akses ke outside network.

Konfigurasi Router ISP/Cloud

Router>en
Router#config t
Router(config)#hostname ISP
ISP(config)#int s1/1
ISP(config-if)#ip add 202.201.100.1 255.255.255.252
ISP(config-if)#clock rate 64000
ISP(config-if)#no sh
ISP(config-if)#int s1/2
ISP(config-if)#ip add 118.98.216.5 255.255.255.252
ISP(config-if)#clock rate 64000
ISP(config-if)#no sh
ISP(config-if)#router rip
ISP(config-router)#network 202.201.100.0
ISP(config-router)#network 118.98.216.4
ISP(config-router)#version 2
ISP(config-router)#no auto-summary
ISP(config-router)#exit

Konfigurasi Router Brisbane

Router>en
Router#config t
Router(config)#hostname Brisbane
Brisbane(config)#int f0/0
Brisbane(config-if)#ip add 192.168.10.1 255.255.255.0
Brisbane(config-if)#no sh
Brisbane(config-if)#int s1/0
Brisbane(config-if)#ip add 202.201.100.2 255.255.255.252
Brisbane(config-if)#no sh
Brisbane#en
Brisbane#config t
Brisbane(config)#int tunnel0
Brisbane(config-if)#ip add 10.10.10.1 255.255.255.0
Brisbane(config-if)#tunnel source s1/0
Brisbane(config-if)#tunnel destination 118.98.216.6
Brisbane(config-if)#ip route 0.0.0.0 0.0.0.0 10.10.10.2
Brisbane(config)#exit
Brisbane#
Brisbane#config t
Brisbane(config)#ip route 0.0.0.0 0.0.0.0 202.201.100.1

Konfigurasi Router Jogja

Router>en
Router#config t
Router(config)#hostname Jogja
Jogja(config)#int f0/0
Jogja(config-if)#ip add 192.168.100.1 255.255.255.0
Jogja(config-if)#no sh
Jogja(config-if)#int s1/0
Jogja(config-if)#ip add 118.98.216.6 255.255.255.252
Jogja(config-if)#no sh
Jogja>en
Jogja#config t
Jogja(config)#int tunnel0
Jogja(config-if)#
Jogja(config-if)#ip add 10.10.10.2 255.255.255.0
Jogja(config-if)#tunnel source s1/0
Jogja(config-if)#tunnel destination 202.201.100.2
Jogja(config-if)#ip route 0.0.0.0 0.0.0.0 10.10.10.1
Jogja(config)#exit
Jogja#
Jogja#config t
Jogja(config)#ip route 0.0.0.0 0.0.0.0 118.98.216.5

Selamat mencoba ! ! !

NAT dan PAT untuk security

2009-06-30T18:22:00.000-07:00

NAT adalah sebuah fungsi router yang memetakan alamat IP private (Lokal) ke alamat IP yang dikenaldi Internet, sehingga jaringan private bisa internetan. NAT juga berfungsi sebagai IP masquerading dan demilitarized zone (DMZ) untuk pengamanan seperti web server dan email server sehingga Private IP dapat diakses dari luar jaringan seperti internet. Teknik ini biasa disebut dengan Port Address Translation (PAT). Berikut adalah command line mengaktifkan NAT dan PAT pada cisco Router

Router>en
Router#confg t
Router-Client(config)#access-list 2 permit 192.168.100.10 0.0.0.255
Router-Client(config)#ip nat inside source list 2 int s1/0 overload
Router-Client(config)#int f0/0
Router-Client(config-if)#ip nat inside
Router-Client(config-if)#int s1/0
Router-Client(config-if)#ip nat outside
Router-Client(config-if)#exit
Router-Client(config)#ip nat inside source static tcp 192.168.100.200 80 202.201.100.70 80
Router-Client(config)#exit

Perintah untuk mengaktifkan port redirection bisa berbeda-beda tergantung versi IOS pada router yang digunakan Cisco 1700 series dan 2600 bisa menggunakan perintah berikut
Router-Client(config)#ip nat inside source static tcp 192.168.100.200 80 interface s1/0 80
Sehingga dengan mengaktifkan perintah diatas ke interface public atau s1/0 80 sebagai outside network akan diredirect ke IP real web server dalam inside network yang menggunakan alamat IP private.

Download File Packet Tracer 5.0
Download Konfigurasi

Configuring Equal Multi-Path Routing ECMP

2009-06-29T19:41:00.000-07:00

Equal Cost Multi-path Routing (ECMP)
The routing protocols may create multipath static routes with equal cost manually, if the cost of the interfaces is adjusted properly. So by adding a static route with multiple gateways, separated by a comma “,” For Instance ( /ip route add gateway=203.100.96.1,202.157.125.1)
OK to the point wae ….. ^_^
Consider the situation above where we have to route packets from the network 192.168.150.0/24 to 2 gateways - 203.100.96.1 and 202.157.125.1.

Note that the SATNET ISP's gives us 1Mbps and INTERSAT - 2Mbps so we want a traffic ratio 1:2 (1/3 of the source/destination IP pairs from 192.168.150.0/24 goes through SATNET, and 2/3 through INTERSAT).

IP addresses of the router:

[admin@nyobo2] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.159.254/24 192.168.150.0 192.168.0.255 Local
1 203.100.96.2/29 203.100.96.0 203.100.96.7 Satnet
2 202.157.125.2/29 202.157.125.0 202.157.125.7 Intersat
[admin@nyobo2] ip address>

Add the default routes - one for SATNET and 2 for INTERSAT so we can get the ratio 1:3

[admin@nyobo2] ip route> add gateway=203.100.96.1,202.157.125.1,202.157.125.1
[admin@nyobo2] ip route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf
# DST-ADDRESS G GATEWAY DISTANCE INTERFACE
0 ADC 203.100.96.0/29 Satnet
1 ADC 202.157.125.0/29 Intersat
2 ADC 192.168.150.0/24 Local
3 A S 0.0.0.0/0 r 203.100.96.1 Satnet
r 202.157.125.1 Intersat
r 202.157.125.1 Intersat
[admin@nyobo2] ip route>

On Cisco Router
CiscoPertamina>en
CiscoPertamina#config t
CiscoPertamina(config)#ip route 0.0.0.0 0.0.0.0 203.100.96.1 10
CiscoPertamina(config)#ip route 0.0.0.0 0.0.0.0 202.157.125.1 100
CiscoPertamina(config)#exit

10 AD for Satnet Default Static Route AD= 1
100 AD for Intersat
Or you may set higher value as needed

QoS and Port Security on VLAN Network

2009-06-19T22:18:00.001-07:00

Note hanya conth BUKAN IP Public Sebenarnya
Switch>en
Switch#vlan database
Switch(vlan)#vlan 2 name PERTAMINA
Switch(vlan)#vlan 3 name EXXON
Switch(vlan)#vlan 4 name HOTSPOT-SEDAYU
Switch(vlan)#exit
APPLY completed.
Exiting....
Switch#config t
Switch(config)#int f0/1
Switch(config-if)#switchport mode trunk
Switch(config-if)#end
Switch#config t
Switch(config)#int f0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 2
Switch(config-if)#int f0/3
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 3
Switch(config-if)#int f0/4
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 4
Switch(config-if)#end
Switch#config t
Switch(config)#int vlan 1
Switch(config-if)#ip add 192.168.1.2 255.255.255.0
Switch(config-if)#no shut
Switch(config-if)#exit
Switch(config)#ip default-gateway 192.168.1.1
Switch(config)#end

Konfigurasi Port Security on VLAN 2
Switch#config t
Switch(config)#int f0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security mac-address sticky
Switch(config-if)#switchport port-security max 4
Switch(config-if)#switchport port-security violation shutdown
Switch(config-if)#ex
Switch(config)#end
Switch#

Router>en
Router#config t
Router(config)#hostname Router-PERTAMINA
Router-PERTAMINA(config)#enable password test
Router-PERTAMINA(config)#line con 0
Router-PERTAMINA(config-line)#password test
Router-PERTAMINA(config-line)#login
Router-PERTAMINA(config-line)#exit
Router-PERTAMINA(config)#line vty 0 4
Router-PERTAMINA(config-line)#password test
Router-PERTAMINA(config-line)#login
Router-PERTAMINA(config-line)#exit
Router-PERTAMINA(config)#exit
Router-PERTAMINA(config)#int f0/0
Router-PERTAMINA(config-if)#no sh
Router-PERTAMINA(config-if)#int f0/0.1
Router-PERTAMIN(config-subif)#encapsulation dot1q 1
Router-PERTAMIN(config-subif)#ip add 192.168.1.1 255.255.255.0
Router-PERTAMIN(config-subif)#int f0/0.2
Router-PERTAMIN(config-subif)#encapsulation dot1q 2
Router-PERTAMIN(config-subif)#ip add 192.168.2.1 255.255.255.0
Router-PERTAMIN(config-subif)#int f0/0.3
Router-PERTAMIN(config-subif)#encapsulation dot1q 3
Router-PERTAMIN(config-subif)#ip add 192.168.3.1 255.255.255.0
Router-PERTAMIN(config-subif)#int f0/0.4
Router-PERTAMIN(config-subif)#encapsulation dot1q 4
Router-PERTAMIN(config-subif)#ip add 192.168.4.1 255.255.255.0
Router-PERTAMIN(config-subif)#exit

Konfigurasi DHCP Network masing2 VLAN
Router-PERTAMINA#config t
Router-PERTAMINA(config)#int f0/0.2
Router-PERTAMIN(config-subif)#ip dhcp pool PERTAMINA
Router-PERTAMINA(dhcp-config)#network 192.168.2.0 255.255.255.0
Router-PERTAMINA(dhcp-config)#default-router 192.168.2.1
Router-PERTAMINA(dhcp-config)#dns-server 124.195.15.100
Router-PERTAMINA(dhcp-config)#ip dhcp excluded-address 192.168.2.100 192.168.2.200
Router-PERTAMINA(config)#int f0/0.3
Router-PERTAMIN(config-subif)#ip dhcp pool EXXON
Router-PERTAMINA(dhcp-config)#network 192.168.3.0 255.255.255.0
Router-PERTAMINA(dhcp-config)#default-router 192.168.3.1
Router-PERTAMINA(dhcp-config)#dns-server 124.195.15.100
Router-PERTAMINA(dhcp-config)#ip dhcp excluded-address 192.168.3.100 192.168.3.200
Router-PERTAMINA(config)#int f0/0.4
Router-PERTAMIN(config-subif)#ip dhcp pool HOTSPOT-SEDAYU
Router-PERTAMINA(dhcp-config)#network 192.168.4.0 255.255.255.0
Router-PERTAMINA(dhcp-config)#default-router 192.168.4.1
Router-PERTAMINA(dhcp-config)#dns-server 124.195.15.100
Router-PERTAMINA(dhcp-config)#ip dhcp excluded-address 192.168.4.100 192.168.4.200
Router-PERTAMINA(config)#exit

Mengaktifkan Dynamic Routing RiP
Router-PERTAMINA#config t
Router-PERTAMINA(config)#int s1/0
Router-PERTAMINA(config-if)#ip add 202.100.156.10 255.255.255.248
Router-PERTAMINA(config-if)#no sh
Router-PERTAMINA(config-if)#ex
Router-PERTAMINA(config-if)#router rip
Router-PERTAMI(config-router)#network 202.100.156.0
Router-PERTAMI(config-router)#exit
Router-PERTAMINA(config)#ex
Router-PERTAMINA#ping 202.100.156.9

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.156.9, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 17/31/47 ms

Router-PERTAMINA#
Router-PERTAMINA#config t
Router-PERTAMINA(config)#access-list 123 deny tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq 23
Router-PERTAMINA(config)#access-list 123 deny tcp 192.168.2.0 0.0.0.255 host 202.100.156.10 eq 23
Router-PERTAMINA(config)#access-list 123 permit ip any any
Router-PERTAMINA(config)#int f0/0
Router-PERTAMINA(config-if)#no shut
Router-PERTAMINA(config-if)#int f0/0.2
Router-PERTAMIN(config-subif)#ip access-group 123 in
Router-PERTAMIN(config-subif)#exit
Router-PERTAMINA(config)#

Konfigurasi QoS
Password:

Router-PERTAMINA>en
Password:
Router-PERTAMINA#config t
Router-PERTAMINA(config)#router rip
Router-PERTAMI(config-router)#distance 80
Router-PERTAMI(config-router)#exit
Router-PERTAMINA(config)#ex

Router ISP Di konfigurasi hanya sebagai gateway
atau koneksi Back to Back dlm Packet Tracer
ISP>en
Router>en
Router#config t
Router(config)#hostname ISP
ISP(config)#enable password test
ISP(config)#line vty 04
ISP(config-line)#password test
ISP(config-line)#login
ISP(config-line)#exit
ISP(config)#int s1/0
ISP#config t
ISP(config)#int s1/0
ISP(config-if)#ip add 202.100.156.9 255.255.255.248
ISP(config-if)#clock rate 64000
ISP(config-if)#bandwidth 2048
ISP(config-if)#no shut
ISP(config-if)#router rip
ISP(config-router)#network 202.100.156.0
ISP(config-router)#exit
ISP(config)#

=====================================================================================================================================
Show Running Config
Router-PERTAMINA#sh run
Building configuration...

Current configuration : 1630 bytes
!
version 12.2
no service password-encryption
!
hostname Router-PERTAMINA
!
!
enable password test
!
!
!
!
ip ssh version 1
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation dot1Q 1 native
ip address 192.168.1.1 255.255.255.0
!
interface FastEthernet0/0.2
encapsulation dot1Q 2
ip address 192.168.2.1 255.255.255.0
ip access-group 123 in
!
interface FastEthernet0/0.3
encapsulation dot1Q 3
ip address 192.168.3.1 255.255.255.0
!
interface FastEthernet0/0.4
encapsulation dot1Q 4
ip address 192.168.4.1 255.255.255.0
!
interface Serial1/0
ip address 202.100.156.10 255.255.255.248
!
interface Serial1/1
no ip address
shutdown
!
interface Serial1/2
no ip address
shutdown
!
interface Serial1/3
no ip address
shutdown
!
router rip
network 202.100.156.0
distance 80
!
ip classless
!
!
access-list 123 deny tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq telnet
access-list 123 deny tcp 192.168.2.0 0.0.0.255 host 202.100.156.10 eq telnet
access-list 123 permit ip any any
!
ip dhcp excluded-address 192.168.2.100 192.168.2.200
ip dhcp excluded-address 192.168.3.100 192.168.3.200
ip dhcp excluded-address 192.168.4.100 192.168.4.200
!
ip dhcp pool PERTAMINA
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
dns-server 124.195.15.100
ip dhcp pool EXXON
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
dns-server 124.195.15.100
ip dhcp pool HOTSPOT-SEDAYU
network 192.168.4.0 255.255.255.0
default-router 192.168.4.1
dns-server 124.195.15.100
!
line con 0
password test
login
line vty 0 4
password test
login
!
!
end

====================================================================================================================================

Show Running Config
Switch>en
Switch#sh run
Building configuration...

Current configuration : 1430 bytes
!
version 12.1
no service password-encryption
!
hostname Switch
!
!
!
interface FastEthernet0/1
switchport mode trunk
!
interface FastEthernet0/2
switchport access vlan 2
switchport mode access
switchport port-security
switchport port-security maximum 4
switchport port-security mac-address sticky
switchport port-security mac-address sticky 0001.64D2.3070
switchport port-security mac-address sticky 0005.5E31.73AA
switchport port-security mac-address sticky 0005.5EA2.B990
switchport port-security mac-address sticky 00D0.FFB4.36D0
!
interface FastEthernet0/3
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/4
switchport access vlan 4
switchport mode access
!
More .......!
!
interface Vlan1
ip address 192.168.1.2 255.255.255.0
!
ip default-gateway 192.168.1.1
!
line con 0
!
line vty 0 4
login
line vty 5 15
login
!
!
end

Switch#
Switch#sh vlan

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/22, Fa0/23, Fa0/24
2 PERTAMINA active Fa0/2
3 EXXON active Fa0/3
4 HOTSPOT-SEDAYU active Fa0/4
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 0 0
2 enet 100002 1500 - - - - - 0 0
3 enet 100003 1500 - - - - - 0 0
4 enet 100004 1500 - - - - - 0 0
1002 enet 101002 1500 - - - - - 0 0
1003 enet 101003 1500 - - - - - 0 0
1004 enet 101004 1500 - - - - - 0 0
1005 enet 101005 1500 - - - - - 0 0

Download file untuk latihan Packet tracert

Konfigurasi Fail Over dan DHCP Server di MikroTik Router OS

2009-03-26T05:24:00.000-07:00

Jika kita punya 2 koneksi internet atau WAN misalnya ISP 1 Indosat dan ISP2 JARDIKNAS, maka kita bisa mengkonfigurasi fail over . Fail over adalah teknik membackup koneksi internet dalam arti misalnya koneksi dari ISP 1 down maka koneksi akan secara otomatis pindah ke ISP2 dan sebaliknya, tetapi jika ISP 1 up lagi maka koneksi akan berpindah ke ISP 1 atau bisa keduanya. Jika di setup priority koneksi misalnya ISP 1 sebagai priority dan ISP2 sebagai backup atau 1:4 maka ISP 1 akan dijadikan priority sebagi koneksi ke internet.Ok sekarang kita langsung saja konfigurasi failover diasumsikan topologinya seperti gambar diatas :
Setting Interface
/interface
set ether1 name=LAN
set ether2 name=Indosat
set ether3 name=Jardiknas
Setting IP Address
/ip address
add address=202.201.100.1 netmask=255.255.255.0 interface=LAN comment=”” disabled=no
add address=202.200.36.70 netmask=255.255.255.248 interface=Indosat comment=”” disabled=no
add address=10.13.15.18 netmask=255.255.255.252 interface=Jardiknas comment=”” disabled=no

Setting Mangle untuk konsep NTH dan mark packet
/ip firewall mangle
add chain=prerouting in-interface=LAN connection-state=new nth=1,1,0 action=mark-connection new-connection-mark=Koneksi1 passthrough=yes comment=”” disabled-no
add chain=prerouting in-interface=LAN connection-mark=Koneksi1 action=mark-routing new-routing-mark=Koneksi1 paathrough=no comment=”” disabled=no
add chain=prerouting in-interface=LAN connection-state=new nth=1,1,1 action=mark-connection new-connection-mark=Koneksi2 passthrough=yes comment=”” disabled-no
add chain=prerouting in-interface=LAN connection-mark=Koneksi2 action=mark-routing new-routing-mark=Koneksi2 paathrough=no comment=”” disabled=no
Setting IP Firewall NAT Table Koneksi 1 dan Koneksi 2
/ip firewall nat
add chain=srcnat connection-mark=Koneksi1 action=src-nat to-address=202.200.36.70 to-ports=0-65535 comment=”” disabled=no
add chain=srcnat connection-mark=Koneksi2 action=src-nat to-address=10.13.15.18 to-ports=0-65535 comment=”” disabled=no
Setting IP Route Koneksi1 dan Koneksi2
/ip route
add dst-address=0.0.0.0/0 gateway=10.13.15.17 scope=255 target-scope=10 routing-mark=Koneksi2 comment=”” disabled=no
add dst-address=0.0.0.0/0 gateway=202.200.36.69 scope=255 target-scope=10 routing-mark=Koneksi1 comment=”” disabled=no
add dst-address=0.0.0.0/0 gateway=202.200.36.69 scope=255 target-scope=10 routing-mark=Koneksi1 comment=”” disabled=no
add dst-address=0.0.0.0/0 gateway=202.200.36.69 scope=255 target-scope=10 comment=”” disabled=no >>> diset sebagai default routing
Konfigurasi DHCP Server (Dynamic Host Configuration Protocol)
Jika kita menginginkan client mendapatkan IP address secara otomatis maka perlu kita setup dhcp server pada Mikrotik. Berikut langkah-langkahnya :

Tambahkan IP address pool
/ip pool add name=dhcp-pool ranges=202.201.100.2-202.201.100.254

Tambahkan DHCP Network dan gatewaynya yang akan didistribusikan ke client.Pada contoh ini networknya adalah 202.201.100.0/24 dan gatewaynya 202.201.100.1
/ip dhcp-server network add address=202.201.100.0/24 gateway=202.201.100.1 dns-server=202.201.100.1 comment=”"

Tambahkan DHCP Server ( pada contoh ini dhcp diterapkan pada interface LAN )
/ip dhcp-server add interface=LAN address-pool=dhcp-pool

Untuk cek status DHCP server
[admin@nurwajianto] > ip dhcp-server print
Flags: X - disabled, I - invalid
# NAME INTERFACE RELAY ADDRESS-POOL LEASE-TIME ADD-ARP 0dhcp1 Local

Tanda X menyatakan bahwa DHCP server belum enable.
Untuk mengaktifkan DHCP Server dengan mengetikan perintah berikut
/ip dhcp-server enable 0

kemudian cek kembali dhcp-server seperti langkah 4, jika tanda X sudah tidak ada berarti sudah aktif. Dengan konfigurasi DHCP maka setiap client yang akan mendapatkan IP address secara otomatis.

Good luck and better try than never

Download Selengkapnya
Konfigurasi Fail Over dan DHCP Server di MikroTik Router OS.pdf

Membangun Lab. Komputer dengan VLAN

2009-02-03T14:12:00.001-08:00

Pengertian virtual local area network (VLAN) adalah metode untuk menciptakan jaringan-jaringan yang secara logika tersusun sendiri-sendiri. VLAN sendiri berada dalam jaringan Local Area Network (LAN), sehingga dalam jaringan (LAN) bisa terdapat satu atau lebih VLAN. Dengan demikian kita dapat mengambil kesimpulan bahwa dalam dalam suatu jaringan, kita dapat membuat lagi satu atau lebih jaringan (jaringan di dalam jaringan). Beberapa manfaat VLAN adalah Performance, VLAN mampu mengurangi jumlah data yang dikirim ke tujuan yang tidak perlu. Sehingga lalu lintas data yang terjadi di jaringan tersebut dengan sendirinya akan berkurang. Dalam contoh konfigurasi berikut kita ambil contoh konfigursi VLAN untuk lab sekolah atau perguruan tinggi seperti gambar topologi diatas. Diasumsikan menggunakan Cisco Router 2600 series.

Routing protocol dynamic : RIP version 2

Internet IP address : 202.201.93.70

Gateway : 202.201.93.69

DNS : 124.195.15.100

VLAN ID 1 Network : 192.168.1.0/24 Default VLAN 1

VLAN ID 2 Network : 192.168.2.0/24 VLAN Name Fakultas-Ekonomi

VLAN ID 3 Network : 192.168.3.0/24 VLAN Name Fakultas-Kedokteran

VLAN ID 4 Network : 192.168.4.0/24 VLAN Name Fakultas-Teknik

VLAN ID 5 Network : 192.168.5.0/24 VLAN Name Fakultas-Farmasi

Masing – masing VLAN dikonfigurasi DHCP

Semua password adalah “ubi”

============================================================================

Berikut adalah langkah konfigurasi :

Setting Password untuk Router

Router>en

Router#config t

Router(config)#enable password ubi ---> Terserah mau dikasih nama apa saja

Router(config)#line vty 0 4

Router(config-line)#password ubi ---> Setting password untuk telnet router

Router(config-line)#login

Router(config-line)#exit

Langkah pemberian IP address sub-interface untuk masing2 VLAN

Router(config)#int f0/0

Router(config-if)#no shutdown ---> Perintah untuk mengaktifkan fast eth0/0

Router(config-if)#int f0/0.1 ----> Masuk ke mode sub-interface ditandai dgn config-subif

Router(config-subif)#encapsulation dot1q 1

Router(config-subif)#ip add 192.168.1.1 255.255.255.0 ----> Gateway untuk VLAN 1

Router(config-subif)#int f0/0.2

Router(config-subif)#encapsulation dot1q 2

Router(config-subif)#ip add 192.168.2.1 255.255.255.0 ----> Gateway untuk VLAN 2

Router(config-subif)#int f0/0.3

Router(config-subif)#encapsulation dot1q 3

Router(config-subif)#ip add 192.168.3.1 255.255.255.0 ----> Gateway untuk VLAN 3

Router(config-subif)#int f0/0.4

Router(config-subif)#encapsulation dot1q 4

Router(config-subif)#ip add 192.168.4.1 255.255.255.0 ----> Gateway untuk VLAN 4

Router(config-subif)#int f0/0.5

Router(config-subif)#encapsulation dot1q 5

Router(config-subif)#ip add 192.168.5.1 255.255.255.0 ----> Gateway untuk VLAN 5

Router(config-subif)#exit

Router(config)#end

Router#config t

Router(config)#int s1/0

Router(config-if)#ip add 202.201.93.70 255.255.255.252

Router(config-if)#clock rate 64000

Router(config-if)#bandwidth 2048

Router(config-if)#description IP Public ke Internet

Router(config-if)#no sh

Router(config-if)#

Langkah mengaktifkan Konfigurasi Dynamic Routing RIP version 2

Router(config-if)#router rip

Router(config-router)#network 202.201.93.0

Router(config-router)#network 192.168.1.0

Router(config-router)#network 192.168.2.0

Router(config-router)#network 192.168.3.0

Router(config-router)#network 192.168.4.0

Router(config-router)#network 192.168.5.0

Router(config-router)#version 2

Router(config-router)#no auto-summary

Router(config-router)#exit

Router(config)#end

Langkah mengaktifkan konfigurasi DHCP untuk masing2 VLAN

Router#

Router#config t

Router(config)#int f0/0.2

Router(config-subif)#ip dhcp pool Fakultas-Ekonomi

Router(dhcp-config)#network 192.168.2.0 255.255.255.0

Router(dhcp-config)#default-router 192.168.2.1

Router(dhcp-config)#dns-server 124.195.15.100

Router(dhcp-config)#ip dhcp excluded-address 192.168.2.1 192.168.2.10

Router(config)#exit

Router#config t

Router(config)#int f0/0.3

Router(config-subif)#ip dhcp pool Fakultas-Kedokteran

Router(dhcp-config)#network 192.168.3.0 255.255.255.0

Router(dhcp-config)#default-router 192.168.3.1

Router(dhcp-config)#dns-server 124.195.15.100

Router(dhcp-config)#ip dhcp excluded-address 192.168.3.1 192.168.3.10

Router(config)#exit

Router#config t

Router(config)#int f0/0.4

Router(config-subif)#ip dhcp pool Fakultas-Teknik

Router(dhcp-config)#network 192.168.4.0 255.255.255.0

Router(dhcp-config)#default-router 192.168.4.1

Router(dhcp-config)#dns-server 124.195.15.100

Router(dhcp-config)#ip dhcp excluded-address 192.168.4.1 192.168.4.10

Router(config)#exit

Router#config t

Router(config)#int f0/0.5

Router(config-subif)#ip dhcp pool Fakultas-Farmasi

Router(dhcp-config)#network 192.168.5.0 255.255.255.0

Router(dhcp-config)#default-router 192.168.5.1

Router(dhcp-config)#dns-server 124.195.15.100

Router(dhcp-config)#ip dhcp excluded-address 192.168.5.1 192.168.5.10

Router(config)#exit

Router#

Konfigurasi Di Switch-VLAN

Membuat VLAN Database

Switch>en

Switch#config t

Switch(config)#hostname Switch-VLAN

Switch-VLAN(config)#^Z

Switch-VLAN#vlan database

Switch-VLAN(vlan)#vlan 2 name Fakultas-Ekonomi

Switch-VLAN(vlan)#vlan 3 name Fakultas-Kedokteran

Switch-VLAN(vlan)#vlan 4 name Fakultas-Teknik

Switch-VLAN(vlan)#vlan 5 name Fakultas-Farmasi

Switch-VLAN(vlan)#exit

Mengaktifkan koneksi VLAN ke router /naik ke layer 3 inter-VLAN routing

Switch-VLAN#config t

Switch-VLAN(config)#int f0/1

Switch-VLAN(config-if)#switchport mode trunk

Switch-VLAN(config-if)#end

Pemberian membership pada VLAN atau IP subnet address based

Switch-VLAN#config t

Switch-VLAN(config)#int f0/2