Hi there.
That is smart.
How about here?
Again, in this lecture, I have to show you how you can do the lock down to the mike grab, should
you have to actually to lock down the mike with a cracker.
So as you can see, you will have a level of seven points.
Let's start actually with the first point.
Log into the microcosm via the MAC addresses as possible.
So that's something we have seen it in the previous lab that I could log into there out of the added
Mac address.
Let's try it again so I will disconnect.
And now from router one if I go to the Mac address.
So that is the MAC address over here, which is a layer two.
And then I'll say connect.
Then here we go, I'm able to connect to it.
So yeah, that's also a vulnerability that we don't want to keep the Mac address open for anyone to
log in.
Of course, it is also good to keep the Mac address in case you don't have any more reachability on
layer three, then you can use it as a last resort to be able to connect to the micrograph.
But yes, all depend on what your scenario wants it to be.
So if you want to have some security, then you should better disable the Mac address.
If you want to have some like a redundancy or like a last resort, then in this case you can keep the
Mac address open.
But this is a course that we are speaking about security.
So I want to show you how you can disable the possibility to log into the router via the port.
Number one is done, but number two, do not allow to log in from one box into the router from its MAC
address.
So we have seen that it's possible that I can log into the MAC address now.
How can I stop that?
So what we need to do now, we have to go to tools, we have to go to the MAC server.
You can see it over here or Mac show where you have this MAC one box by default it is allowing all the
Mac win box to the router on all the interface and certainly it's on all what you can do.
You can say, I don't want that.
The Mac connection to win box to be allowed on any of the interfaces.
So just you say no and then you will say here, okay.
Now if we try again to log into the router from its Mac address, let's try.
You can see it's not working anymore.
So we are not allowing anymore to log in to the router beyond my college.
But what if we try to the IP if I click on the IP.
So we are now connecting to the IP and then I say connect.
Now it is working on the IP.
So IP is working MAC address, it's not working.
So that is how you can disallow it.
Now someone can say, well, but I want for example to disallow it on all the interfaces, but only
one interface which is you could not do or C or whatever.
I want it to be allowed.
So it is something we can do then.
Yes, sure.
You can go to the interface interface list over here and you can create an interface list.
First you have to create the list.
So those are you.
We have seen them inside the Mac server.
So you create an interface list, you name it list, and then you put inside this interface list, for
example, you put item that whatever is necessary and now you can go to the Mac server again and then
from here to the Mac web server.
And you say that I want to allow only the list one which contains the necessary.
So that's how you can do it.
What number two is down port number three, log into the second author and check if you can ping the
Mac address or frother.
So as you can see in the graph, I have now added a new router and if you want I can show you here.
So this scenario, which is computer after one item that's still the same.
I just added a new author which is rather too connected to it and it's three or four after one.
So now that saying, okay, go there out of two and try to make being from Rocket two to the Mac other.
So from the to off to the Mac address and not to the IP addresses as possible.
So again, to Hacker, any information that you provide to the hacker for him is important because from
that he will be able to run his attack based on some of the information or the collection of the information
that he is getting from your network.
So let's see if the two competing the Mac others will profit one we go to router two.
So that is yes, you can see the disruptive two.
If I go to IP neighbors then I can see that on the neighbor router to see on the interface ethernet
three because is connected to the necessary to rafter one.
You see that he has this neighbor which is often wanted.
You can see this clearly over here.
So now we can try to pin it on the Mac others right click Mac Bing.
Here we go.
So he's able to bring the Mac address of Frota one again.
That is something we also want to disable it.
We don't want anyone to be able to ping the Mac address.
All three is down.
Fourth number four, disable the possibility to ping the Mac address of routing one.
So we have to do this work now.
Without that one would go to rot.
The one.
And from out there one I have to go to again tools.
Machover And here we have the iMac Pink you can see it.
So this Mac bank is enabled by default.
I just disable it.
Mac being server enabled, I just uncheck it.
Then that means I have disable it.
So this has been disabled.
Let's go to characters to again that is relative to and before we could be able to pink.
The other son.
Father one Now look, that's not working anymore.
So that's what is still locked down off the rafters.
So I'm just stopping everything, which is possibly the hacker can use it to collect information to
be able to run his attack.
So now you see that the bank is not working anymore.
All number four is done.
Point number five.
Actually, I before I go to the park, number five, I just want to also to show you that you can do
this also from the command line.
So if you want to, we can go back to the first points to make the command.
Let's say if we want to do this, allow of the log in from one box from each other.
So I don't want that's something we have seen it over here.
So on the Mac one box server, I don't want anyone to log in.
So if we put it all, that means everyone can log can log in to the Mac address of their author from
from one box.
Now, if I want to make it from the command line.
So from here we go to the command line and you write towards Mac server and now we can say the Mac one
box sets allowed interface and now you have all dynamic or non, you can say just non and then enter.
Now if you go to the tools again and we go to the Mac server, you can see that it is now non.
So I did this for this point for the second part, which is to disable the Mac ping server.
So let's enable it and I want to show you that how you can disable it from the command line.
So I also have to say to Mac server and now we have to say think and then set enable equal now and then
enter.
Now if we go to the Mac Bing server, you can see that this has been unchecked.
So this is how you can do it from the command line.
Now let's go back to the point that we have to do now is to not allow a request from the DNS on the
router.
What does it mean?
Let's say that you are having the Internet found out there, which we already have.
It's from router one.
So a lot of engineers, what they do, they want to to have the DNS gcash so the DNS gushing to happen
on there rather.
So that means those end users or devices like this one will have as a DNS, the IP of the router one,
which is the IP of the gateway.
So in this case, when there is a DNS requests, it will come to the router and then the router by itself,
the check.
If it's squashed, then he will give him directly the information.
If it's not cached, then he go and make the DNS request from the internet and bring him what you want.
Right.
Now, if we keep this open, then in this case, maybe someone will be using our router to partially
the initial quest from the internet.
So someone like a bad guy over here or not even a bad guy, it could be anyone.
Like using our router to be like a DNS relay.
Then all the traffic will be passing from our router to will go to the DNS server which is on the internet,
even though not from our LAN.
I'm talking about some one users.
So that's why it's very important that you disable the DNS on the rather.
So let me show you where it's there.
So here if we go to IP DNS.
So on the IP DNS, normally if you are using this sort of to make the caching so you have here allow
remote request and then you can see that the cache will be shown up over here.
So this is normally how it is, but if you want to disable it, just go to the DNS over here and just
uncheck it, uncheck it and then over there for the computer.
Then you should not let them use your router IP address.
They should use some public IP of the address like a .8.8.88.84241.1.1.1.
You just give them those DNS, they put it on their computers or devices.
Know how to do that on the command line is very simple IP, DNS.
And then over here you can say set.
And then you have to look now to the allowed remote request and then you have to say no.
And that's how you do it.
On the all number five is done.
But number six, disable the neighbor discovery on and off the one.
So what is neighbor discovery?
If we go to the wooden box, I will open my inbox.
So the neighbor discovery is a protocol which shows me this information like what is the Mac address
of the rotten one?
It's IP address.
It's I.
Entity, what version it's using, what is the data versus when it is up?
Same relative to you can see also the IP version six spot.
So these are information that the hacker can use it to be able to gather this information because this
information will happen to make this attack.
But not only here.
Also, you can see it when you go inside or out one for example.
So from Raptor one.
And if you go to IP neighbors, you can see also inside that other one, the IP neighbors.
So the MIGRATE, they use what is called the LDP, which is the protocol that used for the neighbor
for Cisco.
That is a similar protocol called CDP, Cisco Discovery Protocol.
But LDP is an independent of a neighbor, a protocol that is used by all brands.
And Mexico used that one.
So if I want to disable this IP neighbor protocol, so how can I do that?
We have to go to IP.
You have to go to the neighbor.
And here we have the discovery settings.
And you can see actually, I can see now that it's having a protocol CTP, which is for Cisco, LDP
and NDP.
So it's used three different protocols.
So over here you can say that.
Non.
I don't want to be discover on any of the interfaces.
All right.
So here you can use also this one only for list one.
So if I say non, so rather one will not be discovered by any of the interfaces.
And then I will say, okay, I can see everything is gone now.
But now if I go to in-box, shall we see the other one?
Let's have a look.
We don't see it anymore.
You see, without the one that's not shown anymore.
Does it means that I cannot log into the relatives?
No.
We can still look in the.
This is IP username, password connect.
You are able to log in, but you are not allowing the hacker to know that there is a rather somewhere.
Then he can run his attack to that rather.
So you are disabling the possibility for this rather to be seen.
So that is how you can do it now on the command line.
Let me enable it now again and let's do it on the common line.
So here we have to say all interface, all.
And now on the command line, we have to go from here and we have to write IP neighbor and then discovery
settings set discovery interface list equal, you know.
Once you do that, if we go now to the IP neighbors, you can see that it has now not blocked.
Number six is done and the last point is to disable bandwidth, test and run on what is the bandwidth
test.
And then we speak about someone boundaries test is a tool that is provided by microchip to allow us
to make test for the bandwidth.
How much our output is doing is upload and download.
So now we have to write this over here.
I can from another one if I want to see how much I can do, upload and download from relative to tractor
one, then I can make better this test from rather to two after one.
Then I can see the information.
But believe it or not, once you run the bandwidth test, the speed of the router will go very high.
Let me show you that.
By the way, bandwidths, this is enabled by default on all of the my classic quarter.
So let's go to router one.
That is not the one.
Let's put it something like this small so we can put side by side that out of one and out of two.
So that is about two one.
Let's open router two next to it.
So that is rather too.
Very good.
So now if we go to tools, we can see that the boundless test server is enabled by default on the Raptor
one.
So let's run a boundary test from relative to to see how much bandwidth able to do.
So let's do that.
I will go from here to the tools bandwidth test.
I will put the IP address of the other one I to let's say to do that one because this is the router
one because I'm doing bandwidths from right to two to Raptor one.
And then I'll say, okay, that's, I want it to be UDP and I want to check those direction to upload
the download.
What is the username and password or from the one?
So it's username and password.
One, two, three, four, five, six.
And then I will say start.
Look, I disappear from the one it's almost hundred percent.
So you can see that sometimes the hacker does not want only to retrieve information from you, but you
want to stop your network.
And if your router is reaching a secure 100%, that means that author is not able to do the normal jobs
that you should do.
Like routing, like not like there should be, like all of things you will not be able to to do them
or maybe will do them, but very slowly because the SPU is very high.
So you can see that once I stop the boundaries test Luke, the ship has dropped on Rafter one, so we
need to stop the bandwidth test on the routers.
So how to do that?
We can just go to tools.
Boundless Stachura.
I would just disable this one.
So I would also take out authenticate.
That's it.
Now, if we try again, you.
She cannot connect.
So now how to do it on the command line.
So let me just put it again and show you how you can do it on the command line.
Now we go from here.
And from here I have to show tools, bandwidth, server and set enabled.
It will.
No.
So once you say enable equal now now we look to the tools bandwidths server.
Do this on.
We try to do it now.
Again, cannot connect.
All right.
So that's how we can disable the bandwidth test.
Now, the starting point, they are saying that you have to disable run more.
So what is run on exactly?
Let me show you on the graph Romo on means that in case you have layer two connectivity like just like
a cable connected those two interfaces I'd say that you are somewhere like this computer connected to
or out of one.
Let's say that this computer cannot shear off of two.
So you enable Roman over here to enable Roman over here.
And this one would be like a Roman server.
So it is going to be like a Ramone server then because you can connect to that one.
Then also from this server, Roman server, you are able via arm to go and connect to rather to to open
one box, for example.
So that's also something that the hacker can use it to be able to reach to some devices that are far
away from him.
But there is just a lot more connectivity between them than he can reach it.
If you want, that can show you a very fast an example.
Look, let's go to another one that is sort of to the darker one on tools.
And we have Roman, let's enable Roman on another one.
So this is Roman enabled on to one and then I will do the same order out of two tools.
Roman and is enabled on right up to now.
Look what I'm going to do.
I'm going to open a wooden box.
And then I connect a Roman to while I don't say that you don't want that Misurata one hour connector
route the one on Rome or connect to someone then directly to show me the other two.
So you look also it shows me another rather, which is I'm using at home, it's like a switch.
So yeah, this is not in my network, but yeah, I could see that.
That is because this has Roman enabled.
I could reshape.
So now if I want to go to outer to from Roman, then I click on it and then connect.
Because here we only have my others and I'm able to go to relative to settings what run more.
So what we need to do now, we have to always disable Roman.
Well, I'm not saying that we have to always, because I also use Roman a lot.
So again, it's that historically you should disable Roman because that's a vulnerability that a hacker
can use it.
But for my side, I use Roman a lot because sometimes if when you have, for example, like a network
of 50 routers and you cannot reach all the others because they are connected to different cables and
different range of IP, then you have a Roman on everything.
Then you are able to reach Roman because you just have for layer two connectivity, you can reach all
the rafters.
All right.
But as it is a course about security.
So I have to show you how you can disable it.
So all you need to do is you got to go to choose Roman and uncheck it.
Sam You can do on all the other other.
So how to disable it here?
Also on the command line, let me show you how you can do that.
So we have to go to the command line and from here we have to try to Roman so enable equal no.
And that's how you describe a Roman false number seven is done.
And with this path, I have showed you a lot of things that we can do to lock down our router.
So those are very important things.
Please use them whenever you can.
Then you are able to secure your router to not be hacked very easily.
So I hope that this lecture was informative for you and I'll see you in the upcoming election.