Know everyone that is my dad here in Love Number three I'm going to show you how you can configure the
detesting the snooping to protect your network.
So as you can see he will have 12 parts to do.
But before I start doing the parts let me just show you what is the last thing are you that are going
to work on.
And then our explain why you need to have the HTP snooping configuration in your network so you can
see here is our network I we have our computer connected to this router on Ethernet too and this router
is connected to router 2.
We also eat them at three in the face.
So it's almost the same like what we have seen in the previous lap but the idea is this following we
have to configure the Sonata to become a switch.
So to have a switch that means that we have to put all parts inside a bridge bar and then this other
becomes as a switch and this router over here we need to convert it to become a dish server.
So what is the thing.
We know now that there should be service connected to it and that three of this switch.
Let's call it now the switch that means that we can make this port as a trusted port.
That means that the DCP server can pass traffic from this port.
You can imagine if someone has to put that rock they see the server.
For example on there is Europe or internet for.
OK let's take this for can at for and someone bring a recipe server and he connected to disport so that
he said this to the server here.
OK.
So what happened is that there is this port and this port and this port are in a switch.
That means that if this computer here is asking for an IP address from the server he may get the IP
from this rocketships server and then of course you also send him a gateway.
And this gateway that means that all the traffic of this PC will have to go through the gateway that
is given from this city server and that someone can intercept the traffic that is passing from this
computer.
And that's what we called the DCP as a rock.
They should be.
That means that it's not a validation.
So to avoid that what we can do.
We know that the this the this is the server that is connected to the Timmothy is the valid one.
Then we can make this port as trusted port.
OK.
So we make this port trusted port and all other ports.
This board and this port here and this port here.
And if you have more ports on the switch that we have we made them on trust and trusted means that the
DNC server communication not the DNC.
The DNC server communication will not happen let me if someone plugged.
There should be server on this board for example.
He put it over then the server disputes over will not be able to communicate with the client.
It's only going to be conjugating with the guys on this board because it's a trusted board.
So that is the concept of the HTP snooping.
So what we can do we can make one part of the board which is connected to that there should be server
as trusted and the rest will make them untrusted.
And then in this way we secure our network that we no one can put a rock they strip the server and provide
us IP addresses and routes that we should not go through it.
OK so now you know the concept of what is the set piece to be.
Let's now go back and configure part number one.
Upgrade your Lauter to the latest version.
So before I start this point I put the picture here.
And at this point they're asking us to upgrade the router to the latest version.
Why we have to do that because they are simply snooping is isn't you setting that the critic is providing
with the newer version of fumoir.
Man that's true.
When you are taking now this course.
But in the next couple of month back.
So now we are in quarter 4 of 2018.
Then the distribution of being was not available.
So now what you need to do we have to upgrade your router to the latest version.
Actually I have upgraded my router and are ready but if you want to know how to do that and I think
that you already know how to do that you can open the Winbox and from here you have to go to system
packages and you have to make a check for updates.
At this moment the latest version is six point forty three point four.
So it's already updated.
But in case you want to check if you have a higher version then you can check out date and also your
router needs to be connected to the Internet.
In my case my router is not connected to the internet so you can see if I'm at chuck a bit so it will
not show me anything.
But if your router is connected the then it would communicate with the mike to take care of servers
and then it would check if there is a new version.
Then it will tell you there is a new version and you can download it and install it.
OK point number one is done.
Point number two go to the first router name its switch and create the bridge interface to the inside
of it all your boss.
So what we need now to do again if we go to the graph we have all those parts that are on this router
we have to put them inside the bridge so we make a bridge interface and that we put all those it in
that one two three and four I have only four interfaces on this router.
Then this router becomes like a switch because all the ports are inside and which layer to they work
layer.
So lets do that.
I will go here to the Winbox I will make a breach.
So thats rich one.
And inside the bridge I have to put it there face it and thats one and output interfaces the next.
Now after we put it in that too it may get disconnected because I'm connecting my computer to Ethernet
to all of this to this switch or this router and because we're putting it in a rage then it may disconnect.
So that is it enough to put it in that three so she is disconnected No problem I'll connect again.
Now I will create inside this bridge up with the part of you tonight through that just to put it in
a.
And we put Also internet for
so they seem to be snooping works on the bridges.
So you have to have a rich interface on all your parts.
Then the that this will be kind of work part number two is done.
We have put all the parts inside the bridge interface.
Number three go to the bridge interface and check the the SEPs not be so then never there should be
something we have to go inside the bridge interface so we can go from here and DoubleClick on it and
you can see Desta is doing is showing that actually after you upgrade your router to the latest version
it should show that if you don't see that option here that means you are on a all version for the router
OS and you need to upgrade it.
So you have to check the there should be still being on the bridge.
OK.
So that's what I have to do.
Say OK point number three is done.
We have checked that there should be on the bridge interface.
Now number four make it in that three trusted and or other port on the roster.
What does it mean if we go back here to the picture we see that drop of two which is going to be the
dish to be servers that is the dish over it's connected to in that stream of this.
Then I have to make it necessary.
The trusted interface.
And I will make all the other interfaces which I've eaten at one two and three and four actually three
it's already trusted.
So one two and four we're made down on trust.
That means that if the recipe is connected to eat and it's three that it will work if the recipe server
can communicate.
But if it's connected to the other port it will not work.
So how to do that we go back to Winbox and from here we have to go to the bridge and inside the bridge
inside the bridge we have the interfaces that we have put down the ports.
So you go to it and had three and you can see here when you double click on it and it's free you see
you have this one which is trusted trusted means.
That's the part that I trust that's the part which is connected to the HTP server.
And I would say OK the other parts you don't do anything because by default there are unfrosted.
So you see they're not checked so it's not one hour and not make a trusted Internet to own and not make
it trusted and either not for or not make it trusted.
So only make trusted Ethan at three because that's the one connected to the server but before it's done.
But number five go to router to sign it.
And I bet others on internet three to one or do I say that want to fight for.
So if you go back to the picture here router which is the server is having this interface intimately
connected to it in a city of that there should be.
All right.
That's the physical connectivity that we have.
So we need to put an IP address on this interface and we make the server on that interface.
All right.
So let's do that.
We got to the other rather So I have to move my cable and I connect my computer to the second router.
Now I would go to this author so they just decided on the router too.
I will name it if you want to we can change the name.
So let's go to System and then we got our identity.
We give it a name router to and on this router I have to go to IP address and I give and I a 1 and 2
1 6 1 2 5 4 Stosh 24.
And this is going to happen on internet 3.
So that's really the has this IP address.
And then I would say OK point number five is done we have put that eyebrow address on the router too
which is going to be the DST.
So now we can integrate the data on internet 3.
So that's something we have seen before and we can do it very fast.
Now I would go to a router too and I will go to IP DSP server.
I click on there to be set up.
I would say I want to create this sheepy server on internet 3 next.
So that is the range of IP the network others that's fine.
They're just the gateway.
Yes that's correct.
Here is the pool.
And also I can show you that if you want.
You can create more pools here but now we create only 1 pool.
This one find the server we can put anything we want as DNS server here.
So what they do they do they don't they this time and finish.
So now if they dropped it to has there should be server and he gives I got this from.
It's either Internet 3 interface.
OK.
Point Number six is done part number 7.
Check if your PC get an IP address from the DSP server.
So now what I need to do again if I go back to the picture I have now I plug my computer to this router
to be able to go to one box or plug it again on Ethernet too.
And this is a switch.
So this is a switch and a router to it's connected to Ethernet 3 which is the trusted interface that
we have to see if my computer which is connected now to this which will get an IP address from the disk.
So first I would connect my computer to that router.
So now my computer is to this switch actually connected and I will open the current prime
and from here first to check if I have to be compre if I have any others on it.
So you can see I don't have any others.
What was the IP conflicts that's all there is no I got this.
If I say I've become fake slash all we should say slush
it it looks like there is some connectivity problem.
I think that my router by mistake is now turned off so I moved the cable a bit so I will wait for the
router to come online again.
And then we will try to see if we get an idea.
So the switch is now back online and now we try again and we say I'd be fake to see if there's an app
out there so you can see it has receded I gather from the DCP server if you want we can try to release
this IP address so we take them off and then you can see there's no I've got it.
And now again I would say IP conflicts slash revenue and I would say either I wait a minute and then
we can see in the few seconds that you would get an IP address from the DST server you can get 1 2 1
6 8 1 2 5 3 and why he got the IP address because as you can see the router which is routed to here
acting as there should be server is connected to the trusted interface and it is a switch.
Then it will forward the DST the buckets back and forth between the server and the PC.
OK so if we want also we can go to Winbox we go to Iraq up to now and we can go to these we can see
that it has giving this gather to my partner above 7 has done both.
Number 8 do IP conflicts Lesters IIS on your computer to remove the IP address to receive from the server.
So we need to remove this site either so I will say IP conflicts Lesch release and we see there is no
any other is now on my part number eight is done.
There is no I gather on my computer now connect a router to to the Internet for of this switch.
So what they are asking us now to do is to take this cable which is connected to it and that's here
to move it and connect it to Internet for.
OK we put it on the internet for of the switch so that means it's not any more connected to it than
that three which is the trusted one we connected to it and that for which is a known trusted one its
not trusted.
And we see that if the pc will get an IP address on.
So let's do that.
So I would go to here that is the cable of this.
I took it out from Ethan at 3 and now I put it aside for him.
So now the DCP server is connected from its interface it unnecessary to the in the face of the switch
on it and not before.
And remember if I just to put it here that's the switch he has eaten that three is trusted and the rest
is not trust that's all eaten up for there's not a trust board.
OK.
And then we will see if there will be communication with a dish to be sure.
And the PC to get an idea on the spot.
Number nine is done both number.
Then do I pick up a slush renewing on your PC does it receive an IP address from the dashiki server.
Let's try now we go here.
And we still don't have an IP address.
We can't check IP config we have actually we have an IP IP address let me remove it.
So I would say again IP conflicts flash release do not have anything.
And we do IP config slash Ringle.
OK so now we are renewing the IP address and now the computer is asking for a day I should be Schober
to give him an IP address.
And in case the DCP server and Souf then he can give him an IP address in our case.
Remember we are now connected to Internet four of this switch which is an untrusted.
That means one even get in-case router to see the server he is answering to the PC when it comes to
eating at.
And it's untrusted they would say no you cannot pass from here.
It's an untrusted bar and then the computer will not get an IP address from the distributor from the
range of 1 to 1 6 and that one that's something that check so as to try to give an IP address but it
will not.
Now if I say IP config you can see it get an up people I gather.
And that's.
And I gather that Microsoft Windows he give it to to the computer which started by 169 to fight for
something.
And that's what we call it people.
OK it's an automatic I got this one the PC cannot find it there should be Schober to give him an IP
address.
The windows give him this IP address that something locally inside the windows.
OK.
So as you can see he didn't get an IP address from the ranch of the desk server because there were no
communication between the DST the server and the client which is in our case my computer on ABBERTON
is done and we did receive an IP address from the dealership is asking us now to reconnect to internet
3 and do IP conflicts Slusher.
So we have to put the cable again and the switch on it and that's really and have to review the IP address
and we have to see if we will get now and I gather this.
Let's try something the cable from within at 4:00 and I put it on it and it's three again which is the
trusted.
And I will go to my computer come on line and if we say no because complete we're still on IP but if
I say IP conflicts Let's review and then I will say enter we have to wait a bit and then we should see
that indeed he got an IP address.
Why.
Because now the DCP server is connected to the trusted port which is Internet 3.
And that's what we have configured what we were doing the DSP snooping.
So he has received the IP addresses from the DST server.
So they asking what do you conclude.
So we conclude that internet 3 is the trusted port and the DST has to be connected to that port in order
to provide IP addresses to the host number 11 is Afghanistan and point number two that reset both routers
to the next labs.
I will do that also in a moment.
And that's what I wanted to show and the conversation of the day ICP snooping.
As you can see it's a very important feature that they have added to their router or us.
And again remember you have to upgrade your router OS to the latest version.
And then when you do that the distribution of being will be there and you always need to have Bridge
interfaces in order to configure the DSP Snoopy.
And with the desktop is not being you are protecting your network that know any drug there should be
would be plugged in your network and it would provide information to your host like ip address the subject
mask gateway and DNS and other information and then they can do some type of attacks against you.
So this is what I wanted to show you in this flap about the speech therapy.
I hope that you like this feature and I wish you and the upcoming election.