Lab3a: Static Networking

Check the status of all network interfaces on Linux is:

ifconfig -a

(location of the config file /sbin/ifconfig).

Global network configuration parameters (i.e. not interface specific) are in /etc/sysconfig/network

Interface-specific network parameters are in /etc/sysconfig/network-scripts/ifcfg-ens33 for the Ethernet 0 interface and

in /etc/sysconfig/network-scripts/ifcfg-ens37 for Ethernet 1 interface.

In older machines we may find these named ‘eth0’ and ‘eth1’, but current machines use the Consistent Network Device Naming conventions.

Step 1: Locate Ethernet1

On Windows Server, we will use the GUI to configure our 2nd network card.

Server manager → Local Server → then click on the interface (Ethernet1) to bring up the Network Connections control panel.

Step 2: Ethernet1 Properties

Right-click on the interface (Ethernet1) → Properties

Step 3: Add IP

Choose “Internet Protocol Version 4 (TCP/IPv4)” → Properties

Then choose the “Use the following IP Address” & enter the values you calculated

Inet address: 10.0.2.2

Subnet mask: 255.255.255.0

Default route: 10.0.2.1

Step 4: Verify IP Configuration

Confirm that the configuration is correct (# ipconfig command )

# ipconfig

Now you should be able to ping the Linux server

Verify that this is two way by pinging from the Linux server to your Windows server.

If you can’t, you may need to set up your firewalls to enable the ping command. See the next optional task to set up the firewall on both Linux and Windows.

Step 1: verify firewalld status

Verify that firewalld is active (currently running) and enabled (will start at boot) with

systemctl status firewalld

Step 2: Install firewall-config

Linux is considerably harder to set up, so we will install the firewall-config package to manage the firewall. Let's Do this now!

Run the command with:

yum install firewall-config

Step 3: Setup REJECT incoming pings

After installing firewall management tool - "firewall-config" from the terminal run the following command to open firewall configuration window -

#firewall-config

Summary of disable echo-reply & echo-request on Linux

Firewall configuration > Connections > ens37 > public > ICMP Filter > echo-reply (check - to disable)

Firewall configuration > Connections > ens37 > public > ICMP Filter > echo-request (check - to disable)

In the connections list on the left, check the zone that is ens37 interface is in (usually “public”).

Then in the main part of the window, we make sure we are in the ‘Zones’ tab and the public zone is selected. There is a set of sub-tabs, e.g. Services, Ports, Protocols, etc.

If we scroll across we should find a tab called “ICMP Filter”. By default the boxes are unchecked. Unlike Windows, Linux by default allows all ping (ICMP Echo) requests.

If we turn on the checkbox for echo-reply, Linux should REJECT the incoming Pings.

Apply this, and then check that we now can’t ping from Windows.

Step 4: re-enable ICMP reply

Finishing off this task by re-enabling ping (ICMP reply).

The command-line equivalents of this are:

• firewall-cmd --add-icmp-block=echo-reply

• firewall-cmd --add icmp-block=echo-reply

• firewall-cmd --query-icmp-block=echo-reply

Step 1: edit ifcfg-ens33

To make the ens33 autoconnect working when the system boot.

#vim /etc/sysconfig/network-scripts/ifcfg-ens33

> ONBOOT=yes

> :wq (//save & quit the config file)

Detail:
First, edit/view ifcfg-ens33 (Ethernet 0).

BOOTPROTO should say BOOTPROTO=dhcp, meaning that this interface will be dynamically assigned an IP address by a DHCP server. Because of this there shouldn’t be an IPADDR or NETMASK entry in this file.

Also note/check that DEFROUTE=yes. This means that this interface should be the default route/gateway.

Finally, look for ONBOOT. If it shows ONBOOT=no then change it to ONBOOT=yes.

Step 2: edit ifcfg-ens37

Then edit ifcfg-ens37 (or create it if it doesn’t exist by copying ifcfg-ens33):

# cp /etc/sysconfig/network-scripts/ifcfg-ens33 /etc/sysconfig/network-scripts/ifcfg-ens37

Edit the ifcfg-ens37 file

> BOOTPROTO=none

>Delete the "DEFAULTROUTE"

>NAME=ens37

>Delete the "UUID...."

>DEVICE=ens37

>ONBOOT=yes

Add:

>IPADDR=10.0.2.1

>NETMASK=255.255.255.0

>:wq

• • Change the line that starts with DEVICE= to say DEVICE=ens37

  • Change the line that starts with NAME= to say NAME=ens37

  • If there is a UUID line, delete it

  • Because our ens37 interface should have a static IP address, next change the BOOTPROTO line to say BOOTPROTO=none

  • Then set the variables IPADDR and NETMASK to the same values as you used for Task 1 (e.g. Add the line IPADDR=10.0.2.x where x was your host TCP/IP address)

    • • IPADDR=10.0.2.1

      • NETMASK=255.255.255.0

  • Make sure it says DEFROUTE=no (this is not the default route)

  • Also make sure this interface will start up automatically when the machine boots (ONBOOT=yes)

Step 3: Test interface configuration

3a. Test the configuration, use the ifdown and ifup scripts in the network-scripts directory. Bring the interface down first, and then up:

• • • • • ifdown ens37

        • ifup ens37

Error: If encountered an error when running ifdown ens37 the error message says which include:

"Error: no active connection provided"

Solution:

Run the following command -

# nmcli con up ens37

3b. Alternatively to restart/reload all networking, we can run:

systemctl restart NetworkManager.service