Free Cisco CCNA Lab: Basic Router Security with Enable Password Encryption

Welcome to this free Cisco CCNA Packet Tracer practice lab. You can download the lab file from the link in the

description. See if you can complete the lab yourself first and then continue watching this

video if you have any trouble or watch it afterwards to check your solution. In this lab, we will be working with two

routers R1 and R2. We will configure basic security on the routers by using the enable password

which is used to enter privileged exec mode also known as enable mode. I will only work with one of the routers in

this video for the sake of time but I highly recommend that you perform the configurations on both of the routers

for practice. Repetition is essential to become familiar with the command line interface

or CLI. Step one is to connect the two routers by their gigabit Ethernet 00 interfaces.

I will refer to these as the gig0000 interfaces. Click on connections in the bottom left

and select the cable. Connect it to the gig 00 interface on R1 and then R2.

There we have it. Step one is complete. Step two is to set the host names according to the network diagram that is

to R1 and R2. Click on each router and then select CLI to access the command line interface

from which we will configure each router. The current host name for each router is

displayed here. As you can see, each router is currently named router.

To change the host name of a router, we must enter global configuration mode. However, to get there, we must first

enter privileged exec mode. This is achieved by using the enable command.

To demonstrate a shortcut, I will use the exit command to return to the previous exec mode.

Notice that you can enter privileged exec mode by simply typing en. You can also type en and then use tab to

autocomplete it to enable but this isn't necessary. EN alone is fine. E however is too short and we are told

this is an ambiguous command. This is because there are other potential commands that begin with E,

which we can see by typing E and then a question mark. As you can see, there are two potential

commands, enable and exit. So, if you just enter E, the router doesn't know which command you mean. However, enable

is the only command beginning with EN. So, EN is all the router needs to know which command you mean.

Now that we are in privileged exec mode, we can use the configure terminal command to get to global configuration

mode. If you want to use shortcuts again as we did with enable and en the shortest version of the configure

terminal command is conf t. From here we can set the host name of the router. This is done with the hostn

name command. I will enter hostname r1. As you can see the host name has changed from router to R1.

Change the host name on R2 as well. And then step two is complete. Step three is to set the enable password

on each router to Cisco. The enable password is used to enter privileged exec mode which as I

mentioned before is also called enable mode. Previously we had no password set. So we were able to enter privileged exec

mode without any password. Now we are going to protect privileged exec mode so that only administrators

can access it. The command is simple and it is done in global configuration mode which we are

already in. Type enable password Cisco. That's it. Now let's test it out. From here, I will

use the exit command twice. Once to bring me back to privileged exec mode and then once again to bring me back to

exec mode. Now I will use the enable command again. However, this time I am asked for a

password. The characters do not appear as I type. However, if I type the password Cisco

correctly and press enter, I am brought to privileged exec mode. Now let's see what happens if I fail to enter the

correct password. I enter the wrong password once, twice, and then three times before being

rejected for having bad secrets. Now I will try again with the correct password and I'm in. Step three is now

complete. Step four is simply to view the password in the running configuration.

The running configuration is the current configuration of the router, whether or not you have actually saved it. If you

turn off the router without saving the running configuration, you will lose any changes. If you want to keep your

changes, you will save them to what's called the startup configuration. That will be for another lab.

To view the running configuration, use the show running config command from privileged exec mode, which we are

already in. You can abbreviate it too. For example, sh run.

Enter the command and you can see the password right here with the exact command we used before. Enable password

Cisco. Step four asks if the password is encrypted, meaning translated into an

unreadable code to protect it from being discovered by people who should not know the password. As you can see, it is not

encrypted. It is written in clear text right here Cisco. So the answer is no. Step four is now complete.

Step five is to enable password encryption on the router. We can protect passwords by encrypting them to render

them unreadable. This is done from global configuration mode with the command service password

encryption. I will enter the command. And now step five is complete.

Step six is to once again view the running config. I will use the same command as before. And now let's check

the password. However, the command doesn't work. That is because we are currently in global configuration mode

and showr running config must be entered from privilege exec mode. Now I could type exit to drop back to privileged

exec mode and then enter the command. But there is one more way. If I type do in front of the command, I can enter it

from global configuration mode. do show running config. There we go. Let's look at the password. You can see here enable

password followed by a seven and then a string of other numbers. The password has successfully been encrypted.

Although we didn't type this seven when we entered the command, it refers to the type of encryption used. There are other

types as well, but that's not something to worry about now. The string of numbers that follow are

the password Cisco encrypted to be unreadable so that anyone looking over our shoulder can't read the password.

Keep in mind that the encryption used in the service password encryption command isn't very secure and can be cracked,

but this at least renders the password safe from someone simply glancing over your shoulder. Step six is complete.

Step seven is to disable password encryption. We enabled password encryption with the service password

encryption command. Now we will simply type no followed by the same command no service password encryption. That's

it. Step seven is now complete. Step eight is once again to view the password in the running configuration.

This time I'll exit down to privileged exec mode and type show running config to view the running configuration.

As you can see the password is still encrypted. Why is that? even though we disabled password encryption.

Well, disabling password encryption will prevent future passwords from being encrypted. However, it does not

unencrypt passwords that are already encrypted. So, the answer to step eight is yes, the password is encrypted. Step

eight and the lab are both now complete. Thank you for watching. I hope this lab and video have been helpful. Please

subscribe for future labs like this which will be released weekly. If you have requests for any specific labs, let

me know in the comment section. If you want to support my channel, I accept Bitcoin donations via the address in the

description. I am also a Brave verified publisher and accept BAT or basic attention token donations in the Brave

browser. Thank you.