! ==========================================================
! MAG212 CYBER Campus Lab - Nimbus Coffee HQ (fictional)
! Device: NB-EDGE  (edge router, ISR4331)
! Paste in Packet Tracer: CLI tab > enable > configure terminal (then this file)
! Tested in Packet Tracer 9.0 on macOS (Nov 2026). PT notes are marked "PT:".
! LAB ONLY: change every password before using ideas from this lab anywhere real.
! ==========================================================
! PT: stop log messages from cutting into pasted lines (turn back on with "logging console")
no logging console
hostname NB-EDGE
no ip domain-lookup
ip domain-name nimbus.lab
service password-encryption
service timestamps log datetime msec
security passwords min-length 10
enable secret M212-Enable-ChangeMe!
username netadmin privilege 15 secret M212-Lab-ChangeMe!
login block-for 120 attempts 3 within 60
! PT: rejects the next command. Real IOS accepts it: login quiet-mode access-class VTY_MGMT
banner motd ^Authorized access only. Activity on this device is logged.^
!
interface Loopback0
 ip address 10.212.255.1 255.255.255.255
!
interface GigabitEthernet0/0/0
 description WAN to ISP
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 ip access-group WAN_IN in
 no cdp enable
 no shutdown
!
interface GigabitEthernet0/0/1
 description Routed link to NB-CORE1 Gi1/0/1
 ip address 10.212.0.1 255.255.255.252
 ip nat inside
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 M212-ospf-Key
 no shutdown
!
! PT: Gi0/0/2 on the ISR4331 is an SFP slot. Before cabling, open the router > Physical tab
! and drag a GLC-TE (copper SFP) into the empty GE 0/0/2 slot, or the port is not offered.
interface GigabitEthernet0/0/2
 description Routed link to NB-CORE2 Gi1/0/1
 ip address 10.212.0.5 255.255.255.252
 ip nat inside
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 M212-ospf-Key
 no shutdown
!
router ospf 1
 router-id 10.212.255.1
 passive-interface default
 no passive-interface GigabitEthernet0/0/1
 no passive-interface GigabitEthernet0/0/2
 network 10.212.0.0 0.0.0.7 area 0
 network 10.212.255.1 0.0.0.0 area 0
 default-information originate
!
ip route 0.0.0.0 0.0.0.0 203.0.113.1
!
ip access-list standard NAT_INSIDE
 permit 10.212.0.0 0.0.255.255
ip nat inside source list NAT_INSIDE interface GigabitEthernet0/0/0 overload
!
ip access-list extended WAN_IN
 remark Anti-spoofing only, NOT a firewall: drops impossible sources from the Internet.
 remark Inbound protection comes from NAT overload (no inbound mappings) and VTY_MGMT.
 deny ip 0.0.0.0 0.255.255.255 any
 deny ip 10.0.0.0 0.255.255.255 any
 deny ip 100.64.0.0 0.63.255.255 any
 deny ip 127.0.0.0 0.255.255.255 any
 deny ip 169.254.0.0 0.0.255.255 any
 deny ip 172.16.0.0 0.15.255.255 any
 deny ip 192.168.0.0 0.0.255.255 any
 deny ip 224.0.0.0 31.255.255.255 any
 permit ip any any
!
! SSH needs a hostname, a domain name and an RSA key before SSH version 2 can be enabled.
! RE-PASTING? If this device already has a key, delete the next line first, or IOS asks
! "replace? [yes/no]" and swallows the following line as the answer.
crypto key generate rsa general-keys modulus 2048
!
ip access-list standard VTY_MGMT
 remark Only the management VLAN may SSH to network devices
 permit 10.212.199.0 0.0.0.31
 deny any
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line con 0
 login local
 exec-timeout 10 0
 logging synchronous
line vty 0 15
 login local
 transport input ssh
 access-class VTY_MGMT in
 exec-timeout 10 0
!
logging host 10.212.150.10
ntp server 10.212.150.10
!
end
write memory
