Easy & Pinpoint Cisco Routers and Switch Configurations! The Ultimate Resource

Easy Pinpoint method to crack a Cisco IOS password

2010-07-28T10:27:00.000-07:00

Easy Pinpoint method to crack a Cisco IOS password

Many administrators don't realize how easily someone could crack a Cisco IOS password. In fact, it's quite a simple process. Let's examine the different types of Cisco passwords and discuss how you can ensure they stay secret.

To begin, keep in mind that I'm not trying to teach anyone how to become a cracker. Rather, I believe it's important that administrators understand this process so they can better protect their routers' administrative passwords.

There are three types of Cisco passwords: clear-text passwords, type 7 encryption, and type 5 encryption. Let's take a look at the pros and cons of each.

Clear-text passwords

It should go without saying that clear-text passwords are completely insecure. Basically, if someone can view your router's configuration, then he or she can also see the password since it has no encryption at all. In other words, clear-text passwords offer almost no benefits.

Type 7 encryption

Type 7 encrypted passwords are weak, and it can be surprisingly easy to crack them. In fact, one could accomplish this using a six-line Perl script. (You can find this script and directions on the Tech FAQ Web site.)

In addition, Windows-based programs are available that allow you to enter a decrypted password, and the program will immediately return the clear-text password. (SolarWinds sells a password decryptor for this purpose.)

Finally, you can find a Java applet on the Web that decrypts Cisco passwords, and you can download an offline version for your own use.

Type 5 encryption

Encrypted with the MD5 algorithm, type 5 passwords are the most secure of the three. There is currently no known method for decrypting a type 5 password.

The only way to crack a type 5 password is by initiating a brute-force or dictionary attack. In addition, programs are available to do this on the Web. To learn how to protect your systems from such an attack, check out this article, "Protect your router from a dictionary DoS attack."

Protecting your passwords

With the exception of a brute-force dictionary attack, all of these password-cracking methods rely on the event that someone somehow gains access to your router's configuration files in the first place. Of course, the chance of this happening becomes less likely when you've stored the configuration on the router and made it mandatory to have administrator privileges to access the configuration.

However, that doesn't mean it can't happen. Here are some possible scenarios:

Like a good administrator, you back up your configuration files to a TFTP server. However, the configuration file directory has NTFS or shared permissions for either everyone or all authenticated users. If someone can access the configuration file, he or she could easily decode a type 7 password and then gain access to the real router.
Like some organizations, you provide a username and password to support personnel that has read-only access to the configuration file. However, if someone has permission to read the file, he or she could easily decode a type 7 password.

The almost foolproof way to gain access to a router's configuration file is from the console. If someone can access the router's console, he or she can also view the configuration file and—of course—perform password recovery. This is why physical security for routers is so important.

Locking down access with commands

Cisco has an IOS command called no service password-recovery. This command prevents anyone with console access from accessing the router configuration and clearing the password. (For documentation of this command, check out Cisco's Web site.)

In addition, you should always use the enable secret command rather than the enable password command. The enable password command uses the weaker type 7 encryption, whereas the enable secret command uses the stronger type 5 encryption.

Cisco also has the service password-encryption command. But even with this command, all other passwords on the router remain encrypted with only the weaker type 7 encryption. To encrypt any username passwords, use the command username secret instead of the normal username command. (For more information, see Cisco's documentation for this command.)

Lock down routers with these summarized steps

In summary, to protect your routers, take the following steps:

Whenever possible, always use type 5 encryption, using commands such as enable secret and username secret.
Whenever storing your router's configuration somewhere off the router itself, take steps to protect access to the configuration by setting the proper permissions.
Use as much physical security as reasonably possible to protect access to the router's console.

Capture a Port on Cisco Switches using SPAN

2010-06-21T00:15:00.000-07:00

SPANs on Cisco Switches

Believe me, Cisco’s SPAN may be something you were looking for. So lets see what it is.

The switched port analyzer (SPAN) is a mechanism on Cisco switches that allows you to take traffic on one port and copy it to another. It’s generally used to get traffic to a sniffer or IDS for analysis, but it’s a great tool to use to sample traffic from a host for troubleshooting.

Let’s use a real-world example. You suspect that somebody is downloading songs or some other restricted content from your office’s internet, and you just want to CONFIRM that he is really downloading that stuff before taking some appropriate actions. This is an example scenarion whare SPAN can help you. You can use a SPAN to copy his traffic to another switch interface (may be your own PC’s port in that Cisco switch) whare you have already installed a Sniffer software.

Let’s say you have a 2950, and that suspecious person is on port F0/1 of your switch. You have your own PC plugged into F0/24 ready to capture the traffic. Here’s what you do. In global config mode, write ;

Switch(config)#monitor session 1 source interface F0/1 both

Switch(config)#monitor session 1 destination interface F0/24

This will create a new monitor session (that is, a SPAN session) that copies traffic from port F0/1 in both directions (simply saying, downloads and uploads) to port F0/24. Now, when you run tcpdump on your Linux box or some nice sniffer (easily available on the web) on your PC, you see all the traffic coming in and going out of that person’s port.

That’s pretty easy, right? You can have multiple sources ports by just adding more source lines or using ranges of ports. You can also just copy received or transmitted traffic from a source. Check out the contextual help for a little more info.

To see what’s going on, you can do a show monitor or a show monitor session 1 (depending on the IOS version). You’ll see something like this.

switch#sh monitor

Session 1

---------

Type              : Local Session

Source Ports      :

Both          : Fa0/1

Destination Ports : Fa0/24

Encapsulation : Native

Ingress : Disabled

If you take a look at the destination port when the SPAN is running, you’ll see it’s in a state of up/down (monitoring). I think you can figure out that this means we’re monitoring some traffic to this port. Here’s what you’ll see if you look at the port.

switch#sh int f0/24

FastEthernet0/24 is up, line protocol is down (monitoring)

...

There are two big things to keep in mind when doing SPANs. The first is that monitoring a port can drive CPU utilization way up (depending on the platform and traffic volume), so you may run into problems if you have a bunch of SPANs going at the same time. Related to this is the fact that, if your switch has to decide between switching and copying traffic, it will stop copying until there’s enough CPU headroom to do that safely, and you’ll lose packets in the meantime. It’s a switch — not a copier.

The second thing to keep in mind involves those little voices in your head called ethics. What if you see a VOIP phone call from your boss to the HR department? How about if you find someone in upper management copying a spreadsheet of people to be fired tomorrow? How about if you find an engineer’s telnet password to a key system? These are things that you probably shouldn’t see, so be careful when looking at the packets. I would suggest you tell someone in your security when you’re going to do a packet capture to make sure someone knows you’re not up to no good.

Easy Pinpoint method to Protect your router from a dictionary DoS attack

2010-06-18T05:59:00.000-07:00

Easy Pinpoint method to Protect your router from a dictionary DoS attack

You may not realize it, but a dictionary denial of service (DoS) attack on Telnet, SSH, or HTTP ports could hit your Cisco router. In fact, I bet most network administrators have at least one, if not more, of these ports open for router management.

Of course, having these ports open to a public network is much more dangerous than leaving them open on a private network. But either way, you need to do whatever you can to protect your routers from a dictionary DoS attack, which attackers could use to gain access to your router or simply create a service outage on your network.

Thanks to login enhancements in IOS 12.3(4)T and later, you can provide your routers with additional protection. These new login enhancements offer the following benefits:

Create delays between successive login attempts.
Disallow login if there are too many failed login attempts.
Create messages in the system log or send SNMP traps that alert/record additional information about the failed and disallowed logins.

How do you know if your router contains the appropriate code? The simplest way to find out is to go to Global Configuration Mode and enter login ? This command returns a list of choices, as shown below:

block-for Set quiet-mode active time period

delay Set delay between successive fail login

on-failure Set options for failed login attempt

on-success Set options for successful login attempt

quiet-mode Set quiet-mode options

If you don't have this code in your IOS, it will return an "Unrecognized command" error.

If you don't have the feature, use the Cisco IOS Feature Navigator to find the code for your router that has this feature. (Look for Cisco IOS Login Enhancements.) You can also use this tool to search for other features that you need. Keep in mind that a Cisco maintenance contract is necessary to download IOS code and access the Feature Navigator.

The only command required to configure the most basic form of these features is the login block-for command. Once you've enabled this command, there's a default login delay of one second. The system will deny all logins for a specified number of seconds if the maximum number of tries occurs within the time you indicate.

In global configuration mode, execute the following:

Here's an example:

This command configures the system to deny all logins to the router if there are five failed login attempts within 60 seconds. Then, if you enter show login, you'll receive the following output:

A default login delay of 1 second is applied.

No Quiet-Mode access list has been configured.

Router enabled to watch for login attacks.

If more than 5 login failures occur in 60 seconds or less,

logins will be disabled for 120 seconds.

Router presently in Normal-Mode.

Current Watch Window remaining time 54 seconds.

Present login failure count 0.

This shows you the setting you've configured, including the default login delay of one second, along with additional information. It also tells you that the router is in Normal Mode, which means that the router is currently allowing logins.

The router goes into Quiet Mode when it believes something has attacked it, and it begins denying all logins. You can also configure an ACL that will serve as an exclusion list of hosts/networks that the router will allow, regardless of whether it's in Quiet Mode.

Here are some options to configure some of these other commands:

login delay : Add the number of seconds of delay between failed logins. You can choose one to 10 seconds.
login on-failure and login on-success: This allows you to choose the type of logging/SNMP alerts when there are failed and successful logins.
login quiet-mode access-class : Add the ACL number, and this allows you to enter an exclusion list of hosts/networks allowed to log in to the router, regardless of whether the router is in Quiet or Normal Mode.

In general, I suggest enabling login block-for on all routers for security purposes. These new features will help better secure your routers.

And while you're at it--if you haven't already--consider enabling only SSH on your routers and only allowing access to that from the internal network. SSH encrypts all traffic between a PC and a router (including usernames and passwords).

For the complete command reference on these new features, check out the Cisco IOS Login Enhancements Documentation.

OSPF Basic Config

2010-05-29T10:53:00.001-07:00

Easy Pinpoint OSPF configurations on Cisco Routers

OSPF, as we all know is one of the most widely used IGPs today. Having knowledge of OSPF configurations is very important for any Network Engineer. Below are the steps given for OSPF configuration in your network.

NOTE: Bofore starting OSPF configuration on your Router, you must have at least 1 "UP" and active interface.

A major part of OSPF routing configuration in Cisco IOS is specifying the interfaces on which you want to run OSPF and the OSPF areas to which these interfaces belong. IOS gives you two configuration mechanisms:

1. The first mechanism is using "network" command within in the OSPF routing process configuration. The "network" command allows you to specify an ACL-like filter that can match multiple interfaces with a single command, significantly reducing the configuration complexity.

Router # configure terminal

Router(config) # router ospf [process-id]

Router(config-router) #network [ip-address] [wildcard-mask] area [area]

EXAMPLE:

Router # configure terminal

Router(config) # router ospf 555

Router(config-router) #network 10.0.0.0 0.255.255.255 area 0

2. The easiest, but less known method of configuring OSPF is via using interface-mode command for enabling OSPF. Syntax for using this command is explained below:

Router # configure terminal

Router(config) # interface [interface-type] [interface-number]

Router(config-if) # ip ospf [process-id] area [area-id]

EXAMPLE:

Router # configure terminal

Router(config) # interface serial 1/0

Router(config-if) # ip ospf 555 area 0

Both methods would accomplish exactly same task, i.e enabling OSPF on Serial 1/0 with OSPF process-id 555 (before using "network" command, you must have the ip address configured on Serial 1/0 within 10.0.0.0 network range).

Other useful OSPF commands are explained in next post. Hope it helped.

Enabling Static Routing on Cisco Devices

2010-02-12T04:46:00.000-08:00

Easy Static Routing configuration on Cisco Router / Switches

Static routing occurs when you manually add routes in each router’s routing table. The advantages of static routing are mentioned below:

1) It puts no overhead on the router CPU (dynamic routing protocols eg OSPF, EIGRP, RIP are CPU intensive).

2) There is no bandwidth usage between routers for routing managenent traffic (as for “Routing Updates” in dynamic routing protocols).

3) It adds security because the administrator can choose to allow routing access to certain networks only and can define a specific path for specific traffic etc.

But Static routing also has the following disadvantages:

1) The administrator must really understand the internetwork and how each router is connected in order to configure routes correctly (more responsibility on administrator).

2) If a single network is added to the internetwork, the administrator has to add a route to it on all routers by hand (this can be a lengthy job if you have many routers in your network).

3) If one network or next-hop has gone down, you will have to manually edit the routing entries in all affected routers.

The command syntax to configuring a static route in cisco router’s routing table is:

Router#configure terminal

Router(config)#ip route [destination_network] [destination_mask]

[next-hop_address or exit interface]

An example of configuring a static route is mentioned below:

Router#configure terminal

Router(config)#ip route 10.0.0.0 255.0.0.0 15.0.0.2

Where 10.0.0.0 / 255.0.0.0 is destination network and 15.0.0.2 is the next-hop address of far-end router.

How OSPF Router ID is selected?

2010-02-12T04:41:00.000-08:00

OSPF Router ID selection algorithm

Every OSPF process running in Cisco IOS requires a router-wide unique router ID. An IP address of an active interface is commonly used as the OSPF router ID; you can also use the router-id address router configuration command to ensure the OSPF router ID does not change even when the interface IP addresses change.

OSPF router ID should not be changed after the OSPF process has been started. OSPF router ID change resets all OSPF adjacencies, resulting in temporary router outage. The router also has to originate new copies of all its LSAs with the new router ID. Stale copies of the LSAs originated by the “old” OSPF process remain in the OSPF topology databases of all routers until they expire (their age increases beyond max-age).

Router ID selection algorithm

If the router-id is specified in the OSPF configuration, the specified IP address is used. If the IP address configured with the router-id command overlaps with the router ID of another already active OSPF process, the router-id command fails.

If OSPF router ID was not set with the router-id configuration command (router-id command was not used in the OSPF configuration or there was a router ID overlap with another OSPF process), OSPF uses an interface IP address as its router ID.

The following algorithm is used to select an interface IP address as the OSPF router ID:

IP addresses of all applicable loopback interfaces are collected. Addresses already used as OSPF router ID of other OSPF processes are removed. If any addresses are left, the highest IP address is used as the OSPF router ID.

Applicable interfaces are operational (line protocol is up) interfaces in the IP routing table as the OSPF process.

If the OSPF router ID has not been selected in the first step, IP addresses of all other applicable interfaces are collected. OSPF router IDs of active OSPF processes are removed from the list and the highest IP address is used.
If the router was still not able to select an OSPF router ID, an error message is logged and the OSPF process does not start.

An OSPF process that failed to select a router ID retries the selection process every time an IP address becomes available (an applicable interface changes its state to up or an IP address is configured on an applicable interface).

Changing the OSPF router ID

Once an OSPF router ID is selected, it is not changed even if the interface that was used to select it changes its operational state or its IP address. Earlier IOS releases changed the OSPF router ID when the underlying interface state changed, resulting in unnecessary network instabilities.

To change the OSPF router ID, you have to reset the OSPF process with the clear ip ospf process command (even when the new router ID was requested with the router-id router configuration command).

AN EXCELLENT CISCO IOS COMMAND

2010-02-03T00:47:00.000-08:00

AN EXCELLENT IOS COMMAND

           I just found and amazing Cisco IOS command, that i should have learned years ago. This IOS command is very handy, specially when making lengthy configurations on a large number of routers.

The said command works as a macro and can actually assigns a "keyword" (which can be a single alphabet) for a lengthy IOS command. This command is issued from global config mode and the syntax of this command is;

          Router(config)# alias (config mode) (your keyword) (complete command)

where,
config mode:    It is the mode from which the actual command (or keyword) will be issued. This mode can be EXEC, CONFIG, INTERFACE mode etc.
your keyword: It is your keyword that you want to use in-place of lengthy command.
complete command: It is the complete command that the router will assume instead of the keyword.

Example 1, To assign keyword "SII" for command "Show Ip Interface" (which in entered in exec mode), you can use following command;

Router(config)# alias exec SII Show Ip Interface

          Now, when keyword "SII" will be typed in exec-mode (# mode), it will be treated by router as complete command "Show Ip Interface" were entered.

Example 2, To assign keyword "NS" for command "No Shut" for enabling an interface, we can use this as;

         Router(config)# alias interface NS No Shut

         After that, whenever keyword NS will be entered in any interface configuration mode, it will be treated as complete command "No Shutdown" were entered.

          As a general guideline, I am also showing some most commonly used aliases. You just copy them in the global config mode of your Router / Switch.

Router(config)# alias configure sir show ip route

Router(config)# alias configure siib show ip interface brief

Router(config)# alias exec sir show ip route

Router(config)# alias exec siib show ip interface brief

Router(config)# alias exec s sh run

Router(config)# alias exec c conf t

Router(config)# alias exec map show frame map

Router(config)# alias exec pvc show frame pvc

Router(config)# alias interface ns no shutdown

Router(config)# alias interface sa switchport mode access

Router(config)# alias exec w write memory

Easy enabling Secure Shell (SSH) on Cisco Routers & Switches

2009-10-12T06:35:00.001-07:00

Easy enabling Secure Shell (SSH) on Cisco Routers & Switches

As most of you know that Telnet has no security mechanisms. Telnet sends passwords in clear-text and these passwords can be easily seen using a packet sniffer like Wireshark, formerly called Ethereal (goto the post Easy capturing Telnet Password using Wireshark Packet Sniffer to view complete procedure). Instead of Telnet, you can use Secure Shell, which creates a more secure session than telnet, which uses an unencrypted data stream. You can understand SSH as an “security-enabled” version of Telnet. Secure Shell (SSH) uses encrypted keys to send data so that your username and password are not sent in the clear text.

Here are the steps to setting up SSH:

1. Set your hostname:

Router(config)#hostname R_1

2. Set the domain name (both the hostname and domain name are required for the encryption keys to be generated):

R_1(config)#ip domain-name example.com

3. Generate the encryption keys for securing the session:

R_1(config)#crypto key generate rsa general-keys

Then it will ask for number of bits to use for asynchronous encryption (using public-private keys). You can use 1024 bit keys for most router platforms. Generating 2048 bit keys will be CPU intensive. Generating keys may take few seconds to 15 minutes generate keys, depending upon your platform.

4. Set the max idle timer for a SSH session to 60 socends:

R_1(config)#ip ssh time-out 60

5. Set the max failed attempts for an SSH connection to 2:

R_1(config)#ip ssh authentication-retries 2

6. Then, goto vty lines config mode using following command, the last vty line number changes router-to-router. Use question mark to view last line-number:

R_1(config)#line vty 0 ?

R_1(config)#line vty 0 4

7. Last, configure SSH and then Telnet as access protocols:

R_1(config-line)#transport input ssh telnet

If you do not use the keyword telnet at the end of the command string, then only SSH will work on the router.

Easy capturing Telnet Password using Wireshark Packet Sniffer

2009-10-12T06:30:00.000-07:00

Easy capturing Telnet Password using Wireshark Packet Sniffer

Wireshark is a freeware, open-source packet-sniffer and can be downloaded from www.wireshark.org/download.html (size:17 MB). Steps to capture telnet passwords using this software are mentioned below:

1. First connect to the LAN segment where passwords are sent using a Hub etc or any other medium where you are able to get telnet packets (as Hub repeats all packets on all ports, except receiving port).

2. Then open Wireshark and on top-left pane, click your interface connecting to that LAN segment (like your Fastethernet interface) and live capture will start.

3. In the Wireshark window, you will see many columns like source, destination, protocol and info etc. In ‘Protocol’ column, you will see written ‘TELNET’. Right-click on that and click ‘Follow TCP Stream’, This step will show you an output like this

...............

User Access Verification

Password: .............P..............ANSI..cisco1

Router>eenn

Password: cisco2

Router#sshhooww iipp iinntt bbrr

Interface IP-Address OK? Status Protocol

FastEthernet0/0 10.0.0.1 YES up up

FastEthernet0/1 unassigned YES up up

Router#

As you can see, it is not only showing the login and enable secret password, but also the complete session whatever the administrator is doing. In above example, cisco1 is the login password and cisco2 is enable secret password. Also, remember that this output will show some text doubled like “show ip int br” command, but it can still be easily understood.

So, afraid of using Telnet in your network. Instead of Telnet, use SSH. Refer to post Easy enabling Secure Shell (SSH) on Cisco Routers and Switches for start using SSH on your device).

Easy Functions of Layer-2 Switching

2009-10-04T06:41:00.000-07:00

Functions of Layer-2 Switching

There are three distinct functions performed at OSI layer-2 (the Data-Link layer) namely Learning, Forwarding & Filtering and Loop Avoidence. These functions are explained in following sections;

1) Learning
When switch starts, the MAC address table has no entry. When a node transmits data on its wire the MAC address of the node is learned by Switch Port connected to that node. In this way all the MAC addresses are learned by respective ports and these entries remain in the cache for a specific time. If during this specific time no new frame arrives from a node MAC address entry for that node is dropped from cache.

2) Forwarding & Filtering

When a MAC address for a port is learnt, packets addressed to that MAC address are forwarded only to the port associated with it, using one of the Switching Methods (i.e Store & Forward, Cut Through & Fragment Free).

3) Loop Avoidance

Switches and Bridges use Spanning Tree Protocol (STP), specified by IEEE 802.1d, or one of its variants to prevent loops. Loops can be caused by multiple connections between switches, established for redundancy.

Easy Switching Techniques used by Cisco Switches

2009-10-04T05:17:00.000-07:00

Switching Methods of Cisco Switches

Switching methods are the techniques used by switches to forward frames after their reception, with respect to how much of the frame has been received and error checking. There are mainly three techniques used in Cisco Switches, which are;

1) Store & Forward: In this method complete frame is received by the switch. CRC, source address and destination address are checked. This method has following features:-

• Highest latency (delay in forwarding of frame) but may vary depending upon the length of frame.

• Highest error checking.

• Lowest frame forwarding speed.

Catalyst 500 switch uses this method.

2) Cut Through: In this method forwarding starts as soon as destination address of the frame is received in header. Also known as WIRE SPEED. This method has following features:-

• Lowest latency.

• Lowest error checking.

• Highest frame forwarding speed.

3) Fragment Free (Modified Cut Through): In this method forwarding starts as soon as first 64 bytes of the frame are received as fragmentation occurs usually in first 64 bytes. This method has following features:-

• Latency approx 60 Sec.

• Sufficient error checking.

• Moderate frame forwarding speed.

Switch and Bridge Diferences and Working

2009-10-04T04:37:00.000-07:00

Switch and Bridge

Switches and Bridges are pretty similar, both operate at the Data Link layer (just above Physical) and both can filter data so that only the appropriate segment or host receives a transmission. Both filter packets based on the physical address (AKA MAC - Media Access Control - address) of the sender/receiver although newer switches sometimes include the capabilities of a router and can forward data based on IP address (operating at the Network Layer) and are referred to as IP Switches or Multi Layer Switches.

Often the desired results could be achieved using either a switch or a bridge but *in general* bridges are used to extend the distance capabilities of the network because bridge can connect only two networks/ LANs/ hosts, means bridge has only two ports. While switch can connect more than two networks/ LANs/ Hosts because switch has more than two ports., and switches are used to primarily for their filtering capabilities to create multiple, smaller virtual LAN's out of one large LAN for easier management/administration (V-Lan's). Further details about both of them are given below;

The Switch

A switch is a layer 2 network device that forwards frames using MAC addresses in the header of frames. It improves network performance by segmenting the network and creating separate collision domains on each port so reducing competition for bandwidth.

In a switch, frame forwarding is handled by specialized hardware called "Application Specific Integrated Circuit" (ASIC). A switch dynamically builds and maintains a Content-Addressable Memory (CAM) table, holding all of the necessary MAC information for each port.

The Bridge

Bridge is a layer 2 device used to connect different network types or networks of the same type. Packets having destination address on the same network segment are dropped. Bridges use "Store and Forward" method to inspect the whole packet. As a common thought, bridge introduces 20 to 30 % latency. Generally, a bridge has only two ports and divides a collision domain into two parts.

Configuration of MOTD Banner on Cisco Router

2009-10-01T23:11:00.000-07:00

Setting Up MOTD Banners on Cisco Router

A banner is more than just a little cool—one very good reason for having a banner is to give any and all who dare attempt to telnet or dial into your internetwork a little security notice.

And you can create a banner to give anyone who shows up on the router exactly the information you want them to have. Although there are many banner types like exec process creation banner,incoming terminal line banner, login banner, message of the day (MOTD) banner is the most extensively used banner.

Router(config)#banner ?
LINE                c banner-text c, where ‘c’ is a delimiting character
exec                Set EXEC process creation banner
incoming        Set incoming terminal line banner
login                Set login banner
motd               Set Message of the Day banner

Message of the day banner offers an all round performance by giving a message to every person dialing into or connecting to the router via Telnet or auxiliary port, or even through a console port. The part to understand is the delimiting character—its used to tell the router when the message is completed. You can use any character you want for it, but you can’t use the delimiting character in the message itself, that’swhy use . As seen here:

Router(config)#banner motd ?
LINE c banner-text c, where ‘c’ is a delimiting character
Router(config)#banner motd #
[Enter text message here. End with the character ‘#’.]
#
Router(config)#

For example, you can set a banner on one line as shown:

Router(config)#banner motd # Unauthorized access prohibited! It may lead to legal action. If you are not an authorized user, disconnect now. #

Easy Configuration of the System Clock on Cisco Routers & Switches

2009-10-01T22:21:00.000-07:00

Setting the System Clock on Cisco Routers & Switches

Router’s clock is a useful tool when making advanced configurations and different routers’ clock must be exactly synchronized. The system clock runs from the moment the system starts up and keeps track of the current date and time. The system clock can be set from a number of sources, and in turn can be used to distribute to other systems. To manually set the system clock, use one of the formats of the clock set EXEC command (Remember, its not a golbal config command, although it affects the whole router).

Router# clock set hh:mm:ss day month yyyy
Router# clock set hh:mm:ss month day yyyy

In the following example, the system clock is manually set to 1:32 p.m. on May 12, 2001:

Router#clock set 09:40:00 19 Jan 2009

To view the status of current clock of Router, use following command;

Router# show clock

09:40:31.247 UTC Mon Jan 19 2009

Easy Enable Password Configuration on Cisco Routers & Switches

2009-10-01T21:36:00.001-07:00

Easy Enable Password Configuration on Cisco Routers

The “enable password” and “enable secret passwords set password that’s used to enter privileged mode. You can use this to restrict people from changing your router or switch’s configurations, if they have connected to your device. You can set the enable passwords from global configuration mode like this:

Router(config)#enable ?
password Assign the privileged level password
secret Assign the privileged level secret

The following points describe the enable password parameters:
Password Sets the enable password on older, pre-10.3 systems, and isn’t ever used if an enable secret is set.
Secret Is the newer, encrypted password that overrides the enable password if it’s set. Use this method in your real-world configs, instead of “enable password” method.
Here’s an example of setting the enable passwords:

Router(config)#enable secret your-password
Router(config)#enable password your secret password

If you try to set the enable secret and enable passwords the same, the router will give you a nice, polite warning to change the second password. If you don’t have older legacy routers, don’t even bother to use the enable password.

Easy Hostname Configuration on Cisco Router

2009-10-01T21:21:00.001-07:00

Easy configuring of Hostnames on Cisco Router

You can easily set the “name” of the router with the “hostname” command used in global configuration mode. This is only locally significant, which means that it has no bearing on how the router performs name lookups or how the router works on the internetwork and its identification in the internetwork (by the way, identification is commonly done using IP address).

Router>enable

[to enter privileged exec mode]

Router#configure terminal

[to enter global configuration mode]

Router(config)#hostname [hostname of router]

[final command to configure the hostname]

A recommended practice is to name the router something related to the location to ensure that you are configuring the correct router and also to easily identify the router when you are connected to multiple routers simultaneously, for some troubleshooting or configuring something.

BASIC COMMANDS OF CISCO IOS

2009-10-01T21:17:00.001-07:00

BASIC IOS COMMANDS

1. Router’s initial prompt (user-exsec mode).

Router>

2. Enter Privilege Mode.

Router>enable

Router#

3. Show the active configuration in memory using following command. The currently active configuration script running on the router is referred to as the running-configuration on the cisco routers command-line interface. privileged mode is required to execute this command.

Router#show running-config

4. Flash memory is a special kind of memory on the router that contains the operating system image file(s). Unlike regular router memory, Flash memory continues to maintain the file image even after power is lost. To view the contents of flash, use command;

Router#show flash

5. The routers Command Line Interface (CLI) maintains history of last 10 commands (by default) you have entered in memory. To view the past commands still in router memory, issue;

Router#show history

6. What two commands will let you retrieve the previous command you typed?

Press the up arrow

< ctrl > P

7. What two commands will let you use the next command in the history buffer?

Press the down arrow

< ctrl > N

Also refer to help post for further terminal editing features.

8. To view the status of the current layer 3 routed protocols running on your router;

Router#show protocols

9. The command to obtain critical information, such as: router platform type, operating system revision, operating system last boot time and file location, amount of memory, number of interfaces, and configuration register is;

Router#show version

10. Issue following command to view the router’s clock;

Router#show clock

11. What command will display a cached list of hosts and all of their interfaces IP

Addresses?

Router#show hosts

12. To view a list of all users who are connected to the router;

Router#show users

13. Use following command to view detailed information about each interface.

Router#show interfaces

14. What command will show the global and interface-specific status of any layer 3 protocols?

Router#show protocols

FIRST INTERATION WITH CISCO IOS

2009-10-01T21:04:00.000-07:00

FIRST INTERATION WITH CISCO IOS (Internetwork Operating System)

As it’s the first time you are connected to Cisco router, we are going to start with very basic stuff. (The prompts discussed in this post are shown when you are connected to router’s CLI and have rejected to enter Setup mode. If you are want to know about Cisco Router's Boot Sequence, refer to Cisco router’s startup sequence, post). Let’s go for it then;

When you connect to a new router via console cable, and the interface and other status messages have been displayed, press the "Enter" key to get started.

You are now connected to your Router at the user mode prompt (Router> prompt). This prompt is broken down into two parts, the hostname-part and the mode-part. "Router" is the Router's hostname and ">" means you are in user mode.

1. Press RETURN to get started

Router>

2. Next type the command enable to get to the privileged mode prompt.

Router>enable

Router#

3. To get back to the user mode, simply type disable. From the user mode, type disable to go back into user-exec mode. You can also type logout or exit to leave the router.

Router# disable

Router>

Router>exit

Router con0 is now available

Press RETURN to get started

4. You are now again in user-exec mode. Type the command that is used to view all the available commands at this prompt.

Router>?

3. Type the command used to enter Privilege mode.

Router>enable

Router#

4. View the available commands in Privilege mode.

Router#?

5. Type the command that will allow you to see all of the show commands.

Router#show ?

6. Type the command that will allow you to see the active or running configuration.

Router#show running-config

7. At the more prompt, hit the key that will show you the next page of information.

8. Type one of the commands that will log you out of the router.

Router#exit

Router#disable

Ways to Connect to a Cisco Router : Console, Auxialiary and Virtual Terminal Lines

2009-10-01T06:21:00.000-07:00

Connecting to a Cisco Router

Most OSI layer-1 devices (like Hubs an Repeaters) and rare layer-2 devices come with fixed and unchangeable configuration. But advanced networking devices (obviously, like Cisco Routers and Switches) let you fine tune each and every parameter of our device and make very advanced configs. You can connect to a Cisco router to configure it, verify its configuration, and check statistics.

There are mainly three ways to connect to a Cisco Router which are using the console port, using auxilliary port and using virtual terminal lines. All these ways are discussed below.

1. Most often, the first place you would connect to is the console port. The console port is usually an RJ-45 (8-pin modular) connection located often at the back of the router—by default, there’s may or may not be a password set. The new ISR routers use cisco as the username and cisco as the password by default.

2. You can also connect to a Cisco router through an auxiliary port. An auxiliary port allows you to configure modem commands so that a modem can be connected to the router. This is a cool feature—it lets you dial up a remote router and attach to the auxiliary port if the router is down and you need to configure it using console like features. The auxiliary port can also be used same like console port (to directly connect RJ-45).

3. The third way to connect to a Cisco router is through programs like Telnet and Secure Shell etc. (In-band means configuring the router through the network, the opposite of “out-of-band.”)Telnet is a terminal emulation program that acts as though it’s a dumb terminal. You can use Telnet to connect to any active interface on a router, such as an Ethernet or serial port.

How to use Keyboard Hot Keys of Cisco IOS? The Terminal Editing

2009-10-01T05:45:00.001-07:00

Keyboard Hot Keys

Cisco provides an easy to use and faster experience to its devices. Here is another cool feature for your support. This feature is about using IOS keyboard hot keys. This feature is useful is such situation like you have typed a wrong and lengthy IOS command but came to know this before entering, so instead of holding the Backspace key pressed until whole command is erased, you can simply press Ctrl-U to erase the whole line at once. Some of them are rarely used, while some are used very often used while configuring your Cisco device. The following table lists more of such keyboard hot keys.

Ctrl+A Moves your cursor to the beginning of the line

Ctrl+E Moves your cursor to the end of the line

Esc+B Moves back one word

Ctrl+B Moves back one character

Ctrl+F Moves forward one character

Esc+F Moves forward one word

Ctrl+D Deletes a single character

Backspace Deletes a single character

Ctrl+R Redisplays a line

Ctrl+U Erases a line

Ctrl+W Erases a word

Ctrl+Z Ends Configuration mode and returns to EXEC

Tab Finishes typing a command for you

How to use Easy Help Features on Cisco Routers and Switches?

2009-10-01T05:30:00.000-07:00

How to use Easy Help Features on Cisco Routers and Switches?

Cisco routers and switches provide you an easy way to help you while configuring your router by showing you all possible commands supported at that specific mode. So you do not have to remenber all the lengthy commands as this feature takes you to a simple chose-the-right-answer position. All these ways ara similarly applicable irrespective of router’s mode. There are three great places of using Cisco IOS’s help features, which are listed below:

1) To list all commands available for a particular command mode, enter a question mark (?) at that prompt. Like

Router #?

access-enable Create a temporary Access-List entry

access-profile Apply user-profile to interface

calendar Manage the hardware calendar

…… (a long list of supported commandss)

2) To obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called word help, because it lists only the keywords or arguments that begin with the abbreviation you entered. e.g.

Router# co?
configure connect copy

3) To list a command's associated keywords or arguments, enter a question mark (?) in place of a keyword or argument on the command line. This form of help is called command syntax help, because it lists the keywords or arguments that apply based on the command, keywords, and arguments you have already entered. e.g.

Router# cofigure ?

memory Configure from NV memory

network Configure from a TFTP network host

overwrite-network Overwrite NV memory from TFTP host

terminal Configure from the terminal

Another great feature: If you enter an incorrect command, the caret symbol (^) and help response indicate the error. Notice that the caret symbol character is displayed at the point in the command string where the IOS detected that you entered an incorrect command, keyword, or argument.
This error location facility together with the interactive help system allows you to find and correct syntax errors easily.

Easy Cisco Router Boot Sequence

2009-10-01T04:09:00.000-07:00

The Cisco Router Boot Sequence

When a router boots up, it performs a series of steps, called the Boot Sequence, to test the hardware and load the necessary software and files. The boot sequence consists of the following steps:

1. The router performs a POST. The POST tests the hardware to verify that all components of the device are operational and present. For example, the POST checks for the different interfaces on the router. The POST is stored in and run from ROM (read-only memory).

2. The bootstrap looks for and loads the Cisco IOS software. The Bootstrap is a program in ROM that is used to execute programs. The bootstrap program is responsible for finding where each IOS program is located and then loading the file. By default, the IOS software is loaded from flash memory in all Cisco routers. It can also be loaded from other locations like a TFTP server or router’s ROM (the “mini IOS”).

3. The IOS software looks for a valid configuration file stored in NVRAM. This file is called startup-config and is only there if an administrator copies the running-config file into NVRAM, a brand new router will not have such file.

4. If a startup-config file is in NVRAM, the router will load and run this file. The router is now operational. If a startup-config file is not in NVRAM, the router will start the setup-mode configuration upon bootup.

Basics of Router and Switch. What they are?

2009-09-29T14:24:00.001-07:00

The Router

A Router is a layer 3 network device that moves data between different network segments and can look into a packet header to determine the best path for the packet to travel. Routers can connect network segments that use different protocols. They also allow all users in a network to share a single connection to the Internet or a WAN. It is used to improve network performance by:-

• segmenting the network and creating separate collision & broadcast domains.

• reducing competition for bandwidth.

• Broadcasts are not forwarded to other network segments.

• Increases security by using Access Lists.

The Network Switch

A network switch commonly refers to a Network bridge that processes and routes data at the Data link layer (layer 2) of the OSI model. Switches that additionally process data at the Network layer (layer 3 and above) are often referred to as Layer 3 switches or Multilayer switches.

Some more facts about switches are:-
• Switches don’t look at IP address information.

• Switches only sends traffic to the devices that are the destination for that traffic, saving bandwidth.

• Each device connected to the switch gets the full bandwidth of the switch port because the switch prevents collisions

• There are many types of switches, managed, unmanaged, chassis-based, and layer 3.

Basic Configuration Modes of a Cisco Router / Switch

2009-09-29T12:44:00.000-07:00

Configuration Modes of a Cisco Router / Switch

The Cisco IOS software CLI defines different configuration modes for different tasks. These modes are structured in a hierarchical fashion, and each mode allows a group of specific commands.

The basic modes of Cisco Command Line Interface (CLI) are:-

• User mode
• Privileged mode

• Global Configuration Mode
• Setup mode

• Rom Monitor Mode

User Exec Mode

When a Cisco router is powered-on, this is the first mode that appears. User exec mode allow you to perform basic tests and list some system information. This mode is indicated by “[hostname]>” sign.

Privileged Mode
To configure a cisco device, you enter into privileged mode from user exec mode. All The commands available in user exec mode are also available in Privileged mode. Privileged exec commands can be used to make major system changes, set operating parameters, perform a detailed examination of the router's status, test and debug router operation, access global and other included configuration modes. This mode is indicated by “[hostname]#” sign.

Global Configuration Mode

From Privileged mode you can enter global configuration mode. This gives you access to configuration commands that affect the system as a whole, and to other configuration modes.
You can access many other specific configuration modes from Global Configuration mode that allow complex configurations to be performed. This mode is shown by [hostname] (config) # sign.

Interface configuration Mode

This mode is accessed from Global config mode, and is used for configuring the interfaces of device. The command to access this mode from global config mode is:

[hostname] (config)# interface serial 0/0. This mode is shown by

[hostname] ( config-if )# sign.

======================================
======================================

Setup and Rom Monitor modes are special Cisco CLI configuration modes which are used for very specific configuration tasks. Further description is given below:

Setup Mode

When powered-on, if the Cisco router does not have a configuration file, it will ask to enter the Setup mode or not. Setup mode is a step-by-step process which presents you with a prompted dialog (called the system configuration dialog) in which you establish basic configuration. For better learning, experts recommend to use IOS CLI instead of setup mode for all configurations.
Rom Monitor Mode

If the router does not find a valid operating system image, or if you interrupt the boot sequence, the system may enter ROM monitor mode. From ROM monitor mode you can boot the device or perform diagnostic tests.

Internal Components of a Cisco Router / Switch

2009-09-29T11:05:00.000-07:00

Cisco Router Internal Components

--- ROM

ROM is used to store the router's bootstrap startup program (which searches for a suitable system image when the router is switched on), operating system software, and power-on diagnostic tests programs. In order to perform ROM upgrades you remove and replace pluggable chips on the motherboard.

--- Flash Memory

Flash is a variation of Electrically Erasable Programmable Read-Only Memory (EEPROM). It holds operating system image(s). Flash memory is erasable, reprogrammable ROM. You can perform Cisco® IOS software upgrades without having to remove and replace chips. Flash content is retained when you switch off or restart the router.

--- RAM

RAM (Random Access Memorys ) is used to store operational information such as routing tables, router's running configuration file. RAM also provides caching and packet buffering capabilities. Its contents are lost when you switch off or restart the router. All configuration changes are saved to this file unless you explicitly save the changes to the NVRAM.

--- NVRAM

NVRAM (NonVolatile Random Access Memory) is used to store the router's startup configuration file. It does not lose data when power is switched off. So the contents of the startup configuration file are maintained even when you switch off or restart the router. The router looks for the configuration information in the NVRAM unless the router is configured to load the configuration file from some other source.

--- NETWORK INTERFACES

The network interfaces provide network connectivity to the router. The may be located on the motherboard or on separate interface modules. It may have many interfaces for LAN (Local Area Network) and WAN (Wide Area Network) connectivity. Network interfaces are diacussed in greater in next posts.