nonkimono

Adding Repositories on CentOS

noreply@blogger.com (Joseph Martinez) — Fri, 17 Apr 2009 00:57:00 +0000

Adding DAG Repo:

#cd /etc/yum.repos.d
#vi dag.repo

Fill-in the following lines and save it.

[dag]
name=Dag RPM Repository for Red Hat Enterprise Linux baseurl=http://apt.sw.be/redhat/el$releasever/en/$basearch/dag
gpgcheck=1
enabled=1

Issue this ;

# rpm –import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt

Try to install using yum.

Neat huh...

Cisco Discovery Protocol

noreply@blogger.com (Joseph Martinez) — Tue, 20 Jan 2009 01:39:00 +0000

Cisco Discovery Protocol

Router#show cdp	Displays global CDP information (such as timers)
Router#show cdp neighbors	Displays information about neighbors
Router#show cdp neighbors detail	Displays more detail about neighbor device
Router#show cdp entry word	Displays information about device named word
Router#show cdp entry *	Displays information about all devices
Router#show cdp interface	Displays info about interfaces that have CDP running
Router#show cdp interface x	Displays info about specific interface x running CDP
Router#show cdp traffic	Displays traffic infopackets in/out/version
Router(config)#cdp holdtime x	Changes length of time to keep CDP packets
Router(config)#cdp timer x	Changes how often CDP updates are sent
Router(config)#cdp run	Enables CDP globally (on by default)
Router(config)#no cdp run	Turns off CDP globally
Router(config-if)#cdp enable	Enables CDP on a specific interface
Router(config-if)#no cdp enable	Turns off CDP on a specific interface
Router#clear cdp counters	Resets traffic counters to 0
Router#clear cdp table	Deletes the CDP table
Router#debug cdp adjacency	Monitors CDP neighbor information
Router#debug cdp events	Monitors all CDP events
Router#debug cdp ip	Monitors CDP events specifically for IP
Router#debug cdp packets	Monitors CDP packet-related information

Caution:

Although CDP is an excellent source of information to you the network administrator, is it a potential security risk if a hacker gains access to one of your systems. The information that you gain through CDP is also gained by the hacker.

After you have used CDP to gather your information in a production environment, turn it off to thwart any bad people from using it for no good.

Copying IOS to TFTP Server

noreply@blogger.com (Joseph Martinez) — Wed, 14 Jan 2009 00:58:00 +0000

Copying IOS to TFTP Server

2900 Series Switch

2900Switch#copy flash:c2900XL-hs-mz-112.8.10-SA6.bin tftp	Same procedure as with router
Source filename [c2900XL-hs-mz-112.8.10-SA6.bin]?	Just press ENTER
Destination IP address or hostname [ ]192.168.1.3	Address of TFTP server
Destination filename [c2900XL-hs-mz-112.8.10-SA6.bin]?	Just press ENTER
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!	Each bang symbol (!) = 1 datagram sent



1119104 bytes copied in 21.43 secs
2900Switch#

2950 Series Switch

2950Switch#copy flash tftp	Same procedure as with router
Source filename [ ]? c2950-c3h2s-mz.120-5.3.WC.1.bin
Destination IP address or hostname [ ]192.168.1.3	Address of TFTP server
Destination filename [c2950-c3h2s-mz.120-5.3.WC.1.bin]?	Just press ENTER
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!	Each bang symbol (!) = 1 datagram sent


1674921 bytes copied in 31.542 secs
2950Switch#

Restoring IOS from ROMmon Mode Using Xmodem

noreply@blogger.com (Joseph Martinez) — Wed, 07 Jan 2009 00:34:00 +0000

Restoring IOS from ROMmon Mode Using Xmodem

The output that follows was taken from a 1720 router. Some of this output might vary from yours, depending on the router model that you are using.

rommon 1 >confreg	Shows configuration summary. Step through the questions, answering defaults until you can change the console baud rate. Change it to 115200; makes transfer go faster
Configuration Summary enabled are: load rom after netboot fails console baud: 9600 boot: image specified by the boot system commands or default to: cisco2-c1700
do you wish to change the configuration? y/n [n]: y enable "diagnostic mode"? y/n [n]: n enable "use net in IP bcast address"? y/n [n]: n disable "load rom after netboot fails"? y/n [n]: n enable "use all zero broadcast"? y/n [n]: n enable "break/abort has effect"? y/n [n]: n enable "ignore system config info"? y/n [n]: n change console baud rate? y/n [n]: y enter rate: 0=9600, 1=4800, 2=1200, 3=2400 4=19200, 5=38400, 6=57600, 7=115200 [0]: 7 change the boot characteristics? y/n [n]: n	Prompts will begin to ask a series of questions that will allow you to change the config-register. Answer n to all questions except the one that asks you to change the console baud rate. For the enter rate, choose 7 because that is the number that represents a baud rate of 115200
Configuration Summary enabled are: load rom after netboot fails console baud: 115200 boot: image specified by the boot system commands or default to: cisco2-c1700 do you wish to change the configuration? y/n [n]: n rommon2>	After the summary is shown again, choose n to not change the configuration and go to the rommon> prompt again

rommon 2>reset	Reloads router at new com speed. Change HyperTerminal setting to 115200 to match the router's new console setting


Rommon 1>xmodem c1700-js-l_121-3.bin	Asking to transfer this image using Xmodem
......
Do you wish to continue? y/n [n ]:y	Choose y to continue


	In HyperTerminal, go to Transfer, then Send File (See Figure A). Locate the IOS file on the hard drive and click Send (See Figure B)
Router will reload when transfer is completed

Reset baud rate on router

Router(config)#line con 0
Router(config-line)#speed 9600
Router(config-line)#exit	HyperTerminal will stop responding. Reconnect to the router using 9600 baud, 8-N-1

Figure A. Finding the IOS Image File

Figure B. Sending the IOS Image File to the Router

Restoring/Upgrading IOS from a TFTP Server

noreply@blogger.com (Joseph Martinez) — Mon, 22 Dec 2008 05:03:00 +0000

Restoring/Upgrading IOS from a TFTP Server

Otep#copy tftp flash
Address or name of remote host [ ]? 192.168.119.20
Source filename [ ]? c2600-js-l_121-3.bin ***Hit ENTER
Destination filename [c2600-js-l_121-3.bin]? ***Hit ENTER
Accessing tftp://192.168.119.20/c2600-js-l_121-3.bin
Erase flash: before copying? [confirm] ***Hit ENTER	If Flash memory is full, must erase it first
Erasing the flash file system will remove all files
Continue? [confirm]***Hit ENTER	Press CNTL+C if you want to cancel
Erasing device eeeeeeeeeeeeeeeeee...erased	Each e represents data being erased
Loading c2600-js-l_121-3.bin from 192.168.119.20
(via) FastEthernet 0/0): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!	Each bang symbol (!) = 1 datagram of data
Verifying Check sum .................. OK
[OK 8906589 Bytes]
8906589 bytes copied in 277.45 secs
Otep#	Success

Backing Up IOS to a TFTP Server

noreply@blogger.com (Joseph Martinez) — Wed, 17 Dec 2008 02:23:00 +0000

Backing Up IOS to a TFTP Server

OTEP#copy flash tftp
Source filename [ ]? c2600-js-l_121-3.bin	Name of IOS image
Address or name of remote host [ ]? 192.168.119.20	Address of TFTP server
Destination filename [c2600-js-l_121-3.bin]?Hit ENTER	Destination filename is the same as the source filename, so just press ENTER
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (u@!!!!!!!!!!!!!!!!!!!!!!!!!!!!
8906589 bytes copied in 263.68 seconds
OTEP#

Restoring Configurations

noreply@blogger.com (Joseph Martinez) — Thu, 04 Dec 2008 23:53:00 +0000

Restoring Configurations

Otep#copy tftp run	Copies configuration file from TFTP server to DRAM
Address or name of remote host[ ]? 192.168.119.20	IP address of TFTP server
Source filename [ ]?Otep-confg	Enter the name of the file you want to retrieve
Destination filename [running-config]? Hit ENTER
Accessing tftp://192.168.119.20/Denver-confg...
Loading Denver-confg from 192.168.119.02 (via Fast Ethernet 0/0):
!!!!!!!!!!!!!!
[OK-624 bytes]
624 bytes copied in 9.45 secs
Otep#	File has been transferred successfully

Note:

You can also use the preceding sequence for a copy tftp start command sequence.

Backing Up Configurations

noreply@blogger.com (Joseph Martinez) — Wed, 03 Dec 2008 00:54:00 +0000

Backing Up Configurations

OTEP#copy run start	Saves running-config from DRAM to NVRAM (locally)

OTEP#copy run tftp	Copies running-config to remote TFTP server
Address or name of remote host[ ]? 192.168.119.20	IP address of TFTP server
Destination Filename [OTEP-confg]? PRESS ENTER	Name to use for file saved on TFTP server
!!!!!!!!!!!!!!!	Each bang symbol (!) = 1 datagram of data
624 bytes copied in 7.05 secs
OTEP#	File has been transferred successfully

Note:

You can also use the preceding sequence for a copy start tftp command sequence.

Boot System Commands

noreply@blogger.com (Joseph Martinez) — Thu, 27 Nov 2008 00:58:00 +0000

Boot System Commands

Router(config)#boot system flash image-name	Loads IOS with image-name
Router(config)#boot system tftp image-name172.16.10.3	Loads IOS with image-name from a TFTP server
Router(config)#boot system rom	Loads IOS from ROM
Router(config)#exit
Router#copy run start	Saves running-configuration to NVRAM. Router will execute commands in order they were entered on next reload

If you enter boot system flash first, that is the first place the router will go to look for the IOS. If you want to go to a TFTP server first, make sure that the boot system tftp command is the first one you enter.

Configuration Example: VTP and Inter-VLAN Routing

noreply@blogger.com (Joseph Martinez) — Fri, 21 Nov 2008 01:18:00 +0000

Configuration Example: VTP and Inter-VLAN Routing

Figure A shows the network topology for the configuration of VTP and inter-VLAN routing. There are separate sections on configuring both 2900 and 2950 series switches.

Figure A. Network Topology for VTP and Inter-VLAN Routing Configuration

ISP Router

Router>en

Router>#config t

Router(config)#hostname ISP
Sets the host name

ISP(config)#no ip domain-lookup
Turns off DNS resolution to avoid wait time dur to DNS lookup of spelling errors

ISP(config)#line con 0

ISP(config-line)#logging synchronous
Appends the command line to a new lineno interruption from info items

ISP(config-line)#exec-timeout 0 0
Console session will never time out

ISP(config-line)#exit

ISP(config)#enable secret cisco
Sets the secret password to cisco

ISP(config)#int lo 0
Creates a loopback address for testing purposes

ISP(config-if)#description simulated address representing remote website

ISP(config-if)#ip address 172.16.1.1 255.255.255.0

ISP(config-if)#int s0/0
Enters serial interface configuration mode

ISP(config-if)#description WAN link to the Corporate Router

ISP(config-if)#ip address 200.200.200.13 255.255.255.252

ISP(config-if)#clock 56000
Sets the clock rate for the serial link

ISP(config-if)#no shut

ISP(config-if)#exit

ISP(config-if)#router eigrp 10
Turns on the EIGRP routing process

ISP(config-router)#network 172.16.0.0
Advertises the 172.16.0.0 network

ISP(config-router)#network 200.200.200.0
Advertises the 200.200.200.0 network

ISP(config-router)#no auto-summary
Turns off automatic summarization at the classful boundary

ISP(config-router)#exit

ISP(config)#exit

ISP#copy run start
Saves the configuration to NVRAM

CORP Router (1721 Router Running Cisco IOS Software Release 12.2(4)
These commands work also for the 1760 and the 2620/2621 series routers

Router>en

Router#config t

Router(config)#hostname CORP
Sets host name

CORP(config)#no ip domain-lookup
Turns off resolution to avoid wait time due to DNS lookup of spelling errors

CORP(config)#line con 0

CORP(config-line)#logging synchronous
Appends the command line to a new lineno interruption from info items

CORP(config-line)#exec-timeout 0 0
Console session will never time out

CORP(config-line)#exit

CORP(config)#enable secret cisco
Sets the secret password to cisco

CORP(config)#int s1

CORP(config-if)#desc WAN link to ISP Router

CORP(config-if)#ip add 200.200.200.14 255.255.255.252

CORP(config-if)#bandwidth 1544
Sets bandwith to 1544 kilobits for EIGRP calculation

CORP(config-if)#no shut

CORP(config-if)#exit

CORP(config)#int fa0

CORP(config-if)#full duplex

CORP(config-if)#no shut

CORP(config-if)#int fa0.1
Creates a subinterface

CORP(config-if)#no ip address
Ensures there is no IP address assigned to the interface

CORP(config-subif)#desc Management VLAN 1
Assigns a description to the subinterface

CORP(config-subif)#encapsulation dot1q 1 native
Enables Dot1Q encapsulation with VLAN 1 as the native VLAN

CORP(config-subif)#ip add 192.168.1.1 255.255.255.0
Assigns an IP address to the subinterface

CORP(config-subif)#int fa0.10
Creates a subinterface

CORP(config-subif)#desc Sales VLAN 10
Assigns a description to the subinterface

CORP(config-subif)#encapsulation dot1q 10
Enables Dot1Q encapsulation on VLAN 10

CORP(config-subif)#ip add 192.168.10.1 255.255.255.0
Assigns an IP address to the subinterface

CORP(config-subif)#int fa0.20
Creates a subinterface

CORP(config-subif)#desc Engineering VLAN 20
Assigns a description to the subinterface

CORP(config-subif)#encapsulation dot1q 20
Enables Dot1Q encapsulation on VLAN 20

CORP(config-subif)#ip add 192.168.20.1 255.255.255.0
Assigns an IP address to the subinterface

CORP(config-subif)#int fa0.30
Creates a subinterface

CORP(config-subif)#desc Marketing VLAN 30
Assigns a description to the subinterface

CORP(config-subif)#encapsulation dot1q 30
Enables Dot1Q encapsulation on VLAN 30

CORP(config-subif)#ip add 192.168.1.1 255.255.255.0
Assigns an IP address to the subinterface

CORP(config-subif)#exit

CORP(config)#router eigrp 10
Turns on the EIGRP routing process

CORP(config-router)#network 192.168.1.0
Advertises the 192.168.1.0 network

CORP(config-router)#network 192.168.10.0
Advertises the 192.168.10.0 network

CORP(config-router)#network 192.168.20.0
Advertises the 192.168.20.0 network

CORP(config-router)#network 192.168.30.0
Advertises the 192.168.30.0 network

CORP(config-router)#network 200.200.200.0
Advertises the 200.200.200.0 network

CORP(config-router)#no auto-summary
Turns off auto summari-zation

CORP(config-router)#exit

CORP(config)#exit

CORP#copy run start
Saves the configuration to NVRAM

Caution: Remember to advertise all networks. Advertising 192.168.0.0 does not advertise networks from 192.168.0.0192.168.255.0. These are separate classful networks, so they must be advertised separately, just like 200.200.200.0 is advertised separately.

2900 Series Switch

switch>en

switch>#config t

switch(config)#hostname 2900Switch
Sets host name

2900Switch(config)#no ip domain-lookup
Turns off DNS resolution to avoid wait time due to DNS lookup of spelling errors

2900Switch(config)#line con 0

2900Switch(config-line)#logging synchronous
Appends the command line to a new lineno interruption from info items

2900Switch(config-line)#exec-timeout 0 0
Console session will never time out

2900Switch(config)#exit

2900Switch(config)#enable secret cisco
Sets the secret password to cisco

2900Switch(config)#exit

2900Switch#vlan database
Enters VLAN database mode

2900Switch(vlan)#vlan 10 name Sales
Creates VLAN 10 with the name Sales

2900Switch(vlan)#vlan 20 name Engineering
Creates VLAN 20 with the name Engineering

2900Switch(vlan)#vlan 30 name Marketing
Creates VLAN 30 with the name Marketing

2900Switch(vlan)#vtp server
Makes the switch a VTP server

2900Switch(vlan)#vtp domain academy
Assigns a domain name of academy

2900Switch(vlan)#exit
Applies all changes to VLAN database and exits mode

2900Switch#config t

2900Switch(config)#int vlan1

2900Switch(config-if)#ip add 192.168.1.2 255.255.255.0

2900Switch(config-if)#no shutdown

2900Switch(config-if)#exit

2900Switch(config)#ip default-gateway 192.168.1.1

2900Switch(config)#int fa 0/1

2900Switch(config-if)#desc Trunk Link to CORP Router

2900Switch(config-if)#switchport mode trunk
Creates a trunk link

2900Switch(config-if)#switchport trunk encapsulation dot1q
Sets encapsulation to Dot1Q

2900Switch(config-if)#int fa 0/2

2900Switch(config-if)#switchport access vlan 10
Assigns a port to VLAN 10

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in Spanning Tree Protocol (STP)

Note: The command switchport mode access is not needed, because this is the default mode for interfaces. Use it only if the port was previously set to be a trunk link.

2900Switch(config-if)#int fa0/3

2900Switch(config-if)#switchport access vlan 10
Assigns a port to VLAN 10

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/4

2900Switch(config-if)#switchport access vlan 10
Assigns a port to VLAN 10

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/5

2900Switch(config-if)#switchport access vlan 20
Assigns a port to VLAN 20

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/6

2900Switch(config-if)#switchport access vlan 20
Assigns a port to VLAN 20

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/7

2900Switch(config-if)#switchport access vlan 20
Assigns a port to VLAN 20

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/8

2900Switch(config-if)#switchport access vlan 20
Assigns a port to VLAN 20

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/9

2900Switch(config-if)#switchport access vlan 30
Assigns a port to VLAN 30

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/10

2900Switch(config-if)#switchport access vlan 30
Assigns a port to VLAN 30

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/11

2900Switch(config-if)#switchport access vlan 30
Assigns a port to VLAN 30

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)#int fa0/12

Save as Draft

2900Switch(config-if)#switchport access vlan 30
Assigns a port to VLAN 30

2900Switch(config-if)#spanning-tree portfast
Transitions the port directly to the Forwarding state in STP

2900Switch(config-if)# CTRL + Z

2900Switch#copy run start
Saves the configuration to NVRAM

2900Switch#

2950 Series Switch

switch>en

switch>#config t

switch(config)#hostname 2950Switch
Sets the host name

2950Switch(config)#no ip domain-lookup
Turns off DNS resolution to avoid wait time due to DNS lookup of spelling errors

2950Switch(config)#line con 0

2950Switch(config-line)#logging synchronous
Appends the command line to a new lineno interruption from info items

2950Switch(config-line)#exec-timeout 0 0
Console session will never time out

2950Switch(config-line)#exit

2950Switch(config)#enable secret cisco
Sets the secret password to cisco

2950Switch(config)#vlan 10
Creates VLAN 10

2950Switch(config-vlan)#name Sales
Defines the name of Sales

2950Switch(config-vlan)#vlan 20
Creates VLAN 20

2950Switch(config-vlan)#name Engineering
Defines the name of Engineering

2950Switch(config-vlan)#vlan 30
Creates VLAN 30

2950Switch(config-vlan)#name Marketing
Defines the name of Marketing

2950Switch(config-vlan)#exit

2950Switch(config)#vtp mode server
Makes the switch a VTP server

2950Switch(config)#vtp domain academy
Assigns a domain name of academy

2950Switch(config)#int vlan1
Creates the virtual VLAN 1 interface

2950Switch(config-if)#ip add 192.168.1.2 255.255.255.0
Assigns an IP address to the interface

2950Switch(config-if)#no shutdown

2950Switch(config-if)#exit

2950Switch(config)#ip default-gateway 192.168.1.1
Assigns the IP address of the default gateway

2950Switch(config)#int fa 0/1

2950Switch(config-if)#desc Trunk Link to CORP Router

2950Switch(config-if)#switchport mode trunk
Creates a trunk link

2950Switch(config-if)#int range fa 0/2 4

2950Switch(config-if-range)#switchport access vlan 10
Assigns ports to VLAN 10

2950Switch(config-if-range)#spanning-tree portfast
Transitions ports directly to the Forwarding state in STP

Note: The command switchport mode access is not needed, because this is the default mode for interfaces. Use it only if the port was previously set to be a trunk link.

2950Switch(config-if-range)#int range fa0/5 8

2950Switch(config-if-range)#switchport access vlan 20
Assigns ports to VLAN 20

2950Switch(config-if-range)#spanning-tree portfast
Transitions port directly to the Forwarding state in STP

2950Switch(config-if-range)#int range fa0/9 - 12

2950Switch(config-if-range)#switchport access vlan 30
Assigns ports to VLAN 10

2950Switch(config-if-range)#spanning-tree portfast
Transitions ports directly to the Forwarding state in STP

2950Switch(config-if-range)# CTRL + Z

2950Switch#copy run start
Saves the configuration to NVRAM

Inter-VLAN Communication: Router-on-a-Stick

noreply@blogger.com (Joseph Martinez) — Tue, 18 Nov 2008 00:41:00 +0000

Inter-VLAN Communication: Router-on-a-Stick

Router(config)#int fa 0/0	Enters interface mode for interface fa 0/0
Router(config-if)#no shut	Turns the interface on
Router(config-if)#int fa 0/0.1	Creates subinterface 0/0.1
Router(config-subif)#encapsulation dot1q 1 native	Assigns the native VLAN (usually VLAN 1) to this logical subinterface
Router(config-subif)#ip address 192.168.1.1 255.255.255.0	Assigns an IP address to the subinterface
Router(config-subif)#int fa 0/0.10	Creates subinterface 0/0.10
Router(config-subif)#encapsulation dot1q 10	Assigns VLAN 10 to this subinterface
Router(config-subif)#ip address 192.168.10.1 255.255.255.0	Assigns an IP address to the subinterface
Router(config-subif)# CNTL + Z
Router#

Confirming VTP Configuration

noreply@blogger.com (Joseph Martinez) — Fri, 14 Nov 2008 01:19:00 +0000

Confirming VTP Configuration

1900 Series Switch

1900Switch#show vtp	Displays all VTP information

2900/2950 Series Switch

29x0Switch#show vtp status	Displays VTP domain status
29x0Switch#show vtp counters	Displays VTP statistics

VTP Configuration

noreply@blogger.com (Joseph Martinez) — Thu, 13 Nov 2008 02:13:00 +0000

VTP Configuration

1900 Series Switch

1900Switch(config)#vtp client ***Changes the switch to VTP client mode

1900Switch(config)#vtp server ***Changes the switch to default VTP server mode

1900Switch(config)#vtp transparent ***Changes the switch to VTP transparent mode

1900Switch(config)#vtp domain CNAP ***Sets the name of the VTP management domain to CNAP

1900Switch(config)#vtp password cisco ***Sets the VTP password to cisco

2900 Series Switch

2900Switch#vlan database ***Enters VLAN database mode

2900Switch(vlan)#vtp client ***Changes the switch to client mode

2900Switch(vlan)#vtp server ***Changes the switch to server mode 2900Switch(vlan)#vtp transparent Changes the switch to transparent mode

2900Switch(vlan)#vtp domain academy ***Sets the name of the VTP management domain to academy

2900Switch(vlan)#vtp password catalyst ***Sets the VTP password to catalyst

2900Switch(vlan)#vtp v2-mode ***Sets VTP mode to version 2

2900Switch(vlan)#vtp pruning ***Enables VTP pruning

2900Switch(vlan)#exit ***Applies the changes and exits mode

2900Switch#

2950 Series Switch

2950Switch#config t ***Enters global config mode

2950Switch(config)#vtp mode client ***Changes the switch to client mode

2950Switch(config)#vtp mode server ***Changes the switch to server mode

2950Switch(config)#vtp mode transparent ***Changes the switch to transparent mode

2950Switch(config)#vtp domain academy ***Sets the name of the VTP management domain to academy

2950Switch(config)#vtp password catalyst ***Sets the VTP password to catalyst

2950Switch(config)#vtp v2-mode ***Sets VTP mode to version 2

2950Switch(config)#vtp pruning ***Enables VTP pruning

Note:
VTP versions 1 and 2 are not interoperable. All switches must use the same version. The biggest difference between version 1 and 2 is that version 2 has support for Token Ring VLANs.

Caution:
Switches that are in client mode update their VLAN database from switches that are in server mode. If you have two or more switches interconnected and you delete a VLAN database, you may find that it becomes updated from a server switch because of your VTP mode.
Another serious problem occurs when you take a new switch in server mode (the default mode) and plug it into an existing network. If the VTP revision number is higher on the new switch, it sends an update to all other switches to overwrite their VLAN database with new informationin this case, an empty VLAN database. You now have a production network with no VLAN information.
Recommended practice is that you put a switch into VTP client mode before adding them into a production network, allow it to receive an update of current VLAN information, and then change it to VTP server mode.

Verifying Trunking

noreply@blogger.com (Joseph Martinez) — Wed, 12 Nov 2008 00:42:00 +0000

Verifying Trunking

1900 Series Switch

1900Switch#show trunk A	Displays trunking information about port 0/26
DISL state: On, Trunking: On, Encapsulation type: ISL
1900Switch#

2900 and 2950 Series Switches

29x0Switch#show int fa 0/1 switchport	Shows the status of the interface, including trunking information
Name: Fa0/1
Switchport: Enabled
Administrative mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: isl
Operational Trunking Encapsulation: isl

29x0Switch#

Password protect web folder

noreply@blogger.com (Joseph Martinez) — Tue, 11 Nov 2008 01:24:00 +0000

Apache authentication can be configured to require web site visitors to login with a user id and password. This is different than adding a login form on a web page and creating your own authentication. This tutorial describes the various methods available for authentication with Apache and its' configuration. Login protection is applied to the web pages stored in a directory. The login dialog box which requests the user id and password is provided by the web browser at the request of Apache. Apache allows the configuration to be entered in its' configuration files (i.e. main configuration file /etc/httpd/conf/httpd.conf, supplementary configuration files /etc/httpd/conf.d/component.conf or in a file which resides within the directory to be password protected.

Apache password file authentication:

Directory protection using .htaccess and .htpasswd

This tutorial applies to Apache based web servers. It requires:

1. Editing the server configuration file (httpd.conf) to enable/allow a directory structure on the server to be password protected. Basically the default access permission statement need modification.
2. The creation and addition of two files specifying the actual logins and passwords. (.htaccess and .htpasswd)

Use this sparingly because Apache will have to check all directories and subdirectories specified in the configuration file for the existence of the .htaccess file adding to a servers latency.

When trying to access a file in a protected directory, the user will be presented with a window (dialog box) requesting a username and password. This protection applies to all sub-directories. Other .htaccess files in sub directories may respecify access rules.

Apache authentication uses the modules mod_auth and mod_access.

Apache configuration file:

File: /etc/httpd/conf/httpd.conf (older systems used access.conf)

Default: This disables the processing of .htaccess files for the system.

AllowOverride None

or for a specified directory:

AllowOverride None

Change to and/or specify directory to protect:

AllowOverride All

OR

AllowOverride AuthConfig

AllowOverride parameters: AuthConfig FileInfo Indexes Limits Options

The name of the "distributed" and user controlled configuration file .htaccess is defined with the directive: (default shown)

AccessFileName .htaccess

Password protection by a single login:

Password files:

1. Create the directory you want to password protect (example: membersonly)
2. Create a file /home/domain/public_html/membersonly/.htaccess in that director that looks something like this:

AuthName "Add your login message here."
AuthType Basic
AuthUserFile /home/domain/public_html/membersonly/.htpasswd
AuthGroupFile /dev/null
require user name-of-user

In this case the "name-of-user" is the login name you wish to use for accessing the web site.

[Pitfall] The literature is full of examples of the next method but I never got it to work.

One can use Apache directives to specify access and restriction:

AuthName "Add your login message here."
AuthType Basic
AuthUserFile /home/domain/public_html/membersonly/.htpasswd
AuthGroupFile /dev/null
require user name-of-user

Also see: List of Apache directives. If an incorrect directive is used in the .htaccess file it will result in a server error. Check your log files: /var/log/httpd/error_log.
The name of the access file .htaccess is specified by the httpd.conf directive AccessFileName.

3. Create the password file /home/domain/public_html/membersonly/.htpasswd using the program htpasswd:

htpasswd -c .htpasswd name-of-user

Man page: htpasswd

Example file: .htpasswd

user1:KgvCSeExtS4kM
USER1:KgvCSeExtS4kM
User1:KgvCSeExtS4kM

Flexible password protection by group access permissions:

This example differs from the previous example in that it allows for greater control and flexibility by using groups.

Password files:

1. Create a file .htgroup in that directory that contains the groupname and list of users:

member-users: user1 user2 user3 ... etc

Where member-users is the name of the group.

2. Modify .htaccess in the membersonly directory so it looks something like:

AuthName "Add your login message here."
AuthType Basic
AuthUserFile /home/domain/public_html/membersonly/.htpasswd
AuthGroupFile /home/domain/public_html/membersonly/.htgroup
require group member-users

3. Create the password file .htpasswd using the program htpasswd for each user as above. You don't need the -c option if you are using the same .htpasswd file. (-c is only to create a new file)

htpasswd -c /home/domain/public_html/membersonly/.htpasswd user1
htpasswd /home/domain/public_html/membersonly/.htpasswd user2

Restrict access based on domain or IP address:

Allow specified domain to access site:

Order deny, allow
Deny from all
Allow from allowable-domain.com
Allow from XXX.XXX.XXX
Deny from evil-domain.com

Specify first three (or one, or two, ...) octets of IP address defining allowable domain.

Placing Authentication directives in httpd.conf exclusively instead of using .htaccess:

The purpose of using the "distributed configuration file" .htaccess is so that users may control authentication. It can also be set in the Apache configuration file httpd.conf WITHOUT using the .htaccess file. This can improve server performance as the server will not have to look for the .htaccess file in each subdirectory.

File: httpd.conf (portion)

..
...

AllowOverride AuthConfig
AuthName "Add your login message here."
AuthType Basic
AuthUserFile /home/domain/public_html/membersonly/.htpasswd
AuthGroupFile /dev/null
require user name-of-user

...
..

Verifying Trunking

noreply@blogger.com (Joseph Martinez) — Thu, 21 Aug 2008 00:32:00 +0000

Verifying Trunking

1900 Series Switch

1900Switch#show trunk A
Displays trunking information about port 0/26
DISL state: On, Trunking: On, Encapsulation type: ISL

1900Switch#

2900 and 2950 Series Switches

29x0Switch#show int fa 0/1 switchport
Shows the status of the interface, including trunking information
Name: Fa0/1

Switchport: Enabled

Administrative mode: trunk

Operational Mode: trunk

Administrative Trunking Encapsulation: isl

Operational Trunking Encapsulation: isl

29x0Switch#

Configuring Dot1Q Trunks

noreply@blogger.com (Joseph Martinez) — Tue, 05 Aug 2008 00:31:00 +0000

Configuring Dot1Q Trunks

2900 Series Switch

2900Switch(config)#int fa 0/1	Enters interface mode
2900Switch(config-if)#switchport mode trunk	Turns port to trunking mode
2900Switch(config-if)#switchport trunk encapsulation dot1q	Sets encapsulation type to Dot1Qthis is the default encapsulation type

2950 Series Switch

2950Switch(config)#int fa 0/1	Enters interface mode
2950Switch(config-if)#switchport mode trunk	Turns port to trunking mode

Configuring ISL Trunks

noreply@blogger.com (Joseph Martinez) — Thu, 24 Jul 2008 00:32:00 +0000

Configuring ISL Trunks

Note:

The 1900 series switch supports only Inter-Switch Link (ISL) trunking. The 2900 series switch supports both ISL and Dot1Q trunking. The 2950 series switch supports only Dot1Q trunking.

1900 Series Switch

1900Switch(config)#int fa 0/26	Enters interface mode
1900Switch(config-if)#TRunk on	Turns trunking mode on

2900 Series Switch

2900Switch(config)#int fa 0/1	Enters interface mode
2900Switch(config-if)#switchport mode trunk	Turns port to trunking mode
2900Switch(config-if)#switchport trunkencapsulation isl	Sets encapsulation type to ISL

Note:

Trunking can only occur on a Fast Ethernet port. A 1900 series switch has only two Fast Ethernet portsports A and B. These are defined as fa 0/26 and FA 0/27 in the command-line interface (CLI).

Note:

For any series switch, you must set trunk mode at both ends of the link for the trunk to become active.

Troubleshooting VLANs

noreply@blogger.com (Joseph Martinez) — Wed, 23 Jul 2008 00:36:00 +0000

Troubleshooting VLANs

2900Switch#show vlan	Displays the complete VLAN database
2900Switch#show vlan brief	Displays a summary of the VLAN database
2900Switch#show interfaces	Displays a summary of each interface, including speed and duplex settings
2900Switch#debug sw-vlan packets	Displays information about VLAN packets a router has received but is not capable of supporting

Erasing VLAN Configurations

noreply@blogger.com (Joseph Martinez) — Mon, 21 Jul 2008 00:33:00 +0000

Erasing VLAN Configurations

1900 Series Switch

1900Switch#delete vtp	Deletes all VLAN information from the switch and resets VTP parameters to the factory defaults
or
1900Switch(config)#int fa 0/2
1900Switch(config-if)#no vlan static 2	Removes interface from VLAN 2 and puts it back into default VLAN 1
1900Switch(config-if)#exit
1900Switch(config)#no vlan 2 name Engineering	Removes only VLAN 2 from database
1900Switch(config)#

2900/2950 Series Switch

2900Switch#delete flash:vlan.dat	Removes entire VLAN database from Flash memory Make sure there is no space between the colon (:) and the characters vlan.dat. You can potentially erase the entire contents of Flash memory with this command if the syntax is not correct
2900Switch#delete flash:
Delete filename [ ]? vlan.dat	Removes entire VLAN database from Flash memory
Delete flash:vlan.dat? [confirm]	Press the Enter key
2900Switch#
or
2900Switch#config t
2900Switch(config)#int fa 0/3
2900Switch(config-if)#no switchport access vlan 3	Removes port from VLAN 3 and reassigns it to default VLAN 1
2900Switch(config-if)#exit
2900Switch(config)#exit
2900Switch#vlan database	Enters VLAN database mode
2900(vlan)#no vlan 3	Removes only VLAN 2 from database
2900(vlan)#exit	Applies changes and exits VLAN database mode

Note:

For the 1900 series switch, removing a VLAN from the database does not reassign ports in that VLAN back to the default Management VLAN. You must also go into the specific interface and reassign the ports as well.

Note:

For any series switch, you cannot remove VLAN 1.

Assigning Ports Using the range Command (2950 Switch Only)

noreply@blogger.com (Joseph Martinez) — Thu, 17 Jul 2008 22:36:00 +0000

Assigning Ports Using the range Command (2950 Switch Only)

2950Switch(config)#int range fa 0/1 - 4	Enables you to set the same configuration para-meters on multiple ports at the same time. Note that there is a space before and after the hyphen
2950Switch(config-if-range)#switchport mode access	Sets all ports to access mode
2950Switch(config-if-range)#switchport access vlan 10	Assigns all ports to VLAN 10

Assigning Ports to VLANs

noreply@blogger.com (Joseph Martinez) — Mon, 14 Jul 2008 03:13:00 +0000

Assigning Ports to VLANs

1900 Series Switch

1900Switch#config t
1900Switch(config)#int e0/2	Moves to interface mode
1900Switch(config-if)#vlan static 2	Assigns this port to VLAN 2
1900Switch(config-if)#int e0/3	Moves to interface mode
1900Switch(config-if)#vlan static 3	Assigns this port to VLAN 3
1900Switch(config-if)#exit	Exits interface mode
1900Switch(config)#

2900/2950 Series Switch

2900Switch#config t
2900Switch(config)#int fa0/2	Moves to interface mode
2900Switch(config-if)#switchport mode access	Sets switchport mode to access
2900Switch(config-if)#switchport access vlan 2	Assigns this port to VLAN 2
2900Switch(config-if)#int fa0/3	Moves to interface mode
2900Switch(config-if)#switchport mode access	Sets switchport mode to access
2900Switch(config-if)#switchport access vlan 3	Assigns this port to VLAN 3
2900Switch(config-if)#exit	Exits interface mode
2900Switch(config)#

Creating Static VLANs

noreply@blogger.com (Joseph Martinez) — Wed, 09 Jul 2008 01:09:00 +0000

Creating Static VLANs

1900 Series Switch

1900Switch#config t
1900Switch(config)#vlan 2 name Engineering	Creates VLAN 2 and names it Engineering
1900Switch(config)#vlan 3 name Marketing	Creates VLAN 3 and names it Marketing

2900 Series Switch

2900Switch#vlan database	Enters VLAN database mode
2900(vlan)#vlan 2 name Engineering	Creates VLAN 2 and names it Engineering
2900(vlan)#vlan 3 name Marketing	Creates VLAN 3 and names it Marketing
2900(vlan)#exit	Applies changes and exits VLAN database mode
2900#

2950 Series Switch

2950Switch#config t	Enters global config mode
2950Switch(config)#vlan 10	Creates VLAN 10 and enters VLAN config mode for further definitions
2950Switch(config-vlan)#name Accounting	Assigns a name to a VLAN
2950Switch(config-vlan)#exit	Moves back to global config mode
2950Switch(config)#vlan 20	Creates VLAN 20 and enters VLAN config mode for further definitions
2950Switch(config-vlan)#name Sales	Assigns a name to a VLAN
2950Switch(config-vlan)#exit	Moves back to global config mode

Tip:

For the 2900 series switch, you must apply the changes to the VLAN database for the changes to take effect. You can also use the command apply in the VLAN database, which will apply the changes, but not exit the mode. Using the Ctrl+Z command to exit out of the VLAN database will not apply the changes to the VLAN database. You must use the command exit to exit the VLAN database and have the changes successfully applied.

Tip:

For the 2950 series switch, the use of the VLAN database is being phased out, in favor of creating VLANs in the manner demonstrated in the preceding command syntax. If you use the vlan database command at the 2950Switch# prompt, the 2950 IOS will tell you this but will still allow you to use commands the same as the 2900 series switch. Get used to this style; it is the method to be used on all future releases of switches.

Displaying VLAN Information

noreply@blogger.com (Joseph Martinez) — Tue, 08 Jul 2008 00:35:00 +0000

Displaying VLAN Information

1900 Series Switch

1900Switch#show vlan	Shows VLAN information
1900Switch#show vlan-membership	Shows which ports belong to which VLAN
1900Switch#show vlan 2	Displays information about VLAN 2 only

2900/2950 Series Switch

2900Switch#show vlan	Shows all VLAN status
2900Switch#show vlan brief	Shows all VLAN status in brief
2900Switch#show vlan id 2	Displays information of VLAN 2 only
2900Switch#show vlan name Marketing	Displays information of VLAN named Marketing only

Port Monitoring on a Cisco 2950 Switch

noreply@blogger.com (Joseph Martinez) — Wed, 02 Jul 2008 00:41:00 +0000

Port Monitoring on a Cisco 2950 Switch:

c3550(config)#monitor session 1 source ?
interface SPAN source interface
remote SPAN source Remote
vlan SPAN source VLAN
c3550(config)#monitor session 1 source interface fa0/1 - 3 rx
c3550(config)#monitor session 1 destination interface fa0/24

Switch# show monitor session 1