Today, I had to troubleshoot a very peculiar problem on my Cisco Catalyst 3750 switches in two different sites. To cut a long story short, both the sites originally had IPSec VPNs over ADSL internet andtherefore static routes added to pass through their VPN firewalls. However, with a recent WAN migration with leased lines, all traffic moved to the WAN routers.

However, the Static Routes became stale (obsolete) and we were unable to delete the static routes. The routes are not in the running config (no "ip route command in config") and a reboot wouldn't help.

When you do

ciscoswitch# show ip route
Default gateway is 10.10.10.1

Host Gateway Last Use Total Uses Interface
192.168.1.1 10.10.10.4 0:00 460318 Vlan1
192.168.1.2 10.10.10.4 0:00 25586 Vlan1
192.168.1.3 10.10.10.4 0:00 25570 Vlan1

The static routes cannot be deleted using

ciscoswitch(config)# no ip route 192.168.1.1 255.255.255.255 10.10.10.4

or

ciscoswitch# clear ip route *

or

ciscoswitch# clear ip cache *

How to resolve?

Finally, the resolution was to disable and enable the "ip routing" service.

Disable IP Routing

ciscoswitch(config)#no ip routing

Enable IP Routing

ciscoswitch(config)#ip routing

This fixed the problem and we are back in business. The stale routing table entries are gone.

I'm sure someone out there is looking for this and might help!!!

VLAN Interfaces are required in network scenarios where you have different VLANs and need Inter-VLAN switching on Layer3 (Routing capable) switches. Every VLAN that needs to be routed should have a VLAN interface.

Let's say we have VLAN 10 which hosts the subnet 192.168.10.0 subnet, VLAN hosts 192.168.20.0 subnet and VLAN 30 hosts 192.168.30.0 subnet. For Inter-VLAN routing to work, we need to have a VLAN interface setup for each of these VLANs and configured with an IP address from the same subnet which will be the default Gateway for that subnet. Lets say, 192.168.10.254,192.168.20.254.192.168.30.254 are the IP addresses for VLAN Interfaces of VLAn 10,20,30 respectively.

Assuming the VLANs are configured already, let's proceed to get the VLAN interfaces created.

Enable Routing on the Switch

ciscoswitch# conf t

ciscoswitch(config)# ip routing

Add VLAN Interface

ciscoswitch(config)# interface vlan10

ciscoswitch(config-if)# no shut

ciscoswitch(config-if)# ip address 192.168.10.0 255.255.255.0

This configures a VLAN interface for VLAN 10.

Default Route on Switch

Add a default route on the Switch. This will forward all traffic from the different VLANs to the default router.

ciscoswitch(config)#ip route 0.0.0.0 0.0.0.0 192.168.100.1

Interface to the Router

If the switch cannot reach the default router through a VLAN then an interface that connects to the router which does these routing needs to configured as a routed interface and assigned with an IP address that is in the same subnet as that of the Default router.

ciscoswitch(config)# interface gi0/1

ciscoswitch(config-if)# no shut

ciscoswitch(config-if)# no switchport

ciscoswitch(config-if)# ip address 192.168.100.2 255.255.255.0

This makes the inerface as a routed interface and assigns an IP address in the same subnet as the default router.

Cisco Routers and Switches with L3 routing functions are seen to have problems with High CPU usage when SNMP is enabled. This can range anything from 15% to 40%. According to Cisco, these are low priority processes and other priority processes requiring CPU cycles are given priority over these processes and this level of CPU utilisation can be is normal. However, it is always better to be safe than sorry and get the CPU utilisation caused by SNMP to bare minimum so as to ensure the Routers function smoothly.

The reason behind the High CPU usage can be caused by the Network Management Server (SNMP Server) like HP Openview querying for the Routing Tables and ARP tables to learn about other networks  or querying for certain MIBs which can be resource intensive.

We can use the SNMP View configurations to include/exclude SNMP MIBs in Cisco IOS. So modify your SNMP configuration as follows:

Include the SNMP Root (ISO)

ciscorouter(config)# snmp-server view cutdown iso included

Exlcude queries for Routing Table & ARP Table

We exclude the ipRouteTable & ipNetToMediaTable MIBs to avoid polliong for Routing tables and ARP tables.

ciscorouter(config)# snmp-server view cutdown 1.3.6.1.2.1.4.21 excluded
ciscorouter(config)# snmp-server view cutdown 1.3.6.1.2.1.4.22 excluded
ciscorouter(config)# snmp-server view cutdown 1.3.6.1.2.1.3 excluded

Exclude CPU Intensive snmpUsmMIB, snmpVacmMIB,snmpCommunityMIB

These are good to disable for Security reasons as well.

ciscorouter(config)# snmp-server view cutdown 1.3.6.1.6.3.15 excluded
ciscorouter(config)# snmp-server view cutdown 1.3.6.1.6.3.16 excluded
ciscorouter(config)# snmp-server view cutdown 1.3.6.1.6.3.18 excluded

Configure SNMP Community

Configure the SNMP community with the cutdown view as follows:

ciscorouter(config)# snmp-server community public view cutdown RO
ciscorouter(config)# snmp-server community myprivate view cutdown RW

This should help. For simple SNMP configurations, click here

For official Cisco Documentation click here

Back from the holidays only to find my Windows Profile gone missing at work. One of the annoying things was to add all my remote hosts back onto WyseTerm. While the bad news is that there is no single file (which one would expect) that maintains this list, the good news comes in the form of Windows Registry. Yes, the WyseTerm host information is stored in Windows Registry and can be exported from the registry on to a new profile or other users profile.

The WyseTerm Host information, also known as the Common Address Book can be exported from the Windows Registry and then imported onto the new users profile as follows:

1. Click Start – Run – type "regedit" and press enter to open Windows Registry.

2. Navigate to

[HKEY_CURRENT_USER\Software\Hummingbird\Connectivity\[version]\HostExplorer\Common]

where [version] is the version of your Hummingbird software.

3. Click File and select EXPORT to export the "Common Address Book". Enter a file name to save the reg file.

4. Now, login as the new user and run this reg file. This should import the WyseTerm host list onto the users WyseTerm.

 This should help!!!

The enhanced password security in Cisco IOS introduced in 12.0(18)S allows an admin to configure MD5 encryption for passwords. Prior to this feature the encryption level on Type 7 passwords used a week encryption and can be cracked easily and the clear text password (type 0) as anyone would know is completely insecure. Anyone who can gain access to the privilege mode can view/decrypt these passwords.

 
To configure enhanced password security, create a user with MD5 password encryption as follows from the Global configuration mode:

MD5 Encryption on clear text password:

You can enter a clear text password which will be encrypted using MD5 algorithm

ciscorouter(config)# username ciscoadmin secret ciscopass

where ciscoadmin is the user and his clear text password "ciscopass" which will then be converted into a MD5 encrypted text.

This is equivalent to

ciscorouter(config)# username ciscoadmin secret 0 ciscopass

where "0" [default] indicates MD5 encryption on a clear text password.

MD5 encrypted text as password

To enter an MD5 encrypted password instead of a clear text password

ciscorouter(config)# username ciscoadmin secret 5 $1$feb0$a104Qd9UZ./Ak00KTggPD0

where "5" indicates the entered password is a MD5 encrypted text.

To verify the logins with MD5 encryption,

Clear Text password

ciscorouter# show running-config
!
version 12.2
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname ciscorouter
!
logging rate-limit console 10 except errors
no logging console
enable secret 0 $1$53Ew$Dp8.E4JGpg7rKxQa49BF9/
!
username ciscoadmin secret 5 $1$fBYK$rH5/OChyx/
!
…
…

MD5 encrypted text entered as password

ciscorouter# show running-config
!
version 12.2
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname ciscorouter
!
logging rate-limit console 10 except errors
no logging console
enable secret 5 $1$feb0$a104Qd9UZ./Ak00KTggPD0
!
username ciscoadmin secret 5
!
ip subnet-zero

Here the MD5 encrypted password entered itself is not displayed against the username.

DHCP snooping is a DHCP security feature that provides security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding table. An untrusted DHCP message is a message that is received from outside the network or firewall causing denial of service attacks.

The DHCP snooping binding table contains the MAC address, IP address, lease time, binding type, VLAN number, and interface information that corresponds to the local untrusted interfaces of a switch. An untrusted interface is an interface that is configured to receive messages from outside the network or firewall. A trusted interface is an interface that is configured to receive only messages from within the network.

DHCP snooping can be enabled on the switch per vlan as it can intercept the DHCP messages at the layer2.

The following is a step by step procedure to enable and configure DHCP snooping in Cisco catalyst switches running Cisco IOS

Enable DHCP Snooping

ciscoswitch(config)# ip dhcp snooping

Enable DHCP Snooping on VLANs

DHCP snooping can be enabled on one or more VLANs or a range of VLANs

ciscoswitch(config)# ip dhcp snooping vlan number 100

The above enables dhcp snooping on VLAN 100

To enable on more VLANs

ciscoswitch(config)# ip dhcp snooping vlan number 10-15 100 110

where the DHCP snooping is enabled on VLAN 10-15, 100 and 110

Enable DHCP Option 82

This allows DHCP option 82 message insertions into the packets. Option 82 is the Relay Agent Information Option as described in RFC 3046

ciscoswitch(config)# ip dhcp snooping information option

Configure Trust Interface

Interface not explcicitly configured as a trust interface is treated as an untrusted interface.

ciscoswitch(config)# interface fa0/0

ciscoswitch(config-if)# ip dhcp snooping trust

DHCP Snooping Rate limiting (optional)

Rate limiting allows restricting the number of DHCP packets per second (pps) that an interface can receive

ciscoswitch(config-if)# ip dhcp snooping limit rate 202

Where "202" indicates that the interface can receive "202" messages per second

This should configure DHCP Snooping on Cisco IOS switches.

Display DHCP Snooping

ciscoswitch# show ip dhcp snooping
DHCP Snooping is configured on the following VLANs:
    10-15 100 110
Insertion of option 82 information is enabled.
Interface           Trusted        Rate limit (pps)
———           ——-        —————-
FastEthernet2/1     yes            10
FastEthernet2/2     yes            none
FastEthernet3/1     no             20

Display DHCP Snooping Binding Table

ciscoswitch# show ip dhcp snooping binding
MacAddress      IP Address      Lease (seconds)      Type        VLAN      Interface
———–     ———–     —————-     —–       —–     ————
0000.0100.0201  10.0.0.1        1600                 dynamic     100       FastEthernet2/1

If you want to allow a low-priviledged user on a Cisco router or a Switch to view the Startup Config then this can be done in Routers and Switches running Cisco IOS.

This infact is a simple 2 step procedure as follows:

Set Privileges to view Startup Config

From the Global configuration mode, set the permissions for the privilege level 3. This should allow the users set with privilege level 3 to view the startup config.

ciscorouter(config)# privilege exec level 3 show startup-config

Create User with the privilege

ciscorouter(config)# username operations priv 3 password opsuser

The above creates a new local user named "operations" on the Cisco router with password "opsuser"

Set privileges to view Running-config

To make the user view the running configuration. It gets a bit more complex. Set the privilege as follows:

ciscorouter(config)# privilege exec all level 3 show running-config

This will set the permissions to view the running config but only when viewed as follows

ciscorouter# show running-config view full

On the other hand, all the show commands will be enabled for the user.

I dont think we need an introduction to the most widely used Remote console utility, PUTTY. Putty support SSH, Telnet, RLogin & RAW connections.

If you telnet or SSH to your Cisco IOS routers or switches or Juniper Firewalls and ofcourse anything that support CLI and SSH or Telnet then one of the things you would prefer to do is to take a backup of the config (Running or Startup) or even capture session text including logs tech information etc. We discussed here about using Hypereterminal to capture text and hence backup and restore config on Cisco IOS Routers and Switches.

Capture Text in Putty

When you have established a remote session with a device like a Cisco Router and you want to capture text from the session as with any other remote consoles like Hyper terminal then

1. Right-click on the menubar and select "change Settings"

2. Click logging under Session.

3. Select "Log all session output"

4. Select the location (default is your desktop) using the browse button and enter the file name (default is putty.log) and click Apply

This should create the file in the location you choose and start loggin everyting from the session.

If you want to make this a default for any saved session in your putty, then choose the session and click load and then follow the above procedure.

Backup config from Cisco IOS Routers & Switches

Now, to backup configuration from a Cisco IOS Based routers and switches, do the following:

ciscorouter# term len 0

ciscorouter# sh running-config

For Startup Configuration

ciscorouter# sh startup-config

The above will show the running config and will in turn be loggedd to the file.

Backup config from Juniper Netscreen Firewalls

In case of Juniper Netscreen based Firewalls,login via SSH or Telnet and run the following command:

admin> get config

As I said earlier, any device that allows you to sh config in the CLI then they all can certainly be backed up this way.

When troubleshooting a problem with Access Control lists, one of the things you would want to do is to clear the counters on the ACL matches.

In Cisco IOS, you can clear the ACL Matches counters as follows:

Clear Counters on All ACLs

ciscorouter# clear access-list counters

This clears the matches on all the ACLs on the cisco router or switch.

Clear Counters on Specific ACLs

ciscorouter# clear access-list counters 60

In this, we clear the matches on the ACL number 60. You can also use the name of the ACL instead of ACL number.

To verify the counters are cleared,

ciscorouters# show access-lists

This should show the access-list with the counters cleared on the ACL(s)