Cisco Commands Site

Network Address Translation

2010-12-31T22:38:00.000-08:00

Private IP Addresses: RFC 1918

The following table lists the address ranges as specified in RFC 1918 that can be used by anyone as internal private addresses. These will be your “inside-the-LAN” addresses that will have to be translated into public addresses that can be routed across the Internet. Any network is allowed to use these addresses; however, these addresses are not allowed to be routed onto the public Internet.

Configuring Dynamic NAT: One Private to One Public Address Translation

Configuring PAT: Many Private to One Public Address Translation

All private addresses use a single public IP address and numerous port numbers for translation.

NOTE: You can have an IP NAT pool of more than one address, if needed. The syntax for this is as follows:

Corp(config)#ip nat pool scott 64.64.64.70 74.64.64.128 netmask 255.255.255.128

You would then have a pool of 63 addresses (and all of their ports) available for translation.

Configuring Static NAT: One Private to One Permanent Public Address Translation

CAUTION: Make sure that you have in your router configurations a way for packets to travel back to your NAT router. Include a static route on the ISP router advertising your NAT pool and how to travel back to your internal network. Without this in place, a packet can leave your network with a public address, but it will not be able to return if your ISP router does not know where the pool of public addresses exists in the network. You should be advertising the pool of public addresses, not your private addresses.

Verifying NAT and PAT Configurations

Troubleshooting NAT and PAT Configurations

Basic Troubleshooting

2010-10-26T04:35:00.001-07:00

Viewing the Routing Table

Determining the Gateway of Last Resort

NOTE: The ip default-network command is for use with the deprecated Cisco proprietary Interior Gateway Routing Protocol (IGRP). Although you can use it with Enhanced Interior Gateway Routing Protocol (EIGRP) or RIP, it is not recommended. Use the ip route 0.0.0.0 0.0.0.0 command instead.

Routers that use the ip default-network command must have either a specific route to that network or a 0.0.0.0 /0 default route.

Determining the Last Routing Update

OSI Layer 3 Testing

Interpreting the show interface Command

The traceroute Command

The show controllers Command

debug Commands

CAUTION: Turning all possible debugging on is extremely CPU intensive and will probably cause your router to crash. Use extreme caution if you try this on a production device. Instead, be selective about which debug commands you turn on.

Do not leave debugging turned on. After you have gathered the necessary information from debugging, turn all debugging off. If you want to turn off only one specific debug command and leave others on, issue the no debug x command, where x is the specific debug command you want to disable.

Using Time Stamps

TIP: Make sure you have the date and time set with the clock command at privileged mode so that the time stamps are more meaningful.

Operating System IP Verification Commands

The following are commands that you should use to verify what your IP settings are. Different operating systems have different commands.

• ipconfig (Windows 2000/XP):
Click Start > Run > Command > ipconfig or ipconfig/all.

• winipcfg (Windows 95/98/Me):
Click Start > Run > winipcfg.

• ifconfig (Mac/Linux):
#ifconfig

The ip http server Command

CAUTION: The HTTP server was introduced in Cisco IOS Software Release 11.0 to extend router management to the web. You have limited management capabilities to your router through a web browser if the ip http server command is turned on.

Do not turn on the ip http server command unless you plan to use the browser interface for the router. Having it on creates a potential security hole because another port is open.

The netstat Command

SNMP and Syslog

2010-06-09T04:00:00.001-07:00

Configuring SNMP

NOTE: A community string is like a password. In the case of the first command, the community string grants you access to SNMP.

Configuring Syslog

There are eight levels of severity in logging messages, as follows:

Setting a level means you will get that level and everything below it. Level 6 means you
will receive level 6 and 7 messages. Level 4 means you will get levels 4 through 7.

The ping and traceroute Commands

2010-05-06T01:24:00.000-07:00

ICMP Redirect Messages

The ping Command

The following table describes the possible ping output characters.

Examples of Using the ping and the Extended ping Commands

The traceroute Command

Telnet and SSH

2010-03-15T01:54:00.001-07:00

Using Telnet to Remotely Connect to Other Devices

The following five commands all achieve the same result: the attempt to connect remotely to the router named Paris at IP address 172.16.20.1.

Any of the preceding commands lead to the following configuration sequence:

CAUTION: The following configuration creates a big security hole. Never use it in a live production environment. Use it in the lab only!

NOTE: A device must have two passwords for a remote user to be able to make changes to your configuration:

Line vty password (or have it explicitly turned off; see the preceding Caution)

Enable or enable secret password

Without the enable or enable secret password, a remote user will only be able to get to user mode, not to privileged mode. This is extra security.

Configuring the Secure Shell Protocol (SSH)

CAUTION: SSH Version 1 implementations have known security issues. It is recommended to use SSH Version 2 whenever possible.

NOTE: To work, SSH requires a local username database, a local IP domain, and an RSA key to be generated.

The Cisco implementation of SSH requires Cisco IOS Software to support Rivest- Shamir-Adleman (RSA) authentication and minimum Data Encryption Standard (DES) encryption—a cryptographic software image.

Cisco Discovery Protocol (CDP)

2010-02-24T05:41:00.000-08:00

Cisco Discovery Protocol

CAUTION: Although CDP is necessary for some management applications, CDP should still be disabled in some instances.

Disable CDP globally if

CDP is not required at all.

The device is located in an insecure environment.

Use the command no cdp run to disable CDP globally:

RouterOrSwitch(config)#no cdp run

Disable CDP on any interface if

Management is not being performed.

The switch interface is a nontrunk interface.

The interface is connected to a nontrusted network.

Use the interface configuration command no cdp enable to disable CDP on a specific interface:

RouterOrSwitch(config)#interface fastethernet 0/1
RouterOrSwitch(config-if)#no cdp enable

Configuration Example: DHCP

2010-02-09T08:16:00.000-08:00

Figure 24-1 illustrates the network topology for the configuration that follows, which shows how to configure DHCP services on a Cisco IOS router using the commands covered in this post.

Edmonton Router

Gibbons Router

DHCP

2010-01-19T23:13:00.000-08:00

Configuring DHCP

Verifying and Troubleshooting DHCP Configuration

Configuring a DHCP Helper Address

NOTE: The ip helper-address command will forward broadcast packets as a unicast to eight different UDP ports by default:

• TFTP (port 69)
• DNS (port 53)
• Time service (port 37)
• NetBIOS name server (port 137)
• NetBIOS datagram server (port 138)
• Boot Protocol (BOOTP) client and server datagrams (ports 67 and 68)
• TACACS service (port 49)

If you want to close some of these ports, use the no ip forward-protocol udp x command at the global configuration prompt, where x is the port number you want to close. The following command stops the forwarding of broadcasts to port 49:

Router(config)#no ip forward-protocol udp 49

If you want to open other UDP ports, use the ip forward-helper udp x command, where x is the port number you want to open:

Router(config)#ip forward-protocol udp 517

DHCP Client on a Cisco IOS Software Ethernet Interface

Configuration Example: PAT

2010-01-04T04:28:00.001-08:00

ISP Router

Company Router

Network Address Translation

2009-12-23T00:46:00.000-08:00

Configuration Example: Single Area OSPF

2009-12-02T06:54:00.001-08:00

Austin Router

Houston Router

Galveston Router

Single Area OSPF

2009-11-13T08:40:00.000-08:00

OSPF: Mandatory Commands

Using Wildcard Masks with OSPF Areas

When compared to an IP address, a wildcard mask identifies which addresses get matched for placement into an area:

A 0 (zero) in a wildcard mask means to check the corresponding bit in the address for an exact match.

A 1 (one) in a wildcard mask means to ignore the corresponding bit in the address—can be either 1 or 0.

TIP: An octet of all 0s means that the octet has to match exactly to the address. An octet of all 1s means that the octet can be ignored.

Configuring OSPF: Optional Commands

The following commands, although not mandatory, enable you to have a more controlled and efficient deployment of OSPF in your network.

Loopback Interfaces

Router ID

DR/BDR Elections

Modifying Cost Metrics

Authentication: Simple

Authentication: Using MD5 Encryption

Timers

Propagating a Default Route

Verifying OSPF Configuration

Troubleshooting OSPF

Configuration Example: EIGRP

2009-10-29T10:21:00.000-07:00

Austin Router

Houston Router

EIGRP

2009-10-17T08:18:00.000-07:00

Configuring Enhanced Interior Gateway Routing Protocol (EIGRP)

NOTE: tos is a reference to the original Interior Gateway Routing Protocol (IGRP) intention to have IGRP perform type-of-service routing. Because this was never adopted into practice, the tos field in this command is always set to zero (0).

NOTE: With default settings in place, the metric of EIGRP is reduced to the slowest bandwidth plus the sum of all the delays of the exit interfaces from the local router to the destination network.

TIP: For two routers to form a neighbor relationship in EIGRP, the k values must match.

CAUTION: Unless you are very familiar with what is occurring in your network, it is recommended that you do not change the k values.

EIGRP Auto-Summarization

CAUTION: EIGRP automatically summarizes networks at the classful boundary. A poorly designed network with discontiguous subnets could have problems with connectivity if the summarization feature is left on. For instance, you could have two routers advertise the same network—172.16.0.0/16—when in fact they wanted to advertise two different networks—172.16.10.0/24 and 172.16.20.0/24.

Recommended practice is that you turn off automatic summarization if necessary, use the ip summary-address command, and summarize manually what you need to.

Load Balancing: variance

NOTE: If a path is not a feasible successor, it is not used in load balancing.

NOTE: EIGRP supports up to six unequal-cost paths.

Bandwidth Use

NOTE: By default, EIGRP is set to use only up to 50 percent of the bandwidth of an interface to exchange routing information. Values greater than 100 percent can be configured. This configuration option might prove useful if the bandwidth is set artificially low for other reasons, such as manipulation of the routing metric or to accommodate an oversubscribed multipoint Frame Relay configuration.

NOTE: The ip bandwidth-percent command relies on the value set by the bandwidth command.

Authentication

NOTE: For the start time and the end time to have relevance, ensure that the router knows the correct time. Recommended practice dictates that you run Network Time Protocol (NTP) or some other time-synchronization method if you intend to set lifetimes on keys.

Verifying EIGRP

Troubleshooting EIGRP

RIP

2009-09-26T07:31:00.000-07:00

The ip classless Command

NOTE: A supernet route is a route that covers a range of subnets with a single entry.

NOTE: The ip classless command is enabled by default in Cisco IOS Software Release 11.3 and later.

RIP Routing: Mandatory Commands

NOTE: You need to advertise only the classful network number, not a subnet:

Router(config-router)#network 172.16.0.0
not
Router(config-router)#network 172.16.10.0

If you advertise a subnet, you will not receive an error message, because the router will automatically convert the subnet to the classful network address.

RIP Routing: Optional Commands

Troubleshooting RIP Issues

Configuration Example: RIPv2 Routing

Cancun Router

Acapulco Router

Mazatlan Router

Static Routing

2009-09-17T06:41:00.000-07:00

Configuring a Static Route on a Router

When using the ip route command, you can identify where packets should be routed in two ways:

The next-hop address

The exit interface

Both ways are shown in the “Configuration Example: Static Routes” and the “Configuring a Default Route on a Router” sections.

The permanent Keyword (Optional)

Without the permanent keyword in a static route statement, a static route will be removed if an interface goes down. A downed interface will cause the directly connected network and any associated static routes to be removed from the routing table. If the interface comes back up, the routes are returned.

Adding the permanent keyword to a static route statement will keep the static routes in the routing table even if the interface goes down and the directly connected networks are removed. You cannot get to these routes—the interface is down—but the routes remain in the table. The advantage to this is that when the interface comes back up, the static routes do not need to be reprocessed and placed back into the routing table, thus saving time and processing power.

When a static route is added or deleted, this route, along with all other static routes, is processed in one second. Before Cisco IOS Software Release 12.0, this processing time was
five seconds.

The routing table processes static routes every minute to install or remove static routes according to the changing routing table.

To specify that the route will not be removed, even if the interface shuts down, enter the following command, for example:

Router(config)#ip route 172.16.20.0 255.255.255.0 172.16.10.2 permanent

Static Routes and Administrative Distance (Optional)

To specify that an administrative distance of 200 has been assigned to a given route, enter the following command, for example:

Router(config)#ip route 172.16.20.0 255.255.255.0 172.16.10.2 200

By default, a static route is assigned an administrative distance (AD) of 1. Administrative distance rates the “trustworthiness” of a route. AD is a number from 0 through 255, where 0 is absolutely trusted and 255 cannot be trusted at all. Therefore, an AD of 1 is an extremely reliable rating, with only an AD of 0 being better. An AD of 0 is assigned to a directly connected route. The following table lists the administrative distance for each type of route.

By default, a static route is always used rather than a routing protocol. By adding an AD number to your ip route statement, however, you can effectively create a backup route to your routing protocol. If your network is using EIGRP, and you need a backup route, add a static route with an AD greater than 90. EIGRP will be used because its AD is better (lower) than the static route. If EIGRP goes down, however, the static route will be used in its place. This is known as a floating static route.

If a static route refers to an exit interface rather than a next-hop address, the destination is considered to be directly connected and is therefore given an AD of 0 rather than 1.

Configuring a Default Route on a Router

Verifying Static Routes

To display the contents of the IP routing table, enter the following command:

Router#show ip route

NOTE: The codes to the left of the routes in the table tell you from where the router learned the routes. A static route is described by the letter S.

Configuration Example: Static Routes

Boston Router

Buffalo Router

Bangor Router

EtherChannel

2009-08-24T00:21:00.000-07:00

EtherChannel provides fault-tolerant, high-speed links between switches, routers, and servers. An EtherChannel consists of individual Fast Ethernet or Gigabit Ethernet links bundled into a single logical link. If a link within an EtherChannel fails, traffic previously carried over that failed link changes to the remaining links within the EtherChannel.

Interface Modes in EtherChannel

Guidelines for Configuring EtherChannel

PAgP is Cisco proprietary.
LACP is defined in 802.3ad.
You can combine from two to eight parallel links.
All ports must be identical:
— Same speed and duplex
— Cannot mix Fast Ethernet and Gigabit Ethernet
— Cannot mix PAgP and LACP
— Must all be VLAN trunk or nontrunk operational status
All links must be either Layer 2 or Layer 3 in a single channel group.
To create a channel in PAgP, sides must be set to
— Auto-Desirable
— Desirable-Desirable
To create a channel in LACP, sides must be set to
— Active-Active
— Active-Passive
To create a channel without using PAgP or LACP, sides must be set to On-On. Donot configure a GigaStack gigabit interface converter (GBIC) as part of an EtherChannel.
An interface that is already configured to be a Switched Port Analyzer (SPAN) destination port will not join an EtherChannel group until SPAN is disabled.
Donot configure a secure port as part of an EtherChannel.
Interfaces with different native VLANs cannot form an EtherChannel.
When using trunk links, ensure all trunks are in the same mode—Inter-Switch Link (ISL) or dot1q.

Configuring Layer 2 EtherChannel

Verifying EtherChannel

Spanning Tree Protocol (STP)

2009-08-16T04:07:00.000-07:00

Enabling Spanning Tree Protocol

NOTE: If more VLANs are defined in the VLAN Trunking Protocol (VTP) than there are spanning-tree instances, you can only have STP on 64 VLANs. If you have more than 128 VLANs, it is recommended that you use Multiple STP.

Configuring the Root Switch

Configuring a Secondary Root Switch

Configuring Port Priority

Configuring the Path Cost

Configuring the Switch Priority of a VLAN

NOTE: With the priority keyword, the range is 0 to 61440 in increments of 4096. The default is 32768. The lower the priority, the more likely the switch will be chosen as the root switch.

Only the following numbers can be used as a priority value:

CAUTION: Cisco recommends caution when using this command. Cisco further recommends that the spanning-tree vlan x root primary or the spanning-tree vlan x root secondary command be used instead to modify the switch priority.

Configuring STP Timers

NOTE: For the hello-time command, the range is 1 to 10 seconds. The default is 2 seconds.
For the forward-time command, the range is 4 to 30 seconds. The default is 15 seconds.
For the max-age command, the range is 6 to 40 seconds. The default is 20 seconds.

CAUTION: Cisco recommends caution when using this command. Cisco further recommends that the spanning-tree vlan x root primary or the spanning-tree vlan x root secondary command be used instead to modify the switch timers.

Verifying STP

Optional STP Configurations

Although the following commands are not mandatory for STP to work, you might find these helpful to fine-tune your network.

PortFast

BPDU Guard

Changing the Spanning-Tree Mode

Different types of spanning tree can be configured on a Cisco switch. The options vary according to the platform:

Per-VLAN Spanning Tree (PVST)—There is one instance of spanning tree for each VLAN. This is a Cisco proprietary protocol.

Per-VLAN Spanning Tree Plus (PVST+)—Also Cisco proprietary. Has added extensions to the PVST protocol.

Rapid PVST+—This mode is the same as PVST+ except that it uses a rapid convergence based on the 802.1w standard.

Multiple Spanning Tree Protocol (MSTP)—IEEE 802.1s. Extends the 802.1w Rapid Spanning Tree (RST) algorithm to multiple spanning trees. Multiple VLANs can map to a single instance of RST. You cannot run MSTP and PVST at the same time.

Extended System ID

Enabling Rapid Spanning Tree

Troubleshooting Spanning Tree

VLAN Trunking Protocol and Inter-VLAN Routing

2009-08-09T07:51:00.000-07:00

Dynamic Trunking Protocol (DTP)

TIP: The default mode is dependent on the platform. For the 2960, the default mode is dynamic auto.

TIP: On a 2960 switch, the default for all ports is to be an access port. However, with the default DTP mode being dynamic auto, an access port can be converted into a trunk port if that port receives DTP information from the other side of the link if that side is set to trunk or desirable. It is therefore recommended to hardcode all access ports as access ports with the switchport mode access command. This way, DTP information will not inadvertently change an access port to a trunk port. Any port set with the switchport mode access command ignores any DTP requests to convert the link.

Setting the Encapsulation Type

Depending on the series of switch that you are using, you might have a choice as to what type of VLAN encapsulation you want to use: the Cisco proprietary Inter-Switch Link (ISL) or the IEEE Standard 802.1q (dot1q). The 2960 switch supports only dot1q trunking.

TIP: With the switchport trunk encapsulation negotiate command set, the preferred trunking method is ISL.

CAUTION: The 2960 series switch supports only dot1q trunking.

VLAN Trunking Protocol (VTP)

VTP is a Cisco proprietary protocol that allows for VLAN configuration (addition, deletion,
or renaming of VLANs) to be consistently maintained across a common administrative domain.

Using Global Configuration Mode

NOTE: Only VLANs included in the pruning-eligible list can be pruned. VLANs 2 through 1001 are pruning eligible by default on trunk ports. Reserved VLANs and extended-range VLANs cannot be pruned. To change which eligible VLANs can be pruned, use the interface-specific switchport trunk pruning vlan command:

Switch(config-if)#switchport trunk pruning vlan remove 4, 20-30
! Removes VLANs 4 and 20-30
Switch(config-if)#switchport trunk pruning vlan except 40-50
! All VLANs are added to the pruning list except for 40-50

Verifying VTP

NOTE: If trunking has been established before VTP is set up, VTP information is propagated throughout the switch fabric almost immediately. However, because VTP information is advertised only every 300 seconds (5 minutes), unless a change has been made to force an update, it can take several minutes for VTP information to be propagated.

Inter-VLAN Communication Using an External Router: Router-on-a-Stick

NOTE: The subnets of the VLANs are directly connected to the router. Routing between these subnets does not require a dynamic routing protocol. In a more complex topology, these routes need to either be advertised with whatever dynamic routing protocol is being used or be redistributed into whatever dynamic routing protocol is being used.

NOTE: Routes to the subnets associated with these VLANs appear in the routing table as directly connected networks.

Inter-VLAN Communication Tips

Although most routers support both ISL and dot1q encapsulation, some switch models only support dot1q (the 2950 and 2960 series, for example).
If you need to use ISL as your trunking protocol, use the command encapsulation isl x, where x is the number of the VLAN to be assigned to that subinterface.
Recommended best practice is to use the same number of the VLAN number for the subinterface number. It is easier to troubleshoot VLAN 10 on subinterface fa0/0.10 than on fa0/0.2.
The native VLAN (usually VLAN 1) cannot be configured on a subinterface for Cisco IOS Software releases that are earlier than 12.1(3)T. Native VLAN IP addresses therefore need to be configured on the physical interface. Other VLAN traffic is configured on subinterfaces:

Router(config)#interface fastethernet 0/0
Router(config-if)#encapsulation dot1q 1 native
Router(config-if)#ip address 192.168.1.1 255.255.255.0
Router(config-if)#interface fastethernet 0/0.10
Router(config-subif)#encapsulation dot1q 10
Router(config-subif)#ip address 192.168.10.1 255.255.255.0

Configuration Example: Inter-VLAN Communication

Figure 13-1 illustrates the network topology for the configuration that follows, which shows
how to configure inter-VLAN communication using commands.

ISP Router

CORP Router

L2Switch1 (Catalyst 2960)

VLANs

2009-07-27T09:22:00.000-07:00

Creating Static VLANs

Static VLANs occur when a switch port is manually assigned by the network administrator to belong to a VLAN. Each port is associated with a specific VLAN. By default, all ports are originally assigned to VLAN 1.

Using VLAN Configuration Mode

NOTE: This method is the only way to configure extended-range VLANs (VLAN IDs from 100 to 4094).

NOTE: Regardless of the method used to create VLANs, the VTP revision number is increased by 1 each time a VLAN is created or changed.

Assigning Ports to VLANs

NOTE: When the switchport mode access command is used, the port operates as a nontrunking, single VLAN interface that transmits and receives nonencapsulated frames.

An access port can belong to only one VLAN.

Using the range Command

Verifying VLAN Information

Saving VLAN Configurations

The configurations of VLANs 1 through 1005 are always saved in the VLAN database. As long as the apply or the exit command is executed in VLAN database mode, changes are saved. If you are using VLAN configuration mode, the exit command saves the changes to the VLAN database, too.

If the VLAN database configuration is used at startup, and the startup configuration file contains extended-range VLAN configuration, this information is lost when the system boots.

If you are using VTP transparent mode, the configurations are also saved in the running
configuration and can be saved to the startup configuration using the copy running-config startup-config command.

If the VTP mode is transparent in the startup configuration, and the VLAN database and the
VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database.

Erasing VLAN Configurations

NOTE: When you delete a VLAN from a switch that is in VTP server mode, the VLAN is removed from the VLAN database for all switches in the VTP domain. When you delete a VLAN from a switch that is in VTP transparent mode, the VLAN is deleted only on that specific switch.

NOTE: You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.

CAUTION: When you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN. Therefore, it is recommended that you reassign ports to a new VLAN or the default VLAN before you delete a VLAN from the VLAN database.

Configuring a Switch

2009-07-13T02:46:00.000-07:00

Help Commands

Command Modes

Verifying Commands

Resetting Switch Configuration

Setting Host Names

Setting Passwords
Setting passwords for the 2960 series switches is the same method as used for a router.

Setting IP Addresses and Default Gateways

TIP: For the 2960 series switches, the IP address of the switch is just that—the IP address for the entire switch. That is why you set the address in VLAN 1 (the default VLAN of the switch) and not in a specific Ethernet interface.

2009-07-13T02:37:00.000-07:00

Setting Interface Descriptions

TIP: The 2960 series switches have either 12 or 24 Fast Ethernet ports named fa0/1, fa0/2,
... fa0/24—there is no fastethernet 0/0.

Setting Duplex Operation

Setting Operation Speed

Managing the MAC Address Table

Configuring Static MAC Addresses

Switch Port Security

Verifying Switch Port Security

Sticky MAC Addresses

Sticky MAC addresses are a feature of port security. Sticky MAC addresses limit switch port access to a specific MAC address that can be dynamically learned, as opposed to a network administrator manually associating a MAC address with a specific switch port. These addresses are stored in the running configuration file. If this file is saved, the sticky MAC addresses do not have to be relearned when the switch is rebooted, and thus provide a high level of switch port security.

Configuring a Single Cisco Router

2009-07-07T06:04:00.001-07:00

Router Modes

TIP: There are other modes than these. Not all commands work in all modes. Be careful. If you type in a command that you know is correct—show running-config, for example—and you get an error, make sure that you are in the correct mode.

Entering Global Configuration Mode

Configuring a Router Name
This command works on both routers and switches.

2009-07-07T06:01:00.001-07:00

Configuring Passwords
These commands work on both routers and switches.

CAUTION: The enable secret password is encrypted by default. The enable password is not. For this reason, recommended practice is that you never use the enable password command. Use only the enable secret password command in a router or switch configuration.

You cannot set both enable secret password and enable password to the same password. Doing so defeats the use of encryption.

2009-07-07T05:50:00.000-07:00

Interface Names

One of the biggest problems that new administrators face is the interface names on the different models of routers. With all the different Cisco devices in production networks today, some administrators are becoming confused about the names of their interfaces. The following chart is a sample of some of the different interface names for various routers.

This is by no means a complete list. Refer to the hardware guide of the specific router that you are working on to see the different combinations, or use the following command to see which interfaces are installed on your particular router:

router#show ip interface brief

Moving Between Interfaces
What happens in Column 1 is the same thing occurring in Column 3.

Configuring a Serial Interface

TIP: The clock rate command is used only on a serial interface that has a DCE cable plugged into it. There must be a clock rate set on every serial link between routers. It does not matter which router has the DCE cable plugged into it or which interface the cable is plugged into. Serial 0 on one router can be plugged into Serial 1 on another router.

Configuring a Fast Ethernet Interface

2009-07-07T05:18:00.000-07:00

Creating a Message-of-the-Day Banner

TIP: The MOTD banner is displayed on all terminals and is useful for sending messages that affect all users. Use the no banner motd command to disable the MOTD banner. The MOTD banner displays before the login prompt and the login banner, if one has been created.

Creating a Login Banner

TIP: The login banner displays before the username and password login prompts. Use the no banner login command to disable the login banner. The MOTD banner displays before the login banner.

Setting the Clock Time Zone

Assigning a Local Host Name to an IP Address

TIP: The default port number in the ip host command is 23, or Telnet. If you want to Telnet to a device, just enter the IP host name itself:

Router#london = Router#telnet london = Router#telnet 172.16.1.3

The no ip domain-lookup Command

TIP: Ever type in a command incorrectly and are left having to wait for a minute or two as the router tries to translate your command to a domain server of 255.255.255.255? The router is set by default to try to resolve any word that is not a command to a Domain Name System (DNS) server at address 255.255.255.255. If you are not going to set up DNS, turn off this feature to save you time as you type, especially if you are a poor typist.

The logging synchronous Command

TIP: Ever try to type in a command and an informational line appears in the middle of what you were typing? Lose your place? Do not know where you are in the command, so you just press Enter and start all over? The logging synchronous command tells the router that if any informational items get displayed on the screen, your prompt and command line should be moved to a new line, so as not to confuse you.

The informational line does not get inserted into the middle of the command you are trying to type. If you were to continue typing, the command would execute properly, even though it looks wrong on the screen.

The exec-timeout Command

TIP: The command exec-timeout 0 0 is great for a lab environment because the console never logs out. This is considered to be bad security and is dangerous in the real world. The default for the exec-timeout command is 10 minutes and zero (0) seconds (exec-timeout 10 0).

Saving Configurations

Erasing Configurations

TIP: The running configuration is still in dynamic memory. Reload the router to clear the running configuration.

show Commands

EXEC Commands in Configuration Mode: The do Command

TIP: The do command is useful when you want to execute EXEC commands, such as show, clear, or debug, while remaining in global configuration mode or in any configuration submode. You cannot use the do command to execute the configure terminal command because it is the configure terminal command that changes the mode to global configuration mode.