Configuring Cisco IOS

Configuring Cisco IOS
   
General Information

Routers come with different memory sets:

    ROM
    Shared RAM
    RAM (routing tables and data structures)
    Flash (IOS)
    NVRAM (Configuration files)

Commands

    To select boot source: boot system flash/rom/filname IP-address
    To erase router configuration: write erase
    To display current configuration: sh conf (from NVRAM) or wri term (from RAM)
    To configure router: conf term (or mem, or net) Remember to type CTRL-Z to leave configuration mode
    To configure interface: 
    int e0
            ip address 10.0.0.1 255.255.255.0
            no shutdown
    To show interface status: sh int e0
    To save configuration: wri mem
    enable password = password is shown in clear text when displaying configuration
    enable secret = password is shown encrypted when displaying configuration
    To set number of virtual terminals and password:
    line vty 0 4
            password access
    To disable name lookup: no ip domain-lookup
    To avoid assigning IP address to ethernet port for P-2-P connection:
    int s0
            ip unnumbered e0
    To configure route: ip route 120.0.0.0 255.255.255.0 150.1.1.1
    When connecting two routers with a cross-over cable, "clockrate 64000" is only needed on the router acting as DCE
    Password Recovery Procedure for the Cisco 2500 router: http://www.cisco.com/warp/public/474/pswdrec_2500.html
    Password Recovery Procedure for the Cisco 1600 router: http://www.cisco.com/warp/public/474/pswdrec_1600.shtml
    Do not use Hyperterminal to connect to Cisco routers through the Console plug
    Configuration register is 0x2102 for Cisco 2500 models, 0x102 for Cisco 1600 models
    To save the flash/NVRAM image on a remote TFTP server: #copy tftp flash
    To download a new IOS image into the router from a remote TFTP server: #copy flash tftp
    To update IOS:
        Install Cisco's TFTP Server
        Copy the new image with extension .bin into the TFTP Server's directory
        Launch the TFTP Server
        Connect to the Cisco router through the Console port, switch to admin mode, and type copy flash tftp. Follow the on-screen instructions to

        Note: under W2K, you might to add an extra ".bin" as file extension in addition to the default .bin extension

        Instead of "copy tftp flash", try "copy tftp: flash"
    To list images availables in flash memory, run "dir"
    To disable source-routing: no ip source-route
    Domain name and DNS server: ip domain-name example.com ip name-server 192.168.55.132 ip name-server 192.168.27.32
    To configure AAA user authentication. aaa new-model aaa authentication login lista tacacs+ enable

ALCs

Note: (CHECK) You cannot remove just one line from an existing ACL instruction, as this removes the entire section from IOS. You must type the entire section to add or remove one instruction.

Note: Watch out for the order of instructions in ACLs, as they are processed from top to bottom, ie."deny ip any any" followed by "allow tcp any any" means that a user will not be able to connect using a TCP-based application since the first line is interpreted first.

    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq smtp
    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq pop3
    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq 110
    access-list 110 permit udp any any eq 137
    access-list 110 permit udp any any eq 138
    access-list 110 permit udp any any eq 139
    access-list 110 permit icmp any any
    access-list 110 deny ip any any!

Logging

IOS debugging messages use the same "facilities" for identification. They are, however, formatted differently than error messages, beginning with a timestamp followed only by the "facility" and the debug message output. IOS error and debug messages follow the Unix syslog severity format (0 emerg to 7 debug). Messages appear in the IOS reporting output action depending on the severity level defined.

The IOS provides four output actions for viewing system event and error data. Console logging is activated by default. In its default configuration, all (severity level 7, debugging) message data is sent to the router's console port (line con0). This approach is similar to Unix, where error and event data is sent to /dev/console or /dev/tty0. To disable console logging, use the configuration mode command . Sending logging data only to the console port may seem odd, since most interaction is done using vty sessions, but the console port can be connected to a terminal server, which buffers the message data or a serial line printer (just like Unix) that can print out event messages. While esoteric, these two methods of data collection were quite acceptable for many years and they are secure from a networking perspective since the data is sent via serial to a locally attached display device (just remember to lock the door).

To view system messages over a vty session (line vty 0 - 4), monitor logging must be configured. To view logging data, the enable exec command is run to activate logging output to the vty. To enable monitor logging, use the configuration command . The monitor logging option is the most practical method for viewing logging events in real time. It is highly recommended that you establish two vty sessions, one for displaying event reporting data, and the other for command execution. Often, when troubleshooting or running a debugging sequence, a large amount of logging data is generated. This obscures the vty with logging output, making command entry quite difficult at times. Once terminal monitoring is enables on a vty, it cannot be disabled (unless the logging monitor service is disabled using the configuration command ).

Local storage of logging messages on the router is also available via buffer logging. Since most routers do not have a hard disk, messages are saved in a DRAM buffer. While buffer logging does not directly affect the router's performance, it does consume memory. However, if your router is short on memory, you may see performance issues with processes that need memory if your logging buffer allocation is too large. To verify your router's memory configuration, use the enable exec command which will provide a variety of operational facts about your router, including the amount of DRAM allocated for packet buffers and the amount allocated for operational processes (i.e., routing tables, CEF tables, etc.) To see if you are having memory allocation issues, use the enable exec command . A reasonable buffer allocation is 64k; the "history" logfile is a rotating one, which overwrites the last log entry when the size limit has been reached. To configure buffered logging use the following configuration commands:

    Godzilla-ABR(config)#logging buffered notice
    Godzilla-ABR(config)#logging buffered 64000
    Godzilla-ABR(config)#logging history size 250

The above configuration sets the buffer size at 64k and sets the history count at 250 messages. To view the buffered logging data, use the exec command . This command performs two functions; it reports on the configuration of the router's various reporting display actions, and outputs the logging buffer history (if buffer logging is configured).

To send system messages to a remote syslog host, ;TRAP logging needs to be configured as a reporting output action. Remote reporting has two big advantages over local reporting.

    History and archiving: Storing logs remotely shifts the burden of storing log output to a device with an actual file system and cheap ample storage. This provides the option to keep large-sized log files and/or the ability to archive and store log files.
    Data Manipulation: Once the log data is on a system with tools that can manipulate it, log data can be used to generate and syndicate some very interesting and valuable reports, as you will see later with the SNMP scanner report script.

Configuring TRAP logging is a four step process:

    Define a syslog host using the configuration command .
    Define the logging severity of the messages to be sent using the configuration command .
    Define the IP address that will be associated as the origin address of the logging messages. This is set using the configuration command .
        The final step defines the syslog "facility" that the messages are sent to on the remote syslog server. Use the configuration command . Here is a trap reporting configuration example that uses the Loopback interface as the report origin address:

        Godzilla-ABR(config)#logging 64.128.20.12
        Godzilla-ABR(config)#logging trap informational
        Godzilla-ABR(config)#logging source-interface Loopback 0
        Godzilla-ABR(config)#logging facility local2