Showing posts with label Cisco tips and tricks. Show all posts
How to mirror network traffic in cisco ?
Posted by Anbu on Monday, February 18, 2013
Problem:
How to mirror network traffic in cisco ?
Solution:
Usually when we admin a network, we need to know what are the protocols used more frequently, and why not, discover if someone are using improper P2P software; so we can use SPAN.
The Switched Port Analyzer (SPAN) feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer. For example, if you want to capture Ethernet traffic that is sent between host A and host B, you must implement SPAN feature.
In this diagram, the sniffer is attached to a port (destination SPAN port) that is configured to receive a copy of every packet sent between host A and host B (source SPAN port). This port is called a SPAN port.
A source port, also called a monitored port, is a switched or routed port that you monitor for network traffic analysis. In a single local SPAN session or RSPAN source session, you can monitor source port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs.
A source port has these characteristics:
It can be any port type, such as EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth.
It can be monitored in multiple SPAN sessions.
It cannot be a destination port.
Each source port can be configured with a direction (ingress, egress, or both) to monitor. For EtherChannel sources, the monitored direction applies to all physical ports in the group.
Source ports can be in the same or different VLANs.
For VLAN SPAN sources, all active ports in the source VLAN are included as source ports.
Each local SPAN session or RSPAN destination session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports and VLANs.
A destination port has these characteristics:
A destination port must reside on the same switch as the source port (for a local SPAN session).
A destination port can be any Ethernet physical port.
A destination port can participate in only one SPAN session at a time. A destination port in one SPAN session cannot be a destination port for a second SPAN session.
A destination port cannot be a source port.
A destination port cannot be an EtherChannel group.
A destination port can be a physical port that is assigned to an EtherChannel group, even if the EtherChannel group has been specified as a SPAN source. The port is removed from the group while it is configured as a SPAN destination port.
The port does not transmit any traffic except that traffic required for the SPAN session unless learning is enabled. If learning is enabled, the port also transmits traffic directed to hosts that have been learned on the destination port.
The state of the destination port is up/down by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port.
If ingress traffic forwarding is enabled for a network security device. The destination port forwards traffic at Layer 2.
A destination port does not participate in spanning tree while the SPAN session is active.
When it is a destination port, it does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).
A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored.
A destination port receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.
For example, if I want monitor traffic from/to fastethernet 0/1 (source port) using fastethernet0/3 (destination port) on my Catalyst 2950, the configuration is:
SW2950#configure terminal
SW2950(config)#
SW2950(config)#monitor session 1 source interface fastethernet 0/1
SW2950(config)#monitor session 1 destination interface fastethernet 0/3
SW2950(config)#
SW2950#show monitor session 1
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1
Destination Ports: Fa0/3
SW2950#
This configuration works also for the Catalyst 2940, 2955, 2960, 2970, 3550, 3560, 3560-E, 3750 and 3750-E Series Switches. Instead if I use a Catalyst 2900XL/3500XL the configuration is quite different:
SW2900XL(config)#interface fastethernet 0/3
SW2900XL(config-if)#port monitor fastethernet 0/1
Sometimes source ports are not located on the same switch as the destination port; in these situations is needed use an advanced SPAN feature: RSPAN or ERSPAN.
Remote SPAN (RSPAN) allows you to monitor source ports that are spread all over a switched network, not only locally on a switch with SPAN. The functionality works exactly as a regular SPAN session. The traffic that is monitored by SPAN is not directly copied to the destination port, but flooded into a special RSPAN VLAN. The destination port can then be located anywhere in this RSPAN VLAN. There can even be several destination ports.
RSPAN session cannot cross any Layer 3 device as RSPAN is a LAN (Layer 2) feature. In order to monitor traffic across a WAN or different networks, use Encapsulated Remote SwitchPort Analyser (ERSPAN).
The ERSPAN feature supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network.
ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session. You separately configure ERSPAN source sessions and destination sessions on different switches.
How to mirror network traffic in cisco ?
Solution:
Usually when we admin a network, we need to know what are the protocols used more frequently, and why not, discover if someone are using improper P2P software; so we can use SPAN.
The Switched Port Analyzer (SPAN) feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer. For example, if you want to capture Ethernet traffic that is sent between host A and host B, you must implement SPAN feature.
In this diagram, the sniffer is attached to a port (destination SPAN port) that is configured to receive a copy of every packet sent between host A and host B (source SPAN port). This port is called a SPAN port.
A source port, also called a monitored port, is a switched or routed port that you monitor for network traffic analysis. In a single local SPAN session or RSPAN source session, you can monitor source port traffic, such as received (Rx), transmitted (Tx), or bidirectional (both). The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs.
A source port has these characteristics:
It can be any port type, such as EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth.
It can be monitored in multiple SPAN sessions.
It cannot be a destination port.
Each source port can be configured with a direction (ingress, egress, or both) to monitor. For EtherChannel sources, the monitored direction applies to all physical ports in the group.
Source ports can be in the same or different VLANs.
For VLAN SPAN sources, all active ports in the source VLAN are included as source ports.
Each local SPAN session or RSPAN destination session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports and VLANs.
A destination port has these characteristics:
A destination port must reside on the same switch as the source port (for a local SPAN session).
A destination port can be any Ethernet physical port.
A destination port can participate in only one SPAN session at a time. A destination port in one SPAN session cannot be a destination port for a second SPAN session.
A destination port cannot be a source port.
A destination port cannot be an EtherChannel group.
A destination port can be a physical port that is assigned to an EtherChannel group, even if the EtherChannel group has been specified as a SPAN source. The port is removed from the group while it is configured as a SPAN destination port.
The port does not transmit any traffic except that traffic required for the SPAN session unless learning is enabled. If learning is enabled, the port also transmits traffic directed to hosts that have been learned on the destination port.
The state of the destination port is up/down by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port.
If ingress traffic forwarding is enabled for a network security device. The destination port forwards traffic at Layer 2.
A destination port does not participate in spanning tree while the SPAN session is active.
When it is a destination port, it does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).
A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored.
A destination port receives copies of sent and received traffic for all monitored source ports. If a destination port is oversubscribed, it can become congested. This congestion can affect traffic forwarding on one or more of the source ports.
For example, if I want monitor traffic from/to fastethernet 0/1 (source port) using fastethernet0/3 (destination port) on my Catalyst 2950, the configuration is:
SW2950#configure terminal
SW2950(config)#
SW2950(config)#monitor session 1 source interface fastethernet 0/1
SW2950(config)#monitor session 1 destination interface fastethernet 0/3
SW2950(config)#
SW2950#show monitor session 1
Session 1
---------
Source Ports:
RX Only: None
TX Only: None
Both: Fa0/1
Destination Ports: Fa0/3
SW2950#
This configuration works also for the Catalyst 2940, 2955, 2960, 2970, 3550, 3560, 3560-E, 3750 and 3750-E Series Switches. Instead if I use a Catalyst 2900XL/3500XL the configuration is quite different:
SW2900XL(config)#interface fastethernet 0/3
SW2900XL(config-if)#port monitor fastethernet 0/1
Sometimes source ports are not located on the same switch as the destination port; in these situations is needed use an advanced SPAN feature: RSPAN or ERSPAN.
Remote SPAN (RSPAN) allows you to monitor source ports that are spread all over a switched network, not only locally on a switch with SPAN. The functionality works exactly as a regular SPAN session. The traffic that is monitored by SPAN is not directly copied to the destination port, but flooded into a special RSPAN VLAN. The destination port can then be located anywhere in this RSPAN VLAN. There can even be several destination ports.
RSPAN session cannot cross any Layer 3 device as RSPAN is a LAN (Layer 2) feature. In order to monitor traffic across a WAN or different networks, use Encapsulated Remote SwitchPort Analyser (ERSPAN).
The ERSPAN feature supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network.
ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session. You separately configure ERSPAN source sessions and destination sessions on different switches.
How to setup a GRE tunnel on a Cisco Router ?
Posted by Anbu on
Problem:
How to setup a GRE tunnel on a Cisco Router ?
Solution:
So, let’s warm up the new year with an easy tutorial on how to setup a GRE tunnel on a Cisco router.
Consider this scenario:
Router1 = 172.16.1.1
Router2 = 192.168.0.1
The routing between these routers are fixed so that they can reach each other, like on the internet.
Router2 will have the network 10.0.10.0/24 routed to it via a GRE tunnel.
The address on the tunnel interfaces will be 10.0.0.1 and 10.0.0.2 for Router1 and Router2 respectively.
Router1 configuration:
Router1(config)#interface Tunnel 0
Router1(config-if)#tunnel source 172.16.1.1
Router1(config-if)#tunnel destination 192.168.0.1
Router1(config-if)#tunnel mode gre ip
Router1(config-if)#ip address 10.0.0.1 255.255.255.252
Router1(config-if)#no shutdown
Router1(config-if)#exit
Router1(config)#ip route 10.0.10.0 255.255.255.0 10.0.0.2
Router1(config)#interface Tunnel 0
Router1(config-if)#tunnel source 192.168.0.1
Router1(config-if)#tunnel destination 172.16.1.1
Router1(config-if)#tunnel mode gre ip
Router1(config-if)#ip address 10.0.0.2 255.255.255.252
Router1(config-if)#no shutdown
Router1(config-if)#exit
Router1(config)#ip route 10.0.10.0 255.255.255.0 Null 0
You can now setup addresses within 10.0.10.0/24 on any interface you want and use them like as they were routed to your router directly.
The traceroute from Router2 to Router1 should look something like this:
Router2#traceroute 10.0.0.1
Type escape sequence to abort.
Tracing the route to 10.0.0.1
1 10.0.0.1 8 msec 8 msec 8 msec
Voila, we got routing over GRE!
How to setup a GRE tunnel on a Cisco Router ?
Solution:
So, let’s warm up the new year with an easy tutorial on how to setup a GRE tunnel on a Cisco router.
Consider this scenario:
Router1 = 172.16.1.1
Router2 = 192.168.0.1
The routing between these routers are fixed so that they can reach each other, like on the internet.
Router2 will have the network 10.0.10.0/24 routed to it via a GRE tunnel.
The address on the tunnel interfaces will be 10.0.0.1 and 10.0.0.2 for Router1 and Router2 respectively.
Router1 configuration:
Router1(config)#interface Tunnel 0
Router1(config-if)#tunnel source 172.16.1.1
Router1(config-if)#tunnel destination 192.168.0.1
Router1(config-if)#tunnel mode gre ip
Router1(config-if)#ip address 10.0.0.1 255.255.255.252
Router1(config-if)#no shutdown
Router1(config-if)#exit
Router1(config)#ip route 10.0.10.0 255.255.255.0 10.0.0.2
Router1(config)#interface Tunnel 0
Router1(config-if)#tunnel source 192.168.0.1
Router1(config-if)#tunnel destination 172.16.1.1
Router1(config-if)#tunnel mode gre ip
Router1(config-if)#ip address 10.0.0.2 255.255.255.252
Router1(config-if)#no shutdown
Router1(config-if)#exit
Router1(config)#ip route 10.0.10.0 255.255.255.0 Null 0
You can now setup addresses within 10.0.10.0/24 on any interface you want and use them like as they were routed to your router directly.
The traceroute from Router2 to Router1 should look something like this:
Router2#traceroute 10.0.0.1
Type escape sequence to abort.
Tracing the route to 10.0.0.1
1 10.0.0.1 8 msec 8 msec 8 msec
Voila, we got routing over GRE!
How to configure IPv6 BGP Peering Sessions on Cisco IOS
Posted by Anbu on
Problem:
How to configure IPv6 BGP Peering Sessions on Cisco IOS
Solution:
The future is closer than you think, are you ready?
Here is a little tutorial on configuring IPv6 BGP peering sessions on Cisco IOS.
First set the IP address on the interface, if this is a private peering session you can use a small network from your own PA block, on an exchange this IP address should be assigned by the exchange administrators.
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#int fa 0/0
Router(config-if)#ipv6 address 3ffe:1234:1234::1/64
Then, it can be an idea to nullroute the prefix you are going to announce, I think it is good practice because it will also effectively blackhole traffic destined to unexisting networks. This will be announced into BGP with the redistribute static configuration item.
Router#conf t
Router(config)#ipv6 route 3ffe:2000::/32 null 0
Now we create a prefix list that permits only this network, this is very important to avoid leaks of prefixes to your peers. This prefix list is going to be applied outbound on to the BGP peering.
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#ipv6 prefix-list announceAS65001-ipv6 seq 5 permit 3FFE:2000::/32
! better safe than sorry
Router(config)#ipv6 prefix-list announceAS65001-ipv6 seq 5000 deny ::/0 le 128
Now we are ready to configure the BGP peering session, this is just a simple example and most of these commands can be applied to peer groups, so that each configuration gets easier.
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#router bgp 65001
Router(config-router)#redistribute static
Router(config-router)#neighbor 3ffe:1234:1234::2 remote-as 65002
Router(config-router)#address-family ipv6 unicast
Router(config-router-af)#neighbor 3ffe:1234:1234::2 activate
Router(config-router-af)#neighbor 3ffe:1234:1234::2 soft-reconfiguration inbound
Router(config-router-af)#redistribute static
Router(config-router-af)#neighbor 3ffe:1234:1234::2 prefix-list announceAS65001-ipv6 out
This will redistribute the static nullroute we made earlier to the peer at 3ffe:1234:1324::2, and the peering session should be up by now.
I can verify it on the other end:
Router2#sh ip bgp ipv6 unicast
BGP table version is 8, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network Next Hop Metric LocPrf Weight Path
*> 3FFE:2000::/32 3FFE:1234:1234::1
0 0 65001 ?
As you can see, the network 3ffe:2000::/32 is now announced on this peering session, the route is sourced from AS65001. You can also get this on the summary:
Router2#sh ip bgp ipv6 unicast summary
BGP router identifier 10.0.0.1, local AS number 65002
BGP table version is 8, main routing table version 8
1 network entries using 152 bytes of memory
1 path entries using 76 bytes of memory
2/1 BGP path/bestpath attribute entries using 248 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 500 total bytes of memory
BGP activity 2/1 prefixes, 4/3 paths, scan interval 60 secs
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
3FFE:1234:1234::1
4 65001 26 23 8 0 0 00:05:54 1
If you want to see the prefixes announced to a peer or received from a peer. (This requires soft reconfiguration inbound configured on the peering session, neighbor 3ffe:1234:1234::2 soft-reconfiguration inbound in configuration.
Router2#sh ip bgp ipv6 unicast neighbors 3ffe:1234:1234::1 received-routes
BGP table version is 8, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network Next Hop Metric LocPrf Weight Path
*> 3FFE:2000::/32 3FFE:1234:1234::1
0 0 65001 ?
Total number of prefixes 1
The prefix 3ffe:2000::/32 is received from 3ffe:1234:1234::1.
Router#sh ip bgp ipv6 unicast neighbors 3ffe:1234:1234::2 advertised-routes
BGP table version is 3, local router ID is 10.0.0.2
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network Next Hop Metric LocPrf Weight Path
*> 3FFE:2000::/32 :: 0 32768 ?
Total number of prefixes 1
Voila, a better understanding and some real life examples of IPv6 BGP peering in Cisco IOS.
How to apply ACL in cisco ios for ipv4 and ipv6
Posted by Anbu on
Problem:
How to apply ACL in cisco ios for ipv4 and ipv6
Solution:
IPv4 and IPv6 Access Control Lists In Cisco IOS
What are Access Control Lists?
ACLs are simple rulesets, they can be used to filter network traffic, routing updates, matching packets and a lot of different uses. The most common and basic usage must be to restrict network traffic to your router by applying it on the vty lines.
The access control lists have numbers and can also have text as identifiers, each number or string represents a specific access control list.
There are several “classes” of Access Control Lists, the most common ones are
IP Standard Access List
List numbers 1-99, can only define source or destination, not source and destination.
IP Extended Access List
List numbers 100-199, can define both source and destination as well as port and protocol numbers.
Okay, I understand…. but how do I configure it?
A IP standard access control list with two entries is configured like this
Router#conf t
Router(config)#ip access-list standard 5
Router(config-std-nacl)#5 permit 192.168.0.0 0.0.0.255
Router(config-std-nacl)#10 permit 192.168.1.0 0.0.0.255
To apply this inbound on an interface, just use
Router#conf t
Router(config)#int te 1/1
Router(config-if)#ip access-group 5 in
The alternative way to define an access list number 5 with two entries is
Router#conf t
Router(config)#access-list 5 permit 192.168.0.0 0.0.0.255
Router(config)#access-list 5 permit 192.168.1.0 0.0.0.255
Router(config)#
To apply this one inbound on a line interface
Router#conf t
Router(config)#line vty 1
Router(config-line)#access-class 5 in
Nice, now I have a lot of ACLs configured in my network for all the IPv4 traffic, mon ami! But IPv6 traffic still seems to keep flowing right through, thought you said you were supposed to make sense of all this in the end?
Yeah, I know I promised that and as long as you understand the IPv4 basics you will understand IPv6 pretty well. You will need to understand basic IPv6 subnetting theory to be able to filter subnets (obviously), if anyone wants me to write an article about it, just comment about it and I will get on to it ASAP. When you learn that, you will see that IPv6 access control lists are pretty much the same as for IPv4.
Anyways, I take for granted you understand IPv6 subnetting by now so I will just get right on to the configuration, an example for an IPv6 access list in Cisco IOS follows
Router#conf t
Router(config)#ipv6 access-list myfirewall
Router(config-ipv6-acl)#permit 3ffe:200::/32 any
Router(config-ipv6-acl)#permit 3ffe:100::/32 any
To verify the access-lists just look at this
Router#show access-lists myfirewall
IPv6 access list myfirewall
permit ipv6 3FFE:200::/32 any sequence 10
permit ipv6 3FFE:201::/32 any sequence 20
Router#
To apply this IPv6 Access Control List to an interface, just do as follows
Router#conf t
Router(config)#int te 1/1
Router(config-if)#ipv6 traffic-filter myfirewall in
To apply this IPv6 access control list to a line
Router#conf t
Router(config)#line vty 1
Router(config-line)#ipv6 access-class myfirewall in
How to apply ACL in cisco ios for ipv4 and ipv6
Solution:
IPv4 and IPv6 Access Control Lists In Cisco IOS
What are Access Control Lists?
ACLs are simple rulesets, they can be used to filter network traffic, routing updates, matching packets and a lot of different uses. The most common and basic usage must be to restrict network traffic to your router by applying it on the vty lines.
The access control lists have numbers and can also have text as identifiers, each number or string represents a specific access control list.
There are several “classes” of Access Control Lists, the most common ones are
IP Standard Access List
List numbers 1-99, can only define source or destination, not source and destination.
IP Extended Access List
List numbers 100-199, can define both source and destination as well as port and protocol numbers.
Okay, I understand…. but how do I configure it?
A IP standard access control list with two entries is configured like this
Router#conf t
Router(config)#ip access-list standard 5
Router(config-std-nacl)#5 permit 192.168.0.0 0.0.0.255
Router(config-std-nacl)#10 permit 192.168.1.0 0.0.0.255
To apply this inbound on an interface, just use
Router#conf t
Router(config)#int te 1/1
Router(config-if)#ip access-group 5 in
The alternative way to define an access list number 5 with two entries is
Router#conf t
Router(config)#access-list 5 permit 192.168.0.0 0.0.0.255
Router(config)#access-list 5 permit 192.168.1.0 0.0.0.255
Router(config)#
To apply this one inbound on a line interface
Router#conf t
Router(config)#line vty 1
Router(config-line)#access-class 5 in
Nice, now I have a lot of ACLs configured in my network for all the IPv4 traffic, mon ami! But IPv6 traffic still seems to keep flowing right through, thought you said you were supposed to make sense of all this in the end?
Yeah, I know I promised that and as long as you understand the IPv4 basics you will understand IPv6 pretty well. You will need to understand basic IPv6 subnetting theory to be able to filter subnets (obviously), if anyone wants me to write an article about it, just comment about it and I will get on to it ASAP. When you learn that, you will see that IPv6 access control lists are pretty much the same as for IPv4.
Anyways, I take for granted you understand IPv6 subnetting by now so I will just get right on to the configuration, an example for an IPv6 access list in Cisco IOS follows
Router#conf t
Router(config)#ipv6 access-list myfirewall
Router(config-ipv6-acl)#permit 3ffe:200::/32 any
Router(config-ipv6-acl)#permit 3ffe:100::/32 any
To verify the access-lists just look at this
Router#show access-lists myfirewall
IPv6 access list myfirewall
permit ipv6 3FFE:200::/32 any sequence 10
permit ipv6 3FFE:201::/32 any sequence 20
Router#
To apply this IPv6 Access Control List to an interface, just do as follows
Router#conf t
Router(config)#int te 1/1
Router(config-if)#ipv6 traffic-filter myfirewall in
To apply this IPv6 access control list to a line
Router#conf t
Router(config)#line vty 1
Router(config-line)#ipv6 access-class myfirewall in
How to secure a cisco network
Posted by Anbu on
Problem:
How to secure a cisco network
Solution:
1. Reverse Path Forwarding
When you enable Reverse Path Forwarding (RPF) on an interface, the router will check with a lookup in the FIB/CEF table to see that there exists a path back to the source address on the interface on which it receives a packet. This avoids spoofing of packets.
The way to configure reverse path forwarding is like this
Router#configure terminal
Router(config)#interface GigabitEthernet 2/1
Router(config-if)#ip verify unicast reverse-path
2. Silence that port
A lot of networks leak sensitive information on their switchports, this should be a pretty silent switchport.
Switch#configure terminal
Switch(config)#interface GigabitEthernet0/16
Switch(config-if)#no cdp enable
Switch(config-if)#spanning-tree bpdufilter enable
Switch(config-if)#no keepalive
This will supress CDP (Cisco Discovery Protocol), spanning-tree bpdu’s and ethernet keepalives on that interface.
3. Configure AAA and ACL’s for secure VTY access
VTY’s are for example the telnet connections on Cisco, to configure who should be able to access your switch via telnet just do like this:
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#access-list 80 permit 10.0.0.0 0.0.0.255
Switch(config)#access-list 80 permit 192.168.0.0 0.0.255.255
Switch(config)#line vty 0 15
Switch(config-line)#access-class 80 in
Switch(config-line)#end
Switch#
This will limit VTY access to 10.0.0.0/8 and 192.168.0.0/16, the netmask is a Cisco wildcard mask, troubles figuring them out? Try the wildcard cheat.
If you want to have separate users (will show up in logs) instead of the regular password prompt, you can configure AAA as such:
Switch#configure terminal
Switch(config)#username cisco secret mypassword
Switch(config)#aaa new-model
Switch(config)#aaa authentication login default local
Switch(config)#line vty 0 15
Switch(config-line)#login authentication default
Switch(config-line)#^Z
Switch#
4. Encrypt passwords in Configuration
Do you see this in your configuration?
Switch#show run | include ^username
username admin password 0 mysecret
To enable encryption of passwords just configure
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#service password-encryption
Switch(config)#end
*Mar 4 10:21:10.343: %SYS-5-CONFIG_I: Configured from console by console
Switch#show run | include ^username
username admin password 7 060B1632494D1B1C11
This gives Cisco Type 7 encryption (which, I am sorry to say; is very crackable), but it is at least something.
I like to use ’secret’ instead of ‘password’ which gives MD5 passwords in the configuration file, I am not sure of the difference, but it seems to give me what I want.
5. More secure routing protocols with passive-interface default
A passive interface is an interface which does not send nor receive routing information. Passive-interface default is supported by all routing protocols, and is configured quickly.
router routing-protocol
passive-interface default
no passive-interface interface
Passive-interface default sets all interfaces passive, and no passive-interface activates one interface. I have a more real life configuration example below.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#router ospf 1
Router(config-router)#passive-interface default
Router(config-router)#no passive-interface fastEthernet 0/2
Router(config-router)#^Z
Router#
*Mar 4 10:36:17.931: %SYS-5-CONFIG_I: Configured from console by console
This will ensure that OSPF traffic is only exchanged on fastEthernet 0/2.
How to secure a cisco network
Solution:
1. Reverse Path Forwarding
When you enable Reverse Path Forwarding (RPF) on an interface, the router will check with a lookup in the FIB/CEF table to see that there exists a path back to the source address on the interface on which it receives a packet. This avoids spoofing of packets.
The way to configure reverse path forwarding is like this
Router#configure terminal
Router(config)#interface GigabitEthernet 2/1
Router(config-if)#ip verify unicast reverse-path
2. Silence that port
A lot of networks leak sensitive information on their switchports, this should be a pretty silent switchport.
Switch#configure terminal
Switch(config)#interface GigabitEthernet0/16
Switch(config-if)#no cdp enable
Switch(config-if)#spanning-tree bpdufilter enable
Switch(config-if)#no keepalive
This will supress CDP (Cisco Discovery Protocol), spanning-tree bpdu’s and ethernet keepalives on that interface.
3. Configure AAA and ACL’s for secure VTY access
VTY’s are for example the telnet connections on Cisco, to configure who should be able to access your switch via telnet just do like this:
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#access-list 80 permit 10.0.0.0 0.0.0.255
Switch(config)#access-list 80 permit 192.168.0.0 0.0.255.255
Switch(config)#line vty 0 15
Switch(config-line)#access-class 80 in
Switch(config-line)#end
Switch#
This will limit VTY access to 10.0.0.0/8 and 192.168.0.0/16, the netmask is a Cisco wildcard mask, troubles figuring them out? Try the wildcard cheat.
If you want to have separate users (will show up in logs) instead of the regular password prompt, you can configure AAA as such:
Switch#configure terminal
Switch(config)#username cisco secret mypassword
Switch(config)#aaa new-model
Switch(config)#aaa authentication login default local
Switch(config)#line vty 0 15
Switch(config-line)#login authentication default
Switch(config-line)#^Z
Switch#
4. Encrypt passwords in Configuration
Do you see this in your configuration?
Switch#show run | include ^username
username admin password 0 mysecret
To enable encryption of passwords just configure
Switch#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#service password-encryption
Switch(config)#end
*Mar 4 10:21:10.343: %SYS-5-CONFIG_I: Configured from console by console
Switch#show run | include ^username
username admin password 7 060B1632494D1B1C11
This gives Cisco Type 7 encryption (which, I am sorry to say; is very crackable), but it is at least something.
I like to use ’secret’ instead of ‘password’ which gives MD5 passwords in the configuration file, I am not sure of the difference, but it seems to give me what I want.
5. More secure routing protocols with passive-interface default
A passive interface is an interface which does not send nor receive routing information. Passive-interface default is supported by all routing protocols, and is configured quickly.
router routing-protocol
passive-interface default
no passive-interface interface
Passive-interface default sets all interfaces passive, and no passive-interface activates one interface. I have a more real life configuration example below.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#router ospf 1
Router(config-router)#passive-interface default
Router(config-router)#no passive-interface fastEthernet 0/2
Router(config-router)#^Z
Router#
*Mar 4 10:36:17.931: %SYS-5-CONFIG_I: Configured from console by console
This will ensure that OSPF traffic is only exchanged on fastEthernet 0/2.
How to Locate the Cisco Switchport of a Server based on IP Address
Posted by Anbu on Sunday, February 17, 2013
Problem:
How to Locate the Cisco Switchport of a Server based on IP Address
Solution:
Locating computers or servers is a task I often do, and this is a tutorial on how I do it.
I have mentioned the do command, and mentioned it again in my 5 Magic Cisco Tips and Tricks article.
I am now going to give you more of a tutorial!
Locating a machine on switch port in a larger Cisco network
If you only have the IP address, just run this command:
show ip route *ipaddress*
The router will now tell you which interface this subnet is connected to.
In a usual setting you might have routed a larger block of addresses to for example a routing switch.
If this is the case, you will need to investigate layer 3 further down to that switch/router.
When you have found the IP address as directly connected issue this command to look up the MAC address in the ARP table.
show ip arp | include *ipaddress*
This will output the MAC address for this IP address, you can use this with this command:
show mac address-table | include *macaddress*
You will now see which port this hardware address is connected to.
In case you have a switch connected, you will need do the show mac address-table command on that switch also.
You can often identify switches by doing a show mac address-table interface *port*
If this gives a long list of MAC addresses with the TYPE dynamic, this is probably a switch.
How to Locate the Cisco Switchport of a Server based on IP Address
Solution:
Locating computers or servers is a task I often do, and this is a tutorial on how I do it.
I have mentioned the do command, and mentioned it again in my 5 Magic Cisco Tips and Tricks article.
I am now going to give you more of a tutorial!
Locating a machine on switch port in a larger Cisco network
If you only have the IP address, just run this command:
show ip route *ipaddress*
The router will now tell you which interface this subnet is connected to.
In a usual setting you might have routed a larger block of addresses to for example a routing switch.
If this is the case, you will need to investigate layer 3 further down to that switch/router.
When you have found the IP address as directly connected issue this command to look up the MAC address in the ARP table.
show ip arp | include *ipaddress*
This will output the MAC address for this IP address, you can use this with this command:
show mac address-table | include *macaddress*
You will now see which port this hardware address is connected to.
In case you have a switch connected, you will need do the show mac address-table command on that switch also.
You can often identify switches by doing a show mac address-table interface *port*
If this gives a long list of MAC addresses with the TYPE dynamic, this is probably a switch.
How to apply rate limit in interface using Qos
Posted by Anbu on
Filed within
Cisco,
Cisco ios,
Cisco tips and tricks,
how to apply Qos,
Networking,
networking tips and tricks,
Qos
Problem:
How to apply rate limit in interface using Qos
Solution:
QOS feature that performs rate-limiting and packet classification is called CAR-Committed Access Rate.
Here is a quick tip that limits an Internet based traffic
(primarily http and FTP) to 512K, with a nice, fat burst.
First create the access lists.
access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq ftp
Then apply rate limiting rules to the appropriate interface:
interface Serial1/0
bandwidth 2048
ip address 172.16.100.2 255.255.255.252
rate-limit input access-group 100 512000 1024000 2048000 conform-action transmit exceed-action drop
rate-limit output access-group 100 512000 1024000 2048000 conform-action transmit exceed-action drop
It will limit only http and ftp trafic, for other corporate web applications running on different ports, it will still get full E1 bandwidth.
Warning:-If, in a rate-limit rule, you reference an access list that does not exist, the rule will match all traffic. Usually not good.
How to apply rate limit in interface using Qos
Solution:
QOS feature that performs rate-limiting and packet classification is called CAR-Committed Access Rate.
Here is a quick tip that limits an Internet based traffic
(primarily http and FTP) to 512K, with a nice, fat burst.
First create the access lists.
access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq ftp
Then apply rate limiting rules to the appropriate interface:
interface Serial1/0
bandwidth 2048
ip address 172.16.100.2 255.255.255.252
rate-limit input access-group 100 512000 1024000 2048000 conform-action transmit exceed-action drop
rate-limit output access-group 100 512000 1024000 2048000 conform-action transmit exceed-action drop
It will limit only http and ftp trafic, for other corporate web applications running on different ports, it will still get full E1 bandwidth.
Warning:-If, in a rate-limit rule, you reference an access list that does not exist, the rule will match all traffic. Usually not good.
How to give security to switch ports in cisco
Posted by Anbu on
Problem:
How to give security to switch ports in cisco
Solution:
Someone connecting to your network can cause serious damage if you are sloppy with security.
Port-security
port-security on switches is very flexible, first show the status of port security
Switch#show port-security interface Gi0/19
Port Security : Disabled
Port Status : Secure-down
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 001b.53b1.ffff:20
Security Violation Count : 181
Port security is disabled, violation mode is shutdown which means that the port should be shutdown if port security is tripped. There are
Let us limit this port to one MAC address, and if we see more than one; shutdown the port.
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#int gi 0/19
Switch(config-if)#switchport port-security maximum 1
Switch(config-if)#switchport port-security violation shutdown
Switch(config-if)#switchport port-security
Switch(config-if)#
11:31:17: %PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/19, putting Gi0/19 in err-disable state
Switch(config-if)#
11:31:17: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 001b.53b1.ffff on port GigabitEthernet0/19.
11:31:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/19, changed state to down
Switch(config-if)#
11:31:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/19, changed state to down
What happened here? First we limited the port to max one MAC address, then we configured that if this is violated then the port should be shutdown. And at last we turned on port-security.
As you can see, immediately the port went in an errdisable state for a security violation.
Storm-control
Storm control can be used to limit the amount of broadcast, unicast or multicast traffic on a port.
To show the status of storm control
Switch#show storm-control gigabitEthernet 0/19
Interface Filter State Upper Lower Current
——— ————- ———– ———– ———-
Switch#
A typical broadcast storm can look like this
Switch#show interface gigabitEthernet 0/19 | i rate
Queueing strategy: fifo
5 minute input rate 106111000 bits/sec, 207129 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
Switch#
I have over 100mbit input traffic, and nothing output. I can try to apply storm-control that with shutdown the port if the amount of broadcast traffic reaches 100mbit.
Switch#conf t
Switch(config)#interface gigabitEthernet 0/19
Switch(config-if)#storm-control action shutdown
Switch(config-if)#storm-control broadcast level bps 100000000
2d10h: %PM-4-ERR_DISABLE: storm-control error detected on Gi0/19, putting Gi0/19 in err-disable state
2d10h: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Gi0/19. The interface has been disabled.
2d10h: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/19, changed state to down
2d10h: %LINK-3-UPDOWN: Interface GigabitEthernet0/19, changed state to down
The interface went straight into errdisable due to the huge amount of broadcast traffic we were receiving.
You can also get the status of storm control
Switch#show storm-control
Interface Filter State Upper Lower Current
——— ————- ———– ———– ———-
Gi0/19 Link Down 100m bps 100m bps 0 bps
These are two great techniques of securing your network ports, just tune them to your preference and they will bring you a lot of good.
How to give security to switch ports in cisco
Solution:
Someone connecting to your network can cause serious damage if you are sloppy with security.
Port-security
port-security on switches is very flexible, first show the status of port security
Switch#show port-security interface Gi0/19
Port Security : Disabled
Port Status : Secure-down
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 001b.53b1.ffff:20
Security Violation Count : 181
Port security is disabled, violation mode is shutdown which means that the port should be shutdown if port security is tripped. There are
Let us limit this port to one MAC address, and if we see more than one; shutdown the port.
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#int gi 0/19
Switch(config-if)#switchport port-security maximum 1
Switch(config-if)#switchport port-security violation shutdown
Switch(config-if)#switchport port-security
Switch(config-if)#
11:31:17: %PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/19, putting Gi0/19 in err-disable state
Switch(config-if)#
11:31:17: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 001b.53b1.ffff on port GigabitEthernet0/19.
11:31:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/19, changed state to down
Switch(config-if)#
11:31:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/19, changed state to down
What happened here? First we limited the port to max one MAC address, then we configured that if this is violated then the port should be shutdown. And at last we turned on port-security.
As you can see, immediately the port went in an errdisable state for a security violation.
Storm-control
Storm control can be used to limit the amount of broadcast, unicast or multicast traffic on a port.
To show the status of storm control
Switch#show storm-control gigabitEthernet 0/19
Interface Filter State Upper Lower Current
——— ————- ———– ———– ———-
Switch#
A typical broadcast storm can look like this
Switch#show interface gigabitEthernet 0/19 | i rate
Queueing strategy: fifo
5 minute input rate 106111000 bits/sec, 207129 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
Switch#
I have over 100mbit input traffic, and nothing output. I can try to apply storm-control that with shutdown the port if the amount of broadcast traffic reaches 100mbit.
Switch#conf t
Switch(config)#interface gigabitEthernet 0/19
Switch(config-if)#storm-control action shutdown
Switch(config-if)#storm-control broadcast level bps 100000000
2d10h: %PM-4-ERR_DISABLE: storm-control error detected on Gi0/19, putting Gi0/19 in err-disable state
2d10h: %STORM_CONTROL-3-SHUTDOWN: A packet storm was detected on Gi0/19. The interface has been disabled.
2d10h: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/19, changed state to down
2d10h: %LINK-3-UPDOWN: Interface GigabitEthernet0/19, changed state to down
The interface went straight into errdisable due to the huge amount of broadcast traffic we were receiving.
You can also get the status of storm control
Switch#show storm-control
Interface Filter State Upper Lower Current
——— ————- ———– ———– ———-
Gi0/19 Link Down 100m bps 100m bps 0 bps
These are two great techniques of securing your network ports, just tune them to your preference and they will bring you a lot of good.
Configuring a trunk link between a cisco switch and linux
Posted by Anbu on
Problem:
How to configure a trunk link between a cisco switch and linux
Solution:
Sometimes you want to test configuration settings, and linux is a good environment to do these kinds of tests in
To configure a trunk between a cisco switch and a linux machine you first have to do the trunk configuration on the cisco switch:
switch(config)# int Gi 1/0/1
switch(config-if)#switchport trunk encapsulation dot1q
switch(config-if)# switchport mode trunk
switch(config-if)# int vlan 200
switch(config-if)# ip address 10.0.0.1 255.255.255.0
switch(config-if)# no shutdown
switch(config-if)# exit
switch(config)#
Then the linux configuration for an interface eth0:
linux# /sbin/modprobe 8021q
linux# /sbin/vconfig add eth0 200
linux#/sbin/ifconfig eth0.200 10.0.0.2 netmask 255.255.255.0 up
linux# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=1.17 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.698 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.716 ms
How to configure a trunk link between a cisco switch and linux
Solution:
Sometimes you want to test configuration settings, and linux is a good environment to do these kinds of tests in
To configure a trunk between a cisco switch and a linux machine you first have to do the trunk configuration on the cisco switch:
switch(config)# int Gi 1/0/1
switch(config-if)#switchport trunk encapsulation dot1q
switch(config-if)# switchport mode trunk
switch(config-if)# int vlan 200
switch(config-if)# ip address 10.0.0.1 255.255.255.0
switch(config-if)# no shutdown
switch(config-if)# exit
switch(config)#
Then the linux configuration for an interface eth0:
linux# /sbin/modprobe 8021q
linux# /sbin/vconfig add eth0 200
linux#/sbin/ifconfig eth0.200 10.0.0.2 netmask 255.255.255.0 up
linux# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=1.17 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.698 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.716 ms
How to configure BGP With Peer-group and Filtering Routing in IOS
Posted by Anbu on
Problem:
How to configure BGP With Peer-group and Filtering Routing in IOS
Solution:
We are going to setup a peering session from AS 65500 with 65000, and we are going to announce the prefix 10.0.0.0/8
We have the IP address 172.16.1.200, while our peer have the IP address 172.16.1.1
There are different ways of filtering routes in IOS, but we’re going to focus on filtering with prefix-lists.
First enter global configuration mode by entering: ISP# conf t
To create a BGP process with AS number 65500 enter: ISP(config)# router bgp 65500
The following commands will create a peer group named IXPeers which will use the prefix-list announceAS65500 for outbound announcements.
ISP(config-router)#neighbor IXPeers peer-group
ISP(config-router)#neighbor IXPeers prefix-list announceAS65500 out
You should at best use an individual prefix-list for each and one of your peer to control inbound announcements to your autonomous system, but as this also means large administrative overhead, you can use a max prefix for the peers IXPeers.
Config: ISP(config-router)#neighbor IXPeers maximum-prefix 10
Set this to a number of prefixes you are comfortable with accepting from your peers, this is also a judgement of how much you trust your peers.
You can set a individual maximum-prefix for each peer by entering it in the neighbor statement for the peer in question.
(for example: Config: neighbor 10.20.30.40 maximum-prefix 50)
Now we are going to enter a static nullroute for the prefix 10.0.0.0/8, and redistribute it to BGP and also create the prefix-list announceAS65500
This static route to the virtual Null interface will also effectively blackhole any traffic destined for a not existing subnet in your network.
We are also going to add a static route for two more prefixes, so we can verify that the filtering works. (PS! You can apply a route map on the redistribute command to filter which prefixes that should enter the BGP table at all.)
ISP(config)#ip route 10.0.0.0 255.0.0.0 null 0
ISP(config)#ip route 192.168.0.0 255.255.255.0 null 0
ISP(config)#ip route 192.168.8.0 255.255.254.0 null 0
ISP(config)#ip prefix-list announceAS65500 seq 5 permit 10.0.0.0/8
ISP(config)#router bgp 65500
ISP(config-router)#redistribute static
You can now verify that the prefix 10.0.0.0/8 exists in your local BGP table.
ISP#sh ip bgp 10.0.0.0/8
BGP routing table entry for 10.0.0.0/8, version 4
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Flag: 0×820
Not advertised to any peer
Local
0.0.0.0 from 0.0.0.0 (172.16.1.200)
Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best
Enter BGP configuration again with router bgp 65500 in global configuration mode, and configure the peering session:
ISP(config-router)#neighbor 172.16.1.1 remote-as 65000
ISP(config-router)#neighbor 172.16.1.1 peer-group IXPeers
*Sep 6 04:43:21.207: %BGP-5-ADJCHANGE: neighbor 172.16.1.1 Up
The peering session is now established, let us verify on the IXPeer side which prefixes that are announced. (PS! This only works with the neighbor 172.16.1.200 soft-reconfiguration inbound command in BGP configuration.)
IX-Peer#sh ip bgp neighbor 172.16.1.200 received-routes | include *>
*> 10.0.0.0 172.16.1.200 0 0 65500 ?
Voila, the only network announced from 65500 is now 10.0.0.0/8!
You can now modify the prefix-list to allow other prefixes to be announced:
ISP(config)#ip prefix-list announceAS65500 seq 10 permit 192.168.0.0/24
ISP#clear ip bgp 172.16.1.1 soft out
And verification from the IXPeer
IX-Peer#sh ip bgp neighbor 172.16.1.200 received-routes | include *>
*> 10.0.0.0 172.16.1.200 0 0 65500 ?
*> 192.168.0.0 172.16.1.200 0 0 65500 ?
How to configure BGP With Peer-group and Filtering Routing in IOS
Solution:
We are going to setup a peering session from AS 65500 with 65000, and we are going to announce the prefix 10.0.0.0/8
We have the IP address 172.16.1.200, while our peer have the IP address 172.16.1.1
There are different ways of filtering routes in IOS, but we’re going to focus on filtering with prefix-lists.
First enter global configuration mode by entering: ISP# conf t
To create a BGP process with AS number 65500 enter: ISP(config)# router bgp 65500
The following commands will create a peer group named IXPeers which will use the prefix-list announceAS65500 for outbound announcements.
ISP(config-router)#neighbor IXPeers peer-group
ISP(config-router)#neighbor IXPeers prefix-list announceAS65500 out
You should at best use an individual prefix-list for each and one of your peer to control inbound announcements to your autonomous system, but as this also means large administrative overhead, you can use a max prefix for the peers IXPeers.
Config: ISP(config-router)#neighbor IXPeers maximum-prefix 10
Set this to a number of prefixes you are comfortable with accepting from your peers, this is also a judgement of how much you trust your peers.
You can set a individual maximum-prefix for each peer by entering it in the neighbor statement for the peer in question.
(for example: Config: neighbor 10.20.30.40 maximum-prefix 50)
Now we are going to enter a static nullroute for the prefix 10.0.0.0/8, and redistribute it to BGP and also create the prefix-list announceAS65500
This static route to the virtual Null interface will also effectively blackhole any traffic destined for a not existing subnet in your network.
We are also going to add a static route for two more prefixes, so we can verify that the filtering works. (PS! You can apply a route map on the redistribute command to filter which prefixes that should enter the BGP table at all.)
ISP(config)#ip route 10.0.0.0 255.0.0.0 null 0
ISP(config)#ip route 192.168.0.0 255.255.255.0 null 0
ISP(config)#ip route 192.168.8.0 255.255.254.0 null 0
ISP(config)#ip prefix-list announceAS65500 seq 5 permit 10.0.0.0/8
ISP(config)#router bgp 65500
ISP(config-router)#redistribute static
You can now verify that the prefix 10.0.0.0/8 exists in your local BGP table.
ISP#sh ip bgp 10.0.0.0/8
BGP routing table entry for 10.0.0.0/8, version 4
Paths: (1 available, best #1, table Default-IP-Routing-Table)
Flag: 0×820
Not advertised to any peer
Local
0.0.0.0 from 0.0.0.0 (172.16.1.200)
Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best
Enter BGP configuration again with router bgp 65500 in global configuration mode, and configure the peering session:
ISP(config-router)#neighbor 172.16.1.1 remote-as 65000
ISP(config-router)#neighbor 172.16.1.1 peer-group IXPeers
*Sep 6 04:43:21.207: %BGP-5-ADJCHANGE: neighbor 172.16.1.1 Up
The peering session is now established, let us verify on the IXPeer side which prefixes that are announced. (PS! This only works with the neighbor 172.16.1.200 soft-reconfiguration inbound command in BGP configuration.)
IX-Peer#sh ip bgp neighbor 172.16.1.200 received-routes | include *>
*> 10.0.0.0 172.16.1.200 0 0 65500 ?
Voila, the only network announced from 65500 is now 10.0.0.0/8!
You can now modify the prefix-list to allow other prefixes to be announced:
ISP(config)#ip prefix-list announceAS65500 seq 10 permit 192.168.0.0/24
ISP#clear ip bgp 172.16.1.1 soft out
And verification from the IXPeer
IX-Peer#sh ip bgp neighbor 172.16.1.200 received-routes | include *>
*> 10.0.0.0 172.16.1.200 0 0 65500 ?
*> 192.168.0.0 172.16.1.200 0 0 65500 ?
How to enable SSH in Cisco IOS
Posted by Anbu on
Filed within
Cisco,
Cisco ios,
Cisco tips and tricks,
Networking,
networking tips and tricks,
online security,
security,
SSH
Problem:
How to enable SSH in Cisco IOS
Solution:
Please follow these steps to enable SSH on a Cisco 7200 router.
Router(config)#hostname myrouter
myrouter(config)#ip domain-name gho.no
myrouter(config)#crypto key generate rsa general-keys
The name for the keys will be: myrouter.gho.no
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
*Sep 6 16:00:27.417: %SSH-5-ENABLED: SSH 1.99 has been enabled
SSH version 1 is prone to a lot of vulnerabilities, you should use SSH version 2.
Router(config)#ip ssh version 2
To verify that you are indeed running SSH version 2, you can issue the show ip ssh command in exec mode.
myrouter#sh ip ssh
SSH Enabled – version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
How to enable SSH in Cisco IOS
Solution:
Please follow these steps to enable SSH on a Cisco 7200 router.
Router(config)#hostname myrouter
myrouter(config)#ip domain-name gho.no
myrouter(config)#crypto key generate rsa general-keys
The name for the keys will be: myrouter.gho.no
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
*Sep 6 16:00:27.417: %SSH-5-ENABLED: SSH 1.99 has been enabled
SSH version 1 is prone to a lot of vulnerabilities, you should use SSH version 2.
Router(config)#ip ssh version 2
To verify that you are indeed running SSH version 2, you can issue the show ip ssh command in exec mode.
myrouter#sh ip ssh
SSH Enabled – version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
How bgp selects the best path ?
Posted by Anbu on
Problem:
How bgp selects the best path ?
Solution:
In BGP running on a Cisco router, this is the process:
Use paths with the highest Weight
Use paths with the highest Local Preference
Use paths sourced with the network or redistribute command over paths sourced from the aggregate-address command.
Choose the route with the shortest AS-Path
Use paths origined from (in this order) IGP, EGP and Unknown. (IGP paths are prefered over EGP, EGP over unknown)
Choose the path with the lowest MED (‘MED is cost’, so the path with the lowest MED is prefered)
Choose eBGP paths over iBGP
If there are multiple prefered iBGP paths, use the one with the lowest IGP metric.
Now see if there are multiple paths , and if the router is running with the bgp-multipath command. (then they will be installed)
If there are multiple eBGP paths for the destination, choose the oldest one (the one first received).
If there are no current best path, or you run the bgp best path compare-routerid command.
Choose the route originating from the router with the lowest router-id.
(Route Reflectors) If paths originate from the same router, choose the path with the lowest cluster list length.
At last, choose the route that originates from the lowest neighbor address
Why isn’t the prefix received and installed to the routing table?
This happens from time to time, this is often because there are no IGP route to the NEXT_HOP in the BGP UPDATE. It can also occur if the local-as is present in the AS_PATH attribute.
How can I see which prefixes are filtered, and which are received?
You can use the command neighbor 10.20.30.40 soft-reconfiguration inbound to make the router store rejected, filtered and other routing information in memory for you. You can then use the show ip bgp neighbor 10.20.30.40 received-routes and show ip bgp neighbor 10.20.30.40 advertised-routes to see you received and advertised routes.
How bgp selects the best path ?
Solution:
In BGP running on a Cisco router, this is the process:
Use paths with the highest Weight
Use paths with the highest Local Preference
Use paths sourced with the network or redistribute command over paths sourced from the aggregate-address command.
Choose the route with the shortest AS-Path
Use paths origined from (in this order) IGP, EGP and Unknown. (IGP paths are prefered over EGP, EGP over unknown)
Choose the path with the lowest MED (‘MED is cost’, so the path with the lowest MED is prefered)
Choose eBGP paths over iBGP
If there are multiple prefered iBGP paths, use the one with the lowest IGP metric.
Now see if there are multiple paths , and if the router is running with the bgp-multipath command. (then they will be installed)
If there are multiple eBGP paths for the destination, choose the oldest one (the one first received).
If there are no current best path, or you run the bgp best path compare-routerid command.
Choose the route originating from the router with the lowest router-id.
(Route Reflectors) If paths originate from the same router, choose the path with the lowest cluster list length.
At last, choose the route that originates from the lowest neighbor address
Why isn’t the prefix received and installed to the routing table?
This happens from time to time, this is often because there are no IGP route to the NEXT_HOP in the BGP UPDATE. It can also occur if the local-as is present in the AS_PATH attribute.
How can I see which prefixes are filtered, and which are received?
You can use the command neighbor 10.20.30.40 soft-reconfiguration inbound to make the router store rejected, filtered and other routing information in memory for you. You can then use the show ip bgp neighbor 10.20.30.40 received-routes and show ip bgp neighbor 10.20.30.40 advertised-routes to see you received and advertised routes.
Configuring IPv6 OSPF routing in Cisco IOS
Posted by Anbu on Saturday, February 16, 2013
Problem:
How to configure IPv6 OSPF routing in Cisco IOS
Solution:
This is really simple, first configure the IPv6 addresses on the interfaces.
Router1
Router1(config)# interface fastethernet 0/0
Router1(config-if)#ipv6 address 2001:1ad8::1/126
Router2
Router2(config)#int fa 0/0
Router2(config-if)#ipv6 address 2001:1ad8::2/126
Verify the IPv6 connectivity with ping:
Router2#ping ipv6 2001:1ad8::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:1AD8::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/10/20 ms
Set a nullroute to redistribute to IPv6 OSPF, and configure IPv6 OSPF routing on Router1:
Router1(config)#ipv6 route 2001:1ad8:500::/64 null 0
Router1(config)# interface fa 0/0
Router1(config-if)#ipv6 ospf 1 area 0
Router1(config-if)#ipv6 router ospf 1
Router1(config-rtr)#redistribute static
Do the same thing on Router2, except for the static route and redistribution.
Router2(config)#int fastethernet 0/0
Router2(config-if)#ipv6 ospf 1 area 0
Now verify the IPv6 OSPF router neighborship
Router2#show ipv6 ospf neighbor
Neighbor ID Pri State Dead Time Interface ID Interface
172.16.1.1 1 FULL/BDR 00:00:31 4 FastEthernet0/0
Check for the route
Router2#sh ipv6 route ospf | include ^O
OE2 2001:1AD8:500::/64 [110/20]
How to configure IPv6 OSPF routing in Cisco IOS
Solution:
This is really simple, first configure the IPv6 addresses on the interfaces.
Router1
Router1(config)# interface fastethernet 0/0
Router1(config-if)#ipv6 address 2001:1ad8::1/126
Router2
Router2(config)#int fa 0/0
Router2(config-if)#ipv6 address 2001:1ad8::2/126
Verify the IPv6 connectivity with ping:
Router2#ping ipv6 2001:1ad8::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:1AD8::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/10/20 ms
Set a nullroute to redistribute to IPv6 OSPF, and configure IPv6 OSPF routing on Router1:
Router1(config)#ipv6 route 2001:1ad8:500::/64 null 0
Router1(config)# interface fa 0/0
Router1(config-if)#ipv6 ospf 1 area 0
Router1(config-if)#ipv6 router ospf 1
Router1(config-rtr)#redistribute static
Do the same thing on Router2, except for the static route and redistribution.
Router2(config)#int fastethernet 0/0
Router2(config-if)#ipv6 ospf 1 area 0
Now verify the IPv6 OSPF router neighborship
Router2#show ipv6 ospf neighbor
Neighbor ID Pri State Dead Time Interface ID Interface
172.16.1.1 1 FULL/BDR 00:00:31 4 FastEthernet0/0
Check for the route
Router2#sh ipv6 route ospf | include ^O
OE2 2001:1AD8:500::/64 [110/20]
Configuration registers on Cisco IOS
Posted by Anbu on
Problem:
How to identify configuration registers on Cisco IOS
Solutions:
0×102
Ignores break, 9600 baud
0×1202
1200 baud
0×2101
Boots into bootstrap, Ignores break, Boots into ROM if initial boot fails, 9600 baud
0×2102
Ignores break, boots into ROM if intial boot fails, 9600 baud default for most platforms
0×2120
Boots into ROM, 19200 baud
0×2122
Ignores break, boots into rom if initial boot fails, 19200 baud
0×2124
Netboot, ignores break, boots into ROM if initial boot fails, 19200 baud
0×2142
Ignores break, boots into ROM if initial boot fails, 4800 baud
0×2922
Ignores break, boots into ROM if initial boot fails, 38400 baud
0×3122
Ignores break, boots into ROM if initial boot fails, 57600 baud
0×3902
Ignores break, boots into ROM if initial boot fails, 115200 baud
To find your configuration register just type (funny one): show ver | include ion_reg
To set it from IOS just type in global config mode: config-register <new register>
How to identify configuration registers on Cisco IOS
Solutions:
0×102
Ignores break, 9600 baud
0×1202
1200 baud
0×2101
Boots into bootstrap, Ignores break, Boots into ROM if initial boot fails, 9600 baud
0×2102
Ignores break, boots into ROM if intial boot fails, 9600 baud default for most platforms
0×2120
Boots into ROM, 19200 baud
0×2122
Ignores break, boots into rom if initial boot fails, 19200 baud
0×2124
Netboot, ignores break, boots into ROM if initial boot fails, 19200 baud
0×2142
Ignores break, boots into ROM if initial boot fails, 4800 baud
0×2922
Ignores break, boots into ROM if initial boot fails, 38400 baud
0×3122
Ignores break, boots into ROM if initial boot fails, 57600 baud
0×3902
Ignores break, boots into ROM if initial boot fails, 115200 baud
To find your configuration register just type (funny one): show ver | include ion_reg
To set it from IOS just type in global config mode: config-register <new register>
Configuring a Cisco 7200 as a DNS server
Posted by Anbu on
Problem:
Configuring a Cisco 7200 as a DNS server
Solution:
we can use a 7200 as a DNS server and managed to use the Cisco 7200 as a DNS server for my .lan domain.
This is how I configured it
ISP(config)#ip dns primary lan soa ns.nic.lan holm.blackedge.org 30 30 30
ISP(config)#ip dns server
ISP(config)#ip host ns.nic.lan 172.16.1.200
ISP(config)#ip host ns2.nic.lan 172.16.1.1
The ip dns primary command defines the zone.
The ip dns server enables the DNS server.
The ip host commands adds records to the zone.
To verify the configuration on another router:
IXPeer(config)#ip name-server 172.16.1.200
IXPeer#ping ns.nic.lan
Translating “ns.nic.lan”…domain server (172.16.1.200) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.200, timeout is 2 seconds:
!!!!!
IXPeer#ping ns2.nic.lan
Translating “ns2.nic.lan”…domain server (172.16.1.200) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
…..
Success rate is 0 percent (0/5)
IXPeer#
This is a simple way to get local DNS resolution enabled on a Cisco 7200 router!
Configuring a Cisco 7200 as a DNS server
Solution:
we can use a 7200 as a DNS server and managed to use the Cisco 7200 as a DNS server for my .lan domain.
This is how I configured it
ISP(config)#ip dns primary lan soa ns.nic.lan holm.blackedge.org 30 30 30
ISP(config)#ip dns server
ISP(config)#ip host ns.nic.lan 172.16.1.200
ISP(config)#ip host ns2.nic.lan 172.16.1.1
The ip dns primary command defines the zone.
The ip dns server enables the DNS server.
The ip host commands adds records to the zone.
To verify the configuration on another router:
IXPeer(config)#ip name-server 172.16.1.200
IXPeer#ping ns.nic.lan
Translating “ns.nic.lan”…domain server (172.16.1.200) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.200, timeout is 2 seconds:
!!!!!
IXPeer#ping ns2.nic.lan
Translating “ns2.nic.lan”…domain server (172.16.1.200) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
…..
Success rate is 0 percent (0/5)
IXPeer#
This is a simple way to get local DNS resolution enabled on a Cisco 7200 router!
Backup cisco configuration files automatically
Posted by Anbu on
Problem:
Backup cisco configuration files automatically
Solution:
You can use the Cisco ‘archive’ command in global configuration mode to let the Cisco switch or router automatically save backups of your configuration file to a TFTP, FTP, HTTP HTTPS, SCP or RCP filesystem.
To configure automatic backup on to for example a TFTP server on write-memory just do this:
Switch(config)# archive
Switch(config-archive)# path tftp://10.0.0.1/ciscobackups/Switch
Switch(config-archive)# write-memory
The switch or router will now automatically archive a copy of your running configuration on 10.0.0.1
You can use show archive to verify backups.
Switch# show archive
The next archive file will be named tftp://10.0.0.1/ciscobackups/Switch-3
Archive # Name
0 tftp://10.0.0.1/ciscobackups/Switch-1
1 tftp://10.0.0.1/ciscobackups/Switch-2 <- Most Recent
And you can also use the EXEC command ‘configure replace‘ to take use of archived configuration files and rollback on to one of them.
Backup cisco configuration files automatically
Solution:
You can use the Cisco ‘archive’ command in global configuration mode to let the Cisco switch or router automatically save backups of your configuration file to a TFTP, FTP, HTTP HTTPS, SCP or RCP filesystem.
To configure automatic backup on to for example a TFTP server on write-memory just do this:
Switch(config)# archive
Switch(config-archive)# path tftp://10.0.0.1/ciscobackups/Switch
Switch(config-archive)# write-memory
The switch or router will now automatically archive a copy of your running configuration on 10.0.0.1
You can use show archive to verify backups.
Switch# show archive
The next archive file will be named tftp://10.0.0.1/ciscobackups/Switch-3
Archive # Name
0 tftp://10.0.0.1/ciscobackups/Switch-1
1 tftp://10.0.0.1/ciscobackups/Switch-2 <- Most Recent
And you can also use the EXEC command ‘configure replace‘ to take use of archived configuration files and rollback on to one of them.
Configuring 802.1Q Trunk Links in Cisco IOS
Posted by Anbu on
Problem:
How to configure 802.1Q Trunk Links in Cisco IOS
Solution:
What is a trunk link?
A port in trunking mode can carry multiple vlans with two types of encapsulation, either ISL or 802.1Q.
Multiple vendors support 802.1Q, and that makes it my choice for a trunking protocol.
How does 802.1Q work?
It works by inserting a 4-byte tag in the original frame header, this contains the VLAN identification along with some other information.
Bits 16 3 1 12
TPID PRIORITY CFI VID
The TPID is the Tag Protocol Identifier, this should be set to 0×8100 for 802.1Q.
The PRIORITY is a 3-bit priority, ranges from 0 – 7.
The CFI is the Canonical Format Idicator, which means that it is used to identify if the MAC address is in canonical format or not, if it is set to 0 the address is in canonical format.
The tag is 4 bytes long, and with a 12-bit VLAN ID field, it can hold 2^12 = 4096 Vlans.
The switch will also recompute the FCS-field, since the frame is altered.
Configuration of a trunk link
Now, to configure a trunk link between two switches the following code should be suitable:
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# exit
Switch(config) vlan 500
The encapsulation will define the encapsulation of the trunk link to either ISL or 802.1Q.
The mode trunk will force the port into a trunking mode, where you can also choose dynamic to make switches negotiate the mode. I force all ports to their mode, always.
The vlan 500 command will create the vlan 500, this should automatically be trunked when configured on both sides.
Disallow some vlans:
Sometimes we don’t wanna make a mess and let some vlans over some trunk links.
Imagine spanning a customers vlan from US to Spain by accident, or worse..
Imagine delivering layer 2 connectivity between a set of location for a customer on different vlan ID’s, delivered on a trunk link. If you aren’t careful you can end up letting private vlan traffic leak between customers.
Switch(config)# interface Gig1/0/1
Switch(config-if)# switchport trunk allowed vlan 500
This will make sure that only vlan 500 is allowed over this trunk link, even if the other side tries to negotiate another vlan from you.
Pitfalls
Make sure to use the add statement if you are adding more vlans to a trunk link.
Switch(config-if)# switchport trunk allowed vlan add 200
Or else the configuration will overwrite the old vlans you might have configured on a link.
Verification
To verify your trunk links, you can for example do this:
Switch#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/1 auto 802.1q trunking 1
Port Vlans allowed on trunk
Gi1/0/1 500
Port Vlans allowed and active in management domain
Gi1/0/1 500
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/1 500
Here you can see that port Gi1/0/1 is trunking, and that vlan 500 is allowed and active over the trunk.
You can also use show vlan id;
Switch# show vlan id 500
VLAN Name Status Ports
—- ——————————– ——— ——————————-
500 VLAN500 active Gi1/0/1, Gi1/0/2
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
—- —– ———- —– —— —— ——– —- ——– —— ——
500 enet 101545 1500 – – – – – 0 0
Remote SPAN VLAN
—————-
Disabled
Primary Secondary Type Ports
——- ——— —————– ——————————————
Switch#
Here you can see that vlan 500 is configured on the trunk link Gigabit ethernet 1/0/1 and also on 1/0/2.
That’s a little insight in 802.1Q trunking vlan links!
How to configure 802.1Q Trunk Links in Cisco IOS
Solution:
What is a trunk link?
A port in trunking mode can carry multiple vlans with two types of encapsulation, either ISL or 802.1Q.
Multiple vendors support 802.1Q, and that makes it my choice for a trunking protocol.
How does 802.1Q work?
It works by inserting a 4-byte tag in the original frame header, this contains the VLAN identification along with some other information.
Bits 16 3 1 12
TPID PRIORITY CFI VID
The TPID is the Tag Protocol Identifier, this should be set to 0×8100 for 802.1Q.
The PRIORITY is a 3-bit priority, ranges from 0 – 7.
The CFI is the Canonical Format Idicator, which means that it is used to identify if the MAC address is in canonical format or not, if it is set to 0 the address is in canonical format.
The tag is 4 bytes long, and with a 12-bit VLAN ID field, it can hold 2^12 = 4096 Vlans.
The switch will also recompute the FCS-field, since the frame is altered.
Configuration of a trunk link
Now, to configure a trunk link between two switches the following code should be suitable:
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# exit
Switch(config) vlan 500
The encapsulation will define the encapsulation of the trunk link to either ISL or 802.1Q.
The mode trunk will force the port into a trunking mode, where you can also choose dynamic to make switches negotiate the mode. I force all ports to their mode, always.
The vlan 500 command will create the vlan 500, this should automatically be trunked when configured on both sides.
Disallow some vlans:
Sometimes we don’t wanna make a mess and let some vlans over some trunk links.
Imagine spanning a customers vlan from US to Spain by accident, or worse..
Imagine delivering layer 2 connectivity between a set of location for a customer on different vlan ID’s, delivered on a trunk link. If you aren’t careful you can end up letting private vlan traffic leak between customers.
Switch(config)# interface Gig1/0/1
Switch(config-if)# switchport trunk allowed vlan 500
This will make sure that only vlan 500 is allowed over this trunk link, even if the other side tries to negotiate another vlan from you.
Pitfalls
Make sure to use the add statement if you are adding more vlans to a trunk link.
Switch(config-if)# switchport trunk allowed vlan add 200
Or else the configuration will overwrite the old vlans you might have configured on a link.
Verification
To verify your trunk links, you can for example do this:
Switch#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/1 auto 802.1q trunking 1
Port Vlans allowed on trunk
Gi1/0/1 500
Port Vlans allowed and active in management domain
Gi1/0/1 500
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/1 500
Here you can see that port Gi1/0/1 is trunking, and that vlan 500 is allowed and active over the trunk.
You can also use show vlan id;
Switch# show vlan id 500
VLAN Name Status Ports
—- ——————————– ——— ——————————-
500 VLAN500 active Gi1/0/1, Gi1/0/2
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
—- —– ———- —– —— —— ——– —- ——– —— ——
500 enet 101545 1500 – – – – – 0 0
Remote SPAN VLAN
—————-
Disabled
Primary Secondary Type Ports
——- ——— —————– ——————————————
Switch#
Here you can see that vlan 500 is configured on the trunk link Gigabit ethernet 1/0/1 and also on 1/0/2.
That’s a little insight in 802.1Q trunking vlan links!
Cisco 3750 Password Recovery
Posted by Anbu on
Problem:
How to recover a Passoword in Cisco 3750
Solution:
How to recover a Passoword in Cisco 3750
Solution:
This password recovery method also applies to at least the:
Cisco 2950, Cisco 2960, Cico 3550, Cisco 3560 and Cisco 3750 series.
The only difference will be for how long you will hold the mode button,
from my experience just try to hold it longer if it doesn’t work.
(It should be around 15 seconds for the 3750.)
Connect the PC to the console port
Settings:
9600 bits
8 data bits
‘none’ parity
1 stop bit
If the switch is powered on, power it off and press and hold the mode button while you power on the switch again. Hold it for about 15 seconds until the SYS led is solid green, then release it.
The switch should then give you this prompt
switch:
To initialize the flash file system, run the command
switch: flash_init
The switch will now print a bunch of messages about the flash memory, hopefully one of them will be ‘done initializing flash’.
The next command is load_helper to load any helper images required by boot.
You can now list the contents of your flash by running dir flash:
There should be a file named ‘config.text’, you can rename this file
switch: rename flash:config.text flash:oldconfig.backup
To further boot the switch run the boot command, this will start the boot you are used to. When the switch is booted up, you will realize that the configuration is gone.. But you are enabled on the switch now.
To recover the old configuration:
Switch#rename flash:oldconfig.backup flash:config.text
And now to replace the running configuration with the backup
Switch#copy flash:config.text running-config
Destination filename [running-config]?
Press enter, and you will have your old switch configuration back and you are enabled.
Just remember to change your password now!
