====== Cisco random pastebin :) ======
===== See open ports =====
R1# show control-plane host open-ports
Active internet connections (servers and established)
Prot Local Address Foreign Address Service State
tcp *:23 *:0 Telnet LISTEN
tcp *:80 *:0 HTTP CORE LISTEN
tcp *:179 *:0 BGP LISTEN
tcp *:179 10.0.7.2:43962 BGP ESTABLIS
tcp *:23 10.0.7.2:18036 Telnet ESTABLIS
udp *:67 *:0 DHCPD Receive LISTEN
udp *:68 *:0 BootP client LISTEN
udp *:123 *:0 NTP LISTEN
**Notes:**
* This show command does not display non-TCP/UDP servers (OSPF, EIGRP, RSVP) or even some UDP-based services (RIP).
===== Policy QoS =====
----
**Policy/QoS**
policy-map 3GbE
class class-default
police cir 3000000000 bc 562500000 conform-action transmit
exceed-action drop violate-action drop
----
**Why are you receiving significantly more than 5Mbps inbound on interface f0/0 from the device with the MAC address of 1111.2222.3333? \\
Answer: Rate-limit command is wrong. Should use ‘access-group rate-limit 100′ to reference rate-limit access-list 100, not ‘access-group 100′.**
interface FastEthernet0/0
rate-limit input access-group rate-limit 100 5000000 2500 2500 conform-action transmit exceed-action drop
!
access-list rate-limit 100 1111.2222.3333
r1(config-if)#do sh int fa0/0 rate-limit
FastEthernet0/0
Input
**matches: access-group rate-limit 100**
params: 5000000 bps, 2500 limit, 2500 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
last packet: 2557168ms ago, current burst: 0 bytes
last cleared 00:01:43 ago, conformed 0 bps, exceeded 0 bps
----
===== Alias =====
To display IP addresses assigned to router's interfaces (excluding interfaces with no IP address) use ''show ip interface brief | exclude unassigned'' command.
Here is a sample printout:
C1#show ip int brief | excl unassigned
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 172.16.0.1 YES NVRAM up up
Serial1/0 10.0.7.17 YES NVRAM up up
Loopback0 10.0.1.1 YES NVRAM up up
Tunnel0 192.168.0.1 YES manual up up
You could define an alias to create a new IOS command generating this printout, for example, **''alias exec ipconfig show ip interface brief | exclude unassigned''**.
**List of useful aliases**
alias exec ifconfig show ip interface brief | exclude unassigned
alias exec sofn show ip ospf neighbor
alias exec proc show processes cpu | exclude 0.00%__0.00%__0.00%
and some more
alias exec siib sh ip int brief
alias exec srint sh run int
alias exec srb sh run | begin
alias exec srs sh run | sec
alias exec sri sh run | incl
alias exec sia sh ip access-list
alias configure ping do ping
alias configure sh do sh
alias configure siib do siib
alias configure srint do srint
alias configure srb do srb
alias configure sri do sri
alias configure sia do sia
alias interface ping do ping
alias interface sh do sh
alias interface siib do siib
alias interface srint do srint
alias interface srb do srb
alias interface sri do sri
alias interface sia do sia
alias subinterface ping do ping
alias subinterface sh do sh
alias subinterface siib do siib
alias subinterface srint do srint
alias subinterface srb do srb
alias subinterface sri do sri
alias subinterface sia do sia
alias exec s show run
alias exec c config t
alias exec srs show run | section
alias exec srb show run | begin
alias exec si show run interface
alias exec sri show run | include
alias exec siib show ip interface brief | exclude admin
alias exec sib show ip bgp
alias exec sir show ip route
alias exec sirp show ip route vrf PURPLE
alias exec sibp show ip bgp vpnv4 vrf PURPLE
alias exec pp ping vrf PURPLE
alias exec zp show policy-map type inspect zone-pair
alias exec sci show crypto ipsec
alias exec sck show crypto isakmp
alias exec cci clear crypto sa
alias exec cck clear crypto isakmp
alias exec sio show ip ospf
alias exec sie show ip eigrp
===== A basic script for handling ACLs of your Cisco Catalyst =====
A handy script //( [[http://tuttodebian.blogspot.com/|taken from this site]] )// to keep the ACLs of our Cisco Catalyst 3560 in separate files, so as be able to edit them without connecting to the device and finally update them on the switch by using a perl script like this:
#! /usr/bin/perl -w
# Note: in Debian/Ubuntu you need libnet-telnet-perl package
# to be installed on your system.
use Net::Telnet;
use File::Basename;
my $host = '1.1.1.1';
my $hostname = 'Switch';
my $username = 'ciscouser';
my $passwd = 'ciscopasswd';
my $enable = 'enablesecret';
my $aclname = $ARGV[0];
my $filepath = dirname($0)."/".$aclname;
my $logfile = '/tmp/acl-update.log';
sub Usage {
print "Usage: " . basename($0) . " \n";
exit 1;
}
if ( scalar @ARGV != 1)
{
print "Wrong number of arguments!\n";
&Usage();
}
if ( ! -e $filepath )
{
print "File " . $filepath . " does not exist\n";
&Usage();
}
open(ACL, $filepath) || die("Could not open file $aclname!");
@file = ;
$session = Net::Telnet->new(Timeout => 05,
Prompt => '/$hostname(\(config.*\))?[#>] *$/',
Dump_Log => '$logfile');
$session->open($host);
$session->login($username, $passwd);
$session->cmd("en\n$enable");
$session->cmd("conf t");
$session->cmd("no ip access-list extended $aclname");
$session->cmd("ip access-list extended $aclname");
foreach $line (@file)
{
chomp($line);
$session->cmd($line);
}
$session->cmd("exit");
$session->cmd("exit");
@output = $session->cmd("sh access-list $aclname");
print @output;
$session->cmd("exit");
===== Cisco IPIP Tunnels =====
**Linux (192.168.2.1):**
/sbin/ip tunnel add tunl1 mode ipip remote 192.168.1.1
/sbin/ifconfig tunl1 192.168.3.2 pointopoint 192.168.3.1 netmask 255.255.255.252 mtu 1500
**Cisco (192.168.1.1):**
interface Tunnel0
ip address 192.168.3.1 255.255.255.252
ip mtu 1500
tunnel source 192.168.1.1
tunnel destination 192.168.2.1
tunnel mode ipip
===== GRE tunel (Cisco & Juniper) =====
Juniper(M20) ----------------GRE tunnel-----------------------Cisco(7206)
**Juniper Configuration**
> show configuration interfaces gr-0/1/0
unit 0 {
tunnel {
source 219.93.2.1;
destination 219.93.2.2;
key 123456; ## problem
}
family inet {
mtu 1514;
address 192.168.1.1/30;
}
}
**Cisco Configuration**
interface
Tunnel0
ip address 192.168.1.2 255.255.255.252
no ip unreachables
no ip proxy-arp
ip mtu 1514
tunnel source 219.93.2.2
tunnel destination 219.93.2.1
tunnel key 123456 # problem
===== Is there a way to block VTP from coming in a port =====
* make the port an access port
* block 01-00-0C-CC-CC-CC (used by CDP too)
* use transparent vtp v1 & different domain
* block vlan 1 (although actually that's not possible)
You can also use "switchport nonegotiate" to turn DTP off, if you're getting vtp mismatch messages
(different vtp domains on each side).
===== DHCP Configuration for Cisco VOIP Phones =====
....
authoritative;
ddns-update-style none;
option voip-tftp-server code 150 = ip-address;
option voip-tftp-server 192.168.134.192;
This should likely work for you as well, just make sure you replace the IP for “voip-tftp-server” with the address to your core phone server. Hopefully the next time someone hits google looking for “option code 150 cisco phone” the clear answer isn’t so hard to find.
===== Slow ADSL with 12.4 IOS version?! =====
Ciscozine(config-if)#clock rate aal5 ?
1000000
1300000
1600000
2000000
2600000 (default)
3200000
4000000
5300000
7000000
<1000000-7000000> clock rates in bits per second,
choose one from above
Ciscozine(config-if)#Ciscozine(config-if)#clock rate aal5 ?
1000000
1300000
1600000
2000000
2600000 (default)
3200000
4000000
5300000
7000000
<1000000-7000000> clock rates in bits per second,
choose one from above
Ciscozine(config-if)#
In fact, if you don’t define the clock rate command into the atm interface, the IOS set to 2600000 this parameter. To force it, use the command ‘clock rate aal5′; in my case I use the command ‘clock rate aal5 7000000′.
Below the download speed test guarantee the bandwith improvement. More info on http://www.ciscozine.com/2009/11/05/slow-adsl-with-12-4-ios-version/
===== 1:1 NAT (not Cisco NAT) example =====
! WAN interface
interface FastEthernet0/0.457
encapsulation dot1Q 457
ip address 10.66.175.21 255.255.240.0
ip nat outside
! PPPoE ip tcp adjust-mss 1412
!
! LAN interface
interface FastEthernet0/1
ip address 192.168.156.1 255.255.255.0
ip nat inside
!
! Redirect 0.0.0.0 --> 10.66.175.21 --> 192.168.156.2
ip nat inside source static 192.168.156.2 10.66.175.21
With this rule ''ip nat inside source static 192.168.156.2 10.66.175.21'' it's done DNAT/SNAT (portforwarding as well as source NAT). **If things are not working as they should you might have b0rken IOS firmware on Cisco router!**
==== Cisco NAT ====
ip nat pool NAT 10.252.162.2 10.252.162.2 netmask 255.255.255.252
ip nat inside source list 10 pool NAT overload
access-list 10 permit 10.52.4.0 0.0.0.255
===== NAT Based Upon Source Address =====
{{http://evilrouters.net/wp-content/uploads/2010/04/source-address-based-nat.png}}
See original source: http://evilrouters.net/2010/04/21/nat-based-upon-source-address/
====== Foobar ======
interface FastEthernet0/5
description IP PHONE x1014 & HOST 10.1.20.5
switchport access vlan 20
switchport trunk encapsulation dot1q
switchport trunk native vlan 20
switchport trunk allowed vlan none
switchport mode access
switchport nonegotiate
switchport block multicast
switchport block unicast
switchport voice vlan 101
switchport port-security
switchport port-security maximum 3
switchport port-security aging time 10
switchport port-security aging type inactivity
no ip address
ip access-group ip-device-list in
mls qos trust device cisco-phone
mls qos trust dscp
dot1x port-control auto
dot1x guest-vlan 999
dot1x reauthentication
mac access-group mac-device-list in
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
spanning-tree guard root
!
interface FastEthernet0/6
description *** UNUSED Port ***
switchport access vlan 999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan none
switchport mode access
switchport nonegotiate
switchport block multicast
switchport block unicast
switchport port-security
switchport port-security aging time 10
switchport port-security aging type inactivity
no ip address
ip access-group ip-device-list in
shutdown
mls qos cos override
storm-control broadcast level 0.00
storm-control multicast level 0.00
storm-control unicast level 0.00
dot1x port-control force-unauthorized
dot1x guest-vlan 999
dot1x host-mode multi-host
mac access-group mac-device-list in
no cdp enable
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
spanning-tree guard root
bba-group pppoe vpn1
virtual-template 1
sessions per-vc limit 1 (1 max number of vpdn session per-vc)
sessions per-mac limit 1 ( 1 max number of vpnd session per-mac)
sessions per-mac throtlle ...