====== Cisco random pastebin :) ======

===== See open ports =====

   R1# show control-plane host open-ports
   Active internet connections (servers and established)
   Prot   Local Address  Foreign Address          Service    State
    tcp            *:23              *:0           Telnet   LISTEN
    tcp            *:80              *:0        HTTP CORE   LISTEN
    tcp           *:179              *:0              BGP   LISTEN
    tcp           *:179   10.0.7.2:43962              BGP ESTABLIS
    tcp            *:23   10.0.7.2:18036           Telnet ESTABLIS
    udp            *:67              *:0    DHCPD Receive   LISTEN
    udp            *:68              *:0     BootP client   LISTEN
    udp           *:123              *:0              NTP   LISTEN

**Notes:**
    * This show command does not display non-TCP/UDP servers (OSPF, EIGRP, RSVP) or even some UDP-based services (RIP).

===== Policy QoS =====

----

**Policy/QoS**
   policy-map 3GbE
      class class-default
      police cir 3000000000 bc 562500000 conform-action transmit
   exceed-action drop     violate-action drop

----
**Why are you receiving significantly more than 5Mbps inbound on interface f0/0 from the device with the MAC address of 1111.2222.3333? \\

Answer: Rate-limit command is wrong.  Should use ‘access-group rate-limit 100′ to reference rate-limit access-list 100, not ‘access-group 100′.**

   interface FastEthernet0/0
   rate-limit input access-group rate-limit 100 5000000 2500 2500 conform-action transmit exceed-action drop
   !
   access-list rate-limit 100 1111.2222.3333

   r1(config-if)#do sh int fa0/0 rate-limit
   FastEthernet0/0
   Input
   **matches: access-group rate-limit 100**
   params:  5000000 bps, 2500 limit, 2500 extended limit
   conformed 0 packets, 0 bytes; action: transmit
   exceeded 0 packets, 0 bytes; action: drop
   last packet: 2557168ms ago, current burst: 0 bytes
   last cleared 00:01:43 ago, conformed 0 bps, exceeded 0 bps

----


===== Alias =====

To display IP addresses assigned to router's interfaces (excluding interfaces with no IP address) use ''show ip interface brief | exclude unassigned'' command.

Here is a sample printout:

<code>
C1#show ip int brief | excl unassigned  
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            172.16.0.1      YES NVRAM  up                    up      
Serial1/0                  10.0.7.17       YES NVRAM  up                    up      
Loopback0                  10.0.1.1        YES NVRAM  up                    up      
Tunnel0                    192.168.0.1     YES manual up                    up      
</code>

You could define an alias to create a new IOS command generating this printout, for example, **''alias exec ipconfig show ip interface brief | exclude unassigned''**.

**List of useful aliases**
<code>
alias exec ifconfig show ip interface brief | exclude unassigned
alias exec sofn show ip ospf neighbor
alias exec proc show processes cpu | exclude 0.00%__0.00%__0.00%
</code>

and some more

<code>
alias exec siib sh ip int brief
alias exec srint sh run int
alias exec srb sh run | begin
alias exec srs sh run | sec
alias exec sri sh run | incl
alias exec sia sh ip access-list
</code>

<code>
alias configure ping do ping
alias configure sh do sh
alias configure siib do siib
alias configure srint do srint
alias configure srb do srb
alias configure sri do sri
alias configure sia do sia

alias interface ping do ping
alias interface sh do sh
alias interface siib do siib
alias interface srint do srint
alias interface srb do srb
alias interface sri do sri
alias interface sia do sia

alias subinterface ping do ping
alias subinterface sh do sh
alias subinterface siib do siib
alias subinterface srint do srint
alias subinterface srb do srb
alias subinterface sri do sri

alias subinterface sia do sia
</code>

<code>
alias exec s show run
alias exec c config t
alias exec srs show run | section
alias exec srb show run | begin
alias exec si show run interface
alias exec sri show run | include
alias exec siib show ip interface brief | exclude admin
alias exec sib show ip bgp
alias exec sir show ip route
alias exec sirp show ip route vrf PURPLE
alias exec sibp show ip bgp vpnv4 vrf PURPLE
alias exec pp ping vrf PURPLE
alias exec zp show policy-map type inspect zone-pair
alias exec sci show crypto ipsec
alias exec sck show crypto isakmp
alias exec cci clear crypto sa
alias exec cck clear crypto isakmp
alias exec sio show ip ospf
alias exec sie show ip eigrp
</code>

===== A basic script for handling ACLs of your Cisco Catalyst =====
A handy script //( [[http://tuttodebian.blogspot.com/|taken from this site]] )// to keep the ACLs of our Cisco Catalyst 3560 in separate files, so as be able to edit them without connecting to the device and finally update them on the switch by using a perl script like this:

<code perl|f cisco-acl.pl>
#! /usr/bin/perl -w
# Note: in Debian/Ubuntu you need libnet-telnet-perl package
# to be installed on your system.

use Net::Telnet;
use File::Basename;

my $host = '1.1.1.1';
my $hostname = 'Switch';
my $username = 'ciscouser';
my $passwd = 'ciscopasswd';
my $enable = 'enablesecret';
my $aclname = $ARGV[0];
my $filepath = dirname($0)."/".$aclname;
my $logfile = '/tmp/acl-update.log';

sub Usage {
        print "Usage:    " . basename($0) . " \n";
    exit 1;
}

if ( scalar @ARGV != 1)
{
    print "Wrong number of arguments!\n";
    &Usage();
}

if ( ! -e $filepath )
{
    print "File " . $filepath . " does not exist\n";
    &Usage();
}

open(ACL, $filepath) || die("Could not open file $aclname!");
@file = <ACL>;

$session = Net::Telnet->new(Timeout => 05,
                             Prompt => '/$hostname(\(config.*\))?[#>] *$/',
                             Dump_Log => '$logfile');
$session->open($host);
$session->login($username, $passwd);

$session->cmd("en\n$enable");
$session->cmd("conf t");
$session->cmd("no ip access-list extended $aclname");
$session->cmd("ip access-list extended $aclname");
foreach $line (@file)
{
   chomp($line);
   $session->cmd($line);
}
$session->cmd("exit");
$session->cmd("exit");
@output = $session->cmd("sh access-list $aclname");
print @output;
$session->cmd("exit");
</code>


===== Cisco IPIP Tunnels =====

**Linux (192.168.2.1):**

   /sbin/ip tunnel add tunl1 mode ipip remote 192.168.1.1
   /sbin/ifconfig tunl1 192.168.3.2 pointopoint 192.168.3.1 netmask 255.255.255.252 mtu 1500

**Cisco (192.168.1.1):**

   interface Tunnel0
   ip address 192.168.3.1 255.255.255.252
   ip mtu 1500
   tunnel source 192.168.1.1
   tunnel destination 192.168.2.1
   tunnel mode ipip

===== GRE tunel (Cisco & Juniper) =====

   Juniper(M20) ----------------GRE tunnel-----------------------Cisco(7206)

**Juniper Configuration**
<code>
> show configuration interfaces gr-0/1/0
unit 0 {
    tunnel {
        source 219.93.2.1;
        destination 219.93.2.2;
        key 123456; ## problem
    }
    family inet {
        mtu 1514;
        address 192.168.1.1/30;
    }
}
</code>

**Cisco Configuration**
<code>
interface
Tunnel0
 ip address 192.168.1.2 255.255.255.252
 no ip unreachables
 no ip proxy-arp
 ip mtu 1514
 tunnel source 219.93.2.2
 tunnel destination 219.93.2.1
 tunnel key 123456 # problem 
</code>

===== Is there a way  to block VTP from coming in a port =====

   * make the port an access port
   * block 01-00-0C-CC-CC-CC (used by CDP too)
   * use transparent vtp v1 & different domain
   * block vlan 1 (although actually that's not possible)

You can also use "switchport nonegotiate" to turn DTP off, if you're getting vtp mismatch messages
(different vtp domains on each side). 

===== DHCP Configuration for Cisco VOIP Phones =====
<code>
....
authoritative;
ddns-update-style none;
option voip-tftp-server code 150 = ip-address;
option voip-tftp-server 192.168.134.192;
</code>

This should likely work for you as well, just make sure you replace the IP for “voip-tftp-server” with the address to your core phone server.  Hopefully the next time someone hits google looking for “option code 150 cisco phone” the clear answer isn’t so hard to find.

===== Slow ADSL with 12.4 IOS version?! =====

<code>
Ciscozine(config-if)#clock rate aal5 ?
        1000000
        1300000
        1600000
        2000000
        2600000 (default)
        3200000
        4000000
        5300000
        7000000

  <1000000-7000000>  clock rates in bits per second,
                     choose one from above

Ciscozine(config-if)#Ciscozine(config-if)#clock rate aal5 ?
        1000000
        1300000
        1600000
        2000000
        2600000 (default)
        3200000
        4000000
        5300000
        7000000

  <1000000-7000000>  clock rates in bits per second,
                     choose one from above

Ciscozine(config-if)#
</code>

In fact, if you don’t define the clock rate command into the atm interface, the IOS set to 2600000 this parameter. To force it, use the command ‘clock rate aal5′; in my case I use the command ‘clock rate aal5 7000000′.

Below the download speed test guarantee the bandwith improvement. More info on http://www.ciscozine.com/2009/11/05/slow-adsl-with-12-4-ios-version/

===== 1:1 NAT (not Cisco NAT) example =====

<code>
! WAN interface
interface FastEthernet0/0.457
 encapsulation dot1Q 457
 ip address 10.66.175.21 255.255.240.0
 ip nat outside
 ! PPPoE ip tcp adjust-mss 1412
!
! LAN interface
interface FastEthernet0/1
 ip address 192.168.156.1 255.255.255.0
 ip nat inside
!
! Redirect 0.0.0.0 --> 10.66.175.21 --> 192.168.156.2
ip nat inside source static 192.168.156.2 10.66.175.21
</code>

<note tip>With this rule ''ip nat inside source static 192.168.156.2 10.66.175.21'' it's done DNAT/SNAT (portforwarding as well as source NAT). **If things are not working as they should you might have b0rken IOS firmware on Cisco router!**</note>


==== Cisco NAT ====

<code>
ip nat pool NAT 10.252.162.2 10.252.162.2 netmask 255.255.255.252
ip nat inside source list 10 pool NAT overload


access-list 10 permit 10.52.4.0 0.0.0.255
</code>
===== NAT Based Upon Source Address =====

{{http://evilrouters.net/wp-content/uploads/2010/04/source-address-based-nat.png}}

See original source: http://evilrouters.net/2010/04/21/nat-based-upon-source-address/




====== Foobar ======

<html><pre>
interface FastEthernet0/5
description IP PHONE x1014 & HOST 10.1.20.5
switchport access vlan 20
switchport trunk encapsulation dot1q
switchport trunk native vlan 20
switchport trunk allowed vlan none
switchport mode access
switchport nonegotiate
switchport block multicast
switchport block unicast
switchport voice vlan 101
switchport port-security
switchport port-security maximum 3
switchport port-security aging time 10
switchport port-security aging type inactivity
no ip address
ip access-group ip-device-list in
mls qos trust device cisco-phone
mls qos trust dscp
dot1x port-control auto
dot1x guest-vlan 999
dot1x reauthentication
mac access-group mac-device-list in
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
spanning-tree guard root
!
interface FastEthernet0/6
description *** UNUSED Port ***
switchport access vlan 999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan none
switchport mode access
switchport nonegotiate
switchport block multicast
switchport block unicast
switchport port-security
switchport port-security aging time 10
switchport port-security aging type inactivity
no ip address
ip access-group ip-device-list in
shutdown
mls qos cos override
storm-control broadcast level 0.00
storm-control multicast level 0.00
storm-control unicast level 0.00
dot1x port-control force-unauthorized
dot1x guest-vlan 999
dot1x host-mode multi-host
mac access-group mac-device-list in
no cdp enable
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
spanning-tree guard root 
</pre></html>

<html><pre>
bba-group pppoe vpn1 
 virtual-template 1 
 sessions per-vc limit 1 (1 max number of vpdn session per-vc)
 sessions per-mac limit 1 ( 1 max number of vpnd session per-mac)
 sessions per-mac throtlle ...
</pre></html>