Differences

This shows you the differences between two versions of the page.

--- cisco [2006/01/30 14:09]
212.18.42.187
+++ cisco [2013/09/07 09:45]
zagi
@@ Line 1: / Line 1: @@
+====== Cisco stuff on need to know bases ======
+see also: **[[cisco:bgp|Cisco BGP stuff]]**, **[[networking]]**, **[[http://www.cymru.com/Documents/secure-ios-template.html|Secure IOS Template]]**
+==== Related documents ====
+[[http://www.netconfigs.com/tools/bgp.htm]]\\
+[[http://www.cisco.com/warp/public/459/bgp-toc.html]]\\
+[[http://www.caida.org/tools/measurement/cflowd/]]\\
+[[http://www.nanog.org/mtg-0510/pdf/deleskie.pdf]]\\
+[[http://www.dslreports.com/faq/8979]]\\
+[[http://www.dslreports.com/faq/cisco]]\\
+Cisco pppoe [[http://www.dslreports.com/faq/8199]]\\
+Password recovery[[http://www.cisco.com/warp/public/474/]]\\
+[[http://phx-cisco-users.org/index.php|Phoenix Cisco User Group (PCUG)]] Cisco tips [[http://www.ciscoblog.com/docstore/PCUGTips.pdf|presentation]] (local mirror:{{pcugtips.pdf|Cisco tips}})
+==== Password reset and configuration reset ====
+  - Press Break on the terminal keyboard within 60 seconds of the power-up to put the router into ROMMON.
+  - If the break sequence does not work, see Standard Break Key Sequence Combinations During Password Recovery for other key combinations.
+  - Type confreg 0x2142 at the rommon 1> prompt to boot from Flash without loading the configuration.
+  - Type reset at the rommon 2> prompt.
+  - The router reboots but ignores its saved configuration.
+  - Type no after each setup question or press Ctrl-C to skip the initial setup procedure.
+  - Type enable at the Router> prompt.You are taken to the enable mode, and the Router# prompt appears.
+  - Important: Type configure memory or copy startup-config running-config to copy the nonvolatile RAM (NVRAM) into memory.\\
+    Do not type configure terminal .
+  - Type write terminal or show running-config .
+The show running-config and write terminal commands show the configuration of the router. In this configuration you see under all the interfaces the shutdown command, which means all interfaces are currently shutdown. Also, you can see the passwords (enable password, enable secret, vty, console passwords, and so on) either in encrypted or unencrypted format. The unencrypted passwords can be re-used, the encrypted ones will have to be changed with a new one.
+#
+  - Type configure terminal and make the changes.
+  - The prompt is now hostname(config)#.
+  - Type enable secret <password> to change the enable secret password, for example.
+  - Issue the no shutdown command on every interface that is used.
+  - If you issue a show ip interface brief command, every interface that you want to use should be "up up".
+  - Type config-register 0x2102, or the value you recorded in step 2.
+  - Press Ctrl-Z or end to leave the configuration mode.
+  - The prompt is now changed to hostname#.
+  - Type write memory or copy running-config startup-config to commit the changes.
   line console/vty x y
   exec timeout 0 0
   logging synchronous
@@ Line 9: / Line 55: @@
   login
   password xxx
+=== Corrupt/missing IOS image ===
-General security template:
+   * set BAUD 115200
+   * upload vix Xmodem
+==== Cisco security tips ====
+**Disable:**
+    * BOOTP server
+    * Cisco Discovery Protocol (CDP)
+    * HTTP Configuration and Monitoring
+    * Domain Name System (DNS)
+    * Packet Assembler / Disassembler (PAD)
+    * Internet Control Message Protocol (ICMP) Redirects
+    * IP Source Routing
+    * Finger Service
+    * Proxy ARP
+    * IP Directed Broadcast
+==== Cisco config tips ====
+** Cisco PIX ***
+  no fixup protocol smtp 25
+**General security template:**
   no service finger
@@ Line 16: / Line 87: @@
   no service udp-small-servers
   no service tcp-small-servers
+  no service config
+  no service dhcp
+  no service compress-config
+  no ip  http server
   no ip bootp server
+  no ip finger
+  no ip identd
+  no ip source-route
   service nagle
-  no service compress-config
-  no ip  http server
   service timestamps debug datetime localtime show-timezone msec
   service timestamps log datetime localtime show-timezone msec
-  no ip source-route
   ip spd enable
+  no cdp run
   logging buffered 16384
   logging trap debugging
   logging 169.223.10.20
+  logging console warnings
   ip subnet-zero
   ip classless
+  ! Deal with dead connections gracefully
+  service tcp-keepalives-in
+  service tcp-keepalives-out
+  ! Do not allow packet to specify their own route
+  no ip source-route
+  ! Enable Cisco Express Forwarding technology
+  ip cef
+**NTP** (see also: [[http://www.nil.com/ipcorner/SecTimeManagement/]])
+  clock timezone CET 1
+  clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
+  !ntp source Loopback0
+  !ntp master
+  ntp update-calendar
+  ntp server x.x.x.x
+  !ntp broadcast
+**SNMP**
+  snmp-server community NotTelling RO 1
+  snmp-server location Somewhere
+  snmp-server contact Network Operations Centre <noc@net.galaxy>
+  snmp-server enable traps snmp
+  snmp-server host 220.144.159.130 SecretToo
+**DNS**
+  no ip domain-lookup
+  ip domain-list domain.org
+  ip domain-list .
+  ip domain-name domain.org
+  ip name-server 10.0.0.1
+  ip name-server 10.1.0.1
+  line con 0
+   exec-timeout 5 0
+   password 7 <######>
+   login authentication no_tacacs
+   transport input none
+  line aux 0
+   exec-timeout 5 0
+   password 7 <#######>
+   login authentication test
+   modem InOut
+   transport input all
+   stopbits 1
+   speed 19200
+   flowcontrol hardware
+  line vty 0 4
+   exec-timeout 5 0
+   password 7 <########>
+   login authentication test
+   transport input telnet
-General Interface Template:
+**General Interface Template:**
-  no ip redirect
+  no ip redirects
   no ip direct broadcast
   no ip proxy-arp
+  no ip unreachables
+  no ip mask-reply
+  no ip mroute-cache
-General Security Template:
+**General Security Template:**
   service password-encryption
@@ Line 42: / Line 182: @@
   no enable password
+  ! Limit the amount of ICMP traffic (DDOS protection)
+  rate-limit input access-group 110 2048000 8000 8000 conform-action transmit exceed-action drop
+  access-list 103 deny tcp any host 10.0.0.1 established
+**HSRP**
+//Router 1://
+  interface ethernet 0/0
+  description Server LAN
+  ip address 169.223.10.1 255.255.255.0
+  standby 10 ip 169.223.10.254
+//Router 2://
+  interface ethernet 0/0
+  description Service LAN
+  ip address 169.223.10.2 255.255.255.0
+  standby 10 priority 150
+  standby 10 preempt
+  standby 10 ip 169.223.10.254
+The preempt directive tells router1 and router2 that router2 should be used as default gateway whenever possible.\\
+For example, if router2 were temporarily out of service, it would take over from router1 when it is returned to normal operation.
+**BGP**
+  router bgp 200
+  neighbor 215.17.3.1 remote-as 210
+  neighbor 215.17.3.1 soft-reconfiguration in
+  neighbor x.x.x.x ebgp-multihop 255
+  no bgp dampening
+  “clear ip bgp neighbor 215.17.3.1 soft”.
+  bgp dampening [[route-map map-name] | [half-life-time reuse-value suppress-value maximumsuppress-time]]
+  *  half-life-time – range is 1 – 45 minutes; current default is 15 minutes.
+  *  reuse-value – range is 1 – 20000; default is 750.
+  *  suppress-value – range is 1 – 20000; default is 2000.
+  *  max-suppress-time – maximum duration a route can be suppressed. Range is 1 – 255; default is four times half-life time (60 minutes).
+  *  show ip bgp dampened-routes – Display all the damped routes with the time remaining to unsuppress. Very useful for find out which sites are having instability problems.
+  clear ip bgp dampening [<address> <mask>]
+Clear the damping related information. This will also unsuppress the suppressed routes.\\
+Very useful when one of your customers call you about a “unreachable” network that has been suppressed.
+Some ISPs use private ASes within their network (typically but not exclusively for customers who multihome onto their
+backbone). There is a BGP option (CSCdi64489) which prevents any private ASes from being leaked to the Internet:
+  router bgp 109
+  neighbor 145.2.2.2 remove-private-AS
+==DHCP==
+ip dhcp excluded-address 192.168.10.1
+  ip dhcp pool my.lan
+     network 192.168.10.0 255.255.255.0
+     domain-name my.net
+     dns-server 212.18.X.X
+     default-router 192.168.10.1
+     lease 14 0
+**OSPF**
+  router ospf 100
+   network 219.50.10.0 0.0.0.3 area 0
+   network 219.10.1.0 0.0.0.3 area 0
+   network 220.144.159.64 0.0.0.7 area 0
+   network 220.144 159.192 0.0.0.0 area 0
+   passive-interface Serial1/0
+   passive-interface Serial1/1
+   passive-interface Loopback0
+   log-adjacency-changes
+== ACL renumbering ==
+Router(config)#ip access-list resequence MyACL 10 10\\
+== vlan up/interface down ==
+no autostate
+no keepalive
+== Wireless ==
+  dot11 ssid TEST1
+  mbssid guest-mode
+  dot11 ssid TEST2
+  mbssid guest-mode
+Then you have to enable mbssid globally on your radio-interface:
+  interface Dot11Radio0
+  mbssid
+  ssid TEST1
+  ssid TEST2
+  interface Dot11Radio1
+  mbssid
+  ssid TEST1
+  ssid TEST2