Differences
This shows you the differences between two versions of the page.
Next revision | Previous revision | ||
cisco [2005/06/20 15:46] 217.72.75.101 created |
cisco [2015/05/21 15:01] (current) zagi [Cisco config tips] |
||
---|---|---|---|
Line 1: | Line 1: | ||
- | Danes smo se naucili | + | ====== Cisco stuff on need to know bases ====== |
+ | |||
+ | see also: **[[cisco: | ||
+ | |||
+ | |||
+ | |||
+ | ==== Related documents ==== | ||
+ | [[http:// | ||
+ | [[http:// | ||
+ | [[http:// | ||
+ | [[http:// | ||
+ | [[http:// | ||
+ | [[http:// | ||
+ | Cisco pppoe [[http:// | ||
+ | Password recovery[[http:// | ||
+ | [[http:// | ||
+ | |||
+ | ==== Password reset and configuration reset ==== | ||
+ | |||
+ | - Press Break on the terminal keyboard within 60 seconds of the power-up to put the router into ROMMON. | ||
+ | - If the break sequence does not work, see Standard Break Key Sequence Combinations During Password Recovery for other key combinations. | ||
+ | - Type confreg 0x2142 at the rommon 1> prompt to boot from Flash without loading the configuration. | ||
+ | - Type reset at the rommon 2> prompt. | ||
+ | - The router reboots but ignores its saved configuration. | ||
+ | - Type no after each setup question or press Ctrl-C to skip the initial setup procedure. | ||
+ | - Type enable at the Router> prompt.You are taken to the enable mode, and the Router# prompt appears. | ||
+ | - Important: Type configure memory or copy startup-config running-config to copy the nonvolatile RAM (NVRAM) into memory.\\ | ||
+ | Do not type configure terminal . | ||
+ | - Type write terminal or show running-config . | ||
+ | |||
+ | The show running-config and write terminal commands show the configuration of the router. In this configuration you see under all the interfaces the shutdown command, which means all interfaces are currently shutdown. Also, you can see the passwords (enable password, enable secret, vty, console passwords, and so on) either in encrypted or unencrypted format. The unencrypted passwords can be re-used, the encrypted ones will have to be changed with a new one. | ||
+ | # | ||
+ | |||
+ | - Type configure terminal and make the changes. | ||
+ | - The prompt is now hostname(config)# | ||
+ | - Type enable secret < | ||
+ | - Issue the no shutdown command on every interface that is used. | ||
+ | - If you issue a show ip interface brief command, every interface that you want to use should be "up up". | ||
+ | - Type config-register 0x2102, or the value you recorded in step 2. | ||
+ | - Press Ctrl-Z or end to leave the configuration mode. | ||
+ | - The prompt is now changed to hostname# | ||
+ | - Type write memory or copy running-config startup-config to commit the changes. | ||
+ | |||
+ | |||
+ | line console/vty x y | ||
+ | exec timeout 0 0 | ||
+ | logging synchronous | ||
+ | |||
- | line console/vty x y | ||
- | exec timeout 0 0 | ||
- | logging synchronous | ||
kako postavis geslo za XY vmesnik: | kako postavis geslo za XY vmesnik: | ||
- | line console/ | + | |
- | login | + | login |
- | password xxx | + | password xxx |
+ | |||
+ | |||
+ | === Corrupt/ | ||
+ | |||
+ | * set BAUD 115200 | ||
+ | * upload vix Xmodem | ||
+ | |||
+ | ==== Cisco security tips ==== | ||
+ | **Disable: | ||
+ | |||
+ | * BOOTP server | ||
+ | * Cisco Discovery Protocol (CDP) | ||
+ | * HTTP Configuration and Monitoring | ||
+ | * Domain Name System (DNS) | ||
+ | * Packet Assembler / Disassembler (PAD) | ||
+ | * Internet Control Message Protocol (ICMP) Redirects | ||
+ | * IP Source Routing | ||
+ | * Finger Service | ||
+ | * Proxy ARP | ||
+ | * IP Directed Broadcast | ||
+ | |||
+ | ==== Cisco config tips ==== | ||
+ | |||
+ | ** Cisco PIX *** | ||
+ | no fixup protocol smtp 25 | ||
+ | |||
+ | **General security template: | ||
+ | |||
+ | no service finger | ||
+ | no service pad | ||
+ | no service udp-small-servers | ||
+ | no service tcp-small-servers | ||
+ | no service config | ||
+ | no service dhcp | ||
+ | no service compress-config | ||
+ | no ip http server | ||
+ | no ip bootp server | ||
+ | no ip finger | ||
+ | no ip identd | ||
+ | no ip source-route | ||
+ | service nagle | ||
+ | service timestamps debug datetime localtime show-timezone msec | ||
+ | service timestamps log datetime localtime show-timezone msec | ||
+ | |||
+ | ip spd enable | ||
+ | no cdp run | ||
+ | |||
+ | logging buffered 16384 | ||
+ | logging trap debugging | ||
+ | logging 169.223.10.20 | ||
+ | logging console warnings | ||
+ | |||
+ | ip subnet-zero | ||
+ | ip classless | ||
+ | ! Deal with dead connections gracefully | ||
+ | service tcp-keepalives-in | ||
+ | service tcp-keepalives-out | ||
+ | |||
+ | ! Do not allow packet to specify their own route | ||
+ | no ip source-route | ||
+ | |||
+ | ! Enable Cisco Express Forwarding technology | ||
+ | ip cef | ||
+ | |||
+ | **NTP** (see also: [[http:// | ||
+ | clock timezone CET 1 | ||
+ | clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00 | ||
+ | !ntp source Loopback0 | ||
+ | !ntp master | ||
+ | ntp update-calendar | ||
+ | ntp server x.x.x.x | ||
+ | !ntp broadcast | ||
+ | |||
+ | **SNMP** | ||
+ | snmp-server community NotTelling RO 1 | ||
+ | snmp-server location Somewhere | ||
+ | snmp-server contact Network Operations Centre < | ||
+ | snmp-server enable traps snmp | ||
+ | snmp-server host 220.144.159.130 SecretToo | ||
+ | |||
+ | **DNS** | ||
+ | no ip domain-lookup | ||
+ | ip domain-list domain.org | ||
+ | ip domain-list . | ||
+ | ip domain-name domain.org | ||
+ | |||
+ | ip name-server 10.0.0.1 | ||
+ | ip name-server 10.1.0.1 | ||
+ | |||
+ | |||
+ | line con 0 | ||
+ | | ||
+ | | ||
+ | login authentication no_tacacs | ||
+ | | ||
+ | line aux 0 | ||
+ | | ||
+ | | ||
+ | login authentication test | ||
+ | modem InOut | ||
+ | | ||
+ | | ||
+ | speed 19200 | ||
+ | | ||
+ | line vty 0 4 | ||
+ | | ||
+ | | ||
+ | login authentication test | ||
+ | | ||
+ | |||
+ | |||
+ | **General Interface Template: | ||
+ | no ip redirects | ||
+ | no ip direct broadcast | ||
+ | no ip proxy-arp | ||
+ | no ip unreachables | ||
+ | no ip mask-reply | ||
+ | no ip mroute-cache | ||
+ | |||
+ | |||
+ | |||
+ | **General Security Template: | ||
+ | |||
+ | service password-encryption | ||
+ | enable secret < | ||
+ | no enable password | ||
+ | |||
+ | ! Limit the amount of ICMP traffic (DDOS protection) | ||
+ | rate-limit input access-group 110 2048000 8000 8000 conform-action transmit exceed-action drop | ||
+ | |||
+ | |||
+ | access-list 103 deny tcp any host 10.0.0.1 established | ||
+ | |||
+ | |||
+ | **HSRP** | ||
+ | |||
+ | //Router 1:// | ||
+ | interface ethernet 0/0 | ||
+ | description Server LAN | ||
+ | ip address 169.223.10.1 255.255.255.0 | ||
+ | standby 10 ip 169.223.10.254 | ||
+ | |||
+ | //Router 2:// | ||
+ | interface ethernet 0/0 | ||
+ | description Service LAN | ||
+ | ip address 169.223.10.2 255.255.255.0 | ||
+ | standby 10 priority 150 | ||
+ | standby 10 preempt | ||
+ | standby 10 ip 169.223.10.254 | ||
+ | |||
+ | The preempt directive tells router1 and router2 that router2 should be used as default gateway whenever possible.\\ | ||
+ | For example, if router2 were temporarily out of service, it would take over from router1 when it is returned to normal operation. | ||
+ | |||
+ | |||
+ | **BGP** | ||
+ | |||
+ | router bgp 200 | ||
+ | neighbor 215.17.3.1 remote-as 210 | ||
+ | neighbor 215.17.3.1 soft-reconfiguration in | ||
+ | neighbor x.x.x.x ebgp-multihop 255 | ||
+ | no bgp dampening | ||
+ | |||
+ | |||
+ | “clear ip bgp neighbor 215.17.3.1 soft”. | ||
+ | |||
+ | bgp dampening [[route-map map-name] | [half-life-time reuse-value suppress-value maximumsuppress-time]] | ||
+ | |||
+ | * half-life-time – range is 1 – 45 minutes; current default is 15 minutes. | ||
+ | * reuse-value – range is 1 – 20000; default is 750. | ||
+ | * suppress-value – range is 1 – 20000; default is 2000. | ||
+ | * max-suppress-time – maximum duration a route can be suppressed. Range is 1 – 255; default is four times half-life time (60 minutes). | ||
+ | * show ip bgp dampened-routes – Display all the damped routes with the time remaining to unsuppress. Very useful for find out which sites are having instability problems. | ||
+ | |||
+ | |||
+ | clear ip bgp dampening [< | ||
+ | |||
+ | Clear the damping related information. This will also unsuppress the suppressed routes.\\ | ||
+ | Very useful when one of your customers call you about a “unreachable” network that has been suppressed. | ||
+ | |||
+ | Some ISPs use private ASes within their network (typically but not exclusively for customers who multihome onto their | ||
+ | backbone). There is a BGP option (CSCdi64489) which prevents any private ASes from being leaked to the Internet: | ||
+ | |||
+ | router bgp 109 | ||
+ | neighbor 145.2.2.2 remove-private-AS | ||
+ | |||
+ | ==DHCP== | ||
+ | ip dhcp excluded-address 192.168.10.1 | ||
+ | ip dhcp pool my.lan | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | lease 14 0 | ||
+ | |||
+ | **OSPF** | ||
+ | |||
+ | router ospf 100 | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | == ACL renumbering == | ||
+ | |||
+ | Router(config)# | ||
+ | |||
+ | == vlan up/ | ||
+ | |||
+ | no autostate | ||
+ | no keepalive | ||
+ | |||
+ | == Wireless == | ||
+ | dot11 ssid TEST1 | ||
+ | mbssid guest-mode | ||
+ | |||
+ | dot11 ssid TEST2 | ||
+ | mbssid guest-mode | ||
+ | |||
+ | Then you have to enable mbssid globally on your radio-interface: | ||
+ | |||
+ | interface Dot11Radio0 | ||
+ | mbssid | ||
+ | ssid TEST1 | ||
+ | ssid TEST2 | ||
+ | |||
+ | interface Dot11Radio1 | ||
+ | mbssid | ||
+ | ssid TEST1 | ||
+ | ssid TEST2 | ||
+ | |||
+ | ==== Cisco bash policer script ==== | ||
+ | |||
+ | <code bash> | ||
+ | # | ||
+ | # tnt.aufbix.org | ||
+ | # | ||
+ | cir=$(($1*1024*1000)) | ||
+ | nburst=$(($cir*3/ | ||
+ | eburst=$(($nburst*2)) | ||
+ | echo " | ||
+ | echo "class class-default" | ||
+ | echo " | ||
+ | |||
+ | </ | ||