Hardware

• router = Cisco 1941
• switch = Cisco 2960

Configuring a PC

1. Click on the PC, then click the Desktop tab at the top of the window.
2. Click IP Configuration, the first option at the top left.

Disabling a PC's firewall

1. Click on the PC, then click the Desktop tab at the top of the window.
2. Click Firewall at the bottom right.
3. Click Off at the top right to disable it.

Adding a network card to the router for serial connections

For routers to be able to communicate with each other, network cards used for serial connections must be added:

Adding a network card to a server

Before adding the new FastEthernet interface, you must press the red button to cut the power.

PC ports to use

• To configure Cisco devices, use the console cable (cyan) and connect it to the RS232 port.
• To connect to the switch, use the FastEthernet0 port and the Copper Straight-Through cable (black).

Initialization (do this for every configuration)

• enable
• configure terminal
• no ip domain-lookup
• hostname <name>
• banner motd %<message>%

Configuring the console in synchronous mode

• line console 0
• logging synchronous
• exit

Saving the configuration

2 options:

• copy running-config startup-config
• write

Steps to configure a VLAN on a switch

1. Disable DTP (Dynamic Trunking Protocol) and set the interfaces to access mode:
   • interface range f0/1-24
   • switchport mode access
   • switchport nonegotiate
2. Create the VLANs:
   • vlan <num>
   • name <name>
3. Configure the interfaces according to the VLANs:
   • interface <interface>
   • switchport access vlan <num>
4. Configure interfaces in trunk mode:
   • interface <interface>
   • switchport mode trunk

Steps to configure a VLAN on a router

1. Enable the interface:
   • interface <interface>
   • no shutdown
2. Configure the sub-interfaces:
   • interface <interface>.<vlan_num>
   • encapsulation dot1q <vlan_num>
   • ip address <network> <mask>

Changing the native VLAN

• switchport trunk native vlan <vlan_id>

Explanation: community.cisco.com

Removing a VLAN

• no vlan <vlan_num> (in VLAN creation mode)
• no interface vlan <vlan_num> (in configuration mode)

Note: both must be done.

Removing a VLAN sub-interface

• no interface <interface>.<vlan_num>

Verifying the VLAN configuration

• show vlan
• show vlan brief
• show interface trunk
• show interface switchport

Disabling unused ports

• interface range f0/<start>-<end>
• shutdown

Port-security configuration

To enable port-security on a port, use the 1st command; it only works if the port is in access mode (not trunk).

• switchport port-security
• switchport port-security maximum <num>
• switchport port-security mac-address [sticky]

Violation mode configuration

• switchport port-security violation {protect | restrict | shutdown}

Verifying switch port security configuration

• show interfaces switchport
• show port-security
• show port-security address
• show port-security interface <interface>

Configuring a network interface

For a switch, use the vlan1 interface (or the management VLAN).

• interface <interface>
• ip address <ip> <netmask>
• ipv6 address <ip>/<netmask> [eui-64]
• clock rate <clock_rate>
• no shutdown
• description <interface_description>
• exit

Reset an interface:

• default interface <interface>

Adding a default gateway

• ip default-gateway <gateway>

IPv6 addresses

• ipv6 address <ip> link-local
• ipv6 address <ip>/<netmask>
• ipv6 address <network>/<netmask> eui-64

Testing the network connection

These commands can be used with both IPv4 and IPv6.

• Common to all devices: ping <ip>
• Cisco devices only: traceroute <ip>
• PCs only: tracert <ip>

Configuring a static route

• Recursive route:
  • ip route <target_network_ip> <netmask> <router_ip>
  • ipv6 route <network>/<netmask> <router_ip>
• Recursive default route:
  • ip route 0.0.0.0 0.0.0.0 <router_ip>
  • ipv6 route ::/0 <router_ip>
• Directly connected route:
  • ip route <target_network_ip> <netmask> <router_interface>
  • ipv6 route <network>/<netmask> <router_interface>
• Directly connected default route:
  • ip route 0.0.0.0 0.0.0.0 <router_interface>
  • ipv6 route ::/0 <router_interface>

Adding a backup route

• ip route <network> <netmask> <interface/router_ip> <admin_distance>

The lower the administrative distance, the more the route is preferred.

Testing routing (examining network state)

On routers:

• show ip interface brief
• show ip protocols
• show ip route [summary]
• debug ip protocol (cancel with no debug ip protocol)

IPv6:

• show ipv6 rip
• show ipv6 route [summary]
• show ipv6 protocols
• show ipv6 interface brief

RIP configuration steps

1. Initialization:
   • router rip
   • version 2
   • no auto-summary
2. Add connected routes, and prevent sending routing information on certain interfaces:
   • network <connected_network_ip>
   • passive-interface <interface>
3. Propagate routes:
   • redistribute connected
   • redistribute static
   • default information-originate

Verifying that RIP is working properly

• debug ip rip
• show ip rip neighbors
• show ip rip database

RIPng configuration steps

1. Initialization: ipv6 unicast-routing
2. Enable on certain interfaces:
   • interface <interface>
   • ipv6 rip <name> enable
3. Route propagation:
   • ipv6 router rip <name>
   • redistribute static
   • redistribute connected
   • ipv6 rip <name> default-information originate

Note: the <name> parameter that appears in every command is the process name and must be the same on all routers/interfaces.

Verifying that RIPng is working properly

• debug ipv6 rip
• show ip protocols
• show ipv6 rip
• show ipv6 route
• show ipv6 route rip
• show ipv6 rip [name][database]

OSPF configuration steps

1. Initialization:
   • router ospf <process-id>
   • router-id <router-id>
   • auto-cost reference-bandwidth <bandwidth>
2. Add connected routes, and prevent sending routing information on certain interfaces:
   • network <network> <wildcard> area <area-id>
   • passive-interface <interface>
3. Route propagation:
   • redistribute connected
   • redistribute static
   • default-information originate

Choosing the bandwidth:

• gigabit ethernet: auto-cost reference-bandwidth 1000
• 10 gigabit ethernet: auto-cost reference-bandwidth 10000
• back to default: auto-cost reference-bandwidth 100

Changing OSPF priority

• ip ospf priority <priority>

Notes:

• DR = designated router
• BDR = backup designated router
• Default priority = 1
• Max priority = 255, automatically elected DR
• Min priority = 0, cannot be elected DR
• At equal priority, the router with the highest <router-id> is elected.

Verifying that OSPF is working properly

• show ip protocols
• show ip ospf neighbor
• show ip ospf
• show ip ospf interface

Adding ACLs to restrict routing

Command to create an ACL:

• access-list <list_num> {deny | permit} <ip> <wildcard>
• access-list <list_num> {deny | permit} any
• access-list <list_num> {deny | permit} host <ip>

• list_num ∈ [1,99] ⟹ standard ACL, controls the source IP
• list_num ∈ [100,199] ⟹ extended ACL, controls the source/destination IP, or the port, or the service

On a VLAN or ethernet interface (or directly on a physical interface for a router):

• ip access-group <access_list_num> {in | out}

• in = inbound packets
• out = outbound packets

Note: for a switch, the ACL must be added on a VLAN and then the FastEthernet interface added to the VLAN.

Configuring a named ACL

Configure the ACL and its rules:

• ip access-list {standard | extended} {<list_num> | <list_name>}
• [<rule_num>] {deny | permit} <ip> <wildcard>
• [<rule_num>] {deny | permit} any
• [<rule_num>] {deny | permit} host <ip>

Remove the ACL or rules:

• no <rule_num>
• no {deny | permit} ...
• no ip access-list {standard | extended} {<list_num> | <list_name>}

To add the ACL to the interface:

• ip access-group {<list_num> | <list_name>} {in | out}

Steps to configure an IPv6 ACL

1. Create the named ACL: ipv6 access-list <acl_name>
2. Create rules:
   • {permit | deny} ipv6 <source> <destination>
   • with source/destination = {any | host <ip> | <ip>/<netmask>}
3. Add the ACL to the interfaces: ipv6 traffic-list <acl_name> {in | out}

IPv6 ACL rules to block HTTP/HTTPS requests

• deny tcp <source> <destination> eq <port>
• deny tcp <source> <destination> eq www
• deny tcp <source> <destination> eq 443

Removing/modifying an ACL

Remove an ACL:

• no access-list <acl_num>

Remove part of an ACL:

• ip access-list {standard | extended} <acl_num>
• no <rule_num>

Verifying the ACL list

• show access-list

Passwords

• Encrypt passwords: service password-encryption
• Require a minimum password length: security passwords min-length 10
• Assign an encrypted privileged EXEC password: enable secret <pwd>
• Assign a console password and enable login:
  • line console 0
  • password <pwd>
  • login
• Assign a VTY password and enable login (router):
  • line vty 0 4
  • password <pwd>
  • login local
• Assign a VTY password and enable login (switch):
  • line vty 0 15
  • password <pwd>
  • login local

Disconnect after 5 min of inactivity

• line console 0
• exec-timeout 5 0
• line vty 0 4
• exec-timeout 5 0
• exit

Block login for 30 s after 2 failures within 2 min

• login block-for 30 attempts 2 within 120

Enabling Telnet login

• line vty 0 15
• transport input telnet
• password <password>
• login

Enabling SSH login

1. Add a domain name, and create a user for SSH login:
   • ip domain-name <greg.com>
   • username <username> privilege 1 secret <pwd>
2. Configure the VTY lines to allow SSH connections: line vty 0 4
3. Allow SSH only (reject Telnet): transport input ssh
4. The login must be done against a local account:
   • login local
   • exit
5. Generate an RSA key: crypto key generate rsa [general-keys modulus <num_bits>]

Copying the configuration to an FTP server

• ip ftp username <username>
• ip ftp password <password>
• copy running-config ftp: (or startup-config)

Retrieving the configuration from an FTP server

• ip ftp username <username>
• ip ftp password <password>
• copy ftp: running-config

Copying/retrieving the configuration to/from a TFTP server

• copy running-config tftp:
• copy tftp: running-config

Checking the configuration

• show running-config

Configuring a DHCP relay

• service dhcp
• ip helper-address <dhcp_server_ip> (on an interface, not mandatory)

Notes:

• it can take a while for a machine's configuration to complete (alt+d advances 30 sec)
• the client machine absolutely must be in the correct VLAN
• the DHCP relay is needed when the DHCP server is not in the same VLAN as the machines

Configuring a DHCP service

• service dhcp
• ip dhcp pool <pool_name>
• network <network> <mask>
• dns-server <address>
• default-router <address>
• ip dhcp excluded-address <first_ip> [<end_of_ip_range>]

Notes:

• you can create one pool per VLAN by giving the pool the VLAN's name (e.g.: VLAN name = pool name = vlan10)
• to create a global pool, simply don't give it a VLAN name (e.g.: pool name = globalpool)
• an IP address must absolutely be configured on the router's interfaces (+ the VLANs) before DHCP will work
• no need to exclude the DHCP server's own IP address, the DHCP service does this automatically

Verifying the DHCP configuration

• show ip dhcp pool
• show ip dhcp pool <pool_name>
• show ip dhcp binding
• show ip dhcp conflict
• show ip dhcp relay information trusted-sources

On a router (with rommon)

1. Power the machine back on or use reload.
2. While the IOS image is decompressing (lots of ###):
   • In the lab: ctrl+break
   • In Packet Tracer: ctrl+c (otherwise, try ctrl+shift+f6+c)
3. confreg 0x2142
4. reset
5. enable
6. copy startup-config running-config
7. Reset the passwords.
8. write memory, or copy running-config startup-config

Notes:

• register = 2142 ⟹ boot without the startup-config
• register = 2102 ⟹ boot with the startup-config
• register = 2100 ⟹ boot into rommon mode

On a router (NOT rommon)

Only if already connected:

• enable
• configure terminal
• config-register 2142
• do reload
• enable
• copy startup-config running-config
• Reset the passwords.
• write memory, or copy running-config startup-config

On a switch (recovery mode)

1. Connect to the console port at 9600 baud.
2. Power the machine back on or use reload.
3. Hold the mode button for 3 seconds.

   

4. flash_init
5. load_helper (not in Packet Tracer)
6. dir flash:
7. rename flash:config.text flash:<name>
8. reset
9. enable
10. copy flash running-config (you'll be asked for the file name afterward)
11. Change the passwords, then save the new configuration.