cisco router configuration AFNOG 2002 / track 2 # 1 Cisco Router Configuration Basics

cisco router configuration AFNOG 2002 / track 2 # 2 router components äLike a computer they are composed of –Operating System - IOS –Micro Processor to run the IOS –RAM main storage, dynamic configuration –NVRAM to store instruction for performing the self test of the device, backup of config –Flash memory: erasable ROM, contain copy of IOS

cisco router configuration AFNOG 2002 / track 2 # 3 system startup äPOST -> diagnostic on all ROM on all modules äconfiguration -> check and load IOS äload configuration files stored in NVRAM

cisco router configuration AFNOG 2002 / track 2 # 4 overview ärouter configuration controls the operation of the router: äinterface address and netmask ärouting information (static or dynamic) äbooting and startup information äsecurity (passwords)

cisco router configuration AFNOG 2002 / track 2 # 5 where is the configuration? ärouter always has two configurations: ärunning configuration äin RAM, determines how the router is currently operating  is changed by using the configuration command  to see it: show running ästartup confguration äin NVRAM, determines how the router will operate after next reload  is changed using the copy command  to see it: show startup

cisco router configuration AFNOG 2002 / track 2 # 6 where is the configuration? äcan also be stored in more permanent places: äexternal hosts, using TFTP to move it around äin flash memory in the router äcopy command is used to move it around copy run start copy run tftp copy start tftp copy tftp start copy flash start copy start flash

cisco router configuration AFNOG 2002 / track 2 # 7 external Configuration Sources äConsole/auxillary port ävirtual terminals - telnets äTFTP Server äNetwork Management Software

cisco router configuration AFNOG 2002 / track 2 # 8 changing the configuration äconfiguration statements can be entered interactively - changes are made (almost) immediately, to the running configuration äcan use direct serial connection to console port, or ätelnet to vty’s (“virtual terminals”), or ämodem connection to aux port

cisco router configuration AFNOG 2002 / track 2 # 9 changing configuration äor, edited in a text file and uploaded to the router at a later time via tftp; äsome configuration statements, especially access lists, are very difficult to work with interactively, so editing and uploading the file is the only practical way to work; äalso allows version control and auditing changes

cisco router configuration AFNOG 2002 / track 2 # 10 new router configuration process äload configuration parameters into RAM äpersonalize router identification äassign access passwords äconfigure interfaces äconfigure routing protocols äsave configuration parameters to NVRAM

cisco router configuration AFNOG 2002 / track 2 # 11 router modes äUser EXEC mode - limited examination of router –Router> äPrivileged EXEC mode - detailed examination of router, debugging, testing, file manipulation –Router# äROM Monitor - useful for password recovery äSetup Mode

cisco router configuration AFNOG 2002 / track 2 # 12 logging into the router äConnect router to console port or telnet to router –router> –router>enable –password –router# –router#? äConfiguring the router –Terminal (entering the commands directly) –router# configure terminal –router(config)# USER MODE PROMPT PRIVILEDGED MODE PROMPT

cisco router configuration AFNOG 2002 / track 2 # 13 configuring your router äSet the enable password: router(config)# enable password äIf you see in your config file, you will see that the enable password is displayed in clear text -- that is not safe, you have to encrypt it. router(config)# service password-encryption router(config)# enable secret "your pswd"(MD5 encryption) äTo configure interface you should go to interface config menu router(config) interface ethernet0 (or 0/x) router (config-if)# äSave your config uration router #copy running-config startup-config

cisco router configuration AFNOG 2002 / track 2 # 14 configuring your router äconfiguration statements have different contexts: äglobal: enable-password mysecret äinterface: interface ethernet0 ip address ärouter: router ospf 1 network area 0 äline: line vty 04

cisco router configuration AFNOG 2002 / track 2 # 15 global configuration äglobal configuration statements are independent of any particular interface or routing protocol, e.g.: hostname myrouter enable-password mysecret service password-encryption logging facility local0 logging

cisco router configuration AFNOG 2002 / track 2 # 16 global configuration äip-specific global configuration statements: ip classless ip name-server ästatic route creation: ip route

cisco router configuration AFNOG 2002 / track 2 # 17 interface configuration äinterfaces are named by type and position; e.g.: ethernet0, ethernet1,... ethernet5 serial0, serial1... serial3 äand can be abbreviated: ethernet0 or eth0 or e0 serial0 or ser0 or s0

cisco router configuration AFNOG 2002 / track 2 # 18 interface configuration äip address and netmask configuration, using interface commands (interactive configuration example, showing prompts): router#configure terminal router(config)#interface e0 router(config-if)#ip address router(config-if)#no shutdown router(config-if)#^Z router#

cisco router configuration AFNOG 2002 / track 2 # 19 interface configuration äadministratively enable/disable the interface router(config-if)#no shutdown router(config-if)#shutdown ädescription router(config-if)#description ethernet link to admin building router

cisco router configuration AFNOG 2002 / track 2 # 20 äCisco global config should always include: ip classless ip subnet-zero no ip domain-lookup äCisco interface config should usually include: no shutdown no ip proxy-arp no ip redirects

cisco router configuration AFNOG 2002 / track 2 # 21 looking at the configuration  use “show running-configuration” to see the current configuration  use “show startup-configuration” to see the configuration in NVRAM, that will be loaded the next time the router is rebooted or reloaded

cisco router configuration AFNOG 2002 / track 2 # 22 interactive configuration äenter configuration mode, using “configure term” äprompt gives a hint about where you are: router#configure term router(config)#ip classless router(config)#ip subnet-zero router(config)#int e3 router(config-if)#ip addr router(config-if)#no shut router(config-if)#^Z

cisco router configuration AFNOG 2002 / track 2 # 23 storing the configuration on a host  requires: `tftpd’ on a unix host; destination file must exist before the file is written and must be world writable... copy run tftp router#copy run tftp Remote host []? Name of configuration file to write [hostel-rtr-confg]? /usr/local/tftpd/hostel-rtr-confg Write file /usr/local/tftpd/hostel-rtr-confg on... host ? [confirm] Building configuration... Writing /usr/local/tftpd/hostel-rtr-confg !![OK]

cisco router configuration AFNOG 2002 / track 2 # 24 restoring the configuration from a host äuse ‘tftp’ to pull file from unix host, copying to running config or startup router#copy tftp start Address of remote host [ ]? Name of configuration file [hostel-rtr-confg]? Configure using hostel-rtr-confg from ? [confirm] Loading hostel-rtr-confg from (via Ethernet0): ! [OK / bytes] [OK] hostel-rtr# reload

cisco router configuration AFNOG 2002 / track 2 # 25 getting help äIOS has a built-in help facility; use “?” to get a list of possible configuration statements ä“?” after the prompt lists all possible commands: router#?  “ ?” lists all possible subcommands, e.g.: router#show ? router#show ip ?

cisco router configuration AFNOG 2002 / track 2 # 26 getting help ä“ ?” shows all possible command completions router#con? configure connect äthis is different: hostel-rtr#conf ? memory Configure from NV memory network Configure from a TFTP network host overwrite-network Overwrite NV memory from TFTP... network host terminal Configure from the terminal

cisco router configuration AFNOG 2002 / track 2 # 27 getting help äthis also works in configuration mode: router(config)#ip a? accounting-list accounting-threshold accounting-transits address-pool alias as-path router(config)#int e0 router(config-if)#ip a? access-group accounting address

cisco router configuration AFNOG 2002 / track 2 # 28 getting help äcan “explore” a command to figure out the syntax: router(config-if)#ip addr ? A.B.C.D IP address router(config-if)#ip addr ? A.B.C.D IP subnet mask router(config-if)#ip addr ? secondary Make this IP address a secondary address router(config-if)#ip addr router(config-if)#

cisco router configuration AFNOG 2002 / track 2 # 29 getting lazy help äTAB character will complete a partial word hostel-rtr(config)#int hostel-rtr(config)#interface et hostel-rtr(config)#interface ethernet 0 hostel-rtr(config-if)#ip add hostel-rtr(config-if)#ip address änot really necessary; partial commands can be used: router#conf t router(config)#int e0 router(config-if)#ip addr

cisco router configuration AFNOG 2002 / track 2 # 30 getting lazy äcommand history äIOS maintains short list of previously typed commands  up-arrow or ‘ ^p ’ recalls previous command  down-arrow or ‘^n’ recalls next command äline editing äleft-arrow, right-arrow moves cursor inside command  ‘^d’ or backspace will delete character in front of cursor

cisco router configuration AFNOG 2002 / track 2 # 31 Connecting your Freebsd machine to console äConnect your machine to the console port using the serial cable provide ägo to /etc/remote to see the device configured to be used with "tip”.you will see at the end, a line begin with cuaa0c… (you can change it to cisco) bash$ tip cuaa0c (or cisco) router> router>enable router#

cisco router configuration AFNOG 2002 / track 2 # 32 Exercise contd älook at your running configuration äConfigure an IP address for e0/0 depending on your table - use for table A etc älook at your running configuration and your startup configuration äwhat difference is there if any

cisco router configuration AFNOG 2002 / track 2 # 33 using access lists äAccess Control Lists used to implement security in routers –powerful tool for network control –filter packets flow in or out of router interfaces –restrict network use by certain users or devices –deny or permit traffic –operate in sequential, logical order - top down –goes down access list until match is found –inherent deny at the bottom of every list

cisco router configuration AFNOG 2002 / track 2 # 34 using access lists äStandard Access Lists (1 - 99) –simpler address specifications –generally permits or denies entire protocol suite äExtended Access Lists ( ) –more complex address specification –generally permits or denies specific protocols

cisco router configuration AFNOG 2002 / track 2 # 35 ACL format äStandard Access List Configuration format –access-list access-list-number {permit | deny} source {source-mask} –ip access-group access-list-number {in | out} äExtended Access List Configuration format –access-list access-list-number {permit | deny} protocol source {source-mask} destination {destination-mask} –ip access-group access-list-number {in | out}

cisco router configuration AFNOG 2002 / track 2 # 36 where to place IP access list äplace standard access list close to destination äplace extended access lists close to the source of the traffic you want to deny

cisco router configuration AFNOG 2002 / track 2 # 37 using access lists äRouter(config)#Access-list access-list-number {permit|deny}{test conditions} äRouter(config)#{protocol access-group access-list-number äe.g check for IP subnets to check 1111 ignore Address and Wilcard Mask:

cisco router configuration AFNOG 2002 / track 2 # 38 äwildcard bits indicate how to check corresponding address bit –0=check –1=ignore äMatching Any IP Address or abbreviate the expression using the keyword any äMatching a specific host or abbreviate the wildcard using the IP address preceded by the keyword host

cisco router configuration AFNOG 2002 / track 2 # 39 Permit telnet from my network only access-list 1 permit access-list 1 deny any line vty 0 4 access-class 1 in

cisco router configuration AFNOG 2002 / track 2 # 40 Standard Access Lists Example Permit my network only Non E0E1 S0 Access-list 1 permit Interface ethernet 0 ip access-group 1 out interface ethernet 1 ip access-group 1 out

cisco router configuration AFNOG 2002 / track 2 # 41 extended access lists example Deny FTP for E0 Non E0E1 S0 access-list 101 deny tcp eq 21 access-list 101 deny tcp eq 20 access-list 101 permit ip interface ethernet 0 ip access-group 101 out