Cisco Router Configuration Basics cisco router configuration AFNOG

Cisco Router Configuration Basics cisco router configuration AFNOG 2002 / track 2 # 1

router components äLike a computer they are composed of – Operating System - IOS – Micro Processor to run the IOS – RAM main storage, dynamic configuration – NVRAM to store instruction for performing the self test of the device, backup of config – Flash memory: erasable ROM, contain copy of IOS cisco router configuration AFNOG 2002 / track 2 # 2

system startup äPOST -> diagnostic on all ROM on all modules äconfiguration -> check and load IOS äload configuration files stored in NVRAM cisco router configuration AFNOG 2002 / track 2 # 3

overview ärouter configuration controls the operation of the router: äinterface address and netmask ärouting information (static or dynamic) äbooting and startup information äsecurity (passwords) cisco router configuration AFNOG 2002 / track 2 # 4

where is the configuration? ärouter always has two configurations: ärunning configuration äin RAM, determines how the router is currently operating äis changed by using the configuration command äto see it: show running ästartup confguration äin NVRAM, determines how the router will operate after next reload äis changed using the copy command äto see it: show startup cisco router configuration AFNOG 2002 / track 2 # 5

where is the configuration? äcan also be stored in more permanent places: äexternal hosts, using TFTP to move it around äin flash memory in the router äcopy command is used to move it around copy copy cisco router configuration run start run tftp start flash start flash AFNOG 2002 / track 2 # 6

external Configuration Sources äConsole/auxillary port ävirtual terminals - telnets äTFTP Server äNetwork Management Software cisco router configuration AFNOG 2002 / track 2 # 7

changing the configuration äconfiguration statements can be entered interactively changes are made (almost) immediately, to the running configuration äcan use direct serial connection to console port, or ätelnet to vty’s (“virtual terminals”), or ämodem connection to aux port cisco router configuration AFNOG 2002 / track 2 # 8

changing configuration äor, edited in a text file and uploaded to the router at a later time via tftp; äsome configuration statements, especially access lists, are very difficult to work with interactively, so editing and uploading the file is the only practical way to work; äalso allows version control and auditing changes cisco router configuration AFNOG 2002 / track 2 # 9

new router configuration process äload configuration parameters into RAM äpersonalize router identification äassign access passwords äconfigure interfaces äconfigure routing protocols äsave configuration parameters to NVRAM cisco router configuration AFNOG 2002 / track 2 # 10

router modes äUser EXEC mode - limited examination of router – Router> äPrivileged EXEC mode - detailed examination of router, debugging, testing, file manipulation – Router# äROM Monitor - useful for password recovery äSetup Mode cisco router configuration AFNOG 2002 / track 2 # 11

logging into the router äConnect router to console port or telnet to router – router>enable – password – router#? äConfiguring the router USER MODE PROMPT PRIVILEDGED MODE PROMPT – Terminal (entering the commands directly) – router# configure terminal – router(config)# cisco router configuration AFNOG 2002 / track 2 # 12

configuring your router äSet the enable password: router(config)# enable password t 2@afnog ä If you see in your config file, you will see that the enable password is displayed in clear text -- that is not safe, you have to encrypt it. router(config)# service password-encryption router(config)# enable secret "your pswd"(MD 5 encryption) äTo configure interface you should go to interface config menu router(config) interface ethernet 0 (or 0/x) router(config-if)# äSave your configuration router#copy running-config startup-config cisco router configuration AFNOG 2002 / track 2 # 13

configuring your router äconfiguration statements have different contexts: äglobal: enable-password mysecret äinterface: interface ethernet 0 ip address 169. 222. 1. 45 255. 0 ärouter: router ospf 1 network 169. 222. 31. 0 0. 0. 0. 255 area 0 äline: line vty 04 cisco router configuration AFNOG 2002 / track 2 # 14

global configuration äglobal configuration statements are independent of any particular interface or routing protocol, e. g. : hostname myrouter enable-password mysecret service password-encryption logging facility local 0 logging 169. 222. 31. 42 cisco router configuration AFNOG 2002 / track 2 # 15

global configuration äip-specific global configuration statements: ip classless ip name-server 169. 222. 31. 42 ästatic route creation: ip route 169. 222. 16. 0 255. 248. 0 169. 229. 31. 1 cisco router configuration AFNOG 2002 / track 2 # 16

interface configuration äinterfaces are named by type and position; e. g. : ethernet 0, ethernet 1, . . . ethernet 5 serial 0, serial 1. . . serial 3 äand can be abbreviated: ethernet 0 or eth 0 or e 0 serial 0 or ser 0 or s 0 cisco router configuration AFNOG 2002 / track 2 # 17

interface configuration äip address and netmask configuration, using interface commands (interactive configuration example, showing prompts): router#configure terminal router(config)#interface e 0 router(config-if)#ip address 169. 222. 30. 4 255. 0 router(config-if)#no shutdown router(config-if)#^Z router# cisco router configuration AFNOG 2002 / track 2 # 18

interface configuration äadministratively enable/disable the interface router(config-if)#no shutdown router(config-if)#shutdown ädescription router(config-if)#description ethernet link to admin building router cisco router configuration AFNOG 2002 / track 2 # 19

äCisco global config should always include: ip classless ip subnet-zero no ip domain-lookup äCisco interface config should usually include: no shutdown no ip proxy-arp no ip redirects cisco router configuration AFNOG 2002 / track 2 # 20

looking at the configuration äuse “show running-configuration” to see the current configuration äuse “show startup-configuration” to see the configuration in NVRAM, that will be loaded the next time the router is rebooted or reloaded cisco router configuration AFNOG 2002 / track 2 # 21

interactive configuration äenter configuration mode, using “configure term” äprompt gives a hint about where you are: router#configure term router(config)#ip classless router(config)#ip subnet-zero router(config)#int e 3 router(config-if)#ip addr 169. 222. 31. 33 255. 224 router(config-if)#no shut router(config-if)#^Z cisco router configuration AFNOG 2002 / track 2 # 22

storing the configuration on a host ä requires: `tftpd’on a unix host; destination file must exist before the file is written and must be world writable. . . copy run tftp router#copy run tftp Remote host []? 169. 222. 31. 42 Name of configuration file to write [hostel-rtr-confg]? /usr/local/tftpd/hostel-rtr-confg Write file /usr/local/tftpd/hostel-rtr-confg on. . . host 169. 222. 31. 42? [confirm] Building configuration. . . Writing /usr/local/tftpd/hostel-rtr-confg !![OK] cisco router configuration AFNOG 2002 / track 2 # 23

restoring the configuration from a host äuse ‘tftp’ to pull file from unix host, copying to running config or startup router#copy tftp start Address of remote host [255. 255]? 169. 222. 31. 42 Name of configuration file [hostel-rtr-confg]? Configure using hostel-rtr-confg from 169. 222. 31. 42? [confirm] Loading hostel-rtr-confg from 169. 222. 31. 42 (via Ethernet 0): ! [OK - 1005/128975 bytes] [OK] hostel-rtr# reload cisco router configuration AFNOG 2002 / track 2 # 24

getting help äIOS has a built-in help facility; use “? ” to get a list of possible configuration statements ä“? ” after the prompt lists all possible commands: router#? ä “<partial command> ? ” lists all possible subcommands, e. g. : router#show ? router#show ip ? cisco router configuration AFNOG 2002 / track 2 # 25

getting help ä“<partial command>? ” shows all possible command completions router#con? configure connect äthis is different: hostel-rtr#conf ? memory network overwrite-network terminal <cr> cisco router configuration Configure from NV memory Configure from a TFTP network host Overwrite NV memory from TFTP. . . network host Configure from the terminal AFNOG 2002 / track 2 # 26

getting help äthis also works in configuration mode: router(config)#ip a? accounting-list accounting-threshold accounting-transits address-pool alias as-path router(config)#int e 0 router(config-if)#ip a? access-group accounting cisco router configuration address AFNOG 2002 / track 2 # 27

getting help äcan “explore” a command to figure out the syntax: router(config-if)#ip addr ? A. B. C. D IP address router(config-if)#ip addr 169. 222. 64. 1 ? A. B. C. D IP subnet mask router(config-if)#ip addr 169. 222. 64. 1 255. 0 ? secondary Make this IP address a secondary address <cr> router(config-if)#ip addr 169. 222. 64. 1 255. 0 router(config-if)# cisco router configuration AFNOG 2002 / track 2 # 28

getting lazy help äTAB character will complete a partial word hostel-rtr(config)#int<TAB> hostel-rtr(config)#interface ethernet 0 hostel-rtr(config-if)#ip add<TAB> hostel-rtr(config-if)#ip address. . . 169. 222. 64. 1 255. 0 änot really necessary; partial commands can be used: router#conf t router(config)#int e 0 router(config-if)#ip addr 169. 222. . . cisco router configuration AFNOG 2002 / track 2 # 29

getting lazy äcommand history äIOS maintains short list of previously typed commands äup-arrow or ‘^p’ recalls previous command ädown-arrow or ‘^n’ recalls next command äline editing äleft-arrow, right-arrow moves cursor inside command ä ‘^d’ or backspace will delete character in front of cursor cisco router configuration AFNOG 2002 / track 2 # 30

Connecting your Freebsd machine to console äConnect your machine to the console port using the serial cable provide ägo to /etc/remote to see the device configured to be used with "tip”. you will see at the end, a line begin with cuaa 0 c… (you can change it to cisco) bash$ tip cuaa 0 c (or cisco) router>enable router# cisco router configuration AFNOG 2002 / track 2 # 31

Exercise contd älook at your running configuration äConfigure an IP address for e 0/0 depending on your table - use 80. 248. 70. 1 for table A etc älook at your running configuration and your startup configuration äwhat difference is there if any cisco router configuration AFNOG 2002 / track 2 # 32

using access lists äAccess Control Lists used to implement security in routers – powerful tool for network control – filter packets flow in or out of router interfaces – restrict network use by certain users or devices – deny or permit traffic – operate in sequential, logical order top down – goes down access list until match is found – inherent deny at the bottom of every list cisco router configuration AFNOG 2002 / track 2 # 33

using access lists äStandard Access Lists (1 - 99) – simpler address specifications – generally permits or denies entire protocol suite äExtended Access Lists (100 - 199) – more complex address specification – generally permits or denies specific protocols cisco router configuration AFNOG 2002 / track 2 # 34

ACL format äStandard Access List Configuration format – access-list-number {permit | deny} source {source-mask} – ip access-group access-list-number {in | out} äExtended Access List Configuration format – access-list-number {permit | deny} protocol source {source-mask} destination {destination-mask} – ip access-group access-list-number {in | out} cisco router configuration AFNOG 2002 / track 2 # 35

where to place IP access list äplace standard access list close to destination äplace extended access lists close to the source of the traffic you want to deny cisco router configuration AFNOG 2002 / track 2 # 36

using access lists ä Router(config)#Access-list access-list-number {permit|deny}{test conditions} ä Router(config)#{protocol access-group access-list-number ä e. g check for IP subnets 172. 30. 16. 0 to 172. 30. 31. 0 172. 30. 16. 0 0001 0000 check cisco router configuration Address and Wilcard Mask: 172. 30. 16. 0 0. 0. 15. 255 1111 ignore AFNOG 2002 / track 2 # 37

äwildcard bits indicate how to check corresponding address bit – 0=check – 1=ignore äMatching Any IP Address 0. 0 255 or abbreviate the expression using the keyword any äMatching a specific host 172. 30. 16. 29 0. 0 or abbreviate the wildcard using the IP address preceded by the keyword host cisco router configuration AFNOG 2002 / track 2 # 38

Permit telnet from my network only access-list 1 permit 80. 248. 70. 224 0. 0. 0. 15 access-list 1 deny any line vty 0 4 access-class 1 in cisco router configuration AFNOG 2002 / track 2 # 39

Standard Access Lists Example Permit my network only 172. 16. 3. 0 172. 16. 4. 0 Non 172. 16. 0. 0 E 0 S 0 E 1 172. 16. 4. 13 Access-list 1 permit 172. 16. 0. 0. 255 Interface ethernet 0 ip access-group 1 out interface ethernet 1 ip access-group 1 out cisco router configuration AFNOG 2002 / track 2 # 40

extended access lists example Deny FTP for E 0 172. 16. 3. 0 172. 16. 4. 0 Non 172. 16. 0. 0 E 0 S 0 E 1 172. 16. 4. 13 access-list 101 deny tcp 172. 16. 4. 0 0. 0. 0. 255 172. 16. 3. 0 0. 0. 0. 255 eq 21 access-list 101 deny tcp 172. 16. 4. 0 0. 0. 0. 255 172. 16. 3. 0 0. 0. 0. 255 eq 20 access-list 101 permit ip 172. 16. 4. 0 0. 0. 0. 255 0. 0 255 interface ethernet 0 ip access-group 101 out cisco router configuration AFNOG 2002 / track 2 # 41