Create an FTP server – Free and easy

Create an FTP server – Free and easy

If your friends and you want an easy and a fast way to share files, you can create a server on your computer.

A short and free way to create an FTP server (File Transfer Protocol)? It’s actually a protocol which allows you to directly share files from one computer to another over the Internet. If your friend for example has limited space on your computer, he can upload all the files to the server and download them when he needs them.

1. First thing we need to do is to port-forward a port in the router we’re using. The port we need to forward is port number 21. Why? Because by default it’s the port used for FTP. Port forwarding actually means opening a tunnel through the router so that the router wouldn’t reject the connections that are trying to connect to it. How to port-forward? With every router it’s different. Here are the instructions for every one of them.

2. Now once the port is opened, we can create a server using free FTP clients. There are many free FTP clients, but the one we’re going to use is very simple and you don’t need to install it. It’s called CrossFTP. Just download it from here. Select the option shown below;

Once you clicked that, open the file. Select users. A list shown below will appear:

Click save and your FTP server is set. You can enter your server by typing in “ftp://YourLocalIPAddress:21″in the browser. To find out your local IP go to START>RUN>cmd. Here type in ipconfig. The IP address of your computer will appear. That’s your local IP. So if you’re entering the server from the inside, you enter your local IP. But if your entering your server from the outside, let’s say from your friends house you need to know the external IP. That’s step 3->

3. Now your server can be accessed from the outside. The only thing a person needs to know to enter the server is your IP. You can always find out your IP by visiting this site ->www.whatsmyip.org . To access your server from the outside, you need to type in “ftp://YourExternalIPAddress:21″ in your browser.

The problem occurs after a while when your router reboots and your IP address changes. You can always buy a static IP from your Internet Service Provider, but there’s a thing we can do for free is to create a free domain (a name,like a website), so that users of your server don’t need to know your IP, but just the name of the domain.

Here is video instructional

Read More

Useful links for studying CCNA and good reminders.

http://routersimulator.certexams.com/router-labs/index.html

http://www.proprofs.com/quiz-school/story.php?title=ccna-practice-exam

http://www.howtonetwork.net/public/department98.cfm

http://www.howtonetwork.net/public/department140.cfm
http://gtcc-it.net/billings/VLSM.htm

Read More

TestinsideCCNA640-802 v12

TestinsideCCNA640-802 v12

TestinsideCCNA640-802 v12: Download here:
http://rapidshare.com/#!download|167tl3|66726333|TestInside_CCNA640-802_v12.rar|5295

Read More

Free Speed Test

Free Speed Test

Read More

How Do I Configure a Backup for an Easy VPN Connection?

To configure a backup for an Easy VPN Remote connection, your router must have an ISDN, async, or analog modem interface available for the backup.

If the ISDN, async, or analog modem interface has not been configured, follow these steps:

1.From the left frame, click Interfaces and Connections.

2.Click the Create Connection tab.

3.Choose an ISDN, async, or analog modem interface from the list.

4.Click the Create New Connection button and use the wizard to configure the new interface

5.In the appropriate wizard window, set the new interface as a backup for an Easy VPN Remote connection.

If the ISDN, async, or analog modem interface has been configured, follow these steps:

1.From the left frame, click Interfaces and Connections.

2.Click the Edit Interface/Connection tab.

3.Choose an ISDN, async, or analog modem interface from the list of configured interfaces.

4.Click the Edit button.

5.Click the Backup tab and configure the backup for an Easy VPN Remote connection.

6.When you have finished configuring the backup, click OK.

Read More

How Do I Create a VPN to More Than One Site?

You can use Cisco SDM to create multiple VPN tunnels on one interface on your router. Each VPN tunnel will connect the selected interface on your router to a different subnet at the destination router. You can configure multiple VPN tunnels to connect to the same interface but to different subnets on the destination router, or you can configure multiple VPN tunnels that will connect to different interfaces on the destination router.

First, you must create the initial VPN tunnel. The steps below describe how to create the initial VPN tunnel. If you have already created your first VPN tunnel and need to add an additional tunnel to the same interface, skip the first procedure and perform the steps in the next procedure in this help topic.
Create the initial VPN tunnel:

1. From the left frame, select VPN.
2. Select Create a Site-to-Site VPN .
3. Click Launch the Selected Task.

The VPN Wizard starts.

1. Click Quick Setup.
2. Click Next>.
3. From the Select the Router Interface for this VPN Connection field, choose the interface on the source router on which to create the VPN tunnel. This is the interface connected to the Internet on the Local system in the Use Case Scenario diagram.
4. In the Peer Identity field, enter the IP address of the destination router interface.
5. In the Authentication fields, enter and reenter the pre-shared key that the two VPN peers will use.
6. In the Source field, select the interface that connects to the subnet whose IP traffic you want to protect. This is the Local router in the Use Case Scenario diagram, and is usually an interface connected to the LAN.
7. In the Destination fields, enter the IP address and subnet mask of the destination router.
8. Click Next>.
9. Click Finish.

Create an Additional Tunnel from the Same Source Interface

After you have created the initial VPN tunnel, follow these steps to create an additional tunnel from the same source interface to a different destination interface or destination subnet:

1. From the left frame, select VPN.
2. Select Create a Site-to-Site VPN.
3. Click Launch the Selected Task.

The VPN Wizard starts.

1. Click Quick Setup.
2. Click Next>.
3. From the Select the Router Interface for this VPN Connection field, choose the same interface that you used to create the initial VPN connection.
4. In the Peer Identity field, enter the IP address of the destination router interface. You can enter the same IP address that you entered when you created the initial VPN connection. This indicates that this second VPN connection should use the same interface on the destination router as the initial VPN connection. If you do not want both VPN connections to connect to the same destination interface, enter the IP address of a different interface on the destination router.
5. In the Authentication fields, enter and reenter the pre-shared key that the two VPN peers will use.
6. In the Source field, select the same interface used to create the initial VPN connection.
7. In the Destination fields, you have the following options:
8. If, in the Peer Identity field, you entered the IP address of a different interface on the destination router and want to protect the IP traffic coming from a specific subnet, enter the IP address and subnet mask of that subnet in the appropriate fields.
9. If you entered the same IP address in the Peer Identity field as you used for the initial VPN connection, indicating that this VPN tunnel will use the same router interface as the initial VPN tunnel, then enter the IP address and subnet mask of the new subnet that you want to protect in the appropriate fields.
10. Click Next>.
11. Click Finish.

Read More

Cisco Systems' Private VLANs

  Cisco Systems' Private VLANs:

Scalable Security in a Multi-Client Environment

Abstract

This document describes a mechanism to achieve device isolation
through the application of special Layer 2 forwarding constraints.
Such a mechanism allows end devices to share the same IP subnet while
being Layer 2 isolated, which in turn allows network designers to
employ larger subnets and so reduce the address management overhead.

Some of the numerous deployment scenarios of the aforementioned
mechanism (which range from data center designs to Ethernet-to-the-
home-basement networks) are mentioned in the following text to
exemplify the mechanism's possible usages; however, this document is
not intended to cover all such deployment scenarios nor delve into
their details.

Status of This Memo

This document is not an Internet Standards Track specification; it is
published for informational purposes.

This is a contribution to the RFC Series, independently of any other
RFC stream. The RFC Editor has chosen to publish this document at
its discretion and makes no statement about its value for
implementation or deployment. Documents approved for publication by
the RFC Editor are not a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.

Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc5517.


Copyright Notice

Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document.

Table of Contents

1. Introduction ....................................................2
1.1. Security Concerns with Sharing a VLAN ......................3
1.2. The Traditional Solution and Its Related Problems ..........3
2. Private VLANs Architecture ......................................4
2.1. VLAN Pairings and Their Port-Related Characteristics .......7
3. Extending Private VLANs across Switches .........................9
4. A More Flexible IP Addressing Scheme ............................9
5. Routing Considerations .........................................10
6. Security Considerations ........................................10
7. Acknowledgements ...............................................11
8. References .....................................................11
8.1. Normative References ......................................11
8.2. Informative References ....................................11

1. Introduction

In an Ethernet switch, a VLAN is a broadcast domain in which hosts
can establish direct communication with one another at Layer 2. If
untrusted devices are introduced into a VLAN, security issues may
arise because trusted and untrusted devices end up sharing the same
broadcast domain.

The traditional solution to this kind of problem is to assign a
separate VLAN to each user concerned about Layer 2 security issues.
However, the IEEE 802.1Q standard [802.1Q] specifies that the VLAN ID
field in an Ethernet frame is 12 bits wide. That allows for a
theoretical maximum of 4094 VLANs in an Ethernet network (VLAN
numbers 0 and 4095 are reserved). If the network administrator
assigns one VLAN per user, then that equates to a maximum of 4094
users that can be supported. The private VLANs technology described
in this memo addresses this scalability problem by offering more
granular and more flexible Layer 2 segregation, as explained in the
following sections.


1.1. Security Concerns with Sharing a VLAN

Companies who have Internet presence can either host their servers in
their own premises or, alternatively, they can locate their servers
at the Internet Service Provider's premises. A typical ISP would
have a server farm that offers web-hosting functionality for a number
of customers. Co-locating the servers in a server farm offers ease
of management but, at the same time, may raise security concerns.

Let us assume that the ISP puts all the servers in one big VLAN.
Servers residing in the same VLAN can listen to Layer 2 broadcasts
from other servers. Once a server learns the Media Access Control
(MAC) address associated to the IP address of another computer in the
same VLAN, it can establish direct Layer 2 communication with that
device without having to go through a Layer 3 gateway/firewall. If,
for example, an attacker gets access to one of the servers, he or she
can use that compromised host to launch an attack on other servers in
the server farm. To protect themselves from malicious attacks, ISP
customers want their machines to be isolated from other machines in
the same server farm.

The security concerns become even more apparent in metropolitan area
networks. Metropolitan Service Providers may want to provide Layer 2
Ethernet access to homes, rental communities, businesses, etc. In
this scenario, the subscriber next door could very well be a
malicious network user.

It is therefore very important to offer Layer 2 traffic isolation
among customers. Customer A would not want his Layer 2 frames being
broadcast to customer B, who happens to be in the same VLAN. Also,
customer A would not want customer B to bypass a router or a firewall
and establish direct Layer 2 communication with him/her.

1.2. The Traditional Solution and Its Related Problems

The traditional solution would be to assign a separate VLAN to each
customer. That way, each user would be assured of Layer 2 isolation
from devices belonging to other users.

However, with the VLAN-per-customer model, if an ISP wanted to offer
web-hosting services to, say, 4000 customers, it would consume 4000
VLANs. Theoretically, the maximum number of VLANs that an 802.1Q-
compliant networking device can support is 4094. In reality, many
devices support a much smaller number of active VLANs. Even if all
devices supported all 4094 VLANs, there would still be a scalability
problem when the 4095th customer signed up.


A second problem with assigning a separate VLAN per customer is
management of IP addresses. Since each VLAN requires a separate
subnet, there can be potential wastage of IP addresses in each
subnet. This issue has been described by RFC 3069 [RFC3069] and will
not be discussed in detail in this document.

2. Private VLANs Architecture

The private VLANs architecture is similar to but more elaborate than
the aggregated VLAN model proposed in RFC 3069. The concepts of
'super VLAN' and 'sub VLAN' used in that RFC are functionally similar
to the concepts of 'primary VLAN' and 'secondary VLAN' used in this
document.

On the other hand, the private VLANs technology differs from the
mechanism described in [RFC4562] because instead of using a MAC-
address-based 'forced forwarding' scheme it uses a VLAN-based one.

A regular VLAN is a single broadcast domain. The private VLANs
technology partitions a larger VLAN broadcast domain into smaller
sub-domains. So far, two kinds of special sub-domains specific to
the private VLANs technology have been defined: an 'isolated' sub-
domain and a 'community' sub-domain. Each sub-domain is defined by
assigning a proper designation to a group of switch ports.

Within a private VLAN domain, three separate port designations exist.
Each port designation has its own unique set of rules, which regulate
a connected endpoint's ability to communicate with other connected
endpoints within the same private VLAN domain. The three port
designations are promiscuous, isolated, and community.

An endpoint connected to a promiscuous port has the ability to
communicate with any endpoint within the private VLAN. Multiple
promiscuous ports may be defined within a single private VLAN domain.
In most networks, Layer 3 default gateways or network management
stations are commonly connected to promiscuous ports.

Isolated ports are typically used for those endpoints that only
require access to a limited number of outgoing interfaces on a
private-VLAN-enabled device. An endpoint connected to an isolated
port will only possess the ability to communicate with those
endpoints connected to promiscuous ports. Endpoints connected to
adjacent isolated ports cannot communicate with one another. For
example, within a web-hosting environment, isolated ports can be used
to connect hosts that require access only to default gateways.

A community port is a port that is part of a private VLAN community,
which is a grouping of ports connected to devices belonging to the



same entity (for example, a group of hosts of the same ISP customer
or a pool of servers in a data center). Within a community,
endpoints can communicate with one another and can also communicate
with any configured promiscuous port. Endpoints belonging to one
community cannot instead communicate with endpoints belonging to a
different community or with endpoints connected to isolated ports.

The aforementioned three port designations directly correspond to
three different VLAN types (primary, isolated, and community) with
well-defined, port-related characteristics, which are described in
detail in Section 2.1 below.

Figure 1 below illustrates the private VLAN model from a switch port
classification perspective.

-----------
| R |
-----------
|
|
|
----------------------------------------
| p1 |
| |
=====| t1 |
| switch |
| |
| |
|i1 i2 c1 c2 |
----------------------------------------
| | | |
| | | |
| | | |
A B C D

A, B - Isolated devices
C, D - Community devices
R - Router (or other L4-L7 device)
i1, i2 - Isolated switch ports
c1, c2 - Community switch ports
p1 - Promiscuous switch port
t1 - Inter-switch link port (a VLAN-aware port)

Figure 1. Private VLAN classification of switch ports

With reference to Figure 1, each of the port types is described
below.



Isolated ports: An isolated port, e.g., i1 or i2, cannot talk to any
other port in the private VLAN domain except for promiscuous ports
(e.g., p1). If a customer device needs to have access only to a
gateway router, then it should be attached to an isolated port.

Community ports: A community port, e.g., c1 or c2, is part of a group
of ports. The ports within a community can have Layer 2
communications with one another and can also talk to any
promiscuous port. If an ISP customer has, say, 2 devices that
he/she wants to be isolated from other customers' devices but to
be able to communicate among themselves, then community ports
should be used.

Promiscuous ports: As the name suggests, a promiscuous port (p1) can
talk to all other types of ports. A promiscuous port can talk to
isolated ports as well as community ports and vice versa. Layer 3
gateways, DHCP servers, and other 'trusted' devices that need to
communicate with the customer endpoints are typically connected
via promiscuous ports.

Please note that isolated, community, and promiscuous ports can
either be access ports or hybrid/trunk ports (according to the
terminology presented in Annex D of the IEEE 802.1Q specification, up
to its 2004 revision).

The table below summarizes the communication privileges between the
different private VLAN port types.

---------------------------------------------------------------
| | isolat-| promis-| commu-| commu-| interswitch |
| | ted | cuous | nity1 | nity2 | link port |
---------------------------------------------------------------
| isolated | deny | permit | deny | deny | permit |
---------------------------------------------------------------
| promiscuous | permit | permit | permit| permit| permit |
---------------------------------------------------------------
| community1 | deny | permit | permit| deny | permit |
---------------------------------------------------------------
| community2 | deny | permit | deny | permit| permit |
---------------------------------------------------------------
| interswitch | | | | | |
| link port | deny(*)| permit | permit| permit| permit |
---------------------------------------------------------------

Table 1

(*) Please note that this asymmetric behavior is for traffic
traversing inter-switch link ports over an isolated VLAN only.



Traffic from an inter-switch link port to an isolated port will
be denied if it is in the isolated VLAN. Traffic from an inter-
switch link port to an isolated port will be permitted if it is
in the primary VLAN (see below for the different VLAN
characteristics).

N.B.: An inter-switch link port is simply a regular port that
connects two switches (and that happens to carry two or more
VLANs).

2.1. VLAN Pairings and Their Port-Related Characteristics

In practice, the Layer 2 communication constraints described in the
table above can be enforced by creating sub-domains within the same
VLAN domain. However, a sub-domain within a VLAN domain cannot be
easily implemented with only one VLAN ID. Instead, a mechanism of
pairing VLAN IDs can be used to achieve this notion. Specifically,
sub-domains can be represented by pairs of VLAN numbers:

Vp is the primary VLAN ID ------
Vs is the secondary VLAN ID | Vp |
------
where Vs can be: / \
- Vi (an isolated VLAN) / \
- Vc (a community VLAN) / \
------ ------
| Vi | | Vc |
------ ------


Figure 2. A private VLAN domain can be
implemented with one or more VLAN ID pairs.

A private VLAN domain is built with at least one pair of VLAN IDs:
one (and only one) primary VLAN ID (Vp) plus one or more secondary
VLAN IDs (Vs). Secondary VLANs can be of two types: isolated VLANs
(Vi) or community VLANs (Vc).

A primary VLAN is the unique and common VLAN identifier of the whole
private VLAN domain and of all its VLAN ID pairs.

An isolated VLAN is a secondary VLAN whose distinctive characteristic
is that all hosts connected to its ports are isolated at Layer 2.
Therefore, its primary quality is that it allows a design based on
private VLANs to use a total of only two VLAN identifiers (i.e., a
single private VLAN pairing) to provide port isolation and serve any
number of end users (vs. a traditional design in which one separate
plain VLAN ID would be assigned to each port).



A community VLAN is a secondary VLAN that is associated to a group of
ports that connect to a certain "community" of end devices with
mutual trust relationships.

While only one isolated VLAN is allowed in a private VLAN domain,
there can be multiple distinct community VLANs.

Please note that this VLAN pairing scheme simply requires that all
traffic transported within primary and secondary VLANs be tagged
according to the IEEE 802.1Q standard (see for example [802.1Q],
Section B.1.3), with at most a single standard VLAN tag. No special
double-tagging is necessary due to the 1:1 correspondence between a
secondary VLAN and its associated primary VLAN.

(Also note that this document makes use of the "traditional" VLAN
terminology, whereas the IEEE 802.1ag standard [802.1ag] amends key
sections of IEEE 802.1Q-2005 to make the distinction between "VLANs"
and "VLAN IDs" so that every "VLAN" can be assigned one or more VLAN
IDs, similarly to the pairing scheme described in this document.)

The ports in a private VLAN domain derive their special
characteristics (as described in Section 2) from the VLAN pairing(s)
they are configured with. In particular, a promiscuous port is a
port that can communicate with all other private VLAN port types via
the primary VLAN and any associated secondary VLANs, whereas isolated
or community ports can communicate over their respective secondary
VLANs only.

For example, with reference to Figure 1, a router R connected to the
promiscuous port can have Layer 2 communication with a device A
connected to an isolated port and also with a device C connected to a
community port. Devices C and D can also have Layer 2 communication
between themselves since they are part of the same community VLAN.
However, devices A and B cannot communicate at Layer 2 due to the
special port segregation property of the isolated VLAN. Also,
devices A and C cannot communicate at Layer 2 since they belong to
different secondary VLANs.

The impact of these enforced forwarding restrictions is two-fold.
Firstly, service providers can assign multiple customers to the same
isolated VLAN, thereby conserving VLAN IDs. Secondly, end users can
be assured that their Layer 2 traffic cannot be sniffed by other end
users sharing the same isolated VLAN or connected to a different
secondary VLAN.


3. Extending Private VLANs across Switches

Some switch vendors have attempted to provide a port isolation
feature within a VLAN by implementing special logic at the port
level. However, when implemented at the port level, the isolation
behavior is restricted to a single switch.

When a VLAN spans multiple switches, there is no standard mechanism
to propagate port-level isolation information to other switches and,
consequently, the isolation behavior fails in other switches.

In this document, the proposal is to implement the port isolation
information implicitly at the VLAN level. A particular VLAN ID can
be configured to be the isolated VLAN. All switches in the network
would give special "isolated VLAN" treatment to frames tagged with
this particular VLAN ID. Thereby, the isolated VLAN behavior can be
maintained consistently across all switches in a Layer 2 network.

In general, isolated, community, and primary VLANs can all span
multiple switches, just like regular VLANs. Inter-switch link ports
need not be aware of the special VLAN type and will carry frames
tagged with these VLANs just like they do any other frames.

One of the objectives of the private VLANs architecture is to ensure
that traffic from an isolated port in one switch does not reach
another isolated or community port in a different switch even after
traversing an inter-switch link. By implicitly embedding the
isolation information at the VLAN level and by transporting it along
with the packet, it is possible to maintain a consistent behavior
throughout the network. Therefore, the mechanism discussed in
Section 2, which will restrict Layer 2 communication between two
isolated ports in the same switch, will also restrict Layer 2
communication between two isolated ports in two different switches.

4. A More Flexible IP Addressing Scheme

The common practice of deploying multiple VLANs in a network for
security reasons and of allocating a subnet to each VLAN has led to a
certain number of inefficiencies in network designs, such as the
suboptimal utilization of the IP addressing space (as exemplified in
the introduction of RFC 3069 [RFC3069]). Moreover, each subnet
requires addresses to be set aside for internetworking purposes (a
subnetwork address, a directed broadcast address, default gateway
address(es), etc.). So a high number of used VLANs traditionally
translates into a significant number of special addresses to be
consumed.


On the other hand, in a private VLAN domain, all members can share a
common address space that is part of a single subnet associated to
the primary VLAN. An end device can be assigned an IP address
statically or by using a DHCP server connected to a promiscuous port.
Since IP addresses are no longer allocated on a smaller subnet basis
but are assigned from a larger address pool shared by all members in
the private VLAN domain, address allocation becomes much more
efficient: fewer addresses are consumed for internetworking purposes,
while most of the address space is allotted to end devices, leaving
ample flexibility in the way available addresses are (re-)assigned.

5. Routing Considerations

The entire private VLANs architecture confines secondary VLANs within
the 2nd layer of the OSI model. With reference to Figure 2, the
secondary VLANs are internal to a private VLAN domain. Layer 3
entities are not directly aware of their existence: to them it
appears as if all the end devices are part of the primary VLAN.

With reference to Figure 1, the isolation behavior between devices A
and B is at the Layer 2 level only. Devices A and B can still
communicate at the Layer 3 level via the router R. Since A and B are
part of the same subnet, the router assumes that they should be able
to talk directly to each other. That however is prevented by the
isolated VLAN's specific behavior. So, in order to enable A and B to
communicate via the router, a proxy-ARP-like functionality needs to
be supported on the router interface.

With regard to the specific version of the IP protocol in use, all
routing considerations apply to both IPv4 and IPv6 for the case of
unicast traffic. On the other hand, due to their complexity,
considerations about multicast bridging and routing within a private
VLAN domain transcend the scope of this introductory document, and
are therefore omitted.

6. Security Considerations

In a heterogeneous Layer 2 network that is built with switches from
multiple vendors, the private VLAN feature should be supported and
configured on all the switches. If a switch S in that network does
not support this feature, then there may be undesired forwarding of
packets, including permanent flooding of Layer 2 unicast frames.
That is because switch S is not aware of the association between
primary and secondary VLANs and consequently cannot apply the
segregation rules and constraints characteristic of the private VLANs
architecture (an example of one such constraint is explained in
[802.1Q], Section B.1.3). This impact is limited to traffic within
the private VLAN domain and will not affect the regular Layer 2
forwarding behavior on other VLANs.

If the private VLAN feature is properly deployed, it can be used at
Layer 2 to segregate individual users or groups of users from each
other: this segregation allows a network designer to more effectively
constrain Layer 2 forwarding so as to, for instance, block or contain
unwanted inter-device communication like port scans or Address
Resolution Protocol (ARP) poisoning attacks.

7. Acknowledgements

Many people have contributed to the private VLANs architecture. We
would particularly like to thank, in alphabetical order, Senthil
Arunachalam, Jason Chen, Tom Edsall, Michael Fine, Herman Hou, Kannan
Kothandaraman, Milind Kulkarni, Heng-Hsin Liao, Tom Nosella, Prasanna
Parthasarathy, Ramesh Santhanakrishnan, Mukundan Sudarsan, Charley
Wen, and Zhong Xu for their significant contributions.

8. References

8.1. Normative References

[802.1Q] Institute of Electrical and Electronics Engineers,
"Virtual Bridged Local Area Networks", IEEE Standard
802.1Q, 2005 Edition, May 2006.

[802.1ag] Institute of Electrical and Electronics Engineers,
"Connectivity Fault Management", IEEE Standard 802.1ag,
2007 Edition, December 2007.

8.2. Informative References

[RFC3069] McPherson, D. and B. Dykes, "VLAN Aggregation for
Efficient IP Address Allocation", RFC 3069, February 2001.

[RFC4562] Melsen, T. and S. Blake, "MAC-Forced Forwarding: A Method
for Subscriber Separation on an Ethernet Access Network",
RFC 4562, June 2006.

Read More

How To Configure DNS Server On A Cisco Router

How To Configure DNS Server On A Cisco Router

The DNS protocol is used to resolve FQDN (Fully Qualified Domain Names) to IP addresses around the world. This allows us to successfully find and connect to Internet websites and services no matter where they are. Its usefulness, however, doesn't stop there: local company and private networks also rely on DNS to operate efficiently and correctly.
In many cases, where a local DNS server is not available, we are forced to either use our ISP's DNS servers or some public DNS server, however, this can sometimes prove troublesome. Today, small low-end routers have the ability to integrate DNS functionality, making life easier, but so do Cisco routers - they simply have to be setup and you're done.
This article will show you how to configure your Cisco router to provide DNS services to your network, and make all clients use it as a DNS server. Our easy to follow step-by-step process ensures you'll understand the process and have it running within minutes.

Example Scenario

Consider the following network diagram. This is our example network, we'd like to enable the DNS Service so our workstations can properly resolve Internet domains but also local network names.

First step is to enable the DNS service on the router.

Next, we need to configure the router with a public name-server, this will force the router to perform recursive DNS lookups, in other words, for every request it receives from our
workstations the router will try to find the answer by asking as many DNS servers it needs, and finally return with an answer.

The Cisco IOS will allow you to enter up to 6 different name servers (essentially DNS servers). Usually you would use your ISP's DNS server to ensure you have quick responses, then place a few free public DNS servers such as the ones above. This will ensure that you'll get a DNS response from either your ISP or public DNS servers.
Next step is to configure your DNS server with the host names of your local network, this way when Alan's PC trys to ping or connect to Wayne, the router will successfully resolve its netbios name to the appropriate IP address.

If you now try to ping 'wayne' directly from your router's CLI prompt, you should receive an answer:

At this point, you can configure your workstations to use your router's IP address as the primary DNS server.

Article Summary
We've covered how a Cisco router can be used as a basic DNS server to enable network clients to perform DNS queries for the local network and Internet.
Future articles in DNS will cover more advanced configurations, including full domain resource records, DNS load balancing and more.
If you have found the article useful, we would really appreciate you sharing it with others by using the provided services on the top left corner of this article. Sharing our articles takes only a minute of your time and helps Firewall.cx reach more people through such services.

Read More

The Defense Advance Research Projects Agency (DARPA) originally developed Transmission Control Protocol/Internet Protocol (TCP/IP)

The Defense Advance Research Projects Agency (DARPA) originally developed Transmission Control Protocol/Internet Protocol (TCP/IP)

The Defense Advance Research Projects Agency (DARPA) originally developed Transmission Control Protocol/Internet Protocol (TCP/IP) to interconnect various defense department computer networks. The Internet, an international Wide Area Network, uses TCP/IP to connect government and educational institutions across the world. TCP/IP is also in widespread use on commercial and private networks. The TCP/IP suite includes the following protocols:

Physical

Data Link Layer
ARP/RARP: Address Resolution Protocol/Reverse Address
DCAP: Data Link Switching Client Access Protocol

Network Layer
DHCP: Dynamic Host Configuration Protocol
DVMRP :Distance Vector Multicast Routing Protocol
ICMP/ICMPv6: Internet Control Message Protocol
IGMP: Internet Group Management Protocol
IP: Internet Protocol version 4
IPv6: Internet Protocol version 6
MARS: Multicast Address Resolution Server
PIM: Protocol Independent Multicast-Sparse Mode (PIM-SM)
RIP2: Routing Information Protocol
RIPng: for IPv6 Routing Information Protocol for IPv6
RSVP: Resource ReSerVation setup Protocol
VRRP: Virtual Router Redundancy Protocol

Transport Layer
ISTP:
Mobile: IP Mobile IP Protocol
RUDP: Reliable UDP
TALI: Transport Adapter Layer Interface
TCP: Transmission Control Protocol
UDP: User Datagram Protocol
Van: Jacobson compressed TCP
XOT: X.25 over TCP

Session Layer
BGMP: Border Gateway Multicast Protocol
Diameter:
DIS: Distributed Interactive Simulation
DNS: Domain Name Service
ISAKMP/IKE: Internet Security Association and Key Management Protocol and
Internet Key Exchange Protocol
iSCSI: Small Computer Systems Interface
LDAP: Lightweight Directory Access Protocol
MZAP: Multicast-Scope Zone Announcement Protocol
NetBIOS/IP: NetBIOS/IP for TCP/IP Environment

Application Layer
COPS: Common Open Policy Service
FANP: Flow Attribute Notification Protocol
Finger: User Information Protocol
FTP: File Transfer Protocol
HTTP: Hypertext Transfer Protocol
IMAP4: Internet Message Access Protocol rev 4
IMPPpre/IMPPmes: Instant Messaging and Presence Protocols
IPDC: IP Device Control
IRC: ·Internet Relay Chat Protocol
ISAKMP: Internet Message Access Protocol version 4rev1
ISP:
NTP: Network Time Protocol
POP3: Post Office Protocol version 3
Radius: Remote Authentication Dial In User Service
RLOGIN: Remote Login
RTSP: Real-time Streaming Protocol
SCTP: Stream Control Transmision Protocol
S-HTTP: Secure Hypertext Transfer Protocol
SLP: Service Location Protocol
SMTP: Simple Mail Transfer Protocol
SNMP: Simple Network Management Protocol
SOCKS: Socket Secure (Server)
TACACS+: Terminal Access Controller Access Control System
TELNET: TCP/IP Terminal Emulation Protocol
TFTP: Trivial File Transfer Protocol
WCCP: Web Cache Coordination Protocol
X-Window: X Window

Routing
BGP-4: Border Gateway Protocol
EGP: Exterior Gateway Protocol
EIGRP: Enhanced Interior Gateway Routing Protocol
HSRP: Cisco Hot Standby Router Protocol
IGRP: Interior Gateway Routing
NARP: NBMA Address Resolution Protocol
NHRP: Next Hop Resolution Protocol
OSPF: Open Shortest Path First
TRIP: Telephony Routing over IP

Tunneling
ATMP: Ascend Tunnel Management Protocol
L2F: The Layer 2 Forwarding Protocol
L2TP: Layer 2 Tunneling Protocol
PPTP: Point to Point Tunneling Protocol

Security
AH: Authentication Header
ESP: Encapsulating Security Payload
TLS: Transport Layer Security Protocol The

TCP/IP suite is illustrated here in relation to the OSI model:
Click the map to see more details.

Read More

Configuring NTP On A Cisco Router

Network Time Protocol (NTP) is a vital service not only for Cisco devices but almost every network device. Any computer-based device needs to be accurately synchronised with a reliable time source such as an NTP server.
When it comes to Cisco routers, obtaining the correct time is extremely important because a variety of services depend on it. The logging service shows each log entry with the date and time - very critical if you're trying to track a specific incident or troubleshoot a problem.
Generally, most Cisco routers have two clocks (most people are unaware of this!): a battery-powered hardware clock, referenced as the 'calendar' in the IOS CLI, and a software clock, referenced as the 'clock' in the IOS CLI.
The software clock is the primary source for time data and runs from the moment the system is up and running. The software clock can be updated from a number of sources:
• NTP Server
• SNTP (Simple NTP)
• VINES Time Source
• Hardware clock (built into the router)
Because the software clock can be configured to be updated from an external source, it is considered more accurate in comparison to the hardware clock. The hardware clock can be configured to be updated from the software clock.

Example Scenario
This article will show you how to configure your Cisco router to synchronise its software clock from external sources such as NTP servers. We will also show you how to configure your router to act as an NTP server for your internal network devices, ensuring all devices are synchronised.
First example involves setting up the router to request NTP updates and synchronise itself from a public NTP server. This will ensure the router's time is constantly synchronised, however it will not act as an NTP server for internal hosts:

We'll need to configure the router to resolve FQDN using our ISP's name server:

Now we instruct our Cisco router to obtain its updates from the public NTP server.

As soon we issue the command, the router will resolve the FQDN into an ip address and begin its synchronisation. Right after issuing the command, we can verify the router is correctly configured and awaiting synchronisation:

The 'show ntp associations' command shows that the system is configured (~) to synchronise with our selected NTP server, however, it is not yet synchronised. When it is, expect to see the star (*) symbol in front of the tilde (~). The 'ref. clock' column shows the IP address of the NTP server from which our public server (1.gr.pool.ntp.org) is synchronising.
It is also worth noting the column named 'st' which is equal to two (2). This represents the stratum level. The higher the stratum, the closer to the Atomic clock source we are. As a general rule, always try to synchronise with a server that has a low stratum.
The 'show ntp status' command confirms that we are yet to be synchronised with the NTP server as it clearly states that the 'clock is unsynchronised' and also shows us the current system time: 1st of Jan. 1900.
After a couple of minutes, we re-visit the CLI prompt and re-issue the commands with the following results:

Looking at the new output, we can see that our Cisco router is now synchronising with the configured peer (*) - public NTP server. Polling of the public NTP server will occur every 64 seconds, as shown in the command output.
The 'show ntp status' command also confirms the synchronisation, however, notice that the router has set its stratum level to 3. This is expected as the reference is stratum 2. The time is now correctly shown (01:17:15.562 Athens Sun Apr 19 2009).

Synchronising Software clock and Hardware clock
Here we'll see how in fact the software and hardware clocks on a Cisco router can have different times and how we can synchronise them between each other.
The following two commands show the difference in time between the two clocks on our Cisco router:

While the difference is small, we want to keep everything in our network synchronised as precisely as possible.
Keep in mind that 'show clock' refers to the software clock and 'show calendar' refers to the hardware clock.
To synchronise the two clocks all we need to do is issue the following command:

The 'ntp update-calendar' forces the hardware clock to synchronise with the system's software clock. After a couple of minutes, we check to see if the two clocks have synchronised:

We can see now that both clocks are accurately synchronised.

Configuring The System as an Authoritative NTP Server
If you want your system to become an authoritative NTP server from which other internal routers or machines can synchronise, you can achieve this with the following command:

The router now acts as an NTP server and is able to respond to internal clients NTP requests. Checking the 'ntp association' will reveal that the router is obtaining its time synchronisation from itself:

Troubleshooting and Monitoring NTP Status
Troubleshooting NTP messages and events is important when you are trying to verify everything is working correctly. You might notice that your Cisco router is not able to create a peer connection with a configured NTP server or your internal LAN clients might not be able to synchronise with your Cisco router; In any case, knowing how to troubleshoot NTPs is something every engineer must be aware of.
Thankfully Cisco provides a number of options that allow you to troubleshoot many aspects of your NTP service.

The most useful debug commands are the 'debug ntp events', 'debug ntp adjust' and 'debug ntp core'. These three commands provide enough debugging to help you troubleshoot problems you might encounter.
Closing, if you would like more information on the ntp associations created by your router you can try the following command:

The 'show ntp associations detail' command will provide much information on the association created with the NTP servers. This is most helpful when you see you are unable to create an association with an NTP server.

Article Summary
This article provided an insight to NTP configuration on Cisco routers. We analysed why the NTP service is important and how it can be used to keep every node in a network synchronised. We examined different methods of NTP synchronisation and provided a fairly in-depth analysis.
If you have found the article useful, we would really appreciate you sharing it with others by using the provided services on the top left corner of this article. Sharing our articles takes only a minute of your time and helps Firewall.cx reach more people through such services.

Read More

BASIC - Configuring console password of a CISCO router

BASIC - Configuring console password of a CISCO router

1. Enter global configuration mode of the CISCO router.
2. Put the command line console 0 to the router.
3. Provide the password by using password command. For example, if you want to put password "cisco" then the command will be password cisco.
4. At last, put the command login.

Commands for configuring console password

Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#line console 0
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#

Why virtual terminal password is required?

Virtual terminal password refers to telnet password. Through telnet, you can access the router and can change anything. So, it's really important to protect the use of telnet by giving a strong password.
Configuring virtual terminal password of a CISCO router:

Different hardware has different no of vty lines defined. Cisco has the range 0 to 4 vty lines. It means it has 5 vty lines. You can set the password of vty lines by the following steps:

1. Enter global configuration mode of the CISCO router.
2. Put the command line vty 0 4 to the router.
3. Provide the password by using password command. For example, if you want to put password "cisco" then the command will be password cisco.
4. At last, put the command login.

Commands for configuring virtual terminal password

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login
Router(config-line)#

Why enable password is required?

Enable password is required to restrict the access of privileged EXEC mode.
Configuring enable password of a CISCO router:

From the global configuration mode, use the command enable password to restrict access to privileged EXEC mode. However, this password is visible in the routers configuration file. To encrypt the password, enable secret command is required. By using enable secret command the password is encrypted and can't be readable to a human.
Commands for configuring enable password

Enable password:

Router>enable
Router#config
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#enable password cisco
Router(config)#

Perform password encryption:

Router>enable
Router#config
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#enable secret cisco
Router(config)#

How to encrypt all the CISCO router password?

By default all the passwords of a CISCO router is readable in clear text in the configuration file. This is a great security threat if someone read it and configure or change the router configuration. So, to protect form display the password, service password-encryption command is used to encrypt the passwords. service password-encryption is a global command and encrypt the passwords:

* enable password
* console password
* vty password
* aux password

By following the above steps you can easily configure CISCO router passwords.

Read More

INTERNET TEACHING LAB: CISCO ROUTER BASICS INSTRUCTOR VERSION

OVERVIEW
In this lab, we will explore some of the basic information on how to configure a Cisco router. In particular, we will see how to access the FSU Computer Science Internet Teaching Lab routers through the Cisco 2511 firewall router, also known as R6. From that router, we will use a feature called “inverse telnet” to access other lab routers through external RS-232 cables. We will also explore some of the router modes including user mode, enable mode, global configuration mode, and sub configuration mode. For additional information you can access the Cisco IOS manuals online at http://www.cisco.com. (From the Cisco home page, choose Technical Documents-Documentation Home Page-Cisco IOS Software Configuration-Cisco IOS Release 11.1-Cisco IOS Configuration Guides and Command References).
BACKGROUND
The ITL lab consists of six Cisco routers labeled R1, R2, R3, R4, R5, and R6; three Cisco catalyst 3500XL series ethernet switches, and several PCs. Cisco routers run an operating system called Cisco IOS or Cisco Internetwork Operating System. Inside the lab network, devices are numbered using IP private address space documented in the RFC1918 standard. Usually, the lab devices are numbered with the block of class C IP networks from 192.168.1.0/24 through 192.168.254.0/24. (If you are unfamiliar with the “/24” notation, it simply indicates the length of the subnet mask. For example, “/24” indicates a network mask of 255.255.255.0.) Routers R1, R2, R3, R4, and R5 are programmed by students to implement a series of lab exercises to learn about networking. Router R6 also called the “firewall” provides security and connects the lab network to the Computer Science departmental network and Internet. Only limited access is granted to students on this router to prevent changes that might compromise the integrity of the firewall. The firewall uses access lists to selectively block traffic on its ethernet interface. In particular, TELNET access is only permitted when originating from the FSU Computer Science departmental server XI.CS.FSU.EDU. Since the private IP address space is unknown on the Internet backbone, even without these access lists, the lab devices would be unreachable from the Internet. The firewall also performs another important function called “network address translation” or NAT. NAT is configured such that IP packets originating from the lab network will be translated where the source IP address of the packet is replaced by the R6 ethernet address so that it will be globally routable. When the destination server responds, R6 performs the translation in reverse. When enabled, this will allow PCs inside the lab network to access devices outside the lab when communication is initiated from inside the lab only. This will allow you to do things like download files with a web browser on the lab PCs from outside servers. For more background information, see the paper entitled “FSU Computer Science Internet Teaching Lab” which can be found at http://www.cs.fsu.edu/~curci/itl.
PART1 – Log into the Cisco 2511:
The Cisco 2511 firewall access router labeled R6 can be accessed in any of 3 ways:
1. Dumb Terminal or Terminal Emulator configured for 9600 baud and DEC VT100 emulation connected the router’s RS-232 console port.
2. TELNET to ethernet interface E0 from XI.CS.FSU.EDU.
3. TELNET to any router R6 interface from inside the lab network. (Only works when the lab routers are configured to provide connectivity.)
We will use the second method. TELNET from XI.CS.FSU.EDU to the R6 interface E0 will allow you to log into router R6. You can TELNET either using the DNS name ITL1.CS.FSU.EDU or the IP address 128.186.121.88. Access lists on interface E0 will allow access only from XI.CS.FSU.EDU, so you will not be able to TELNET in from any other system outside the lab network. When you are connected, the router prompts you for the user mode password that should have been given to you by your instructor. You will also want to enter the command “enable 2” to increase your security level which will enable some commands otherwise not allowed in the user mode.
xi% telnet itl1
Trying 128.186.121.88...
Connected to itl1.
Escape character is '^]'.
User Access Verification
Password: xxxxxx
fw/r6>enable 2
Password: xxxxxx
fw/r6#
Note that the boldface type above indicates the part that you must type, although you should substitute the password for the “xxxxxx”.
Note on enable levels:
Cisco routers have 16 privilege levels called “enable levels” numbered 0 through 15. Level 0 has the least privilege and cannot make any changes and is also called “user mode”. Level 15 is the most privileged and can make any changes and is often simply called “enable mode”. Intermediate levels are used to provide access between the two extremes. For example, in user mode you cannot list the startup configuration or change the configuration. However, you can set up an intermediate level that allows viewing the startup configuration but does not allow changing the configuration. That is what we have done on the firewall/R6 router with enable level 2. This prevents you from making changes to R6 but allows you to at least view the configuration to see what is going on. The command “enable X” prompts for a password and if accepted, changes to enable level X. If X is omitted, 15 is assumed. On the routers you will program, R1 through R5, we will only use enable levels 0 and 15 and refer to them as “user mode” and “enable mode”. Note that the command prompt changes between these two modes-- “user mode” has the “>” symbol while enable mode has the “#” symbol.
The RS-232 console ports on routers R1 through R5 connect to ports Line1 through Line5 on the 2511 respectively. You can connect to any of these routers across the RS-232 link by typing their name unless there is someone else already using the line. This feature is called “inverse telnet”. You can see if anyone else is logged into the firewall with “show user”. You can see any existing sessions you have with “show session”. Once connected to one of these lines, any characters you type are sent across the RS-232 link to the corresponding router and output from the router is displayed on your screen. The only exception is the special escape sequence that brings you back to router R6 – SHIFT-CONTROL-6-x. On your keyboard, press and hold the SHIFT key, press and hold the CONTROL key, then press the “6” key. Release all keys, then press “x”. You should now be back on router R6. The command “show session” will show you which sessions you have active. You can go back to your previous session by simply hitting return, or entering the integer session number displayed with the “show session” command. The command “clear line X” where X is the integer line number is sometimes necessary to clear an inactive session from an idle user. Here is a capture to demonstrate:
fw/r6#show user
Line User Host(s) Idle Location
0 con 0 r1 2w4d
* 18 vty 0 idle 00:00:00 128.186.121.41
fw/r6#show session
% No connections open
fw/r6#r1
Trying r1 (128.186.121.88, 2001)... Open
r1# - (RETURN and SHIFT-CONTROL-6-x typed here)
fw/r6#r2
Trying r2 (128.186.121.88, 2002)... Open
r2# - (RETURN and SHIFT-CONTROL-6-x typed here)
fw/r6#r3
Trying r3 (128.186.121.88, 2003)... Open
r3> - (RETURN and SHIFT-CONTROL-6-x typed here)
fw/r6#show session
Conn Host Address Byte Idle Conn Name
1 r1 128.186.121.88 0 0 r1
2 r2 128.186.121.88 0 0 r2
* 3 r3 128.186.121.88 0 0 r3
fw/r6#clear line 3
[confirm]y [OK]
fw/r6#logout
(You have open connections) [confirm]y
Closing: r1 !
Closing: r2 !
Closing: r3 ! Connection closed by foreign host.
xi%
Since only one person can use an RS-232 line at a time, if your network is already functional, it may be better to use TELNET from R6 to any of the other lab routers or PCs. By default, Cisco routers allow a maximum of 5 concurrent inbound TELNET sessions.
fw/r6#telnet 192.168.55.5
Trying 192.168.55.5 ... Open
User Access Verification
Password: xxxxxx
r5>enable
Password: xxxxxx
r5#logout
Once logged into your team router go to enable mode. Use the command “show version” to see your router’s IOS version number and operating system image filename. A baseline router configuration file should be located on your router’s flash memory device on a file named “base-rX.cfg” where X is the integer ID corresponding to your router. You can also find a listing of the baseline configuration at the end of this document. Get a directory on your flash filesystem with the command “dir flash:” and verify that the baseline configuration file is present. View this file with “show file flash:base-rX.cfg” If everything looks right, copy the baseline configuration file to your router’s startup configuration with “copy flash:base-rX.cfg startup-config” and reboot with the new configuration using the “reload” command. Follow these steps carefully. After the last step, your router will take about 3 minutes to reboot. The following is an example of these steps on router R3 with some of the unimportant messages removed:
xi% telnet itl1.cs.fsu.edu
Trying 128.186.121.88...
Connected to itl1.
User Access Verification
Password: xxxxx
fw/r6>en 2
Password: xxxxx
fw/r6#r3
Trying r3 (128.186.121.88, 2003)... Open
r3#enable
r3#show version
Cisco Internetwork Operating System Software
IOS (tm) GS Software (GS7-J-M), Version 11.1(24), RELEASE SOFTWARE (fc1)
r3 uptime is 2 days, 2 hours, 47 minutes
System restarted by power-on
System image file is "gs7-j-mz.111-24.bin", booted via flash
cisco RP1 (68040) processor (revision A0) with 65536K bytes of memory.
...
r3#dir flash:
-#- -length- -----date/time------ name
1 4025994 --- -- ---- --:--:-- gs7-j-mz.111-24.bin
2 1289 --- -- ---- --:--:-- base-r3.cfg
165776 bytes available (4028528 bytes used)
r3#show file flash:base-r3.cfg
version 11.1
service udp-small-servers
service tcp-small-servers
!
hostname r3
...
r3#copy flash:base-r3.cfg startup-config
Warning: distilled config is not generated
[OK]
r3#reload
Proceed with reload? [confirm]y
%SYS-5-RELOAD: Reload requested
System Bootstrap, Version 5.0(5), RELEASE SOFTWARE
RP1 processor with 65536 Kbytes of main memory
Reading gs7-j-mz.111-24.bin from flash memory
...
Press RETURN to get started!
r3>
r3>enable
Password: xxxxx
r3#
PART2 – IOS MODES:
The Cisco IOS software can operate in four modes:
1. User Mode
2. Enable Mode
3. Global Configure Mode
4. Sub Configure Mode

The diagram above shows you how to switch between router modes. The following example shows logging into a router (user mode), using the “enable” command to go to enable mode, and using the “configure terminal” command. I then enter a simple configuration to assign an IP address on two interfaces and enable the RIP routing protocol. Note how the command prompt changes as we change between modes. Whitespace is ignored, so I have added whitespace in front of the sub config mode commands for clarity. Note also that a command prefixed with the word “no” negates the meaning of the command such as “shutdown” and “no shutdown”.
Configuration to be entered:
ip classless
interface ethernet2/0
ip address 192.168.10.1 255.255.255.0
no shutdown
interface ethernet 2/1
ip address 192.168.20.1 255.255.255.0
router rip
network 192.168.10.0
network 192.168.20.0
no ip domain-lookup
Here is the captured session:
fw/r6#telnet 192.168.11.1
Trying 192.168.11.1 ... Open
User Access Verification
Password: xxxxxx
r1>enable
Password: xxxxxx
r1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#ip classless
r1(config)#interface ethernet2/0
r1(config-if)#ip address 192.168.10.1 255.255.255.0
r1(config-if)#no shutdown
r1(config-if)#interface ethernet2/1
r1(config-if)#ip address 192.168.20.1 255.255.255.0
r1(config-if)#no shutdown
r1(config-if)#router rip
r1(config-router)#network 192.168.10.0
r1(config-router)#network 192.168.20.0
r1(config-router)#exit
r1(config)#no ip domain-lookup
r1(config)#exit
r1#logout
When entering commands, you need only enter enough letters for it to be unique. For example, you can use “config t” in place of “configuration terminal”. You can also type the question mark “?” at any point to see your options. If your terminal emulates a DEC VT100, you can also use the UP, DOWN, LEFT, and RIGHT arrow keys to recall previous commands and edit them. Here is a session capture that makes the same router configuration as shown above but demonstrates using abbreviated commands and the built-in “?” HELP facility.
fw/r6#telnet 192.168.11.1
Trying 192.168.11.1 ... Open
User Access Verification
Password: xxxxxx
r1>en
Password: xxxxxx
r1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#ip clas?
classless
r1(config)#ip classless
r1(config)#int e2/0
r1(config-if)#ip add 192.168.10.1 255.255.255.0
r1(config-if)#no shut
r1(config-if)#int e2/1
r1(config-if)#ip add 192.168.20.1 255.255.255.0
r1(config-if)#no shut
r1(config-if)#router rip
r1(config-router)#net 192.168.10.0
r1(config-router)#net 192.168.20.0
r1(config-router)#exit
r1(config)#no ip d?
default-gateway default-network dhcp-server domain-list domain-lookup
domain-name dvmrp
r1(config)#no ip domain?
domain-list domain-lookup domain-name
r1(config)#no ip domain-lookup
r1(config)#^Z
r1#lo
Log into your router and modify the configuration to display a login message that says “Team X Router” replacing X with your team number using the “banner login” command. Also change your router’s command prompt from “rX” to “teamX” using the “hostname” command. Use the “show interface loopback0” and “show running-config” to view the configuration on your loopback0 interface. Delete your router’s loopback0 interface with “no interface loopback0” Verify it is gone with “show running-config”. Then put the interface back in with “interface loopback0” Make sure you remember to assign the interface an IP address and make sure it NOT shutdown. Since we have not saved any configuration changes in this part, if you get stuck, you can always use the “reload” command to reboot which will undo any changes you have made. Just remember that if you are prompted to save change, you should answer “NO”.
xi% telnet itl1.cs.fsu.edu
Password: xxxxx
fw/r6>r4
Trying r4 (128.186.121.88, 2004)... Open
r4>enable
Password: xxxxx
r4#config term
Enter configuration commands, one per line. End with CNTL/Z.
r4(config)#banner login "Team 4 Router"
r4(config)#hostname Team4
Team4(config)#^Z
Team4#
%SYS-5-CONFIG_I: Configured from console by console
Team4#show running-config
Building configuration...
Current configuration:
!
version 11.1
service udp-small-servers
service tcp-small-servers
!
hostname Team4
!
interface Loopback0
ip address 192.168.44.4 255.255.255.0
...
Team4#config term
Enter configuration commands, one per line. End with CNTL/Z.
Team4(config)#no interface loopback0
%LINEPROTO-5-UPDOWN: Line protocol on Int Loopback0, changed state to down
%LINK-5-CHANGED: Int Loopback0, changed state to administratively down
Team4(config)#interface loopback0
Team4(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
%LINK-3-UPDOWN: Interface Loopback0, changed state to up
Team4(config-if)#ip address 192.168.44.4 255.255.255.0
Team4(config-if)#description Loopback Interface on Router R4
Team4(config-if)#no shutdown
Team4(config-if)#^Z
Team4#
%SYS-5-CONFIG_I: Configured from console by console
Team4#show running-config
Building configuration...
Current configuration:
!
version 11.1
!
hostname Team4
!
no ip domain-lookup
!
interface Loopback0
description Loopback Interface on Router R4
ip address 192.168.44.4 255.255.255.0
!
...
Team4#
PART3 – Saving and Viewing Configurations:
Cisco routers have two configurations, the startup configuration, and the running configuration. Normally, when a router is booted, it reads in the startup configuration which is stored in flash memory. Once the router is running, the current configuration in RAM is called the running configuration. If no changes are made after booting, both the startup and running configurations will be the same. You can make changes interactively to the running configuration. You can also commit the changes to the startup configuration in flash or reboot which will cause any changes you have made to be lost. Here are the relevant commands:
- show startup-config
List the startup configuration in flash to the screen.
- show running-config
List the running configuration currently executing in RAM to the screen.
- copy running-config startup-config
Copy the currently running configuration to the startup configuration in flash to commit any changes you have made. The committed changes will persist even after rebooting the router.
- terminal length 24
Set the router to pause every 24 lines when displaying messages larger than 24 lines.
- terminal length 0
Set the router to not pause when display messages, no matter how long they are even if they scroll off the screen. This is sometimes handy when using a terminal emulator to capture a command with lots of output.
- reload
Reboot the router.
- write erase
Completely erase the startup configuration. Use with care!
- write
An old deprecated command that is a synonym for “copy running-config startup-config”
- write terminal
An old deprecated command that is a synonym for “show running-config”
Your assignment is to capture your router’s running configuration to a text file, erase the startup config and reboot so your router will have no configuration, then get the your text file config back into the router and commit the changes. Afterwards, verify that your router will reboot with the appropriate configuration. Use the following steps to guide you through the process.
1. Log into your router and go to enable mode.
2. Configure your terminal session to inhibit paging.
3. Configure your terminal emulator to capture text.
4. Display the running configuration to your screen while simultaneously capturing it to a text file.
5. Stop capturing text and edit the captured text file with a text editor, removing any extraneous text.
6. Completely erase your router’s startup configuration with “erase startup-config”
7. Reboot your router with “reload”
8. After rebooting, you may see an error message indicating that the startup configuration is missing and get prompted by the auto configuration dialog. You should be able to simply press control-C to cancel the dialog.
9. Log into your router, go to enable mode, and list the running configuration to your screen. Compared to your captured text file in step 5 and explain which part of the configuration is still there and which part is missing.
10. Go to global configuration mode and use copy and paste to put the configuration back into your router.
11. List the running configuration and compared to your saved configuration from step 5. How do they differ? Fix any differences so the running configuration is identical to your saved configuration from step 5.
12. Save your changes by copying the running configuration to the startup configuration.
13. Reboot your router and verify it reboots with the correct configuration.
14. Log into your router and go to enable mode. Configure your session to not page every 24 lines. Set your terminal emulator program to capture text. Display the running configuration to your screen while simultaneously capturing to a text file. Get the text file into some text editor and clean up any extraneous text.
PART4 – Miscellaneous Commands:
Read up on the following commands and try them out on your router. Provide a brief explanation of what each does.
1. telnet
2. ping
3. traceroute
4. show version
5. show clock
6. show diagbus
7. show interface
8. show ip interface brief
9. show ip routing
10. show ip protocol
telnet w.x.y.z
TELNET to a remote host or router w.x.y.z, just like UNIX.
ping w.x.y.z
PING a remote host or router w.x.y.z, just like UNIX.
traceroute w.x.y.z
Trace the route to remote host or router w.x.y.z, just like UNIX.
show version
Display the Cisco IOS software version and additional info.
show clock
Display the time/date according to the router’s internal clock.
show interface
Display all router interfaces including lots of status information.
show ip interface brief
Display all router interfaces briefly, one per line, including the up/down status and IP address if one is assigned.
show ip routing
Display the IP routing table.
show ip protocol
Display information any active IP routing protocols.
BASELINE ROUTER CONFIGURATION:
For completeness, here is a listing of the baseline router configuration mentioned in part 1 for routers R1, R2, R3, R4 and R5. The section labeled “COMMON:” is needed on all routers. The sections labeled “R1:”, “R2”, etc, are the router specific sections. These configurations should already be present on each router’s flash memory on file
“base-rX.cfg” where X is the integer identifier of the router.

COMMON:
service udp-small-servers
service tcp-small-servers
enable password cisco
no ip domain-lookup
no ip classless
logging buffered
snmp-server community public RO
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
password cisco
login
R1:
hostname r1
interface Loopback0
ip address 192.168.11.1 255.255.255.0
no shutdown
interface Fddi0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
interface Serial1/2
description Link to R2 S1/1
ip address 192.168.12.1 255.255.255.0
bandwidth 2000
no shutdown
interface Serial1/3
description Link to R3 S1/1
ip address 192.168.13.1 255.255.255.0
bandwidth 2000
no shutdown
interface Serial1/4
description Link to R4 S1/1
ip address 192.168.14.1 255.255.255.0
bandwidth 2000
no shutdown
interface Serial1/6
description Link to R6 S0
ip address 192.168.16.1 255.255.255.0
bandwidth 2000
no shutdown
interface E2/0
description Vlan 10 to cat1 FA0/1
ip address 192.168.10.1 255.255.255.0
no shutdown
interface E2/1
description Vlan 20 to cat1 FA0/2
ip address 192.168.20.1 255.255.255.0
no shutdown
interface E2/2
description Vlan 30 to cat1 FA0/3
ip address 192.168.30.1 255.255.255.0
no shutdown
interface E2/3
description Vlan 40 to cat1 FA0/4
ip address 192.168.40.1 255.255.255.0
no shutdown
interface E2/4
description Vlan 50 to cat1 FA0/5
ip address 192.168.50.1 255.255.255.0
no shutdown
interface E2/5
description Vlan 60 to cat1 FA0/6
ip address 192.168.60.1 255.255.255.0
no shutdown
router rip
network 192.168.11.0
network 192.168.12.0
network 192.168.13.0
network 192.168.14.0
network 192.168.16.0
network 192.168.1.0
network 192.168.10.0
network 192.168.20.0
network 192.168.30.0
network 192.168.40.0
network 192.168.50.0
network 192.168.60.0
R2:
hostname r2
interface Loopback0
ip address 192.168.22.2 255.255.255.0
no shutdown
interface Fddi0/0
ip address 192.168.1.2 255.255.255.0
no shutdown
interface Serial1/1
description Link to R1 S1/2
ip address 192.168.12.2 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/3
description Link to R3 S1/2
ip address 192.168.23.2 255.255.255.0
bandwidth 2000
no shutdown
interface Serial1/4
description Link to R4 S1/2
ip address 192.168.24.2 255.255.255.0
bandwidth 2000
no shutdown
router rip
network 192.168.12.0
network 192.168.22.0
network 192.168.23.0
network 192.168.24.0
network 192.168.1.0
R3:
hostname r3
interface Loopback0
ip address 192.168.33.3 255.255.255.0
no shutdown
interface Fddi0/0
ip address 192.168.1.3 255.255.255.0
no shutdown
interface Serial1/0
description Link to self
no ip address
bandwidth 2000
no shutdown
interface Serial1/1
description Link to R1 S1/3
ip address 192.168.13.3 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/2
description Link to R2 S1/3
ip address 192.168.23.3 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/3
description Link to self
no ip address
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/4
description Link to R4 S1/3
ip address 192.168.34.3 255.255.255.0
bandwidth 2000
no shutdown
interface Serial1/6
description Link to R6 S1
ip address 192.168.36.3 255.255.255.0
bandwidth 2000
no shutdown
router rip
network 192.168.33.0
network 192.168.13.0
network 192.168.23.0
network 192.168.34.0
network 192.168.36.0
network 192.168.1.0
R4:
hostname r4
interface Loopback0
ip address 192.168.44.4 255.255.255.0
no shutdown
interface Fddi0/0
description Link to R5 FDDI0
ip address 192.168.1.4 255.255.255.0
no shutdown
interface Serial1/1
description Link to R1 S1/4
ip address 192.168.14.4 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/2
description Link to R2 S1/4
ip address 192.168.24.4 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
interface Serial1/3
description Link to R3 S1/4
ip address 192.168.34.4 255.255.255.0
bandwidth 2000
clockrate 2000000
no shutdown
router rip
network 192.168.44.0
network 192.168.14.0
network 192.168.24.0
network 192.168.34.0
network 192.168.1.0
R5:
hostname r5
interface loopback0
ip address 192.168.55.5 255.255.255.0
no shutdown
interface FastEthernet0
description Vlan70 to cat1 FA0/7
ip address 192.168.70.1 255.255.255.0
media-type 100BaseX
no shutdown
interface Ethernet0
description Vlan80 to cat1 FA0/8
ip address 192.168.80.1 255.255.255.0
media-type 10BaseT
no shutdown
interface Ethernet1
description Vlan90 to cat1 FA0/9
ip address 192.168.90.1 255.255.255.0
media-type 10BaseT
no shutdown
interface Fddi0
description Link to R4 FDDI0/0
ip address 192.168.1.5 255.255.255.0
no keepalive
no shutdown
router rip
network 192.168.55.0
network 192.168.70.0
network 192.168.80.0
network 192.168.90.0
network 192.168.1.0

Read More