Knowledge Base

In this section learn how to set initial configuration in Cisco devices. You can also follow the video of this section on my channel on YouTube.

We have 3 modes in Cisco devices, namely:

In privilege mode, you can run show commands, while in global mode you can change configuration of switch.

vty lines are using for users to connect via SSH, Telnet. In other words, to enable SSH or Telnet, you have to use these lines. By default, Cisco breaks up vty lines into two segments:

• vty 0 – 4 (older devices)

• vty 5- 15

we have two options for setting password for the privilege mode:

• password which is in clear mode

• secret which is encryption mode

or

if you use password instead of secret with # show running-config command you can see the clear password. To encrypt the password use this command:

now if you look at running-config , everything has become encrypted.

by default, all Cisco devices have vlan 1, so in other section will know how to make a vlan. In this code, we set IP address 192.168.1.1 with subnet mask 255.255.255.0. Then, we use command no shutdown to enable interface.

if you have router and you want to access your Cisco switch to router for the Internet, you have to set default gateway.

you can shutdown ports for the range of ports. For example, range of 1 to 4 is shutdown by shutdown command.

use no shutdown or no shut to enable ports

you can set a banner for a switch with motd command. After motd you have to use kind of character and it can be * + | or anything. The important matter is that both character should be the same as the code it is shown

​

​

​

Mistype translating domain server

In Cisco devices, if you enter a some command wrong, by default try to map it to domain name and it takes 30 sec to do that. To prevent mistype, we use this command:

if you are working with Cisco command line, you can set session timeout with these command. In these examples, we set timeout to 10 seconds.

vty line:

line console:

to save your configuration you can run these two commands:

or

The first question is asked by those who are using Cisco devices for the first time is that how can I connect to Cisco devices. It needs kind of cable which is called rollover cable.

rollover cable contains RJ-45 and RS-232 and as it is demonstrated in below picture, RJ-45 is connected to switch and on the other hand RS-232 is connected to PC.

you can use kind of these software in PC to connect to switch through the console port. Putty is a famous software which supports SSH, Telnet, Serial.

I’ve uploaded a video in Youtube to become familiar how to connect rollover cable to switch and how to connect switch through Putty

To connect several vlans together, there is a model which is called “Router-on-a-stick“. This model has some advantages:

• Cost effective

• Easy to Implement

On the other hand, there are some drawbacks in this model:

• Congestion on link(bottleneck on trunk port)

• If router becomes down, network will down

As it is shown, first set an IP address for the PC0 and PC1. PC0 is on Vlan 10, while PC1 is on Vlan 20. Default Gateway of both PCs are set with the IP address of Vlan in Switch. For routing between to Vlan, Just we use “ip routing” command as it is shown in below code:

A trunk port is a port that is assigned to carry traffic for all the VLANs.Trunk send Untagged and Tagged information. There are two standards for Trunking:

• ISL(Cisco)

• 802.1Q(Industry Standard) is 4 Byte which is considered without Native Vlan

Example:

For changing Native Vlan just write:

To allow specific vlan just write:

In above-mentioned code, just vlan 10, 20, 30 allowed through trunk port

A virtual LAN (Local Area Network) is a logical subnetwork that can group together a collection of devices from different physical LAN.

Imagine that we have different departments on your company and you want to separate each department based on their employees. So, with the VLAN concept you can create a VLAN and then assign different ports to these VLANs.

In the above picture, we have 3 departments, each of which is assigned to unique VLAN. let’s configure switch:

For viewing created VLANs, we enter this command:

In above picture, a PC in VLAN 10 is connected to port Fa0/1 switch. So, we can write this command to access port Fa0/1 to VLAN 10:

Now, if we enter show vlan:

Now we do it for other ports:

and the result is:

By default in Cisco switches , Vlan 1 is a native Vlan. It means, untagged traffic carries in this vlan. We’ll know how to change Native Vlan.

Sometimes it is necessary to have policy and separate your Vlan like below diagram. In this diagram, WWW and FTP server have communication together, so we put in community. On the other hand, SQL server shouldn’t be seen by FTP or WWW server, so, we put on isolated. In fact, there are three types of sub Vlan in Private Vlan:

• Promiscuous: can be reached by sub Vlan

• Isolated : can not be seen by other Vlans

• Community: only can see community member

Imagine we want to make primary vlan for these sub Vlan. We make a Vlan “100” as a primary:

Then, make sub Vlan for www and FTP as 101 and SQL as 102

After that, we put www, FTP and SQL in primary Vlan:

Next, we assign interface to each Vlan

To use show command:

To prevent loop between switches, Cisco uses Spanning-Tree protocol. STP is the simplest and oldest protocol which is enable by default in Cisco devices. STP is a industry standard which is used by other vendors to prevent loops in devices.

STP uses BPDU(bridge protocol data unit) to detect loops in devices. If there is any loops in Cisco devices, block redundant links. As you can see in figure 1, we have 3 switches with the same priority and in the root bridge selection, switch with the lowest priority selects as a root bridge. Now, we have the same priority, so the second feature in root bridge selection is the lowest Mac-Address. Therefore, switch A becomes root bridge and switch B and C use their shortest path to reach root bridge. This port is called root port. Then, we have selection between switch B and C, as we mentioned, switch B has the lowest Mac-Address, so it becomes Designated port and in switch C connection will be blocked.

We can configure switch for STP and change the priority or make a switch as primary root:

you can use show command to see the root or states of connections:

This is the same idea of STP . The only difference here is using in Vlan instead of STP. The delay in receiving BPDUs can cause problems like convergence time problems. Per-VLAN Spanning Tree (PVST) is a solution for these problems. PVST operates a separate instance of STP for each individual VLAN . So, it helps load-balancing more efficiently.

Cisco enhanced the original 802.1D specification with features such as Uplink Fast, Backbone Fast, and Port Fast to speed up the convergence time of a bridged network. In RSTP we have five states, namely:

It means, by removing listening states now convergence takes on 30 seconds. To configure, simply add:

As you see in Figure 2, we have Alternate port instead of block port in RSTP. Also, RSTP can detect edge port and separate root port from edge port.

PortFast causes a switch or trunk port to enter the spanning tree forwarding state immediately, bypassing the listening and learning states.

You can use PortFast on switch or trunk ports that are connected to a single workstation, switch, or server to allow those devices to connect to the network immediately, instead of waiting for the port to transition from the listening and learning states to the forwarding state.

The most secure implementation of PortFast is to enable it only on ports that connect end stations to switches. To config it:

PortFast BPDU guard prevents loops by moving a nontrunking port into an errdisable state when a BPDU is received on that port. When you enable BPDU guard on the switch, spanning tree shuts down PortFast-configured interfaces that receive BPDUs. Cisco recommend every ports connected to endpoint devices should have BPDU guard. BPDU guard:

• Change the interface to errdisable state

• Prevent from receiving BPDU

To enable BPDU guard:

While, BPDU filtering allows you to avoid transmitting BPDUs on PortFast-enabled ports that are connected to an end system. When you enable PortFast on the switch, spanning tree places ports in the forwarding state immediately, instead of going through the listening, learning, and forwarding states. BPDU filtering:

• Prevent from sending and receiving BPDU

• Stop spanning-tree in the interface

BPDU guard and root guard are similar, but their impact is different. BPDU guard disables the port upon BPDU reception if PortFast is enabled on the port. The disablement effectively denies devices behind such ports from participation in STP. You must manually reenable the port that is put into errdisable state or configure errdisable-timeout.

Root guard allows the device to participate in STP as long as the device does not try to become the root. If root guard blocks the port, subsequent recovery is automatic. Recovery occurs as soon as the offending device ceases to send superior BPDUs.

When one of the ports in a physically redundant topology no longer receives BPDUs, the STP conceives that the topology is loop free. Eventually, the blocking port from the alternate or backup port becomes designated and moves to a forwarding state. This situation creates a loop.

The loop guard feature makes additional checks. If BPDUs are not received on a non-designated port, and loop guard is enabled, that port is moved into the STP loop-inconsistent blocking state, instead of the listening / learning / forwarding state. Without the loop guard feature, the port assumes the designated port role. The port moves to the STP forwarding state and creates a loop.

MST extends the IEEE 802.1w rapid spanning tree (RST) algorithm to multiple spanning trees. This extension provides both rapid convergence and load balancing in a VLAN environment. MST converges faster than Per VLAN Spanning Tree Plus (PVST+) and is backward compatible with 802.1D STP, 802.1w (Rapid Spanning Tree Protocol [RSTP]), and the Cisco PVST+ architecture.

MST allows you to build multiple spanning trees over trunks. You can group and associate VLANs to spanning tree instances. Each instance can have a topology independent of other spanning tree instances. This architecture provides multiple forwarding paths for data traffic and enables load balancing. Network fault tolerance is improved because a failure in one instance (forwarding path) does not affect other instances.

In large networks, you can more easily administer the network and use redundant paths by locating different Vlan and spanning tree instance assignments in different parts of the network.

MST includes some regions and each region contains Vlans. As it shown in below code, we have different instances and in each instance we have Vlans. If Vlans don’t have any instance, it goes to instance 0.

to show mst configuration:

To sniff or to analyse traffic on specific port or Vlan you can use SPAN. As it is shown in Figure 1, we want to have traffic of FastEthernet0/1 on port FastEthernet0/10. So, simple we can define monitor session for interface FastEthernet0/1 as a source and FastEthernet0/10 as a destination.

This is exactly the same scenario of SPAN, but here we remotely monitor a port in switch. First, you have to define separate Vlan between two switches. Then, you can specify source and destination.

NetFlow is a networking analysis protocol that gives the ability to collect detailed information about network traffic as it flows through a router interface. NetFlow helps network administrators answers the questions of who (users), what (application), when (time of day), where (source and destination IP addresses) and how network traffic is flowing.

+NetFlow Monitor: a component applied to an interface and collects information about flows. Flow monitors consist of a record and a cache. You add the record to the flow monitor after the flow monitor is created. In the topology above, we can apply the NetFlow Monitors to the s0/0, Fa0/0 and Fa0/1 interfaces of the router to collect traffic information of these interfaces + NetFlow Exporter: aggregates packets into flows, stores IP flow information in its NetFlow cache and exports them in the form of flow records to the NetFlow collector + NetFlow Collector: collects flow records sent from the NetFlow exporters, parsing and storing the flows. Usually a collector is a separate software running on a network server. NetFlow records are exported to a NetFlow collector using User Datagram Protocol (UDP) + NetFlow Sampler: used to reduce the number of packets that are selected for analysis. It is applied to a NetFlow Monitor to reduce the overhead load because the number of packets that the flow monitor must analyze is reduced. But notice that the accuracy of the information stored in the flow monitor’s cache is also reduced correspondingly.

When packets arrive at the NetFlow Exporter, each of them is inspected for one or many IP packet attributes. These attributes are used to determine if the packet is unique or similar to other packets. If it is similar then it is classified as in the same flow.

There are seven key IP packet attributes that can be used by NetFlow to classify packets into separate flows: + IP source address + IP destination address + Source port + Destination port + Layer 3 protocol type + Class of Service (or Type of Service – ToS) Byte + Input (Router or switch) interface

Other attributes can be also used and they are called non-key attributes such as timestamps, packet and byte counters, TCP flag information…

After inspecting these attributes, the NetFlow Exporter condenses them into flow records and save in a database called the NetFlow cache. These flow records can also be exported to a NetFlow Collector.

How to view NetFlow data

There are two main methods to view NetFlow data:

+ Command Line Interface (CLI): Because the NetFlow cache is a part of the NetFlow Exporter so we can view this cache directly via the Command-Line-Interface (CLI), which is very useful for troubleshooting, with the “show ip cache flow” command. An example output of this command is shown below:

+ A NetFlow reporting tool: there are many tools that can collect NetFlow packets sent to the NetFlow Collector and display a comprehensive view. Below is an example of what SolarWinds NetFlow Traffic Analyzer can analyze:

Version 1: the original format supported in the initial NetFlow releases. Versions 2, 3 and 4 were not released. Version 5: an enhancement that adds Border Gateway Protocol (BGP) autonomous system information, flow sequence numbers and a few additional fields. This is the standard and most common NetFlow version. Only support IPv4. Version 6: similar to version 7 Version 7: Cisco-specific version for Catalyst 5000 series switches but not compatible with Cisco routers Version 8: choice of aggregation schemes in order to reduce resource usage Version 9: support flow-record format and it is known as Flexible NetFlow technology. NetFlow version 9 includes a template to describe what is being exported. It supports extensible file export format to enable easier support. It also supports additional fields & technologies such as MPLS, IPv6, IPSec, NBAR protocols, Multicast, VLAN ID…

In general, the two most important NetFlow versions are Version 5 and Version 9 which we will learn how to configure them.

To configure NetFlow version 9 (Flexible NetFlow), we need to configure three components: 1. Flow Record 2. Flow Exporter 3. Flow Monitor

The following configuration enables NetFlow version 9 on Fa0/1 interface and export to a NetFlow collector at 10.1.1.1 on UDP port 2055.

1. Configure the Flow Record:

2. Configure the Exporter:

3. Configure the Exporter:

4. Apply to an interface

SNMP is an application-layer protocol that provides a message format for communication between managers and agents. The SNMP system consists of:

• an SNMP manager,

• an SNMP agent,

• and a MIB.

The SNMP agent contains MIB variables whose values the SNMP manager can request or change. A manager can get a value from an agent or store a value into the agent. The agent gathers data from the MIB, the repository for information about device parameters and network data. The agent can also respond to a manager’s requests to get or set data.

An agent can send unsolicited traps to the manager. Traps are messages alerting the SNMP manager to a condition on the network. Traps can mean improper user authentication, restarts, link status (up or down), MAC address tracking, closing of a TCP connection, loss of connection to a neighbor, or other significant events.

configuring SNMPV2 is so simple, just write :

configuring SNMPV3 needs three steps:

1- Defining View

2- Defining Group

3- Defining User

PRTG is really good tool for grabbing information from devices which are working with SNMP. You can download this software and connecting around 100 sensors are free. In other word, you can use it for small business.

1-First, Add a New Device, and IPV4 address.

2- Second, Select SNMP version, type of Authentication(SHA-MD5) and enter your username and password.

3- Third, enter encryption type and Pre-shared key.

4- Add your desire sensor, there are alot of sensors for different devices, for example I add ping to this device.

TACACS+ and Radius is a security application that provides centralized validation of users attempting to gain access to a router or network access server. In Table 1 main difference between TACACS and Radius are mentioned:

To configure Radius or TACACS+ , first we define a new model and then we use dot1x authentication:

EtherChannel is a port link aggregation technology or port-channel architecture used primarily on Cisco switches. It allows grouping of several physical Ethernet links to create one logical Ethernet link for the purpose of providing fault-tolerance and high-speed links between switches, routers and servers(wiki).

There are two protocols in ether-channel:

• PAGP (Cisco proprietary )

  • on

  • auto

  • desirable

• LACP(Industry Standard)(802.3AD)

  • on

  • active

  • passive

To implement layer 2 PAGP:

To implement layer 2 LACP:

In layer3, we use virtual ip address in port channel to define PAGP:

Routing is a huge concept in Cisco and I don’t want to dive into routing protcols concept, but I want to focus on simple routing which is called Static Routing. To know this concept look at this diagram. In static routnig, to reach from network1 to network2 , you need to define networks in router1 and router 2.

R1 knows just their interfaces, for reaching to network 192.168.3.0/24, we use interface 192.168.2.2, therefore we write:

R2 knows just their interfaces, for reaching to network 192.168.1.0/24, we use interface 192.168.2.1, therefore we write:

Dynamic Host Configuration Protocol (DHCP) is a protocol to dynamically giva an IP address to different devices. In cisco, defining DHCP is following these steps:

1. Define DHCP exclude-address: We separate unwanted address in DHCP

2. Define DHCP Pool : We define DHCP pool which is assigned to clients

3. Define network, dns-server and default router

In Cisco switches, you can limit PCs based on their Mac-address. Port security enhances the security in Cisco devices

Let’s implement a scenario to learn more about port security:

Senario 1: In company A, we want to define port-security to learn mac-address of all PCs on the nework and maximum each port has to learn maximum two mac-address. In a case of violation, ports should shutdown immediately.

You can use these commands to see port security:

SSH, also known as Secure Socket Shell, is a network protocol that provides administrators with a secure way to access a remote computer.

To have a secure connection to Cisco devices, we don’t use Telnet. Because Telnet sends the password in plain Text. If you use kind of sniffer tools such as Wireshark, you can see exact password is passing to the device. So, for having secure connection all system administrators use SSH.

There are 5 steps for creating SSH connection, which are namely:

1. Create a hostname

2. Create a domain name

3. Generate RSA key

4. Create a local account

5. Allow SSH in vty line

In line 4, length of RSA key depends on the device. Some devices support more than 1024 or 2048.

In line 6, you can use password or secret, as I told you in previous section, secret encrypts your password in running-config, but password is shown in clear text.

In line 8, you can select telnet, ssh or both of them to allow in vty line. In other words, if you select all, ssh users and telnet users can connect through vty line

VTP is a layer 2 messaging protocol which is a Cisco proprietary protocol that propagates the definition of Virtual Local Area Networks (VLAN) on the whole local area network. VTP minimizes misconfigurations and configuration inconsistencies that can result in a number of problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations.

There are three versions of VTP, namely version 1, version 2, version 3. All feature of 3 versions of VTP is shown in Table1

There are three main modes in VTP:

• Server : This is a default mode of VTP. You can create, modify, and delete VLANs and specify other configuration parameters (such as VTP version and VTP pruning) for the entire VTP domain. VTP servers advertise their VLAN configuration to other network devices

• Client: VTP clients behave the same way as VTP servers, but you cannot create, change, or delete VLANs on a VTP client.

• Transparent: VTP transparent network devices do not participate in VTP. A VTP transparent network device does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, in VTP version 2, a transparent network device will forward received VTP advertisements from its trunking LAN ports. In VTP version 3, a transparent network device is specific to an instance.

Example:

We want to make a Vlan in Switch 1 and change its mode to server mode. Between Switch 1 and Switch 2, we use trunk port and then set Switch 2 mode for VTP to client.

to see status of VTP:

Now if you check, switch2 , you can see Vlan 10, 20 are made automatically.

VTP pruning enhances network bandwidth use by reducing unnecessary flooded traffic, such as broadcast, multicast, unknown, and flooded unicast packets. VTP pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. By default, VTP pruning is disabled.

As you can see in above pictures, traffic with and without VTP Pruning is demonstrated. To enable VTP pruning:

In Cisco we have two types of access-list:

• Standard

  • It’s based on source address

  • It uses lower process utilization

• Extended

  • It’s based on source/destination and port number

  • It uses high process utilization

Imagine in router 2, we want to deny any packets come from network 192.168.3.0/24. To prevent these packet based on standard access-list just pay attention to source:

In this command, first, we define access-list and write it as 10. This number should between 1 to 99 . Then, we deny every source address in network 192.168.3.0/24. In access-list, we always use wildcard mask instead of netmask. To know wildcard mask, just substract 255.255.255.255 from network mask , the result shows wildcard mask.

Next, we permit others to access network. If you forget to write line 2, all network will be down. Because you forbid any connections from router 2.

After that, we have to associate access-list to router interface. We have inbound and outbound, in this example, we are entering from network 192.168.3.0/24 to router 2. So, we write access-list in inbound of router.

The best practise we can bring here, is our previous router-on-a-stick. In above example, we have two PCs which can communicate together through router 0. Switch 0 is connected to Router0 through trunk port. PCs IP address is:

• PC0

  • IP Address: 192.168.10.2

  • Netmask: 255.255.255.0

  • Default Gateway: 192.168.10.1

• PC1

  • IP Address: 192.168.20.2

  • Netmask: 255.255.255.0

  • Default Gateway: 192.168.20.1

Now, we want to forbid every packet goes from vlan 10 to vlan 20 and vice versa. So, we can define access-list based on source and destination. In extended access-list, you have to follow these rules:

1- Protocol –> Source Address–> Destination Address –> Port

2- Extended access-list starts from 100-199

This is for Vlan 10 which bans every packet from network 192.168.10.0/24 to 192.168.20.0/24. We define protocol, IP. It means, any related protocol to IP such as ftp, web, ….. In other words, I ban all protocols of IP.

For Vlan 20, we have:

Then, we access above-mentioned access-list to int fa0/0.10 and fa0/0.20: