Check if autorecovery is enabled. Disabled by default.
Configure vlans
Note: Even when a switch port is changed from access to trunk, its access vlan is maintained in the config.
When automatic trunk negotiation fails (e.g. because I unplug a link between to switches and put it into
my laptop) the configured access vlan becomes active once again and I might be able to reach network parts
Iām not supposed to. Always disable DTP / trunk auto negotiation.
Layer2 Switch Vlan Config
Command
Description
(config)# [no] vlan 23
[delete vlan or] create vlan and enter config-vlan mode
(config-vlan)# name TelephoneSanitizer
Name this vlan TelephoneSanitizer
(config)# int g1/1
(config-if)# switchport mode access
Make frames out this port untagged
(config-if)# switchport access vlan 23
(config)# int g1/2
(config-if)# switchport mode trunk
Make frames out this port tagged by default
(config-if)# switchport trunk encapsulation dot1q
Sometimes the default is ciscos old isl.
(config-if)# switchport trunk native vlan 256
Except for vlan 256, which is still untagged.
(config-if)# switchport nonegotiate
Disable DTP
Layer3 Switch Vlan Config
Command
Description
(config)# interface vlan 23
enter interface config mode
(config-if)# ip address 1.2.3.4 255.255.255.0
set device ip in vlan 23
(config-if)# no shutdown
virtual interfaces are disabled by default
(config-if)# int g
(config)# no vlan 23
delete vlan 23
Router (on a Stick) Vlan Config
Command
Description
(config)# interface g1/1.10
Create subinterface g1/1.10 on g1/1
(config-subif)# encapsulation dot1q 10
enable ieee 802.1Q vlan tagging with vlan 10 on the subinterface
(config-subif)# ip address 10.0.10.1 255.255.255.0
# show vlans
Show vlans and their trunk interfaces
Troubleshoot Vlans on a switch
Command
Description
# show vlan [{id 23, name TelephoneSanitizer}] [brief]
Show vlan settings for all switch ports
# show interfaces g1/1 switchport
Verify mode and vlan of g1/1
# show interfaces g1/1 trunk
Show trunk settings and state
# show run interface vlan 1
Quick way to search the running config.
# show interface status
Show trunk mode / access vlan
# show dtp interface g1/1
Show current DTP mode for g1/1
VTP
Command
Description
(config)# vtp mode [server, client, transparent]
(config)# vtp domain
(config)# vtp password
(config)# vtp pruning
Troubleshoot VTP
Command
Description
show vtp status
show vtp domain, pruning, mode and more
show vtp password
STP
Spaning Tree Protocol (802.1D) blocks ports with redundant links to prevent layer 2 loops and broadcast storms.
Has the combined bandwidth and members as extra info.
# show etherchannel summary
Show etherchannel protocols and members as a list
# show etherchannel port-channel 1
Show per member state and stats
Configure a Serial
Layer 1 link speed is dictated by a CSU/DSU, in a lab without an external CSU/DSU a DTE (Data Terminal Equipment) cable and DCE (Data Communications Equipment) cable are used.
(config)# ip nat pool POOL 1.2.3.5 1.2.3.10 netmask 255.255.255.240
Create an IP Address Pool for NATing
(config)# ip nat inside source list 42 pool POOL
DNAT IPs matching ACL #42 1:1 with IPs from nat pool āPOOLā.
Note the missing overload.
PAT
The overload keyword means, that one or a couple of external IPs are to be used for multiple
internal IPs. Higher level information like connection port numbers are used to identify the
correct internal destination for incoming packets. Cisco calls this PAT, while this is what your
average joes home router would call NAT.
Enter config mode for vty 0 to 4 (up to 15 allowed).
(config)# line console 0
Enter config mode for the console port
(config-line)# login
Require login on telnet/console connection.
(config-line)# password
Enable Telnet and set vty login password.
(config-line)# access-class 10 in
Set ACL to limit inbound IPs allowed to access vty
(config-line)# access-class 42 in
Overwrite the used ACL, only one ACL per vty + direction!
(config-line)# exec-timeout 10
Autologout after 10 Minutes
(config-line)# login local
Require login on telnet/console connection via local users.
(config)# username h.acker secret C1sco123
Create local user with encrypted password.
SSH
Command
Description
(config)# hostname Foobar
Required to generate SSH keys.
(config)# ip domain-name example.com
Required to generate SSH keys.
(config)# crypto key generate rsa modulus 2048
Generate keys like itās 1995! Potentially takes forever.
(config)# ip ssh version 2
Force SSHv2
(config-line)# transport input ssh
Force ssh, disable telnet.
# show ip ssh
SSH version, timeout time, auth retries..
# show ssh
List of active connections
Clock
Command
Description
# show clock
Show time and date
(config)# clock set 23:50:42 10 Jan 2017
Update clock
(config)# clock timezone EST 0
Update timezone to EST
(config)# ntp server 10.20.30.40
Configure upstream ntp server.
(config)# ntp master [stratum]
Enable ntp server.
# show ntp associations
ntp connections.
# show ntp status
synchronized?, statum, ā¦
Disable unused services
Command
Description
# show control-plane host open-ports
Show open ports
(config)# no ip http server
Stop the http server (but not https).
(config)# no cdp enable
Stop CDP
# auto secure
Radius
Command
Description
(config)# username password
Local backup user.
(config)# aaa new-model
Enable aaa services.
(config)# radius server
Add and define Radius conf.
(config-radius-server)# address ipv4 [auth-port ]
Use this hostname/ip of server.
(config-radius-server)# key
Radius PSK
(config)# aaa group server radius
Create authentication group.
(config-sg-radius)# server name
Using the radius config.
(config)# aaa authentication login group local
Allow that group and local users in.
TACACS+
Command
Description
(config)# username password
Local backup user.
(config)# aaa new-model
Enable aaa services.
(config)# tacacs server
Add and define TACACS conf.
(config-server-tacacs)# address ipv4
(config-server-tacacs)# [port ]
(config-server-tacacs)# key
(config)# aaa group server tacacs+
Multiple possible.
(config-sg-tacacs+)# server name
(config)# aaa authentication login group local
Allow that group and local users in.
Syslog
Command
Description
# logging 10.20.30.40
Log to this syslog server (name or ip)
# logging trap informational
Only log messages with min. informational sev.
service sequence-number | Needed for seqence number in syslog messages
service time stamps log [datetime, log] | Needed for date and time in syslog messages
Enables cdp globaly and on all interfaces (default)
# (config-if)# [no] cdp enable
Enable cdp on an interface
# show cdp neighbors [detail]
List connected cisco devices (name, local/remote port, [ip] ..)
# show cdp entry *
LLDP - Link Layer Discovery Protocol
Command
Description
# [no] lldp run
Enables lldp globaly and on all interfaces
(config-if)# [no] lldp transmit
Enable lldp packet transmission on interface
(config-if)# [no] lddp receive
Enable lldp packet reception on interace
PPP
Command
Description
(config)# username fnord password pass
Create users for pap auth.
(config)# inteface S0/0/0
(config-if)# clock rate 125000
Baud rate. Only on DCE cable!
(config-if)# bandwidth 125
Logical speed used for routing cost calc, RSVPā¦
(config-if)# encapsulation ppp
Default is HDLC
(config-if)# ppp authentication pap
Require remote to authenticate via pap
(config-if)# ppp pap sent-username fnord password pass
Authenticate to remote pap
(config)# hostname routy1
Required for CHAP, used as chap client username
(config)# username routy2 password foobar
Create users for chap auth for routy2
(config)# inteface S0/0/0
(config-if)# no ppp authentication pap
Remove in favor of chap
(config-if)# no ppp pap sent-username fnord password pass
Remove in favor of chap
(config-if)# ppp authentication chap
Require remote to authenticate via chap
Note: When routy1 connects to routy2 it looks in itās local user database for a user named routy2 and uses that users password. This means the passwords have to be the same on both sides and the usernames must be the other sides hostname.
Troubleshooting PPP
Command
Description
# show controllers S0/0/0
interface, connected type of cable, clock rate
# show interfaces
encapsulation, logical bandwidth
# show ppp all
session state, auth type, peer ip and name
# debug ppp authentication
MLP
Command
Description
(config)# interface Multilink23
Create and configure virtual if
(config-if)# ip address 10.20.30.40 255.255.255.0
(config-if)# ppp multilink
Enable mlp
(conifg-if)# ppp multilink group 23
Make phys ifs with mlp #23 join.
(config)# interface s0/0/0
Configure phys ifs
(config-if)# no ip address
Remove ip addrs.
(config-if)# encapsulation ppp
(config-if)# ppp multilink
(config-if)# ppp multilink group 23
Join mlp group #23.
Troubleshooting MLP
Command
Description
show ppp multilink
Physical IFs,
PPPoE
Command
Description
(config)# interface Dialer23
Create and configure virtual dialer interface.
(config-if)# ip address negotiated
Get IP via PPP/IPCP
(config-if)# encapsulation ppp
(config-if)# dialer pool 23
The dialer interface is a member of one dialer poolā¦
(config)# interface s0/0/0
(config-if)# no ip address
(config-if)# pppoe-client dial-pool-number 23
ā¦ the pool is a group of one or more physical interfaces.
Troubleshooting PPPoE
Command
Description
# show ip interface brief
is the dialer if up? Does the dialer have an IP via IPCP?
# show pppoe session
Are PPPoE sessions established? Which ports.
GRE
Note: We can run OSPF and other routing protocols through this gre tunnel, as gre supports multicast.
Command
Description
(config)# interface tunnel23
(config-if)# ip address 192.168.1.1 255.255.255.0
transit net
(config-if)# tunnel source 10.20.30.40
local, can be linklocal
(config-if)# tunnel destination 6.5.4.3
remote, can be linklocal
tunnel mode gre ip
ip mtu
Troubleshooting GRE
Command
Description
# show ip interface brief tunnel23
Line hould be up, given a route to the destination.
# show inteface tunnel23
Tunnel source, dest, protocol
# show ip route
Should include the transit net as directly connected.
RIPv2
Command
Description
(config)# router rip
Enable RIP and enter itās config mode
(config-router)# version 2
Set RIPv2, which is Classless
(config-router)# network 192.168.0.0
Advertise connected networks which are within .
(config-router)# network 0.0.0.0
Advertise all connected networks.
(config-router)# timers basic
(config-router)# no auto-summary
Donāt summarize a smaller subnet route in a bigger one.
(config-router)# passive-interface g1/1
Donāt send RIP updates out this interface
(config-router)# passive-interface default
Donāt send RIP updates on any if by default
(config-router)# no passive-interface g1/2
Overwrite passive-interface default
(config-router)# default information originate
Advertise the default route.
(config-if)# no ip rip advertise 123
Troubleshooting RIPv2
Command
Description
# show ip[v6] protocols
Show rip timers, interfaces, networks,
# show ip rip database
Routes learned by rip, used to combile the routing table
# show ip route
Show learned routes
# clear ip route *
Get rid of all routes
EIGRP
Note: The network command enables any interface with an ip in that net to send and receive EIGRP updates. Also it enables routes to this nets to start beeing advertised.
Command
Description
# show run | section eigrp
Show EIGRP settings.
# show interfaces g1/1
Show configured/default bandwith and delay.
(config-if)# bandwidth
Overwrite bandwidth used for eigrp metric.
(config-if)# delay
Overwrite deplay used for eigrp metric.
(config)# router eigrp 23
Add and conf EIGRP AS#23
(config-router)# network 10.20.30.0 0.0.0.255
Announce routes to 10.20.30.0/24
(config-router)# no shutdown
On some iOS versions itās off by default.
(config-router)# [no] eigrp router-id
Defaults to highest loopback ip
(config-router)# [no] passive-interface g1/2
Disable EIGRP here. Ignore incoming pkgs.
(config-router)# [no] passive-interface default
Disable EIGRP on all ifs by default.
(config-router)# maximum-paths
Default 4, must match, number of loadbalanced paths.
(config-router)# variance 4
Default 1, Max 4:1 variance for unequal lb.
(config-router)# no auto-summary
Donāt summarize a smaller subnet route in a big one.
# show ip[v6] eigrp neighbors
Neighbor addr, if, hold time, uptime, queued pkgs
# show ip[v6] eigrp interfaces [if-name]
If, Number of peers, pending routes, queued pkgs
# show ip[v6] route [eigrp]
Routes starting with D were learned via EIGRP
# show ip[v6] eigrp topology [all-links]
Topology table, as#, router-id
EIGRP with ipv6
Command
Description
(config)# ipv6 unicast-routing
Enable v6 routing on the router
(config)# ipv6 router eigrp 23
Configure eigrp as #23
(config-rtr)# no shutdown
Enable this eigrp routing process.
(config-if)# [no] ipv6 eigrp 23
Enable eigrp with ipv6 for as #23 on this if.
OSPF
cost = reference bandwidth / interface bandwidth
The default reference bandwith is 100Mbps. Everything faster has a cost of 1.
Command
Description
(config)# router ospf 1
1 is the pid, not the area.
(config-router)# router-id 1.2.3.4
Defaults to highest IPv4 on lo, then other ifs.
(config-router)# network 10.20.30.0 0.0.0.255 area 0
(config-router)# auto-cost reference-bandwidth <refbw in Mb/s>
Change reference bandwidth speed
(config-if)# ip ospf cost 23
Overwrite interface cost to 23
(config-if)# bandwidth <bw in kb/s>
Change interface bandwidth
Router Types
Term
Definition
Internal Router
All OSPF interfaces in one area
Backbone Router
Has one or more OSPF interfaces in the backbone
Area Boundary Router (ABR)
Has at least one interface in the backbone area and at least one in another area
Autonomous System Boundary Router (ASBR)
Injects routes into OSPF via redistribution from other routing protocols
OSPF with ipv6 (OSPFv3)
Command
Description
(config)# ipv6 unicast-routing
(config)# ipv6 router ospf
(config-router)# router-id
Required if we donāt have any v4 addrs configured.
(config-if)# ipv6 ospf area
Required for OSPFv3.
The networks command does not exist, non mentioned commands are the same.
Troubleshooting OSPF
Command
Description
# show run | sect ospf
# show ip(v6) protocols
Other protocols with lower AD?
# show ipv6 ospf
reference bandwidth, router id, networks, interface per area
# show ip(v6) ospf neighbor
neighbor IDs, IPs and via interface.
# show ip(v6) ospf neighbor detail
dr, bdr, timers, ā¦
# show interface brief
admin down? link?
# show ip(v6) ospf interface brief
ospf enabled interfaces
# show ip(v6) ospf interface g1/1
ospf related infos for g1/1, passive?
# show ip(v6) route (ospf)
ospf routes are marked O, show route ad and cost
BGP
Note: In other routing protocols the network statement is used to determin the interfaces over which the protocol should talk to its neighbors. In BGP it indicates only which routes should be advertised to the BGP neighbors. The network needs to match an exact route in the routing table or it will still not be announced.
Command
Description
(config)# router bgp
Create routing process.
(config)# neighbor remote-as
BGP does not auto discover neighbors.
(config)# network [mask ]
Advertise this network.
Command
Description
# show run | sect bgp
# show ip bgp summary
neighbors IPs, ASs and session states, bgp version
# show ip bgp neighbors [peer-ip]
tcp sessions and timers, bgp parameters
# show ip bgp
routing infos received from all peers
CLI
Default Behavior
Here Iāll collect crazy default behaviors and how to fix them, I guess..
Command
Description
(config)# no ip domain-lookup
Donāt try to telnet unknown single word commands
Modes
Mode
Prompt
enter
User
>
N/A
Exec
#
> enable
Config
(config)#
# configure terminal
Interface
(config-if)#
(config)# interface g1/0
Line
(config-line)#
(config)# line vty 0 4
DHCP
(dhcp-config)#
(config)# ip dhcp pool Foobar
Filters
Name
Function
include hostname
find a line including āhostnameā
section interface
find a section including āinterfaceā
begin interface
Show remaining config starting with the first line containing āinterfaceā
exclude !
exclude all line containing ! (comments)
Navigation
Sequence
Function
Ctrl-Shfit-6
Kill many commands
Ctrl-Shift-6 x
Move telnet session to background
Esc-B
Ctrl-Left arrow
Esc-F
Ctrl-Right arrow
Ctrl-R
Redraw the current line
Ctrl-U
Erase line
Ctrl-W
Delete the word left of the cursor
Ctrl-C
Drop back to Exec, does not kill processes..
Ctrl-A
Move Cursor to the beginning of the line
Ctrl-E
Move Cursor to the end of the line
Tab
Autocompletion
?
Help, can be entered mostly everywhere
Packet Types
Ethernet Frame
Field
Field Length
Description
Preamble
8 bytes
Alternating 1s and 0s used to synchronize
Destination MAC (DA)
6 bytes
MAC of recipient
Source MAC (SA)
6 bytes
MAC of sender
802.1Q tag (optional)
4 bytes
Optional vlan tag. Starts with 0x8100 to mark 802.1Q mode in type location.
Type or Length
2 bytes
Layer three type OR length if smaler then 1536 bytes.
Data
46 - 1500 bytes
Payload
Frame check sequence (FCS)
4 bytes
32 bit CRC Checksum
IPv4 Header
Field
Field Length
Description
Version
4 bits
IP Version, always four
Internet Header Length (IHL)
4 bits
Length of the header
Service Type
8 bits
Desired QOS information (DSCP and ECN)
Total Length
2 bytes
Packet length, including this header
Identification
2 bytes
A unique ID
Flag
3 bits
fragmentation behaviour
Fragment Offset
13 bits
TTL
1 byte
TTL, decreased by every router by one.
Protocol
1 byte
Layer four type
Header Checksum
2 bytes
Options (optional)
16 bytes
Padding
max. 31 bits
Pad to the nearest 32 bit boundary
TCP Segment
Field
Field Length
Description
Source Port
2 bytes
Destination Port
2 bytes
Squence Number
4 bytes
Unique Number for this Segment
Acknowledgement Number
4 bytes
Next expected sequence number, acknowledge all prior Segments.
Header Lenght
4 bits
Header size in multiples of 4 bytes, sometimes also called Data Offset.
Reserved
3 bits
N/A
Flags
9 bits
Control Flags like SYN, ACK, FIN, RST and Flags for congestion control.
Window size
2 bytes
bytes sender is currently willing to receive
Checksum
2 bytes
Header Checksum
Urgent Pointer
2 bytes
Points to the last āurgentā byte in the Segment, used when URG flag is set.