Feb 112008
 

During baselining or troubleshooting activity you may need to determine out the CPU Utilization of your device. The following command show the 5 second, 1 minute, and 5 minute CPU Utilization of your device, and what processes are using the cpu.

  1. Connect to your Cisco IOS device via console, telnet or ssh (if enabled)
  2. Type in "show processes cpu" and press the enter key.


This command works on all Cisco IOS devices I’ve ever configured.

Feb 112008
 

This is for you folks that have an old 2900XL switch. So old that you need to troubleshoot, but you’ve forgotten the password to get in.
This was tested on 12.05 code.

1) Hold the "Mode" button while connecting the power cord (careful, electric current running through your body is very panful from what I’ve heard).
2) I let go of the button after 15 or 20 seconds, but there is an official number of seconds (see CCO at http://www.cisco.com).
3) You’ll be be dropped at the "switch:" prompt.
4) Type "flash_init" and press enter.
5) Type "load_helper" and press enter.
6) Type "rename flash:config.text flash:config.old" (or .new, or whatever you like that’s different from the original name :) ) and press enter.
7) Type "boot" and press enter.
8) When the switch boots up type "no" and press enter to bypass setup.
9) Press "Enter"
10) Type "rename flash:config.old flash:config.text" and press enter.
11) Type "copy flash:config.text system:running-config" and press enter.
12) Press "Enter".
13) Now you will be back to your old configuration.

Don’t forget to change you passwords to something you know, or you’ll be doing this all over again!

Feb 112008
 

In the following commands quotes are only used for illustration. They should not be typed as part of the command.

    1. Telnet to or Console into the Cisco Router or Switch running IOS.
    2. At the prompt, type "enable" and press enter to go to privileged mode.
    3. Type "config t" to go into configuration mode.
    4. Type username ‘theusername’ password ‘thepassword’ and press enter.

**Note – the actual username and password you want to configure should be typed in the command instead of ‘theusername’ and ‘thepassword’.

    5. Type "line vty 0 4" and press enter, to go into the vty configuration mode.
    6. Type "login local" and press enter.
    7. Type "exit" and press enter.
    8. Type "exit" and press enter.
    9. You should be back in privileged mode.
    10. Type "wr mem" to save the configuration options you just changed to nvram.
Feb 112008
 

This is a basic tasks that Network folks and SysAdmins who are responsible for their own LANs will find useful. This how to requires basic knowledge of vlans and trunks.

BTW, Nortel folks use the term "tagging" instead of "trunking."
If you’re not familiar with with those concepts http://www.cisco.com is a good place to search. Use the keywords trunking and vlans in your search.

  1. Connect to your Cisco switch running IOS. This will be console, telnet, or ssh depending on how you’ve set it up.
  2. Type "enable" and press Enter to go to "enable" mode.
  3. Type "config t" and press Enter to go to "configure" mode.
  4. Type "interface interface" to go to interface configuration mode for the interface you’ve chosen to be the trunk.
  5. Type "switchport" and press Enter to make the port a layer 2 port.
  6. Type "switchport trunk encapsulation dot1q" and press Enter to configure the trunk encapsulation on the port.

    ***Note – 802.1q is the standard and should be used especially if you are going to connect the other end of the trunk to a non-Cisco switch.

  7. Type "switchport mode trunk" and press Enter to configure the port as a trunk.

    You’ve now configured the port as an 802.1Q trunk that will tag traffic from all the vlans except VLAN1 (VLAN1 is Cisco’s default Native VLAN) as they exit the port.

  8. Type "exit" and press enter. Then Type "exit" and press enter again to get back to enable mode.
  9. Type "wri mem" and press Enter to save your configuration.
Feb 112008
 

This is the most commonly used method of restricting Telnet access to Cisco IOS-based Routers and Switches.

  1. Connect to your Cisco switch running IOS. This will be via console if you are configuring the router/switch for the first time.
  2. Type "enable" and press Enter to go to "enable" mode.
  3. Type "config t" and press Enter to go to "configure" mode.
  4. Type "line vty 0 4" and press Enter to go into line configuration mode.
  5. Type "login" and press Enter to configure the router/switch to present a password prompt when a user telnets to the device.
  6. Type password yourpassword" to configure the password you want to be used to access the router/switch.
  7. Type "exit" and press enter. Then Type "exit" and press enter again to get back to enable mode.
  8. Telnet to the router/switch and enter the password you configured above at the prompt., then press Enter.

    Only after a successful login should you go to the next step!

  9. Type "wri mem" and press Enter to save your configuration.
Feb 112008
 

How to configure an Extended Access List on Cisco Routers and IOS based Switches

Securing devices such as routers and switches from unauthorized access, restricting access between hosts or networks, protecting the perimeter of your network, and setting up IPSec tunnels are some of the tasks that require an understanding of access lists.

This short How To will show you how to configure an extended access list entry. The extended access list differs from standard access list in allowing you to configure source and destination IP Addresses, Source and Destination ports, and other parameters – including the times the access list is in effect (a very cool feature, in my opininion)!

This access list entry will be configured to allow the 192.168.1.0/24 network to send packets to the 10.1.1.0/24 network via IP. It will also log packets that match the access list, allowing you to determine whether traffic is flowing
from the 192.168.1.0/24 network to the 10.1.1.0/24 network.

***Note – the access entry is one way. If there is an access list configured on the return path, the source and destination networks in the access list entry below should be reversed and configured in that access list.

  1. Connect to your Cisco switch running IOS. This will be console, telnet, or ssh depending on how you’ve set it up.
  2. Type "enable" and press Enter to go to "enable" mode.
  3. Type "config t" and press Enter to go to "configure" mode.
  4. Type access-list 101 permit ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255 log and press Enter to configure the access-list entry.
  5. Type "interface interface" to go to interface configuration mode for the interface that the traffic from the 192.168.1.0/24 network will come through. Let’s assume for our purposes we are configuring the interface that is connected to the 192.168.1.0/24 network, and it is interface FastEthernet0/0.
  6. Type ip access-group 101 in.

    ***Note – because there is only one entry in the access list the 192.168.1.0/24 network will only be allowed to send packets to the 10.1.1.0/24 network. This is because in a Cisco access-list only traffic that is explicitly allowed will be passed through.

  7. Type "exit" and press enter. Then Type "exit" and press enter again to get back to enable mode.
  8. Type "wri mem" and press Enter to save your configuration.
Feb 112008
 

***Note – check your Cisco IOS device to see if sending Netflow is supported. I was surprised to find that some Cisco layer 3 switching platforms don’t currently support Netflow. An example is the Catalyst 3560.

In Global configuration mode:

  1. Type "ip flow-export destination ipaddress port" and press enter.
    ipaddress is the IP address of your Netflow Collector. port is the port your Netflow Collector listens on.
  2. Type "ip flow-export source interface" and press enter. interface is the interface/s you want to get statistics on.
  3. Type "ip flow-export version versionnumber" and press enter. versionnumber is the version of Netflow your Netflow Collector supports.

Under the interfaces you want to get statistics on:

  1. Type "ip route-cache flow" and press enter.

This configuration is specific to non-MLS devices. There will be an MLS specific Netflow HowTo shortly. :)

Feb 112008
 

**Note** – once you complete this procedure the startup configuration is gone from the IOS device. If you have not stored the configuration somewhere it’s lost for good!`

  1. Connect to the IOS device (Switch or Router) via telnet or Console.
  2. Type  “enable and press enter to go to privileged mode.
  3. Type  “write erase and press enter to clear the config from nvram.
  4. Typereload and press enter. When asked whether to save the configuration sayno.
    The IOS device will reboot and come back up with the default configuration.
  5. When the device comes back up. Go back into privileged mode (step 2 above).
  6. Typeconfig-register 0×2102 and press enter.
  7. Typewrite mem and press enter.

Now you can create a new configuration and it will be recognized if the IOS device is restarted.

Feb 102008
 

This quick how to is for those linux admin/users who have there Linux server accessible to the outside world.

Don’t you hate when those bots start hitting you with a ssh dictionary attack??? Well block using IPTABLES.

    • Here I will show you how to add the first rule in iptables…

    • The 1st rule we add is where we tell iptables to create a list called ssh_attempt and store the source ip of every recent ssh attempt on port 22 using tcp on interface eth0.
    • "iptables -A INPUT -i eth0 -p tcp -m tcp –dport 22 -m state –state NEW -m recent –set –name ssh_attempt –rsource"
    • step by step explanation..
    • iptables is the command that you use to enter the firewall rules in.
    • "-A INPUT" means APPEND to the INPUT chain
    • "-i eth0" means this rule will use the interface eth0
    • "-p tcp" means we are using the TCP protocol
    • "-m tcp" means we are matching the TCP protocol
    • "–dport 22" means we are matching based on the destination port 22
    • "-m state –state NEW" This rule will only apply to NEW incoming ssh connections not ESTABLISHED or RELATED.
    • "-m recent –set –name ssh_attempt –rsource" allows us to match packets based on recent events that we have previously matched and sets the name of the list , while saving the source ip address and port.
    • In this step we will show you how to deny those bots..

    • "iptables -A INPUT -i eth0 -p tcp -m tcp –dport 22 -m state –state NEW -m recent –update –seconds 10 –hitcount 2 –name ssh_attempt –rsource -j DROP"
    • The only difference in this rule is these options.
    • "–update –seconds 10 –hitcount 1 –name ssh_attempt" This will match true if the source is available in the specified list and it also updates the last-seen time in the list. The "–seconds 10" match is used to specify how long since the "last seen". The "–hitcount 2" will limit the match to only include packets that have seen at least the hitcount amount of packets.
Feb 102008
 

I will try to make this tutorial as general as possible, as I can give you the REDHAT way of doing things as concerns to where REDHAT base systems maintain there networking files or Gentoo based systems…etc

    • Lets start with the basics….

    • To view all your active network interface
      run this command "ifconfig"
    •   sabayon-dynasty ~ # ifconfig
      eth0
      Link encap:Ethernet HWaddr 00:0E:35:94:FB:D9
      inet addr:192.168.101.5 Bcast:192.168.101.255 Mask:255.255.255.0
      inet6 addr: fe80::20e:35ff:fe94:fbd9/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
      RX packets:2656195 errors:0 dropped:19 overruns:0 frame:0
      TX packets:1762149 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:3593125256 (3426.6 Mb) TX bytes:144856589 (138.1 Mb)
      Interrupt:10 Base address:0xe000 Memory:e0200000-e0200fff
    • Or you can be specific and run (ifconfig and the interface name)"ifconfig eth0"
    • Setup your network interfaces!

    • REDHAT WAYFor redhat based systems you will have to do this (assuming your network interface is eth0 and using DHCP)..
      "vi /etc/sysconfig/network-scripts/ifcfg-eth0"

      DEVICE=eth0
      BOOTPROTO=dhcp
      HWADDR=00:E0:81:24:CQ:82
      ONBOOT=yes
    • Now for a static ip setup (assuming eth0)..
      "vi /etc/sysconfig/network-scripts/ifcfg-eth0"


      DEVICE=eth0
      BROADCAST=192.168.101.255
      BOOTPROTO=static
      HWADDR=00:E0:81:24:CQ:82
      IPADDR=192.168.101.5
      NETMASK=255.255.255.0
      NETWORK=192.168.101.0
      ONBOOT=yes
      TYPE=Ethernet
    • Now run this "service network restart" or run this "ifdown eth0" to make sure the interface is down, then "ifup eth0"
    • GENTOO WAYFor gentoo based systems you will have to do this.

    • (assuming your network interface is eth0 and using DHCP)..
      "vi /etc/conf.d/net"


      config_eth0=( "dhcp" )
      dhcp_eth0="nosendhost"
      dns_domain_eth0="linuxdynasty"
    • Now for a static ip setup (assuming eth0)..
      "vi /etc/conf.d/net"


      config_eth0=( "192.168.0.2 netmask 255.255.255.0 broadcast 192.168.0.255" )
      routes_eth0=("default via 192.168.0.1") # IPv4 default route
    • Now run this "rc-update add net.eth0 default" so that it is in the default run level.
    • Now to get the interface up and running…
      "/etc/init.d/net.eth0 restart"

Warning: fopen(/home/dynasty/linuxdynasty.org/wp-content/plugins/wp-google-plus-one/lib/standard.txt) [function.fopen]: failed to open stream: No such file or directory in /home/dynasty/linuxdynasty.org/wp-content/plugins/wp-google-plus-one/plusone.php on line 104

Warning: fread(): supplied argument is not a valid stream resource in /home/dynasty/linuxdynasty.org/wp-content/plugins/wp-google-plus-one/plusone.php on line 105

Warning: fclose(): supplied argument is not a valid stream resource in /home/dynasty/linuxdynasty.org/wp-content/plugins/wp-google-plus-one/plusone.php on line 106
.