Cisco Cookbook. Kevin Dooley and IanJ. Brown. O'REILLY 4 Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo

Transcription

1 Cisco Cookbook Kevin Dooley and IanJ. Brown O'REILLY 4 Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo

2 Table of Contents Preface xv 1. Router Configuration and File Management Configuring the Router via TFTP Saving Router Configuration to Server Booting the Router Using a Remote Configuration File Storing Configuration Files Larger than NVRAM Clearing the Startup Configuration Loading a New IOS Image Booting a Different IOS Image Booting Over the Network Copying an IOS Image to a Server Copying an IOS Image Through the Console Deleting Files from Flash Partitioning Flash Using the Router as a TFTP Server Using FTP from the Router Generating Large Numbers of Router Configurations Changing the Configurations of Many Routers at Once Extracting Hardware Inventory Information Backing Up Router Configurations Router Management Creating Command Aliases Managing the Router's ARP Cache Tuning Router Buffers Using the Cisco Discovery Protocol Disabling the Cisco Discovery Protocol 60

3 ii. 2.6 Using the Small Servers Enabling HTTP Access to a Router Using Static Hostname Tables Enabling Domain Name Services Disabling Domain Name Lookups Specifying a Router Reload Time Creating Exception Dump Files Generating a Report of Interface Information Generating a Report of Routing Table Information Generating a Report of ARP Table Information Generating a Server Host Table File User Access and Privilege Levels Setting Up User IDs Encrypting Passwords Using Better Encryption Techniques Removing Passwords from a Router Configuration File Deciphering Cisco's Weak Password Encryption Displaying Active Users Sending Messages to Other Users Changing the Number of VTYs Changing VTY Timeouts Restricting VTY Access by Protocol Enabling Absolute Timeouts on VTY Lines Implementing Banners Disabling Banners on a Port Disabling Router Lines Reserving a VTY Port for Administrative Access Restricting Inbound Telnet Access Logging Telnet Access Setting the Source Address for Telnet Automating the Login Sequence Using SSH for Secure Access Changing the Privilege Level of IOS Commands Defining Per-User Privileges Defining Per-Port Privileges 135 vi Table of Contents

4 4. TACACS Authenticating Login IDs from a Central System Restricting Command Access Losing Access to the TACACS+ Server Disabling TACACS+ Authentication on a Particular Line Capturing User Keystrokes Logging System Events Setting the IP Source Address for TACACS+ Messages Obtaining Free TACACS+Server Software Sample Server Configuration Files IP Routing Finding an IP Route Finding Types of IP Routes Converting Different Mask Formats Using Static Routing Floating Static Routes Using Policy-Based Routing to Route Based on Source Address Using Policy-Based Routing to Route Based on Application Type Examining Policy-Based Routing Changing Administrative Distances Routing Over Multiple Paths with Equal Costs RIP Configuring RIP Version Filtering Routes with RIP Redistributing Static Routes into RIP Redistributing Routes Using Route Maps Creating a Default Route in RIP Disabling RIP on an Interface Unicast Updates for RIP Applying Offsets to Routes Adjusting Timers Configuring Interpacket Delay Enabling Triggered Updates Increasing the RIP Input Queue Configuring RIP Version Enabling RIP Authentication RIP Route Summarization Route Tagging 223 Table of Contents vii

5 7. EIGRP Configuring EIGRP Filtering Routes with EIGRP Redistributing Routes into EIGRP Redistributing Routes into EIGRP Using Route Maps Creating a Default Route in EIGRP Disabling EIGRP on an Interface EIGRP Route Summarization Adjusting EIGRP Metrics Adjusting Timers Enabling EIGRP Authentication Logging EIGRP Neighbor State Changes Limiting EIGRP's Bandwidth Utilization EIGRP Stub Routing Route Tagging Viewing EIGRP Status OSPF Configuring OSPF Filtering Routes in OSPF Adjusting OSPF Costs Creating a Default Route in OSPF Redistributing Static Routes into OSPF Redistributing External Routes into OSPF Manipulating DR Selection Setting the OSPF RID Enabling OSPF Authentication Selecting the Appropriate Area Types Summarizing Routes in OSPF Disabling OSPF on Certain Interfaces OSPF Route Tagging Logging OSPF Adjacency Changes Adjusting OSPF Timers Viewing OSPF Status with Domain Names Debugging OSPF BGP Configuring BGP Using ebgp Multihop 321 viii Table of Contents

6 9.3 Adjusting the Next-Hop Attribute Connecting to Two ISPs Connecting to Two ISPs with Redundant Routers Restricting Networks Advertised to a BGP Peer Adjusting Local Preference Values Load Balancing Removing Private ASNs from the AS Path Filtering BGP Routes Based on AS Paths Reducing the Size of the Received Routing Table Summarizing Outbound Routing Information Prepending ASNs to the AS Path Redistributing Routes with BGP Using Peer Groups Authenticating BGP Peers Putting It All Together Frame Relay Setting Up Frame Relay with Point-to-Point Subinterfaces Adjusting LMI Options Setting Up Frame Relay with Map Statements Using Multipoint Subinterfaces Configuring Frame Relay SVCs Simulating a Frame Relay Cloud Compressing Frame Relay Data on a Subinterface Compressing Frame Relay Data with Maps Viewing Frame Relay Status Information Queueing and Congestion Fast Switching and CEF Setting the DSCP or TOS Field Using Priority Queueing Using Custom Queueing Using Custom Queues with Priority Queues Using Weighted Fair Queueing Using Class-Based Weighted Fair Queueing Controlling Congestion with WRED Using RSVP Using Generic Traffic Shaping Using Frame-Relay Traffic Shaping 419 Table of Contents

7 11.12 Using Committed Access Rate Implementing Standards-Based Per-Hop Behavior Viewing Queue Parameters Tunnels and VPNs Creating a Tunnel Tunneling Foreign Protocols in IP Tunneling with Dynamic Routing Protocols Viewing Tunnel Status Creating an Encrypted Router-to-Router VPN Generating RSA Keys Creating a Router-to-Router VPN with RSA Keys Creating a VPN Between a Workstation and a Router Check IPSec Protocol Status Dial Backup Automating Dial Backup Using Dialer Interfaces Using an Async Modem on the AUX Port Using Backup Interfaces Using Dialer Watch Ensuring Proper Disconnection View Dial Backup Status Debugging Dial Backup NTPandTime Timestamping Router Logs Setting the Time Setting the Time Zone Adjusting for Daylight Saving Time Synchronizing the Time on All Routers (NTP) Configuring NTP Redundancy Setting the Router as the NTP Master for the Network Changing NTP Synchronization Periods Using NTP to Send Periodic Broadcast Time Updates Using NTP to Send Periodic Multicast Time Updates Enabling and Disabling NTP Per Interface NTP Authentication Limiting the Number of Peers 522 Table of Contents

8 14.14 Restricting Peers Setting the Clock Period Checking the NTP Status Debugging NTP DLSw Configuring DLSw Using DLSw to Bridge Between Ethernet and Token Ring Converting Ethernet and Token Ring MAC Addresses Configuring SDLC Configuring SDLC for Multidrop Connections Using STUN Using BSTUN Controlling DLSw Packet Fragmentation Tagging DLSw Packets for QoS Supporting SNA Priorities DLSw+Redundancy and Fault Tolerance Viewing DLSw Status Information Viewing SDLC Status Information Debugging DSLw Router Interfaces and Media Viewing Interface Status Configuring Serial Interfaces Using an Internal Tl CSU/DSU Using an Internal ISDN PRI Module Using an Internal 56Kbps CSU/DSU Configuring an Async Serial Interface Configuring ATM Subinterfaces Setting Payload Scrambling on an ATM Circuit Configuring Ethernet Interface Features Configuring Token Ring Interface Features Connecting VLAN Trunks With ISL Connecting VLAN Trunks with 802.1Q Simple Network Management Protocol Configuring SNMP Extracting Router Information via SNMP Tools Recording Important Router Information for SNMP Access 617 Table of Contents

9 17.4 Extracting Inventory Information from a List of Routerswith SNMP Using Access Lists to Protect SNMP Access Logging Unauthorized SNMP Attempts Limiting MIB Access Using SNMP to Modify a Router's Running Configuration Using SNMP to Copy a New IOS Image Using SNMP to Perform Mass Configuration Changes Preventing Unauthorized Configuration Modifications Making Interface Table Numbers Permanent Enabling SNMP Traps and Informs Sending syslog Messages as SNMP Traps and Informs Setting SNMP Packet Size Setting SNMP Queue Size Setting SNMP Timeout Values Disabling Link Up/Down Traps per Interface Setting the IP Source Address for SNMP Traps Using RMON to Send Traps Enabling SNMPv Using SAA Logging Enabling Local Router Logging Setting the Log Size Clearing the Router's Log Sending Log Messages to Your Screen Using a Remote Log Server Enabling Syslog on a Unix Server Changing the Default Log Facility Restricting What Log Messages Are Sent to the Server Setting the IP Source Address for Syslog Messages Logging Router Syslog Messages in Different Files Maintaining Syslog Files on the Server Testing the Syslog Sever Configuration Preventing the Most Common Messages from Being Logged Rate-Limiting Syslog Traffic Access Lists Filtering by Source or Destination IP Address Adding a Comment to an ACL 697 xii I Table of Contents

10 19.3 Filtering by Application Filtering Based on TCP Header Flags Restricting TCP Session Direction Filtering Multiport Applications Filtering Based on DSCP and TOS Logging when an Access List Is Used Logging TCP Sessions Analyzing ACL Log Entries Using Named and Reflexive Access Lists Dealing with Passive Mode FTP Using Context-Based Access Lists DHCP Using IP Helper Addresses for DHCP Limiting the Impact of IP Helper Addresses Using DHCP to Dynamically Configure Router IP Addresses Dynamically Allocating Client IP Addresses via DHCP Defining DHCP Configuration Options Defining DHCP Lease Periods Allocating Static IP Addresses with DHCP Configuring a DHCP Database Client Configuring Multiple DHCP Servers per Subnet Showing DHCP Status Debugging DHCP NAT Configuring Basic NAT Functionality Allocating External Addresses Dynamically Allocating External Addresses Statically Translating Some Addresses Statically and Others Dynamically Translating in Both Directions Simultaneously Rewriting the Network Prefix Adjusting NAT Timers Changing TCP Ports for FTP Checking NAT Status Debugging NAT 767 Table of Contents I xiii

11 22. Hot Standby Router Protocol Configuring Basic HSRP Functionality Using HSRP Preempt Making HSRP React to Problems on Other Interfaces Load Balancing with HSRP Redirecting ICMP with HSRP Manipulating HSRP Timers Using HSRP on a Token Ring Network HSRP SNMP Support Increasing HSRP Security Showing HSRP State Information Debugging HSRP IP Multicast Configuring Basic Multicast Functionality with PIM-DM Routing Multicast Traffic with PIMSM and BSR Routing Multicast Traffic with PIM-SM and Auto-RP Configuring Routing for a Low Frequency Multicast Application Configuring CGMP Static Multicast Routes and Group Memberships Routing Multicast Traffic with MOSPF Routing Multicast Traffic with DVMRP DVMRP Tunnels Controlling Multicast Scope with TTL Using Administratively Scoped Addressing Exchanging Multicast Routing Information with MBGP Using MSDP to Discover External Sources Converting Broadcasts to Multicasts Showing Multicast Status Debugging Multicast Routing 846 A. External Software Packages 851 B. IP Precedence, TOS, and DSCP Classifications 855 Index 869 xiv I Table of Contents