Cisco Cookbook Kevin Dooley and IanJ. Brown O'REILLY 4 Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo
Table of Contents Preface xv 1. Router Configuration and File Management 1 1.1 Configuring the Router via TFTP 4 1.2 Saving Router Configuration to Server 5 1.3 Booting the Router Using a Remote Configuration File 7 1.4 Storing Configuration Files Larger than NVRAM 10 1.5 Clearing the Startup Configuration 12 1.6 Loading a New IOS Image 15 1.7 Booting a Different IOS Image 18 1.8 Booting Over the Network 22 1.9 Copying an IOS Image to a Server 24 1.10 Copying an IOS Image Through the Console 25 1.11 Deleting Files from Flash 27 1.12 Partitioning Flash 29 1.13 Using the Router as a TFTP Server 31 1.14 Using FTP from the Router 33 1.15 Generating Large Numbers of Router Configurations 34 1.16 Changing the Configurations of Many Routers at Once 37 1.17 Extracting Hardware Inventory Information 41 1.18 Backing Up Router Configurations 43 2. Router Management 47 2.1 Creating Command Aliases 47 2.2 Managing the Router's ARP Cache 50 2.3 Tuning Router Buffers 52 2.4 Using the Cisco Discovery Protocol 57 2.5 Disabling the Cisco Discovery Protocol 60
ii. 2.6 Using the Small Servers 62 2.7 Enabling HTTP Access to a Router 66 2.8 Using Static Hostname Tables 68 2.9 Enabling Domain Name Services 70 2.10 Disabling Domain Name Lookups 72 2.11 Specifying a Router Reload Time 75 2.12 Creating Exception Dump Files 77 2.13 Generating a Report of Interface Information 80 2.14 Generating a Report of Routing Table Information 83 2.15 Generating a Report of ARP Table Information 85 2.16 Generating a Server Host Table File 87 3. User Access and Privilege Levels 90 3.1 Setting Up User IDs 91 3.2 Encrypting Passwords 94 3.3 Using Better Encryption Techniques 96 3.4 Removing Passwords from a Router Configuration File 97 3.5 Deciphering Cisco's Weak Password Encryption 99 3.6 Displaying Active Users 102 3.7 Sending Messages to Other Users 104 3.8 Changing the Number of VTYs 106 3.9 Changing VTY Timeouts 108 3.10 Restricting VTY Access by Protocol 109 3.11 Enabling Absolute Timeouts on VTY Lines 111 3.12 Implementing Banners 112 3.13 Disabling Banners on a Port 115 3.14 Disabling Router Lines 116 3.15 Reserving a VTY Port for Administrative Access 118 3.16 Restricting Inbound Telnet Access 120 3.17 Logging Telnet Access 121 3.18 Setting the Source Address for Telnet 122 3.19 Automating the Login Sequence 123 3.20 Using SSH for Secure Access 126 3.21 Changing the Privilege Level of IOS Commands 129 3.22 Defining Per-User Privileges 132 3.23 Defining Per-Port Privileges 135 vi Table of Contents
4. TACACS+ 137 4.1 Authenticating Login IDs from a Central System 139 4.2 Restricting Command Access 142 4.3 Losing Access to the TACACS+ Server 143 4.4 Disabling TACACS+ Authentication on a Particular Line 145 4.5 Capturing User Keystrokes 147 4.6 Logging System Events 148 4.7 Setting the IP Source Address for TACACS+ Messages 150 4.8 Obtaining Free TACACS+Server Software 151 4.9 Sample Server Configuration Files 152 5. IP Routing 156 5.1 Finding an IP Route 159 5.2 Finding Types of IP Routes 160 5.3 Converting Different Mask Formats 162 5.4 Using Static Routing 167 5.5 Floating Static Routes 170 5.6 Using Policy-Based Routing to Route Based on Source Address 172 5.7 Using Policy-Based Routing to Route Based on Application Type 176 5.8 Examining Policy-Based Routing 179 5.9 Changing Administrative Distances 180 5.10 Routing Over Multiple Paths with Equal Costs 183 6. RIP 186 6.1 Configuring RIP Version 1 187 6.2 Filtering Routes with RIP 190 6.3 Redistributing Static Routes into RIP 194 6.4 Redistributing Routes Using Route Maps 197 6.5 Creating a Default Route in RIP 199 6.6 Disabling RIP on an Interface 201 6.7 Unicast Updates for RIP 203 6.8 Applying Offsets to Routes 205 6.9 Adjusting Timers 207 6.10 Configuring Interpacket Delay 210 6.11 Enabling Triggered Updates 212 6.12 Increasing the RIP Input Queue 214 6.13 Configuring RIP Version 2 215 6.14 Enabling RIP Authentication 217 6.15 RIP Route Summarization 220 6.16 Route Tagging 223 Table of Contents vii
7. EIGRP 225 7.1 Configuring EIGRP 226 7.2 Filtering Routes with EIGRP 230 7.3 Redistributing Routes into EIGRP 234 7.4 Redistributing Routes into EIGRP Using Route Maps 238 7.5 Creating a Default Route in EIGRP 239 7.6 Disabling EIGRP on an Interface 241 7.7 EIGRP Route Summarization 243 7.8 Adjusting EIGRP Metrics 245 7.9 Adjusting Timers 248 7.10 Enabling EIGRP Authentication 249 7.11 Logging EIGRP Neighbor State Changes 251 7.12 Limiting EIGRP's Bandwidth Utilization 253 7.13 EIGRP Stub Routing 254 7.14 Route Tagging 255 7.15 Viewing EIGRP Status 257 8. OSPF 261 8.1 Configuring OSPF 266 8.2 Filtering Routes in OSPF 268 8.3 Adjusting OSPF Costs 270 8.4 Creating a Default Route in OSPF 272 8.5 Redistributing Static Routes into OSPF 275 8.6 Redistributing External Routes into OSPF 277 8.7 Manipulating DR Selection 279 8.8 Setting the OSPF RID 281 8.9 Enabling OSPF Authentication 283 8.10 Selecting the Appropriate Area Types 288 8.11 Summarizing Routes in OSPF 296 8.12 Disabling OSPF on Certain Interfaces 299 8.13 OSPF Route Tagging 300 8.14 Logging OSPF Adjacency Changes 302 8.15 Adjusting OSPF Timers 303 8.16 Viewing OSPF Status with Domain Names 305 8.17 Debugging OSPF 306 9. BGP 307 9.1 Configuring BGP 315 9.2 Using ebgp Multihop 321 viii Table of Contents
9.3 Adjusting the Next-Hop Attribute 322 9.4 Connecting to Two ISPs 324 9.5 Connecting to Two ISPs with Redundant Routers 327 9.6 Restricting Networks Advertised to a BGP Peer 330 9.7 Adjusting Local Preference Values 333 9.8 Load Balancing 338 9.9 Removing Private ASNs from the AS Path 339 9.10 Filtering BGP Routes Based on AS Paths 341 9.11 Reducing the Size of the Received Routing Table 345 9.12 Summarizing Outbound Routing Information 347 9.13 Prepending ASNs to the AS Path 351 9.14 Redistributing Routes with BGP 353 9.15 Using Peer Groups 357 9.16 Authenticating BGP Peers 358 9.17 Putting It All Together 360 10. Frame Relay 364 10.1 Setting Up Frame Relay with Point-to-Point Subinterfaces 367 10.2 Adjusting LMI Options 371 10.3 Setting Up Frame Relay with Map Statements 373 10.4 Using Multipoint Subinterfaces 376 10.5 Configuring Frame Relay SVCs 377 10.6 Simulating a Frame Relay Cloud 380 10.7 Compressing Frame Relay Data on a Subinterface 382 10.8 Compressing Frame Relay Data with Maps 385 10.9 Viewing Frame Relay Status Information 386 11. Queueing and Congestion 389 11.1 Fast Switching and CEF 393 11.2 Setting the DSCP or TOS Field 396 11.3 Using Priority Queueing 400 11.4 Using Custom Queueing 402 11.5 Using Custom Queues with Priority Queues 406 11.6 Using Weighted Fair Queueing 407 11.7 Using Class-Based Weighted Fair Queueing 409 11.8 Controlling Congestion with WRED 411 11.9 Using RSVP 415 11.10 Using Generic Traffic Shaping 418 11.11 Using Frame-Relay Traffic Shaping 419 Table of Contents
11.12 Using Committed Access Rate 421 11.13 Implementing Standards-Based Per-Hop Behavior 426 11.14 Viewing Queue Parameters 429 12. Tunnels and VPNs 432 12.1 Creating a Tunnel 437 12.2 Tunneling Foreign Protocols in IP 441 12.3 Tunneling with Dynamic Routing Protocols 442 12.4 Viewing Tunnel Status 446 12.5 Creating an Encrypted Router-to-Router VPN 447 12.6 Generating RSA Keys 454 12.7 Creating a Router-to-Router VPN with RSA Keys 458 12.8 Creating a VPN Between a Workstation and a Router 461 12.9 Check IPSec Protocol Status 464 13. Dial Backup 469 13.1 Automating Dial Backup 473 13.2 Using Dialer Interfaces 479 13.3 Using an Async Modem on the AUX Port 483 13.4 Using Backup Interfaces 485 13.5 Using Dialer Watch 488 13.6 Ensuring Proper Disconnection 490 13.7 View Dial Backup Status 492 13.8 Debugging Dial Backup 496 14. NTPandTime 498 14.1 Timestamping Router Logs 500 14.2 Setting the Time 502 14.3 Setting the Time Zone 504 14.4 Adjusting for Daylight Saving Time 505 14.5 Synchronizing the Time on All Routers (NTP) 507 14.6 Configuring NTP Redundancy 510 14.7 Setting the Router as the NTP Master for the Network 513 14.8 Changing NTP Synchronization Periods 514 14.9 Using NTP to Send Periodic Broadcast Time Updates 515 14.10 Using NTP to Send Periodic Multicast Time Updates 517 14.11 Enabling and Disabling NTP Per Interface 519 14.12 NTP Authentication 520 14.13 Limiting the Number of Peers 522 Table of Contents
14.14 Restricting Peers 523 14.15 Setting the Clock Period 524 14.16 Checking the NTP Status 525 14.17 Debugging NTP 527 15. DLSw 530 15.1 Configuring DLSw 535 15.2 Using DLSw to Bridge Between Ethernet and Token Ring 542 15.3 Converting Ethernet and Token Ring MAC Addresses 544 15.4 Configuring SDLC 547 15.5 Configuring SDLC for Multidrop Connections 551 15.6 Using STUN 553 15.7 Using BSTUN 556 15.8 Controlling DLSw Packet Fragmentation 558 15.9 Tagging DLSw Packets for QoS 559 15.10 Supporting SNA Priorities 560 15.11 DLSw+Redundancy and Fault Tolerance 562 15.12 Viewing DLSw Status Information 563 15.13 Viewing SDLC Status Information 564 15.14 Debugging DSLw 567 16. Router Interfaces and Media 572 16.1 Viewing Interface Status 572 16.2 Configuring Serial Interfaces 581 16.3 Using an Internal Tl CSU/DSU 585 16.4 Using an Internal ISDN PRI Module 587 16.5 Using an Internal 56Kbps CSU/DSU 589 16.6 Configuring an Async Serial Interface 591 16.7 Configuring ATM Subinterfaces 592 16.8 Setting Payload Scrambling on an ATM Circuit 595 16.9 Configuring Ethernet Interface Features 596 16.10 Configuring Token Ring Interface Features 599 16.11 Connecting VLAN Trunks With ISL 600 16.12 Connecting VLAN Trunks with 802.1Q 604 17. Simple Network Management Protocol 607 17.1 Configuring SNMP 611 17.2 Extracting Router Information via SNMP Tools 614 17.3 Recording Important Router Information for SNMP Access 617 Table of Contents
17.4 Extracting Inventory Information from a List of Routerswith SNMP 619 17.5 Using Access Lists to Protect SNMP Access 621 17.6 Logging Unauthorized SNMP Attempts 623 17.7 Limiting MIB Access 625 17.8 Using SNMP to Modify a Router's Running Configuration 628 17.9 Using SNMP to Copy a New IOS Image 631 17.10 Using SNMP to Perform Mass Configuration Changes 633 17.11 Preventing Unauthorized Configuration Modifications 636 17.12 Making Interface Table Numbers Permanent 638 17.13 Enabling SNMP Traps and Informs 640 17.14 Sending syslog Messages as SNMP Traps and Informs 643 17.15 Setting SNMP Packet Size 645 17.16 Setting SNMP Queue Size 646 17.17 Setting SNMP Timeout Values 648 17.18 Disabling Link Up/Down Traps per Interface 649 17.19 Setting the IP Source Address for SNMP Traps 649 17.20 Using RMON to Send Traps 651 17.21 Enabling SNMPv3 656 17.22 Using SAA 661 18. Logging 667 18.1 Enabling Local Router Logging 669 18.2 Setting the Log Size 670 18.3 Clearing the Router's Log 672 18.4 Sending Log Messages to Your Screen 673 18.5 Using a Remote Log Server 674 18.6 Enabling Syslog on a Unix Server 676 18.7 Changing the Default Log Facility 677 18.8 Restricting What Log Messages Are Sent to the Server 680 18.9 Setting the IP Source Address for Syslog Messages 682 18.10 Logging Router Syslog Messages in Different Files 683 18.11 Maintaining Syslog Files on the Server 683 18.12 Testing the Syslog Sever Configuration 685 18.13 Preventing the Most Common Messages from Being Logged 688 18.14 Rate-Limiting Syslog Traffic 689 19. Access Lists 691 19.1 Filtering by Source or Destination IP Address 693 19.2 Adding a Comment to an ACL 697 xii I Table of Contents
19.3 Filtering by Application 698 19.4 Filtering Based on TCP Header Flags 704 19.5 Restricting TCP Session Direction 705 19.6 Filtering Multiport Applications 707 19.7 Filtering Based on DSCP and TOS 709 19.8 Logging when an Access List Is Used 710 19.9 Logging TCP Sessions 712 19.10 Analyzing ACL Log Entries 714 19.11 Using Named and Reflexive Access Lists 718 19.12 Dealing with Passive Mode FTP 720 19.13 Using Context-Based Access Lists 721 20. DHCP 728 20.1 Using IP Helper Addresses for DHCP 729 20.2 Limiting the Impact of IP Helper Addresses 731 20.3 Using DHCP to Dynamically Configure Router IP Addresses 733 20.4 Dynamically Allocating Client IP Addresses via DHCP 735 20.5 Defining DHCP Configuration Options 737 20.6 Defining DHCP Lease Periods 740 20.7 Allocating Static IP Addresses with DHCP 741 20.8 Configuring a DHCP Database Client 743 20.9 Configuring Multiple DHCP Servers per Subnet 745 20.10 Showing DHCP Status 747 20.11 Debugging DHCP 748 21. NAT 750 21.1 Configuring Basic NAT Functionality 752 21.2 Allocating External Addresses Dynamically 754 21.3 Allocating External Addresses Statically 756 21.4 Translating Some Addresses Statically and Others Dynamically 757 21.5 Translating in Both Directions Simultaneously 758 21.6 Rewriting the Network Prefix 761 21.7 Adjusting NAT Timers 762 21.8 Changing TCP Ports for FTP 763 21.9 Checking NAT Status 764 21.10 Debugging NAT 767 Table of Contents I xiii
22. Hot Standby Router Protocol 768 22.1 Configuring Basic HSRP Functionality 773 22.2 Using HSRP Preempt 777 22.3 Making HSRP React to Problems on Other Interfaces 779 22.4 Load Balancing with HSRP 782 22.5 Redirecting ICMP with HSRP 785 22.6 Manipulating HSRP Timers 786 22.7 Using HSRP on a Token Ring Network 788 22.8 HSRP SNMP Support 790 22.9 Increasing HSRP Security 791 22.10 Showing HSRP State Information 795 22.11 Debugging HSRP 796 23. IP Multicast 798 23.1 Configuring Basic Multicast Functionality with PIM-DM 806 23.2 Routing Multicast Traffic with PIMSM and BSR 808 23.3 Routing Multicast Traffic with PIM-SM and Auto-RP 812 23.4 Configuring Routing for a Low Frequency Multicast Application 815 23.5 Configuring CGMP 818 23.6 Static Multicast Routes and Group Memberships 819 23.7 Routing Multicast Traffic with MOSPF 820 23.8 Routing Multicast Traffic with DVMRP 821 23.9 DVMRP Tunnels 824 23.10 Controlling Multicast Scope with TTL 826 23.11 Using Administratively Scoped Addressing 828 23.12 Exchanging Multicast Routing Information with MBGP 830 23.13 Using MSDP to Discover External Sources 833 23.14 Converting Broadcasts to Multicasts 835 23.15 Showing Multicast Status 837 23.16 Debugging Multicast Routing 846 A. External Software Packages 851 B. IP Precedence, TOS, and DSCP Classifications 855 Index 869 xiv I Table of Contents