Catalyst 3750 Series Switches in the stack do not boot with the new image after a software upgrade.

I faced with this issue after upgrading IOSs on my 3750 series switches stack. Stack consists of 4 catalyst 3750 series. After I have copied anf setting new IOS file as a boot file on has failed to boot and I got "Switch is not usable" error.

My solution.

• I have removed stack cables from the switch that has failed to boot
• I have set the new IOS with boot sytem .... command.
• I ensured that the switch booted up with new IOS
• I have powered off the switch.
• I have connected stack cables and power on the switch.

Read more...

Enable SSH and disable Telnet on Cisco Catalyst series switches

Enable SSH and disable Telnet on Cisco Catalyst series switches


Conf t
aaa new model
username cisco password yourpassword
ip domain name yourdomain.com
crypto key generate rsa
(you can choose size of key modules from 360 to 2048)
end
line vty 0 4
transport input ssh
end

to prevent telnet access to switch


access-list 110 permit tcp any host 192.6.1.7(your switch ip)  eq 22
access-list 110 deny tcp any host 192.6.1.7
access-list 110 permit tcp any any
interface range  gigabitethernet1/0/1-24
ip access-group 110 in
end
copy run start




Read more...

Cisco Catalyst 3750 IOS Upgrade

Cisco Catalyst 3750 IOS Upgrade Steps (by using TFTP)

1. Download suitable ios image file from CISCO web site.(do not forget to Check the DRAM and flash memory requirements)
2. Copy releated file to flash memory by using copy tftp:filename flash:  command

Example

copy tftp:c3750-ipbasek9-mz.122-55.SE6.bin flash

3) if you havent got enough free space in flash memory you should delete the old boot file by using;

delete /f /r flash:filename command before copying new one.

Example

delete /f /r flash:c3750-ipbase-mz.122-50.SE5.bin

4) Verify the MD5 checksum of a file by using verify /md5 flash:filename command

Example

verifiy /md5 flash: c3750-ipbasek9-mz.122-55.SE6.bin

5) set the new file as boot file;

conf t
boot system switch all flash:c3750-ipbasek9-mz.122-55.SE6.bin
write memory
reload







Read more...

Error reading flash (is a directory)

This error means that the file you want to copy from flash to tftp is under a directory.

Follow the steps below

• execute sh flash command

CiscoSw#sh flash
Directory of flash:/c3750-ipbase-mz.122-50.SE5/
    5  drwx        4608   Mar 1 1993 03:09:56 +03:00  html
  424  -rwx     9574343   Mar 1 1993 03:13:20 +03:00  c3750-ipbase-mz.122-50.SE5
  425  -rwx         643   Mar 1 1993 03:13:20 +03:00  info
15998976 bytes total (3625472 bytes free)

• execute command cd flash:c3750-ipbase.mz.122-50
• execute dir

CiscoSw#dir
Directory of flash:/c3750-ipbase-mz.122-50.SE5/
    5  drwx        4608   Mar 1 1993 03:09:56 +03:00  html
  424  -rwx     9574343   Mar 1 1993 03:13:20 +03:00  c3750-ipbase-mz.122-50.SE5.bin
  425  -rwx         643   Mar 1 1993 03:13:20 +03:00  info

• then you can copy ios file to tftp by usinf copy flash tftp command as stated below;

CiscoSw#copy flash:c3750-ipbase-mz.122-50.SE5.bin tftp:
Address or name of remote host []? 192.6.1.57
Destination filename [c3750-ipbase-mz.122-50.SE5.bin]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
9574343 bytes copied in 36.054 secs (265556 bytes/sec)

Read more...

Creating Cisco command aliases

You can use command aliases as a shortcut in Cisco Network Devices.

Example

alias exec save copy run start
alias configuration save copy run start
alias interface save copy run start
alias line save copy run start

After executing command above. You can use save command instead of copy run start command on exec, configuration, interface and line levels.
Read more...

View IP address of host connected to Cisco Switch

First you should identify releated device mac address by using "sh mac-address-table" and then you can match mac and ip address by using sh arp or sh ip arp command.
Read more...

Enable IPv6 support on Catalyst Switches (3750)

Switch1>enable
Switch1#config t
Switch1(config)#sdm prefer dual-ipv4-and-ipv6 default
Switch1(config)#end
Switch1#reload

You should reload the device in order for changes to take effects.

you can check ipv6 support by using "show sdm  prefer" command.

After this you can configure ipv6 addresses and ACLs features on Catalyst 3750 series switches.
Read more...

Command rejected: ........ is a dynamic port

On Cisco Catalyst series switch Port security feature can only be configured on static access ports or trunk ports. So you should set the interface switchport mode as access by using

"switchport mode access" interface configuration command.
Read more...

Securing the Cisco IOS image file

You can hide the your Routers Cisco IOS by using Cisco IOS Resilient Configuration. Users can not view IOS information by using after "Show flash" command after this configuration.  By using this property you can hide the IOS and These secure files cannot be removed by the user. No extra space is required to secure the primary Cisco IOS image file.

The Cisco IOS Resilient Configuration feature is mainly intended to speed up the recovery process.

In Global Configuration Mode, use the commands below;

 secure boot-image    'Enables Cisco IOS image resilience

 secure boot-config    'Stores a secure copy of the primary bootset in persistent storage.

 end

 show secure bootset ' Displays the status of configuration resilience and the primary bootset filename

Note: This feature is available only on platforms that support a Personal Computer Memory Card International Association (PCMCIA) Advanced Technology Attachment (ATA) disk. There must be enough space on the storage device to accommodate at least one Cisco IOS image (two for upgrades) and a copy of the running configuration.

Read more...

Cisco Switch MAC based Port Security

In order configure MAC Address based Port Security on Cisco Switch perform the following commands; (These commands below are valid for 3750 series, for other models command may vary) conf t int GiX/x/x switchport mode access (port security can be used on access mode) switchport port-security switchport port-security mac-address xxxx.xxxx.xxxx end wr (To determine maximum number of mac addresses that can connect to specific interface; config-if)switchport port-security maximum number Only MAC address xxxx.xxxx.xxxx will be able to connect to related port. Otherwise port will be shutdown (default action) If port is shutdown, you will see port status as a err-disabled #show interfaces gigabitethernet 4/1/1 status Port Name Status Vlan Duplex Speed Type Gi4/1 err−disabled 100 full 1000 1000BaseSX
In order to re-enable port(In interface prompt);
int G1/0/19 no switchport port-security (this cmd will completely remove port-security, may not be necessary) shut no shut Manually enabling port can be nightmare for network administrators. You can configure automatic recovery by using the commands below; (config)#errdisable recovery cause psecure-violation (config)#errdisable recovery interval ? <30-86400> timer-interval(sec) (config)#errdisable recovery interval 300 With the configuration above you can assign only one mac address per port, by using mac access lists you can assign many mac addresses to a port; Ex; mac access-list extended PermitMacList permit host xxxx.xxxx.xxxx any int fa0/1 mac access-group PermitMacList in int fa0/2 mac access-group PermitMacList in
Read more...

View MAC Address(es) and IP Address of devices connected to Cisco Router

Execute the show arp command and get the MAC and IP address of devices connected to Cisco Router.
Read more...

Disable Cisco Password Recovery

Cisco devices permits to password recovery by default during the reload system. But if person has a physical access to devices he can change password.For this reason, you may want to disable password recovery procedure.

Use the “no service password-recovery” command
When you do this carefully read the warning message.

Router(config)#no service password-recovery
WARNING:
Executing this command will disable password recovery mechanism.
Do not execute this command without another plan for
password recovery.
Are you sure you want to continue? [yes/no]: yes
Router(config)#
Read more...

Block Dictionary Attack on Cisco

To block dictionary attack on Cisco routing and switching devices we can use login block- for command.
By using this command we can block for ‘x’ seconds after failed ‘y’ logins are tried within ‘z’ seconds.
The following example shows how block login access for 100 seconds after 4 failed login attempts within 20 seconds:

login block-for 100 attempts 4 within 20

During this block period all types of login attempts( Telnet, SSH, and HTTP) are denied.

But it is possible to exclude IP address for this blocking.
Ex: Exclude 192.168.1.0 Network (C Class)

login quiet-mode access-class 10
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
Read more...

Using Previledge mode commands in Global Config Mode

I think it is very useful tip when using the show, ping, and telnet commands. Instead of switching back and forth between global configuration mode and privilege mode to use these commands, you can remain in global configuration mode and type the do command with the original syntax.

For example:

Router(config)#do show running-config

or

Router(config)#do show interface s0

or

Router(config)#do PING 20.0.0.1


Read more...

View Console Log messages on Telnet Sessions in Cisco

Execute the Command “terminal monitor”. By enabling this command, all your console messages can be seen on a telnet session. Always disable it after you have complete your work . Otherwise every time you will telnet that router/switch, you will see console messages coming on your telnet session.
Read more...

Full Help Menu in User Exec Level Cisco IOS

Normally in User Exec mode you can not see all avaliable show commands. But there is a trick to see Full help of show commands.

Router> terminal full-help
Router> show ?

If you make this permanent behaviour in your Cisco Router your administrator must execute full-help line configuration command.
Read more...

Cisco IOS Naming

In Cisco IOS names every character has a meaning.

IOS SOFTWARE :

y :ip
7 :adsl
s :plus

o :firewall
v :voice
k9 :IPSEC 3 DES , encryption > 64 bit
k8 :IPSEC 56 , encryption <64 bit
3 :IDS
n :IPX
br2 :AT / IBM
a :APPN
j :ENTERPRISE
a3 :SNA SOFTWARE



c1700-y-mz12.2-2.T1 :IP
c1700-y7-mz :IP / ADSL
c1700-sy7-mz :IP / ADSL plus
c1700-k9sy7-mz :IP / ADSL PLUS 3 DES
c1700-k8sy7-mz :IP / ADSL PLUS IPSEC 56
c1700-k9o3sy7-mz :IP / ADSL / FW / IDS PLUS IPSEC 3 DES
c1700-k8o3sy7-mz :IP / ADSL / FW / IDS PLUS IPSEC 56
c1700-bnr2sy7-mz :IP / ADSL / IPX / AT / IBM PLUS
c1700-no3sy7-mz :IP / ADSL / IPX / FW / IDS PLUS
c1700-bk9no3r2sv3y7-mz :IP / ADSL / IPX/AT/IBM/VOICE/FW/IDS PLUS IPSEC 3 DES
c3640-ajs-mz.120.22 :ENTERPRISE / APPN PLUS
c3640-js-mz.122-10a.bin :ENTERPRISE PLUS
c3640-ainr-mz.112-26.P4.bin :IP / IPX / IBM / APPN
c3640-a3js-mz.122-10a.bin :ENTERPRISE / SNASOFTWARE PLUS



Example of a Cisco IOS Image Name




Read more...

Cisco Aironet 1100 Series MAC Address Filtering

Print Page
Open Services->Filters Menu and choose "MAC ADDRESS FILTERS" from the right pane.




Enter Number between 700-799 to "Filter Index" part.



Enter the MAC Address that you want to block or forward.


then Click "Add" Button.



In this Example we give a forward right to the device that have MAC Address 1111.1111.1111 and block the rest of devices.



Then Click Apply button to save the rule.



Choose Apply Filters TAB from the .





Choose the traffic direction and Interface to apply the rule. To save configuration press apply button.




Read more...

IPV4 and IPV6 Access Control Lists on Cisco IOS

ACLs are used to filter network traffic, routing updates, matching packets and a lot of different uses. Main usage is restrict network traffic to unwanted systems.

The access control lists have numbers and can also have text as identifiers, each number or string represents a specific access control list.

There are may types of Access Control Lists, the most common ones are;


IP Standard Access List
List numbers 1-99, can only define source or destination, not source and destination.
IP Extended Access List
List numbers 100-199, can define both source and destination as well as port and protocol numbers.

A IP standard access control list with two entries is configured like this

Router#conf t
Router(config)#ip access-list standard 5
Router(config-std-nacl)#5 permit 192.168.0.0 0.0.0.255
Router(config-std-nacl)#10 permit 192.168.1.0 0.0.0.255

To apply this inbound on an interface, just use

Router#conf t
Router(config)#int te 1/1
Router(config-if)#ip access-group 5 in

The alternative way to define an access list number 5 with two entries is

Router#conf t
Router(config)#access-list 5 permit 192.168.0.0 0.0.0.255
Router(config)#access-list 5 permit 192.168.1.0 0.0.0.255
Router(config)#

To apply this one inbound on a line interface

Router#conf t
Router(config)#line vty 1
Router(config-line)#access-class 5 in

IPV6 usage of Access Lists

Router#conf t
Router(config)#ipv6 access-list myfirewall
Router(config-ipv6-acl)#permit 3ffe:200::/32 any
Router(config-ipv6-acl)#permit 3ffe:100::/32 any

To verify the access-lists just look at this

Router#show access-lists myfirewall
IPv6 access list myfirewall
permit ipv6 3FFE:200::/32 any sequence 10
permit ipv6 3FFE:201::/32 any sequence 20
Router#

To apply this IPv6 Access Control List to an interface, just do as follows

Router#conf t
Router(config)#int te 1/1
Router(config-if)#ipv6 traffic-filter myfirewall in

To apply this IPv6 access control list to a line

Router#conf t
Router(config)#line vty 1
Router(config-line)#ipv6 access-class myfirewall in


Read more...

Cisco 2801 WIC1-SHDSL support

Read more...