Network technologies and trends » Cisco 3560

Remote Telnet useful tips!

Yasir Irfan — Tue, 08 Sep 2009 09:45:07 +0000

We all work remotely with Cisco routers and Switches, we often do login to do some configuration changes in the Cisco routers and Switches. What if we configured wrongly in the live Cisco routers and Switches which are located in the remote sites, we don’t enjoy the liberty of resetting the devices unless we have control over the power distribution.

In this scenario the “reload” command proves to be very handy and useful. Just before making any changes to the configuration we can use the “reload” command as demonstrated below

ITKE-Cisco#reload in ?

Delay before reload (mmm or hhh:mm)

ITKE-Cisco#reload in 10

System configuration has been modified. Save? [yes/no]: no

Building configuration…

[OK]

Reload scheduled in 10 minutes by yasir on vty0 (10.0.0.5)

Proceed with reload? [confirm]

ITKE-Cisco#

***

*** — SHUTDOWN in 0:05:00 —

***

The above demonstrated command will reload the device in 10 minutes. After applying the “reload” command we can proceed with the configuration changes. If things go wrong and we lost connectivity

to the device, then try back after 10 minutes as the device will get reloaded with the original startup-configuration which can helps us to restore the connectivity to the device.

Once we are sure about the new configuration and its working properly without any hassles there is always a way “reload cancel” command is there to cancel the reload.

ITKE-Cisco#reload cancel

I find this command to be very handy and useful especially when we have to telnet or SSH to remote Cisco router or a Switch.

Cisco Etherchannel Overview and how it can be configured in Cisco Catalyst Switches – Series 3

Yasir Irfan — Sat, 27 Dec 2008 06:19:02 +0000

Dear Friends, hope everyone is having great holidays, have fun. In my previous post I was focusing on some of the limitations of Etherchannel. Now let’s proceed a step ahead and figure out about the Etherchannel negotiation protocols. Etherchannels can be negotiated between two Cisco Catalyst Switches to provide some dynamic link configuration.

Basically there are two types of protocols are available, which can be used to bundled the automated creation of an Etherchannel in the Cisco Catalyst Switches.

In upcomming post I will try to concentrate on automating the creation of an Etherchannel . Have fun and happy new year 2009.

Cisco Etherchannel Overview and how it can be configured in Cisco Catalyst Switches – Series 2

Yasir Irfan — Sat, 20 Dec 2008 06:33:06 +0000

Dear Friends, in my previous post I just introduced Etherchannel, now let’s proceed one step ahead, there are certain limits with the Etherchannel lets figure out what are those limits,

·         An Etherchannel Group Number must be in the range of 1 to 256.

·         All ports in the target Etherchannel group MUST be in the same VLAN.

·         If one physical link in the Etherchannel group is a TRUNK, then all other ports must be configured as trunks carrying the same VLAN information.

·         Any defined broadcast limits must be the same across all ports in an Etherchannel.

·         An LACP Etherchannel group cannot support any physical links in half duplex mode.

·         No port in the Etherchannel group can be defined as a SPAN port.

How to configure an interface to default settings in a Cisco Switch or a Cisco Router?

Yasir Irfan — Sat, 13 Dec 2008 06:27:03 +0000

This is a cool command to erase just the configuration for a particular interface in a Cisco Switch or a Cisco Router.

In the following example we will configure the interface fast Ethernet 0/9 to default configuration

Current Configuration for fast Ethernet 0/9

ITKE-Cisco#sho running-config interface fastEthernet 0/9

Building configuration…

Current configuration : 85 bytes

interface FastEthernet0/9

switchport access vlan 100

switchport mode access

end

ITKE-Cisco

Now we will configure the fast Ethernet 0/9 to default configuration using the following command

“default interface fastEthernet 0/9”

ITKE-Cisco#configure t

Enter configuration commands, one per line. End with CNTL/Z.

ITKE-Cisco(config)#default interface fastEthernet 0/9

Interface FastEthernet0/6 set to default configuration

ITKE-Cisco(config)#

Running configuration for fast Ethernet 0/9 after configuring to default settings

ITKE-Cisco#sho running-config interface fastEthernet 0/9

Building configuration…

Current configuration : 68 bytes

interface FastEthernet0/9

switchport mode dynamic desirable

end

ITKE-Cisco#

How to configure SPAN(Switched Port Analyzer ) feature in a Cisco Catalyst Switch

Yasir Irfan — Tue, 02 Dec 2008 07:30:23 +0000

It’s quite important for Network Engineers and an essential network troubleshooting technique to utilize the ability of Cisco Catalyst Switches to mirror the traffic and send it to a sniffer for analysis. All Cisco Catalyst Switches support the Switched Port Analyzer (SPAN) feature. The SPAN copies traffic from the specified interface or VLANs and mirrors this traffic to a specified destination interface (SPAN interface). Then you can connect the PC with a sniffing tool (Wireshark) installed on the destination SPAN interface to capture all the mirrored traffic.Let’s see how to configure the SPAN in Cisco Catalyst Switches. To enable the switch SPAN mirroring feature configure the following on the catalyst switch: Configuration Example – Monitoring traffic from a specific interfaceITKEAS01#configure tITKEAS01(config) monitor session 1 source interface gigabitEthernet 0/5

ITKEAS01(config)#monitor session 1 destination interface gigabitEthernet 0/10

The above configuration will capture all traffic from interface gigabitEthernet 0/5 and send it to SPAN port interface gigabitEthernet 0/10

Configuration Example – Monitoring an entire VLAN traffic
ITKEAS01(config)#monitor session 1 source vlan 100
ITKEAS01(config) monitor session 1 destination interface gigabitEthernet 0/10 The above configuration will capture all traffic of VLAN 100 and send it to SPAN port interface gigabitEthernet 0/10

Use show monitor session 1 to verify your configuration.

How to configure DHCP Snooping in a Cisco Catalyst Switches.

Yasir Irfan — Sat, 22 Nov 2008 12:56:06 +0000

So here we go, with the configuration of DHCP snooping on a Cisco Switch. This feature protects the network by allowing the Cisco Switches to accept DHCP response message only from the authorized servers connected to the trusted interfaces in a Cisco Switch.

All Switch to Switch connections are configured as 802.1 1Q Trunk ports.

IP Address and HSRP Details for the Core Switches From the above scenario we have two Cisco 6513 Series Switches as a Core/ Distribution with three VLANS one for management of Switches VLAN 50,VLAN 100 for all the servers and VLAN 101 for clients. Two Cisco 3560 Series Switches as Server Farm Switches and a Cisco 3560 Series Switch as an Access Switch.There are two DHCP servers with an IP address 10.0.1.100 and 10.0.1.101 connected with Server Farm Switches with HP NIC teaming. We configure DHCP Snooping based on above scenario.

The first step to configure DHCP Snooping is to turn on DHCP snooping in all Cisco Switches using the “ip dhcp snooping” command.

All Cisco Switches (config)#ip dhcp snooping Second step is to configure the trusted interfaces, from the above scenario all trunk ports are configured as trusted ports as well as the interfaces G0/7,(ITKESF01 50.0.0.6), G0/17,(ITKESF02 50.0.0.7), G0/9 ITKESF01 50.0.0.6) and G0/18 ITKESF02 50.0.0.7) connected to DHCP servers with IP 10.0.1.100 and 10.0.1.101. Lets configure all trunk ports in ITKEBB01

ITKEBB01(config)#interface range gigabitEthernet 3/21 – 23

ITKEBB01 (config-if)#ip dhcp snooping trust

Now let’s configure all trunk ports in ITKEBB02

ITKEBB02(config)#interface range gigabitEthernet 3/21 – 23 ITKEBB02 (config-if)#ip dhcp snooping trust

ITKEBB02 (config)#interface gigabitEthernet 3/16

ITKEBB02 (config-if)#ip dhcp snooping trust

Now let’s configure the trusted ports for the DHCP servers

ITKESF01(config)#interface gigabitEthernet 0/7

ITKESF01 (config-if)#ip dhcp snooping trust

ITKESF01(config)#interface gigabitEthernet 0/17 ITKESF01 (config-if)#ip dhcp snooping trust

ITKESF02(config)#interface gigabitEthernet 0/9

ITKESF02 (config-if)#ip dhcp snooping trust

ITKESF02(config)#interface gigabitEthernet 0/18 ITKESF02 (config-if)#ip dhcp snooping trust

Now let’s configure the trunk ports Access Switch ITKEAS01

ITKEAS01(config)#interface range gigabitEthernet 0/49 – 52

ITKEAS01 (config-if)#ip dhcp snooping trust

Finally we are going to configure VLANS for DHCP snooping DHCP snooping will used on all the VLANs (VLAN 100 & 101)except management VLAN 50 . Also we will limit the requests rate received in the Access Switch (ITKEAS01) ALL SWITCHES(config)# ip dhcp snooping VLAN 100,101

ITKEAS01(config)#interface range gigabitEthernet 0/1 – 48

ITKEAS01 (config-if)#ip dhcp snooping limit rate 20

Displaying the DHCP snooping

For further reference please do check this article from Cisco about DHCP snooping.

Why should we consider implementing DHCP Snooping?

Yasir Irfan — Sat, 22 Nov 2008 07:22:25 +0000

Dear FriendsIn my previous post I was discussing about the DHCP Snooping, it may be hard to believe a DHCP sever can lead to lot troubles in your network. Consider a host sends out DHCP discovery packets, it listens for a DHCP offers packets and accepts the first available offer from a DHCP server. Guess what happens if the host gets a DHCP offer from a rouge DHCP server? The host could end up with using rouge DHCP server with an IP address and the default gateway. The host cannot access any of the resources from your network.

Yes we can prevent this with DHCP snooping thanks to Cisco. DHCP snooping classifies interfaces as either trusted or untrusted. DHCP messages received on trusted interfaces will be permitted to pass through the Cisco switch, but DHCP messages received on untrusted interface in a Cisco Switch results in putting the interface into error disable state. Configuring DHCP snooping in a Network is quite troublesome job but I will try to make things easier for you by using a scenario, which hopefully I am going post soon.

What is Dynamic Host Configuration Protocol (DHCP) Snooping?

Yasir Irfan — Thu, 20 Nov 2008 07:54:05 +0000

Dynamic Host Configuration Protocol (DHCP) Snooping is a security feature which filters untrusted DHCP messages, this security feature can protects the devices on the network from associating with an unauthorized DHCP server. When the Dynamic Host Configuration Protocol (DHCP) Snooping feature is enabled on a Cisco Switch , the Cisco Switch builds a table of MAC address, IP address lease time , binding type and interface information. In coming posts I will try to explain to how to enable and configure the Dynamic Host Configuration Protocol (DHCP) snooping security feature in a Cisco Switch.

How to configure SNMPv3 in a Cisco Catalyst Switch – Series 2

Yasir Irfan — Mon, 20 Oct 2008 05:06:23 +0000

In the first series we just started to know about SNMP Version 3 and we just created a SNMP View called ITKEView. Now let’s proceed further and create a SNMP group called “ITKEGroup”. This group is granted an access to view “ITKEview” which we created in the previous step.

ITKE(config)# snmp-server group ITKEview v3 auth

Finally let’s create a SNMP username called “ITKEuser” and grant it an access to the “ITKEGroup” that we created in previous step. We will provide an authentication password as well as privacy password which will serve as an encryption key for the SNMP protocol. ITKE(config)# nmp-server user ITKEuser ITKEGroup v3 auth md5 ITKEpass priv des56 ITKEpass2

How to configure SNMPv3 in a Cisco Catalyst Switch – Series 1

Yasir Irfan — Sun, 12 Oct 2008 05:17:50 +0000

Configuring SNMP Version 3 in a Cisco Catalyst Switch is bit more complicated compared to SNMP v1 and v2. But after configuring SNMPv3 you can relax as the SNMPv3 provides more security by adding authentication (username and password) as well as encryption to the protocol.

What is SNMPv3 ?Simple Network Management Protocol version 3. The specification for this Full Standard protocol is published in RFCs 3410 and 3418. SNMPv3 provides a Full Standard administrative framework (authorization, access control, etc.) and a remote configuration/administration MIB. Also check the SNMPv3 documentation from Cisco Systems.

How to configure SNMPv3 in a Cisco Catalyst Switch ?

First we begin with configuration of SNMPv3 on the Cisco Catalyst Switch by creating a SNMP “view”. A “view” defines what information can be accessed by the SNMP user/group when they query the SNMPv3 enabled Cisco Catalyst Switch. In the below example we will create “view” called ITKEView. We will enable “system” , “internet” and “interfaces” SNMP OIDS on the Cisco Catalyst Switch.

ITKE(config)# snmp-server view ITKEView internet includedITKE(config)# snmp-server view ITKEView system includedITKE(config)# snmp-server view ITKEView interfaces included

To be continued in next series