[kml_flashembed movie="http://www.youtube.com/v/eGbRAzqrINA" width="425" height="350" wmode="transparent" /]

Normally we use any of decrypting software’s to decrypt the Cisco type 7 passwords, which were encrypted by using a Cisco IOS command “service password-encryption”.  Image you don’t have an access to the internet or you don’t have a Cisco password decrypting software’s, what you will do in this situation. No worries you can use the Cisco Router or a Cisco Switch itself to decrypt the Cisco type 7 passwords.  Amazing isn’t it! We can make use of a feature call “key chain” to decrypt the encrypted type 7 passwords. To demonstrate I am just creating a scenario

Step 1

Create a username in your Cisco device and encrypt the password  by using following commands

ITKE-AS01(config)#username itke password joinitke

ITKE-AS01(config)# service password-encryption

Step 2

Let’s see user name and password we created

ITKE-AS01#sho run | include username

username itke password 7 12130A1E1C02180F2F

ITKE-AS01#

We can see “7 12130A1E1C02180F2F” is the encrypted password for joinitke which we created in step 1.

Step 3

Now we need to create a key chain and copy the encrypted password as the key string as demonstrated below

ITKE-AS01(config)#key chain getpassword

ITKE-AS01(config-keychain)#key 1

ITKE-AS01(config-keychain-key)#key-string 7 12130A1E1C02180F2F

Step 4

Now we can see the decrypted password by using the Cisco IOS command “show key chain getpassword”

ITKE-AS01#show key chain getpassword

Key-chain getpassword:

    key 1 — text “joinitke”

        accept lifetime (always valid) – (always valid) [valid now]

        send lifetime (always valid) – (always valid) [valid now]

ITKE-AS01#

Amazing we can use a Cisco Router or a Cisco Catalyst Switch to decrypt the type 7 encrypted passwords. Use this and do let me know.

Here is a cool tip for saving your time when ever your telnet to your Cisco Switch or a router. By using no login command you can telnet directly to your Cisco device without any authentication, this proves to be good only in lab environment to save time but its hardly recommended not to use this feature in real networks.

To configure this feature follow the below configuration steps.

           ITKE01>enable

           ITKE01#configure terminal

           ITKE01 (config)#line vty 0 4

           ITKE01 (config-line)#no login

Testing:

           C:\>telnet 192.168.0.1

          ITKE01>

Notice that no authentication was required. You are taken directly to user mode.

We all know how important a Cisco Discovery Protocol (CDP) to troubleshoot the network, but sometimes this may leads to a problem. These days lot of free CDP discovery utilities is available. Anyone can download the CDP utility and start gathering info about your network. It’s always recommended to disable the Cisco Discovery Protocol (CDP) on all the interfaces in your Cisco devices. The only interfaces need to use the Cisco Discovery Protocol (CDP) are the ones which are connected to your Cisco Routers and Cisco Switches. Cisco Discovery Protocol (CDP) can be disabled by using “no cdp enable” command in the entire interface you need.

In my access Switch the CDP is enabled in all interfaces, you can determine this by using a command “show cdp interfaces” you can see CDP is enabled in  all the interfaces.

ITKE-AS01#sho cdp interfaces

FastEthernet0/1 is down, line protocol is down

  Encapsulation ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

FastEthernet0/2 is down, line protocol is down

  Encapsulation ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

FastEthernet0/3 is up, line protocol is up

  Encapsulation ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

FastEthernet0/4 is down, line protocol is down

  Encapsulation ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

FastEthernet0/12 is down, line protocol is down

FastEthernet0/24 is up, line protocol is up

  Encapsulation ARPA

  Sending CDP packets every 60 seconds

  Holdtime is 180 seconds

ITKE-AS01#

Let’s see to which interface the router is connected

ITKE-AS01#show cdp neighbors

Capability Codes: R – Router, T – Trans Bridge, B – Source Route Bridge

                  S – Switch, H – Host, I – IGMP, r – Repeater, P – Phone,

                  D – Remote, C – CVTA, M – Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

MOHMPLS          Fas0/24          176            R       2620XM    Fas 0/0

ITKE-AS01#

Let’s disable the CDP in all the interfaces expect fast Ethernet 0/24

ITKE-AS01#configure t

ITKE-AS01(config)#interface range fastEthernet 0/1 -23

ITKE-AS01 (config-if-range)#no cdp enable

In the above example I have disabled CDP in all interfaces except the one connected to the router.

There is a cool handy way to know TTY sessions established in any Cisco Router or a Cisco Switch. By using this feature you can know the number of active telnet sessions from the prompt itself.

Normally whenever you log to any Cisco Router or Switch you will find this menu

ITKE-AS01#

By using the “prompt” command you can see the difference

You might be wondering how come this is possible, ok now let me show you how to enable this feature in a Cisco Router or a Cisco Switch,

Log in to your Cisco Device and use the following command “prompt %h:%n%p”

ITKE-AS01#config t

ITKE-AS01 (config)# prompt %h:%n%p
ITKE-AS01 (config)# exit

In the example I have used three escape sequences to set the prompt name to the hostname (%h), followed by the command number (%n) and then followed by the appropriate prompt character for the current command mode (%p).

You can see the difference in the hostname after applying the “prompt %h:%n%p” command.

ITKE-AS01:1#sho users

    Line       User       Host(s)              Idle       Location

*  1 vty 0     yasir      idle                 00:00:00 10.0.0.5

  Interface      User        Mode                     Idle     Peer Address

ITKE-AS01:1#

As the number of TTY session increases you can see the incremental change in the hostname with the sequence number as displayed below.

Example with two TTY sessions

ITKE-AS01:2#sho users

    Line       User       Host(s)              Idle       Location

   1 vty 0     yasir      idle                 00:00:23 10.0.0.5

*  2 vty 1     itkeuser      idle                 00:00:00 10.0.0.5

  Interface      User        Mode                     Idle     Peer Address

ITKE-AS01:2#

Example with three TTY sessions

ITKE-AS01:3#sho users

    Line       User       Host(s)              Idle       Location

   1 vty 0     yasir      idle                 00:01:14 10.0.0.5

   2 vty 1     itkeuser      idle           00:00:50 10.0.0.6

*  3 vty 2     itkeadmin   idle         00:00:00 10.0.0.7

  Interface      User        Mode                     Idle     Peer Address

ITKE-AS01:3#

Example with four TTY sessions

ITKE-AS01:4#sho users

    Line       User       Host(s)              Idle       Location

   1 vty 0     yasir      idle                 00:01:43 10.0.0.5

   2 vty 1     itkeuser      idle            00:01:20 10.0.0.6

   3 vty 2     itkeadmin   idle            00:00:29 10.0.0.7

*  4 vty 3     yasir      idle                 00:00:00 10.0.0.5

  Interface      User        Mode                     Idle     Peer Address

ITKE-AS01:4#

I you want to disable the TTY display enter the “no prompt” command as shown below.
ITKE-AS01:4#config t
ITKE-AS01:4 (config)# no prompt

Following are the prompt Variables available for the “prompt” command.

Most people do not realize starting an IOS version 12.3 (4) T and higher an “archive” and “archive config” commands were introduced by Cisco Systems.

The main advantage of advantage of an “archive” command is to have incremental backups of your Cisco Router or Switches configurations and for some reasons if you have blowup with the configuration then using the this feature you can retrieve the old configuration file into your Cisco router or switch.

The “archive config” command allows you to save Cisco IOS configurations in the configuration archive using a standard location and filename prefix that is automatically appended with an incremental version number (and optional timestamp) as each consecutive file is saved.
Once the maximum number of file saved in the archive, the oldest file will be automatically replaced by the next file.

The “show archive” command displays information for all configuration files saved in the Cisco IOS configuration archive.
In this example, we will save the archive configuration files on the flash memory; however, you can also store the configuration files remotely using such protocols as FTP, HTTP, HTTPS,RCP, SCP, and TFTP.
By using following set of commands we can enable archive feature in a Cisco Router or a Cisco Switch provided the IOS version is either 12.3 (4) T or higher . In this example, the location and filename prefix is specified as disk0: itkebackup

ITKE-AS0 (config)#archive

ITKE-AS01(config-archive)#path flash:itkebackup

To save the current running configuration in the configuration archive use the “archive config” command as shown below

ITKE-AS01# archive config

The “show archive” command displays information of the files saved in the configuration archive as shown in the following example:

ITKE-AS01#show archive

         There are currently 3 archive configurations saved.

         The next archive file will be named flash: itkebackup -3

         Archive # Name

         0

         1 flash: itkebackup -1

         2 flash: itkebackup -2 <- Most Recent

         3

         4

         5

         6

         7

         8

         9

         10

         11

         12

         13

         14

ITKE-AS01#

By using the “configure replace flash” command you can restore the configuration

ITKE-AS01#configure replace flash: itkebackup -2

         This will apply all necessary additions and deletions

         to replace the current running configuration with the

         contents of the specified configuration file, which is

         assumed to be a complete configuration, not a partial

         configuration. Enter Y if you are sure you want to proceed. ? [no]: y

         Total number of passes: 0

         Rollback Done

The “archive” command is quite handy to keep the he is great for keeping multiple copies of the running config in an archive.

In my previous post I was talking about the Secure Copy (SCP) what is it?  , now let’s see how to configure Secure Copy (SCP) in a Cisco Router or a Switch.

In order to configure Secure Copy (SCP) in a Cisco Router make sure the SSH is enabled and its working.

Step 1) Lets enable the SSH and AAA features in the Cisco Device

ITKE-AS1(config)#ip domain-name itke.com

ITKE-AS1(config)#crypto key generate rsa general-keys modulus 512

The name for the keys will be: ITKE-AS1.itke.com

% The key modulus size is 512 bits

% Generating 512 bit RSA keys, keys will be non-exportable…[OK]

ITKE-AS1(config)#

ITKE-AS1(config)#aaa new-model

ITKE-AS1(config)#aaa authentication login default local

ITKE-AS1(config)#aaa authentication exec default local

Step 2) In order to use the SCP feature to manage configuration we must have at least once user account with enough privilege to access it

ITKE-AS1(config)#

ITKE-AS1(config)#username itke privilege 15 password secret itkeleads

Step 3) Now you are ready to enable the SCP server on:

ITKE-AS1(config)#ip scp server enable

Just by following these 3 simple steps we can enable Secure Copy (SCP) in a Cisco router or a Switch. For any further clarifications you can always have a close look at Cisco’s document on Secure Copy (SCP). 

We are all aware of the traditional way of transferring IOS files from and to Cisco Catalyst Switches, Cisco Routers and Cisco PIX/ASA firewall devices using TFPT, FTP and lately https. However there is also one more way to copy the IOS files, which is known as Secure Copy (SCP). The Secure Copy (SCP) is a secure and authenticated method of copying a configuration file or transferring an Image files to Cisco Catalyst Switches, Cisco Routers and Cisco PIX/ASA firewall devices.

Cisco Systems introduced the Secure Copy (SCP) feature in the following IOS releases

PIX/ASA firewalls 7.1 and above, FWSM 3.1 and above.

The Secure Copy (SCP) works on SSH protocol on port 22 which is like an encrypted tunnel. This tool is very useful especially to transfer files for upgrades or to perform safe backups.

In my next post you will find the commands to configure SCP in a Cisco Router and Switch.