Schließen
Automatically Installed Local Host Routes
** A host route is where the destination address is a specific device IP with a subnet mask of /32 for IPv4 or /128 for IPv6.
There are three ways a host route can be added to the routing table:
- Automatically installed when an IP address is configured on the router
- Configured as a static host route
- Host route automatically obtained through other methods
Manually Configured Host Routes
A host route can be a manually configured static route to direct traffic to a specific destination device, such as an authentication server
** The static route uses a destination IP address and a 255.255.255.255 (/32) mask for IPv4 host routes and a /128 prefix length for IPv6 host routes
Manually Configured Host Routes
** For IPv6 static routes, the next-hop address can be the link-local address of the adjacent router. However, you must specify an interface type and an interface number when using a link-local address as the next hop
Configure and Verify CDP
Ej: ? to disabled CDP for all the interfaces on the device
For Cisco devices, CDP is enabled by default. For security reasons, it may be desirable to disable CDP on a network device globally, or per interface.
To enable CDP globally for all the supported interfaces on the device, enter "cdp run" in the global configuration mode.
** To disable CDP on a specific interface, such as the interface facing an ISP, enter no cdp enable in the interface configuration mode.
Configure and Verify CDP
Ej: ? To verify the status of CDP and display a list of neighbors
Currently, this device does not have any neighbors because it is not physically connected to any devices
Configure and Verify CDP
Use the "show cdp interface" command to display the interfaces that are CDP enabled on a device. The status of each interface is also displayed.
Ej: shows that five interfaces are CDP enabled on the router with only one active connection to another device.
Discover Devices Using CDP
Ej: Port identifier - The name of the local and remote port (Gig 0/1 and Fas 0/5, respectively)
- Capabilities list - Whether the device is a router or a switch (S for switch; I for IGMP is beyond scope for this course)
Discover Devices Using CDP
Ej: ? command can also provide information, such as the neighbors’ IOS version and IP address
- VTP Management Domain
- Native VLAN
- Duplex
- Management address(es)
LLDP
** Cisco devices also support Link Layer Discovery Protocol (LLDP), which is a vendor neutral neighbor discovery protocol similar to CDP.
Depending on the device, LLDP may be enabled by default. To enable LLDP globally on a Cisco network device, enter "lldp run" command in the global configuration mode
Configure and Verify LLDP
Ej: Similar to CDP, LLDP can be configured on specific interfaces. However, LLDP must be configured separately to transmit and receive LLDP packets; "no lldp run" interface commnand
"show lldp"
Discover Devices Using LLDP
Ej: With LLDP enabled, device neighbors can be discovered using the xxx command
The letter B under capability for S2 represents a Bridge. For this output, the word bridge can also mean switch.
"show lldp neighbors detail"
Setting the System Clock
When the time is not synchronized between devices, it will be impossible to determine the order of the events and the cause of an event.
Typically, the date and time settings on a router or switch can be set using one of two methods:
1. Manually configure the date and time
2. Configure the Network Time Protocol (NTP)
NTP Operation
Each level in this hierarchical system is called a stratum. The stratum level is defined as the number of hop counts from the authoritative source.
Smaller stratum numbers indicate that the server is closer to the authorized time source than larger stratum numbers. The larger the stratum number, the lower the stratum level.
** The max hop count is 15. Stratum 16, the lowest stratum level, indicates that a device is unsynchronized. Time servers on the same stratum level can be configured to act as a peer with other time servers on the same stratum level for backup or verification of time.
Configure and Verify NTP
Ej: ? command displays the current time on the software clock and the time source is also displayed
Ej: the software clock has been manually configured.
"ntp server (ip-address) "
Configure and Verify NTP
Ej: ? commands to verify that R1 is synchronized with the NTP server at 209.165.200.225
Notice that R1 is synchronized with a stratum 1 NTP server at 209.165.200.225, which is synchronized with a GPS clock.
R1 is now a stratum 2 device synchronized with the NTP server at 209.165.220.225.
Password Recovery
Passwords on devices are used to prevent unauthorized access. For encrypted passwords, such as the enable secret passwords, the passwords must be replaced after recovery.
Depending on the device, the detailed procedure for password recovery varies; however, all the password recovery procedures follow the same principle:
Password Recovery
Console access to the device through a terminal or terminal emulator software on a PC is required for password recovery. The terminal settings to access the device are:
- 9600 baud rate
- No parity
- 8 data bits
- 1 stop bit
- No flow control
Password Recovery
The ROMMON software supports some basic commands, such as confreg. The confreg 0x2142 command allows the user to set the configuration register to 0x2142. With the configuration register at 0x2142, the device will ignore the startup config file during startup.
The startup config file is where the forgotten passwords are stored. After setting the configuration register to 0x2142, type reset at the prompt to restart the device. Enter the break sequence while the device is rebooting and decompressing the IOS.
Password Recovery
Ej: After the device has finished reloading, copy the startup-config to running-config
CAUTION: Do not enter "copy running-config startup-config" This command erases your original startup configuration.
Password Recovery
Because you are in privileged EXEC mode, you can now configure all the necessary passwords.
After the new passwords are configured, change the configuration register back to 0x2102 using the "config-register 0x2102" command in the global configuration mode. Save the running-config to startup-config and reload the device
The device now uses the newly configured passwords for authentication. Be sure to use show commands to verify that all the configurations are still in place
