Lesson 3 - Initial Configuration of Cisco Switch and Router

Understanding technologies requires a skill. Even though not mine, but the best definition of what a skill is, could be summarized in five words: knowledge and one thousand repetitions.

In this lesson, there is no real technology to explain. Instead, you will get familiar with some useful commands we use very often while configuring our routers and switches. This practical exercise however, is going to help hone your skills obtained in the previous lesson.

Take a look at our simple topology first:

And here's our plan for the initial configuration. 

1. Configure the host names on both the switch and the router (SW1 and R1 respectively).
2. When you mistype the command in the 'enabled mode' the IOS is trying to resolve this name to ip address. Disable that name resolution.
3. Protect the 'privileged exec mode' with clear text password. Use 'cisco_enable' as your password.
4. Encrypt the password with 'over-shoulder' algorithm.
5. Protect the access to the console port 0. Use 'cisco_console' as your password.
6. Configure the console port 0, so it disconnects you after 5 min. 30 sec. of idleness.
7. Configure the console port 0 such, that system messages sent to the screen, do not interfere with what you are typing.
8. After careful consideration you decide to use the most secure access to the 'privileged exec mode'. Disable the previous method and configure the same password using MD5 algorithm to encrypt the password.
9. On the switch assign ip address (use: 192.168.1.253/24) on the management interface Vlan 1.
10. Configure the switch to use the default-gateway (address of the default gateway: 192.168.1.254/24) in case it is managed remotely from another subnet or network.
11. Enable the router's interface FastEthernet1/0. Use 192.168.1.254/24 address.
12. Enable the interface facing the Internet Serial0/1 (we pretend it is the public interface). Use ip address 172.31.1.1/30.
13. Enable the remote access to your devices via telnet. Use password 'cisco_remote'.
14. After careful consideration you decide to use ssh as the remote access method rather than telnet. Configure that.
15. Save the configuration on both switch and the router so it is available after reload/power cycle.

Solution:

1. Configure the host names on both the switch and the router (SW1 and R1 respectively). 

---

Most of the steps are identical on a switch and a router.  That is why I'm presenting, router's configuration only. You have to repeat them on the switch yourself. If the configuration of the switch is different, it is presented as well (step 9 and step 10).

---

If your prompt shows the user mode '>' you must enter the privileged mode first by typing 'enable':

Router>enable

Router#

Then, in order to set the host name on the router you must enter the 'config mode' (you can abreviate the command to 'conf t'):

Router#configure terminal

Router(config)#

Finally, you type in:

Router(config)#hostname R1

R1(config)#

---

NOTICE!
The commands take effect immediately as long as their syntax is correct.

---

2. When you mistype the command in the 'enabled mode' the IOS is trying to resolve this name to ip address. Disable that name resolution. 

R1(config)#no ip domain-lookup

3. Protect the 'privileged exec mode' with clear text password. Use 'cisco_enable' as your password.

R1(config)#enable password cisco_enable

4. Encrypt the password with 'over-shoulder' algorithm.

R1(config)#service password-encryption

5. Protect the access to the console port 0. Use 'cisco_console' as your password.

In order to do that you have to change the context from 'config mode' to 'line console 0' mode. Pay attention to the prompt! The 'login' keyword is going to prompt the user for the password.

---

NOTICE!
the 'no login' command would allow the user to access the console 0 WITHOUT asking for the password even if one was configured.

---

R1(config)#line console 0

R1(config-line)#password cisco_console

R1(config-line)#login

6. Configure the console port 0, so it disconnects you after 5 min. 30 sec. of idleness.

We're still in console 0 prompt so, we can continue configuring console 0.

R1(config-line)#exec-timeout 5 30
R1(config-line)#

If you wanted the console line 0 to never disconnect you during the time of idleness, you would use:exec-timeout 0 0.

7. Configure the console port 0 such, that system messages sent to the screen, do not interfere with what you are typing.

By default, all system messages are sent to the console 0 and they may interfere with what you are currently typing on the console 0 line. If you are accessing the device via telnet/ssh (remotely), you do not see any messages. If you want to see them on the vty lines (remote connection via telnet/ssh), you must type in: 'terminal monitor' in the 'enabled mode'. Here is the command to satisfy the step 7 in our design:

R1(config-line)#logging synchronous

8. After careful consideration you decide to use the most secure access to the 'privileged exec mode'. Disable the previous method and configure the same password using MD5 algorithm to encrypt the password.

As we are still in the line console 0 context (look at the prompt), we need to step back to the 'config mode', and then remove the previous 'enable' password. Next we will proceed with md5 password configuration. If you did not remove the previous 'enable password', system is going to use the more secure one anyway.

R1(config-line)#exit

R1(config)#no enable password
R1(config)#enable secret cisco_enable

9. On the switch assign ip address (use: 192.168.1.253/24) on the management interface Vlan 1.

I assume that you have completed the steps 1-8 on BOTH router and switch. The commands and prompts will be identical. Now, you can assign ip address on Vlan 1 interface.

SW1>enable

SW1#conf t

SW1(config)#interface vlan 1

SW1(config-if)#ip address 192.168.1.253 255.255.255.0

SW1(config-if)#no shutdown

10. Configure the switch to use the default-gateway (address of the default gateway: 192.168.1.254/24) in case it is managed remotely from another subnet or network.

We need to step back to 'config mode' from interface Vlan1 mode to accomplish the task.

SW1(config-if)#exit

SW1(config)#ip default-gateway 192.168.1.254

11. Enable the router's interface FastEthernet1/0. Use 192.168.1.254/24 address.

R1(config)#interface f1/0

R1(config-if)#ip address 192.168.1.254 255.255.255.0

R1(config-if)#no shutdown

12. Enable the interface facing the Internet Serial0/1 (we pretend it is the public interface). Use ip address 172.31.1.1/24.

Even though we are currently in F1/0 interface context (look at the prompt), we can jump directly towards s0/1 without typing 'exit' first. If you use real routers (not dynamips), one end of the connection must use DCE cable and the other DTE cable. They are connected back-to-back and DCE interface must be set up with the clock rate.

R1(config-if)#interface s0/1

R1(config-if)#ip address 172.31.1.1 255.255.255.252

R1(config-if)#no shutdown

13. Enable the remote access to your devices via telnet. Use password 'cisco_remote'.

Remote access connections are service by special, virtual lines called vty. Here, we will use vty lines 0 through 4, allowing only five concurrent connections via telnet.

R1(config-if)#line vty 0 4

R1(config-if)#password cisco_remote
R1(config-if)#login

14. After careful consideration you decide to use ssh as the remote access method rather than telnet. Configure that.

This is going to be the most complex part in our lab. Below are four steps need to complete the task.

a) Configure system domain-name. Without the domain name, IOS cannot generate rsa keys used for encryption and decryption (public/private). The domain name can be any name you choose to use (here: ccna.local) but company's real name is a good idea.

R1(config-line)#exit

R1(config)#ip domain-name ccna.local

R1(config)#

b) When you type the below command the system will ask you what should be the length of the keys. Choose 1024 value. IOS will take a few seconds to generate them and automatically start SSH server. Wait till it's done.

R1(config)#crypto key generate rsa

R1(config)#

c) Create a user account that will be used for ssh access (here: user=admin, password=S3cr3t).

R1(config)#username admin password cisco_remote

R1(config)#

d) Enable ssh protcol and disable telnet on vty lines 0 4. Make sure that ssh will use locally created user (admin) for ssh connections. This is done using 'login local' command.

R1(config)#line vty 0 4

R1(config-line)#transport input ssh

R1(config-line)#login local

R1(config-line)#end

R1#

15. Save the configuration on both switch and the router so it is available after reload/power cycle.

R1#copy running-config startup-config 

Thnx to ciscoiseasy, for letting us serve you with the simulations.

Lesson 1 - Connecting to Cisco Console Port with MINICOM

Cisco is not hard. When I learned it, anybody could do it!

If you are a linux user user you must learn how to connect to your Cisco router or switch using roll-over cable (the cable that comes with your device).

Step1 - Installing Minicom

Linux users will use application called 'minicom'.  If you are Ubuntu user you can install it using either 'Synaptic Package Manager' or type in the following in your terminal window:

$ sudo apt-get install minicom

Once it is installed, you must configure the 'minicom' to communicate with the console port of your router/switch.

Step 2 - Connection to Console Port

Power up your router/switch and connect the roll-over cable to your computer's serial port (DB-9) and to the 'console' port of your router/switch (RJ-45).

Step 3 - Configure Minicom

Open your Terminal window (Applications ==> Accessories ==> Terminal) and type in:

$ minicom -s

Scroll down to 'Serial Port Setup' and hit Enter:

Pic. 1

Choose 'A' to set up the serial port of your computer (here the first serial port is referenced as ttyS0) so it reads as highlighted below. Then hit Enter again to accept the change:

Pic. 2

Next, press 'E' and then 'C' again to access the transmission speed and change it to '9600' value (no apostrophies). You should see values like highlighted below:

Pic. 3

Then hit Enter twice to get back to the first screen (Pic.1)

The last thing is to save this configuration (you can choose 'dfl' to be the default template or with some other name).

Pic. 4

  

If you chose 'dflp and then, 'Exit from Minicom', you can try out your work now. Type in:

$ minicom

and hit Enter

You should see the console prompt of your router/switch. If you want to leave the minicom use CTRL-A keystroke and then type 'x' and confirm you want to leave the application.

How to : Basic Router Configuration

Initial Router Configurations: This post shows how to configure the router initially from router
 boot process to optimizing router for best user experience to securing routers console and telnet ports.
 I am using GNS3 and router 2691 image in gns3.

Initial Router Boot Process : Router boot Process consist of

1> POST : Power On Self Test

2> Booting IOS (operationg system of cisco devices) from routers flash memory.

3> Initial Configuration Setup : I basically prefer not to set up router from initial config

When you chose no to initial config dialog router will enter into user mode which is designated as

Router> This mode is known as user mode, you can do ?
For the commands you can enter in this mode. you can only use very general show commands
 from this mode.

Router>?

Exec commands:

access-enable Create a temporary Access-List entry

access-profile Apply user-profile to interface

clear Reset functions

connect Open a terminal connection

disable Turn off privileged commands

disconnect Disconnect an existing network connection

enable Turn on privileged commands

exit Exit from the EXEC

help Description of the interactive help system

lock Lock the terminal

login Log in as a particular user

logout Exit from the EXEC

modemui Start a modem-like user interface

mrinfo Request neighbor and version information from a multicast

router

mstat Show statistics after multiple multicast traceroutes

mtrace Trace reverse multicast path from destination to source

name-connection Name an existing network connection

pad Open a X.29 PAD connection

ping Send echo messages

ppp Start IETF Point-to-Point Protocol (PPP)

resume Resume an active network connection

rlogin Open an rlogin connection

show Show running system information

slip Start Serial-line IP (SLIP)

ssh Open a secure shell client connection

systat Display information about terminal lines

tclquit Quit Tool Command Language shell

telnet Open a telnet connection

terminal Set terminal line parameters

tn3270 Open a tn3270 connection

traceroute Trace route to destination

tunnel Open a tunnel connection

udptn Open an udptn connection

where List active connections

x28 Become an X.28 PAD

x3 Set X.3 parameters on PAD

To Enter into privilege mode do

Router>en

Router# In this mode you can do some show commands, copy commands to save your
 running-configuration to your routers startup configuration

To enter to the main configuration mode do

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)# (This is the main mode for configuring basically everything in the router)

So lets start configuring the router

How to change the hostname of router

Router(config)#hostname testrouter

testrouter(config)#

here above you can see the change in hostname from default hostname Router to testrouter

How to configure log on banner on router

testrouter(config)#banner motd *

Enter TEXT message. End with the character '*'.

Personal Router Unauthorized access Restricted

*

Above motd means message of the day and this banner is displayed at first log on.
 You have to enter the same Character at the start and end of each motd in this case it is *.

Below you can see how the banner is displayed

testrouter con0 is now available

Press RETURN to get started.

*Mar 1 00:24:00.555: %SYS-5-CONFIG_I: Configured from console by console
Personal Router Unauthorized access Restricted

How to Secure the console login of router : ( When you connect your router to P.C with console cable,
 this console password is required)

testrouter(config)#line console 0

testrouter(config-line)#password cisco

testrouter(config-line)#login (The opposite of login i.e no login will not ask for password when loggin
through console of the router , which can be very risky)

How to secure telnet login of the router : This will secure the login when telneting from the remote P.C

testrouter(config)#line vty 0 ?

<1-935> Last Line number



The above command shows that this router supports 936 vty ports (virtual tele terminal i.e 936 connections )

testrouter(config)#line vty 0

testrouter(config-line)#line vty 0 4

testrouter(config-line)#login

% Login disabled on line 66, until 'password' is set

% Login disabled on line 67, until 'password' is set

% Login disabled on line 68, until 'password' is set

% Login disabled on line 69, until 'password' is set

% Login disabled on line 70, until 'password' is set

testrouter(config-line)#password test

The commands allows the telnet login for vty 0 4 and requires password test to enter
 to the router through telnet.

How to secure privelege/enable mode on router : This configuration will ask for the password 
when entering from the user mode to privilege mode

testrouter(config)#enable secret test

testrouter(config)#exit

testrouter#exit

Below shows how this router asks for the password

testrouter con0 is now available

Press RETURN to get started.

*Mar 1 00:37:34.707: %SYS-5-CONFIG_I: Configured from console by console

Personal Router Unauthorized access Restricted

User Access Verification

Password:

testrouter>en

Password:

testrouter#

How to optimize router for best user experience:

Below command should be entered both for line console and for line vty, I will be showing in console,
 you can do the same in line vty

testrouter(config)#line co

testrouter(config)#line console 0

testrouter(config-line)#log

testrouter(config-line)#logg

testrouter(config-line)#logging sy

testrouter(config-line)#logging synchronous

loggin synchronous will keep the status messages from interrupting what you are typing

testrouter(config-line)#exec-timeout 20 0 : exec timeout will give the timeout interval i.e here if
 no command is typed for 20 minutes the router will throw the user to user mode

Thank You,

In my next post of cisco basics I'll be configuring interfaces. Hope this will be informative for you

How to Configure Interface on Routers :

There may be various kinds of interfaces on the router like fastethernet, serial etc, but for all the 
interface, configuration are basically similar. I am going to show you here the commands
 for configuring the most popular interfaces i.e fastethernet and serial

testrouter#show ip interface brief (This command will show you all the interface, configured ip address,
 interface status, protocol status etc)

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 unassigned YES unset administratively down down

FastEthernet0/1 unassigned YES unset administratively down down

If you want more detailed description then you can do

testrouter#show interfaces ( This will show you detailed view of the interfaces like MTU size,
 Encapsulation on the interface, Erros etc which will be discussed later on other topics.)

you can also do

testrouter#show interfaces fastEthernet 0/0

for detailed configuration of specific interfaces.

To configure interface goto the interface in your routers

testrouter#config t

testrouter(config)#interface fastEthernet 0/0

testrouter(config-if)#ip address 192.168.1.20 255.255.255.0

testrouter(config-if)#no shutdown

*Mar 1 00:07:17.667: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Mar 1 00:07:18.667: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0
changed state to up

testrouter(config-if)#do show ip interface brief

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 192.168.1.20 YES manual up up

FastEthernet0/1 unassigned YES unset administratively down down

As you can see from the above that now FastEthernet0/0 is configured with ip address 192.168.1.20 and its status and protocol are both up. Any time you see status up but protocol down then it means the interface is administratively down and you have to issue no shutdown commands on the interface. If status is down then you have to check your physical connection as Status deals with physical layer. By the way , you can use show commands from any mode, but you have to use it with do.