CCNA Exploration 4 IOS Commands Page 1 IOS Commands Last ...

CCNA Exploration 4 IOS Commands

IOS Commands Last update: 2/7/8 Refs:

L – Labs All others are Exploration 4 v4 curriculum material TI references.

2.1.6

R(config-f)# encapsulation hdlc

HDLC is the default encapsulation

show interface serial

Determine the ecapsulation

show controllers

Determine DCE or DTE

interface serial 0/0 encapsulation ppp compress [predictor | stac] ppp quality percentage ppp callback [accept | request]

PPP encapsulation

2.3.2

Options

ppp multilink 2.3.4

debug ppp [packet] [negotiation] [error]

2.4.5

ppp authentication {chap | pap | chap pap | pap chap } [callin]

PPP authentication

2.4.5

hostname R1 username R3 password sameone ! int s0/0 encapsulation ppp ppp authentication pap ppp pap sent-username R1 password sameone

Configure PAP authentication example

hostname R1 username R3 password sameone ! int s0/0 encapsulation ppp ppp authentication chap

Configure CHAP authentication example

2.4.6

debug ppp authentication

Frame Relay 3.1.5 3.1.5

int s0/0 encapsulation frame-relay [cisco | ietf] frame-relay lmi-type [cisco | ansi | q933a] keepalive number no frame-relay inverse-arp frame-relay map ip addr dlci [broadcast] [cisco | ietf]

Default is cisco From IOS 11.2, the default LMI autosense feature detects the LMI type Number of secs for LMI keepalive interval. Default 10 secs. Disable inverse arp Static mapping

int s0/0/0 ip address 10.10.10.1 255.255.255.0 encapsulation frame-relay no shutdown no frame-relay inverse-arp frame-relay map ip 10.10.10.2 102 broadcast frame-relay map ip 10.10.10.3 103 broadcast

Example: Static mapping

frame-relay lmi-type [cisco | ansi | q933a] keepalive

Set LMI switch type (pre IOS 11.2)

3.4.1

interface s0/0.103 [multipoint | point-to-point]

Creating a FR sub-interface

3.4.1

R1(config-subif)# frame-relay interface-dlci dlci

Links a DLCI with a subinterface. Use only with subinterfaces.

Mel Ralph, Expl4 IOS.doc, 02/07/2008

Page 1

CCNA Exploration 4 IOS Commands 3.4.2 3.1.5 3.1.5

show interfaces show frame-relay pvc [interface interface] [dlci] clear counters show frame-relay map show frame-relay lmi debug frame-relay lmi

3.4.2

clear frame-relay inarp

3.4.3

debug frame-relay lmi

Clear dynamically created Frame Relay maps that are created using Inverse ARP

Network Security 4.2.3

R1(config)# do show run | include string

4.2.3

enable password password

4.2.3

username username password password

Local database

4.2.3 4.2.3 4.2.4

service password-encryption security passwords min-length n line aux 0 login no password

Use type 7 password encryption IOS 12.3(1) and later. Prevent login on a line. Default for VTY.

4.2.4

transport input protocol

Specify a VTY connection protocol

4.2.4

line vty 0 4 no transport input transport input telnet ssh exec-timeout 3 service tcp-keepalives-in

Support incoming Telnet and SSH sessions

4.2.4

hostname R1 ip domain-name cisco.com crypto key generate rsa username student secret password line vty 0 4 transport input ssh login local ip ssh time-out 15 ip ssh authentication-retries 2

Example: Configure SSH

4.2.5

service timestamps

Enable time-stamps for debug and log msgs.

4.3.1

no no no no no no no no no

service tcp-small-servers service udp-small-servers ip bootp server ip finger service finger ip http server snmp-server ip bootp server ip name-server

Vulnerable Router Services

no no no no no

cdp run boot network service config ip source-route ip classless

4.2.4

shutdown no ip directed-broadcast no ip proxy-arp no ip unreachable no ip redirect 4.3.1

Prevent idle session. Enable TCP keepalives.

Interface mode:

ip name-server addresses no ip domain-lookup passive-interface default no passive-interface s0/0/0

4.3.2

key chain RIP_KEY

Mel Ralph, Expl4 IOS.doc, 02/07/2008

RIPv2 authentication.

Page 2

CCNA Exploration 4 IOS Commands key 1 key-string cisco int s0/0 ip rip authentication mode md5 ip rip authentication key-chain RIP_KEY key chain EIGRP_KEY key 1 key-string cisco

Configure authentication for EIGRP:

int s0/0 ip authentication mode eigrp 1 md5 ip authentication key-chain eigrp 1 EIGRP_KEY int s0/0 ip ospf message-digest-key 1 md5 cisco ip ospf authentication message-digest

Configure authentication for OSPF:

router ospf 10 area 0 authentication message-digest 4.3.3

R# auto secure

4.4.2

ip http server ip http secure-server ip http authentication local username Student privilege 15 secret cisco line vty 0 4 privilege level 15 login local transport input telnet ssh

4.5.1

show file systems

4.5.2

copy copy copy copy

4.5.4

show flash: copy flash: tftp:

4.5.6

service timestamps debug datetime msec show processes no debug all terminal monitor

4.5.7

config-register 0x2102

Configuration register. Factory setting.

L 4.6.1

username name [privilege 0-15] password password

Default privilege is 0.

Cpedia

R(config)# username mark password kram R(config)# line console 0 R(config-line)# login local

Use local database to authenticate login

R(config)# line console 0 R(config-line)# login R(config-line)# password cisco

Use password command, no username.

system:running-config nvram:startup-config system:running-config tftp: tftp: system:running-config tftp: nvram:startup-config

Configure a router to use SDM

copy command is used to move configuration files

Backing Up IOS Software Image

ACLs 5.2.2

R(config)# access-list number {deny|permit|remark} source [source-wildcard] [log]

Configuring Standard ACLs

no access-list number 5.2.4

R(config-if)# ip access-group {access-list-number | access-list-name} {in|out}

Apply an ACL to an interface

access-class access-list-number {in [vrf-also] | out}

Using an ACL to Control VTY Access

Mel Ralph, Expl4 IOS.doc, 02/07/2008

Page 3

CCNA Exploration 4 IOS Commands

5.2.5

line vty 0 4 login password class access-class 21 in

Example

show run | include access-list no access-list 20

Editing Numbered ACLs

access-list number remark remark 5.2.6

ip access-list [standard | extended] name

Standard Named ACLs

ip access-group name [in|out] 5.2.7

show access-lists [ acl-number|name ]

5.3.2

access-list number {deny | permit | remark} protocol sourceIP [source-wildcard] [op port-number] destIP [dest-wildcard] [op port-number] [established]

Extended ACLs

DHCP 7.1.4

ip dhcp excluded-address low-address [high-address] ip dhcp pool name network net-addr subnet-msk default-router ipaddr dns-server ipaddr no service dhcp show ip dhcp binding show ip dhcp server

7.1.5

show ip dhcp pool ip address dhcp

7.12.8

R2# show ip dhcp conflict

Enable is the default displays a list of all IP address to MAC address bindings count information regarding the number of DHCP messages view multiple pools Configuring a router int as a DHCP Client

access-list 100 permit ip host 0.0.0.0 host 255.255.255.255 debug ip packet detail 100 debug ip dhcp server events

NAT 7.2.4

ip nat inside source static 192.168.10.254 209.165.200.254 int s0/0 ip nat inside int s0/1 ip nat outside

Static NAT

access-list 1 permit 192.168.0.0 0.0.255.255

Dynamic NAT

ip nat pool NAT-POOL1 209.165.200.226 209.165.200.240 netmask 255.255.255.224 ip nat inside source list 1 pool NAT-POOL1 7.2.6

ip nat inside source list 1 interface s0/1 overload

NAT Overload for a Single Public IP Address

access-list 1 permit 192.168.0.0 0.0.255.255

NAT Overload for a Pool of Public IP Addresses

ip nat pool NAT-POOL2 209.165.200.226 209.165.200.240 netmask 255.255.255.224 ip nat inside source list 1 pool NAT-POOL2 overload 7.2.8

show ip nat translations [verbose] show ip nat statistics

Mel Ralph, Expl4 IOS.doc, 02/07/2008

Page 4

CCNA Exploration 4 IOS Commands

ip nat translation timeout timeout_seconds clear ip nat translation *

Default is 24 hrs

debug ip nat [detailed] IPv6 ipv6 address ipv6-address/prefix-length

Assign address to interface

ipv6 address ipv6-prefix/prefix-length eui-64

EUI-64 Interface ID Assignment

7.3.4

ipv6 unicast-routing int fa0/0 ip address 192.168.99.1 255.255.255.0 ipv6 address 3ff:b00:c18:1::3/127

Dual Stacking example

7.3.7

ipv6 host name [port] ipv6-address1 [ipv6-address2...ipv6-address4]

Specify host name

ip name-server address

Specify DNS server

ipv6 unicast-routing ipv6 router rip name int fa0/0 ipv6 rip name enable

Configure RIPng with IPv6

7.3.2

7.3.8

Mel Ralph, Expl4 IOS.doc, 02/07/2008

Page 5