Clear config on a port

To clear the config on a port: Use the default interface command:

eg: you have changed int gi1/0/19

conf t
default interface gi1/0/19

Saves having to put no .. blah blah on each interface.

TDR testing – testing cables

A time-domain reflectometer (TDR) is an electronic instrument used to determine the characteristics of electrical lines by observing reflected waveforms. It can be used to characterize and locate faults in metallic cables (for example, twisted pair wire or coaxial cable).

With Cisco, you can run TDR tests without any hardware.

1. Command to start the TDR: “test cable tdr interface <interface of your choice>”;
2. Wait for about 5 to 7 seconds for the test to run; and.
3. Command to show the result of the TDR test: “show cable tdr interface <interface of your choice>”

Here is a TDR from a defective cable:

TDR test last run on: September 01 14:59:13

Interface   Speed Local pair Pair length        Remote pair Pair status
———   —– ———- —————— ———– ——————–
Gi4/0/39    100M  Pair A     57   +/- 10 meters N/A         Normal
Pair B     62   +/- 10 meters N/A         Normal
Pair C     14   +/- 5  meters N/A         Short
Pair D     0    +/- 5  meters N/A         Open

===============================================

Suspend mode – LACP

Servers using ‘teamed’ nics, (LACP) can fail if the switch is rebooted because the server fails to respond to LACP BPDUs.  This will result in a loss of connection to the server.

Solution 1:

LACP sets a port to the suspended state if it does not receive an LACP bridge protocol data unit (BPDU) from the peer ports in a port channel. This can cause some servers to fail to boot up as they require LACP to logically bring up the port.

This command does not require a license.

Examples

This example shows how to enable LACP port suspension on a port channel:

switch# configure terminal

switch(config)# interface port-channel 100

switch(config-if)# shutdown

switch(config-if)# lacp suspend-individual

switch(config-if)#

This example shows how to disable LACP port suspension on a port channel:

switch# configure terminal

switch(config)# interface port-channel 100

switch(config-if)# no lacp suspend-individual

switch(config-if)#

Solution 2:

Remove and join ports to the port channel, one by one.

show lacp [port channel number] neigh

(check the interfaces which are expected to join this port channel we will change the config of those interfaces)

Conf t

interface [the first interface which is configured for the port channel being checked]

no channel-group [the port channel number] mode active

!

interface [the second interface which is configured for the port channel being checked]

no channel-group [the port channel number] mode active

channel-group [the port channel number] mode desirable

!

interface [the first interface which is configured for the port channel being checked]

channel-group [the port channel number] mode desirable

!

When it is done, to check the interfaces are now up/up and the service given by the servers connected to them have been restored.

Repeat this process for each impacted port channel.

Configuring netflow – top talkers, etc

Configuring netflow – top talkers, etc Netflow can be configured in internal or external interface.  ip flow-cache entries 2000 ip flow-cache timeout active 30 <On interface:  eg int g0/0> ip flow ingress ip flow egress (or) ip route-cache flow ip flow-top-talkers top 50 sort by  (Note: This means sort by bytes – command is correct.) cache-timeout 600000 To query netflow:  sh ip flow top-talkers Typical output:  Router#sh ip flow top-talkers

Problem: Switchports will not go into voice VLAN no matter what you do: -ISL

Problem:  Switchports will not go into voice VLAN no matter what you do: Very old switches: IOS ™ C2900XL Software (C2900XL-C3H2S-M) . Eg 2924. To enable phones to work, need to trunk the switchports, and because they are so old, they are encapsulating in ISL. Need to add this code for each port:switchport trunk encapsulation dot1q switchport mode trunk switchport voice vlan X

Using an ACL to prevent internet access for a specific host

Using an ACL to prevent internet access for a specific host. (RFC 1819 addresses)   A reminder:  Extended ACL should be put as close to the source of traffic as possible. Hence, if you are trying to block a host from getting to the internet, the internal interface is where the ACL should be applied.     Extended IP access list block-xp-inet 10 permit ip any 10.0.0.0 0.255.255.255 (6208743 matches) (Three private network ranges, known as RFC1819 addresses) 20 permit ip any 172.16.0.0 0.15.255.255 (38084001 matches) 30 permit ip any 192.168.0.0 0.0.255.255 (39679 matches) 40 deny ip (host ip)  0.0.0.1 any (276 matches) (Blocks the individual hosts:  As there were two, we used two addresses which would be in the a /31 range:  0-1 1-2 3-4 4-5 5-6 6-7 8-9 10-11 12-13 etc) 50 permit ip any any (25393344 matches) 60 deny ip any any log (Shows how the access list is working)

SSH access on Cisco routers and switches

4 things needed for ssh   – Device name – Domain name – RSA Crypto Key – If you copy a config from one router to another, you will need to regenerate the RSA keys, otherwise you will lock yourself out of the router. – Enable SSH   no ip http server no ip http secure-server ! hostname “Test” ! ip domain name test.net ! crypto key gen rsa 1024 ! ip ssh version 2 ! line vty 0 15 transport input ssh transport output ssh

Finding a rogue DHCP server

Find a machine which has an address from the rogue DHCP server. Ask the user to browse to the gateway address.  That might tell you what it is. On the Windows machine run arp –a from the command prompt, to find the MAC address of the dhcp server. Find the port with that MAC and shut the rogue DHCP  down. If you can’t get access to a user machine, create a secondary IP in the same VLAN as the user (usually the production vlan) in the same range as the rogue DHCP server.  eg, if the server is 192.168.1.1, create secondary IP of 192.168.1.55, for example. Ping 192.168.1.255 and then run sh arp.  You will probably find the server. Then on the switch find the port and shut it down.

Port Security

Port security

 

http://www.computernetworkingnotes.com/ccna-study-guide/switchport-port-security-explained-with-examples.html

GNS3 ASA 5520

GNS3 supports ASA5520 emulation.  Note:  GNS3 Version 0.8.7.

http://ithitman.blogspot.co.uk/2013/08/gns3-configuring-asa-on-gns3.html