I frequently use
sh int | i (FastEthernet|0 packets input)
or the same with GigabitEthernet, whatever kind of interfaces I want to check.
sh int (which is show interfaces) gives a huge list of ste status of all interfaces
The pipe symbol | can be used for filtering, but also in search expressions
| i (for include) filters the output which matches the ...
You need to use the following command to add your VLAN 30 to an existing Dot1Q trunk on a Cisco Catalyst switch:
switchport trunk allowed vlan add 30
Otherwise IOS just thinks you're trying to overwrite the existing configuration and you are left with an accidentally deleted set of allowed VLANs.
You could similarly use "remove" in place of "add" to ...
Ultimately... DOCUMENTATION. You need to know where every patch cable goes to be 100% certain you aren't disconnecting something someone may expect to work at some point. Just because a port is currently "down" doesn't mean someone has not been using it. Also just because the counters are currently zero doesn't mean it's never been used or not going to be ...
The VPN can be reset by entering
clear crypto ipsec sa peer <remote-peer-IP>
on one side. The following traffic will cause the IPSEC tunnel to be reestablished.
You can do it on your side, entering the remote IP. Or login to the remote site, but possibly you have to do it outside the VPN, so using a different interface, for example using the public ...
In most modern versions of IOS (since 12.2(8)T - thanks @ytti) BGP synchronization is disabled by default (and shown in the running config as such, ie no synchronization shows up in show run when you turn on BGP). As to which IOS version they decided to make it a "hidden default", I'm not entirely too sure, but you should be able to do:
show running-config ...
We can use the alias command in global conf mode:
alias <mode> <command-alias> <original-command>
<mode> is one of the many IOS command modes. If you need it in different modes, you have to call it for each one - type alias ? to get a long list of modes.
An example for checking for a dhcp snooped IP, type in global conf mode
"logging synchronous" prevents every logging output from immediately interrupting your console session.
See command documentation:
"This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts."
show ip route vrf * displays the global routing table plus all the VRF instances.
sh ip route vrf * 0.0.0.0 displays the default route for each VRF.
This shows the default route for each VRF, including the default VRF. As this IOS 12.4 doesn't show the VRF name when displaying a matching route, a route tag was added on the static routes to help identify ...
You can reset the tunnel via the ASDM software as well as in the command line.
In the ASDM (Version 6.3):
Go to Monitoring, then select VPN from the list of Interfaces
Then expand VPN statistics and click on Sessions.
Choose the type of tunnel you're looking for from the drop-down at the right (IPSEC Site-To-Site for example.)
Click on the tunnel you wish ...
Fully agreed with Stefan. VRF is the way to go here. Quick example how to incorporate it to suggested config:
ip vrf VLAN1
ip vrf VLAN2
ip vrf forwarding VLAN1
ip address 18.104.22.168 255.255.255.0
ip vrf forwading VLAN2
ip address 22.214.171.124 255.255.255.0
Now vlan1 and vlan2 routing is separated.
To inspect ...
You could monitor the traffic
on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL.
set up an access list for matching the traffic
create a capture buffer monitor capture buffer holdpackets filter access-list <number>
define a capture point monitor capture point ... ...
They are in order of specificity; The most specific (longest network mask) is first, and the least specific (shortest netmask) is last. If the network is variably subnetted, then they are grouped with the least-specific of the various netmasks, and ordered most-specific-first in each of the groupings.
It seems the output of show ip route is in the ...
Is there any reason why Cisco show run does not show the full version which is 16.3.7 in this example?
For the simple reason that the only the major and minor versions are necessary for a complete understanding of the configuration. While there may be feature changes and/or enhancements between 16.2 and 16.3, changes in the build/revision should not impact ...
I also like
sh int | inc line protocol is|Last input
FastEthernet0/29 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
FastEthernet0/30 is up, line protocol is up (connected)
Last input never, output 00:00:07, output hang never
FastEthernet0/46 is down, line protocol is down (notconnect)
If you actually configured
line vty 04
Then you have something like:
line vty 0 3
transport input telnet ssh
line vty 4
transport input ssh
This is because you configured only the fifth VTY line (04=4).
The correct command is:
line vty 0 4
line vty 0 15
since most (all?) modern Cisco switches have 16 vty lines and not 5.
In the simplest sense, shutdown turns the interface off.
no shutdown turns the interface on (enables it).
You can configure an interface in either case. Using the shutdown command is one of the things you can do when configuring an interface.
I would scrape the output (or grab it with SNMP, even better) and use standard UNIX tools to parse it. Here's an easy example:
Here, I saved a partial output from 'show int counters' (just for demo purposes) to a file called "counters".
[mkantows@ochofu049]$ cat counters
Port InOctets InUcastPkts InMcastPkts InBcastPkts
I like @Stefan's answer but with this command line "sh int | i (Ethernet| 0 packets input)" which now grabs all Ethernet interface types and filters out non-zero numbers that happen to end in zero. He mentioned that some fine tuning might be possible so this is just one example.
Another option is...
sh int counters | i (Port|_0 0 ...
Depending on which version of 12.x you're on, you should be able to do the following:
router(config-sip-ua)#no transport tcp
router(config-sip-ua)#no transport udp
This stops the router from listening on port 5060.
Usually NAT will be used to translate between private to public IP address but this is not the only use case. You can also translate between any addresses you want such as private to private.
The terms local and global most often refer to the inside and outside of your network but this doesn't mean that it MUST be LAN and WAN although it often is.
So say ...
The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session.
The default gateway on a switch has the same function as ...
Cisco devices add a salt to the passwords before hashing so they can't be cracked with dictionary attacks (such as rainbow tables). The salt is partially made up of the device ID, if I recall.
MD5 is mostly still safe to use but is known to have collisions, so it's almost always suggested to use another hashing algorithm. On some of the more recent ...
I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session.
Issue this for example to get a list of site to site vpn tunnels that are up.
show vpn-sessiondb l2l
Connection : 192.168.1.1
Index : 330 ...
$1$ marks the MD5-crypt password hash also commonly used in past years for user passwords in Linux systems. In that function, it's now been pretty much superseded by the similar SHA256-crypt and SHA512-crypt hashes ($5$ and $6$). None of those are just a single run of the underlying hash function, but iterate the hash repeatedly and include a salt (the part ...
I would recommend using a route-map for only one purpose (one for nat, another to pbr); mixed use can make for a mess. For NAT, the match interface will apply post-routing -- handy to make conditional nat entries.
The route-map for PBR should use an ACL to match the traffic coming from LAN2 and then set the next-hop to the desired interface with set ...
While ACLs are a simple and safe way, it doesn't scale well indeed.
If your router provides VRF or at least the the VRF Lite feature you could group VLANs into VRFs. A VRF can be seen like a virtual router, VRF instances cannot talk to each other unless you explicitely define routing between them.
In a complex network, I group VLANs into several security ...
Technically, you're doing PPPoEoA.
The VC Mux part will have to be set on the modem, as that's the only thing that has access to the ATM layer. If you had a dsl interface in the router, you'd do:
blue-gw#show run int atm0.1
Current configuration : 131 bytes
interface ATM0.1 point-to-point
pvc dsl 8/35