41

I frequently use sh int | i (FastEthernet|0 packets input) or the same with GigabitEthernet, whatever kind of interfaces I want to check. sh int (which is show interfaces) gives a huge list of ste status of all interfaces The pipe symbol | can be used for filtering, but also in search expressions | i (for include) filters the output which matches the ...


39

You need to use the following command to add your VLAN 30 to an existing Dot1Q trunk on a Cisco Catalyst switch: switchport trunk allowed vlan add 30 Otherwise IOS just thinks you're trying to overwrite the existing configuration and you are left with an accidentally deleted set of allowed VLANs. You could similarly use "remove" in place of "add" to ...


29

The VPN can be reset by entering clear crypto ipsec sa peer <remote-peer-IP> on one side. The following traffic will cause the IPSEC tunnel to be reestablished. You can do it on your side, entering the remote IP. Or login to the remote site, but possibly you have to do it outside the VPN, so using a different interface, for example using the public ...


28

Ultimately... DOCUMENTATION. You need to know where every patch cable goes to be 100% certain you aren't disconnecting something someone may expect to work at some point. Just because a port is currently "down" doesn't mean someone has not been using it. Also just because the counters are currently zero doesn't mean it's never been used or not going to be ...


21

In global configuration mode, typing default interface [the interface] will clear the interface's configuration in the running-config.


18

In most modern versions of IOS (since 12.2(8)T - thanks @ytti) BGP synchronization is disabled by default (and shown in the running config as such, ie no synchronization shows up in show run when you turn on BGP). As to which IOS version they decided to make it a "hidden default", I'm not entirely too sure, but you should be able to do: show running-config ...


17

We can use the alias command in global conf mode: alias <mode> <command-alias> <original-command> <mode> is one of the many IOS command modes. If you need it in different modes, you have to call it for each one - type alias ? to get a long list of modes. An example for checking for a dhcp snooped IP, type in global conf mode ...


16

show ip route vrf * displays the global routing table plus all the VRF instances. sh ip route vrf * 0.0.0.0 displays the default route for each VRF. This shows the default route for each VRF, including the default VRF. As this IOS 12.4 doesn't show the VRF name when displaying a matching route, a route tag was added on the static routes to help identify ...


16

"logging synchronous" prevents every logging output from immediately interrupting your console session. See command documentation: "This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts." http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534


15

You can reset the tunnel via the ASDM software as well as in the command line. In the ASDM (Version 6.3): Go to Monitoring, then select VPN from the list of Interfaces Then expand VPN statistics and click on Sessions. Choose the type of tunnel you're looking for from the drop-down at the right (IPSEC Site-To-Site for example.) Click on the tunnel you wish ...


14

Fully agreed with Stefan. VRF is the way to go here. Quick example how to incorporate it to suggested config: ip vrf VLAN1 rd 42:1 ip vrf VLAN2 rd 42:2 ! int vlan1 ip vrf forwarding VLAN1 ip address 1.1.1.1 255.255.255.0 int vlan2 ip vrf forwading VLAN2 ip address 2.2.2.2 255.255.255.0 ! Now vlan1 and vlan2 routing is separated. To inspect ...


13

You could monitor the traffic on the router, Cisco IOS 12.4(20)T and later, there is a packet capture feature, with filtering on interface name and direction and ACL. set up an access list for matching the traffic create a capture buffer monitor capture buffer holdpackets filter access-list <number> define a capture point monitor capture point ... ...


13

Take a look at Layer2 traceroute (for cisco).. Cdp should be running btw... Router# traceroute mac 0000.0201.0601 0000.0201.0201 Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6) con6 (2.2.6.6) :Fa0/1 => Fa0/3 con5 (2.2.5.5 ) : Fa0/3 => Gi0/1 con1 (2.2.1.1 ) : Gi0/1 => Gi0/2 con2 ...


13

They are in order of specificity; The most specific (longest network mask) is first, and the least specific (shortest netmask) is last. If the network is variably subnetted, then they are grouped with the least-specific of the various netmasks, and ordered most-specific-first in each of the groupings. update It seems the output of show ip route is in the ...


13

Is there any reason why Cisco show run does not show the full version which is 16.3.7 in this example? For the simple reason that the only the major and minor versions are necessary for a complete understanding of the configuration. While there may be feature changes and/or enhancements between 16.2 and 16.3, changes in the build/revision should not impact ...


12

I also like sh int | inc line protocol is|Last input which outputs FastEthernet0/29 is down, line protocol is down (notconnect) Last input never, output never, output hang never FastEthernet0/30 is up, line protocol is up (connected) Last input never, output 00:00:07, output hang never FastEthernet0/46 is down, line protocol is down (notconnect) ...


12

If you actually configured line vty 04 Then you have something like: line vty 0 3 transport input telnet ssh line vty 4 transport input ssh This is because you configured only the fifth VTY line (04=4). The correct command is: line vty 0 4 or rather: line vty 0 15 since most (all?) modern Cisco switches have 16 vty lines and not 5. You ...


11

I would scrape the output (or grab it with SNMP, even better) and use standard UNIX tools to parse it. Here's an easy example: Here, I saved a partial output from 'show int counters' (just for demo purposes) to a file called "counters". [mkantows@ochofu049]$ cat counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Gi1/0/1 ...


11

I like @Stefan's answer but with this command line "sh int | i (Ethernet| 0 packets input)" which now grabs all Ethernet interface types and filters out non-zero numbers that happen to end in zero. He mentioned that some fine tuning might be possible so this is just one example. Another option is... sh int counters | i (Port|_0 0 ...


11

Depending on which version of 12.x you're on, you should be able to do the following: router(config)#sip-ua router(config-sip-ua)#no transport tcp router(config-sip-ua)#no transport udp This stops the router from listening on port 5060.


11

Usually NAT will be used to translate between private to public IP address but this is not the only use case. You can also translate between any addresses you want such as private to private. The terms local and global most often refer to the inside and outside of your network but this doesn't mean that it MUST be LAN and WAN although it often is. So say ...


11

tl;dr The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session. Long explanation: The default gateway on a switch has the same function as ...


10

I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session. Issue this for example to get a list of site to site vpn tunnels that are up. show vpn-sessiondb l2l output example: Connection : 192.168.1.1 Index : 330 ...


9

I would recommend using a route-map for only one purpose (one for nat, another to pbr); mixed use can make for a mess. For NAT, the match interface will apply post-routing -- handy to make conditional nat entries. The route-map for PBR should use an ACL to match the traffic coming from LAN2 and then set the next-hop to the desired interface with set ...


9

While ACLs are a simple and safe way, it doesn't scale well indeed. If your router provides VRF or at least the the VRF Lite feature you could group VLANs into VRFs. A VRF can be seen like a virtual router, VRF instances cannot talk to each other unless you explicitely define routing between them. In a complex network, I group VLANs into several security ...


9

Technically, you're doing PPPoEoA. The VC Mux part will have to be set on the modem, as that's the only thing that has access to the ATM layer. If you had a dsl interface in the router, you'd do: blue-gw#show run int atm0.1 Building configuration... Current configuration : 131 bytes ! interface ATM0.1 point-to-point bandwidth 6000 pvc dsl 8/35 ...


9

By doing clear ipsec sa peer <peer IP> will only reset the IPSec portion. There isn't a way to clear just one isakmp tunnel. Therefore the best way that I know is to remove the peer from the crypto map and reapply it. no crypto map mymap 40 set peer 12.1.1.1 crypto map mymap 40 set peer 12.1.1.1 This way you can take the peer out, wait for the ...


9

To add VLANs to a trunk you have to use the following syntax: switchport trunk allowed vlan add 30 To remove a VLAN from the trunk you need to use the remove syntax: switchport trunk allowed vlan remove 30 When you don't use add/remove you're telling the port to only configure the new VLAN. This is a common error. If your platform supports it you can ...


9

You cannot change the LSRefreshTime because it's hard-coded as an "architectural constant" in the OSPF RFC.


Only top voted, non community-wiki answers of a minimum length are eligible