18

"logging synchronous" prevents every logging output from immediately interrupting your console session. See command documentation: "This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts." http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534


13

Is there any reason why Cisco show run does not show the full version which is 16.3.7 in this example? For the simple reason that the only the major and minor versions are necessary for a complete understanding of the configuration. While there may be feature changes and/or enhancements between 16.2 and 16.3, changes in the build/revision should not impact ...


12

If you actually configured line vty 04 Then you have something like: line vty 0 3 transport input telnet ssh line vty 4 transport input ssh This is because you configured only the fifth VTY line (04=4). The correct command is: line vty 0 4 or rather: line vty 0 15 since most (all?) modern Cisco switches have 16 vty lines and not 5. You ...


12

In the simplest sense, shutdown turns the interface off. no shutdown turns the interface on (enables it). You can configure an interface in either case. Using the shutdown command is one of the things you can do when configuring an interface.


11

tl;dr The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session. Long explanation: The default gateway on a switch has the same function as ...


11

Cisco devices add a salt to the passwords before hashing so they can't be cracked with dictionary attacks (such as rainbow tables). The salt is partially made up of the device ID, if I recall. MD5 is mostly still safe to use but is known to have collisions, so it's almost always suggested to use another hashing algorithm. On some of the more recent ...


10

I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session. Issue this for example to get a list of site to site vpn tunnels that are up. show vpn-sessiondb l2l output example: Connection : 192.168.1.1 Index : 330 ...


10

$1$ marks the MD5-crypt password hash also commonly used in past years for user passwords in Linux systems. In that function, it's now been pretty much superseded by the similar SHA256-crypt and SHA512-crypt hashes ($5$ and $6$). None of those are just a single run of the underlying hash function, but iterate the hash repeatedly and include a salt (the part ...


9

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. Simply unpluuging it, waiting a few minutes, then plugging it back in should work. Also, Cisco maintains a Password Recovery Procedures web page with links to the ...


9

Packet Tracer is a simulator aimed at CCNA level courses. It doesn't accurately simulate real devices but only a subset of their functions. (and still those simulations aren't perfect). I would not rely on this tool to test whatever part is not explicitly teached in Cisco courses that use Packet Tracer. TLDR you cannot trust PT to correctly simulate this.


8

On physical layer AUX port works on asynchronous serial RS-232 protocol. However, one can specify various application layer protocols like telnet or SSH as allowed input protocols under AUX line configuration. Am I correct that those protocols are specified only to enable or disable reverse-telnet or reverse-SSH? Short Answer: On an aux line, transport ...


8

The issue has been resolved. When I checked the running configuration on the router, I noticed I have the line below under the line vty 0 4 access-list class 23 in All I had to do was to negate the command and everything went back to normal. Thanks all for your support.


8

Cisco has a whole bunch of different operating systems for a variety of products: IOS runs on most Cisco routers and switches. IOS XE is a more modern, modular version of IOS. IOS XR runs on high-end routers. NX-OS runs on the Nexus line of datacenter switches. ASA OS runs on Cisco ASA devices. AireOS runs on Access Points. And I'm probably forgetting a lot ...


8

The two forms are equivalent. "domain-name" is the older form, and newer versions seem to prefer "domain name". Maybe at some point Cisco realized that removing the hyphen allowed them to extend the "ip domain ..." command line, i.e. you can have: ip domain name <xxx> ip domain <some other domain related function> ip domain <yet ...


8

They are the same. Cisco IOS also supports the command ip domain name starting from its 12.2 Software release. You can check it here: IOS: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-i3.html#wp1026378069 IOS-XE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-xe-3se-3850-cr-book/ipaddr-xe-...


8

The Cisco command completion uses the <TAB> key (one of the Juniper options). Cisco commands also do not even need to be complete to work; they only need to be complete enough to be unambiguous. For example, most people type sh run rather than the full show running-config. You can also type ? to get the list of options.


7

Think about this very carefully. Inside source means that you want to translate the source address from traffic originating inside your network. This is the typical "home networking" arrangement which allows you to use private addresses on the public Internet. Of course, this is not the only use for this version. Inside destination means that you want ...


7

Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses: See Configuring the Port Security Violation Mode on a Port on page 62-6: protect—Drops packets with unknown source addresses until you remove a sufficient ...


7

The document to which you link claims a specific IOS version. It may be incorrect; that would not be unusual in Cisco documentation. In reality, having tested this on several IOS 15.X versions, you do not specify a prefix length on a link-local address since it is implicit for the link local address, as you saw in your CLI help (ipv6 address ? shows X:X:X:X:...


7

Using the ip helper-address command sets up a DHCP relay. DHCP only works on the LAN to which it is connected because it uses broadcast, which cannot cross a router. To remedy that situation, DHCP relay was created. It gives DHCP an option so that a router intercepts the DHCP client's broadcast request, creates a unicast request to the DHCP server on a ...


7

Simply use the "no" form of the command to remove the first statement, then add the second one. Like this: config t no ip nat inside source static tcp 172.*.*.1 80 117.218.*.* 80 extendable ip nat inside source static tcp 172.*.*.2 80 117.218.*.* 80 extendable


7

I have a setup with dual redundant Cisco catalyst 4506-E using the WS-X45-SUP8L-E supervisor engine and two 48-port switches below it. My task is to access and modify the switch configuration. Access shall be accomplished locally only, through console port using serial cable and user/pass combo. The notion that "thou shalt not use ssh / telnet /...


7

If you’re using ‘show log’ to display messages in the logging buffer, then you’re using IOS or IOS-XE. In both of those Cisco operating systems there is a default syslog buffer size (configured in bytes). It happens that you can currently fit 360 messages in that buffer. You can change the log buffer size to be much larger with: “logging buffered 15000000 ...


6

You can show all interfaces that are up by: show interfaces status | include connected Then your script can count them. The show interfaces status cli command shows you all interfaces. The interfaces that are "up" are in the connected state. The | include connected shows only the lines of the output that contain the word "connected". Newer Cisco IOS ...


6

To add to Ron's great answer: The key piece of this is that the Router sending the DHCP request on behalf of the client will unicast the request with a source address from the address space the client is in (the interface the relay/helper-address is configured on). This is ensures the DHCP server offers an IP from the correct scope.


6

You can change to the SFP interface. Under the interface configuration, configure: media-type sfp To change back to the copper interface: media-type rj45


6

Based on the comments I think you are confused about guard root. You configure guard root on the downstream interfaces of all the switches, except the root switch. Basically, you are trying to protect the root interfaces on a switch (root switches do not have root interfaces) by preventing the other interfaces from becoming root interfaces. This will protect ...


6

To put it in other words... The running-config has a version listed because that's the version of IOS that was used to create/write that config most recently. Every statement in that config should work with any 16.3.anything version of IOS. Your show version is showing the exact version running on that hardware. Since 16.3.7 matches, you can be confident ...


6

I would have said the numbers represent different things: show version says "I am running this version", and of necessity has much detail version output in show conf says "This configuration will run on this version" If you copy the config somewhere, it still says "This configuration runs on this version" For analogy: "How old are you?" -- "I am 23 and 3 ...


Only top voted, non community-wiki answers of a minimum length are eligible