2022 Developer Survey is open! Take survey.
18 votes
Accepted

Cisco IOS programming, automation, and information

Almost everyNote 1 Cisco IOS system running at least IOS 12.2 has built-in tcl shell programmability. You can store tcl scripts in flash and run them. Cisco IOS also has a light native programming ...
user avatar
17 votes
Accepted

Switchport mode access VLAN & switchport mode trunk on one interface

No this isn't doing anything. When the port is in trunk mode, then any "switchport access" statements are not used. The same is true with a port in access mode with any "switchport trunk" statements....
user avatar
  • 26.7k
16 votes
Accepted

Edit Cisco IOS ACL without hanging the router

The reason your router hangs is because you're editing the ACL through the same interface that it's applied to. Usually what happens is you wind up blocking yourself accidentally. Note that I make a ...
user avatar
13 votes

Why does the Cisco show run command not show the full version, while the show version command does?

Is there any reason why Cisco show run does not show the full version which is 16.3.7 in this example? For the simple reason that the only the major and minor versions are necessary for a complete ...
user avatar
  • 26.7k
12 votes
Accepted

How to understand "normal burst" and "maximum burst" in Cisco CAR?

Let's calculate what we're dealing with here. CAR is basically the older version of IOS policing, so all these concepts apply to both. Committed Information Rate (CIR) = 5,000,000 (5Mbps) Burst ...
user avatar
  • 1,589
12 votes
Accepted

How to Disable telnet on Cisco switch totaly?

If you actually configured line vty 04 Then you have something like: line vty 0 3 transport input telnet ssh line vty 4 transport input ssh This is because you configured only the fifth VTY ...
user avatar
  • 18.3k
11 votes
Accepted

Cisco 2960 switch will not recognize new TACACS+ commands

sw-R2-3#show ver | i Software Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3, RELEASE SOFTWARE (fc1) sw-R2-3#conf t Enter configuration commands, one per line. End ...
user avatar
  • 29.5k
11 votes
Accepted

load-balancing on congestion, OSPF over MPLS

... The load balancing works when I replace the MPLS by ATM switches. This doesn't sound like a parallel comparison, because routers don't care whether you're forwarding through an ATM PVC or an ...
user avatar
11 votes
Accepted

Meaning of the ip default-gateway L2 switch

tl;dr The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be ...
user avatar
  • 92.9k
11 votes

routing between vlans not working

You don't have NAT enabled (you don't have ip nat outside on Vl 20). Without NAT, the ISP doesn't know how to route back to your 192.9.200.0 network. If you NAT to the VLan 20 address, the ISP ...
user avatar
  • 62.1k
11 votes
Accepted

Why does the CISCO's command 'enable secret <password>' produce different hash from MD5?

Cisco devices add a salt to the passwords before hashing so they can't be cracked with dictionary attacks (such as rainbow tables). The salt is partially made up of the device ID, if I recall. MD5 is ...
user avatar
  • 4,436
10 votes

Why does the CISCO's command 'enable secret <password>' produce different hash from MD5?

$1$ marks the MD5-crypt password hash also commonly used in past years for user passwords in Linux systems. In that function, it's now been pretty much superseded by the similar SHA256-crypt and ...
user avatar
  • 236
8 votes
Accepted

Cisco Router Telnet Connection Refused

The issue has been resolved. When I checked the running configuration on the router, I noticed I have the line below under the line vty 0 4 access-list class 23 in All I had to do was to negate the ...
user avatar
  • 569
8 votes
Accepted

Interpreting Cisco logging symbols

If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log. If with an asterisk, it means you didn't set the clock or it ...
user avatar
8 votes
Accepted

malloc failures and ARP packed on a Cisco 2901

show arp comes back with 60,000+ entries. That would explain the memory consumption and poor performance but I'm not 100% sure as to why this is happening. When you configured ip route 0.0.0.0 0.0.0....
user avatar
8 votes
Accepted

Cisco IOS: OSPFv3 route cost

I believe you are looking for show ipv6 ospf rib. Almost all show ip * commands have a show ipv6 equivalent.
user avatar
8 votes
Accepted

QoS between two sites

I'd recommend migrating from old-school CAR to modern config of CBWFQ. When you do that, you can nest QoS policies together to accomplish more complicated QoS scenarios. Per this Cisco doc, GRE ...
user avatar
  • 1,589
8 votes
Accepted

Cisco IOS versions vs Cisco ASA versions?

Cisco has a whole bunch of different operating systems for a variety of products: IOS runs on most Cisco routers and switches. IOS XE is a more modern, modular version of IOS. IOS XR runs on high-end ...
user avatar
  • 1,899
8 votes

What is the difference between "ip domain name" and "ip domain-name"?

The two forms are equivalent. "domain-name" is the older form, and newer versions seem to prefer "domain name". Maybe at some point Cisco realized that removing the hyphen allowed them to extend the "...
user avatar
  • 2,396
8 votes
Accepted

What is the difference between "ip domain name" and "ip domain-name"?

They are the same. Cisco IOS also supports the command ip domain name starting from its 12.2 Software release. You can check it here: IOS: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/...
user avatar
  • 3,744
8 votes
Accepted

Why is option 82 required for DHCP when you use `ip verify source port-security`?

How is this different than using port security or ip source guard alone and why is option 82 required for this to work? When you add the MAC address source filtering to IP source guard using the ip ...
user avatar
  • 26.7k
8 votes
Accepted

When and where to use Spanning-Tree (Portfast)

Spanning tree only runs between switches, never to standard end hosts. Bear in mind that, under normal circumstances, a port supporting spanning tree will (when it first comes up) run through a ...
user avatar
  • 6,018
8 votes
Accepted

Configuring OSPF on two directly connected routers which are in different areas

In order to connect two areas, one router has to serve as an area border router (ABR). That router has interfaces in both areas. In other words, the boundary between two areas is a router, not the ...
user avatar
  • 62.1k
7 votes
Accepted

Cisco IOS cli prompts - any way to know which interface you are configuring?

AFAIK, the answer is NO. I never understood how this valuable feature has escaped IOS for so many years or I manged to never discover it. ;-) I use the following technique in some cases when I want ...
user avatar
7 votes
Accepted

Disable reset button on Cisco 2950?

You can disable this feature using: no setup express To quote Cisco: The primary purpose of the no setup express command is to prevent someone from deleting the switch configuration by pressing ...
user avatar
  • 4,601
7 votes
Accepted

Configuring a password policy on Cisco IOS or NX-OS

Regarding password complexity for local accounts, you have these options... Cisco NX-OS: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS rejects weak passwords by ...
user avatar
7 votes

How do I restrict a user for certain commands on Cisco IOS

You already know the majority of the answer to your own question - you need to configure commands the user can run at a specific privilege level. enable without a privilege level argument defaults to ...
user avatar
  • 8,847
7 votes
Accepted

How to run a CAM Table Overflow attack in GNS3 using Cisco 3725 routers?

Well, you're hitting that space where emulation and physical world interconnect. First, let us cover the basics: 3725 is a router, and it has some limited switching capabilities, because it could (...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible