ICND IOS CLI Study Guide (CCENT)

Transcription

1 ICND IOS CLI Study Guide (CCENT) Hostname: 2. hostname SW1 SWITCH CONFIGURATION Mgmt IP: 2. interface vlan 1 3. ip address no shut Gateway: 2. ip default-gateway Local User/Pwd: 2. username shane password cisco Enable Secret Pwd: 2. enable secret cisco Console/VTY Logins: 2. lin con 0 OR lin vty 0 4 (range of virtual connections) 3. password cisco 4. login (OR login local to use a local username & pwd) Exec Timeout: 2. lin con 0 OR vty exec-timeout (10 mins & 10 secs) Service Pwd Encryption: 2. service password-encryption (encrypts "lin", "enable pwd", & local user pwds) Copy Run Start: 2. cop run start Hostname: 2. hostname R1 ROUTER CONFIGURATION Local User/Pwd: 2. username shane password cisco Enable Secret Pwd: 2. enable secret cisco Console/VTY Logins: 2. lin con 0 OR lin vty 0 4 (range of virtual connections) 3. password cisco 4. login (OR login local to use a local username & pwd) Exec Timeout: 2. lin con 0 OR vty exec-timeout (10 mins & 10 secs) Service Pwd Encryption: 2. service password-encryption (encrypts "lin", "enable pwd", & local user pwds) Interface IP Address: 2. int f0/0 3. ip address no shut 5. Loopback Address: a. int loopback 0 b. ip address Banner: 2. banner motd #Temp Maintenance msgs# 3. banner login #Perm Unauth Msg#

2 Configure VLANs: 2. vlan name Clients 4. int range f0/ switchport access vlan Repeat 2-5 for additional VLANs 7. show vlan brief Configure Trunking: 2. int f0/24 3. switchport trunk encapsulation dot1q 4. switchport mode trunk 5. switchport trunk allowed vlan 10,20 (or for Range or single VLAN #) 6. show interface f0/24 trunk 5. switchport trunk allowed vlan add # (add a VLAN if needed or forgot earlier) Enable/Configure Port Security: 2. int range f0/ switchport mode access 4. DYNAMIC: 5. STATIC: mac-address STICKY: mac-address sticky 7. LIMITATION: maximum 2 8. switchport port-security violation protect restrict 9. show port-security interface Shutdown Unused ports: 2. int range f1/0-1/5 3. shut Reassign Unused Ports: 2. int range f1/12-1/5 3. switchport access vlan 999 (optionally, 1st creat vlan, then sub vlan config give name unused) 4. banner exec #Msg displayed AFTER a user logs in# Configure Ethernet Interface: 1. See IP Address config above 2. show interface f0/0 Verify Configuration: 1. show cmds -> running-config, cdp neighbors detail, ip interface brief Configure Static Route: 2. ip route NOTE: IP Address in above cmd = remote Network, remote Network Mask, Next Hop Router IP 3. ip route (the Default route) 4. show ip route Configure OSPF: 2. router ospf 1 3. (optional) router-id network area 0 5. Repeat #4 for all Directly Connected Routes OR: b. int f0/0 c. ip ospf 1 area 0 d. repeat a-c for remaining Connected Interfaces 6. sho ip ospf neighbor AND/OR database ; show ip protocol 7. Configure on ALL Routers 8. For IPv6 b. ipv6 unicast-routing c. ipv6 router ospf 1 d. router-id e. pass-interface g0/0.10 (opt) f. int f0/0 g. ipv6 ospf 1 area 0 h. repeat f-g for other interfaces Configure a Passive Interface: 2. router ospf 1 3. passive-interface g0/ show ip ospf interface

3 Change Native VLAN: 2. int f0/24 (or, whatever int is trunk port) 3. switchport trunk native vlan 99 Configure Inter-VLAN Routing/ROAS: 2. int f0/0 3. no ip address 4. int f0/ ip address encapsulation dot1q native 7. no shut 8. int f0/ encapsulation dot1q ip address no shut 12. Repeat #2-#5 to add additional VLANs Configure SVI (Enable Routing on L3 Switch): 1. sdm prefer lanbase-routing 2. reload 3. conf t 4. ip routing 5. interface vlan 1 6. ip address no shut 8. vlan vlan 30 (repeat if needed) 10. interface vlan ip address cmd 12. no shut 13. repeat #10-12 for remaining VLANs Configure DHCP: 1. ip address dhcp (on an interface) 2. ip dhcp pool name 3. network /24 4. default-router EXIT, then conf t -> ip dhcp excluded-address #.#.#.# #.#.#.# Configure ACLs: 1. Numbered Standard (1-99; Source IP ONLY) a. access-list 1 permit host b. access-list 1 deny c. access-list 1 permit any d. int s0/1 e. ip access-group 1 out 2. Numbered Extended a. access-list 100 permit ip host b. access-list 100 deny tcp any

4 any (deny any traffic with a tcp header to any device ) c. access-list 100 permit udp any (deny all packets with a udp header from given Subnet to any destination device) d. access-list 100 deny tcp any host eq 23 (deny any packet with a tcp header from any source host to specific device on port 23) e. apply ACL on Interface in/out 3. Named Standard a. ip access-list standard somename b. permit c. deny d. permit any e. apply to appropriate Interface in or out 4. Named Extended a. ip access-list extended somename b. permit ip any eq www c. permit ip any any d. apply to appropriate Interface in or out Configure NAT: 1. STATIC: b. ip nat inside source static c. int f0/1 d. ip nat in e. int s0/0 f. ip nat out g. show ip nat translations 2. DYNAMIC: b. ip access-list standard 100 c. permit ip any d. ip nat pool PoolName netmask e. ip nat inside source list 100 pool PoolName f. int f0/0 g. ip nat in h. int s0/1 i. ip nat out 3. PAT: b. access-list 101 permit any

5 (repeat this step to add to list if needed) c. ip nat inside source list 101 interface S0/0/0 overload Configure NTP Client: 2. ntp server version 4 3. show ntp status OR associations Device Password Security: 2. enable secret cisco (Priv Exec Mode Pwd) 3. services password-encryption (encrypts enable, local user, & lin Pwds) Disable Telnet: 2. lin vty transport input ssh Enable SSH: 2. ip domain name shane.local 3. username shane password cisco 4. crypto key generate rsa generalkeys modulus ip ssh version 2 6. lin vty transport input ssh Configure ACL for Telnet/SSH Access: 1. access-list 20 permit lin vty access-class 20 in The above configurations assume you know the why behind them. This Guide is solely intended to remove all noise around the ICND1 Outline & provide a direct CLI How-to procedure for each of the listed tasks. Reference the ICND1 Study Guide for detailed explanations of each. Created by Shane Williford 19 October If you reference this Study Guide, please give credit to the author.