Rename or move nameif Inside, Outside on Cisco ASA

# copy running-config flash:/running-config.backup
# copy running-config tftp:

edit running-config on your PC with text editor compatible with unix text files

# copy tftp:  flash:/running-config.new
# copy flash:/running-config.new  startup-config
# reload

if you need return to old configuration

# copy flash:/running-config.backup  startup-config
# reload

P.S. was tested with ASA 8.3, works perfect

Enable SSH access on IOS without AAA

# conf t
# hostname Router
# ip domain-name ciscotest.com
# crypto key generate rsa
# username cisco privilege 15 secret cisco
# ip ssh version 2
# ip ssh time-out 120
# ip ssh authetication-retries 3
# line vty 0 15
# login local
# transport input ssh

Enable SNMP on Cisco ASA

 # conf t
 # snmp-server community public
 # snmp-server location Rack22
 # snmp-server contact IT support
 # snmp-server host Management 10.10.10.100 community public version 2c

Enable SSH on Cisco ASA

# conf t
# domain-name cisco.com
# crypto key generate rsa
# ssh 0.0.0.0 0.0.0.0 inside
# username cisco password cisco
# enable password cisco
# aaa authentication ssh console LOCAL

Dell server and two cisco switches

Connect Dell server with two Gbps NIC to two Cisco switches 4948. Cisco switches are connected with trunk.

 

1. On Dell server configure Virtual Adapter, add NIC's and type set to Smart Load Balancing.

2. On Cisco switches add server vlan to trunk bettween switches.

3. Configure server ports on two switches.

interface GigabitEthernet1/7

 description Dell server

 switchport access vlan 111

 logging event link-status

 load-interval 30

 spanning-tree portfast

Port security on a trunk port

interface FastEthernet0/1

 switchport trunk native vlan 20

 switchport mode trunk

 switchport port-security maximum 2

 switchport port-security

 switchport port-security violation restrict

 switchport port-security mac-address sticky

 switchport port-security maximum 1 vlan 20,30

VRF-Lite guest VLAN for Wireless

ip vrf GUEST_WIFI

 description Guest vlan

interface Vlan66

 description Guest WiFi

 ip vrf forwarding GUEST_WIFI

 ip address 10.10.10.250 255.255.255.0

 ip nat inside

 ip virtual-reassembly

ip access-list extended nonat0_GUEST_WIFI

 deny   ip 10.10.10.0 0.0.0.255 10.10.10.0 0.0.0.255

 permit ip 10.10.10.0 0.0.0.255 any

ip nat inside source list nonat0_GUEST_WIFI interface FastEthernet1 vrf GUEST_WIFI overload

ip route vrf GUEST_WIFI 0.0.0.0 0.0.0.0 FastEthernet1 192.168.0.1 global

ip dhcp pool GUEST_WIFI

   vrf GUEST_WIFI

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.250 

   dns-server 8.8.8.8  

   domain-name guest

   lease 2

OSPF redistribute static routers

access-list 10 permit 10.10.10.10

access-list 10 permit 10.10.20.0 0.0.0.255

route-map STATIC-OSPF permit 10

 match ip address 10

router ospf 100

 redistribute static metric 100 subnets route-map STATIC-OSPF

Cisco IOS archive

Cisco has simple method for backup config

mkdir flash:/archive

 

conf t

archive

 log config

  logging enable

  hidekeys

 path flash:archive/config

 write-memory

 

 

you can use other options like path tftp,scp... etc

also notify syslog contenttype plaintext if you want write to log

for check archive:

 

 

show archive log config all

show archive config differences flash:archive/config-1 system:running-config

 

Software upgrade Cisco Wireless LAN Controller

1. check your controller software version.

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.

Product Name..................................... Cisco Controller

Product Version.................................. 6.0.199.4

2. check  release notes for new software version and check upgrade patch table. 

3. download new image from cisco site and copy it to tftp server.

4. login to controller

(Cisco Controller) >transfer download mode tftp

(Cisco Controller) >transfer download serverip 172.16.15.70

(Cisco Controller) >transfer download path .

(Cisco Controller) >transfer download filename AIR-WLC2100-K9-7-0-116-0.aes

(Cisco Controller) >transfer download start

Mode............................................. TFTP

Data Type........................................ Code

TFTP Server IP................................... 172.22.22.10

TFTP Packet Timeout.............................. 6

TFTP Max Retries................................. 10

TFTP Path........................................ ./

TFTP Filename.................................... AIR-WLC2100-K9-7-0-116-0.aes

This may take some time.

Are you sure you want to start? (y/N) y

TFTP Code transfer starting.

TFTP receive complete... extracting components.

/mnt/application

Writing new RTOS to flash disk.

Writing new Code to flash disk.

Executing install_code script.

Writing new APIB to flash disk.

Executing install_apib script.

TFTP File transfer is successful.

  Reboot the controller for update to complete.

  Optionally, pre-download the image to APs before rebooting to reduce network downtime.

(Cisco Controller) >reset system

The system has unsaved changes.

Would you like to save them now? (y/N) y

Configuration Saved!

System will now restart!

Enable ASDM for Cisco ASA

ciscoasa# conf t

ciscoasa(config)#asdm image disk0:/asdm-645-106.bin

ciscoasa(config)#http server enable

ciscoasa(config)#http 172.16.1.0 255.255.255.0 inside

upgrade ROM and IOS for cisco 4900 switches

for ROM upgrade:

1. download last rom from cisco site.

2. copy rom file to switch bootflash:

3. turn on switch and enter control-C to go to rommon

4. enter rommon 1 >boot bootflash:cat4500-ios-promupgrade-122_31r_SGA7(or your rom)

5. switch will restarted after upgraide

6. run show version  | i ROM

 

 

for IOS upgrade:

1. download last ios

2. copy ios to switch bootflash:

3. enter show running-config | i boot system

4. go to config mode 

5. enter no boot system flash bootflash:cat4500-entservicesk9-mz.122-13.SG1.bin(your ios)

6. enter boot system flash bootflash:cat4500-entservicesk9-mz.122-54.SG.bin

7. save config and reboot switch

8. check ios version after reboot show version | i bootflash 

Cisco DHCP Snooping

just config, it's pretty easy

!enable DHCP snooping for vlan 1

ip dhcp snooping

ip dhcp snooping vlan 1

!enable DHCP option 82

ip dhcp snooping information option

!set trust port for DHCP server

int Gi0/2

ip dhcp snooping trust

!set limit per second

int range Fa0/1 - 24

ip dhcp snooping limit rate 20

!set trust trunk port:

ip dhcp snooping trust

show settings:

show ip dhcp snooping

show ip dhcp snooping binding

VPN syslog error

If vpn is up but you have errors log

%CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed

 

for fix it add to router

crypto ipsec security-association replay window-size 1024

Flexible NetFlow for IOS

 

If you use vpn links standart netflow don't work with vpn links. You need use flexible netflow.

It works well with vpn links. Update your IOS if your router don't support it.   

 

Example:

 

flow exporter NETFLOW1-EXPORTER

 

 description NetFlow Analyzer

 destination 172.16.0.1

 source Loopback0

 output-features

 transport udp 9996

 export-protocol netflow-v9

!

!

flow exporter NETFLOW2-EXPORTER

 description Scrutinizer

 destination 172.16.0.2

 source Loopback0

 output-features

 transport udp 9996

 export-protocol netflow-v9

!

!

flow monitor NETFLOW1

 record netflow-original

 exporter NETFLOW2-EXPORTER

 exporter NETFLOW1-EXPORTER

 cache timeout active 1

!

!

interface Tunnel12

 ip flow monitor NETFLOW1 input

 ip flow monitor NETFLOW1 output

!

!

interface FastEthernet1

 ip flow monitor NETFLOW1 input

 ip flow monitor NETFLOW1 output

 

 

link: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/ps6965/prod_white_paper0900aecd804be1cc.html

 

Cisco router as dhcp client

Sometimes ISP provide only dhcp ip for branch offices.  When you use firewall, I hope you use it , you need use rule for open dhcp traffic  in your firewall.

interface FastEthernet0/0 ip address dhcp ip access-group ISP in ip access-list extended ISP permit udp any eq bootps any eq bootpc

Connect Cisco IP Phone 7960 to Asterisk

Previous post was about upgrade cisco ip phone to SIP version firmware.

Now short post how to setup asterisk

Example sip.conf

[550] host=dynamic context = office-all type=friend username = 550 secret = secret550 callerid = cisco550 <550> [551] host=dynamic context = office-all type=friend username = 551 secret = secret551 callerid = cisco551 <551>

 

for reload config run asterisk console and run command

unknown*CLI> config reload /etc/asterisk/sip.conf

Cisco 7960 upgrade to SIP firmware

I bought one ip phone cisco 7960 on ebay it was with SCCP firmware. I use asterisk so need upgrade firmware.

Step by step.

1. Download and setup SolarWinds TFTP Server. It is free and works well.

2. Need SIP firmware from cisco site. I downloaded last version P0S3-08-8-00.zip . Unzip it to TFTP directory.

3. We need additional 5 files. I used notepad for it.

3.1 SIP<MAC adresse>.cnf

Example for two lines :

line1_name : 550 line1_authname : 550 ;user name registered in your Asterisk PBX line1_password : secret550 ;password registered in your Asterisk PBX line2_name : 551 line2_authname : 551 line2_password : secret551

3.2 SIPDefault.cnf

Example:

#Image Version image_version:P0S3-08-8-00 ; #Proxy server address proxy1_address: 192.168.10.1 ; proxy_register: 1;

3.3 xmlDefault.CNF.XML

Example:

<loadInformation7 model="IP Phone 7960">P0S3-08-8-00</loadInformation7>

3.4 RINGLIST.DAT

Example:

Piano 1 Piano1.raw Piano 2 Piano2.raw Pop Pop.raw Pulse Pulse1.raw Old Style ringer1.pcm Synth Low ringer2.pcm

3.5 dialplan.xml

Example:

<DIALTEMPLATE> <TEMPLATE MATCH="*" Timeout="5"/> <!-- Anything else --> </DIALTEMPLATE>

4. Copy all files to TFTP directory. As result we get 10 files.
5. Run TFTP server.
6. Erase cisco ip phone old config.

6.1 Disconnect network cable, power on phone.

6.2 Unlock configuration., go to settings-Network configuration-Erase configuration-yes

6.3 SaveCancel-Exit.

7. Unlock configuration., go to settings-Network configuration-TFTP server. Enter new TFTP server, Save-Exit.

8. Power off, connect network cable, power on phone.

As result you will see tftp server logs and your ip phone will get SIP firmware.

Cisco port security

SW1# conf t

SW1(config)# interface fastethernet0/1

SW1(config-if)# switchport mode access

SW1(config-if)# switchport port-security

SW1(config-if)# switchport port-security maximum 2

SW1(config-if)# switchport port-security violation restrict

SW1(config-if)# switchport port-security mac-address xxxx.xxxx.xxxa

SW1(config-if)# switchport port-security mac-address xxxx.xxxx.xxxb

Cisco port mirroring

conf t

monitor session 1 source interface fa1/0/1

monitor session 1 destination interface fa1/0/15

if your switch doesn't support the monitor session syntax, you will need

to do the following:

interface FastEthernet0/x

port monitor FastEthernet0/a

port monitor FastEthernet0/b

fa0/x is the port your sniffer is plugged into, 0/a and 0/b would be any

ports u want to sniff.