Networks

Cisco IOS guide - Commands and configuration

Configuring a Cisco IOS device: CLI modes, network interfaces, DHCP service, access passwords, hostname, saving the configuration and remote SSH access.

· 7 min read · level: intermediate
Illustration 1 — Guide Cisco IOS - Commandes et configuration

Cisco Systems is an American computer company that originally specialized in network hardware, and since 2009 in servers.

Cisco IOS, formerly IOS (Internetwork Operating System), is the operating system produced by Cisco Systems and running on most of its equipment.

Here you will see how to correctly configure network equipment running the IOS operating system.

CLI configuration modes

The CLI (Command Line Interface) modes we will refer to below are the following:

Router> <- User execution mode (User EXEC Mode) Router # <- Privileged execution mode (Privileged EXEC mode) Router (config) # <- Global configuration mode (Global Configuration Mode) Router (config-if) # <- Interface configuration mode (Interface Configuration Mode) Router (config-line) # <- Line configuration mode (Line Configuration Mode)

Configuring the network interfaces

This is an essential step for your router to be able to forward packets on the network. The most fundamental setting for a router interface is the IP address. From global configuration mode, you have to enter interface configuration mode:

Illustration 2 — Guide Cisco IOS - Commandes et configuration

Switch to privileged execution mode: (alias: en)

Router>enable

Enter global configuration mode from privileged execution mode:

Router#config terminal

Configure the GigabitEthernet 0/0 interface (alias: int gig0/0)

Router(config)#interface GigabitEthernet 0/0

Assign an IP address to the interface (here, the WAN connection)

Router(config-if)#ip address 200.200.200.2 255.255.255.252

Turn the interface on (alias: no sh; not shutting down = turning on in IOS)

Router(config-if)#no shutdown

Leave a mode (alias: ex)

Router(config-if)#exit

Configure the GigabitEthernet 0/1 interface (here, the gateway of the LAN)

Router(config)#interface GigabitEthernet 0/1
Router(config-if)#ip address 172.16.0.1 255.255.0.0
Router(config-if)#no shutdown
Router(config-if)#exit

Configuring the DHCP service

A Cisco router can be configured as a DHCP server in order to assign IP addresses dynamically to internal hosts. We must first create a pool of IP addresses that will be used to assign them to the clients:

Configure the DHCP pool to assign addresses to internal hosts

Router(config)#ip dhcp pool lan-pool

Configure the network on which the addresses are to be distributed

Router(dhcp-config)#network 172.16.0.0 255.255.0.0

Configure the default gateway to allow the hosts to leave the network

Router(dhcp-config)#default-router 172.16.0.1

Configure the main DNS server to resolve domain names into IP addresses

Router(dhcp-config)#dns-server 1.1.1.1

It is also possible to exclude the IP addresses you do not want to assign by DHCP.

Exclude the first addresses, 1 to 50:

Router(dhcp-config)#ip dhcp excluded-address 172.16.0.1 172.16.0.50

Configuring the access passwords

The first step consists in securing your access to the router by configuring a global secret password as well as passwords for Telnet or Console as needed.

In global configuration mode, you configure the settings that affect the whole router. Here, we are going to configure the password known as enable secret, which you will use from now on to enter privileged execution mode from user execution mode.

Router(config)#enable secret <votremotdepasse>

From now on, when you connect from user EXEC mode, a password will be requested.

Enter the configuration of the virtual teletype (vty) lines, used for Telnet and also SSH.

0 4 means that there are 5 simultaneous sessions that can take place; 0 15 = 16 sessions

Router(config)#line vty 0 4

It is also suggested to configure a password for the VTY lines, which will secure your access when connecting remotely.

Router(config-line)#password <motdepassevtyfort>

Enable password checking at login.

Routeur(config-line)#login

Some people prefer to also create local user accounts (user names and passwords) on the router itself in order to authenticate to the device.

Configuring a hostname and a domain

To tell your router apart from the other devices on the network, you have to configure its hostname.

Router(config)#hostname Awoui-R01
Awoui-R01(config)#

Note that the prompt of your router changes to the new hostname you have just defined.

In particular for remote administration, it will be necessary to associate the router with a domain.

Awoui-R01(config)#ip domain-name awoui.fr

Displaying and saving the configuration

Saving the running configuration (called running-config) into the NVRAM makes it possible to keep it. This will overwrite the old startup configuration (called startup-config).

Leave configuration mode (if necessary)

Awoui-R01(config)#exit

Copy the running configuration to the startup configuration (Overwrite)

Awoui-R01#copy running-config startup-config

Display the current configuration to check the settings

Awoui-R01#show running-config

When you issue the "show running-configuration" command on the router, you tell the device to display the configuration running in the RAM. When you issue the "show startup-configuration" command, you ask the router to display the configuration stored in the NVRAM.

It is possible to use the show commands from configuration mode thanks to the do argument

Awoui-R01(config)#do show running-config

Types of router memory

A Cisco router has four types of memory:

  • ROM: this is where the POST script of the router is located. The POST (Power On Self Test) software is used at startup to carry out the initial hardware check of the device. The ROM also contains a mini-IOS used for password recovery.
  • RAM: this is where the running configuration is located. After the device starts, the IOS software is loaded into the RAM. In addition, the RAM contains the routing tables, the network settings during operation, and so on. When configuring the router, we are in fact modifying the running configuration which, as we said, is stored in the RAM
  • NVRAM: When we save the running configuration (using the "write" command), it is stored in the NVRAM and becomes the startup configuration. After the router restarts, the startup configuration is loaded from the NVRAM.
  • Flash: this is like the hard drive of a PC. It contains the image file of the IOS software and any backup configurations you might save from time to time.

How to connect to a router in order to configure it:

You can connect to a Cisco IOS router directly or remotely. The first time, when the device is not yet configured, you generally connect directly with a console cable through the CON port.

The console cable connection is also called the "out-of-band" connection method.

After configuring the router and assigning IP addresses to its interfaces, you can connect to the router from the network with an "in-band" connection method using Telnet or SSH. Note however that Telnet uses clear-text communication whereas SSH uses encrypted traffic, so SSH is preferred.

Generate the key pair used to encrypt the connection

Awoui-R01(config)#crypto key generate rsa
The name for the keys will be: Awoui-R01.awoui.fr
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...[OK]

Associating the SSH protocol with the virtual lines.

line vty 0 4 
transport input ssh
login local

Login local makes it possible to enable password checking at login, but this time using the local user accounts.

Creating a local user for remote access

Awoui-R01(config)#username <monutilisateur> secret <motdepassefort>

Associating the highest privilege level (15) with the user created

Awoui-R01(config)#username <monutilisateur> privilege 15

To connect over SSH from a cmd on a PC

ssh -l «monutilisateur» 172.16.0.1