Cisco
My Cisco Lab
I decided to get my own Cisco equipment to practice with after receiving a switch (thanks to Jon Nistor at TorIX). It would help in making me become more proficient in what I love to do, that is networking. So far, for my own Cisco lab, I have three devices to work with – 3524 switch, 2501 router, and a 2503 router. I’m still looking to get more equipment, better if it has the IOS 12.4 which has the SDM (Security Device Manager) as well, though not really necessary.
Also, I found out a couple days ago that there’s this really good resource website which actually provides free access to Cisco equipment for training purposes. The site is PacketLife.net. Lab equipment and other costs are provided or sponsored by the site’s owner, commercial sponsors, and voluntary contributions by the community members. I know of a few sites that allow you to use their equipment but for a fee, so hearing about this site was fantastic. Members can schedule to use 1 of 3 blocks of equipment that they have one session at a time.
I’ll be using that site as well from time to time when I need to work with more equipment than what I have.
Adding a Switch Port Interface to a VLAN
In an internet data centre, clients can set up a colocation where they can run their servers for access with the internet. In my job, what I would do is configure the Cisco Catalyst switch 3750 for new colocation clients. It is pretty simple. I check for a free port, assign this to the client, then assign them to a VLAN.
Here’s a configuration sample of how it would go:
————————-
colo.switch>en
colo.switch>password:
colo.switch#show run int fa 1/0/11
Building configuration…
Current configuration : 36 bytes
!
interface FastEthernet1/0/11
end
colo.switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
colo.switch(config)#int fa 1/0/11
colo.switch(config-if)#desc ClientNum – ClientName – VLAN 311
colo.switch(config-if)#switchport access vlan 311
% Access VLAN does not exist. Creating vlan 311
colo.switch(config-if)#dup full
colo.switch(config-if)#speed 100
colo.switch(config-if)#storm-control broadcast level pps 10k 9k
colo.switch(config-if)#storm-control multicast level pps 10k 9k
colo.switch(config-if)#storm-control unicast level pps 10k 9k
colo.switch(config-if)#switchport mode access
colo.switch(config-if)#no shut
colo.switch(config-if)#^Z
colo.switch#show run int fa 1/0/11
Building configuration…
Current configuration : 298 bytes
!
interface FastEthernet1/0/11
description ClientNum – ClientName – VLAN 311
switchport access vlan 311
switchport mode access
speed 100
duplex full
storm-control broadcast level pps 10k 9k
storm-control multicast level pps 10k 9k
storm-control unicast level pps 10k 9k
end
colo.switch#copy run start
Destination filename [startup-config]?
Building configuration…
[OK]
colo.switch#
————————-
Always keep in mind when configuring a switch port that there are no existing configurations there that you would be overwriting by mistake. This is why the show run int fa 1/0/xx is important as it would display the existing running-configuration.
When you’re done with your configurations and have verified them correct, be sure to save them to the memory by using the command copy run start.
This post just shows a sample of configuring a switch port to a VLAN. Of course, this is not all that needs to be done for the client as they wouldn’t have access yet to and from the internet. The next step would be assigning them IP addresses and configuring the routes. More of that in another post.
Cisco PIX Firewall Basics
Firewalls are essential components of an effective information security infrastructure. At its most basic level, a firewall is a hardware or software that filters traffic between your network and the Internet. The firewall (hardware) I am most familiar in using is the Cisco PIX (Private Internet eXchange) Firewall. It was one of the first products in the IP firewall and NAT appliance market segments.
PIX firewalls include the following security and network services features:
- Network Address Translation (NAT) or Port Address Translation (PAT)
- Content filtering
- URL filtering
- IPsec VPN
- DHCP client/server
- PPPoE support
- Advanced security services for multimedia applications including Voice over IP (VoIP), H.323, SIP, Skinny
Managing the firewall can be done through its integrated web-based management interface called PIX Device Manager (PDM), command-line interface (CLI), Telnet, Secure Shell (SSH), console port, SNMP, and syslog.
Here are 10 steps to ensure your PIX Firewall is as secure as it can be:
- Password protect it
- Know your access-lists
- Log denials and errors
- Use SSH in place of Telnet
- Understand the ASA
- Enable optional security
- Keep the PIX OS and PDM patched
- Back up your configuration
- Use secure encryption
- Know your network
Read more in detail here: Cisco PIX Firewall: Lock it down in 10 steps
Most PIX Firewall models optionally support multiple outside or perimeter networks (also known as demilitarized zones (DMZs)). Connections between the networks can be controlled by the PIX Firewall.
A Demilitarized zone (DMZ) is the most common and secure firewall topology, often referred to as a screened subnet. A DMZ creates a secure space between your Internet and your network. It will typically contain the following:
- Web server
- Mail server
- Application gateway
- E-commerce systems (It should contain only your front-end systems. Your back-end systems should be on your internal network.)
In 2005, Cisco introduced the newer Adaptive Security Appliance (ASA) firewall that inherited much of PIX features, and in 2008 announced the PIX end-of-sale. I actually just found out about their discontinuity of the PIX firewall as I was doing some research for this blog post. However, the PIX technology is still sold in a blade, the FireWall Services Module (FWSM), for the Cisco Catalyst 6500 switch series and the 7600 Router series.
Photo Credit: fzurell
Cisco IOS 10 Basic Commands That Should Be Mastered
David Davis wrote in TechRepublic about the ten commands that a Cisco professional or network administrator should know when using the Cisco IOS in routers, switches, and firewalls. This is a good reminder for me, and I’m glad to know that I have embedded all of it in my brain already.
Below is the list he made plus my comments on what I think about each item.
1. The “?”
This is the most helpful command ever. There are thousands of possible commands in the Cisco IOS and this is definitely useful when you don’t know or can’t remember the command to type, or the parameter that should come next.
2. show running-configuration (sh run)
If you want to check the current configuration of the router, switch, or firewall, this is what is used.
3. copy running-configuration startup-configuration (copy run start)
This command will save your current configuration, which is in the RAM, to the nonvolatile RAM (NVRAM). You can also use the copy command to copy to the TFTP server. If you must turn off your router, do not forget to use this command unless you don’t want to save the configuration changes you made.
4. show interface (sh int)
For troubleshooting, this command is used to check the status of the router’s interfaces.
5. show ip interface (sh ip int)
Much useful information about the configuration and status of the IP protocol and its services, on all interfaces are displayed with this command. Alternatively, you can add brief at the end of the command to get a shorter quick status.
6. config terminal, enable, interface, and router (conf t, en, int, router)
These are used to enter different modes in configuring the router.
7. no shutdown (no shut)
This is used to enable an interface, and also useful for troubleshooting when used with shut (to bring down interface then up).
8. show ip route (sh ip ro)
To check the routing table, use this command.
9. show version (sh ver)
This will display the router’s firmware settings, the last time the router was booted, the version of the IOS, the name of the IOS file, the model of the router, and the router’s amount of RAM and Flash.
10. debug
This is helpful in troubleshooting. The debug command is used with other commands like for example, debug ip route.
Alright. That should be pretty simple to remember. Commands, stay in my brain please, thank you.
Photo Credit: dontthink.feel
Tech-Life in Pink 