From 698390d9763fadaba657b0f243e19b34dc67d9b1 Mon Sep 17 00:00:00 2001 From: Hugh Ratsch Date: Wed, 29 Jan 2025 16:33:31 -0600 Subject: [PATCH] updated summary page and added cli examples --- src/7-command-line-examples.md | 670 +++++++++++++++++++++++++++++++++ src/SUMMARY.md | 3 +- 2 files changed, 672 insertions(+), 1 deletion(-) create mode 100644 src/7-command-line-examples.md diff --git a/src/7-command-line-examples.md b/src/7-command-line-examples.md new file mode 100644 index 0000000..7ad8d4b --- /dev/null +++ b/src/7-command-line-examples.md @@ -0,0 +1,670 @@ +# Cisco IOS Command Reference Sheet + +## Basic Device Access +```cisco +# Access Modes +enable # Privileged EXEC Mode (User → Privileged) +configure terminal # Global Configuration Mode (Privileged → Global) +end # Return to Privileged EXEC Mode +exit # Exit one level back + +# Basic Show Commands +show running-config # Current configuration +show startup-config # Saved configuration +show version # IOS version and hardware info +show flash: # Contents of flash memory +show history # Previously used commands + +# Configuration Management +write memory # Save configuration +copy running-config startup-config # Save configuration (alternative) +erase startup-config # Erase saved configuration +reload # Restart device +``` + +## Device Configuration +```cisco +# System Settings +hostname DEVICE_NAME +service password-encryption # Encrypt plaintext passwords +no ip domain-lookup # Disable DNS lookup +banner motd #MESSAGE# # Set login banner + +# Password Configuration +enable secret PASSWORD # Encrypted privileged mode password +enable password PASSWORD # Plaintext privileged mode password + +# Console Settings +line console 0 + password PASSWORD + login + logging synchronous # Prevent command interruption by logs + +# SSH Configuration +ip domain-name DOMAIN +crypto key generate rsa modulus 2048 +username ADMIN privilege 15 secret PASSWORD +line vty 0 15 + transport input ssh + login local +``` + +## Interface Configuration +```cisco +# Basic Interface Commands +interface GigabitEthernet0/0 + description LINK_DESCRIPTION + ip address 192.168.1.1 255.255.255.0 + no shutdown + duplex {auto|full|half} + speed {auto|10|100|1000} + mtu 1500 + +# Interface Status Commands +show ip interface brief # Quick interface status +show interfaces # Detailed interface statistics +show interfaces description # Interface descriptions +show interfaces status # L1/L2 interface status +show controllers # Interface hardware status + +# Interface Range Configuration +interface range g0/0 - 3 # Configure multiple interfaces +interface range g0/0, g0/2 # Select specific interfaces +default interface g0/0 # Reset interface configuration +``` + +## Layer 2 Switching +```cisco +# VLAN Configuration +vlan 10 + name DEPARTMENT +show vlan brief +show vlan id 10 + +# Access Port Configuration +interface g0/1 + switchport mode access + switchport access vlan 10 + switchport port-security + switchport port-security maximum 2 + switchport port-security mac-address sticky + +# Trunk Configuration +interface g0/1 + switchport mode trunk + switchport trunk allowed vlan 10,20,30 + switchport trunk native vlan 999 + switchport nonegotiate # Disable DTP + +# VTP Configuration +vtp mode {server|client|transparent} +vtp domain DOMAIN_NAME +vtp version {1|2|3} +show vtp status +``` + +## Spanning Tree Protocol +```cisco +# Global STP Commands +spanning-tree mode {pvst|rapid-pvst|mst} +spanning-tree extend system-id +show spanning-tree +show spanning-tree summary + +# VLAN STP Configuration +spanning-tree vlan 1 root primary +spanning-tree vlan 1 root secondary +spanning-tree vlan 1 priority 24576 + +# Interface STP Configuration +interface g0/1 + spanning-tree portfast + spanning-tree bpduguard enable + spanning-tree guard root + spanning-tree cost 100 + spanning-tree port-priority 64 +``` + +## EtherChannel +```cisco +# LACP Configuration +interface range g0/1-2 + channel-group 1 mode active # LACP active + channel-group 1 mode passive # LACP passive + +# PAgP Configuration +interface range g0/1-2 + channel-group 1 mode desirable # PAgP desirable + channel-group 1 mode auto # PAgP auto + +# Static Configuration +interface range g0/1-2 + channel-group 1 mode on # Force channel without protocol + +# Verification Commands +show etherchannel summary +show etherchannel port-channel +show etherchannel load-balance +``` + +## Layer 3 Routing +```cisco +# Basic Routing Commands +ip routing # Enable routing on L3 switch +show ip route +show ip protocols + +# Static Routes +ip route 0.0.0.0 0.0.0.0 NEXT_HOP # Default route +ip route NETWORK MASK NEXT_HOP # Static route +ip route NETWORK MASK Null0 # Null route + +# OSPF Configuration +router ospf 1 + router-id 1.1.1.1 + network 192.168.1.0 0.0.0.255 area 0 + default-information originate + passive-interface default + no passive-interface g0/1 + +interface g0/1 + ip ospf 1 area 0 + ip ospf cost 100 + ip ospf priority 255 +``` + +## NAT & PAT +```cisco +# Static NAT +ip nat inside source static LOCAL_IP GLOBAL_IP + +# Dynamic NAT +ip nat pool NAT_POOL 200.1.1.1 200.1.1.10 netmask 255.255.255.0 +ip nat inside source list 1 pool NAT_POOL + +# PAT (NAT Overload) +access-list 1 permit 192.168.1.0 0.0.0.255 +ip nat inside source list 1 interface g0/1 overload + +# NAT Interface Configuration +interface g0/0 + ip nat inside +interface g0/1 + ip nat outside + +# Verification +show ip nat translations +show ip nat statistics +``` + +## Network Services +```cisco +# DHCP Server +ip dhcp excluded-address 192.168.1.1 192.168.1.10 +ip dhcp pool POOL_NAME + network 192.168.1.0 255.255.255.0 + default-router 192.168.1.1 + dns-server 8.8.8.8 + lease 7 + +# DHCP Relay +interface g0/1 + ip helper-address DHCP_SERVER_IP + +# NTP Configuration +ntp server IP_ADDRESS +ntp master +ntp authenticate +ntp trusted-key 1 +ntp authentication-key 1 md5 PASSWORD + +# Syslog +logging host IP_ADDRESS +logging trap debugging +logging facility local7 +``` + +## Monitoring & Troubleshooting +```cisco +# Discovery Protocols +show cdp neighbors detail +show lldp neighbors detail +show cdp interface + +# Debug Commands +debug ip ospf packet +debug ip ospf hello +no debug all # Disable all debugging + +# Interface Diagnostics +show interfaces counters +show interfaces counters errors +show controllers ethernet-controller +show processes cpu +show memory statistics + +# Logging +show logging +show logging history +terminal monitor # Enable logging in SSH/Telnet +``` + +--- + +## 1. Basic Device Configuration +### 1.1 Initial Device Access +- **Enable Mode**: Access privileged EXEC mode + ```cisco + Router> enable + Router# + ``` +- **Configuration Mode**: Enter global configuration mode + ```cisco + Router# configure terminal + Router(config)# + ``` +- **Basic Device Security**: + ```cisco + enable password boson # Basic password (not encrypted) + enable secret boson # Encrypted password (preferred) + ``` + +### 1.2 Device Management +- **Hostname Configuration**: + ```cisco + hostname R1 + ``` +- **Interface Configuration**: + ```cisco + interface GigabitEthernet 0/0 + description Connection to SW1 + ip address 192.168.1.1 255.255.255.0 + no shutdown + ``` +- **Saving Configuration**: + ```cisco + write memory # or 'wr' + copy running-config startup-config + ``` + +## 2. Interface Configuration +### 2.1 IPv4 Configuration +```cisco +## conf ipv4 ## +en +conf t +int f0/1 +ip addr 192.168.1.1 255.255.255.0 +no shut +end +wr +``` +- Purpose: Configures basic IPv4 addressing on an interface +- Key Components: + - `ip addr`: Assigns IP address and subnet mask + - `no shut`: Enables the interface + - `wr`: Saves configuration to NVRAM + +### 2.2 IPv6 Configuration +```cisco +## conf ipv6 ## +en +conf t +ipv6 unicast-routing +int f0/1 +ipv6 addr 2001:db8:3445:abde::1/64 +no shut +end wr +``` +- Purpose: Enables and configures IPv6 on an interface +- Key Components: + - `ipv6 unicast-routing`: Enables IPv6 routing globally + - `ipv6 addr`: Assigns IPv6 address with prefix length + +## 3. VLAN Configuration +### 3.1 Basic VLAN Setup +```cisco +## create vlan and conf name ## +en +conf t +vlan 10 +name Sales + +## conf int as switchport for vlan ## +int f0/1 +sw mo ac +switchport access vlan 10 +``` +- Purpose: Creates and assigns VLANs to interfaces +- Key Concepts: + - VLANs segment broadcast domains + - Access ports belong to single VLAN + - Trunk ports carry multiple VLAN traffic + +### 3.2 VLAN Trunking +```cisco +## conf SW for 802.1q and trunking mode ## +en +conf t +int f0/1 +sw tr enc dot1q +sw mo tr +``` +- Purpose: Configures trunk links between switches +- Features: + - 802.1Q tagging for VLAN identification + - Supports multiple VLANs over single link + - Can specify allowed VLANs + +### 3.3 Inter-VLAN Routing +```cisco +## create a subint for vlan 10 ## +en +conf t +int f0/0.10 +enc dot1q 10 +ip addr 192.168.10.1 255.255.255.192 +``` +- Purpose: Enables routing between VLANs +- Methods: + - Router-on-a-stick (shown above) + - Layer 3 switch routing + - Multiple physical interfaces + +## 4. Spanning Tree Protocol (STP) +### 4.1 Basic STP Configuration +```cisco +## conf vlan pvst (Rapid-PVST+) ## +en +conf t +spanning-tree vlan 100 priority root + +## conf portfast on int f0/1 ## +int f0/1 +spanning-tree portfast +``` +- Purpose: Prevents layer 2 loops +- Key Features: + - Root bridge election + - Loop prevention + - Convergence optimization + +## 5. EtherChannel Configuration +### 5.1 Layer 2 EtherChannel +```cisco +## layer 2 etherchannel ## +en +conf t +int r f0/1 - 4 +channel-group 1 mode active +``` +- Purpose: Combines multiple physical links into one logical link +- Benefits: + - Increased bandwidth + - Redundancy + - Load balancing + +## 6. Security Features +### 6.1 SSH Configuration +```cisco +## conf ssh ## +en +conf t +line vty 0 15 +no password sharedpassword +login local +transport input ssh # enable ssh only + +## ssh generate rsa key ## +crypto key generate rsa +``` +- Purpose: Secure remote access +- Key Components: + - RSA key generation + - VTY line configuration + - Authentication methods + +### 6.2 Port Security +```cisco +## Basic Port Security ## +en +conf t +int f0/1 +switchport port-security +switchport port-security maximum 2 +switchport port-security mac-address sticky +``` +- Purpose: Prevents unauthorized access at switch ports +- Features: + - MAC address limiting + - Violation actions + - Sticky learning + +## 7. Routing Protocols +### 7.1 OSPF Configuration +```cisco +## conf OSPF process and area on int ## +en +conf t +int f0/1 +ip ospf 10 area 0 + +## conf network to operate in OSPF area 0 ## +router ospf 10 +network 203.0.113.0 0.0.0.7 area 0 +``` +- Purpose: Dynamic routing protocol for internal networks +- Key Concepts: + - Area-based hierarchy + - Link-state protocol + - Dijkstra's algorithm for path selection +- Verification Commands: + ```cisco + show ip ospf + show ip ospf neighbor + show ip route ospf + ``` + +### 7.2 Static Routing +```cisco +## conf a default route by int ## +ip route 0.0.0.0 0.0.0.0 int f0/1 + +## conf a default route by next int ip addr ## +ip route 0.0.0.0 0.0.0.0 203.0.113.1 +``` +- Purpose: Manually configured routes +- Use Cases: + - Default routes + - Stub networks + - Small network designs + +## 8. Network Address Translation (NAT) +### 8.1 Static NAT +```cisco +## implement static nat on router ## +en +conf t +int g0/0 +ip nat outside + +int g0/1 +ip nat inside +exit + +ip nat inside source static 192.168.100.38 192.0.2.9 +``` +- Purpose: One-to-one mapping of private to public addresses +- Verification: + ```cisco + show ip nat translations + show ip nat statistics + ``` + +### 8.2 PAT (NAT Overload) +```cisco +## conf pat aka nat overload ## +en +conf t +access-list 1 permit 192.168.100.32 0.0.0.31 +int g0/1 +ip nat inside +int g0/0 +ip nat outside +ip nat inside source list 1 interface g0/0 overload +``` +- Purpose: Many-to-one address translation +- Benefits: + - Conserves public IP addresses + - Common in home/small business networks + +## 9. Network Services +### 9.1 DHCP Configuration +```cisco +## conf dhcp server ## +en +conf t +service dhcp +ip dhcp excluded-address 172.16.10.17 +ip dhcp pool pool_one +network 172.16.10.16 255.255.255.240 +default-router 172.16.10.17 + +## conf dhcp relay ## +int f0/1 +ip helper 203.0.113.1 +``` +- Purpose: Automatic IP address assignment +- Components: + - DHCP pool definition + - Excluded addresses + - Default gateway + - DHCP relay for remote networks + +### 9.2 NTP Configuration +```cisco +## conf ntp server ## +en +conf t +ntp master + +## conf ntp client ## +ntp authenticate +ntp authentication-key 1 md5 80$0n! +ntp trusted-key 1 +ntp server 203.0.113.5 key 1 +``` +- Purpose: Network time synchronization +- Security Features: + - Authentication + - Access control lists + - Trusted keys + +### 9.3 DNS Configuration +```cisco +## enable dns server ## +en +conf t +ip dns server + +## conf dns host table ## +ip host www 192.168.52.44 +``` +- Purpose: Domain name resolution +- Features: + - Local DNS server + - Static host mappings + - DNS forwarding + +## 10. High Availability +### 10.1 HSRP Configuration +```cisco +## conf hsrp ## +en +conf t +int f0/0 +standby 1 ip 192.168.1.1 +standby 1 priority 110 +standby 1 preempt +``` +- Purpose: Router redundancy protocol +- Features: + - Virtual IP address + - Priority-based active router selection + - Preemption capability + +### 10.2 VRRP Configuration +```cisco +## conf vrrp ## +en +conf t +int vlan 100 +vrrp 1 ip 192.168.100.1 +vrrp 1 priority 110 +``` +- Purpose: Alternative to HSRP +- Key Differences: + - Industry standard (vs. Cisco proprietary HSRP) + - Similar functionality + +## 11. Troubleshooting +### 11.1 Interface Status +```cisco +## check all int ## +show ip interface brief +show interface status # switches only + +## check one int ## +show ip interface f0/1 +``` +- Purpose: Verify interface operation +- Key Information: + - Line/protocol status + - IP addressing + - Interface errors + +### 11.2 Protocol Debugging +```cisco +## debug ospf hello msg ## +debug ip ospf hello + +## show nat translations ## +show ip nat translations + +## show routing table ## +show ip route +``` +- Purpose: Detailed protocol analysis +- Best Practices: + - Use specific debug commands + - Monitor system resources + - Clear debug when finished + +### 11.3 Common Show Commands +```cisco +show running-config +show vlan brief +show spanning-tree +show etherchannel summary +show cdp neighbors +``` +- Purpose: Configuration verification +- Use Cases: + - Troubleshooting + - Documentation + - Change verification + +## 12. Best Practices +### 12.1 Configuration Management +- Save configurations regularly +- Document changes +- Use consistent naming conventions +- Implement secure passwords +- Regular backups + +### 12.2 Security Guidelines +- Disable unused ports +- Use secure protocols (SSH vs Telnet) +- Implement access lists +- Regular security audits +- Password best practices \ No newline at end of file diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 52cc6f8..46276e4 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -10,4 +10,5 @@ - [Dynamic Routing](3-ip-connectivity.md#dynamic-routing) - [IP Services](4-ip-services.md) - [Security Fundamentals](5-security-fundamentals.md) -- [Automation and Programmability](6-automation-and-programmability.md) \ No newline at end of file +- [Automation and Programmability](6-automation-and-programmability.md) +- [Command Line Examples](7-command-line-examples.md) \ No newline at end of file