To configure syslog on a Cisco device you need to use the following commands:
R1(config)#logging <server IP>
R1(config)#logging trap <level of logging trap>
R1(config)#logging source-interface <source int>
R1(config)#logging on
R1(config)#logging origin-id <IP>, <hostname>, <string> (optional if you have more than one device on one syslog server)
Simple Network Management Protocol is widely used to gather information from network nodes. SNMP is an application layer protocol that runs on top of TCP/IP, typically on UDP port 161. SNMP is most often in read-only mode, in which information is read from the node, but no changes can be made. SNMP also supports read-write mode, which allows changes to be made to the node’s configuration.
There are three versions of SNMP, V1, V2 and V3. V1 and V2lack strong security methods. V3 supports strong security by enabling the use of MD5 or SHA hashed authentication and DES encryption with SNMP messages.
To configure SNMP V1
Router(config)#snmp-server community <string> ro <ACL> (Read-only string)
Router(config)#snmp-server community <string> rw <ACL> (Read-write string)
Simple SNMP V3 configuration:
Router(config)#snmp-server group SNMP_GROUP v3 auth
Router(config)#snmp-server user SNMP_USER SNMP_GROUP v3 auth md5 my_password
Configuring NTP
Router(config)#clock timezone GB <+ or – from GMT>
Router(config)#ntp server <IP / hostname>
Router(config)#ntp master <stratum number>
Server Side Authentication
Router(config)#ntp authentication-key MY_KEY_NUMBER md5 MY_KEY
Router(config)#ntp peer REMOTE_PEER key MY_KEY_NUMBER
Client Side Authentication
Router(config)#ntp authentication-key MY_KEY_NUMBER md5 MY_KEY
Router(config)#ntp trusted-key MY_KEY
Router(config)#ntp server SERVER_IP
This configuration example is for use with a 3G WIC card within a Cisco based Router.
This was configured with a Vodafone Network.
Place the SIM card into it, then insert the card in the router and power it on.
Below is an example of a Vodafone UK Cellar Profile.
Router# cellular 0 gsm profile create 1 Internet chap web web
From the profile you’ve just created, you can review it using command
router# sh cellular 0 profile Profile Information ==================== Profile 4 = ACTIVE -------- PDP Type = IPv4 PDP address = 192.168.1.1 Access Point Name (APN) = Internet Authentication = PAP Username: web, Password: web * - Default profile
You need to define a chat script first, which is used for modem setup and call
initialization. If you are familiar with IOS dial configurations, you feel at home.
Please note that the last number in the dial string (1 in the example below) refers
to the modem profile number you hopefully have defined earlier.
!
your chat script
chat-script vodafone “” “ATDT*98*1#” TIMEOUT 60 CONNECT
!
The bare interface config.
Subcommands at the Cellular interface
interface Cellular0
ip address negotiated
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string vodafone
dialer-group 1
async mode interactive
ppp chap hostname web
ppp chap password 0 web
ppp ipcp dns request
!
ip route 0.0.0.0 0.0.0.0 Cellular0
dialer-list 1 protocol ip permit
!
This is the async line assigned to the 3G modem
line 3
! you need to specify your chat script here
script dialer vodafone
no exec
!
show command:
Just in case you need it for troubleshooting, here are the show commands to use.
debug chat
debug modem
debug dialer events
debug ppp authentication
Rather than reloading the router to restart the module,
you can actually using CLI to reset or reboot the module :
router(config)# service internal
router(config)# exit
router# test cellular 0 modem-power-cycle ! for rebooting
router# test cellular 0 modem-reset ! for resetting
Remember to create the Cellular Profile, after tftp config to router :
cellular 0 gsm profile create 1 Internet chap web web
This is the bare configuration, you will need to add NAT, firewalls etc etc.
References:
http://www.davidsudjiman.info/2009/05/29/cisco-881g-and-pcex-3g-hspa-
configuration-cheat-sheet/
As you can see, most DSL customers are put on the Fast Mode first, since there’s a higher efficiency (more data, less error correction code in each packet).
Also, Fast Mode allows users to have quicker, smaller ping times.
Unless a higher gauge wire is used in the local loop, or a the power output of the modem is increased (for a greater number of frequencies) the max distance in the loop, to perserve sync is about 5.5 km. The sync would be roughly 230 kbps.
On the other hand, if the interleaved channel is used, due to poor wire or interference on the loop, a small amount of data is transmitted per packet, to make room for more error correction code. This means a lower efficiency exists, to get more reliability and less errors, loss of sync or dropped or lost packets. The ping times or delays would increase, as well.
Some carriers suggest that at 3.6 km distance, a subscriber could achieve 3 Mbps …however, real world conditions usually advise 2.7 km, from what I’ve read on this forum, for example.
By default, site-to-site VPNs timeout after 30 minutes of idle time. This is a pain for me when I first try to access a site and have the first few packets of my Remote Desktop session or ping or whatever drop. (Yes – those 3 seconds of my life are EXTREMELY valuable). Here’s the secret, straight from Cisco:
PIX/ASA 7.x and later
Enter the vpn-idle-timeout command in group-policy configuration mode or in username configuration mode in order to configure the user timeout period:
hostname(config)#group-policy DfltGrpPolicy attributes hostname(config-group-policy)#vpn-idle-timeout none
Configure a maximum amount of time for VPN connections with the vpn-session-timeout command in group-policy configuration mode or in username configuration mode:
hostname(config)#group-policy DfltGrpPolicy attributes hostname(config-group-policy)#vpn-session-timeout none
Cisco IOS Router
Use the crypto ipsec security-association idle-time command in global configuration mode or crypto map configuration mode in order to configure the IPsec SA idle timer. By default IPsec SA idle timers are disabled.
crypto ipsec security-association idle-time seconds
Time is in seconds, which the idle timer allows an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.
This post describes how to set up IP SLA to allow a static route to failover if pings to a specified internet host should fail. This is really useful if you have two ISPs (and thus, two default routes) where the router cannot detect a link failure. This is really common if you have a cable/DSL modem or some type of wireless connectivity. Here’s the basic config:
ip sla 1 < The number 1 here is arbitrary, used only to identify this sla. It is otherwise knows as the operation number>
icmp-echo 4.2.2.2 < 4.2.2.2 is a DNS server that responds to pings out on the internet>
timeout 500 < This is how long to wait for a response from the ping>
frequency 3 < This is the repeat rate for the SLA>
ip sla schedule 1 start-time now life forever < This command says “start SLA 1 now and keep it running forever>
track 1 rtr 1 reachability < This comand creates the track object “1″ and monitors the SLA 1>
now for the routing, we need to change the default route and associate it with the tracker
no ip route 0.0.0.0 0.0.0.0 1.1.1.1
and then put it back with the tracking
ip route 0.0.0.0 0.0.0.0 1.1.1.1 track 1
Then we need to add our secondary route
ip route 0.0.0.0 0.0.0.0 1.1.1.2 10
Now when the ping to 4.2.2.2 fails the primary route is removed and the secondary route with the higher metric becomes the default. The route will be reinstated when the connectivity is restored.
With the 12.4 and higher releases the commands have changed slightly but the “?” is your friend.
Today I was figuring out how to get an automatic backup of the configuration of a cisco router device. After some searching I found a Cisco Document. (Link)
In this document was written how to create an automatic backup. What do you need to create this backup.
how to configure.
Go to the configuration terminal mode.
Type ” KRON POLICY–LIST” give this map a name like ” BACKUP“
Type cli “output command like below in the picture“
After you made the “Policy-List” you have to create an occurrence schedule
Tis list you can create with the command “KRON OCCURRENCE “backup-schedule-name” at <time> <date> one time or recuring“ like in the picture above.
After this you have to point to the backup policy-list otherwise your kron backup schedule doesn’t work.
This is tested and worked. ( only one disadvantage is that it overwrites to old file and don’t create a new file with time and date. )
dot11 ssid CommsWireless
vlan 1
authentication open
guest-mode
!
interface Dot11Radio0
no ip address
encryption vlan 1 key 1 size 128bit 7 3D5B79CA337DD1C379430BA081F3 transmit-key
encryption vlan 1 mode wep mandatory
!
ssid CommsWireless
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
world-mode dot11d country GB outdoor
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source no
bridge-group 1 source-learning no
bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
!
!
interface BVI1
description $ES_LAN$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
!
bridge 1 protocol ieee
bridge 1 route ip
!
Permanent IP-address Mapping to a host MAC-address
ip dhcp pool “ name ”
host 192.168.4.8 255.255.255.240
client-identifier 0100.24b2.7fef.e7
client-name Comms-Networks
!
ip dhcp pool “ name ”
host 192.168.4.9 255.255.255.240
client-identifier 0100.1641.6CB3.26
client-name Comms-Networks
where 01 represents the Ethernet media type. Every request sent from a DHCP client to DHCP servers
contains a hardware type and a client hardware address. For Ethernet and 802.11 wireless clients, the
hardware type is always 01.
Some HP network printers/printservers (ethernet!) prepend 00 instead of 01. Some don’t
prepend anything so only hardware-address is working with them.
The client hardware address is simply the MAC address of the client’s network
(Ethernet or Wireless) interface. Every request sent from a DHCP client to DHCP servers may optionally
also contain a DHCP Client Identifier option.
debug;
ip dhcp server events
debug ip dhcp server packet