What is the difference in a routers running configuration and startup configuration?
|
Dale Liu, in
Cisco Router and Switch Forensics, 2009 If you have used a PC since 1995 and it ran something newer than Windows 3.1, there is a good chance you have heard of or
maybe even used HyperTerminal to perform the functions of communication and terminal emulation. If you have access to HyperTerminal, you are in luck as you can use it in two major ways for connecting to Cisco routers: asynchronously through the console (CONS) or auxiliary (AUX) port, and as a Telnet application. First we will discuss using HyperTerminal asynchronously and then we'll discuss the finer points of using it in network communications as a substitute for Telnet. I go back to the old days of telecommunications where terminal programs such as Telix and MacTerm were all the rage for connecting to bulletin board systems (BBSs), which are yesterday's equivalent of forums and chat. It turns out that anything that can watch the status of a serial port and pass information to and from data buffers to the screen can be a functional terminal program and can work on a router to configure it through its asynchronous connections. In
fact, I still have a legacy Apple IIc running ProTERM in my garage lab, and I use it to configure intelligent switches and routers, just for fun. It's a hoot, and it works with little fuss. Although you can use HyperTerminal through the console and auxiliary ports, each has a special purpose, and a need for safeguarding. HyperTerminal is especially good at recording and uploading the running configuration from and to routers. But if you leave the screen page to 24 lines, you will have to remove the –more-line from your recorded text (it's very annoying when it's in there). In global configuration mode, enter the following: Router#configure terminal Router(config)#line cons 0 Router(config-line)#length 0 Router(config)#line vty 0 4 Router(config-line)#length 0 Router(config-line)#CTRL-Z Router# copy running-config startup-config This will eliminate automatic pausing while you record your running configuration within your HyperTerminal session. Choose Transfer| Capture Text to select a file to capture the data from, and Transfer | Capture | Stop to stop the transfer. The first connection method we will cover is how to connect via a serial console cable connection in HyperTerminal, followed by a Telnet connection into VTY interfaces. Later on, we will transition permanently from the insecure Telnet connection method to a server-supplied Secure Shell (SSH) connection as a short exercise in securing router communications when upgrades are not possible. Any time you have to reset a router's password, or you face an instance where the router can no longer be connected to the network and thus is inaccessible through Telnet, you can use the console port. The console port is used frequently in situations when someone has misconfigured a router from home, or reboots it only to find that he has shut himself out and now needs to physically connect to the router and set things right. Two other noteworthy facts about the console port are that it is used for router password resetting and as a default output destination for router status and debugging messages. I brought up password resetting in the beginning of this section. The console port is the only port on a Cisco router on which you can successfully bypass the stored configuration and subsequently reset the password. To this point, it is very important to have extra physical protection
when it comes to access around your routers. I have worked with penetration testers who have waltzed into a server room or network operations center posing as janitors. While on-scene, they have taken screenshots, cabled into the console port, and left their “calling card,” among
performing other activities, to prove they were there. Once they had physical access, the game of defense was over for the staff. Please don't let that happen to you. The other key function of the console port is that logging, debugging, and status messages are displayed through the console port by default. This is by design, as someone who is physically connected to the router at the console port needs to be aware of all the goings-on inside
the router's head. You can change this by modifying the logging settings and issuing a monitor command while connected to the appropriate terminal interface. This brings up an important point about recordkeeping and auditing. If you don't set up a system to deliver the alerting, debugging, and administrative log data to a logging system configured to receive system messages such as these, there is a chance that you will miss an event that occurred
and will have no information regarding when it happened and who caused it. Such a system is called a syslog server. If you don't know whether a syslog server is being used in this way, maybe you should make that change. If you
really want to set up your router to send messages to a syslog server, use the following commands: Router#configure terminal Router(config)#logging facility local5 Router(config)#logging trap notifications Router(config)#logging
192.168.1.1 Router(config)#logging rate-limit 25 Router(config)# service sequence-numbers Router(config)#service timestamps log datetime msec localtime show-timezone Router(config)#CTRL-Z Router#copy running-config startup-config The first command informs the IOS to use logging and to set it for logging syslog message type 6 or higher (see Cisco for the significance of syslog message type numbers: http://www.cisco.com/en/US/docs/net_mgmt/access_registrar/4.2/user/guide/logging.html). Then the logging trap command selects the severity of messages you want
logged. The syslog server IP address is designated next; so that we don't saturate the syslog server with messages, we are limiting the maximum rate at which syslog messages will be sent to the syslog server. In keeping with the spirit of this book, we are instituting sequence numbers so that the messages are logged sequentially. This makes it easier to detect whether the logs on the syslog server have been tampered with. We add a designation to have the time logged in milliseconds for improved
correlation with events, and we include the time zone information (this part of the log details is very important when performing forensic activities on a system that may span different states or time zones). I also encourage you to ensure that an access control list (ACL) is placed before the syslog server to make it harder for hackers to flood your syslog server with bogus event messages. You can also send your syslog messages to up to 16 different syslog
servers so that different organizations or geographically separated teams will have the benefit of the log reports. Throughout the rest of this chapter, I will describe features that will make logging effective, such as setting the network time from trusted sources as well as ACLs. I will also demonstrate turning off unneeded services, while enforcing username authentication to others. If you are working as a network administrator or are involved in network security at your office, don't get the false idea that you can set and forget once you have configured logging. You job is not finished. All that data going to a syslog server still needs to be
analyzed to determine whether incidents are occurring. If you are working in an incident response role and performing data collection, syslog servers can be faced with an incredible amount of information to parse through. It will blow your mind how much logging is done, and there is a temptation to become intimidated and walk away from it. The inescapable truth is that someone needs to look through the logged data and analyze it. No script, machine, or program can do that for you, as you have
the most advanced analysis engine available: the one between your ears. The good news is that I can repeat and further emphasize the point made by the lead author in the book's Preface to consider using Microsoft's Log Parser to analyze logged data. When you start using it and become familiar with using SQL queries to find the information you need, I am sure you will get hooked on it. Learning the SQL queries is easier than it sounds. Log Parser is available
for download at www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx. In addition, if you already used Log Parser and are interested in using a GUI front end along with SQL queries for IIS/W3C and Event logs, consider checking out Log Parser Lizard from www.lizardlabs.net. I've used this front end extensively to quickly pull out Web server data hits and quickly sort gigabytes of log data to track down unauthorized
traffic and artifacts, and then save my queries in tabs or easily export the data to Microsoft Excel. Don't be surprised if you encounter IT people who think the console port is the only place where the good action happens on a Cisco router. Network technicians and administrators are entitled to their beliefs. I would venture to say that you may become a member of their group if you happen to bring along your own Cisco console cable or have made one
yourself that is compatible with Cisco routers, switches, Private Internet Exchange/Adaptive Security Appliance (PIX/ASA) firewalls, and other network devices. Earlier in this section, I mentioned using an old Apple 8-bit computer to connect to my routers and switches. It's true; I do that. I will usually use my Linux or PC systems for the same purpose only when I have to write documentation or host a training session. The point is that as long as the serial
communications protocol can communicate using RS-232, you are in business. Just remember these key asynchronous settings for your own equipment to work properly: 8 bits of data, no parity bit, and 1-bit stop, with no handshaking. If it helps, try to commit 8N1 to memory. If you're really enthusiastic about making your own console cable, read the related How-to article, “Cabling Guide for Console and AUX Ports,” on Cisco's public Web site at www.cisco.com/en/US/products/hw/routers/ps332/products_tech_note09186a0080094ce6.shtml. It provides plenty of information on the correct pin-out and hardware pieces you need to make and recognize a proper console cable. For our
purposes in this chapter, we will use HyperTerminal to create a Connections setting profile for both a serial connection through the console port and Telnet through virtual terminals (VTY). First we'll address the console port. Figure 6.1 shows the initial stages of opening HyperTerminal and selecting a meaningful connection name. Figure 6.1. HyperTerminal COM Port Setup Figure 6.2 depicts the flow control, parity, and other settings. If you make a mistake with a setting, select File | Properties and then choose the Configure button to reset the setting as appropriate. Figure 6.2. COM Port Settings Once the asynchronous settings have been made, a terminal window will open and it may take only one or two key presses to direct data from the router's console port. In Figure 6.3, you can see that once a username and password were entered, the router immediately provided a privilege-enable mode prompt (Router#). This demonstrates how a username login looks after a certain amount of configuration is done to the router. It's really important to change any default usernames and passwords on your equipment. The default settings are the first things hackers try to exploit. Later in this chapter, I will show you the commands to establish usernames and change passwords, as well as logging in using the SSH secure protocol. Remember, this is not set or configured when the router comes out of the box, so you have to do it as a best security practice. Figure 6.3. Logged into Cisco Router Privileged Enable Mode Thanks go out to Dale Liu for mentioning this “Easter egg.” HyperTerminal will allow you to set Cisco-console cable serial settings with the click of a button. When you are presented with the properties for COM1 (or whatever your serial port on your PC is set to), click the Restore Defaults button on the lower half of the window. Like magic, the settings I described earlier will be applied. Click OK and you are finished. In this section, I discussed the basic settings to enable a console port connection to a router. Most of the configuration functionality, status message reporting, and debugging comes through the console port. Without it, you are unable to bypass startup scripts and change passwords. If you need to do this, the console port is your one ticket for success. From this point on in the chapter, the code in the figures depicts the login of a level 15 user (who will have enable privileges). Take a close look at the prompt and you will see a # sign following the hostname of the router (i.e., Router#). Anytime you see a procedure in this chapter that moves directly from login to global configuration mode, understand that a custom configuration setting is allowed in only that particular setting, and it may not match your own experience on routers you encounter in the field. The Auxiliary PortThe auxiliary (AUX) port has some special uses when it comes to Cisco routers, and most of them are for remote administration. When you connect using the AUX port, you normally don't get all the system status and debugging messages unless you make some changes and set the monitor setting to the AUX port. You can also use the AUX port as your remote login facility if you connected a modem to it and put it on a phone line where you can dial in. If you do this, however, practice due diligence and protect the AUX port and modem dial up, as every feature that is added to a network offers a computer attacker another method to get into the network and cause server trouble, and modem ports are no exception. When you connect a modem to a router's AUX port you take on some rather large security responsibilities and you have some work to do to mitigate possible points of attack. To keep your router from being pillaged you can start by setting appropriate passwords on the AUX port before the temptation sets in to connect your modem. Ensure that the dial-up number to the modem is available only to people on the staff who can be trusted, and who need to know such information. Also, make sure the number is unpublished. When you follow these steps, you will be able to enjoy some of the benefits of remote administration while reducing the chances of a compromise. You can use the AUX port as a second console port, but you will notice some differences once you log in to it the first few times. One of the key differences is that the status, logging, and debugging messages are not displayed on the AUX port unless you make some changes. You also don't see the system boot-up messages until the IOS is fully reloaded. Figure 6.4 shows a configuration of the AUX port with the monitor command and the logging level set to monitor so that the commands will not be overrun by status messages. Figure 6.4. Verifying the Security of AUX Ports You can see that a login was conducted, as well as a check on which port the login was performed. In this case, we confirmed that we were logged in to the AUX port, after which the AUX port configuration was modified and we exited from global configuration mode. As soon as that was finished, status messages of all kinds appeared. If you really want to get your debugging and status messages to appear from the AUX port serial connection, here is how you perform the configuration: Router#configure terminal Router(config)#line aux 0 Router(config-line)#monitor Router(config)#logging synchronous Router(config-line)#CTRL-Z Router# copy running-config startup-config If you are cabled into the AUX port, you should see status messages pop up onto the terminal window. Remember that we talked about protecting the AUX port from intrusion attempts at the beginning of this section? The next code snippet will address how to lock down and render the AUX port inoperable. This is an easy item to inspect for security compliance, courtesy of our friends at the National Security Association (NSA) and their contributions toward furthering router security awareness; the NSA's router/switch configuration hardening guide has done wonders toward that end. Here are the commands entered into the command-line interface (CLI): Router#configure terminal Router(config)#line aux 0 Router(config-line)# login local Router(config-line)#no exec Router(config-line)#exec-timeout 0 1 Router(config-line)#tranport input none Router(config-line)#CTRL-Z Router# copy running-config startup-config Here we have applied an overabundance of countermeasures. We set the idle timeout to one second and zero minutes; we removed the exec banner; and we disabled the input transport. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494182000065 Production OperationsJames Farmer, ... Weyl Wang, in FTTx Networks, 2017 Backup and Restore CapabilityDevelopment of the configuration and provisioning backup and restore strategy maintains the security of the running configuration of the active devices in the network and the subscriber provisioning information—both of which are required to recreate the network’s operating environment. Typically for active devices there will be a software facility to periodically and automatically transfer the running configuration to a back-up file system for storage and retrieval when required. For critical databases used for provisioning, there should be a strategy in place to have periodic back-ups of the data, along with a resiliency strategy to protect the data at all times, as well as having it available at all times, along with periodic back-ups for catastrophic situations. Regardless of the specifics of the processes developed for the network, there must be a periodic testing exercise in which the stored backups are retrieved and restored to representative network devices to assure that back-up processes are working. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124201378000159 Configuring Cisco RoutersDale Liu, ... Luigi DiGrande, in Cisco CCNA/CCENT Exam 640-802, 640-822, 640-816 Preparation Kit, 2009 Configuration FilesThe configuration changes you make while in Global Configuration mode will only affect the currently running configuration of the router. If the router were to be rebooted, the configuration would revert back to the preceding configuration. This is because when the router boots, it pulls its configuration from NVRAM. This configuration is called the startup-config. If you want to make your configuration changes permanent, you must save them to NVRAM. This can be done by typing write memory (or wr mem), or copy running-config startup-config (or copy run to start). Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597493062000087 Collecting the Non-Volatile Data from a RouterDale Liu, in Cisco Router and Switch Forensics, 2009 Frequently Asked QuestionsQ: Will non-volatile data typically provide sufficient evidence of an incident? A:No, unfortunately a knowledgeable bad guy will only make changes to the running configuration and will change your password, requiring a reboot to reset the password to gain access. This overwrites the running configuration with the startup configuration and the actual evidence of configuration changes. Q:What is the preferred method of connecting to a router to gather evidence? A:Use the console port and a program such as HyperTerminal that provides for complete logging of the session. Q:If I do not know the password, how can I access the router to gather non-volatile evidence? A:There is a password reset procedure, but it requires a reboot that will overwrite non-volatile evidence. Q:Why do I have to involve my company's legal department to review my analysis plan? A:Collection of evidence should be done in a manner that does not infringe on existing “Right of Use Policies” within the organization. Q:Why is it important to create an MD5 hash of files on the router? A:The MD5 hash can prove that a copy of the file is a forensically sound, bit-by-bit copy. Q:What are the communications setting for connecting to the AUX port on a Cisco router? A:9,600 bits per second, 8 data bits, Parity = None, Stop Bits = 1, and Flow Control = None. Q:Where in memory is a copy of the router configuration stored? A:A startup copy exists in flash and the running copy is in NVRAM. Q:Why is TFTP considered insecure? A:TFTP provides access without a username and password and uses the connectionless protocol UDP. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494182000089 Cisco IOS Switch BasicsDale Liu, in Cisco Router and Switch Forensics, 2009 Configuration FilesThe Cisco config files are stored in an ASCII-readable text form that can be easily copied in many terminal emulators or SSH sessions. When a switch builds its configuration to display the running configuration, a text representation becomes available once it has completed the process. Cisco switches also can be directed to save their running configuration into a startup file which will be recalled when the switch is power-cycled or reboots. This saved configuration is stored on non-volatile memory called flash memory, which allows it to be written to many times and retain its contents when the electrical power is removed. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494182000107 Building and maintaining a secure networkBranden R. Williams, ... Derek Milroy, in PCI Compliance (Fourth Edition), 2015 Other considerations for Requirement 1As of the last version of PCI DSS (currently in 3.0) the Council added more granularity to the requirements around routers, specifically taking Requirements 1.1–1.3 and extending them to routers. The one requirement that seemed specifically targeted at Cisco routers and firewalls has been enhanced is Requirement 1.2.2, even though it specifically only mentions routers. If any network device in scope for PCI has the capability to have a different running and startup configuration, this requirement applies and you need something to check to make sure they are actually in sync. No changes should be made to the running configuration without first going through the appropriate change management procedures. Additional firewall considerations should be taken with regard to wireless networks and mobile or personal computers. Systems with cardholder information must be segregated from wireless networks for Requirement 1.2.3, and those firewall rules limited only to what is necessary for business. Chapter 8 has more information for you on how to get your wired and wireless networks working securely. These systems may not always get critical patches in a timely manner, and the personal firewall provides some assurance. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128015797000054 AuthorizationAndy Richter, Jeremy Wood, in Practical Deployment of Cisco Identity Services Engine (ISE), 2016 If dACLs don’t work for you and you have specific VLANs you need specific users or devices on, you can absolutely override the VLAN and set the VLAN of these sessions. There are a few things to note about doing VLAN overrides: •You can override the VLAN ID (number) or the VLAN name. This is really important because you have a specific VLAN, say for printers, you specify that you want printers on the VLAN named “Printer” and the specific number could be different for every switch or site.9 •You cannot override the VLAN to the VLAN that is configured on the port as the voice VLAN. This is not supported. •When you perform a VLAN override, the running configuration will show the original VLAN configured. This is because the configuration is not changed but the switch functionality is. If you execute “show interface gig 1/0/1 switchport” or “show authentication session interface gig 1/0/1,” you will see the VLAN ISE has configured while the running configuration has not changed. •You need to take care when performing VLAN overrides as a device is profiled that it’s given a chance to get the IP on the VLAN it’s assigned. Let’s take the example of a policy where printers are assigned to a specific printer VLAN while everything else is left on the port’s default VLAN. When you plug in a new DHCP printer to the network before ISE has a chance to establish any profiling details on the device, it will be assigned to the default VLAN. Once ISE processes the device’s profiling information, ISE will send a CoA to the switch and ask the device to reauthenticate the MAC address (presumably with MAB). The switchport will reauthenticate and be assigned a different VLAN but the printer won’t know that it needs to obtain a new IP address because it’s on a different subnet. The printer will either have to have its port disconnected and reconnected or need to be rebooted so that it requests a new IP on the correct subnet. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128044575000067 Collecting the Volatile Data from a RouterDale Liu, in Cisco Router and Switch Forensics, 2009 BackgroundIn Cisco routers, flash memory is considered persistent, and it holds the startup and configuration files as well as other IOS files and information. This information is generally considered non-volatile. Your primary concern when investigating volatile router information is to capture information contained within the device's RAM. This will include the running configuration and any dynamic tables. These tables include data such as the following: ▪ARP data ▪Routing tables ▪Network address translator (NAT) information ▪ACL violations ▪Interface statistics ▪Protocol statistics ▪Local logging For the most part, an investigation of volatile information on the router will consist of an analysis of the device's DRAM and SRAM states. Also, router intrusions will generally occur at the network perimeter. Intrusions are usually conducted to gain unauthorized access to other systems or to conduct eavesdropping attacks whereby the router is used as a network sniffer. An investigation into the volatile information of a router is commonly conducted to find evidence of the following: ▪A direct compromise of the network device ▪An analysis of the routing tables to detect manipulation ▪An analysis of the ARP tables to detect manipulation ▪Data theft ▪An analysis of DoS attacks ▪Intermittent device reboots and network performance degradation It is important to respond as soon as possible to a network attack if volatile data is to be collected successfully. Cisco routers and switches save the stored configuration of the router in non-volatile RAM (NVRAM). The current configuration may not match the stored configuration. The current configuration is volatile data and has been maintained within the device's RAM. If an intruder deletes the configuration or somebody power-cycles the Cisco router, any information stored within the device's RAM will be lost. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494182000090 Deploying Juniper FirewallsBrad Woodberg, ... Ralph Bonnell, in Configuring Juniper Networks NetScreen & SSG Firewalls, 2007 System RecoveryThere may be times when your Juniper firewall runs into problems from which you cannot recover. Three scenarios are covered in this section. One of the major issues is configuration management. There may be scenarios that cause you to make changes where you are unsure of the repercussions. For example, you may be adding a new route, or a new policy that could wreak havoc on your network, though you are actively running on a successful configuration. In cases where you need a backup copy of a correctly functioning configuration file, you can use the configuration rollback feature. The configuration rollback feature allows you maintain a backup configuration file that you can use in case your primary configuration file, saved or running, runs into problems. The configuration rollback cannot be performed from the WebUI. Use the following steps to save your system configuration. 1.Use the command get file to get a list of files in flash memory. 2.Enter the command save config to last-known good. A new file called $lkg$.cfg will be created. This file is your rollback configuration file. It is a saved copy of the running configuration at the time you executed the command. That file stays on the system unless you explicitly call the delete command to remove it. This means that even if you reset the configuration to the defaults, you still have this configuration available for use. To restore a previously saved system configuration, type the command exec config rollback. Note that this process forces your device to reboot. As long as the file exists, you can use this restoration process at any time. There is one additional way to use configuration rollback. If you are working on a new configuration that could possibly cause you to lose access to your system for any reason, configuration rollback can be placed in watching mode. In this mode, if the device is reset, it will automatically reset the configuration to the stored rollback configuration. This is a life saver in cases where you need to ensure the safe restoration of your device's provided networking services. To put the rollback in watching mode, type the command exec config rollback enable. The command prompt will include the text “rollback enabled”. To turn this mode off, type exec config rollback disable. Now that we have discussed how to recover your configuration, we need to look at another scenario. What if you lose your root password? This is a tough situation to recover from, because you have lost all access to the system. There are two methods to recover from this error. Both methods require you to have console access to the device. In the first scenario, you would log into the serial console using the serial number of the device as the username and password. Once you do this, you will be notified that you will lose your configuration and all your settings. If you have performed proper configuration management, you will be fine. Note; even the configuration rollback file is deleted. So you must have saved your configuration somewhere other than the system if you want to be able to use it to restore service in an emergency. The following shows a typical serial number login and the resulting messages. Another way to access a system when you have forgotten the root password is to use the reset button located on the exterior of the system. To use this type of configuration use the following procedure: Use a pin, place it in the resent hole, push and hold for at least four to six seconds. The status LED will blink amber once per second. 2.Wait for the status LED to begin blinking, and then remove the pin from the reset hole. 3.Wait one to two seconds, and replace the pin in the reset hole, push and hold for at least four to six seconds. 4.Wait for the status LED to turn red, and then eventually to begin blinking green before you release the pin from the reset hole. Doing this will reset the system, and you will lose all your configurations. This is done for security purposes. These are both powerful methods available to recover your device; however, you may want to disable these options. You may not want someone to be able to walk up to your device and reset your configuration. Both methods can be disabled. However, if you disable them, the device will be unrecoverable if you lose the root password. Therefore, do not lose your root password unless you want to physically return the device to Juniper Networks. To disable the ability to log in using the serial number, type unset admin device-reset. To re-enable this feature, type set admin device-reset. To disable the device's reset button, type unset admin hw-reset. To re-enable this feature, type set admin hw-reset. In the previous section we looked at ways to upgrade ScreenOS. However, there are many ways in which the image can be corrupted during upload. More than likely, the file was damaged before you uploaded it. To restore your system to a functional configuration, you must have serial console access to the system, and a TFTP server on the local network to the device. During the boot process, a prompt will be displayed four times. The prompt will say, “Hit any key to run loader. Press any key, and you will be asked for the file you want to load, the IP address you want to assign to your device, and the IP address of the TFTP server. The interface that receives the IP address you assign is one of the following depending on what type of device you have: Trust, E1, or E1/1. If the file can be found on the TFTP server, it will be loaded into flash, and your device will reboot. When the device reboots it will load the new OS image. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491181500058 Collecting the Non-Volatile and Volatile Data from a SwitchDale Liu, in Cisco Router and Switch Forensics, 2009 Show CommandsThe show commands allow you to display information about the switch. This can be either volatile information that will be lost if the switch loses power, or non-volatile information that will be retained should there be a loss of power. This is why it is important that you not shut down the switch until you have had a chance to gather your information. You cannot re-create volatile information; therefore, if you lose this information, it may hinder your investigation. ClockThe show clock command is important as it allows you to establish a synchronized timeline for your other information. Regional differences and drift in switch clocks may cause an incorrect timestamp, so you need to be sure that the time on the switch corresponds with time in the real world. Figure 11.7 shows the output of the show clock command. Figure 11.7. Output of the show clock Command on a Cisco 2924XL Switch VersionThe show version command gives basic information regarding the switch. Important information to note is uptime, which will indicate whether the switch has been restarted; and the hardware and IOS versions, so any known problems/vulnerabilities can be evaluated. Figure 11.8 shows sample show version output from a Cisco 2924 switch. Figure 11.8. Output of the show version Command on a Cisco 2924XL Switch Running ConfigThe running configuration is a volatile piece of information. Any changes to the switch will be indicated in the running configuration. Cisco switches store this configuration file in memory, not in NVRAM, so when the lights go out, this also goes away. To show the running config, use the show running-config command. Figure 11.9 shows the output of this command. Figure 11.9. Output of the show running-config Command on a Cisco 2924XL Switch Startup ConfigThe startup configuration is used when the switch starts up. After starting the IOS, the switch uses the startup configuration to configure the switch. Typically, the running configuration and startup configuration are the same because Cisco professionals use the following command from privileged exec mode to synchronize the two: copy running-configuration startup-configuration. Differences between the two may indicate that tampering has occurred in the system. To show the startup config, use the following command: Switch#show startup-config The output of the show startup-config command is identical in format to that of the show running-config command. MAC TableSwitches learn Media Access Control (MAC) addresses, which are the 48-bit addresses that are hardcoded into networking cards and devices. This learning process allows switches to make routing decisions for packets based on Layer 2 addresses and effectively cut down on traffic on the network. The MAC addresses are dynamically built using a learning method which examines the source MAC address portion of a packet and associates that address with the port number on which it originated. This information is stored in the switch's memory, in what is called the MAC address table. This table, shown in Figure 11.10, contains the MAC addresses, ports on which they were found, and whether they were learned or statically entered. To show the MAC address table, use the show mac command. Figure 11.10. Output of the show mac command on a Cisco 2924XL Switch BannersA banner is the screen you are greeted with before you log in to a switch. Banners are necessary to help reinforce the point that intrusion into another computer system by unauthorized persons is illegal. Every state has its own laws concerning cyberintrusion. You would be wise to consult with your company's legal team on the best wording that would allow intruders to be warned and prosecuted. You can use the banner motd command to create a “Message of the Day” which will be shown to everyone who attempts to log on to the switch. To set a “Message of the Day” banner, use the following command (note that the $ character is used to indicate the beginning and end of the banner): Switch(config)#banner motd $ Enter TEXT message. End with the character ‘$’. ******************************************************************************** Warning - this device is private property. Unauthorized use prohibited under state and federal law. All access to this device is subject to monitoring, logging, tracking and investigation. Inappropriate use may be punished to the fullest extent allowed under the law. ******************************************************************************** $ LoggingAs good as the information is on the switch, it cannot capture all of the data that would be helpful to you. Most organizations also include logging to a separate syslog server, as shown in Figure 11.11, where very granular bits of information can be stored. An example is to set up a system such as Microsoft's Log Parser (www.microsoft.com) or Kiwi's Syslog (www.kiwisyslog.com) to serve as the repository for logging information. Figure 11.11. Console Configuration System Messages Displayed in Kiwi Syslog Software To enable logging to a syslog server at IP 10.1.1.2 on the switch, use the following command: Switch#config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#logging 10.1.1.2 You can configure switches for up to 16 syslog servers so that different Cisco technicians can receive different logs from the switch. For example, one person could be getting messages related to network performance and another could be receiving security alerts. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494182000119 Why is it important to load the startup configuration into the running configuration?A running configuration resides in a device's RAM, so if a device loses power, all configured commands will be lost. To avoid this scenario, you need to copy your current configuration into the startup configuration.
What is the running config in a Cisco router?The running-configuration is the config that is in the router's memory. You change this config when you make changes to the router. Keep in mind that config is not saved until you do a copy running-configuration startup-configuration. This command can be abbreviated sh run.
What is the purpose of the startup configuration file on a Cisco router?What is the purpose of the startup configuration file on a Cisco router? The startup configuration file is stored in NVRAM and contains the commands needed to initially configure a router. It also creates the running configuration file that is stored in in RAM.
What is the difference between the show run and the show start commands?sh config will show the start-up configuration that will load everytime the device reboots. sh run config will show the configuration that is currently running on the device. This configuration will go away when you reboot the device unless you save it as the start-up config.
What does the running configuration file of the router stored?The router's configuration information is stored in a device called the Non-Volatile RAM (NVRAM), and the IOS images are stored in a device called the flash (lowercase). It's important to keep these names straight because, of course, all Flash memory is nonvolatile RAM.
What is the effect of using the router copy running config startup config command on a router?What is the effect of using the Router# copy running-config startup-config command on a router? The contents of ROM will change. The contents of RAM will change. The contents of NVRAM will change.
|
