Tips and Tricks

One of the best ways to understand why Cisco ASA or Cisco router are not passing traffic as needed and exactly what part of configuration is incorrect is to check the event log file. Problem is, the logging of events is turned off by default, and the command sh log will not give you meaningful output, unless you configure logging on your Cisco device.

In order to turn on logging of events, you have to execute the following commands

FW-DELTACONFIG-1(config)#
logging enable
logging timestamp
logging buffer-size 128000
logging buffered 7

This configuration will allow you to capture all possible events occurring in the device's RAM, while limiting the log file to 128 Kbit. This should be sufficient for analyzing approximately the last 5 to 30 minutes of events, depending on how heavy is the traffic load on your device.

You can see the captured data with the command sh log

FW-DELTACONFIG-1# sh log
Log filter
Even when the load of traffic passing through your device is not very high, the amount of messages in the log file can be overwhelming. This makes finding the desired information somewhat problematic. In order to filter log messages down to only the ones you need, use the command sh log | inc "value". This will limit the log output only to the lines that contain the desired value.
For example, if you want to see only the log events that are related to processing of a certain access list, you should filter using the name of that access list, like ACL_INSIDE_IN:

FW-DELTACONFIG-1# sh log | inc ACL_INSIDE_IN
Deny tcp src inside:2.2.2.2/2607 dst outside:1.1.1.1/13000 by access-group "ACL_INSIDE_IN" [0x0, 0x0]
Jun 15 2016 15:13:33: %ASA-4-106023: Deny tcp src inside:2.2.2.2/2607 dst outside:1.1.1.1/13000 by access-group "ACL_INSIDE_IN" [0x0, 0x0]
Jun 15 2016 15:13:33: %ASA-4-106023: Deny tcp src inside:2.2.2.2/2607 dst outside:1.1.1.1/13000 by access-group "ACL_INSIDE_IN" [0x0, 0x0]

You can find all packets that contain a certain IP address in a similar fashion:

FW-DELTACONFIG-1# sh log | inc 1.1.1.1
Jun 15 2016 15:33:00: %ASA-6-302015: Built inbound UDP connection 199837817 for outside:1.1.1.1/61563 (1.1.1.1/61563) to inside:3.3.3.3/53 (3.3.3.3/53)
Jun 15 2016 15:33:00: %ASA-6-302015: Built inbound UDP connection 199837818 for outside:1.1.1.1/62939 (1.1.1.1/62939) to inside:3.3.3.3/53 (3.3.3.3/53)

Timing
Another important aspect of event logging is time - the timestamp that shows when an event occurred. The command logging timestamp forces all events in the log file to be recorded with timestamps, but you should note that having the correct current time configured on the device itself is key to having meaningful timestamps.

You can check the device's current time with the command sh clock

FW-DELTACONFIG-1# sh clock
15:40:11.651 MSK Wed Jun 15 2016

Before you manually set the current time for your device, you should first configure the time zone in which it is located. The following example sets the device into the Moscow time zone of GMT +3

FW-DELTACONFIG-1 (config)#
clock timezone MSK 3

You can set the device's time manually with the command clock set

FW-DELTACONFIG-1 (config)#
clock set 15:40:00 15 MAY 2016

Alternatively, you can point your device to an NTP server that provides the exact current time. You can use both internal or public NTP servers available on the Internet. You can set several different NTP servers in a list.

FW-DELTACONFIG-1 (config)#
ntp server 50.16.201.39

You can check the clock synchronization status with the command sh ntp associations

FW-DELTACONFIG-1# sh ntp associations
address         ref clock     st  when  poll reach  delay  offset    disp
+~50.16.201.39       89.109.251.21     2   919  1024  377   0.6   -2.26    30.5

The smaller the value of disp (30.5), the more accurate the time is on your device.

This article was written by Alexey Yurchenko
Back to Table of contents

User mode >
As soon as you gain access to the device terminal, you enter user mode, which is indicated by a > prompt.

Privileges are barely enough to view the OS version and the device serial number (command sh ver).
Privileged mode #
For advanced configuration, you have to switch to a priviliged mode. Execute enable and type the password for this mode, if needed. On success, the prompt will change to #.

Here, you can execute commands to view current configuration (sh run) or poll device interfaces (sh ip inter brief for network switches and routers or sh inter ip brief for Cisco ASA).
Configuration mode (config)#
To make any changes to the device configuration, you have to enter a third mode, which is the config mode. To gain access, execute conf t from the privileged mode. The prompt will change from # to (config)#.

Important!
Commands for displaying the device configuration may not work in config mode at some Cisco network switches and routers. To execute them, you have to either

return to the privileged mode (#) by executing exit or q (keyboard shortcut Ctrl+Z),

or

from the current mode, type do and the commmand itself.

This article was written by Alexey Yurchenko
Back to Table of contents

Once you start working with Cisco routers, you may wonder how you set up a SSH connection to a router. Five easy steps to do it are below.
We'll take a Cisco 881 router. Steps to set up a connection to a different router (1841, 2800, 3825, etc.) or a switch (2900, 3500, 4800, etc.) are pretty much the same, though interface configuration can be a little different. (Setting up a SSH connection to Cisco ASA firewalls is described in the article "Cisco ASA basic Internet access")
So, we have on hand

a Cisco 881 router,
an administrator's workstation,
several PC's in the office LAN,
a switch connecting the PC's together on the LAN.

The task is to configure a secure connection to the Cisco router via SSH and provide a means of secure remote control.

Step 0. Configuring an interface
The router should have one interface, the one that is going to be used for remote control, enabled. In our case, it'll be a LAN Fastethernet 0 interface.

Quick reference:
A Cisco 881 router has one Layer 3 interface, called Fastethernet 4, and a built-in switch with four Layer 2 interfaces (Fastethernet 0 to Fastethernet 3). Each of those four interfaces can carry traffic to only one virtual Layer 3 interface (Vlan).
We choose an IP address for the router control interface from the office LAN pool — say, 192.168.0.1. Next, we configure Vlan 1 virtual interface to have this IP address. After that, we bind it to one of the physical interfaces of the router (Fastethernet 0) and enable it with a no shut command.

The outline of the required configuration is

IP address → Vlan X interface → Fastethernet Y interface

We set the IP address for the Vlan 1 interface

and bind Vlan 1 to the Fastethernet 0 physical interface

We're doing the last action to check that the configuration is correct. By default, Vlan 1 is binded to each of the Layer 2 interfaces. The configuration will only have this line for Vlan's other than 1.
Next, we check if the newly created interface is accessible from the router itself and from the office workstations, say, from the administrator's workstation. A simple ping will do. Of course, the Fastethernet 0 router interface has to be connected to the LAN switch (or directly to the administrator's workstation), and the workstation address has to be in the same network as the router interface address (for example, 192.168.0.10).
Step 1. Setting up an admin account
For the remote control, we create an admin account, if none has been created before.

Change asterisks to your admin account password.

Important!
A good password will have both uppercase and lowercase characters, numbers and special characters, no less than 8 characters total.

Step 2. Setting a privileged mode password
By default, a user connected to Cisco command-line interface has user access rights and can only read some device parameters and technical information. The command-line prompt in the user mode is:

To list the router configuration and change it, type enable

By default, a privileged mode is not password-protected, and any user connected with a console cable (see more on the console cable connection in this article) can enter the configuration mode. However, a remote user (via ssh or telnet) with no preset privileges, which is our case, cannot access the configuration mode.
We set a privileged mode password (command-line prompt is #) from the configuration mode (conf t).

This password is the same for all users.
A little bit more about about the configuration modes is written in this article
Step 3. Enabling remote control
To enable the remote control, specify the authentication method with login local

After this step, you can connect to the router using telnet protocol, provided that the router control interface is accessible to the user via the network. For that, run from the command prompt at the administrator's workstation

You will be prompted to enter your username and password, as configured in step 1. On authorization, you will be able to control the router in user mode (> prompt). For the privileged mode (# prompt), type enable and enter your password from step 2.
Step 4. Configuring SSH
Telnet protocol (TCP port 23) transmits all commands and configuration data in plain text, which is potentially unsafe. For a secure connection, use SSH protocol (TCP port 22).
To configure an SSH connection, set an arbitrary domain name, generate a cryptographic key and enable SSH protocol version 2.

After this step, you will be able to connect to your router using an SSH client of your choice. For example, you can use PuTTY.
Step 5. Enabling SSH-only connections
To prevent telnet connections to the router, type:

After that, you will be able to access the Cisco command-line interface only via SSH.
Additionally, you can restrict the router/switch remote control to certain IP addresses only. For instructions, look at this article.

Important!
Access your devices in a secure way. Only use secure connections and limit the distribution of remote control privileges.
Important!
Don't forget to save your changes to the device configuration with write or copy run start. Otherwise, the changes will be discarded on reboot.
R-DELTACONFIG#write
Building configuration...
[OK]

This article was written by Alexey Yurchenko
Back to Table of contents

In order to start working with Cisco equipment, you first need to configure it by connecting to its CLI through the console. Let us take a look at a situation in which you have an administrator workstation and console or rollover cables available somewhere close to the equipment that you want to configure.
1) Configuring Cisco equipment with the use of a console cable
In order to configure Cisco equipment through consoling into its’ CLI, you need to use the blue cable that is shipped with each Cisco device. This cable has to be connected to the COM port of the administrator’s workstation on one end, and the console port of the Cisco device on the other (the interface is marked with “CONSOLE” or “CON” lettering)

Modern PCs and laptops often don’t have the COM port installed. In this case, you will have to purchase a USB to COM (RS232) adapter.
I recommend using the free and simple terminal emulator Putty in order to console into your equipment (Download from the official site). After downloading it, just run the program (it does not require installation) and change the default “SSH” connection type to “Serial” in the dialog box that opens (see the screenshot below). Click “Open” to start your console session.

Important!
If you are using the USB to COM adapter, the “Serial line” value may be different from “COM1”. You can check this in the Windows Device Manager, under the “Ports (COM & LPT)” section. If you see that your port number for “Communications port” is different (for example, it is labeled as “COM7”), then change the value in the “Serial line” box in Putty to your value from the Device Manager.

When your Cisco device is powered on and connected to your workstation via the console cable, clicking the “Open” button in Putty will take you to the device’s CLI. If the terminal window is blank, press “Enter”. At this point, your device should output a greeting text, login request or the CLI itself.

2) Configure a Cisco device using a Rollover cable and another router
In some cases it is possible to gain console access into a device through the use of another, already configured, Cisco router and a special “rollover” cable. I am going to call the unconfigured device, the one you just took out of the box, the “new router” and the one that is already configured and is accessible via a remote terminal, such as Telnet or SSH, the “old router”.
Rollover cables are not shipped with Cisco equipment, but they are very easy to make from a regular patch cord cable. All you have to do is cut off one of the connectors of a regular patch cord cable and rearrange the wires, so that they are a mirror reflection of the other RJ-45 end. To make it more clear, here is a diagram displaying a “mirror reflected connector”:

Important!
The wires in the cable must mirror the other end precisely.
In order to console into the new router through a rollover cable, you need to connect the AUX interface of the old router (color coded in black) to the CONSOLE port (color coded in blue) of the new router, using the newly created rollover cable.
On the old router, the one that is already connected, you need to enter the Privileged mode (the hash symbol “#” is displayed after the router’s name. To learn more about various configuration modes, check out this article). Once in privileged mode, enter the following configuration:

After this, enter the following command:

Where x.x.x.x is the IP address of any interface on this router (the old router).
For example, if your router has an interface configured with the IP address of 192.168.1.1, then you can console into the neighboring new router by entering

Sometimes at this stage you will be asked for a password

This might be the password for the old router, from which you are consoling into the new router (a password for entering itself, if one is set)
This also might be a password for the new router, to which you are trying to console, if one has been set at the factory

After entering the required password you will land at the CLI of the new router and can start configuring it.
3) Remote access
The most comfortable way to configure a device, though, is through a remote terminal, while sitting comfortably at your desk. Check out the article “Accessing a Cisco device using the SSH protocol” in order to learn how to do this in a quick and secure manner.

This article was written by Alexey Yurchenko
Back to Table of contents