CCNA Certification Exam Training: Passwords, Cisco Routers, And Network

CCNA certification is important, and so is securing our network's Cisco routers! To reflect the importance of network security, your CCNA certification exam is likely going to contain quite a few questions about the various passwords you can set on a Cisco router. Let's take a look at some of those passwords and when to apply them.

If the previous user has logged out of the router properly, you will see a prompt like this when you sit down at the router console:

R1 con0 is now available

Press RETURN to get started.

R1>

To get into enable mode, by default all I have to do is type "enable".

R1>enable

R1#

See how the prompt changed? By default, I can now run all the show and debug commands I want, not to mention entering global configuration mode and doing pretty much what I want. It just might be a good idea to password protect this mode! We do so with either the enable password command or the enable secret command. Let's use the enable password command first.

R1(config)#enable password dolphins

Now when I log out and then go back to enable mode - or try to - I should be prompted for the password "dolphins". Let's see what happens.

R1>enable

Password:

R1#

I was indeed prompted for a password. Cisco routers will not show asterisks or any other character when you enter a password; in fact, the cursor doesn't even move.

The problem with the enable password command is that the password will show in the configuration in clear text, making it easy for someone to look over your shoulder and note the password for future use, as shown below:

hostname R1

enable password dolphins

We could use the "service password-encryption" command to encrypt the enable password, but that will also encrypt all the other passwords in the Cisco router config. That's not necessarily a bad thing! Here's the effect of this command on the enable password we set earlier.

enable password 7 110D1609071A020217

Pretty effective encryption! However, if we want to have the enable password automatically encrypted, we can use the enable secret command. I'll use that command here to set this password to "saints", and note that I'm not removing the previous enable password.

R1(config)#enable secret saints

After removing the "service password-encryption" command, we're left with two enable mode passwords, and they appear in the Cisco router config like this:

enable password dolphins

enable secret 5 $1$kJB6$fPuVebg7uMnoj5KV4GUKI/

If we have two enable passwords, which one should we use to log into the router? Let's try the first password, "dolphins", first:

R1>enable

Password:

Password:

When you're prompted for the password a second time, you know you got it wrong the first time! Let's try "saints":

R1>enable

Password:

Password:

R1#

When both the enable secret and enable password commands are in use on a Cisco router, the enable secret password always takes precedence. "dolphins" didn't get us in, but "saints" did. That's valuable information for both the CCNA certification exam and real-world networks, because there's no worse feeling than typing a password at a Cisco router prompt and then getting another password prompt!

This is just one way to perform basic Cisco router security with passwords. We'll take a look at other methods in a future CCNA certification exam training tutorial!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of over 100 free certification exam tutorials, including Cisco CCNA certification test prep articles. His exclusive Cisco CCNA study guide and Cisco CCNA training is also available!

Visit his blog and sign up for Cisco Certification Central, a daily newsletter packed with CCNA, Network+, Security+, A+, and CCNP certification exam practice questions! A free 7-part course, ?How To Pass The CCNA?, is also available, and you can attend an in-person or online CCNA boot camp with The Bryant Advantage!

How to Find San Francisco DUI Lawyer

DUI or Drunk Driving offense in San Francisco is considered a criminal offense. The legal proceedings can be long wounded. Sometimes the person arrested under dui, himself/herself makes things more complicated by telling or saying things which are not in the interest of the case in hand and the same statements can be used as an evidence against him/her in the court as and when the matter goes for trial.

Anyway without wasting time, I will begin with San Francisco DUI Lawyer. But before that let us discuss San Francisco Dui laws so that the role of San Francisco DUI Lawyer can be understood more clearly and easily.?

As per San Francisco DUI Law if you are arrested on suspicion of DUI in San Francisco first thing, your Driver's License will be confiscated by the police offer making the arrest. Make sure within ten days you request a hearing in the Motor Vehicle Department so that you can get a temporary driver's license. If you don't request a hearing within the given period of time your Driver's License will be automatically suspended. Remember you have only ten business days to request a hearing.?

Like I informed you earlier its considered a criminal offense and can have severe outcomes like heavy fines, increased insurance cost and possible jail time besides community service and Alcohol Reduction Risk Course. People have lost their jobs because of dui arrests. Your life goes out of gear for being caught driving under influence even once.

While hiring a San Francisco DUI Lawyer you should make sure that his/her area of practice is exclusively DUI and not general. Expertise of a San Francisco DUI Lawyer will be far greater and sharper than a general lawyer. He will have a better insight and understanding about the subject and progress of your case. He/she will build and develop the case in your favor right from the day he/she is hired.?

An effective San Francisco DUI Lawyer firm will be well supported by technical staff. Technical staff like people who know about the intoxilyzer machine, accuracy of Blood Alcohol Content test and about credibility of various machines used to perform these road side tests.?

One can also look at the past records of San Francisco DUI Lawyer he/she intends to hire. Ask him questions. Take free consultation. See if you can vibe. Its important. See if your dui lawyer is ready to make a contract. Is he/she ready to put everything in writing?? These are some of the basic points to consider while hiring San Francisco DUI Lawyer

Purva Mewar operates two dwi/dwi attorney websites. How to find a suitable San Francisco DUI Lawyer and Austin DWI Attorney. Read about laws related to dui/dwi in various states in the US and learn how to find a competent dui/dwi lawyer.

Cisco CCNA Certification Exam Tutorial: RIP Details You Must Know

RIP isn't exactly the most complex routing protocol on the CCNA exam, but that makes it easy to overlook some of the important details you must keep in mind in order to pass the exam! To help you review for the exam, here are just a few of those details!

RIP's default behavior is to send version 1 updates, but to accept both version 1 and 2 routing updates.

R2(config)#router rip

R2(config-router)#net 172.16.0.0

R2(config-router)#^Z

R2#show ip protocols

Routing Protocol is "rip"

Sending updates every 30 seconds, next due in 6 seconds

Invalid after 180 seconds, hold down 180, flushed after 240

Outgoing update filter list for all interfaces is

Incoming update filter list for all interfaces is

Redistributing: rip

Default version control: send version 1, receive any version

Interface Send Recv Key-chain

Serial0 1 1 2

By default, RIP v2 autosummarizes routing updates sent across classful network boundaries. To disable this behavior, run no auto-summary under the RIP process.

R1#conf t

R1(config)#router rip

R1(config-router)#version 2

R1(config-router)#no auto-summary

You do not specify a subnet mask or wildcard mask when configuring RIP - just the classful network, even if you're running RIP v2.

R1#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R1(config)#router rip

R1(config-router)#version 2

R1(config-router)#no auto-summary

R1(config-router)#network 172.10.0.0 ?

 

Debug ip rip displays the routing updates and metrics as the advertisements are sent and requested. To see this in action without waiting for the next regularly scheduled update, run clear ip route *.

R1#debug ip rip

RIP protocol debugging is on

R1#clear ip route *

01:16:54: RIP: sending v1 update to 255.255.255.255 via Loopback1 (1.1.1.1)

01:16:54: network 2.0.0.0, metric 2

01:16:54: network 3.0.0.0, metric 2

01:16:54: network 172.16.0.0, metric 1

01:16:54: network 10.0.0.0, metric 2

01:16:54: RIP: sending v1 update to 255.255.255.255 via Serial0 (172.16.123.1)

01:16:54: subnet 172.16.123.0, metric 1

01:16:54: network 1.0.0.0, metric 1

01:16:54: network 2.0.0.0, metric 2

01:16:54: network 3.0.0.0, metric 2

01:16:54: network 10.0.0.0, metric 2

To see only the routes discovered by a routing protocol, run show ip route followed by the name of the protocol:

R1#show ip route rip

R 2.0.0.0/8 [120/1] via 172.16.123.2, 00:00:26, Serial0

R 3.0.0.0/8 [120/1] via 172.16.13.2, 00:00:09, Serial1

[120/1] via 172.16.123.3, 00:00:09, Serial0

R 10.0.0.0/8 [120/1] via 172.16.13.2, 00:00:09, Serial1

[120/1] via 172.16.123.3, 00:00:09, Serial0

[120/1] via 172.16.123.2, 00:00:26, Serial0

And don't forget - to turn off all currently running debugs, run undebug all.

R1#undebug all

All possible debugging has been turned off

Don't overlook RIP and IGRP when it comes to the CCNA exam. OSPF and EIGRP are more complex to configure, but you need to understand how distance vector protocols work in order to pass the CCNA!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage , home of free CCNA and CCNP tutorials! Pass the CCNA exam with Chris Bryant!

Cisco CCNP / BCMSN Exam Tutorial: Dynamic VLANs and VMPS

Knowledge of Dynamic VLANs and VMPS is important in your efforts to pass the BCMSN exam and earn your CCNP, and it's also a great skill to have for your networking career.

As a CCNA and CCNP candidate, you know how and why to configure static VLANs. Static VLANs can be a powerful tool for reducing unnecessary broadcast and multicast traffic, but if hosts are moved from one switch port to another, you've got to make those changes manually on the switch. With Dynamic VLANs, the changes are made - how else? - dynamically.

The actual configuration of dynamic VLANs is out of the scope of the BCMSN exam, but as a CCNP candidate you need to know the basics of VMPS - a VLAN Membership Policy Server.

Using VMPS results in port VLAN membership changes being performed dynamically, because the port's VLAN membership is decided by the source MAC address of the device connected to that port. (Yet another reason that the first value a switch looks at on an incoming frame is the source MAC address.)

In my home lab network, I've got a host connected to switch port fast0/1 that resides in VLAN 12. What if we had to move Host 1's connection to the switch to port 0/6? With static VLANs, we'd have to connect to the switch, configure the port as an access port, and then place the port into VLAN 12. With VMPS, the only thing we'd have to do is reconnect the cable to port 0/6, and the VMPS would dynamically place that port into VLAN 12.

I urge you to do additional reading regarding VMPS. Use your favorite search engine for the term configuring vmps and you'll quickly find some great official Cisco documentation on this topic.

To review, the VLAN membership of a host is decided by one of two factors. With static VLANs, the host's VLAN membership is the VLAN to which its switch port has been assigned. With dynamic VLANs, it is dependent upon the host's MAC address.

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (http://www.thebryantadvantage.com), home of free CCNP and CCNA tutorials! For my FREE "How To Pass The CCNA" or "CCNP" ebook, visit the website and download your copies. Get your CCNP with The Bryant Advantage!

Cisco CCNP / BSCI Certification: The BGP Attribute "MED"

When you're preparing to pass the BSCI exam and earn your CCNP certification, one of the biggest challenges is learning BGP. BGP is totally different from any protocol you learned to earn your CCNA certification, and one of the differences is that BGP uses path attributes to favor one path over another when multiple paths to or from a destination exist.

Notice I said "to or from". In earlier free BGP tutorials, I discussed the BGP attributes "weight" and "local preference". These attributes are used to favor one path to a destination over another; for example, if BGP AS 100 has two paths to a destination in AS 200, these two attributes can be set in AS 100 to favor one path over another. But what if AS 100 wants to inform the routers in AS 200 as to which path it should use to reach a given destination in AS 100?

That's where the BGP attribute "Multi-Exit Discriminator", or MED, comes in. The MED value can be set in AS 100 to tell AS 200 which path it should use to reach a given network in AS 100.

As with many BGP attributes, the MED can be set with a route-map. What you need to watch is that there is no "set med" value in route maps. To change the MED of a path, you need to change the metric of that path. Let's say that there are two entry paths for AS 200 to use to reach destinations in AS 100. You want AS 200 to use the 100.1.1.0/24 path over the 100.2.2.0/24 path. First, identify the two paths with two separate ACLs.

R1(config)#access-list 22 permit 100.1.1.0 0.0.0.255

R1(config)#access-list 23 permit 100.2.2.0 0.0.0.255

Next, write a route-map that assigns a lower metric to the more-desirable path.

R1(config)#route-map PREFER_PATH permit 10

R1(config-route-map)#match ip address 22

R1(config-route-map)#set metric 100

R1(config-route-map)#route-map PREFER_PATH permit 20

R1(config-route-map)#match ip address 23

R1(config-route-map)#set metric 250

Finally, apply the route-map to the neighbor or neighbors.

R1(config-route-map)#router bgp 100

R1(config-router)#neighbor 22.2.2.2 route-map PREFER_PATH out

The key points to keep in mind is that while many BGP attributes prefer a higher value, the MED is basically an external metric - and a lower metric is preferred, just as with the protocols you've already studied to earn your CCNA certification.

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage , home of free CCNA and CCNP tutorials! Pass the CCNA exam with Chris Bryant!

Cisco CCNA/CCNP Home Lab Setup: How To Configure Reverse Telnet

Occasionally, during your CCNA and CCNP studies, you'll run into a term that just doesn't quite make sense to you. (Okay, more than occasionally!) One such term is "reverse telnet". As a Cisco certification candidate, you know that telnet is simply a protocol that allows you to remotely connect to a networking device such as a router or switch. But what is "reverse telnet", and why is it so important to a Cisco CCNA / CCNP home lab setup?

Where a telnet session is started by a remote user who wants to remotely control a router or switch, a reverse telnet session is started when the host device itself imitates the telnet session.

In a CCNA / CCNP home lab, reverse telnet is configured and used on the access server. The access server isn't a white box server like most of us are used to; an access server is a Cisco router that allows you to connect to multiple routers and switches with one session without having to move a rollover cable from device to device.

Your access server will use an octal cable to connect to the other routers and switches in your home lab. The octal cable has one large serial connector that will connect to the access server, and eight rj-45 connectors that will connect to your other home lab devices. Your access server then needs an IP Host table in order to perform reverse telnet.

An IP Host table is easy to put together (and you better know how to write one to pass the CCNA!). The IP Host table is used for local name resolution, taking the place of a DNS server. A typical access server IP Host table looks like this:

ip host FRS 2007 100.1.1.1

ip host R3 2003 100.1.1.1

ip host R1 2001 100.1.1.1

ip host R2 2002 100.1.1.1

ip host R4 2004 100.1.1.1

ip host R5 2005 100.1.1.1

ip host SW1 2006 100.1.1.1

interface Loopback0

ip address 100.1.1.1 255.255.255.255

no ip directed-broadcast

This configuration will allow you to use your access server to connect to five routers, a frame relay switch, and a switch without ever moving a cable. When you type "R1" at the console line, for example, you'll be connected to R1 via reverse telnet. If you have a smaller lab, an access server is still a real timesaver and an excellent investment. And by getting a static IP address to put on your access server, you can even connect to your home lab from remote locations!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (http://www.thebryantadvantage.com ), home of free CCNA and CCNP tutorials, and The Ultimate CCNA and CCNP Study Packages. For a copy of his FREE "How To Pass The CCNA" or "CCNP" ebook, visit the website and download your copies!