Cisco CCNA Certification Exam Training: Telnet, Passwords, and Privilege

Your CCNA certification exam is likely going to contain questions about Telnet, an application-level protocol that allows remote communication between two networking devices. With Telnet use being as common as it is, you had better know the details of how to configure it in order to pass your CCNA exam and to work in real-world networks.

The basic concept is pretty simple - we want to configure R1, but we're at R2. If we telnet successfully to R1, we will be able to configure R1 if we've been given the proper permission levels. In this CCNA case study, R2 has an IP address of 172.12.123.2 and R1 an address of 172.12.123.1. Let's try to telnet from R2 to R1.

R2#telnet 172.12.123.1

Trying 172.12.123.1 ... Open

Password required, but none set

[Connection to 172.12.123.1 closed by foreign host]

This seems like a problem, but it's a problem we're happy to have. A Cisco router will not let any user telnet to it by default. That's a good thing, because we don't want just anyone connecting to our router! The "password required" message means that no password has been set on the VTY lines on R1. Let's do so now.

R1(config)#line vty 0 4

R1(config-line)#password baseball

A password of "baseball" has been set on the VTY lines, so we shouldn't have any trouble using Telnet to get from R2 to R1. Let's try that now.

R2#telnet 172.12.123.1

Trying 172.12.123.1 ... Open

User Access Verification

Password:

R1>

We're in, and placed into user exec mode. Let's say we want to configure a new IP address on the ethernet interface on R1. We'll now go into privileged exec mode....

R1>enable

% No password set

R1>

... or maybe we won't! The default behavior of Telnet on a Cisco router is to place the incoming user into user exec mode, and require an enable password to allow that user into privileged exec mode! Right now, we can't configure anything on this router and even the show commands we would use are limited at best.

If we wanted to allow all telnetting users to be put into privileged exec mode immediately without being prompted for an enable password, the command privilege level 15 placed on the VTY lines will accomplish this.

R1(config)#line vty 0 4

R1(config-line)#privilege level 15

From R2, we'll telnet into R1 again.

R2#telnet 172.12.123.1

Trying 172.12.123.1 ... Open

User Access Verification

Password:

R1#

We were able to telnet in from R2 with the original password of "baseball", and even better, we were placed into privileged exec mode immediately!

You may or may not want to do this in real-world networks, though. If you want to assign privilege levels on an individual user basis, configure usernames and passwords and use the privilege 15 command in the actual username/password command itself to give this privilege levels to some users but not all.

R1(config)#username heidi password klum

R1(config)#username tim privilege 15 password gunn

Both users can telnet into the router, but the first user will be placed into user exec and challenged for the enable password to enter privileged exec mode. If there is no enable password, the user literally cannot get into privileged exec. The second user will be placed into privileged exec immediately after successfully authenticating.

Passwords on a Cisco router or switch are vitally important, and you're not tied down to granting "all-or-nothing" access. Knowing the details like the ones shown here help you tie down network security while allowing people to do their jobs - and it doesn't hurt to know this stuff for the CCNA exam, either!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of over 100 free certification exam tutorials, including Cisco CCNA certification test prep articles. His exclusive Cisco CCNA study guide and Cisco CCNA training is also available!

Visit his blog and sign up for Cisco Certification Central, a daily newsletter packed with CCNA, Network+, Security+, A+, and CCNP certification exam practice questions! A free 7-part course, ?How To Pass The CCNA?, is also available, and you can attend an in-person or online CCNA boot camp with The Bryant Advantage!

Cisco CCNA Certification Exam Tutorial: Port-Based Authentication

To pass your CCNA exam and earn this coveted certification, you must understand the details of port-based authentication. This knowledge has a great deal of value in production networks as well, since this authentication scheme is regularly implemented. Let's take a look at this particular CCNA skill.

Consider a situation where you have a server that will be connected to your switch, and you want the port to shut down if a device with a different MAC address that that of the switch attempts to connect to that port. You could also have a situation where you have someone who has a connection to a switch port in his office, and he wants to make sure that only his laptop can use that port.

Both of these examples are real-world situations, and there are two solutions for each. First, we could create a static MAC entry for that particular switch port. I don't recommend this, mainly because both you and I have better things to do than manage static MAC entries. The better solution is to configure port-based authentication on the switch.

The Cisco switch uses MAC addresses to enforce port security. With port security, only devices with certain MAC addresses can connect to the port successfully. This is another reason source MACs are looked at before the destination MAC is examined. If the source MAC is non-secure and port-based authentication is in effect, the destination does not matter, as the frame will not be forwarded. In essence, the source MAC address serves as the password.

MAC addresses that are allowed to successfully communicate with the switch port are secure MAC addresses. The default number of secure MAC addresses is 1, but a maximum of 132 secure MACs can be configured.

When a non-secure MAC address attempts to communicate with the switch port, one of three actions will occur, depending on the port security mode. In Protect mode, frames with non-secure MAC addresses are dropped. There is no notification that a violation has occurred. The port will continue to switch frames for the secure MAC address.

In Restrict mode, the same action is taken, but a syslog message is logged via SNMP, which is a messaging protocol used by Cisco routers.

In Shutdown mode, the interface goes into error-disabled state, the port LED will go out, and a syslog message is logged. The port has to be manually reopened. Shutdown mode is the default port-security mode.

Port-based authentication is just one of the many switching skills you'll have to demonstrate to earn your CCNA certification. Make sure you know the basics shown here, including the action of each particular mode, and you're on your way to CCNA exam success!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of free CCNA and CCNP tutorials, The Ultimate CCNA Study Package, and Ultimate CCNP Study Packages.

You can also join his RSS feed and visit his blog, which is updated several times daily with new Cisco certification articles, free tutorials, and daily CCN

Cisco CCNA / CCNP Exam Tutorial: EIGRP Dual Queries, SIA, And Stub Routers

EIGRP is a major subject of the CCNA exam, and Cisco goes into even more detail with EIGRP on your CCNP exams. Part of that detail is the purpose and configuration of EIGRP stub routers.

A problem with EIGRP comes in when a successor is lost and there is no feasible successor. DUAL doesn't give up that easily, though. DUAL will mark the route as Active, indicating that the route is being calculated and cannot be used to route data, and will send out a Query message.

A DUAL Query is basically one neighbor asking another, "Hey, do you know how to get to this network I just lost my route to?" If that neighbor has a route, the query will be answered with that route; if the neighbor doesn't have such a route, that neighbor will ask its neighbors. The process continues until a downstream router replies with the desired route, or the EIGRP downstream routers run out of neighbors to ask.

It's a good idea to limit the scope of your DUAL queries, otherwise routes may go into Stuck In Active state during this reconfiguration. Route summarization helps to limit queries, as does configuration of EIGRP stub routers.

While EIGRP does not have the stub area options that OSPF does, EIGRP does allow a router to be configured as stub. This is commonly done with a hub-and-spoke configuration where the spoke routers do not have the resources to keep a full routing table. Since the spoke's next hop will always be the hub, all the spoke really needs is a default route. For this reason, the only neighbor an EIGRP stub router can have is the hub router. (Obviously, the hub would never be configured as stub.)

Configuring EIGRP stub routers also combats the SIA problem. EIGRP stub routers are not queried for routes when the hub does not have a feasible successor for a successor route that has gone down.

By default, EIGRP stub routers advertise information about two types of routes back to the hub - directly connected networks and summary routes. To change this default, use the eigrp stub command followed by the types of routes you want the stub to advertise back to the hub. (The eigrp stub command run by itself configures the router as stub.)

R1(config)#router eigrp 100

R1(config-router)#eigrp stub ?

connected Do advertise connected routes

receive-only Set IP-EIGRP as receive only neighbor

static Do advertise static routes

summary Do advertise summary routes

Assume a network where R5 is the hub and R4, R6, and R7 are spokes. As long as the spokes have a neighbor relationship only with the hub, they can be configured as stub routers. They will then advertise their directly connected networks and summary routes back to the hub and will receive only a default route back from the hub. If R5 loses a successor and has no feasible successor, it will not send a query packet to any of the stub routers.

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage , home of free CCNA and CCNP tutorials! Pass the CCNA exam with Chris Bryant!

Cisco CCNA Certification Exam Tutorial: DNS And The IP Name-server Command

DNS behaviors of a Cisco router are important topics for both the CCNA exam and real-world production networks, and you probably didn't know there were so many DNS details before you began studying for the exam! In this tutorial, we'll look at the ip name-server command and its proper usage.

When a command is mistyped on a Cisco router, the default behavior of the router is to attempt to resolve it via DNS. First, the router looks for an IP Host table on the local router to perform this resolution ? that?s what the ?translating? word in the output is referring to. If there?s no IP Host table or the IP Host table doesn?t contain an entry for what you typed, the router will send a broadcast in an attempt to resolve this name through a remote DNS server. To prevent this broadcast, enter the global command no ip domain-lookup. Of course, to use DNS to resolve hostnames, ip domain-lookup would have to be reenabled if it?s been turned off.

R2#contin

Translating "contin"...domain server (255.255.255.255)

% Unknown command or computer name, or unable to find computer address

A command is mistyped as ?contin?. The Cisco router?s default behavior is to resolve this entry locally via an IP Host table, which isn't present on the router. A broadcast is then sent out to find a DNS server to perform the name resolution. The DNS lookup attempt must time out before the configuration can continue.

R2#conf t

R2(config)#no ip domain-lookup

R2#contin

Translating "contin"

% Unknown command or computer name, or unable to find computer address

With ?no ip domain-lookup? configured, the router doesn?t attempt to find a remote DNS server. It sees there is no local resolution configured and almost immediately sends a message to the console that the name can?t be resolved.

R2#conf t

R2(config)#ip domain-lookup

R2(config)#ip name-server 10.1.1.1

R2#contin

Translating "contin"...domain server (10.1.1.1)

A DNS server is installed on the network with the IP address 10.1.1.1. DNS lookup is reenabled with the command ip domain-lookup, and the IP address of the DNS server is specified with the ip name-server command.

It's just that easy to tell a Cisco router exactly where the DNS server is!
Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (http://www.thebryantadvantage.com ), home of free CCNA and CCNP tutorials, and The Ultimate CCNA and CCNP Study Packages. For a copy of his FREE "How To Pass The CCNA" or "CCNP" ebook, visit the website and download copies! Our new RSS feed gives you free Cisco questions daily!

Cisco CCNP/BCMSN Exam Tutorial: Spanning Tree Protocol (STP) Timers

In your BCMSN / CCNP exam study, it's easy to overlook some of the details of Spanning Tree Protocol (STP). After all, you learned all of that in your CCNA studies, right? Not necessarily! While some of the BCMSN material will be a review for you, there are some details regarding familiar topics that you need to learn. That includes the timers for STP - Hello Time, MaxAge, and Forward Delay.

You may remember these timers from your CCNA studies as well, and you should also remember that these timers should not be changed lightly. What you might not have known is that if you decide to change any and all of these timers, that change must be configured on the root bridge! The root bridge will inform the nonroot switches of the change via BPDUs.

Hello Time is the interval between BPDUs, two seconds by default.

Forward Delay is the length of both the listening and learning STP stages, with a default value of 15 seconds.

Maximum Age, referred to by the switch as MaxAge, is the amount of time a switch will retain a BPDU's contents before discarding it. The default is 20 seconds.

The value of these timers can be changed with the spanning-tree vlan command shown below. Verify the changes with the show spanning-tree command.

SW1(config)#spanning-tree vlan 1 ?

forward-time Set the forward delay for the spanning tree

hello-time Set the hello interval for the spanning tree

max-age Set the max age interval for the spanning tree

priority Set the bridge priority for the spanning tree

root Configure switch as root

SW1(config)#spanning-tree vlan 1 hello-time 5

SW1(config)#spanning-tree vlan 1 max-age 30

SW1(config)#spanning-tree vlan 1 forward-time 20

SW1(config)#^Z

SW1#show spanning-tree vlan 1

VLAN0001

Spanning tree enabled protocol ieee

Root ID Priority 32769

Address 000f.90e1.c240

This bridge is the root

Hello Time 5 sec Max Age 30 sec Forward Delay 20 sec

Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)

Address 000f.90e1.c240

Hello Time 5 sec Max Age 30 sec Forward Delay 20 sec

Aging Time 300

Interface Role Sts Cost Prio.Nbr Type

Fa0/11 Desg FWD 19 128.11 P2p

Fa0/12 Desg FWD 19 128.12 P2p

Again, you should always take great care in changing these timers. Those defaults are set for a reason - helping to prevent switching loops!
Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (http://www.thebryantadvantage.com ), home of free CCNA and CCNP tutorials, and The Ultimate CCNA and CCNP Study Packages. For a copy of his FREE "How To Pass The CCNA" or "CCNP" ebook, visit the website and download copies! Our new RSS feed gives you free Cisco questions daily!

Luxurious Lifestyle At The San Francisco Bay Area

The San Francisco Bay Area, popularly known as the 'Bay Area' to local residents, is a diverse and thriving metropolitan region that encompasses San Francisco Bay in the northern part of California. San Francisco, North Bay, East Bay, South Bay, Peninsula and Santa Cruz make up the Bay Area regions. They are divided into nine counties: San Francisco, San Benito, San Mateo, Santa Clara, Santa Cruz, Alameda, Napa, Solano and Sonoma.

Although San Francisco City is identified as the cultural and traditional center of the Bay Area, it is not the largest or most populated city within the area. Historically, the Bay Area traces its roots from Spanish explorers who first set foot in the region and founded a Catholic church in 1776.

Bay Area is distributed over a population of nearly seven million residents (as of the latest count in 2006). People are scattered over a number of suburban and urban centers, hence, the general area name. Its generic name is derived from the various regional natures of the area, with no specific reference to a city.

Studies place the population of San Francisco Bay Area among the best in the country for overall education placement, competing with Washington D.C. and Boston. East Bay is known for being the home of famous seminaries and universities, namely Berkeley or the University of California and Stanford University.

Weather is generally agreeable but unpredictable, as bodies of water fence in the land area. Spring casts mild and cloudless days, summer is cool and overcast, and fall weather is warm, hot and sunny, with mild and clear nights, while winter brings in the most humid rainy days, alternating with clear and sunny skies.

The diverse geography is broken up into prime residential and industrial spaces, covering villages, towns and cities, parks in the national, state and regional levels, as well as airports and military bases. All these are connected by a modern and efficient transport system composed mostly of trains (commuter rail and railroads), highways and roads.

Considered as one of the most affluent regions in America, the San Francisco Bay Area boasts having the most median income per household, across the nation. Six out of the 10 best Californian areas that have the most income per capita (Belvedere, Diablo, Atherton, Woodside and Portal Valley) are all in the Bay Area. The popular Alameda, Contra Costa, Marin, San Francisco, San Mateo and Santa Clara counties in Bay Area are also part of the top 100 income per capita counties in the States. As a result, the Bay Area real estate appreciated to the level of the 'most expensive zip code' league. In 2005, Forbes Magazine listed Atherton, Diablo, Ross, Nicasio, Los Altos, Tiburon, Los Gatos, Portal Valley and San Francisco as one of the top 50 most expensive places to live in.
Visit http://www.johnhomesonline.com for more information about California travel.

Cisco CCNA Exam Tutorial: Password Recovery Procedures

It might happen on your CCNA exam, it might happen on your production network - but sooner or later, you're going to have to perform password recovery on a Cisco router or switch. This involves manipulating the router's configuration register, and that is enough to make some CCNA candidates and network administrators really nervous!

It's true that setting the configuration register to the wrong value can damage the router, but if you do the proper research before starting the password recovery process, you'll be fine.

Despite what some books say, there is no "one size fits all" approach to Cisco password recovery. What works on a 2500 router may not work on other routers and switches. There is a great master Cisco document out on the Web that you should bookmark today. Just put "cisco password recovery" in your favorite search engine and you should find it quickly.

The following procedure describes the process in recovering from a lost password on a Cisco 2500 router. As always, don't practice this at home. It is a good idea to get some practice with this technique in your CCNA / CCNP home lab, though!

The password recovery method examined here is for 2500 routers.

An engineer who finds themselves locked out of a router can view and change the password by changing the configuration register.

The router must first be rebooted and a "break" performed within the first 60 seconds of the boot process. This break sequence can also vary depending on what program is used to access the router, but is the usual key combination.

The router will now be in ROM Monitor mode. From the rom monitor prompt, change the default configuration register of 0x2102 to 0x2142 with the o/r 0x2142 command. Reload the router with the letter i. (As you can see, ROM Monitor mode is a lot different than working with the IOS!)

This particular config register setting will cause the router to ignore the contents of NVRAM. Your startup configuration is still there, but it will be ignored on reload.

When the router reloads, you'll be prompted to enter Setup mode. Answer "N", and type enable at the router> prompt.

Be careful here. Type configure memory or copy start run. Do NOT type write memory or copy run start!

Enter the command show running-config. You'll see the passwords in either their encrypted or unencrypted format.

Type config t, then use the appropriate command to set a new enable secret or enable password.

Don't forget to change the configuration register setting back to the original value! The command config-register 0x2102 will do the job. Save this change with write memory or copy run start, and then run reload one more time to restart the router.

This process sounds hard, but it's really not. You just have to be careful, particularly when you're copying the startup config over the running config. You don't want to get that backwards! So take your time, check the online Cisco documentation before starting, get some practice with this procedure with lab equipment, and you'll be ready for success on the CCNA exam and in your production network!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (http://www.thebryantadvantage.com), home of free CCNA and CCNP tutorials! For my FREE "How To Pass The CCNA" or "CCNP" ebook, visit the website and download your copies. Pass your CCNA exam with The Bryant Advantage!

Cisco Certification: The OSI Model Isn't Just For Exams Anymore!

There's nothing I enjoy more than teaching Cisco technologies, especially CCNA candidates. Whether it's in-person or online, everyone's excited to be there. There's a sense of anticipation in the air, and everyone is ready to work hard, get their hands on the racks of Cisco routers and switches I have available...

... and then I break out the OSI model chart. Chins slump. People sigh, or at least wish they hadn't ordered decaf that morning. Okay, it's not that bad. But it does temper the excitement a little. I always get a sense of "why can't we just hurry up and get on the routers and switches? Why do we have to learn this dry stuff?" One reason is that Cisco demands you know the OSI model inside and out for both the Intro and ICND exams. You have to admit that's a pretty good reason, but still, students find the OSI model information to be very dry.

I understand that, because I've been there. My first exposure to the OSI model was actually in a Novell "Networking Technologies" class, and man, was that chart ever dry. They crammed every known protocol (and some unknown ones, I think) into the OSI model. It looked like a giant jigsaw puzzle, and the real problem is that I didn't know what the heck most of that stuff was.

So I dutifully attempted to memorize this massive chart. I managed to pass the exam, but I wondered what all that effort had really been for. It's not like you sit around in a server room or wiring closet and discuss the OSI model.

As a CCNA candidate, you don't have to worry about all the protocols I memorized way back when, but you do have to know what happens at each layer. Which leads to this question:

"If I work with routers and switches, why do I have to know about all the other layers? Don't routers and switches just work at layer 2 and 3?"

Yes, switches work at Layer 2 and routers at Layer 3. But to truly understand networking, you've got to understand what happens at the other layers. Why?

Most network administrators and engineers are going to spend a lot more time troubleshooting than installing. That's just the way it is. And to troubleshoot effectively, you've got to know what's going on at all layers of the OSI model, not just layers 2 and 3. As someone who's done a lot of hiring and conducted a great many job interviews, I can tell you that the ability to troubleshoot is the number one quality I look for.

That's why I tell CCNA and CCNP candidates that they've got to get all the hands-on practice they can; while I understand the importance of theory, the only way to develop troubleshooting ability is to work on the real deal. No simulator program is going to teach you how to troubleshoot.

Additionally, the only way to truly develop your troubleshooting abilities is to know what's going on over the entire network, not just the routers and switches. Troubleshooting always starts at Layer 1; if you don't find a problem at the Physical layer, and everything's fine with your routers and switches, how are you going to continue troubleshooting if you don't know what the next steps are as data moves closer to the end user?

So when it comes to the OSI model, don't just give it a quick once-over and move on to the fun stuff in your CCNA studies. The tangible benefit of passing your exams is great, but it's the hidden benefit of developing your own troubleshooting methodology that makes mastering the OSI model worthwhile.

About The Author

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage. The Bryant Advantage sells the world's most comprehensive CCNA Study Guide in the world, and is the ONLY company specializing in CCNA and CCNP rack rentals, allowing candidates for these certifications to gain vital hands-on experience with full racks of Cisco routers and switches with labs and prices designed just for them. There are also plenty of FREE CCNA and CCNP tutorials! Visit his site at www.thebryantadvantage.com today!

chris@thebryantadvantage.com