Backup Configuration Using Kron Schedule

You want to make sure your router automatically saves its configuration on scheduled time? For that purpose you can use kron command on router or switch.

But (yes, there is a but :)) , first you have to configure accurate time on router, to do that use clock set or use ntp server command.

In this lab I'm using TFTP server (tftpd32) for backing up my config, you can use FTP or SCP and kron command to automatically backup configuration.

Here you can download TFTP, SFTP and SCP servers without any fees. 

http://www.solarwinds.com/

After setting the clock, disable pop-up questions when using copy command, those questions are appears beside you supply the complete source and destination file name in the command line, the IOS  will still ask you a question about ip address of TFTP server and file name destination.

To solve the problem use file prompt quit command (the default value is noisy), after that you can start configuring kron scheduler.

Step 1.

HLabR1(config)#kron policy-list SAVECONFIG

HLabR1(config-kron-policy)#cli copy running-config tftp://10.2.0.2/config

HLabR1(config-kron-policy)#exit

HLabR1(config)#kron occurrence SAVE at 21:51 Sun recurring

HLabR1(config)#policy-list SAVECONFIG

Step 2.

Use debug kron all to see what  going to happen at scheduled time.

Jul  7 21:51:16.656: Kron CLI return 0'

**CLI 'copy running-config tftp://10.2.0.2/config':

!!1253 bytes copied in 3.268 secs (383 bytes/sec)'

Jul  7 21:51:16.664: Major 4, Minor 7

Jul  7 21:51:16.664: Respond to end of CLI Process

Use show kron schedule command to see when will run again.

 

SSH Optional Configuration And Testing

I won't write about how is SSH secure than Telnet and that is recommended practice for remote administration network devices, that all Telnet traffic is forwarded in plain text etc, etc, because you already know that.

I will point for optional configuration that is equally needed (in my opinion), but I will also point to steps that you must configure first.

Step 1: Configure the IP domain name

Step 2: Generate one-way secret keys

Step 3: Verify or create a local database entry

Step 4: Enable VTY inbound SSH sessions

Optionally you can configure SSH version, timeout period and number of authentication retries.

You can configure the time that router waits for SSH client to respond for session by configuring command ip ssh time-out seconds in global configuration mode, default value is 120 seconds.

Also you can control how many attempts user can retries for password during connection with SSH client. The command is ip ssh authentication-retries value , by default user has tree attempts before being disconnected.

During configuration and testing I notice that real numbers of attempts is configured value plus 1, if you enter ip ssh authentication-retries 2  user will have tree times to repeat the password. I tried with value from 0 to 5 and every time I tried to connect I had one plus attempt beside configured value.

As you can see on screen shots and running SSH configuration you get one plus attempt for free. :)

Best Practice Access List Branch Office Router (Firewall)

At Branch office you will not always use ASA for security and VPN connectivity with Central office, best way is to use router that you already have at Branch office using Access control list.

 

This approach is best for this scenario, you can change, add or modify for your needs.

How To Configure VPN Site-to-Site using CiscoCP – GNS3

This is network lab I used to configure VPN in GNS3. I used my LAN to simulate the Internet and the network is 10.143.88.0 /24, and two LAN’s I want connect via VPN, 192.168.100.0/24 and 192.168.200.0/24.

How to remove caps/num lock notifications

Every time when I press Caps Lock or Num Lock on keyboard notification balloon pop-up in right low corner of the screen that it’s been turned on/off. It is annoying and it’s disabled me from typing for a couple of seconds. So I decided to turned off, process responsible for notification is QLC Controller.

You can turn off from Task Manager, but every time you Log Off or Turn Off your computer it’s started again. The best way is to turner of from Startup. To do so, start MSCONFIG from Run and from Startup tab and uncheck HP Hotkey Support. 

This will solve problem permanently.

How To Configure NTP on Cisco router - GNS3

Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks and it works on Application Layer. The protocol uses the User Datagram Protocol (UDP) on port number 123.

I will configure router R1 to use NTP clock synchronization from 2.rs.pool.ntp.org, the source of server from http://www.pool.ntp.org/ which is the largest virtual cluster of time servers.

So let's start.

First check time and date on R1...

R1#show clock

*00:14:33.191 UTC Fri Mar 1 2002

Before we configure R1 to use NTP first of all we need to configure name server and lookup for domain name.

R1(config)#ip domain-lookup

R1(config)#ip name-server 4.2.2.2

Advertise default route under OSPF

In this example I will explain where and how to advertise default route under ospf process to send to other ospf routers.

From diagram you can see topology, it's not complex but is good for this purpose.

First I will list configuration of router R1 and R2 and configuration itself from both routers.

R1 is configured for:

- NAT overload

- Serial interface S1/0 as NAT inside with IP address 10.150.20.1/30, and interface on ISP direction with NAT outside with IP received from ISP DHCP server.

- OSPF routing protocol advertising on interface S1/0 or specific IP address 10.150.20.1/30

!

hostname R1

!

ip domain name lab.local

ip name-server 4.2.2.2

ip name-server 192.168.1.1

!

interface FastEthernet0/0

 ip address dhcp

 ip nat outside

 duplex auto

 speed auto

!

interface Serial1/0

 ip address 10.150.20.1 255.255.255.252

 ip nat inside

 clock rate 64000

!        

router ospf 1

 network 10.150.20.1 0.0.0.0 area 0

!

!        

ip nat inside source list NAT_ADDRESSES interface FastEthernet0/0 overload

!

ip access-list standard NAT_ADDRESSES

 permit 192.168.10.0 0.0.0.255

!

end

There is no command for static route because I received that route from my Linksys which I'm using for access the Internet. Addition: I read that if interface which have enabled ip address dhcp router will automatically learn default route, which is case in this example.

S*   0.0.0.0/0 [254/0] via 10.143.88.254 -- Linksys IP address

Tips for the Cisco IOS alias commands

I read post on packetpushers.net  about IOS Alias command and I found them very helpful. I tried them my self. Read the post first and then experiment, the sky is the limit ;)