Ralf Zimmermann SIEGNETZ.IT GmbH

Routing aktivieren

ip routing

Routen anzeigen

show ip route
show ip route summary

DHCP Relay aktivieren

dhcp-relay

DHCP Relay Informationen anzeigen

show dhcp-relay

DHCP Relay Server für Vlan

vlan 1000 ip helper-address 10.1.1.10

Vlan DHCP Relay Server Informationen anzeigen

show ip helper-address vlan-1000

OSPF aktivieren

router ospf enable

OSPF für Vlan konfigurieren

vlan 1000
    name "Example-Net"
    untagged 1/1-47
    tagged Trk1
    ip ospf 10.1.1.1 area backbone
    ip ospf 10.1.1.1 authentication-key "xxxxxxxx"
    ip ospf 10.1.1.1 passive

OSPF Informationen anzeigen

show ip ospf
show ip ospf general
show ip ospf interface vlan 1000
show ip ospf external-link-state
show ip ospf neighbor detail
show ip ospf statistics vlan 1000
show ip ospf neighbor 10.1.1.1
show ip ospf redistribute
show ip ospf restrict

Routen per Route-Map redistributen

route-map "export-ospf" permit seq 10
    match source-protocol connected

router ospf 
    area backbone
    redistribute connected route-map "export-ospf"
    enable

Vlans anzeigen

show vlans
show vlans 1000
show vlan port a1-a24
show vlan port a1-a24 detail
show vlan custom a1-a3 id name:20 ipaddr state
show vlan custom id

Management Vlan definieren

management vlan 1000

Primary Vlan definieren

primary-vlan 1000

Vlan Namen zuweisen

vlan 1000 name 1000-clients

Vlan Protokolle definieren

vlan 1000 protocol ipv4
vlan 1000 protocol arp

Vlan löschen

no vlan 1000

Statisches Vlan definieren

static-vlan 1000

Ports taggen

vlan 1000 tagged a1-a5

Layer-3 für Vlan deaktivieren

disable layer3 vlan 1000

Ports konfigurieren

no interface 1,6,7-10 tagged vlan 1,3,5-10
interface 2 forbid vlan 4-5

GVRP aktivieren

gvrp

GVRP deaktivieren

no gvrp

Ports konfigurieren

interface 1-2 unknow-vlans block
interface 3 unknown-vlans learn
interface 4-5 unknown-vlans disable

Spanning Tree aktivieren

spanning-tree

STP Mode MSTP auswählen

spanning-tree mode mstp

MSTP konfigurieren

spanning-tree config-name "NETWORK"
spanning-tree config-revision 1 
spanning-tree instance 1 vlan 1000
spanning-tree instance 1 priority 4096
spanning-tree 1-4,5,7 admin-edge-port
spanning-tree 1-4,5,7 mcheck
spanning-tree 1-4,5,7 root-guard
spanning-tree 1-4,5,7 tcn-guard
spanning-tree 1-4,5,7 bpdu-filter
spanning-tree trap [errant-bpdu|loop-guard|new-root|root-guard]

Spanning Tree Informationen Mode anzeigen

spanning-tree show port configuration
show spanning-tree 
show spanning-tree bpdu-protection
show spanning-tree 1-4,5,7 detail
show spanning-tree detail
show spanning-tree root-history
show spanning-tree debug-counters
show spanning-tree traps
show spanning-tree root-history cst
show spanning-tree root-history ist
show spanning-tree root-history mst
show spanning-tree debug-counters instance 1
show spanning-tree debug-counters instance 2 port a14
show spanning-tree root-history vlan 1000
show spanning-tree debug ports 9 vlan 1020

Debug Counter zurücksetzen

spanning-tree clear-debug-counters

Loop Protection definieren

loop-protect mode port
loop-protect mode vlan
loop-protect 1-2
loop-protect 1-2 receiver-action send-disable
loop-protect vlan 20, 30
spanning-tree 1-2 loop-guard

Loop Protection Informationen anzeigen

show loop-protect 1-2,5,7

Zeitserver definieren

timesync sntp
sntp unicast
sntp server priority 1 10.1.1.10

Zeitzone definieren

time daylight-time-rule western-europe
time timezone 60

DNS Server definieren

ip dns server-address priority 1 10.1.1.5
ip dns server-address priority 2 10.1.1.6
ip dns domain-name example.com

IPv4 standard access-list konfigurieren

ip access-list standard example-access-list
    permit host 10.10.10.100
    deny 10.10.10.1/24 log
    permit any

IPv4 standard access-list anzeigen

show access-list example-access-list config

IPv4 numbered access-list konfigurieren

access-list 10 permit host 10.10.10.100
access-list 10 deny 10.10.10.1/24 log
access-list 10 permit any

IPv4 numbered access-list anzeigen

show access-list 10

IPv4 extended access-list konfigurieren

ip access-list extended example-extended-list
    permit tcp host 10.10.10.100 host 10.10.10.200 eq telnet
    deny ip 10.10.10.1/24 10.10.20.1/24
    permit ip any any
vlan 1001 ip access-group example-extended-list in

IPv4 ACL statistics anzeigen

show statistics aclv4 example-ipv4-acl vlan 1020 vlan

Port Security konfigurieren und anzeigen

show arp-protect
arp-protect trust b1-b4, d1
show port-security
show arp-protect statistics
debug arp-protect
show mac-address
port security a1 learn-mode static address-limit 2 mac-address 00c1c2-d1d2d3d4 00a1a2-b1b2b3b4 action send-alarm
clear mac-address port <port-list>
clear mac-address vlan 1000 mac <mac-address>
debug dynamic-ip-lockdown
show ip source-lockdown status
port-security a mac-address 0ca1b4-132456
show port-security intrusion-log
clear intrusion-flags

Logging Informationen "all events" anzeigen

show logging -a

Logging Informationen "since boot" anzeigen

show logging -b

Logging Informationen in "reverse order" anzeigen

show logging -r -a

Logging Informationen "errors" anzeigen

show logging -e

Logging Informationen "major,error,warning,information,debug" anzeigen

show logging -d

Syslog Server konfigurieren

logging origin-id [hostname|ip-address|none]
logging 10.1.1.100 [udp 514|tcp 1470|tls 6514]
logging severity [debug|major|error|warning|info]
logging facility [user|kern|mail|daemon|auth|auth|syslog|lpr|news|uucp|cron|sys9|sys10-sys14|local10-local17]

Logging Filter

logging filter <name> [enable|disable]
clear logging filter <name|all>
show logging filter <name>

Logging Filter Beispiel

logging filter "noUpPorts" 10 "(A10|A22|B5) is now-online" deny
logging filter "noUpPorts" default permit
logging filter "SevWarnFatal" 10 severity warning permit
logging filter "SevWarnFatal" 20 severity major permit
logging filter "SevWarnFatal" default deny
logging filter "noUpDownEvents" 10 event-num 76 deny
logging filter "noUpDownEvents" 20 event-num 77 deny
logging filter "noUpDownEvents" default permit
logging filter "noStpBlockPorts" 10 "(A[1-9]|A10|B[1-4]) .*Blocked by STP" permit
logging filter "noStpBlockPorts" 20 " .*Blocked by STP" deny
logging filter "noStpBlockPorts" default permit 

Debugging Konfiguration anzeigen

show debug

Debug Types

debug [acl|all|destination|event|ip|lldp|lacp|security|services|snmp|vrrp|wireless-services]

Debugging Informationen über Telnet oder SSH anzeigen

debug destination session

Debugging Informationen auf Syslog Server leiten

debug destination logging

Debugging deaktivieren

no debug destination logging

Debugging Beispiele

debug <debug type> include [ip|port|vlan]
debug snmp event include ip 10.1.1.20
debug ip rip database include port 14

Startup-Config anzeigen

show config

Running-Config anzeigen

show running-config

Chassis lokalisieren

chassislocate [blink|on|off]

Transceiver Informationen anzeigen

show interfaces transceiver 1/49 detail
show interfaces transceiver all detail

Diagnose Beispiele

show tech
show boot-history
show history
show system-information
show version
show interfaces
show interfaces-display
show run | include ipv6
show run | exclude ipv6
show run | begin vlan
show arp | include 10.1.1.10
test cable-diagnostics 1/22,1/26-30

Authorized IP's konfigurieren

ip authorized-managers 10.10.10.0 255.255.255.0 access manager
ip authorized-managers 10.10.10.0 255.255.255.0 manager access-method ssh