Setting Passwords Cisco Router/Switch

Set a password for Console login

RTR-01#config t

RTR-01(config)#line console 0

RTR-01(config-line)#login (turns on login enable ability. Otherwise will not prompt)

RTR-01(config-line)#password cisco123

RTR-01(config-line)#end

Set an enable secret password

RTR-01#config t

RTR-01(config)#enable secret cisco123

RTR-01(config)#exit

RTR-01#disable (takes you back to user mode)

RTR-01>enable

Enter password: YOUR_PASSWORD_NOW

Set VTY password

RTR-01#config t

RTR-01(config)#line vty 0 15

RTR-01(config-line)#login (enables the login feature to the VTY line)

RTR-01(config-line)#password cisco123 (sets the password for the line login)

RTR-01(config-line)#end

Enable Global Password Encryption

RTR-01#config t

RTR-01(config)#service password-encryption

Password Recovery for Old/Used Cisco Switch or Router

Sometimes you will obtain an old or used Cisco Switch or Router which has configurations on the device. You can still access the device if you don’t know the password. You can perform the following steps to recover the device all the while saving configurations too.

1.    Connect to the console port.
    a.    Ensure you have a console cable with the prolific device driver. Some cheaper console cables will not allow you to send the break signal during the router/switch boot process.

2.    Reboot the device and send a break signal within the first 30 seconds.
    a.    During reboot you have 30 seconds to send the break signal and interrupt the boot process. This is why you need a higher quality cable with the prolific device driver for break signals.
    b.    You are doing this to enter Rommon boot mode. To change were it looks for the startup configuration.
    c.    You have the following options for sending the break command since laptops and computers are all different:
        i.    Pause/Break key or Ctrl+Pause/Break on keyboard (This is usually the standard for regular keyboards)
        ii.    #Ctrl+Fn+F11
        iii.    #Fn+B
        iv.    #Ctrl+B
        v.    #Ctrl+Fn+B
    d.    Finally, PuTTY has an option to send the break command through the menus:
        i.    Under the PuTTY menu, hover over “Special Command”
        ii.    Then select the “Break” option there.

3.    Modify the Configuration register.
    a.    You are doing this in order to keep it from loading the previous configuration into the running-config. This allows us to bypass the password from the currently installed configuration.
    b.    In Rommon state, there is no OS loaded. It is for recovery purposes. We want to change the “confreg” setting. Type this in:
        i.    #confreg 0x2142
            1.    0x2142 puts it in a state of ignoring the VNRAM contents/startup configuration. But this keeps the old configuration in the system.
            2.    0X2102 is the normal state of boot. Makes it operate normally.
    c.    Next we reset the device to reboot with the new confreg code.
        i.    #reset

4.    Now you can recover your configuration in the router or switch and reset the passwords.
    a.    After reboot, you say “NO” to initial configuration dialog.
    b.    You are now in the router/switch without a configuration.
    c.    Your old configuration is in the startup-config. You can even do a:
        i.    #show startup-config
        ii.    And you can see your old configuration on the router/switch.
    d.    Now we can copy the startup-config into our running-config and we maintain admin rights without the old passwords blocking us:
        i.    #copy startup-config running-config
    e.    Also you can now reset your passwords in global config mode:
        i.    #conf t
        ii.    #enabled secret cisco
        iii.    #line con 0 password cisco
        iv.    And continue with others you wish to reset.
    f.    Make sure to save the configuration:
        i.    #write/#copy run start

5.    Revert the configuration register to the original boot so now you can load your configurations with the new password.
    a.    We have a final step to do. We will need to change that boot process again since that 0x2142 is not the normal boot state. We need to change it back to 0x2102.
        i.    #show version (shows the router/switch status and what the boot reg is set to)
        ii.    #conf t
        iii.    #config-register 0x2102
        iv.    #write
    b.    Now you can reboot with new passwords and your original configuration.

Upgrading the Firmware and IOS for Cisco 4500X

1.    First verify your firmware and your IOS are loaded into the bootflash by executing the following:
    a.    #dir
2.    Once you verified you have the proper files (if you do not, download the correct ones and follow my “Uploading IOS” guide), enter the following commands in order to keep the system from booting into the old IOS. We will do this to force it into the new firmware and IOS files:
    a.    #configure terminal
    b.    #no boot system flash bootflash:YourCurrentLoadedIOS
    c.    #exit
    d.    #write
3.    Next we are actually going to set the config-register and set the device up to load and boot from the files we uploaded into our flash.
    a.    #configure terminal
    b.    #boot system flash bootflash:YourFirmwareUpgradeFileName
    c.    #boot system flash bootflash:YourCiscoIOSFileName
    d.    #config-register 0x2102
    e.    #exit
    f.    #write
4.    Now you need to verify your boot parameters are correct and the system will boot up into your files you want to load:
    a.    #show bootvar
    b.    Look to make sure your BOOT variable is equal to your boot software you wish to boot. ENSURE you check this because I have had where it would load the files out of order, or not put one in. Just verify.
5.    Next you just need to reload the Cisco device and it should start performing the upgrade. It will take up to 5-20 minutes.
    a.    #reload
    b.    Proceed with reload? Confirm
    c.    Not to self and others, sometimes these switches will get stuck and might need to be power cycled. Have a console cable ready just in case troubleshooting is required to get it to boot back up.
6.    Once the switch has loaded up, verify your software has been upgraded with:
    a.    #show version
7.    Next, you need to reset your boot parameters to only load the new IOS and not the firmware file and change back the config-register for proper boot functionality and order:
    a.    #configure terminal
    b.    #no boot system flash bootflash:YourFirmwareFile
    c.    #config-register 0x0102
    d.    #exit
    e.    #write
8.    Finally, you can clean up the files on the system by using the delete command to delete the firmware file. If you have the space and even though you backed up your IOS (you did backup your IOS right?.....), you might still want to keep the old IOS on there just in case you have issues.
    a.    #delete bootflash:YourFirmwareFileName
    b.    Delete filename? Confirm
9.    You have now completed the firmware and IOS upgrade for your system.

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_24829.html#96288

Uploading IOS to Cisco 4500 Device

1.    First, download the appropriate software for your Cisco device.
2.    Once you have the file downloaded, then copy the IOS to the correct folder where your TFTP will pull from.
3.    Now you are ready to upload the file to the bootflash (this is similar to other Cisco devices, but 4500Xs store it in the bootflash).
4.    Next, perform the following commands to perform the upload:
    a.    #copy tftp: bootflash:
    b.    Address or name of remote host? Input_Your_TFTP_IP
    c.    Destination filename? YouCanChangeOrLeaveDefault
    d.    Now you await for the upload to finish.
5.    After your upload has finished, you can now verify the upload has been completed and your file is showing:
    a.    #dir
   
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_24829.html#96288

Backup Cisco IOS on 4500X

1.    First, log into the Cisco device you wish to upgrade.
2.    Perform the following command to verify which IOS version you are currently running:
    a.    #show version
    b.    Scroll up and look for system image file, will say something like “bootflash:cat4500….” or something like this talking about the booting on flash.
3.    Depending on the version or type of switch, you can do either of the following commands to check the directory to verify how much space and what images are loaded on the Cisco system.
    a.    #dir
    b.    #dir flash:/
4.    So once you find the version IOS you are running, and the name of the config file in the directory, you can copy the original IOS to your TFTP server/client by typing in the following, (again, this is to back up the currently running IOS in case any issues arise with the new IOS. If there are any issues, you can easily re-upload this file back into the Cisco system and recover).
    a.    #copy flash tftp
    b.    #Source filename[]?YourCurrentRunningIOS
    c.    #Address or name of remote host[]?YourIPAddressOfSystemToSendIOS
    d.    Then just wait for the copy to transfer to the backup destination.
    e.    You can check the file location you have your TFTP set to download to in order to verify the IOS has been downloaded.

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_24829.html#96288

Configuring LACP EtherChannel on Cisco Switches

1.    First, identify which two interfaces on both devices you will be binding together. Our example we will do TenGigabit 5 and 6 on a Cisco 4500, and Ethernets 7 and 8 on a Nexus 5K.
2.    Once you identified your ports you wish to link together, then you can log into each of the switches you will be working on.
3.    Once you are logged in, first, shut down the interfaces you wish connect. This is Cisco best practice since EtherChannel can cause spanning tree loops if done incorrectly..
    a.    4500 Switch Commands
        i.    #conf t
        ii.    #int range tenGigabit 1/5-6
        iii.    #shut
    b.    Nexus 5K Commands
        i.    #conf t
        ii.    #int ethernet 1/7-8
        iii.    #shut
4.    Now that the interfaces are shut down, we can now continue with the configuration. First, we will do the Nexus 5K
    a.    #conf t (if not already there)
    b.    # int port-channel channel-number
    c.    #description TEST-EtherChannel
    d.    #exit
    e.    # int Ethernet 1/7-8
    f.    #switchport mode trunk
    g.    #(optional) switchport trunk allowed vlan vlan-number
    h.    #channel-group 11 mode active(it will attach to a port channel if already created and matching, if no port channel has been created previously, it will create one for you)
    i.    #exit
5.    Next, we will set up the same thing on the Catalyst 4500X. here, we will just jump straight to the interfaces and set up port-channel directly in the :
    a.    #conf t
    b.    #int range TenGigabit 1/5-6
    c.    #description test-EtherChannel
    d.    #switchport mode trunk
    e.    #channel-group 11 mode active
6.    Your Cisco switches now should be configured and ready to start linking. The last step is to turn on the interfaces. Remember, we shut them down first in order to protect the systems from spanning tree loops. This is especially true when you use the hard coding EtherChannel, but we shut them down anyways for Cisco best practice. Now go into each Cisco switch, select the interfaces in the EtherChannel again, and then turn on the interfaces. The following are the steps:
    a.    Cisco 4500X Example
        i.    #conf t
        ii.    #int range TenGig 1/5-6
        iii.    #no shut
    b.    Cisco Nexus 5K
        i.    #conf t
        ii.    #int Ethernet 1/7-8
        iii.    #no shut
7.    If you noticed, the Cisco Nexus you do not have to select a range for the interfaces. You can just select them. With the Catalayst, you must put in the range in order to select them.
8.    You should start seeing the connections come up. You can do the following to see the status:
    a.    Cisco Nexus 5K: #show interface status
    b.    Cisco Catalyst 4500X: #show ip interface status
   
References:

Cisco Nexus 5K
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/interfaces/6x/b_5500_Interfaces_Config_Guide_Release_6x/b_5500_Interfaces_Config_Guide_Release_602N12_chapter_011.html

Cisco Catalyst 4500X
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/3-1-1SG/configuration/guide/config/channel.pdf

Setting the Clock on Cisco Device

1. You can set the main clock from EXEC privileged mode. The following is the syntax:
a. Clock set “hh:mm:ss” “day month year”
b. Example: “clock set 22:21:20 1 June 2017”
2. After you set it, you can verify by typing “show clock”.