Accessing Cisco IOS Devices

Cisco IOS Access

• The presentation is about accessing Cisco IOS devices.
• Different access methods are available.
• These allow maintenance and initial configurations.

Access Methods

• Console Port: A physical port used for maintenance and initial configurations. Requires a special rollover cable. Connects to a PC's COM port.
• Auxiliary Port (AUX): A physical port used for remote access over telephone lines.
• Out-of-Band Connections: Console and AUX ports are out-of-band, meaning they provide access without a configured networking service.

Access Methods (Continued)

• Secure Shell (SSH): Secure remote CLI connection to a device over a network. This is the recommended method.
• Telnet: Insecure remote CLI connection over a network. Passwords and commands are sent in plain text.

Terminal Emulation Programs

• Terminal emulation programs connect to network devices via console ports or SSH/Telnet connections.
• Examples: PuTTY, Tera Term, SecureCRT.

IOS Navigation

• User EXEC Mode: Limited basic monitoring commands. Identified by the > symbol.
• Privileged EXEC Mode: Access to all commands and features. Identified by the # symbol.

Configuration Modes and Subconfiguration Modes

• Global Configuration Mode: Used to configure global options on the device.
• Line Configuration Mode: Used for console, SSH, Telnet, or AUX access.
• Interface Configuration Mode: Used to configure a switch or router interface.

Navigation Between IOS Modes

• Privileged EXEC Mode: Move from User EXEC to privileged EXEC mode by using the enable command.
• Global Configuration mode: Move in and out of the global configuration mode using the configure terminal command(to return to privilege EXEC mode use the exit command).
• Line Configuration Mode: Move in and out of line configuration mode, by using the line command followed by the management line type then to return to global mode use exit command.

Subconfiguration Modes

• To move out of a subconfiguration mode, use the exit command. To return to privilege EXEC use the end command or Ctrl+Z.
• Move directly from one mode to another using the desired subconfiguration mode command (e.g., (config-line)# to (config-if)#.

The Command Structure

• Basic IOS Command Structure: The command structure defines the format for commands—prompt, command, space, keyword or argument.
• Keywords: Specific parameters defined in the OS (e.g., ip protocols).
• Arguments: User-defined values, not predefined (e.g., IP address 192.168.10.5).

IOS Command Syntax Check

• Different formatting rules, for input, can be applied.
• Boldface text represents commands and keywords.
• Italics represent arguments.
• Brackets [ ] and braces { } are used for optional or required elements.

IOS Command Syntax Check (continued)

• The command syntax provides the pattern, or format, to use when entering commands
• For the ping command, the argument is the IP address of the destination device
• For the traceroute command, the argument is also the IP address of the destination device

IOS Help Features

• Context-sensitive help: Quickly finds commands or help to specific commands, or starts with specific characters.
• Command syntax check: Verifies inputs to check if the input is valid in the given context.
• If the input is invalid feedback will be given.

Hot Keys and Shortcuts

• IOS CLI uses various shortcuts or hot keys to ease the configuration process, monitoring process and troubleshooting process.
• Commands and keywords can be shortened. For example, conf can be used for configure, based on uniqueness.

Hot Keys and Shortcuts (continued)

• Table of keystrokes (e.g., Tab to complete commands, Backspace to erase characters, arrows to move cursor, Ctrl+P for past commands).

Hot Keys and Shortcuts (continued)

• More than one line of command output might be produced, causing the "--More--" prompt in the terminal.
• A variety of keystrokes used to control the display when this prompt appears (e.g., Enter, Space bar, any other key).

Basic Device Configuration

• Initial configuration command for a device involves giving a unique hostname.
• Default device name is Switch.
• Naming guidelines for devices start with a letter, contain no spaces, end with a letter/digit, and use only hyphens, letters or digits, less than 64 chars.

Password Guidelines

• Weak passwords are a security risk
• All access (privileged EXEC, user EXEC, and remote TELNET sessions) should be secured with passwords that are strong and encrypted
• Security Guidelines Guideline 1- use passwords with at least 8 characters (preferable 10 or more) Guideline 2 - passwords must be complex

Configure Passwords

• User EXEC mode access:
  • Use the line console 0 command in global configuration mode.
  • Specify the user EXEC mode password.
  • Enable user EXEC access.
• Privileged EXEC Mode access:
  • Enter global configuration mode.
  • Use the enable secret password command.
• VTY Line Access:
• Use the line vty 0 15 to enable VTY access.
• Specify the password
• Enable VTY access using login

Encrypt Passwords

• Startup-config and running-config files usually display passwords in plain text
• Use the service password-encryption command under global configuration mode to encrypt all plaintext passwords.
• Use show running-config to check password encryption was applied.

Device Security

• Cisco AutoSecure: Default security settings on new OS may need adjusting
• Default usernames/passwords should be changed.
• Limit access to authorized users.
• Turn off/uninstall unnecessary services/applications.
• Update software and install security patches for the hardware.

Enable SSH

• Unique Device Hostname: Needed for Cisco devices
• IP Domain Name: Set IP domain name using global configuration mode
• SSH Traffic Encryption: Create keys using crypto key generate rsa general-keys modulus bits.
• Local Database Verification/Creation: Using username global config command to create the database to authenticate users.
• Authenticate against the local database: Use login local line config command to authenticate against the local database.
• Enable inbound SSH sessions: Use the transport input command to allow SSH sessions on the VTY lines.

Disable Unused Services

• Disable any unused services. This preserves resources like CPU cycles and RAM, protecting the hardware from threat actors exploits.
• Verify this using the show ip ports all command or theshow control-plane host open-ports command.

Save Configurations

• Startup-config: Stored in NVRAM; contains commands to be used for the first initialization upon start up and reboot
• Running-config: Stored in RAM and it represents the current configuration of the router.
• To copy running configuration to startup-config: Use copy running-config startup-config

Capture Configuration to a Text File

• Save configurations to a text file. This can be used for archiving or reference purposes.
• Use terminal emulation software (e.g. PuTTY, Tera Term).
• Enable logging, specifying a file name.

Device Security

This quiz covers different methods for accessing Cisco IOS devices, including console and auxiliary ports, as well as secure connections like SSH and Telnet. It also discusses the use of terminal emulation programs for device management. Test your knowledge on the various access methods and their applications!