Home > Articles > Security > Network Security

  • Print
  • + Share This
This chapter is from the book

This chapter is from the book

IOS Baseline Configuration

This section covers some basic concepts of the IOS CLI, most of which are in close proximity to ASA. Example 3-19 displays the summary boot sequence for a router that had no initial configuration. A successful OS image load culminates in the offer of configuring the device through interactive menus (initial configuration dialog), which was refused in this case. After that, the default EXEC (nonprivileged) Router> mode appears. As previously studied for ASA, the default enable password, whose usage provides access to privileged mode, is BLANK, meaning there is no password and that you just need to press Enter.

Example 3-20, the IOS counterpart of Example 3-3, registers a typical show version output for a Cisco router. Some relevant information that can be obtained from this output includes OS version, physical interfaces, and the amount of memory (RAM, Flash, and NVRAM). The last line of the output informs the value of the Configuration Register, an important boot control parameter. For instance, an HEX value of 2102 for this variable instructs the router to boot using the image stored on its Flash memory and obey what is determined by its startup-config, which is saved in the nonvolatile memory (NVRAM).

Example 3-19. Summary Boot Sequence for an IOS Router

System Bootstrap, Version 12.3(8r)YI, RELEASE SOFTWARE
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2005 by cisco Systems, Inc.
C870 series (Board ID: 3-148) platform with 131072 Kbytes of main memory

Booting flash:/c870-advipservicesk9-mz.124-24.T1.bin
Self decompressing the image : ############################################################################################ [OK]
[output suppressed]
Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T1, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Sat  20-Jun-09 02:20 by prod_rel_team
[output suppressed]
Installed image archive
Cisco 871W (MPC8272) processor (revision 0x100) with 118784K/12288K bytes of memory.
Processor board ID FHK093310A5
MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10
5 FastEthernet interfaces
1 802.11 Radio
128K bytes of non-volatile configuration memory.
24576K bytes of processor board System flash (Intel Strataflash)

--- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no
Press RETURN to get started!
*Mar  1 00:00:05.579: %VPN_HW-6-INFO_LOC: Crypto engine: onboard 0  State changed to: Initialized
*Mar  1 00:00:05.583: %VPN_HW-6-INFO_LOC: Crypto engine: onboard 0  State changed to: Enabled
[output suppressed]
Router>
Router>enable
Router#

Example 3-20. Sample show version Command for IOS

Router# show version
Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T1,
RELEASE SOFTWARE (fc3)
[output suppressed]
ROM: System Bootstrap, Version 12.3(8r)YI, RELEASE SOFTWARE
Router uptime is 2 minutes
System returned to ROM by power-on
System image file is "flash:c870-advipservicesk9-mz.124-24.T1.bin"
[output suppressed]
Cisco 871W (MPC8272) processor (revision 0x100) with 118784K/12288K bytes of memory.
Processor board ID FHK093310A5
MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10
5 FastEthernet interfaces
1 802.11 Radio
128K bytes of non-volatile configuration memory.
24576K bytes of processor board System flash (Intel Strataflash)
Configuration register is 0x2102 Router#

Configuring Interfaces on IOS Routers

IOS interface configuration is simpler than that of ASA-based products, and does not define, for example, information such as nameif and security-level, two concepts that lie at the core of ASA philosophy. Example 3-21 brings two possibilities for IOS interfaces:

  • Configuration of logical parameters directly under the physical interface.
  • Configuration of 802.1Q subinterfaces, enabling many logical subnets to be tied to one physical interface.

Example 3-21. Basic Interface Configuration Tasks

! Configuring logical attributes directly on the physical interface

interface FastEthernet4
 description *** DMZ interface ***
 ip address 192.168.1.201 255.255.255.0
 speed 100
 duplex full
 no shutdown
!
! Creating 802.1Q (Dot1Q) subinterfaces

interface FastEthernet4
 speed 100
 duplex full
 no ip address
 no shutdown
!
interface FastEthernet4.100
 description *** DMZ interface (VLAN 100) ***
 encapsulation dot1q 100
 ip address 192.168.1.201 255.255.255.0
  • + Share This
  • 🔖 Save To Your Account