CISCO Router Configuration

Support

Contents

  1. Connection From Hyper Terminal
  2. Router Structure
  3. Command Modes Summary
  4. Configuration
    1. Basic Configuration
    2. NAT
    3. SYSLOG
    4. QoS
    5. Security
    6. SNMP
    7. AAA
    8. DHCP
    9. Committed Access Rate (CAR)
  5. How to block P2P and Chat
  6. Initial Configuration Dialog
  7. Recovering A Lost Enable Secret Password
  8. Command Help
    Prompt | Modes
    1600> | User EXEC
    1600# | Privileged EXEC
    1600(config)# | Global configuration
    1600(config-if)# | Interface configuration
    1600(config-if)#ip | ip ?
    1600(config-line)# | Line configuration

Router Setting Example

  1. CISCO Router WAN (HDLC) Example
  2. CISCO Router WAN (HDLC) and NAT Example
  3. CISCO Router WAN (HDLC), NAT and Transparent Proxy Example
  4. CISCO Router WAN (HDLC), NAT and DHCP Example
History
Ver | Date | Description
1.3 | 2004/2/15 | Committed Access Rate (CAR) is added
1.2 | 2002/10/11 | NAT and Transparent Proxy are added
1.1 | 2002/08/28 | Recovering A Lost Enable Secret Password is added
1.0 | 2001/09/06 | Released
Support
Download this page (HTML Help File)
http://www.grape-info.com
Copyright © 1999 Grape Info (support [image] grape-info.com) All rights reserved.


Support & License Agreement

Updated on 3 Feb 2004

Support

If you have any doubt, question, constructive critisism, praise or suggestions, please contact to support [image] grape-info.com

License Agreement

This contents is BeggarWare. You may use it for your own personal use without any formal obligation to the author, except that you may not sell it to anybody.

You may not redistribute this contents without the author's express permission.

If you like the contents and feel that you have received some benefit from it, and want to help me develop future versions ("Windows 2003 Server Configuration" and "Symantec Client Security" are coming soon!), then you can contribute as much as you feel the contents is worth.

You can pay by clicking here or by going to https://www.paypal.com and making a payment to support [image] grape-info.com.

The author is not responsible for any damage that you may cause using it.

The author reserves the right to change this license agreement as he sees fit, without notice.

Copyright © 1999 Grape Info (support [image] grape-info.com) All rights reserved.
Back


How to block P2P and Chat by router

P2P and Chat program port list

P2P and Chat | Port | Destination
Gnutella | 6346 6347 (udp tcp) |
Kazaa | 1214 (udp) |
IRC | 6667 |
Napster | 8888 | 64.124.41.187
MSN | 11295, 14753 (utp) 15203, 7760 (tcp) |

Block Gnutella

To block Gnutella, you should close 6346 6347 udp tcp

I assume the network address is 202.0.0.0/28

access-list 101 deny   tcp 202.0.0.0 0.0.0.15 any eq 6346 log
access-list 101 deny   udp 202.0.0.0 0.0.0.15 any eq 6346 log
access-list 101 deny   tcp 202.0.0.0 0.0.0.15 any eq 6347 log
access-list 101 deny   udp 202.0.0.0 0.0.0.15 any eq 6347 log

Block Kazaa

access-list 101 deny   tcp 202.0.0.0 0.0.0.15 any eq 1214 log
access-list 101 deny   udp 202.0.0.0 0.0.0.15 any eq 1214 log

Block ICQ

access-list 100 deny   tcp 202.144.158.192 0.0.0.255 any eq 5190 log
access-list 100 deny   udp 202.144.158.192 0.0.0.255 any eq 5190 log

Block Napster

access-list 100 deny   tcp 202.144.158.192 0.0.0.255 any eq 8888 log
access-list 100 deny   udp 202.144.158.192 0.0.0.255 any eq 8888 log
Notice: I don't guarantee all the services above. Some may not be able to block now or the future.
Back - Support


Committed Access Rate (CAR)

Committed Access Rate (CAR) lets you limit the bandwidth available for each of traffic type, such as HTTP and FTP.

Example 1 - Control by each protocol
Destination | Traffic Type | Bandwidth Limit (Kbps) | Normal Brust Size (Kbytes) | Maximum Burst Size (KBytes) | Precedence of Traffic at Normal Rate (0-4) | Action on Excessive Traffic
Internet | HTTP | 8 | 8 | 8 | Very High (4) | drop
Internet | FTP | 8 | 8 | 8 | Very High (4) | drop
Internet | SMTP | 8 | 8 | 8 | Best Effort (0) | drop
rate-limit output access-group 100 8000 8000 8000 conform-action set-prec-continue 4 exceed-action drop
rate-limit output access-group 101 8000 8000 8000 conform-action set-prec-continue 4 exceed-action drop
rate-limit output access-group 102 8000 8000 8000 conform-action set-prec-continue 0 exceed-action drop

access-list 100 permit tcp any any eq www
access-list 101 permit tcp any any range ftp-data ftp
access-list 102 permit tcp any any eq smtp

Example 2 - Control by each traffic type
Destination | Traffic Type | Bandwidth Limit (Kbps) | Normal Brust Size (Kbytes) | Maximum Burst Size (KBytes) | Precedence of Traffic at Normal Rate (0-4) | Action on Excessive Traffic
Internet | IP | 8 | 8 | 8 | Very High (4) | drop
Internet | TCP | 8 | 8 | 8 | Very High (4) | drop
Internet | UDP | 8 | 8 | 8 | Very High (4) | drop
rate-limit output access-group 100 8000 8000 8000 conform-action set-prec-continue 4 exceed-action drop
rate-limit output access-group 101 8000 8000 8000 conform-action set-prec-continue 4 exceed-action drop
rate-limit output access-group 102 8000 8000 8000 conform-action set-prec-continue 4 exceed-action drop

access-list 100 permit ip any any
access-list 101 permit tcp any any
access-list 102 permit udp any any


Router Command Modes Summary

Command Modes Summary
Mode | Access Method | Prompt | Exit Method | About This Mode
User EXEC | Begin a session with your router | 1600> | Enter logout command | Change terminal settings Perform basic tests Display system information
Privileged EXEC | Enter the enable command while in user EXEC mode | 1600# | To exit to user EXEC mode, enter the disable command To exit global configuration mode, enter the configure command | Configure your router operating parameters Perform the verification steps shown in this guide
Global configuration | Enter the configure command while in privileged EXEC mode | 1600(config)# | To exit to privileged EXEC mode, enter the exit or end command, or press Ctrl-Z To enter interface configuration mode, enter interface command | Use this mode to configure parameters that apply to your router as a whole
Interface configuration | Enter the interface command (with a specific interface) while in the global configuration mode | 1600(config-if)# | To exit to global configuration mode, enter the end command To exit to privileged EXEC mode, enter the exit command, or press Ctrl-Z To enter subinterface configuration mode, specify a subinterface with the interface command | Use this mode to configure parameters for the various LAN and WAN interfaces of your router, including the Ethernet interface Serial interface ISDN interface
Router configuration | Enter your router command followed by the appropriate keyword while in global configuration mode | 1600(config-router)# | To exit to global configuration mode, enter the end command To exit to privileged EXEC mode, enter the exit command, or press Ctrl-Z | Use this mode to configure an IP routing protocol
Line configuration | Specify a line with the line vty command while in the global configuration mode | 1600(config-line)# | To exit to global configuration mode, enter the exit command To exit to privileged EXEC mode, enter the end command, or press Ctrl-Z | Use this mode to configure parameters for the terminal line

Saving Configuration Changes

You need to enter the copy running-confi startup-config command to save your configuration changes to NVRAM so that they are not lost if there is a system reload or power outage. This example shows ho use this command to save your changes:
Router# copy running-config startup-config
Building configuration...
It might take a minute or two to save the configuration to NVRAM. After the configuration has been saved, the following appears:
[OK]
Router#


Router Configuration

Basic Configuration

Change this router's name. NTP server to adjust time, time zone and disable CDP
router#clock set 12:34:50 11 oct 2002
router#conf t
router(config)#hostname gw
gw(config)#ntp server *.*.*.*
gw(config)#clock timezone BST 9
gw(config)#no cdp run
Increase the telnet session timeout
gw#conf t
gw(config)#line vty 0 4
gw(config-line)#exec-timeout 0 0

Network address translation

Network address translation (NAT) is a technique used in computer networking, which relies on rewriting IP addresses of network packets passing through a router or firewall. This is merely a trick, in the sense routers are not supposed to do that sort of thing, but it is still a very useful and widely used trick.

We can distinguish two kinds of NAT: source address translation (source NAT), where the IP address of the computer which initiated the connection is rewritten, and its counterpart: destination address translation NAT (destination NAT).

IP masquerading is a particular case of source NAT; this is a common technique often used to allow multiple computers to relatively transparently share an Internet connection. To the computers on the local network, the "NAT box" looks like just another router, but in reality, it is doing all sorts of magic.

When the computer performing the NAT routes the systems behind it onto the Internet, it transparently changes the source IP address of the internal system to its external (Internet) address and remembers basic data about the connection. The packet then traverses the Internet to its destination as if it had been generated by the router itself. When the reply is sent back, the router looks at the connection tracking data it stored before and determines where to send it back on the internal network.

The benefits of NAT are great. It allows many computers to access the internet utilizing only a single IP address on the internet. This not only saves money for the organization employing NAT, but also conserves addresses on the internet as few are still available. Downsides include difficulty in using services that require the initiation of TCP connections from the outside network, or stateless protocols such as those utilising UDP; unless the NAT router makes specific effort to support such protocols, incoming connections cannot reach their destination.

gw#conf t
gw(config)#int e0
gw(config-if)#ip nat inside
gw(config-if)#exit
gw(config)#int e1
gw(config-if)#ip nat outside
gw(config-if)#exit
gw(config)#access-list 2 permit 192.168.0.0 0.0.0.255
gw(config)#ip nat inside source list 2 interface e1 overload
If you are using destination NAT, you can publish the Internet service like HTTP.
gw(config)#ip nat inside source static tcp 192.168.0.158 80 interface Ethernet0/1 80

SYSLOG

It sends SYSLOG to a Linux Box
gw#conf t
gw(config)#logging on
gw(config)#logging 192.168.0.2
gw(config)#logging facility local1
gw(config)#logging source-interface e0
Change formats of date, save log into memory. See by "sh logging"
gw(config)#timestamps log datetime msec localtime
gw(config)#service timestamps debug uptime
gw(config)#logging buffered 8192 debugging
Edit /etc/sysconfig/syslog (RedHat7.2) to accept syslog messages remotely
SYSLOGD_OPTIONS="-m 0 -r"
Edit /etc/syslog.conf and add one line as below
...
local1.*                         /var/log/gw.log
Edit /etc/logrotate.d/syslog to lotate /var/log/gw.log file
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boo
t.log /var/log/cron /var/log/gw.log {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || t
rue
    endscript
}
Restart Syslog
# /etc/init.d/syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

QoS

Priority Queuing. It change priority for POP3, SMTP
gw#conf t
gw(config)#priority-list 1 protocol ip high tcp pop3
gw(config)#priority-list 1 protocol ip high tcp smtp

Security

Disable Finger, Source Route, Small Server. Log denied address by access-list
gw(config)#no ip finger
gw(config)#no ip source-route
gw(config)#no service tcp-small-servers
gw(config)#no service udp-small-servers
gw(config)#int s0
gw(config-if)#ip accounting access-violations

SNMP

Use the command below to enable the Read-only (RO) community string
gw#conf t
gw(config)#snmp-server community public RO

AAA

To use AAA (Authentication, Authorization and Accounting) to login
gw(config)#aaa new-model
gw(config)#aaa authentication login default local enable
gw(config)#username username password 7 password

DHCP Server

Configuring DHCP on a Cisco router

!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.0.1 192.168.0.100
!
ip dhcp pool internalnet
 network 192.168.0.0 /24
 default-router 192.168.0.1
 domain-name yourdomain.com
 dns-server 192.168.0.2 192.168.0.3
 netbios-name-server 192.168.0.4
 netbios-node-type h-node
 lease 5
!


Connection From Hyper Terminal

  1. Connect Console cable (light blue, RJ-45-RJ-45) between Computer's COM port and Router's Console port

  2. Run [HyperTerminal] from [Start] menu. Type Connection name and click [OK]

  3. Click [OK]

  4. Select [9600] and click [OK]

  5. Type [Enter] key


CISCO Router WAN (HDLC) Example

External Network (DMZ): | 202.0.0.0/28
CISCO Router (2600): | Etnernet0/1: 202.0.0.14 Serial0/0: HDLC (WAN)
The Internet Server1: | 202.0.0.1 (DNS, SMTP, POP3)
The Internet Server2: | 202.0.0.2 (DNS, WWW, SYSLOG, NTP)
gw#show running-config
Building configuration...

Current configuration : 3174 bytes
!
version 12.1
service nagle
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log uptime
service password-encryption
!
hostname gw
!
boot system flash
logging buffered 8192 debugging
aaa new-model
aaa authentication login default local enable
enable secret 5 12345678901234567890
!
username user1 password 7 12345678901234567890
username user2 password 7 12345678901234567890
username user3 password 7 12345678901234567890
!
!
!
!
clock timezone BST 6
ip subnet-zero
no ip source-route
ip domain-list test.com
ip domain-name test.com
ip name-server 202.0.0.1
ip name-server 202.0.0.2
!
!
!
!
interface Ethernet0/0
 no ip address
 no ip directed-broadcast
 shutdown
!
interface Serial0/0
 description 64K HDLC link to the Internet
 bandwidth 64
 ip unnumbered Ethernet0/1
 ip access-group 100 in
 ip access-group 101 out
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 no ip mroute-cache
 down-when-looped
 no cdp enable
!
interface Ethernet0/1
 description HOGE LAN
 ip address 202.0.0.14 255.255.255.240
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 no ip mroute-cache
 no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
no ip http server
!
logging facility local1
logging source-interface Ethernet0/1
logging 202.0.0.2
access-list 100 permit icmp any 202.0.0.0 0.0.0.15
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 established
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit udp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq smtp
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq pop3
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq www
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   udp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 6000 log
access-list 100 deny   ip any any log
access-list 101 permit ip 202.0.0.0 0.0.0.15 any
access-list 101 deny   ip any any log
no cdp run
snmp-server community public RO
banner login ^C
Welcome to HOGE router
^C
!
line con 0
line aux 0
line vty 0 4
 access-class 101 in
 exec-timeout 0 0
 password 7 12345678901234567890
 transport input telnet
 transport output none
!
ntp server 202.0.0.2
end


CISCO Router WAN (HDLC) and NAT Example

Private Network: | 192.168.0.0/24
External Network (DMZ): | 202.0.0.0/28
CISCO Router (2600): | Ethernet0/0: 192.168.0.4 Etnernet0/1: 202.0.0.14 Serial0/0: HDLC (WAN)
The Internet Server1: | 202.0.0.1 (DNS, SMTP, POP3)
The Internet Server2: | 202.0.0.2 (DNS, WWW, SYSLOG, NTP)
gw#show running-config
Building configuration...

Current configuration : 3174 bytes
!
version 12.1
service nagle
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log uptime
service password-encryption
!
hostname gw
!
boot system flash
logging buffered 8192 debugging
aaa new-model
aaa authentication login default local enable
enable secret 5 12345678901234567890
!
username user1 password 7 12345678901234567890
username user2 password 7 12345678901234567890
!
!
clock timezone JST 9
ip subnet-zero
no ip source-route
ip domain-list test.com
ip domain-name test.com
ip name-server 202.0.0.1
ip name-server 202.0.0.2
!
!
!
!
interface Ethernet0/0
 description Private LAN
 ip address 192.168.0.4 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 ip nat inside
 no ip mroute-cache
 no cdp enable
!
interface Serial0/0
 description 64K HDLC link to the Internet
 bandwidth 64
 ip unnumbered Ethernet0/1
 ip access-group 100 in
 ip access-group 101 out
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 ip nat outside
 no ip mroute-cache
 down-when-looped
 no cdp enable
!
interface Ethernet0/1
 description HOGE External (DMZ) LAN
 ip address 202.0.0.14 255.255.255.240
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 no ip mroute-cache
 no cdp enable
!
ip nat inside source list 1 interface Ethernet0/1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
no ip http server
!
logging facility local1
logging source-interface Ethernet0/1
logging 202.0.0.2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 permit icmp any 202.0.0.0 0.0.0.15
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 established
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit udp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq smtp
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq pop3
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq www
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   udp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 6000 log
access-list 100 deny   ip any any log
access-list 101 permit ip 202.0.0.0 0.0.0.15 any
access-list 101 deny   ip any any log
access-list 102 permit ip 202.0.0.0 0.0.0.15 any
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 deny   ip any any log
no cdp run
snmp-server community public RO
banner login ^C
Welcome to HOGE router
^C
!
line con 0
line aux 0
line vty 0 4
 access-class 102 in
 exec-timeout 0 0
 password 7 12345678901234567890
 transport input telnet
 transport output none
!
ntp server 202.0.0.2
end


CISCO Router WAN (HDLC), NAT and DHCP Example

Private Network: | 192.168.0.0/24
External Network (DMZ): | 202.0.0.0/28
CISCO Router (1700): | FastEthernet0:192.168.0.3 Serial0 (HDLC WAN):202.0.0.1
The Internet Server1: | 202.0.0.1 (DNS, SMTP, POP3)
The Internet Server2: | 202.0.0.2 (DNS, WWW, SYSLOG, NTP)
jicajvbt#show running-config
Building configuration...

Current configuration : 2112 bytes
!
version 12.2
service nagle
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log uptime
service password-encryption
!
hostname gw
!
logging buffered 8192 debugging
no logging console
aaa new-model
!
!
aaa session-id common
enable secret 5 123456789012345678901234567890
!
username hoge password 7 1234567890
clock timezone BST 6
ip subnet-zero
no ip source-route
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.0.1 192.168.0.99
!
ip dhcp pool internalnet
   network 192.168.0.0 255.255.255.0
   default-router 192.168.0.3
   domain-name hoge.local
   netbios-name-server 192.168.0.1 192.168.0.2
   netbios-node-type h-node
   dns-server 202.1.1.1 202.1.1.2
   lease 5
!
!
!
!
!
interface FastEthernet0
 description LAN Network
 ip address 192.168.0.2 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip nat inside
 no ip route-cache
 speed auto
 no cdp enable
!
interface Serial0
 description 128Kbps HDLC Link to ISP
 ip address 202.144.157.126 255.255.255.240
 ip access-group 100 in
 ip access-group 101 out
 no ip redirects
 no ip proxy-arp
 ip nat outside
 no ip route-cache
 no fair-queue
 no cdp enable
!
ip nat inside source list 1 interface Serial0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0 permanent
no ip http server
!
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 deny   ip any any log
access-list 101 permit ip 202.144.157.112 0.0.0.15 any
access-list 101 deny   ip any any log
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 deny   ip any any log
no cdp run
radius-server retransmit 3
radius-server authorization permit missing Service-Type
!
line con 0
line aux 0
line vty 0 4
 access-class 102 in
 password 7 030E520807
!
end


CISCO Router WAN (HDLC), NAT and Transparent Proxy Example

Private Network: | 192.168.0.0/24
External Network (DMZ): | 202.0.0.0/28
CISCO Router (2600): | Ethernet0/0: 192.168.0.4 Etnernet0/1: 202.0.0.14 Serial0/0: HDLC (WAN)
The Internet Server1: | 202.0.0.1 (DNS, SMTP, POP3, PROXY)
The Internet Server2: | 202.0.0.2 (DNS, WWW, SYSLOG, NTP)
gw#show running-config
Building configuration...

Current configuration : 3424 bytes
!
version 12.1
service nagle
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log uptime
service password-encryption
!
hostname gw-
!
boot system flash
logging buffered 8192 debugging
aaa new-model
aaa authentication login default local enable
enable secret 5 12345678901234567890
!
username user1 password 7 12345678901234567890
username user2 password 7 12345678901234567890
username user3 password 7 12345678901234567890
!
!
!
!
clock timezone BST 6
ip subnet-zero
no ip source-route
ip domain-list test.com
ip domain-name test.com
ip name-server 202.0.0.1
ip name-server 202.0.0.2
!
!
!
!
interface Ethernet0/0
 description Private LAN
 ip address 192.168.0.4 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 ip nat inside
 no ip mroute-cache
 ip policy route-map proxy-redirect
 no cdp enable
!
interface Serial0/0
 description 64K HDLC link to ISP
 bandwidth 64
 ip unnumbered Ethernet0/1
 ip access-group 100 in
 ip access-group 101 out
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 ip nat outside
 no ip mroute-cache
 down-when-looped
 no cdp enable
!
interface Ethernet0/1
 description External (DMZ) LAN
 ip address 202.0.0.14 255.255.255.240
 no ip redirects
 no ip proxy-arp
 ip accounting access-violations
 no ip mroute-cache
 no cdp enable
!
ip nat inside source list 1 interface Ethernet0/1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
no ip http server
!
logging facility local1
logging source-interface Ethernet0/1
logging 202.0.0.1
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 permit icmp any 202.0.0.0 0.0.0.15
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 established
access-list 100 permit tcp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit udp any 202.0.0.0 0.0.0.15 gt 1023
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.1 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit udp any 202.0.0.2 0.0.0.0 eq domain
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq smtp
access-list 100 permit tcp any 202.0.0.1 0.0.0.0 eq pop3
access-list 100 permit tcp any 202.0.0.2 0.0.0.0 eq www
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   udp any 202.0.0.0 0.0.0.15 eq 2049 log
access-list 100 deny   tcp any 202.0.0.0 0.0.0.15 eq 6000 log
access-list 100 deny   ip any any log
access-list 101 permit ip 202.0.0.0 0.0.0.15 any
access-list 101 deny   ip any any log
access-list 102 permit ip 202.0.0.0 0.0.0.15 any
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 deny   ip any any log
access-list 110 deny   tcp any any neq www
access-list 110 deny   tcp host 202.0.0.1 any
access-list 110 permit tcp any any
no cdp run
route-map proxy-redirect permit 10
 match ip address 110
 set ip next-hop 202.0.0.1
!
snmp-server community public RO
banner login ^C
Welcome
^C
!
line con 0
line aux 0
line vty 0 4
 access-class 102 in
 exec-timeout 0 0
 password 7 11111C0A19
 transport input telnet
 transport output none
!
ntp server 202.144.158.193
end
On a Linux system with IPTables, and the proxy software installed locally you would simply need:
iptables -A PREROUTING -s 192.168.0.0/28 -p tcp -m tcp \
    --dport 80 -j REDIRECT --to-ports 8080
Or if the proxy is on a different system:
iptables -t nat -A PREROUTING -p tcp --dport 80 \
    -i eth0  -j DNAT --to 202.0.0.2:8080
  • If you are using squid, you should give these in /etc/squid/squid.conf
    httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
    Or if you are using Delegate, nothing to change


Initial Configuration Dialog

System Bootstrap, Version 12.0(3)T, RELEASE SOFTWARE (fc1)
Copyright (c) 1999 by cisco Systems, Inc.
C1600 platform with 8192 Kbytes of main memory

program load complete, entry point: 0x4020060, size: 0x165eac

%SYS-6-BOOT_MESSAGES: Messages above this line are from the boot loader.
program load complete, entry point: 0x2005000, size: 0x21f936
Self decompressing the image : #################################################
######################### [OK]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco Internetwork Operating System Software
IOS (tm) 1600 Software (C1600-Y-M), Version 12.0(12), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Mon 10-Jul-00 19:59 by htseng
Image text-base: 0x02005000, data-base: 0x0245E484

cisco 1601 (68360) processor (revision C) with 6144K/2048K bytes of memory.
Processor board ID 23099315, with hardware revision 00000003
Bridging software.
X.25 software, Version 3.0.0.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
System/IO memory with parity disabled
8192K bytes of DRAM onboard
System running from RAM
7K bytes of non-volatile configuration memory.
4096K bytes of processor board PCMCIA flash (Read/Write)

         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: yes

At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.

Basic management setup configures only enough connectivity
for management of the system, extended setup will ask you
to configure each interface on the system

Would you like to enter basic management setup? [yes/no]: yes
Configuring global parameters:

  Enter host name [Router]: hoge-gw

  The enable secret is a password used to protect access to
  privileged EXEC and configuration modes. This password, after
  entered, becomes encrypted in the configuration.
  Enter enable secret: password1

  The enable password is used when you do not specify an
  enable secret password, with some older software versions, and
  some boot images.
  Enter enable password: password2

  The virtual terminal password is used to protect
  access to the router over a network interface.
  Enter virtual terminal password: password3
  Configure SNMP Network Management? [yes]: yes
    Community string [public]: HOGE

Current interface summary

Any interface listed with OK? value "NO" does not have a valid configuration

Interface			   IP-Address	   OK? Method Status				Protocol

Ethernet0			   unassigned	   NO  unset  up					down

Serial0 			   unassigned	   NO  unset  down					down

Enter interface name used to connect to the
management network from the above interface summary: Ethernet0

Configuring interface Ethernet0:
Configure IP on this interface? [yes]: yes
IP address for this interface: 202.144.158.253
Subnet mask for this interface [255.255.255.0] : 255.255.255.240
Class C network is 202.144.158.0, 28 subnet bits; mask is /28

The following configuration command script was created:

hostname hoge-gw
enable secret 5 $1$Tk3z$5NlqsaYCojkq4cNoXl6sG1
enable password password2
line vty 0 4
password password3
snmp-server community HOGE
!
no ip routing

!
interface Ethernet0
no shutdown
ip address 202.144.158.253 255.255.255.240
!
interface Serial0
shutdown
no ip address
!
end

[0] Go to the IOS command prompt without saving this config.
[1] Return back to the setup without saving this config.
[2] Save this configuration to nvram and exit.

Enter your selection [2]: 2
Building configuration...
Use the enabled mode 'configure' command to modify this configuration.

Press RETURN to get started!


Recovering A Lost Enable Secret Password

If the enable secret password is lost, a new password must be set. To recover a lost enable secret for cisco routers, follow the steps outlined below.

Before you begin - Connect A Console

  1. A terminal must be directly attached to the console port of the router. To do this, use the supplied console cable and adapter. Console port settings are 9600 baud, 8N1, no flow control.
    Take the following steps to connect a terminal (an ASCII terminal or a PC running terminal emulation software) to the console port on the router:
    Connection From Hyper Terminal

Procedure

  1. Power cycle the router.

  2. Send a "break" command to the router within the first 60 seconds after power cycle. The break command will vary depending on the terminal emulation package used. For Windows Hyperterminal, the break command is sent by holding the CTRL key down and pressing the BREAK key. After sending a successful break character, the router will be in ROM monitor mode as indicated by the angle bracket (>) prompt.

  3. From the ROM monitor prompt, set the configuration register value to 0x142. This causes the router to bypass the configuration contents stored in NVRAM upon next bootup and reboot the router by typing the following: 2500/4000
    > o/r 0x142
> i
    or 1000/1600/3600/4500
    > confreg 0x142
> reset
    The router will reboot itself.

  4. Enter privileged EXEC mode by typing the enable command. No password will be required. The prompt will change to Router(boot)#.
    Router> enable
Router#

  5. Load the original configuration back into the router. There are two equivalent ways of doing this depending on the software version you are running.
    Router# copy startup-config running-config
    For IOS Releases 11.0 and above
    OR
    Router# config mem
    For IOS Releases prior to 11.0
  6. Set the new enable password.
    7. Router# config term
Router(config)# enable secret new_password
  7. Restore the configuration register and exit configuration mode. The configuration register must be reset so the router will properly boot using the configuration now stored in NVRAM.
    8. Router(config)# config-reg 0x2102
Router(config)# end
  8. Save changes
    9. Router# copy running-config startup-config
    For IOS Releases 11.0 and above OR
    Router# write memory
    For IOS Releases prior to 11.0


Cisco Router Structure

  1. RAM

    2. RAM (DRAM) is used at run time for executable Cisco IOS software (and its subsystems), routing tables, Fast Switching cache, running configuration, packets, and so on.

  2. NVRAM

    3. Non-Volatile RAM (NVRAM) is used for writable permanent storage of the startup configuration. It is an EPROM, where the startup configuration is stored in the same Flash device where the boot code is loaded.

  3. ROM

    4. BootROM is used for permanently storing startup diagnostic code (ROM Monitor) and emergency OS

    The main task for the BootROM is to perform some hardware diagnostics during bootup on the router (Power On Self Test - POST), and to load the Cisco IOS software from the Flash to the Memory.

    The BootROM is not erasable; it is socketed so it can be replaced.

  4. Flash

    5. Flash is used for permanent storage of a full Cisco IOS software image in compressed form.


Global configuration

Command | Description
aaa | Authentication, Authorization and Accounting.
access-list | Add an access list entry
alias | Create command alias
arp | Set a static ARP entry
async-bootp | Modify system bootp parameters
banner | Define a login banner
boot | Modify system boot parameters
bridge | Bridge Group.
buffers | Adjust system buffer pool parameters
busy-message | Display message when connection to host fails
call-history-mib | Define call history mib parameters
cdp | Global CDP configuration subcommands
chat-script | Define a modem chat script
clock | Configure time-of-day clock
config-register | Define the configuration register
default | Set a command to its defaults
default-value | Default character-bits values
dialer | Dialer watch commands
dialer-list | Create a dialer list entry
dnsix-dmdp | Provide DMDP service for DNSIX
dnsix-nat | Provide DNSIX service for audit trails
downward-compatible-config | Generate a configuration compatible with older software
enable | Modify enable password parameters
end | Exit from configure mode
exception | Exception handling
exit | Exit from configure mode
file | Adjust file system parameters
frame-relay | global frame relay configuration commands
help | Description of the interactive help system
hostname | Set system's network name
interface | Select an interface to configure
ip | Global IP configuration subcommands
key | Key management
line | Configure a terminal line
logging | Modify message logging facilities
login-string | Define a host-specific login string
map-class | Configure static map class
map-list | Configure static map list
menu | Define a user-interface menu
modemcap | Modem Capabilities database
multilink | PPP multilink global configuration
netbios | NETBIOS access control filtering
no | Negate a command or set its defaults
partition | Partition device
priority-list | Build a priority list
privilege | Command privilege parameters
prompt | Set system's prompt
queue-list | Build a custom queue list
resume-string | Define a host-specific resume string
rlogin | Rlogin configuration commands
rmon | Remote Monitoring
route-map | Create route-map or enter route-map command mode
router | Enable a routing process
rtr | RTR Base Configuration
scheduler | Scheduler parameters
service | Modify use of network based services
snmp-server | Modify SNMP parameters
sntp | Configure SNTP
stackmaker | Specify stack name and add its member
state-machine | Define a TCP dispatch state machine
subscriber-policy | Subscriber policy
tacacs-server | Modify TACACS query parameters
terminal-queue | Terminal queue commands
tftp-server | Provide TFTP service for netload requests
username | Establish User Name Authentication
virtual-profile | Virtual Profile configuration
x25 | X.25 Level 3
x29 | X29 commands


Interface configuration

Command | Description
access-expression | Build a bridge boolean access expression
arp | Set arp type (arpa, probe, snap) or timeout
backup | Modify backup parameters
bandwidth | Set bandwidth informational parameter
bridge-group | Transparent bridging interface parameters
carrier-delay | Specify delay for interface transitions
cdp | CDP interface subcommands
cmns | OSI CMNS
custom-queue-list | Assign a custom queue list to an interface
default | Set a command to its defaults
delay | Specify interface throughput delay
description | Interface specific description
exit | Exit from interface configuration mode
fair-queue | Enable Fair Queuing on an Interface
help | Description of the interactive help system
hold-queue | Set hold queue depth
ip | Interface Internet Protocol config commands
keepalive | Enable keepalive
llc2 | LLC2 Interface Subcommands
load-interval | Specify interval for load calculation for an interface
logging | Configure logging for interface
loopback | Configure internal loopback on an interface
mac-address | Manually set interface MAC address
media-type | Interface media type
mtu | Set the interface Maximum Transmission Unit (MTU)
netbios | Use a defined NETBIOS access list or enable name-caching
no | Negate a command or set its defaults
priority-group | Assign a priority group to an interface
random-detect | Enable Weighted Random Early Detection (WRED) on an Interface
shutdown | Shutdown the selected interface
snapshot | Configure snapshot support on the interface
snmp | Modify SNMP interface parameters
standby | Hot standby interface subcommands
timeout | Define timeout values for this interface
traffic-shape | Enable Traffic Shaping on an Interface or Sub-Interface
transmit-interface | Assign a transmit interface to a receive-only interface
tx-queue-limit | Configure card level transmit queue limit


Interface configuration ip

Command | Description
access-group | Specify access control for packets
accounting | Enable IP accounting on this interface
address | Set the IP address of an interface
authentication | authentication subcommands
bandwidth-percent | Set EIGRP bandwidth limit
broadcast-address | Set the broadcast address of an interface
directed-broadcast | Enable forwarding of directed broadcasts
hello-interval | Configures IP-EIGRP hello interval
helper-address | Specify a destination address for UDP broadcasts
hold-time | Configures IP-EIGRP hold time
irdp | ICMP Router Discovery Protocol
mask-reply | Enable sending ICMP Mask Reply messages
mobile | Mobile Host Protocol
mtu | Set IP Maximum Transmission Unit
nat | NAT interface commands
nhrp | NHRP interface subcommands
ospf | OSPF interface commands
policy | Enable policy routing
probe | Enable HP Probe support
proxy-arp | Enable proxy ARP
rarp-server | Enable RARP server for static arp entries
redirects | Enable sending ICMP Redirect messages
rip | Router Information Protocol
route-cache | Enable fast-switching cache for outgoing packets
rtp | RTP parameters
security | DDN IP Security Option
split-horizon | Perform split horizon
summary-address | Perform address summarization
tcp | TCP header compression parameters
unnumbered | Enable IP processing without an explicit address
unreachables | Enable sending ICMP Unreachable messages
verify | Enable per packet validation


Line configuration

Command | Description
absolute-timeout | Set absolute timeout for line disconnection
access-class | Filter connections based on an IP access list
activation-character | Define the activation character
autobaud | Set line to autobaud
autocommand | Automatically execute an EXEC command
autohangup | Automatically hangup when last connection closes
autoselect | Set line to autoselect
data-character-bits | Size of characters being handled
databits | Set number of data bits per character
default | Set a command to its defaults
disconnect-character | Define the disconnect character
dispatch-character | Define the dispatch character
dispatch-machine | Reference a TCP dispatch state machine
dispatch-timeout | Set the dispatch timer
domain-lookup | Enable domain lookups in show commands
editing | Enable command line editing
escape-character | Change the current line's escape character
exec | Start an EXEC process
exec-banner | Enable the display of the EXEC banner
exec-character-bits | Size of characters to the command exec
exec-timeout | Set the EXEC timeout
exit | Exit from line configuration mode
flowcontrol | Set the flow control
flush-at-activation | Clear input stream at activation
full-help | Provide help to unprivileged user
help | Description of the interactive help system
history | Enable and control the command history function
hold-character | Define the hold character
insecure | Mark line as 'insecure' for LAT
international | Enable international 8-bit character support
ip | IP options
length | Set number of lines on a screen
location | Enter terminal location description
lockable | Allow users to lock a line
logging | Modify message logging facilities
login | Enable password checking
logout-warning | Set Warning countdown for absolute timeout of line
modem | Configure the Modem Control Lines
monitor | Copy debug output to the current terminal line
motd-banner | Enable the display of the MOTD banner
no | Negate a command or set its defaults
notify | Inform users of output from concurrent sessions
padding | Set padding for a specified output character
parity | Set terminal parity
password | Set a password
private | Configuration options that user can set will remain in effect between terminal sessions
privilege | Change privilege level for line
refuse-message | Define a refuse banner
rotary | Add line to a rotary group
rxspeed | Set the receive speed
script | specify event related chat scripts to run on the line
session-disconnect-warning | Set warning countdown for session-timeout
session-limit | Set maximum number of sessions
session-timeout | Set interval for closing connection when there is no input traffic
special-character-bits | Size of the escape (and other special) characters
speed | Set the transmit and receive speeds
start-character | Define the start character
stop-character | Define the stop character
stopbits | Set async line stop bits
telnet | Telnet protocol-specific configuration
terminal-type | Set the terminal type
timeout | Timeouts for the line
transport | Define transport protocols for line
txspeed | Set the transmit speeds
vacant-message | Define a vacant banner
width | Set width of the display terminal
x25 | X25 protocol-specific configuration


Previleged EXEC Command

Command | Description
access-enable | Create a temporary Access-List entry
access-profile | Apply user-profile to interface
access-template | Create a temporary Access-List entry
bfe | For manual emergency modes setting
cd | Change current directory
clear | Reset functions
clock | Manage the system clock
configure | Enter configuration mode
connect | Open a terminal connection
copy | Copy from one file to another
debug | Debugging functions (see also 'undebug')
delete | Delete a file
dir | List files on a filesystem
disable | Turn off privileged commands
disconnect | Disconnect an existing network connection
enable | Turn on privileged commands
erase | Erase a filesystem
exit | Exit from the EXEC
help | Description of the interactive help system
lock | Lock the terminal
login | Log in as a particular user
logout | Exit from the EXEC
more | Display the contents of a file
name-connection | Name an existing network connection
no | Disable debugging functions
pad | Open a X.29 PAD connection
ping | Send echo messages
ppp | Start IETF Point-to-Point Protocol (PPP)
pwd | Display current working directory
reload | Halt and perform a cold restart
resume | Resume an active network connection
rlogin | Open an rlogin connection
rsh | Execute a remote command
send | Send a message to other tty lines
set | Set system parameter (not config)
setup | Run the SETUP command facility
show | Show running system information
slip | Start Serial-line IP (SLIP)
start-chat | Start a chat-script on a line
systat | Display information about terminal lines
telnet | Open a telnet connection
terminal | Set terminal line parameters
test | Test subsystems, memory, and interfaces
traceroute | Trace route to destination
tunnel | Open a tunnel connection
undebug | Disable debugging functions (see also 'debug')
verify | Verify a file
where | List active connections
write | Write running configuration to memory, network, or terminal
x28 | Become an X.28 PAD
x3 | Set X.3 parameters on PAD


User EXEC Command

Command | Description
access-enable | Create a temporary Access-List entry
access-profile | Apply user-profile to interface
clear | Reset functions
connect | Open a terminal connection
disable | Turn off privileged commands
disconnect | Disconnect an existing network connection
enable | Turn on privileged commands
exit | Exit from the EXEC
help | Description of the interactive help system
lock | Lock the terminal
login | Log in as a particular user
logout | Exit from the EXEC
name-connection | Name an existing network connection
pad | Open a X.29 PAD connection
ping | Send echo messages
ppp | Start IETF Point-to-Point Protocol (PPP)
resume | Resume an active network connection
rlogin | Open an rlogin connection
set | Set system parameter (not config)
show | Show running system information
slip | Start Serial-line IP (SLIP)
systat | Display information about terminal lines
telnet | Open a telnet connection
terminal | Set terminal line parameters
traceroute | Trace route to destination
tunnel | Open a tunnel connection
where | List active connections
x28 | Become an X.28 PAD
x3 | Set X.3 parameters on PAD