Chapter 2: Configuring a Network Operating System

Home routers are actually four devices in one:

Router - Forwards data packets to and receives data packets from the Internet
Switch - Connects end devices using network cables
Wireless access point - Consists of a radio transmitter capable of connecting end
devices wirelessly
Firewall appliance - Secures outgoing traffic and restricts incoming traffic

The operating system on a network device is known as a network operating system.

The Cisco Internetwork Operating System (IOS) is a generic term for the collection of network
operating systems used on Cisco networking devices.
CISCO IOS
When a computer is powered on, it loads the OS, normally from a disk drive, into RAM. The
portion of the OS code that interacts directly with the computer hardware is known as the
kernel. The portion that interfaces with the applications and user is known as the shell. The
user can interact with the shell using either the command-line interface (CLI) or graphical
user interface (GUI).
When using the CLI, the user interacts directly with the system in a text-based environment
by entering commands on the keyboard at a command prompt. The system executes the
command, often providing textual output. The GUI interface allows the user to interact with
the system in an environment that uses graphical images, multimedia, and text. Actions are
performed by interacting with the images on screen. GUI is more user friendly and requires
less knowledge of the command structure to utilize the system. For this reason, many
individuals rely on the GUI environments. Many operating systems offer both GUI and CLI.
The operating system on home routers is usually called firmware. The most common method
for configuring a home router is using a web browser to access an easy to use GUI. Most home
routers enable the update of the firmware as new features or security vulnerabilities are
discovered.
The network operating system used on Cisco devices is called the Cisco Internetwork
Operating System (IOS).
The IOS file itself is several megabytes in size and is stored in a semi-permanent memory area
called flash. Flash memory provides non-volatile storage. This means that the contents of the
memory are not lost when the device loses power. Although the contents of flash are not lost
during a loss of power, they can be changed or overwritten if needed.
In many Cisco devices, the IOS is copied from flash into random access memory (RAM) when
the device is powered on. The IOS then runs from RAM when the device is operating. RAM has
many functions including storing data that is used by the device to support network
operations. Running the IOS in RAM increases performance of the device, however, RAM is
considered volatile memory because data is lost during a power cycle. A power cycle is when
a device is purposely or accidently powered off and then powered back on.
Major functions performed or enabled by Cisco routers and switches include:

Providing network security

IP addressing of virtual and physical interfaces
Enabling interface-specific configurations to optimize connectivity of the respective
media
Routing
Enabling quality of service (QoS) technologies
Supporting network management technologies

ACCESSING A CISCO IOS DEVICE

There are several ways to access the CLI environment. The most common methods are:

Console
Telnet or SSH
AUX port

The console port can be used when the networking services have failed and remote access of
the Cisco IOS device is not possible.
Telnet
Telnet is a method for remotely establishing a CLI session of a device, through a virtual
interface, over a network. Unlike the console connection, Telnet sessions require active
networking services on the device. The network device must have at least one active
interface configured with an Internet address, such as an IPv4 address. Cisco IOS devices
include a Telnet server process that allows users to enter configuration commands from a
Telnet client. In addition to supporting the Telnet server process, the Cisco IOS device also
contains a Telnet client. This allows a network administrator to telnet from the Cisco device
CLI to any other device that supports a Telnet server process.
SSH
The Secure Shell (SSH) protocol provides a remote login similar to Telnet, except that it uses
more secure network services. SSH provides stronger password authentication than Telnet and
uses encryption when transporting session data. This keeps the user ID, password, and the
details of the management session private. As a best practice, use SSH instead of Telnet
whenever possible.
Most versions of Cisco IOS include an SSH server. In some devices, this service is enabled by
default. Other devices require the SSH server to be enabled manually. IOS devices also include
an SSH client that can be used to establish SSH sessions with other devices.
AUX
An older way to establish a CLI session remotely is via a telephone dialup connection using a
modem connected to the auxiliary (AUX) port of a router, which is highlighted in the figure.
Similar to the console connection, the AUX method is also an out-of-band connection and does
not require any networking services to be configured or available on the device. In the event
that network services have failed, it may be possible for a remote administrator to access the
switch or router over a telephone line.
The AUX port can also be used locally, like the console port, with a direct connection to a
computer running a terminal emulation program. However, the console port is preferred over
the AUX port for troubleshooting because it displays startup, debugging, and error messages
by default.
Note: Cisco Catalyst switches do not support an auxiliary connection.
There are a number of excellent terminal emulation programs available for connecting to a
networking device either by a serial connection over a console port or by a Telnet/SSH
connection. Some of these include:

PuTTY (Figure 1)

Tera Term (Figure 2)

SecureCRT (Figure 3)
HyperTerminal
OS X Terminal

NAVIGATING THE IOS

The CLI uses a hierarchical structure for
the modes.
In hierarchical order from most basic to
most specialized, the major modes are:

User executive (User EXEC)

mode
Privileged executive (Privileged
EXEC) mode
Global configuration mode
Other specific configuration
modes, such as interface
configuration mode

The user EXEC mode allows only a limited number of basic monitoring commands. This is
often referred to as view-only mode. The user EXEC level does not allow the execution of any
commands that might change the configuration of the device. Switch>
The privileged EXEC mode. Switch#
Global Configuration Mode. Switch# configure terminal. Switch(config)#. From global
configuration mode, CLI configuration changes are made that affect the operation of the
device as a whole.

Interface mode - to configure one of the network interfaces (Fa0/0, S0/0/0)

Line mode - to configure one of the physical or virtual lines (console, AUX, VTY)

Moving Between the User EXEC and Privileged EXEC Modes. Switch> enable.
Switch# disable
Moving from and to Global Configuration Mode and Submodes. Exit. Ctrl+Z.
immediate submode Switch(config-if)#, without having to exit line configuration mode.
THE COMMAND STRUCTURE. THE COMMAND REFERENCE.
BASIC IOS COMMAND STRUCTURE

A command might require one or more arguments. Unlike a keyword, an argument is

generally not a predefined word. An argument is a value or variable defined by the user.

Common characteristics are:

Syntax - the most detailed version of the syntax for a command that can be found

Default - the manner in which the command is implemented on a device with a default
configuration

Mode - the configuration mode on the device where the command is entered

History - descriptions of how the command is implemented relative to the IOS version

Usage Guidelines - guidelines describing specifically how to implement the command

Examples - useful examples that illustrate common scenarios that use the command

The IOS generally only provides negative feedback, as shown in Figure 1. If the interpreter
understands the command, the requested action is executed and the CLI returns to the
appropriate prompt.
Hot Keys and Shortcuts

Down Arrow - Allows the user to scroll forward through former commands

Up Arrow - Allows the user to scroll backward through former commands

Tab - Completes the remainder of a partially typed command or keyword

Ctrl-A - Moves to the beginning of the line

Ctrl-E - Moves to the end of the line

Ctrl-R - Redisplays a line

Ctrl-Z - Exits the configuration mode and returns to privileged EXEC mode

Ctrl-C - Exits the configuration mode or aborts the current command

Ctrl-Shift-6 - Allows the user to interrupt an IOS process such as ping or traceroute

Abbreviated commands or keywords

Commands and keywords can be abbreviated to the minimum number of characters that identify a unique selection.
For example, the configure command can be abbreviated to conf because configure is the only command that
begins with conf. An abbreviation of con will not work because more than one command begins with con.

The basic examination command is the show command.

Switch# show version

Software version - IOS software version (stored in flash)

Bootstrap version - Bootstrap version (stored in Boot ROM)
System up-time - Time since last reboot
System restart info - Method of restart (e.g., power cycle, crash)
Software image name - IOS filename stored in flash
Router type and processor type - Model number and processor type
Memory type and allocation (shared/main) - Main Processor RAM and Shared
Packet I/O buffering
Software features - Supported protocols/feature sets
Hardware interfaces - Interfaces available on the device
Configuration register - Sets bootup specifications, console speed setting, and
related parameters

HOSTNAMES
Hostnames are configured on the active networking device. If the device name is not explicitly
configured, a factory-assigned default device name is used by Cisco IOS. The default name for
a Cisco IOS switch is "Switch."
Some guidelines for naming conventions are that names should:

Start with a letter

Contain no spaces
End with a letter or digit
Use only letters, digits, and dashes
Be less than 64 characters in length

The hostnames used in the device IOS preserve capitalization and lowercase characters.
Therefore, it allows you to capitalize a name as you ordinarily would. This contrasts with most
Internet naming schemes, where uppercase and lowercase characters are treated identically.
Hostnames allow devices to be identified by network administrators over a network or the
Internet.

Switch(config)# hostname Sw-Floor-1

Sw-Floor-1 (config)# no hostname

LIMITING ACCESS TO DEVICE CONFIGURATIONS

Physically limiting access to network devices by placing them in closets and locked racks is
good practice; however, passwords are the primary defense against unauthorized access to
network devices.
The passwords introduced here are:

Enable password - Limits access to the privileged EXEC mode

Enable secret - Encrypted, limits access to the privileged EXEC mode
Console password - Limits device access using the console connection
VTY password - Limits device access over Telnet

Additionally, use strong passwords that are not easily guessed. The use of weak or easily
guessed passwords continues to be a security issue in many facets of the business world.
Consider these key points when choosing passwords:

Use passwords that are more than 8 characters in length.

Use a combination of upper and lowercase letters, numbers, special characters,
and/or numeric sequences in passwords.
Avoid using the same password for all devices.
Avoid using common words such as password or administrator, because these are
easily guessed.

Switch(config)# enable secret class

he enable secret command provides greater security because the password is encrypted.
The following commands are used in global configuration mode to set a password for the
console line:

Switch(config)# line console 0

Switch(config-line)# password cisco
Switch(config-line)# login

Example commands used to set a password on vty lines:

Switch(config)# line vty 0 15

Switch(config-line)# password cisco
Switch(config-line)# login

The syntax to configure a MOTD, from global configuration mode is:

Switch(config)# banner motd # message #

SAVING CONFIGURATIONS
After making changes to a running configuration file, consider these distinct options:

Return the device to its original configuration.

Remove all configurations from the device.
Make the changed configuration the new startup configuration.

The command to save the running configuration to startup configuration file is:
Switch# copy running-config startup-config

After being executed, the running configuration file updates the startup configuration file.
Switch# reload Reload saved startup-config
Switch# erase startup-config - The startup configuration is removed by using the erase
startup-config command
Backup Configurations with Text Capture
Configuration files can be saved and archived to a text document using Tera Term.
The steps are:

On the File menu, click Log.

Choose the location. Tera Term will begin capturing text.
After capture has been started, execute the show running-config or show
startup-config command at the privileged EXEC prompt. Text displayed in the
terminal window will be placed into the chosen file.
When the capture is complete, select Close in the Tera Term: Log window.
View the output to verify that it was not corrupted.

Restoring Text Configurations

A configuration file can be copied from storage to a device. When copied into the terminal, the
IOS executes each line of the configuration text as a command. The file will probably require
editing before copying. It is advisable to change the encrypted passwords to plain text and
remove the parameter, either the number 5 or 7, which specifies that the password is
encrypted. Non-command text such as "--More--" and IOS messages must be removed. This
process is discussed in the lab.
Further, at the CLI, the device must be set at the global configuration mode to receive the
commands from the text file being copied.
When using Tera Term, the steps are:

Edit text to remove non-commands and save.

On the File menu, click Send file.
Locate the file to be copied into the device and click Open.
Tera Term will paste the file into the device.

The text in the file will be applied as commands in the CLI and become the running
configuration on the device. This is a convenient method for manually configuring a device.
ADDRESS SCHEMES
Ports and Addresses
Network communications depend on end user device interfaces, networking device interfaces,
and the cables that connect them.
Some of the differences between various types of media include:

Distance the media can successfully carry a signal

Environment in which the media is to be installed
Amount of data and the speed at which it must be transmitted
Cost of the media and installation

Ethernet port, the cable must have the correct connector, an RJ-45
Cisco IOS switches have physical ports for devices to connect to, but also have one or more
switch virtual interfaces (SVIs). These are virtual interfaces, because there is no physical
hardware on the device associated with it; an SVI is created in software. The virtual interface
provides a means to remotely manage a switch over a network using IPv4. Each switch comes
with one SVI appearing in the default configuration "out-of-the-box." The default SVI is
interface VLAN1.

Addressing Devices
To access the switch remotely, an IP address and a subnet mask must be configured on the
SVI:

IP address - Together with subnet mask, uniquely identifies end device on the
internetwork

Subnet mask - Determines which part of a larger network is used by an IP address

he figure displays the command to enable IP connectivity to S1, using IP address

192.168.10.2:

interface vlan 1 - Used to navigate to the interface configuration mode from the
global configuration mode

ip address 192.168.10.2 255.255.255.0 - Configures the IP address and subnet

mask for the switch (this is just one of many possible combinations for an IP address
and subnet mask)

no shutdown - Administratively enables the interface to an active state

The switch will still need to have one or more physical ports configured, as well as the VTY
lines, to complete the configuration which enables remote management of the switch.
Practice configuring a switch virtual interface by entering commands in the figure.