Cisco IOS Command Tips and Tricks - Part 2

Cisco IOS command list is getting longer , and it has been split into two posts:

• Cisco IOS Command Tips and Tricks – Part 1
• Cisco IOS Command Tips and Tricks – Part 2

1. Auto secure

Cisco also provides a One-step lockdown-like feature at the command line! This feature is called AutoSecure. It uses the command shown below:

auto secure [management | forwarding] [no-interact | full] [ntp | login | ssh | firewall | tcp-intercept]

2. Change Site-to-Site VPN Idle time out to 5 minutes

For IOS Router

R1(config)#crypto ipsec security-association idle-time 300

For ASA

ASA1(config)#group-policy GP_1.1.1.2 attributes ASA1(config-group-policy)#vpn-idle-timeout 300 ASA1(config-group-policy)#vpn-session-timeout none

3. Find Cisco Devices Serial Number
Usually we could use 'show version' command to find out SN , but for Nexus you will have to use 'show inventory' to get Chassis SN

Nexus1# show inventory NAME: "Chassis", DESCR: "Nexus5548 Chassis" PID: N5K-C5548UP       , VID: V01 , SN: SSI163604J NAME: "Module 1", DESCR: "O2 32X10GE/Modular Universal Platform Supervisor" PID: N5K-C5548UP       , VID: V01 , SN: FOC1645D5F NAME: "Fan 1", DESCR: "Chassis fan module" PID: N5548P-FAN        , VID: N/A , SN: N/A NAME: "Fan 2", DESCR: "Chassis fan module" PID: N5548P-FAN        , VID: N/A , SN: N/A NAME: "Power supply 1", DESCR: "AC power supply" PID: N55-PAC-750W      , VID: V02 , SN: ART16310D6 NAME: "Power supply 2", DESCR: "AC power supply" PID: N55-PAC-750W      , VID: V02 , SN: ART16310SQ NAME: "Module 3", DESCR: "O2 Daughter Card with L3 ASIC" PID: N55-D160L3-V2     , VID: V01 , SN: FOC1637NT8 NAME: "FEX 101 CHASSIS", DESCR: "N2K-C2248TP-1GE  CHASSIS" PID: N2K-C2248TP-1GE   , VID: V03 , SN: SSI1637FHK NAME: "FEX 101 Module 1", DESCR: "Fabric Extender Module: 48x1GE, 4x10GE Supervi sor" PID: N2K-C2248TP-1GE   , VID: V03 , SN: FOC1645WH9 NAME: "FEX 101 Fan 1", DESCR: "Fabric Extender Fan module" PID: N2K-C2248-FAN     , VID: N/A , SN: N/A NAME: "FEX 101 Power Supply 1", DESCR: "Fabric Extender AC power supply" PID: N2200-PAC-400W    , VID: V04 , SN: LIT16390H9 NAME: "FEX 101 Power Supply 2", DESCR: "Fabric Extender AC power supply" PID: N2200-PAC-400W    , VID: V04 , SN: LIT16390HH NAME: "FEX 102 CHASSIS", DESCR: "N2K-C2248TP-1GE  CHASSIS" PID: N2K-C2248TP-1GE   , VID: V03 , SN: SSI16390DJ

4. Show Commands Information

Show Version / Show Flash / Show Interfaces

Show processes CPU / Show memory / Show stacks / Show buffers

Show running-config / Show startup-config

Flash: IOS
RAM: All tables and configuration when router is running. Info will be lost when power off.
ROM: POST, Bootstrap, Mini-IOS
NVRAM:Startup-config


5. SYSLOG Writing to Local Disk or Flash Card

Router(config)# logging persistent url disk0:/syslog size 134217728 filesize 16384         %Warning: the ratio between logging persistent size and logging persistent filesize is 134217728/16384, suggested ratio is less than 196 in order to achieve good system performace Router(config)# logging persistent url disk0:/syslog size 134217728 filesize 1342177   Router#sh log  Syslog logging: enabled (0 messages dropped, 9 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator.     Console logging: disabled     Monitor logging: level debugging, 0 messages logged, xml disabled,                      filtering disabled     Buffer logging:  level debugging, 8665 messages logged, xml disabled,                     filtering disabled     Exception Logging: size (4096 bytes)     Count and timestamp logging messages: disabled     Persistent logging: enabled, url disk0:/syslog, disk space 134217728 bytes, file size 1342177 bytes, batch size 4096 bytes No active filter modules.     Trap logging: level debugging, 8669 message lines logged         Logging to 10.2.2.3  (udp port 514, audit disabled,               link up),               8668 message lines logged,                0 message lines rate-limited,                0 message lines dropped-by-MD,                xml disabled, sequence number disabled               filtering disabled         Logging Source-Interface:       VRF Name:         Loopback0                        Log Buffer (8192 bytes): 12 EST: %C7600_PLATFORM-SP-3-LOW_BATT: Low Voltage detected for NVRAM Battery ........[Omitted] Router# copy disk0:/syslog ftp://myuser:[email protected]/syslog

6. Check Routers Power Supply Status

Router#show environment  SYSTEM POWER SUPPLY STATUS ==========================  Internal Power Supply 1 Type: AC  Internal Power Supply 1 12V Output Status: Normal  Internal Power Supply 2 Type: AC  Internal Power Supply 2 12V Output Status: Fail SYSTEM FAN STATUS =================  Fan 1 OK, Low speed setting  Fan 2 OK, Low speed setting  Fan 3 OK, Low speed setting  Fan 4 OK, Low speed setting  Fan 5 OK, Low speed setting SYSTEM TEMPERATURE STATUS =========================  Intake Left temperature: 25 Celsius, Normal  Intake Right temperature: 22 Celsius, Normal  Exhaust Right temperature: 29 Celsius, Normal  Exhaust Left temperature: 31 Celsius, Normal  CPU temperature: 24 Celsius, Normal  Power Supply Unit 1 temperature: 24 Celsius, Normal            REAL TIME CLOCK BATTERY STATUS ==============================  Battery OK (checked at power up) CPU CORE TEMPERATURE STATUS ===========================   CPU Core current reading, target = 24, reading = 62 : Normal   CPU Core out of target history in past 1045868.0 mins:      Consecutive out-of-range mins high water mark: 0.0      Total minutes out-of-range: 0.0      Last 5 minutes out-of-range: 0.0      Last 5 minutes consecutive out-of-range: 0.0      Last 5 minutes read failure count: 0 SYSTEM WATTAGE ===============  Motherboard, EHWIC, PVDM, Power Supply and Fan Power consumption = 123.1 W  Total System Power consumption is: 123.1 W  Environmental information last updated 00:00:11 ago

7. Portchannel Adding vlan without downtime

For trunk links, it is best to take out portfast and bpduguard from interface configuration.

no spanning-tree portfast
no spanning-tree bpduguard enable

Always add or remove VLANs from the port-channel interface since the individual physical links will inherit the VLAN set automatically.  If added a VLAN to a phyiscal  layer2 interface instead of the logical layer2 port-channel, it will bring the etherchannel down.

For example, to add vlan 50 to etherchannel 3:

conf t
interface port-channel 3
switchport trunk allowed vlan add 50
end

show run interface gi0/3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 2-49
switchport mode trunk
channel-group 3 mode on

The last line "channel-group 1 mode on" indicates that this port is part of etherchannel 3.  If you try to add a VLAN 50 to the etherchannel by  adding the VLAN 50 to the physical port g0/3, this port will be removed from  the etherchannel 3 and this will cause spanning tree to throw a wobbly.


8. Cisco Switch Lights Meaning

SYSTEM(SYST) Light

Overall status of the switch.

• Off: Switch is not powered on
• Green: Switch is working fine
• Amber: Switch is powered on but faulty

REDUNDANT POWER SUPPLY(RPS) Light

Provides backup power to the switch if the main supply goes off.

• Off: No RPS available,
• Green: RPS is working fine
• Blinking Green: Providing backup to some other device
• Amber: RPS is faulty
• Flashing Amber: RPS is providing backup(primary power off)

DUPLEX
Duplex status of the switch ports.

• Off: Switch port is half duplex
• Green: Switch port is full duplex

UTIL
Utilization status of the switch ports.

SPEED
Speed status of the switch ports.

• Off: Switch port is operating at 10Mbps
• Green: Switch port is operating at 100Mbps
• Flashing green: Switch port is operating at 1000Mbps

STAT
Status of the switch ports.

• Off: No device connected/port is administratively down.
• Green: Device is connected.
• Blinking green: Port is sending/receiving data.
• Alternating green amber: Fault in link/Frames experiencing error
• Amber: Port is blocked by Spanning Tree Protocol

9. Log Cisco Device Configuration Change 

9.1 Cisco Switches and Routers Commands:

enable
configure terminal
archive
log config
logging enable
logging size 200
hidekeys
notify syslog
end

Output from command 'show log':

000430: *Mar  9 22:28:47.046 EST: %SYS-5-CONFIG_I: Configured from console by john on vty0 (192.168.0.176)
000431: *Mar  9 22:29:49.936 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:archive
000432: *Mar  9 22:29:52.738 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:log config
000433: *Mar  9 22:29:56.966 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:logging enable
000434: *Mar  9 22:30:04.188 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:logging size 200
000435: *Mar  9 22:30:10.832 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:hidekeys
000436: *Mar  9 22:30:15.035 EST: %PARSER-5-CFGLOG_LOGGEDCMD: User:john  logged command:notify syslog
000437: *Mar  9 22:30:22.727 EST: %SYS-5-CONFIG_I: Configured from console by john on vty0 (192.168.0.176)

9.2 Cisco ASA

The syslog number 111008 and 111010 will log the command that is entered by user. 111010 is for configuration changes.Here is the syslog for your information:

111008: Message: %ASA-5-111008: User user executed the command string
Explanation: The user entered any command, with the exception of a show command.
https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html?bookSearch=true#con_8587071

111010: Message: %ASA-5-111010: User username , running application-name from IP ip addr , executed cmd
Explanation: A user made a configuration change.

• username —The user making the configuration change
• application-name —The application that the user is running
• ip addr —The IP address of the management station
• cmd —The command that the user has executed

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html?bookSearch=true#con_8586950

You need to enable syslog, and severity level 5, and if you don't want to see any other logging, you can only log the above 2 syslog numbers.

Also rather than send level 5 messages, it sends level 3 messages.

logging list notif-cfg-changes message 111008-111010
logging list notif-cfg-changes level errors
logging trap notif-cfg-changes

Note: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_syslog.html#wp1064820