Intro to CLI

Intro to CLI

• Command-line interface

• interface you use to configure Cisco devices

• there is also a GUI (not preferred)

How to connect to a Cisco device?

• when you first configure a device, you have to connect to the console port (eg: connecting a laptop to the console port, either RJ45 or USB mini-B port, of a Cisco catalyst switch)

• using a rollover cable - one end is RJ45 and the other end is DB9 connector (if the laptop does not have a serial port to plug the cable, use an adapter which has USB connector)

• connections inside rollover cable: 1<->8, 2<->7, 3<->6, 4<->5

Accessing the CLI

• using PuTTy (terminal emulator)

User EXEC mode

• also user mode

• default when entering CLI indicated by '>' sign next to host name of the device (like router)

• User EXEC mode is very limited

• can't make any changes to the configuration and we won't be doing anything in this mode

Privileged EXEC mode

• also called 'enable mode'

• Router>enable => Router#

• provides complete access to view the device's configuration, restart the device

• this is not the mode where you change the configuration, but you can change the time of the device, save current configuration file etc.

Features

• use '?' to view the commands available

• type 'en' and press 'tab' to complete the command

• type 'en' and press enter to directly enter into privileged exec mode, because there is only 1 command staritng with 'en' that can be entered in user exec mode.

• typing 'e' and pressing enter will return that it is an ambiguous command, beacuse there is more than 1 command starting with 'e'

• typing 'e?' displays the possible commands that begin with 'e'

Global configuration mode

• enter Privileged EXEC mode

• Router#configure terminal => Router(config)#

• shortest possible command for configure is 'conf' and for terminal is 't'

• Router#conf t => Router(config)#

Making changes to router's configuration

Changing hostname

• enter Global configuration mode

• Router(config)#hostname R1 => R1(config)#

enable password

• can protect [[#Privileged EXEC mode]] mode with a password, so that when entering 'enable' command from user exec mode, a password is asked

• passwords are case sensitive

• should be entered in Global configuration mode

• Router(config)#enable password CCNA

• the password does not display as you type it, for security purposes

• if you enter the wrong password 3 times, you will be denied access

Features

• Router(config)#enable pass? - shows all possible completions of the word (no space before ?)

• Router(config)#enable password ? - shows all possible options one could enter next in the command (space before ?)

• < cr > means there are no further options, enter the command

Configuration files

• there are 2 separate config files kept on the device at once.

• Running-config: the current, active config file on the device. as you enter commands in the CLI, you edit the active configuration

• Startup-config: the config file that will be loaded upon restart of the device. if you don't save the running-config before closing the device (router), you will lose the changes. you have to save them to the startup-config

• should be entered in Privileged exec mode

• Router#show running-config : displays 'enable password CCNA' at the begining of the output

• Router#show startup-config : displays 'not present', because we haven't saved the running-config yet

Saving the configuration

• 3 ways. all entered from privileged exec mode

• after this, 'show startup-config' command will display the same output as 'running-config'

• should also be entered in Privileged exec mode

1. Router#write

2. Router#write memory

3. Router#copy running-config startup-config

Service password encryption

• should be entered in Global configuration mode

• Router(config)#service password-encryption

• because password is displayed in plain text, it is a security risk, which will allow the person to enter privileged exec, global configuration mode and make changes to the device.

• this will encrypt all passwords in a jumble of numbers and letters.

• check by entering 'show running-config' command.

• displays: enable password 7 08027AJ6T

• number '7' indicates the type of encryption used. 7 -> Cisco's proprietary encryption algorithm.

• not very secure, can be cracked (Cisco type 7 password cracker)

enable secret

• Router(config)#enable secret Cisco (Cisco - password)

• check by entering '#do sh run' in global configuration mode.

• displays: enable secret 5 $ajkLsaj483hakhbHABbah

• number '5' indicates MD5 encryption

• much more secure, still can be cracked

Note

• if both 'enable secret' and 'enable password' commands are configured, only 'enable secret' will be valid and 'enable password' will become invalid

• 'service password-encryption' (used to encrypt 'enable password') has no effect on 'enable secret' command, which is always encrypted, whether you enter 'service password-encryption' or not.

• so always use 'enable secret'

Features

• Router(config)#do sh run

• to execute privileged exec mode commands like 'show running-config' in other configuration levels

Cancelling commands

• type 'no' in front of the command

• Router(config)#no service password-encryption

• future passwords will no longer be encrypted and will be in clear text

• passwords which are already encrypted will NOT be decrypted by disabling 'service password-encryption'

Review

Modes

• Router> user EXEC mode

• Router# privileged EXEC mode

• Router(config)# global configuration mode

Commands

• Router>enable to enter privileged EXEC mode

• Router#configure terminal to enter global configuration mode

• Router(config)#enable password password configures a password to protect privileged EXEC mode

• Router(config)#service password-encryption encrypts the enable password (and others)

• Router(config)#enable secret password configures a more secure, always encrypted password

• Router(config)#do privileged-exec-level-command executes a privileged-exec level command from global configuration mode

• Router(config)#no command removes the command

• Router#show running-config displays the current, active configuration file

• Router#show startup-config displays the saved configuration file which will be loaded if the device is restarted

• Router(config)#write saves the configuration

• Router(config)#write memory saves the configuration

• Router(config)#copy running-config startup-config saves the configuration