Understanding the config
There was this config in my show run config in Cisco 2900 series router.
Is this config the reason i had to restart the biometric devices every single time. Could you please help me understand this config. Help.
1 Answer 1
None of those commands should have any effect on your networks.
The ip forward-protocol nd command simply means that the router will forward ND packets for diskless workstations. This is rather obsolete.
The ip http commands are for the HTTP server in the router itself. It is a way to configure the router with HTTP, and it means nothing to anything else connected to the router.
Сброс пароля и базовая настройка Cisco 1941
Бывает так, что приходится сталкиваться с задачами, к решению которых ты вроде бы и не готов, а получить результат надо здесь и сейчас. Знакомо, да? Добро пожаловать в мир восточноевропейского менеджмента с соответствующей культурой управления.
Итак, допустим, ты представитель местечкового провайдера, уже знающий, как настроить какой-нибудь ASUS, но волею судьбы ещё не получивший сертификат CCNA. Рядом с тобой стоит местный админ, тоже без сертификата, глазами молящий ничего не «сбрасывать в ноль», ибо «всё работает, я просто не знаю пароль, только вы никому не говорите».
Подобные ситуации не редкость в наше ковидном мире, когда отделы со своей инфраструктурой тасуюся ежеквартально, директора направлений таинственно исчезают, а очередной управленец, дабы продемонстрировать собственную эффективность, ссорится с единственным цискарём в округе и заключает договора обслуживания при помощи сайта объявлений.
Проведём же вместе сеанс чёрной айтишной магии с последующим её разоблачением. А именно : сбросим пароль, настроим интерфейсы (локальный и внешний), соединим эти сети маршрутами и трансляцией адресов и прикроем(нет) фаерволом. Кирпич с фирменным шильдиком волшебным образом превратится в полезное сетевое устройство.
Устройство и нужные нам интерфейсы
Вот она, наша девочка. Как опытные ребята, подходим с правильной стороны:
Нас интересует её правая часть, где все порты. Голубым помечены консольные, жёлтым — Ethernet
Если подключаться в Ethernet порты, которые жёлтые, то нужно знать IP адреса на этих интерфейсах и пароли на вход — основной и «повышенный» (под которым, собственно и надо всё настраивать). Если чего-то из этого нет, то добро пожаловать в консоль. Её порты помечены нежно-голубым цветом. Такой же цвет у фирменного консольного кабеля Cisco, который обычно к этому времени потерялся.
Кабель «специальный» Cisco. Распайки есть везде.
По нынешним временам COM-порт есть далеко не в каждом ноуте, поэтому придётся к этому шнурку брать стандартный COM-USB переходник. Но можно присмотреться и увидеть, что рядом со «старым» консольным портом есть mini-usb порт с тем же назначением. Переходник в данном случае встроен в циску, и, да, на него нужны драйвера. Устанавливаем их, ребутимся и подключаемся снова. После подключения Cisco через кабель miniusb в списке оборудования в разделе Порты (COM и LPT) появился Cisco Serial (COM14) (не обязательно именно 14, ну что поделать). Для дальнейшей работы рекомендую терминальную программку Putty, ибо в ней есть всё, что необходимо, и она проста, как полено. На сегодня нам от неё нужно будет подключение по интерфейсу Serial (Com14) и впоследствии Telnet (TCP23).
Сбрасываем пароли
Включаем циску и подключаемся в Putty к порту Serial (название COM14, Baud Rate 9600). Убеждаемся, что коннект есть. Далее надо перезагрузить маршрутизатор в ROMMON – начальный загрузчик – совсем урезанную версию операционной системы, которая загружается до cisco IOS и используется для сервисных целей (обновление IOS, восстановление пароля). Чтобы перезагрузить маршрутизатор в ROMMON, нужно прервать обычный процесс загрузки в IOS – для этого в самом начале загрузки надо отправить сигнал прерывания.
Выключаем, и не разрывая консольный сеанс, Включаем Cisco 1941 и нажимаем клавишу Break (она же клавиша Pause) или комбинацию Ctrl+Break на клавиатуре (если в ноуте этого нет, в Putty по правой кнопке мыши можно вызвать special command – break). Полная таблица с сигналами прерывания для разных терминалов находится здесь.
Видим приглашение в режим rommon (ROM monitor) :
Вводим команду изменения конфигурации регистра командой confreg и после перезапускаем роутер командой reset
rommon 1 > confreg 0x2142
rommon 2 > reset
Повышаем привилегии командой enable или просто en И пароль она тут не просит 🙂
Копируем «запароленный» конфиг в память роутера:
Router1#copy startup-config running-config
После этого применится старый конфиг, который был запаролен, но при этом мы уже находимся в привилегированном режиме, откуда можем выставить новые пароли для привилегированного режима, telnet и консоли.
Router1(config)#enable secret $$$NewPassword
Router1(config)#enable password $$$NewPassword
Router1(config)#line vty 0 4
Router1(config)#line console 0
Главное, в конце не забыть вернуть значения регистров по умолчанию. Если этого не сделать, то наш новый конфиг снова будет проигнорирован после перезагрузки роутера.
Router1(config)# config-register 0x2102
Копируем загруженный конфиг в стартовый и перезагружаемся:
Router1# copy running-config startup-config
Роутер теперь с новым паролем для консоли, телнета и привилегированного режима. Ура. Можно отдать циску просиявшему админу вместе с настройками «нового интернета» (мы же от провайдера приехали, помните?). Если во взгляде местного системного администратора затаились нерешительность и страх, то поможем бедолаге.
Настройка интерфейсов
Чтоб два раза не приезжать, пробежимся по всем нужным настройкам «чтоб взлетело». У циски два «жёлтых» интерфейса: GigabitEthernet0/0 и GigabitEthernet0/1. Обычно они должны смотреть в сторону WAN и LAN соответственно, да будет так.
Адресация в WAN, допустим 100.200.100.202/30 со шлюзом провайдера 100.200.100.201
Адресация в LAN, как водится, 192.168.1.1/24 с локальным интерфейсом циски 192.168.1.1
Всё делаем из под рута:
Для конфигурации используем команду configure terminal, для выхода — exit:
Настраиваем локальный интерфейс:
#ip address 192.168.1.1 255.255.255.0
Настраиваем DHCP (на всю подсеть кроме .1-.50 и .200-.254).
#ip dhcp excluded-address 192.168.1.200 192.168.1.254
#ip dhcp excluded-address 192.168.1.1 192.168.1.50
#ip dhcp ping packets 4
#ip dhcp pool MY_DHCP_POOL_1
#network 192.168.1.0 255.255.255.0
Всё, после этой настройки можно подключаться телнетом из локалки при желании (удобно для проверок)
При подключении должен примениться адрес из DHCP пула и пинговаться циска. Советую запустить ping -t чтоб мониторить на всякий случай.
Настраиваем внешний интерфейс:
#ip address 100.200.100.202 255.255.255.252
Тут должен начать пинговаться шлюз прова — 100.200.100.201 — но только от самой циски, не с ноута (между сетями-то пакеты пока не ходят)
#ip forward-protocol nd
#ip route 0.0.0.0 0.0.0.0 100.200.100.201
Тут от самой циски должен начать пинговаться 8.8.8.8
#ip domain timeout 2
#ip name-server 8.8.8.8
#ip name-server 77.88.8.8
Тут от самой циски должен начать пинговаться ya.ru
#copy running-config startup-config (или просто #wr )
В итоге мы настроили на циске две сети, в которых она будет жить и трудиться. Далее надо будет их соединить.
Его величество межсетевой экран
Собственно, его величество фаер. В ипостасях NAT и списков доступа (ACL)
Тут много построено на этих самых списках, ссылки на них вбиваются как в правила интерфейсов (access-group), так и в правилах NAT, поэтому заносить надо аккуратно. Списки работают строго сверху вниз. Поэтому правила для any обычно последние (и они не нужны — по дефолту для any всё запрещено). Список доступа может быть стандантным (access-list standard) , либо расширенным (access-list extended). Отличаются детализацией — у стандартного только действие и источник пакетов, например.
Настройка NAT
Собираем локальную область для маскарадинга (да, я знаю, что это термин для iptables, но суть та же):
#ip access-list standard 10
#permit 192.168.1.0 0.0.0.255
Назначаем стороны маскарадинга (интерфейсы):
Cамое важное: включаем собственно правило (одной строкой):
#ip nat inside source list 10 interface gigabitethernet0/0 overload
Закрываемся от атаки по TCPSYN:
#ip tcp synwait-time 30
Настраиваем список доступа – для внешнего интерфейса (если настроить для внутреннего, то нужны разрешения для dhcp трафика). Первым делом закроем единственный сетевой доступ — телнет (tcp 23). Если подняты http(s) или ssh – тоже закрыть
Пишем список (особое внимание – протоколу icmp)
#ip access-list extended 101
#deny tcp any any eq 23
#permit tcp any any
#permit udp any any
#permit icmp any any echo-reply
#permit icmp any any time-exceeded
#permit icmp any any unreachable
#deny ip any any
Вешаем список на вход во внешний интерфейс:
#ip access-group 101 in
#copy running-config startup-config (или просто #wr )
Так то список только базовую «защиту» обеспечивает, но это головная боль админа уже. После поднятия всех сервисов и их проверки, можно написать построже и применить.
У нас пингуется всё изнутри и циска снаружи. Интернет работает, почта ходит. Все счастливы, танцуют, обнимаются, деньги в карманы засовывают. Твой социальный рейтинг растёт на глазах.
P.S. Полезные команды
Почти весь мониторинг — это команда show. У неё есть короткая форма sh , которую я не рекомендую, ибо такая же короткая форма есть у команды shutdown
Собственно, включение чего-либо, например, интерфейса выглядит вот так:
Выведем на почитать/скопировать весь конфиг:
Можно посмотреть возможности команды show:
Просмотр сводной информации по интерфейсам:
#show ip interface brief
Просмотр информации по интерфейсам L2:
#show interface summary
Просмотр адресов, выданных по DHCP:
#show ip dhcp bind
Удаление строк конфига:
#no [строка конфига]
Например, удалим шлюз по умолчанию:
#no ip default-gateway
Удаляем ВЕСЬ список доступа:
#no ip access-list extended 101
Удаление статического маршрута:
#no ip route [маршрут]
Что-ж для первого визита вполне достаточно. При помощи этой нехитрой магии ты заведёшь себе много друзей, юный падаван 🙂 И не забудь предупредить местного админа о том, что если он как следует не настроит ACL, их сетку могут в скором времени ждать крупные неприятности. Но это уже совсем другая история.
У нас быстрые серверы для любых экспериментов.
Зарегистрируйтесь по ссылке выше или кликнув на баннер и получите 10% скидку на первый месяц аренды сервера любой конфигурации!
Ip forward protocol nd что за команда
Кабель «специальный» Cisco. Распайки есть везде.
rommon 1 > confreg 0x2142
rommon 2 > reset
Router1#copy startup-config running-config
Router1(config)#enable secret $$$NewPassword
Router1(config)#enable password $$$NewPassword
Router1(config)#line vty 0 4
Router1(config)#line console 0
Router1(config)# config-register 0x2102
Router1# copy running-config startup-config
#ip address 192.168.1.1 255.255.255.0
#ip dhcp excluded-address 192.168.1.200 192.168.1.254
#ip dhcp excluded-address 192.168.1.1 192.168.1.50
#ip dhcp ping packets 4
#ip dhcp pool MY_DHCP_POOL_1
#network 192.168.1.0 255.255.255.0
#ip address 100.200.100.202 255.255.255.252
#ip forward-protocol nd
#ip route 0.0.0.0 0.0.0.0 100.200.100.201
#ip domain timeout 2
#ip name-server 8.8.8.8
#ip name-server 77.88.8.8
#ip access-list standard 10
#permit 192.168.1.0 0.0.0.255
#ip nat inside source list 10 interface gigabitethernet0/0 overload
#ip tcp synwait-time 30
#ip access-list extended 101
#deny tcp any any eq 23
#permit tcp any any
#permit udp any any
#permit icmp any any echo-reply
#permit icmp any any time-exceeded
#permit icmp any any unreachable
#deny ip any any
#ip access-group 101 in
#show ip interface brief
#show interface summary
#show ip dhcp bind
#no ip default-gateway
#no ip access-list extended 101
Cisco router первичная настройка
Router#erase startup-config
Router#reload
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname Gw0
Gw0(config)#
Gw0(config)#service password-encryption
Gw0(config)#no ip http server
Gw0(config)#no ip http secure-server
Gw0(config)#no cdp run
Gw0(config)#line con 0
Gw0(config-line)#login
Gw0(config-line)#exit
Gw0(config-line)#login
Gw0(config-line)#exit
Gw0(config) #interface Gi 0/0
Gw0(config-if)#ip address 192.168.0.1 255.255.255.0
Gw0(config-if)#description LAN
Gw0(config-if)#no shutdown
Gw0(config-if)#exit
Gw0(config)# ip name-server 192.168.0.2
Gw0>enable
Gw0#clock set 20:10:00 23 May 2012
Gw0#configure terminal
Gw0# ip domain name iamroot.ru
Gw0(config)# crypto key generate rsa
Gw0(config)# username user privilege 15 secret пароль
Gw0(config)# aaa new-model
Gw0(config)#line vty 0 1441
Gw0(config-line)# transport input ssh
Gw0(config-line)# logging synchronous
Gw0(config-line)#exec-timeout 30 0
Gw0# wr
Gw0#copy running-config startup-config
Gw0#copy run start
Gw0#wr
Gw0#copy run tftp://192.168.0.100
Address or name of remote host [192.168.0.100]? [enter]
Destination filename [router-confg]? [enter]
Gw0#copy run flash:
Gw0#copy flash: run
Gw0# wr
Gw0(config) #interface Gi 0/1
Gw0(config-if)#ip address 89.80.80.80 255.255.255.248
Gw0(config-if)#description WAN
Gw0(config-if)#no shutdown
Gw0(config-if)#exit
Gw0(config)#ip forward-protocol nd
Gw0(config)#ip route 0.0.0.0 0.0.0.0 89.80.80.80
Gw0(config)#ip cef
Gw0(config)#no ipv6 cef
Gw0(config)#interface Gi0/1
Gw0(config-if)#ip nat outside
Gw0(config)#interface Gi0/2
Gw0(config-if)#ip nat inside
Gw0(config)#ip access-list extended NAT
Gw0(config-ext-nacl)#permit ip 192.168.0.0 0.0.0.255 any
Gw0(config)#ip nat inside source list NAT interface Gi0/1 overload
Gw0#conf t
Gw0#(dhcp-config)#ip dhcp pool LAN
Gw0#(dhcp-config)#network 192.168.0.0 255.255.255.0
Gw0#(dhcp-config)#dns-server 192.168.0.1
Gw0#(dhcp-config)#default-router 192.168.0.1
Gw0#(dhcp-config)#lease 7
Gw0#(dhcp-config)#exit
Gw0(config)#ip dhcp excluded-address 192.168.0.1 192.168.0.100
Gw0(config)#ip dhcp excluded-address 192.168.0.200 192.168.0.254
Gw0(config)#ip domain name iamroot.ru
Gw0(config)#ip name-server xxx.xxx.xxx.xxx
Gw0(config)#ip name-server yyy.yyy.yyy.yyy
Gw0(config)#ip domain-lookup
Gw0(config)#ip dns server
Gw0(config)#exit
Gw0#write
vpn#show processes cpu | include PPP
138 0 3 0 0.00% 0.00% 0.00% 0 PPP SIP
139 0 5 0 0.00% 0.00% 0.00% 0 PPP Bind
140 4 10 400 0.00% 0.00% 0.00% 0 PPP IP Route
189 0 2 0 0.00% 0.00% 0.00% 0 PPP Compress Inp
190 0 2 0 0.00% 0.00% 0.00% 0 PPP Compress Res
207 0 2 0 0.00% 0.00% 0.00% 0 PPP NBF
376 11940 4395282 2 0.07% 0.07% 0.07% 0 PPP manager
377 8332 4395327 1 0.07% 0.04% 0.05% 0 PPP Events
378 204 141170 1 0.00% 0.00% 0.00% 0 Multilink PPP
vpn# sh ip int br | tee tftp://192.168.0.1/bri.txt
vpn# sh ip int br | append tftp://192.168.0.1/bri.txt
router# sh ip nat translations
router# sh ip nat statistics
router# debug ip nat
router# show ip dhcp binding
router# show ip dhcp conflict
router# show ip dhcp server statistics
router# clear ip dhcp binding [ip-address]
Настройка Cisco Configuration Professional
Router(config)# line vty 0 4
Router(config-line)# privilege level 15
Router(config-line)# login local
Router(config-line)# transport input telnet
Router(config-line)# transport input telnet ssh
Router(config)# ip http server
Router(config)# ip http secure-server
Router(config)# ip http authentication local
Router(config)# username <username> privilege 15 password 0 <password>
Cisco IOS IP Application Services Command Reference
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Book Title
Cisco IOS IP Application Services Command Reference
ip accounting through ip sctp authenticate
View with Adobe Reader on a variety of devices
Results
Chapter: ip accounting through ip sctp authenticate
ip accounting through ip sctp authenticate
ip accounting
To enable IP accounting on an interface, use the ip accounting command in interface configuration mode. To disable IP accounting, use the no form of this command.
ip accounting [ access-violations ] [ output-packets ]
no ip accounting [ access-violations ] [ output-packets ]
Syntax Description
(Optional) Enables IP accounting with the ability to identify IP traffic that fails IP access lists.
(Optional) Enables IP accounting based on the IP packets output on the interface.
Command Default
IP accounting is disabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
This command was introduced.
The access-violations keyword was added.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
The ip accounting command records the number of bytes (IP header and data) and packets switched through the system on a source and destination IP address basis. Only transit IP traffic is measured and only on an outbound basis; traffic generated by the router access server or terminating in this device is not included in the accounting statistics.
If you specify the access-violations keyword, the ip accounting command provides information identifying IP traffic that fails IP access lists. Identifying IP source addresses that violate IP access lists alerts you to possible attempts to breach security. The data might also indicate that you should verify IP access list configurations.
To receive a logging message on the console when an extended access list entry denies a packet access (to log violations), you must include the log keyword in the access-list (IP extended) or access-list (IP standard) command.
Statistics are accurate even if IP fast switching or IP access lists are being used on the interface. If the access-violations keyword is specified and any IP access list is being used on an interface, then only process switching can generate accurate statistics (IP fast switching or CEF cannot).
IP accounting disables autonomous switching, SSE switching, and distributed switching (dCEF) on the interface. IP accounting will cause packets to be switched on the Route Switch Processor (RSP) instead of the Versatile Interface Processor (VIP), which can cause performance degradation.
Examples
The following example enables IP accounting on Ethernet interface 0:
Related Commands
access-list (IP extended)
Defines an extended IP access list.
access-list (IP standard)
Defines a standard IP access list.
clear ip accounting
Clears the active or checkpointed database when IP accounting is enabled.
Defines filters to control the hosts for which IP accounting information is kept.
Sets the maximum number of accounting entries to be created.
Controls the number of transit records that are stored in the IP accounting database.
show ip accounting
Displays the active accounting or checkpointed database or displays access list violations.
ip accounting-list
To define filters to control the hosts for which IP accounting information is kept, use the ip accounting-list command in global configuration mode. To remove a filter definition, use the no form of this command.
ip accounting-list ip-address wildcard
no ip accounting-list ip-address wildcard
Syntax Description
IP address in dotted decimal format.
Wildcard bits to be applied to the ip-address argument.
Command Default
No filters are defined.
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
The wildcard argument is a 32-bit quantity written in dotted-decimal format. Address bits corresponding to wildcard bits set to 1 are ignored in comparisons; address bits corresponding to wildcard bits set to zero are used in comparisons.
Examples
The following example adds all hosts with IP addresses beginning with 192.31 to the list of hosts for which accounting information will be kept:
Related Commands
clear ip accounting
Clears the active or checkpointed database when IP accounting is enabled.
Enables IP accounting on an interface.
Sets the maximum number of accounting entries to be created.
Controls the number of transit records that are stored in the IP accounting database.
show ip accounting
Displays the active accounting or checkpointed database or displays access list violations.
ip accounting mac-address
To enable IP accounting on a LAN interface based on the source and destination Media Access Control (MAC) address, use the ip accounting mac-address command in interface configuration mode. To disable IP accounting based on the source and destination MAC address, use the no form of this command.
ip accounting mac-address
no ip accounting mac-address
Syntax Description
Performs accounting based on the source MAC address on received packets.
Performs accounting based on the destination MAC address on transmitted packets.
Command Default
IP accounting is disabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
This command was integrated into Cisco IOS Release 12.2(33)SCB.
Usage Guidelines
This feature is supported on Ethernet, Fast Ethernet, and FDDI interfaces.
To display the MAC accounting information, use the show interface mac EXEC command.
MAC address accounting provides accounting information for IP traffic based on the source and destination MAC address on LAN interfaces. This calculates the total packet and byte counts for a LAN interface that receives or sends IP packets to or from a unique MAC address. It also records a timestamp for the last packet received or sent. With MAC address accounting, you can determine how much traffic is being sent to and/or received from various peers at NAPS/peering points.
Examples
The following example enables IP accounting based on the source and destination MAC address for received and transmitted packets:
Examples
The following example enables IP accounting based on the source MAC address for received packets on a Gigabit Ethernet interface:
Related Commands
show interface mac
Displays MAC accounting information for interfaces configured for MAC accounting.
ip accounting precedence
To enable IP accounting on any interface based on IP precedence, use the ip accounting precedence command in interface configuration mode. To disable IP accounting based on IP precedence, use the no form of this command.
ip accounting precedence
no ip accounting precedence
Syntax Description
Performs accounting based on IP precedence on received packets.
Performs accounting based on IP precedence on transmitted packets.
Command Default
IP accounting is not enabled.
Command Modes
Interface configuration (config-if)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
To display IP precedence accounting information, use the show interface precedence EXEC command.
The precedence accounting feature provides accounting information for IP traffic, summarized by IP precedence values. This feature calculates the total packet and byte counts for an interface that receives or sends IP packets and sorts the results based on IP precedence. This feature is supported on all interfaces and subinterfaces and supports Cisco Express Forwarding (CEF), dCEF, flow, and optimum switching.
Examples
The following example enables IP accounting based on IP precedence for received and transmitted packets:
Related Commands
show interface precedence
Displays precedence accounting information for an interface configured for precedence accounting.
ip accounting-threshold
To set the maximum number of accounting entries to be created, use the ip accounting-threshold command in global configuration mode. To restore the default number of entries, use the no form of this command.
ip accounting-threshold threshold
no ip accounting-threshold threshold
Syntax Description
Maximum number of entries (source and destination address pairs) that the Cisco IOS software accumulates.
Command Default
The default maximum number of accounting entries is 512 entries.
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
The accounting threshold defines the maximum number of entries (source and destination address pairs) that the software accumulates, preventing IP accounting from possibly consuming all available free memory. This level of memory consumption could occur in a router that is switching traffic for many hosts. Overflows will be recorded; see the monitoring commands for display formats.
The default accounting threshold of 512 entries results in a maximum table size of 12,928 bytes. Active and checkpointed tables can reach this size independently.
Examples
The following example sets the IP accounting threshold to 500 entries:
Related Commands
clear ip accounting
Clears the active or checkpointed database when IP accounting is enabled.
Enables IP accounting on an interface.
Defines filters to control the hosts for which IP accounting information is kept.
Controls the number of transit records that are stored in the IP accounting database.
show ip accounting
Displays the active accounting or checkpointed database or displays access list violations.
ip accounting-transits
To control the number of transit records that are stored in the IP accounting database, use the ip accounting-transits command in global configuration mode. To return to the default number of records, use the no form of this command.
ip accounting-transits count
no ip accounting-transits
Syntax Description
Number of transit records to store in the IP accounting database.
Command Default
The default number of transit records that are stored in the IP accounting database is 0.
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Transit entries are those that do not match any of the filters specified by ip accounting-list global configuration commands. If no filters are defined, no transit entries are possible.
To maintain accurate accounting totals, the Cisco IOS software maintains two accounting databases: an active and a checkpointed database.
Examples
The following example specifies that no more than 100 transit records are stored:
Related Commands
clear ip accounting
Clears the active or checkpointed database when IP accounting is enabled.
Enables IP accounting on an interface.
Defines filters to control the hosts for which IP accounting information is kept.
Sets the maximum number of accounting entries to be created.
show ip accounting
Displays the active accounting or checkpointed database or displays access list violations.
ip broadcast-address
To define a broadcast address for an interface, use the ip broadcast-address interface configuration command. To restore the default IP broadcast address, use the no form of this command.
ip broadcast-address [ip-address]
no ip broadcast-address [ip-address]
Syntax Description
(Optional) IP broadcast address for a network.
Command Default
Default address: 255.255.255.255 (all ones)
Command Modes
Interface configuration (config-if)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Examples
The following example specifies an IP broadcast address of 0.0.0.0:
ip casa
To configure the router to function as a forwarding agent, use the ip casa command in global configuration mode. To disable the forwarding agent, use the no form of this command.
ip casa control-address igmp-address [udp-limit]
Syntax Description
IP address of the forwarding agent side of the services manager and forwarding agent tunnel used for sending signals. This address is unique for each forwarding agent.
Interior Gateway Management Protocol (IGMP) address on which the forwarding agent will listen for wildcard and fixed affinities.
(Optional) Maximum User Datagram Protocol (UDP) queue length; valid values are from 50 to 65535. The default is 256.
Command Default
No default behavior or values.
Command Modes
Global configuration (config)
Command History
This command was introduced.
Support for this command was added for Catalyst 6500 series switches.
The udp-limit argument was added.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
Usage Guidelines
If more than the maximum udp-limit value arrives in a burst, the Cisco Appliance Services Architecture (CASA) wildcard updates from the service manager might get dropped.
The control-address value is unique for each forwarding agent.
Examples
The following example specifies the Internet address (10.10.4.1) and IGMP address (224.0.1.2) for the forwarding agent and sets the UDP queue length to 300:
Related Commands
Specifies the port on which the forwarding agent will listen for wildcard and fixed affinities.
ip cef traffic-statistics
To change the time interval that controls when Next Hop Resolution Protocol (NHRP) sets up or tears down a switched virtual circuit (SVC), use the ip cef traffic-statistics command in global configuration mode. To restore the default values, use the no form of this command.
ip cef traffic-statistics [ load-interval seconds ] [ update-rate seconds ]
no ip cef traffic-statistics
Syntax Description
(Optional) Length of time (in 30-second increments) during which the average trigger-threshold and teardown-threshold intervals are calculated before an SVC setup or teardown action is taken. (These thresholds are configured in the ip nhrp trigger-svc command.) The load-interval range is from 30 seconds to 300 seconds, in 30-second increments. The default value is 30 seconds.
(Optional) Frequency that the port adapter sends the accounting statistics to the Route Processor (RP). When the route processor is using NHRP in distributed Cisco Express Forwarding switching mode, this value must be set to 5 seconds. The default value is 10 seconds.
Command Default
Load interval: 30 seconds Update rate: 10 seconds
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
The ip nhrp trigger-svc command sets the threshold by which NHRP sets up and tears down a connection. The threshold is the Cisco Express Forwarding traffic load statistics. The thresholds in the ip nhrp trigger-svc command are measured during a sampling interval of 30 seconds, by default. To change that interval over which that threshold is determined, use the load-interval seconds option of the ip cef traffic-statistics command.
When NHRP is configured on a Cisco Express Forwarding switching node with a Versatile Interface Processor (VIP2) adapter, you must make sure the update-rate keyword is set to 5 seconds.
Other Cisco IOS features could also use the ip cef traffic-statistics command; this NHRP feature relies on it.
Examples
In the following example, the triggering and teardown thresholds are calculated based on an average over 120 seconds:
Related Commands
ip nhrp trigger-svc
Configures when NHRP will set up and tear down an SVC based on aggregate traffic rates.
ip directed-broadcast
To enable the translation of a directed broadcast to physical broadcasts, use the ip directed-broadcast interface configuration command. To disable this function, use the no form of this command.
ip directed-broadcast [ access-list-number | extended access-list-number ]
no ip directed-broadcast [ access-list-number | extended access-list-number ]
Syntax Description
(Optional) Standard access list number in the range from 1 to 199. If specified, a broadcast must pass the access list to be forwarded.
(Optional) Extended access list number in the range from 1300 to 2699.
Command Default
Disabled; all IP directed broadcasts are dropped.
Command Modes
Interface configuration (config-if)
Command History
This command was introduced.
The default behavior changed to directed broadcasts being dropped.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Cisco IOS XE 3.3SE
This command was implemented in Cisco IOS XE Release 3.3SE.
Usage Guidelines
An IP directed broadcast is an IP packet whose destination address is a valid broadcast address for some IP subnet, but which originates from a node that is not itself part of that destination subnet.
A router that is not directly connected to its destination subnet forwards an IP directed broadcast in the same way it would forward unicast IP packets destined to a host on that subnet. When a directed broadcast packet reaches a router that is directly connected to its destination subnet, that packet is “exploded” as a broadcast on the destination subnet. The destination address in the IP header of the packet is rewritten to the configured IP broadcast address for the subnet, and the packet is sent as a link-layer broadcast.
The ip directed-broadcast command controls the explosion of directed broadcasts when they reach their target subnets. The command affects only the final transmission of the directed broadcast on its ultimate destination subnet. It does not affect the transit unicast routing of IP directed broadcasts.
If directed broadcast is enabled for an interface, incoming IP packets whose addresses identify them as directed broadcasts intended for the subnet to which that interface is attached will be exploded as broadcasts on that subnet. If an access list has been configured with the ip directed-broadcast command, only directed broadcasts that are permitted by the access list in question will be forwarded; all other directed broadcasts destined for the interface subnet will be dropped.
If the no ip directed-broadcast command has been configured for an interface, directed broadcasts destined for the subnet to which that interface is attached will be dropped, rather than being broadcast.
Because directed broadcasts, and particularly Internet Control Message Protocol (ICMP) directed broadcasts, have been abused by malicious persons, we recommend that security-conscious users disable the ip directed-broadcast command on any interface where directed broadcasts are not needed and that they use access lists to limit the number of exploded packets.
Examples
The following example enables forwarding of IP directed broadcasts on Ethernet interface 0:
Related Commands
Specifies which protocols and ports the router forwards when forwarding broadcast packets.
ip forward-protocol
To specify which protocols and ports the router forwards when forwarding broadcast packets, use the ip forward-protocol command in global configuration mode. To remove a protocol or port, use the no form of this command.
no ip forward-protocol
Syntax Description
Forwards User Datagram Protocol (UDP) packets. See the “Usage Guidelines” section for a list of port numbers forwarded by default.
(Optional) Destination port that controls which UDP services are forwarded.
Forwards Network Disk (ND) packets. This protocol is used by older diskless Sun workstations.
Secure Data Network Service.
Command Default
Router forwarding is enabled.
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Enabling a helper address or UDP flooding on an interface causes the Cisco IOS software to forward particular broadcast packets. You can use the ip forward-protocol command to specify exactly which types of broadcast packets you would like to have forwarded. A number of commonly forwarded applications are enabled by default. Enabling forwarding for some ports [for example, Routing Information Protocol (RIP)] may be hazardous to your network.
If you use the ip forward-protocol command, specifying only UDP without the port enables forwarding and flooding on the default ports.
One common application that requires helper addresses is Dynamic Host Configuration Protocol (DHCP). DHCP is defined in RFC 1531. DHCP protocol information is carried inside of BOOTP packets. To enable BOOTP broadcast forwarding for a set of clients, configure a helper address on the router interface closest to the client. The helper address should specify the address of the DHCP server. If you have multiple servers, you can configure one helper address for each server. Because BOOTP packets are forwarded by default, DHCP information can now be forwarded by the software. The DHCP server now receives broadcasts from the DHCP clients.
If an IP helper address is defined, UDP forwarding is enabled on default ports. If UDP flooding is configured, UDP flooding is enabled on the default ports.
If a helper address is specified and UDP forwarding is enabled, broadcast packets destined to the following port numbers are forwarded by default:
Trivial File Transfer Protocol (TFTP) (port 69)
Domain Naming System (port 53)
Time service (port 37)
NetBIOS Name Server (port 137)
NetBIOS Datagram Server (port 138)
Boot Protocol (BOOTP) client and server packets (ports 67 and 68)
TACACS service (port 49)
IEN-116 Name Service (port 42)
If UDP port 68 is used as the destination port number, it is not forwarded by default.
Examples
The following example defines a helper address and uses the ip forward-protocol command. Using the udp keyword without specifying any port numbers will allow forwarding of UDP packets on the default ports.
ip forward-protocol spanning-tree
To permit IP broadcasts to be flooded throughout the internetwork in a controlled fashion, use the ip forward-protocol spanning-tree command in global configuration mode. To disable the flooding of IP broadcasts, use the no form of this command.
ip forward-protocol spanning-tree [ any-local-broadcast ]
no ip forward-protocol spanning-tree [ any-local-broadcast ]
Syntax Description
(Optional) Accept any local broadcast when flooding.
Command Default
IP broadcast flooding is disabled.
Command Modes
Global configuration (config)
Command History
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
A packet must meet the following criteria to be considered for flooding:
The MAC address of the received frame must be all-ones broadcast address (ffff.ffff.ffff).
The IP destination address must be one of the following: all-ones broadcast (255.255.255.255), subnet broadcast for the receiving interface; major-net broadcast for the receiving interface if the no ip classless command is also configured; or any local IP broadcast address if the ip forward-protocol spanning-tree any-local-broadcast command is configured.
The IP time-to-live (TTL) value must be at least 2.
The IP protocol must be User Datagram Protocol (UDP) (17).
The UDP destination port must be TFTP, Domain Name System (DNS), Time, NetBIOS, ND, or BOOTP packet, or a UDP port specified by the ip forward-protocol udp command.
A flooded UDP datagram is given the destination address specified by the ip broadcast-address command on the output interface. The destination address can be set to any desired address. Thus, the destination address may change as the datagram propagates through the network. The source address is never changed. The TTL value is decremented.
After a decision has been made to send the datagram out on an interface (and the destination address possibly changed), the datagram is handed to the normal IP output routines and is therefore subject to access lists, if they are present on the output interface.
The ip forward-protocol spanning-tree command uses the database created by the bridging Spanning-Tree Protocol. Therefore, the transparent bridging option must be in the routing software, and bridging must be configured on each interface that is to participate in the flooding in order to support this capability.
If an interface does not have bridging configured, it still will be able to receive broadcasts, but it will never forward broadcasts received on that interface. Also, it will never use that interface to send broadcasts received on a different interface.
If no actual bridging is desired, you can configure a type-code bridging filter that will deny all packet types from being bridged. Refer to the Cisco IOS Bridging and IBM Networking Configuration Guide for more information about using access lists to filter bridged traffic. The spanning-tree database is still available to the IP forwarding code to use for the flooding.
The spanning-tree-based flooding mechanism forwards packets whose contents are all ones (255.255.255.255), all zeros (0.0.0.0), and, if subnetting is enabled, all networks (10.108.255.255 as an example in the network number 10.108.0.0). This mechanism also forward packets whose contents are the zeros version of the all-networks broadcast when subnetting is enabled (for example, 10.108.0.0).
This command is an extension of the ip helper-address command, in that the same packets that may be subject to the helper address and forwarded to a single network can now be flooded. Only one copy of the packet will be put on each network segment.
Examples
The following example permits IP broadcasts to be flooded through the internetwork in a controlled fashion: