Configuring Password on Cisco Router

There are mainly three types of passwords that can be set on cisco routers.
To see the lines available in a cisco router we can use the following command.

sandesh#show line
   Tty Line Typ     Tx/Rx    A Roty AccO AccI   Uses   Noise  Overruns   Int
*    0    0 CTY              -    -    -    -      0       0     0/0       -
     1    1 AUX   9600/9600  -    -    -    -      0       0     0/0       -
   322  322 VTY              -    -    -    -      0       0     0/0       -
   323  323 VTY              -    -    -    -      0       0     0/0       -
   324  324 VTY              -    -    -    -      0       0     0/0       -
   325  325 VTY              -    -    -    -      0       0     0/0       -
   326  326 VTY              -    -    -    -      0       0     0/0       -
   327  327 VTY              -    -    -    -      0       0     0/0       -
   328  328 VTY              -    -    -    -      0       0     0/0       -
   329  329 VTY              -    -    -    -      0       0     0/0       -
   330  330 VTY              -    -    -    -      0       0     0/0       -
   331  331 VTY              -    -    -    -      0       0     0/0       -
   332  332 VTY              -    -    -    -      0       0     0/0       -
   333  333 VTY              -    -    -    -      0       0     0/0       -
   334  334 VTY              -    -    -    -      0       0     0/0       -
   335  335 VTY              -    -    -    -      0       0     0/0       -
   336  336 VTY              -    -    -    -      0       0     0/0       -
   337  337 VTY              -    -    -    -      0       0     0/0       -

The router I am using has an auxiliary port, a console port and 16 vty lines. Following are the passwords that can be set for these lines.

1. Auxiliary Password:
      This password is set for the auxiliary port of router which is located at the back of the router. The purpose of an auxiliary port is to connect an external modem to the router. This modem can be used to connect to the router for troubleshooting purposes should regular connectivity fail. Similary to console port, auxiliary port is also an asynchronous serial port with an RJ-45 interface. A rollover cable is used for connections.

CLI Commands for configuration:

Router(config)#line aux 0
Router(config-line)#password auxiliary
Router(config-line)#login

2. Console Password: 
        Router console ports are meant to allow root access to the router via a dumb terminal interface, regardless of the state of the router (unless it is completely dead). By connecting to the console port you can get remote access to the root level of a router without using the network that the router is connected to. This creates a secondary path to the router outside the bandwidth of the network which needs to be secured without relying on the primary network. A rollover cable is used for connections.

More info about physical connection here : https://www.youtube.com/watch?v=_xA94N__uzk

CLI Commands for configuration:

Router(config)#line aux 0
Router(config-line)#password console
Router(config-line)#login

3. VTY Password:
        This is used in vty lines. Whenever, there is a request to connect to these vty lines, the router ass for a password. A number of protocols can be used to connect to these vty lines. For eg: telnet and ssh. The protocols allowed depends on the cisco router series.

CLI Commands for configuration:

The simplese command include the following.

Router(config)#line vty 0 4
Router(config-line)#password remote
Router(config-line)#login

These commands set password for telnet access. When we try to telnet to the management ip of the router, the router asks for the password.
Eg: C:> telnet 8.8.8.8
       Password:
Configuration to ask for username in telnet access:
Now, if we want the router to ask for the username as well, we need to use the following commands.

Router(config)#username cisco password cisco
Router(config)#line vty 0 4
Router(config-line)#login local

The command login local forces the router to ask for username.

SSH Protocol configuration for VTY lines:

We can also configure to use ssh protocol for remote connections as telnet is not secure. Telnet uses plain-text to transport data to and from the router.

Step 1: Configure the domain name:

Router(config)#ip domain-name sandeshshrestha,net

Step 2: Generate RSA key

Router(config)#crypto key generate rsa
% Please define a hostname other than Router.
Router(config)#hostname sandesh
sandesh(config)#crypto key generate rsa
The name for the keys will be: sandesh.sandeshshrestha.net
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 510
% Generating 510 bit RSA keys, keys will be non-exportable...[OK]
sandesh(config)#
*Mar 1 2:53:22.782:  RSA key size needs to be at least 768 bits for ssh version 2
*Mar 1 2:53:22.782:  %SSH-5-ENABLED: SSH 1.5 has been enabled

Two interesting thing to note here:

1. It asks for a hostname other than Router.
2. The ssh verion enabled is 1.5 but there is not 1.5 version for ssh. This basically means that version 2 is not being used here. Instead its version 1. To configure version 2 of ssh, use the following command. Also, note that the rsa key should be at least 768 bits for version 2.

sandesh(config)#ip ssh version 2
Please create RSA keys (of at least 768 bits size) to enable SSH v2.

For reason mentioned above, it gives the error.

Step 3: Configure vty line

Router(config)#line vty 0 4
Router(config-line)#transport input ssh telnet  (allows both ssh and telnet)
Router(config-line)#password ssh
Router(config-line)#login local

Step4: Connect
To connect to vty line in router using ssh we do the following:

C:>ssh cisco@8.8.8.8
Password:

VTP Basics

VLAN Trunking Protocol(VTP) allows switches to share VLAN information automatically. Thus an administrator only need to change VLAN on one switch which will be propagated to all switches. However, this does not reduce the need to assign switchports to different VLANs.

A VTP domain can only support 255 vlans. A switch is enabled in server mode by default. VTP advertisements are sent every 5 minutes by default or when there is a change in configuration revision number caused by addition or deletion of vlans.

VTP Modes:

Server Mode - In VTP server mode you can create, modify and delete vlans. VLAN information is synchronized with other VTP servers and clients on the VTP domain. You can have multiple VTP servers in the VTP domain and VLAN information is synchronized according to the server with the highest configuration revision number. VLAN information is stored in the the vlan.dat file in NVRAM/Flash memory.

Client Mode - Switches in VTP client mode receive and synchronize VLAN database information from other VTP servers and VTP clients in the VTP domain. A VTP client can update a VTP server if it has a higher configuration revision number. VLAN information is stored in the "Running-Config" or DRAM. If a switch in client mode is restarted then all VLAN information, including the VTP revision number on the switch is lost and must be relearned from the VTP server once the client has restarted.

Transparent Mode - Switches in transparent mode receive updates from other servers and clients but do not participate in the VTP Domain, rather they allow the VTP updates and advertisements, to pass through the switch on to other switches in the VTP domain. Transparent mode switches do not synchronize their VLAN information with other VTP servers and clients, but maintain their own separate VLAN configurations.


VTP Configuration Commands:


This command shows the vtp status like vtp version, configuration revision number, number of vlans, etc.

Switch# show vtp status

This configures the domain name of vtp. There can be more than one domain in a topology. VTP does not work across domains i.e. if the client is in a different domain than server, it does not learn about vlan from the server.

Switch(config)# vtp domain
Changing VTP domain name from NULL to


Switch(config)# vtp mode

To make two switches talk to one another, the ports connecting them should be in trunk mode. Either of the ports can be configured to trunk mode and the other will be automatically be in trunk mode as the ports are in dynamic-auto mode.

Switch(config)#int fa0/1
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport  trunk allowed vlan 1-99

Now go to the other switch and configure vtp client mode using the vtp domain and vtp mode command.

How to clear switch for new configuration

1. Connect to the console port and enter priviliged EXEC mode.

From your computer terminal connect to the console port of the switch using a console cable. You should see the console prompt that includes the switch's hostname followed by > or #.

If the prompt ends in > you are in user mode. To enter priviliged EXEC mode, type enable.

2. Delete the VLAN database file.

Switch#delete flash:vlan.dat
Delete flash vlan.dat ? [confirm]
Switch#

3. Erase the start-up config from nvram


The startup configuration of switches can be removed using the erase-start up config command.

Switch# erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue?
[confirm]
[OK]
Erase of nvram: complete
Switch#
Switch# reload