05.CCNA Command Reference

8/13/2019 05.CCNA Command Reference

1/25

CCNA Command Reference

Chris Bryant, CCIE #12933 - www.thebryantadvantage.com Back To Index

CCNA Command ReferenceOverview

All of these sections have "Hot Spots And Gotchas" sections at the end of theindividual chapters to read for additional review.

LAN Switching Commands (2950):

Show interface trunk

SW1#show interface trunk

Port Mode Encapsulation Status Native vlanFa0/11 desirable 802.1q trunking 1

Fa0/12 desirable 802.1q trunking 1

Port Vlans allowed on trunkFa0/11 1-4094Fa0/12 1-4094

Port Vlans allowed and active in management domainFa0/11 1Fa0/12 1

Port Vlans in spanning tree forwarding state and not prunedFa0/11 1Fa0/12 none

This command displays all ports that are actively trunking, their trunkingmode, the encapsulation type, and the native VLAN. It also displays theVLANs that are allowed to have traffic go across the trunk. CCNA

Switching

Frame Relay

Direct Serial Connections

Static And Distance Vector Routing

OSPF

EIGRP

ACLs, NAT, And Route Summarization

Passwords And DNS Behavior


2/25

candidates should note that this is the command that displays the trunkingprotocol in use either 802.1Q (dot1q) or ISL.

Show mac-address-table

SW1#show mac-address-table Mac Address Table-------------------------------------------Vlan Mac Address Type Ports---- ----------- -------- -----All 000f.90e2.25c0 STATIC CPUAll 0100.0ccc.cccc STATIC CPUAll 0100.0ccc.cccd STATIC CPUAll 0100.0cdd.dddd STATIC CPU 1 000b.be2c.518b DYNAMIC Fa0/11Total Mac Addresses for this criterion: 5

This command does just what it says; it shows you the MAC address tablethat the switch has built. Note the dashes that connect the three words.

Show spanning-tree vlan (VLAN_NUMBER)

SW2#show spanning-tree vlan 23

VLAN0023 Spanning tree enabled protocol ieee Root ID Priority 32791 Address 000b.be2c.5180 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32791 (priority 32768 sys-id-ext 23) Address 000b.be2c.5180 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15

Interface Role Sts Cost Prio.Nbr Type---------------- ---- --- --------- -------- --------------------------Fa0/3 Desg FWD 100 128.3 ShrFa0/11 Desg FWD 19 128.11 P2pFa0/12 Desg FWD 19 128.12 P2p

A vital LAN switching command, the command output shows if this deviceis the root bridge for this particular vlan (this bridge is the root), the hello,maxage, and forward delay values for this VLAN, and the status (sts) ofeach port. This will be listening, learning, forwarding, or blocking.

Show vlan brief

SW1#show vlan brief

VLAN Name Status Ports---- -------------------------------- --------- ---------------------------1 default active Fa0/1, Fa0/3, Fa0/4, Fa0/5 Fa0/6, Fa0/7, Fa0/8, Fa0/9


3/25

Fa0/1023 VLAN0023 active Fa0/21002 fddi-default act/unsup1003 token-ring-default act/unsup1004 fddinet-default act/unsup1005 trnet-default act/unsup

Quickly learn what ports are in what VLAN with this command. Note thedefault VLAN is VLAN 1, which is also the native VLAN.

Show vtp status

SW2#show vtp statusVTP Version : 2Configuration Revision : 2Maximum VLANs supported locally : 64Number of existing VLANs : 6VTP Operating Mode : ServerVTP Domain Name : CCNAVTP Pruning Mode : EnabledVTP V2 Mode : Disabled

VTP Traps Generation : DisabledMD5 digest : 0xE2 0xCC 0x1A 0xB8 0x8E 0x80 0x6F 0xF4Configuration last modified by 0.0.0.0 at 3-1-93 00:52:40Local updater ID is 0.0.0.0 (no valid interface found)

The main concerns here is that this is the command that shows you the VTPoperating mode of this device (server, client, or transparent), the VTP domainname, and whether pruning is enabled.

Spanning-tree vlan (VLAN_NUMBER) root primary

SW1#conf tEnter configuration commands, one per line. End with CNTL/Z.SW1(config)#spanning vlan 23 root primarySW1(config)#^ZSW1#show spanning vlan 23

VLAN0023 Spanning tree enabled protocol ieee Root ID Priority 20503 Address 000f.90e2.25c0 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

This one-line command can make a non-root bridge become the root

bridge. In this example, SW1 was configured with the command. WhereSW2 was the root bridge in the previous command example, SW1 is nowthe root bridge. Note the priority change from the default of 32768.

Vtp domainVtp passwordVtp pruning

SW1#conf tEnter configuration commands, one per line. End with CNTL/Z.SW1(config)#vtp domain CCNAChanging VTP domain name from NULL to CCNA

SW1(config)#vtp password CISCOSetting device VLAN database password to CISCOSW1(config)#vtp pruningPruning switched on


4/25

Setting the VTP domain name, password, and enabling pruning are donewith these three commands. Note that the VTP domain name changedfrom NULL in this example; this means that there was no previous VTPdomain membership, not that the previous VTP domain was actuallynamed NULL.

Frame Relay Commands:

Debug frame lmi

R1#debug frame lmiFrame Relay LMI debugging is onDisplaying all Frame Relay LMI dataR1#01:26:40: Serial0(out): StEnq, myseq 98, yourseen 97, DTE up

01:26:40: datagramstart = 0xE47328, datagramsize = 1301:26:40: FR encap = 0xFCF1030901:26:40: 00 75 01 01 01 03 02 62 6101:26:40:01:26:40: Serial0(in): Status, myseq 9801:26:40: RT IE 1, length 1, type 101:26:40: KA IE 3, length 2, yourseq 98, myseq 98R1#01:26:50: Serial0(out): StEnq, myseq 99, yourseen 98, DTE up01:26:50: datagramstart = 0xE476B8, datagramsize = 1301:26:50: FR encap = 0xFCF1030901:26:50: 00 75 01 01 01 03 02 63 6201:26:50:01:26:50: Serial0(in): Status, myseq 9901:26:50: RT IE 1, length 1, type 1

01:26:50: KA IE 3, length 2, yourseq 99, myseq 99R1#undebug allAll possible debugging has been turned off

Used to troubleshoot down frame relay connections, this debug showsyou whether the DTE is up or down, and also the sequence numbers ofthe incoming and outgoing LMI. When theyre equal or 1 apart, thatsgood; any more indicates why your frame relay is down in the first place an LMI mismatch.

Encapsulation frame-relay

R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#interface serial0R1(config-if)#encapsulation frame-relay

The first step in configuring frame relay is enabling it on the interface.This command changes the encapsulation type to frame relay from thedefault of HDLC.

Frame map ip

R1#conf tEnter configuration commands, one per line. End with CNTL/Z.


5/25

R1(config)#int s0R1(config-if)#encapsulation frame-relayR1(config-if)#frame map ip 172.12.123.2 122 broadcastR1(config-if)#frame map ip 172.12.123.3 123 broadcast

This command is used to create manual frame mappings, the preferredmethod in production networks. Frame relay must be configured first, asshown.

Note that the mapping is the remote IP address to the local DLCI. Also,since broadcasts are not sent across frame relay by default, the broadcastkeyword is needed to enable this.

No frame-relay inverse-arp

R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#interface serial0

R1(config-if)#encapsulation frame-relayR1(config-if)#no frame-relay inverse-arp

By default, frame relay will use Inverse ARP to dynamically create framemaps. Using InARP can lead to incomplete frame map tables, and manyproduction networks turn it off when using frame relay. You do so withthis command. Its generally done right after enabling frame-relay.

Show frame lmi

R1#show frame lmi

LMI Statistics for interface Serial0 (Frame Relay DTE) LMI TYPE = CISCO Invalid Unnumbered info 0 Invalid Prot Disc 0 Invalid dummy Call Ref 0 Invalid Msg Type 0 Invalid Status Message 0 Invalid Lock Shift 0 Invalid Information ID 0 Invalid Report IE Len 0 Invalid Report Request 0 Invalid Keep IE Len 0 Num Status Enq. Sent 167 Num Status msgs Rcvd 168 Num Update Status Rcvd 0 Num Status Timeouts 2

There are 12 fields here, but the ones to be most concerned about are thehighlighted ones. Here, 167 status messages have been sent, and 168received. These numbers should be no more than one apart, or the line

protocol is getting ready to drop. There were two timeouts earlier as well.

Bonus command: To set all your router counters back to zero, run thecommand clear counters.

R1#clear countersClear "show interface" counters on all interfaces [confirm]R1#show frame lmi

LMI Statistics for interface Serial0 (Frame Relay DTE) LMI TYPE = CISCO Invalid Unnumbered info 0 Invalid Prot Disc 0 Invalid dummy Call Ref 0 Invalid Msg Type 0 Invalid Status Message 0 Invalid Lock Shift 0 Invalid Information ID 0 Invalid Report IE Len 0 Invalid Report Request 0 Invalid Keep IE Len 0 Num Status Enq. Sent 0 Num Status msgs Rcvd 0 Num Update Status Rcvd 0 Num Status Timeouts 0


6/25

Show frame map

R1#show frame mapSerial0 (up): ip 172.12.123.2 dlci 122(0x7A,0x1CA0), static, broadcast,

CISCO, status defined, activeSerial0 (up): ip 172.12.123.3 dlci 123(0x7B,0x1CB0), static, broadcast, CISCO, status defined, active

This command will show you both your dynamically and staticallyconfigured frame maps and their status. It will also show whetherbroadcasts have been enabled for that mapping.

Show frame pvc

R1#show frame pvc

PVC Statistics for interface Serial0 (Frame Relay DTE)

Active Inactive Deleted Static Local 2 0 0 0 Switched 0 0 0 0 Unused 0 0 0 0

DLCI = 122, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0

input pkts 0 output pkts 0 in bytes 0 out bytes 0 dropped pkts 0 in pkts dropped 0 out pkts dropped 0 out bytes dropped 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0

out bcast pkts 0 out bcast bytes 0 pvc create time 01:40:05, last time pvc status changed 00:29:52

This command shows you how many PVCs you have on your router, theDLCIs in use, their status, and the interface theyre configured on.

It also shows your FECN, BECN, and DE statistics. You must know whatthese are before taking the CCNA exams. Check the Frame Relaysection of my Ultimate CCNA Study Guide for a refresher.

DIrect Serial Connection Commands

Clock rate

R3#conf tR3(config)#int s1R3(config-if)#ip address 172.12.13.2 255.255.255.252R3(config-if)#clock rate 56000R3(config-if)#no shut

01:47:59: %LINK-3-UPDOWN: Interface Serial1, changed state to upR3(config-if)#z01:48:00: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1, changedstate to up


7/25

Here, R3s S1 interface is directly connected to R1s S1 interface. R3sS1 interface is the DCE. When two Cisco routers are directly connectedby serial interface, the DCE must supply a clock rate to the DTE. Thiscommand is configured at the interface level. Once the clock rate isentered, the line protocol will come up. To see the other values for this

command, use IOS Help after the clock rate command.

Show controller serial

R1#show controller serial 1HD unit 1, idb = 0x1DBFEC, driver structure at 0x1E35D0buffer size 1524 HD unit 1, V.35 DTE cable

I truncated about 20 lines of hexadecimal information that this commandresults in, because the key information is in the second line. This

command tells you whether you have the DTE or DCE end of theDTE/DCE cable connected to this particular interface.

Debug ppp negotiation

R1#debug ppp negotiationPPP protocol negotiation debugging is onR1#ping 172.12.12.2

Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.12.12.2, timeout is 2 seconds:

02:12:01: %LINK-3-UPDOWN: Interface BRI0:1, changed state to up02:12:01: BR0:1 PPP: Using dialer call direction02:12:01: BR0:1 PPP: Treating connection as a callout02:12:01: BR0:1 PPP: Phase is ESTABLISHING, Active Open [0 sess, 0 load]02:12:01: BR0:1 LCP: O CONFREQ [Closed] id 1 len 1402:12:01: BR0:1 LCP: AuthProto PAP (0x0304C023)02:12:01: BR0:1 LCP: MagicNumber 0xE0974794 (0x0506E0974794)02:12:01: BR0:1 LCP: I CONFREQ [REQsent] id 1 len 1402:12:01: BR0:1 LCP: AuthProto PAP (0x0304C023)02:12:01: BR0:1 LCP: MagicNumber 0xE0973A66 (0x0506E0973A66)02:12:01: BR0:1 LCP: O CONFACK [REQsent] id 1 len 1402:12:01: BR0:1 LCP: AuthProto PAP (0x0304C023)02:12:01: BR0:1 LCP: MagicNumber 0xE0973A66 (0x0506E0973A66)02:12:01: BR0:1 LCP: I CONFACK [ACKsent] id 1 len 1402:12:01: BR0:1 LCP: AuthProto PAP (0x0304C023)02:12:01: BR0:1 LCP: MagicNumber 0xE0974794 (0x0506E0974794)02:12:01: BR0:1 LCP: State is Open02:12:01: BR0:1 PPP: Phase is AUTHENTICATING, by both [0 sess, 0 load]02:12:01: BR0:1 AUTH: Started process 0 pid 6602:12:01: BR0:1 PAP: O AUTH-REQ id 1 len 12 from "R1"02:12:01: BR0:1 PAP: I AUTH-ACK id 1 len 502:12:01: BR0:1 PAP: I AUTH-REQ id 1 len 12 from "R2"02:12:01: BR0:1 PAP: Authenticating peer R202:12:01: BR0:1 PAP: O AUTH-ACK id 1 len 502:12:01: BR0:1 PPP: Phase is UP [0 sess, 0 load]02:12:01: BR0:1 IPCP: O CONFREQ [Closed] id 1 len 1002:12:01: BR0:1 IPCP: Address 172.12.12.1 (0x0306AC0C0C01)02:12:01: BR0:1 CDPCP: O CONFREQ [Closed] id 1 len 402:12:01: BR0:1 IPCP: I CONFREQ [REQsent] id 1 len 1002:12:01: BR0:1 IPCP: Address 172.12.12.2 (0x0306AC0C0C02)02:12:01: BR0:1 IPCP: O CONFACK [REQsent] id 1 len 1002:12:01: BR0:1 IPCP: Address 172.12.12.2 (0x0306AC0C0C02)02:12:01: BR0:1 CDPCP: I CONFREQ [REQsent] id 1 len 4


8/25

02:12:01: BR0:1 CDPCP: O CONFACK [REQsent] id 1 len 402:12:01: BR0:1 IPCP: I CONFACK [ACKsent] id 1 len 1002:12:01: BR0:1 IPCP: Address 172.12.12.1 (0x0306AC0C0C01)02:1.!!!!Success rate is 80 percent (4/5), round-trip min/avg/max = 36/36/36 msR1#2:01: BR0:1 IPCP: State is Open02:12:01: BR0:1 CDPCP: I CONFACK [ACKsent] id 1 len 4

02:12:01: BR0:1 CDPCP: State is Open02:12:01: BR0 IPCP: Install route to 172.12.12.202:12:02: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changedstatto up

Speaking from experience, I can tell you that its easy to make an errorwhen configuring PPP password authentication, either PAP or CHAP. Anull space can make the entire process fail. Its kind of hard to spot a nullspace with the naked eye, but when theres a problem with PPP, thiscommand will point you in the right direction.

The output shown is a successful PAP authentication.

Encapsulation pppNo encapsulation ppp

R2#conf tR2(config)#interface bri0R2(config-if)#encapsulation ppp

The default encapsulation type of Serial interfaces is HDLC. Before you can enablePAP or CHAP authentication, you must enable PPP encapsulation with thiscommand. To revert to the default HDLC encapsulation, run no encapsulation ppp.

Static and Distance-Vector Commands:

Clear ip route *

R2#clear ip route *

This command clears your routing table of all non-static and non-connected routes. In a lab environment, its very handy; it forces yourrouters running routing protocols to send and request updates, rather thanwaiting for the regularly scheduled updates.

Debug ip packet

R2#debug ip packetIP packet debugging is onR2#ping 172.12.123.2

R2#ping 172.12.123.2

Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.12.123.2, timeout is 2 seconds:

06:10:04: IP: s=172.12.12.2 (local), d=172.12.123.2, len 100, unroutable.06:10:06: IP: s=172.12.12.2 (local), d=172.12.123.2, len 100, unroutable.


9/25

06:10:08: IP: s=172.12.12.2 (local), d=172.12.123.2, len 100, unroutable.06:10:10: IP: s=172.12.12.2 (local), d=172.12.123.2, len 100, unroutable.06:10:12: IP: s=172.12.12.2 (local), d=172.12.123.2, len 100, unroutable.Success rate is 0 percent (0/5)

If you have a problem sending a ping, this command will give you a goodidea where the problem is. Here, the message indicates that there is no

route to the destination.

Debug ip rip

R2#debug ip ripIP protocol debugging is onR2#clear ip route *6:14:53: RIP: received v2 update from 172.23.23.3 on Ethernet06:14:53: 1.0.0.0/8 via 0.0.0.0 in 16 hops (inaccessible)6:14:53: 1.1.1.1/32 via 0.0.0.0 in 2 hops6:14:53: 172.12.0.0/16 via 0.0.0.0 in 16 hops (inaccessible)6:14:53: 172.12.12.2/32 via 0.0.0.0 in 2 hops6:14:53: 172.12.13.0/30 via 0.0.0.0 in 1 hops6:14:53: 172.12.123.0/24 via 0.0.0.0 in 1 hops

6:14:53: 172.23.0.0/16 via 0.0.0.0 in 16 hops (inaccessible)

Run debug ip rip to troubleshoot routing update problems, RIPauthentication problems, and to view the routing update contents. clear iproute *was run to clear the routing table and to force a RIP update. Notethat route poisoning is in operation. (A route that is unavailable is not justdropped from updates; it is advertised with an unreachable metric.)

Ip route

OR

Ip route

R2#conf tR2(config)#ip route 1.1.1.1 255.255.255.255 172.12.123.1

To configure a static route to a given destination IP address, use the ip route command. Thedestination is followed by a subnet mask, and that can be followed by either the next-hop IP addressor the exit interface on the local router.

Ip route 0.0.0.0 0.0.0.0

Ip route 0.0.0.0 0.0.0.0

R2#conf tR2(config)#ip route 0.0.0.0 0.0.0.0 172.12.123.1

OR

R2(config)#ip route 0.0.0.0 0.0.0.0 ethernet0

To configure a default static route, use either of these two commands.

You could have any number for the first 0.0.0.0, since the second set ofzeroes is the subnet mask. This means that any destination will match


10/25

this route statement.

Maximum-paths

R2#conf tR2(config)#router ripR2(config-router)#maximum-paths 5

By default, distance-vector routing protocols perform equal-cost load-balancing over four paths. This default can be set from a minimum of 1 toa maximum of 16 with this command.

Note: If you configure maximum-paths 1, you are in effect disablingequal-cost load-balancing.

No auto-summary

R2#conf t

R2(config)#router ripR2(config-router)#version 2R2(config-router)#no auto-summary

Both RIP version 2 and EIGRP perform summarization of routes whenthose routes are advertised across a network border. (For a complete,illustrated explanation of this concept, please check the EIGRP section ofmy Ultimate CCNA Study Guide.) This default behavior is generallydisabled. To do so, run no auto-summary as shown.

Router ripVersion 1

Version 2

R2#conf tR2(config)#router ripR2(config-router)#version 1R2(config-router)#version 2

router ripenables RIP on your router. RIP runs two versions, 1 and 2, andyou must know the differences between the two before succeeding on theCCNA exams.

By default, RIP sends version 1 updates and accepts version 1 and 2updates. To change this default to accept and send updates of only one

of the two versions, configure version 1orversion 2under the RIP routingprocess.

Show ip protocols

R2#show ip protocolsRouting Protocol is "rip" Sending updates every 30 seconds, next due in 20 seconds Invalid after 180 seconds, hold down 180, flushed after 240 Outgoing update filter list for all interfaces is not set Incoming update filter list for all interfaces is not set Redistributing: rip Default version control: send version 2, receive version 2 Interface Send Recv Triggered RIP Key-chain Serial0.123 2 2 Automatic network summarization is not in effect


11/25

Maximum path: 4 Routing for Networks: 172.12.0.0 Passive Interface(s):Routing Information Sources:

Gateway Distance Last Update

172.12.12.1 120 00:00:24 Distance: (default is 120)

Show ip route

R2#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS interarea * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

1.0.0.0/32 is subnetted, 1 subnetsS 1.1.1.1 [1/0] via 172.12.123.1 172.12.0.0/16 is variably subnetted, 4 subnets, 3 masksC 172.12.12.0/30 is directly connected, BRI0R 172.12.13.0/30 [120/1] via 172.12.12.1, 00:00:10, BRI0C 172.12.12.1/32 is directly connected, BRI0R 172.12.123.0/24 [120/1] via 172.12.12.1, 00:00:10, BRI0 172.23.0.0/27 is subnetted, 1 subnetsC 172.23.23.0 is directly connected, Ethernet0

S* 0.0.0.0/0 is directly connected, Ethernet0 [1/0] via 172.12.123.1

This command displays the entire routing table. To see only the routes ofa given protocol, enter the protocol name at the end of this command,such as show ip route rip:

R2#show ip route rip 172.12.0.0/16 is variably subnetted, 4 subnets, 3 masksR 172.12.13.0/30 [120/1] via 172.12.12.1, 00:00:20, BRI0R 172.12.123.0/24 [120/1] via 172.12.12.1, 00:00:20, BRI0

Exam Tip: Note that the letter indicating EIGRP routes is D. E was already

taken by EGP when EIGRP came along.

Variance

R3#conf tR3(config)#router igrp 1R3(config-router)#variance 3

Variance is used to configure unequal-cost load-balancing. Variance issimply a multiplier. The metric of the best path is multiplied by thevariance; any path with a lower metric than the result will be used forunequal-cost load-balancing.

Example: Three paths to a destination exist, with the following metric:


12/25

Path 1: 4000Path 2: 7500Path 3: 8100

By default, EIGRP will use only Path 1. A variance value of 2 would resultin any path with a metric of less than 8000 being used (4000 x 2), so Path1 and Path 2 would be used. A variance of 3 would result in all threepaths being used for unequal-cost load-balancing.

OSPF Commands

Debug ip ospf adj

R3# debug ip ospf adjacency09:58:43: %SYS-5-CONFIG_I: Configured from console by console

R3#09:58:48: OSPF: Rcv DBD from 2.2.2.2 on Ethernet0 seq 0xEEF opt 0x42 flag0x7 len 32 mtu 1500 state INIT09:58:48: OSPF: 2 Way Communication to 2.2.2.2 on Ethernet0, state 2WAY09:58:48: OSPF: Neighbor change Event on interface Ethernet009:58:48: OSPF: DR/BDR election on Ethernet009:58:48: OSPF: Elect BDR 0.0.0.009:58:48: OSPF: Elect DR 172.23.23.309:58:48: DR: 172.23.23.3 (Id) BDR: none09:58:48: OSPF: Send DBD to 2.2.2.2 on Ethernet0 seq 0x13F3 opt 0x42 flag0x7 len 3209:58:48: OSPF: First DBD and we are not SLAVE09:58:48: OSPF: Rcv DBD from 2.2.2.2 on Ethernet0 seq 0x13F3 opt 0x42 flag0x2 len 132 mtu 1500 state EXSTART09:58:48: OSPF: NBR Negotiation Done. We are the MASTER09:58:48: OSPF: Send DBD to 2.2.2.2 on Ethernet0 seq 0x13F4 opt 0x42 flag0x3 len 15209:58:48: OSPF: Database request to 2.2.2.209:58:48: OSPF: sent LS REQ packet to 172.23.23.2, length 6009:58:48: OSPF: Rcv DBD from 2.2.2.2 on Ethernet0 seq 0x13F4 opt 0x42 flag0x0 len 32R3# mtu 1500 state EXCHANGE09:58:48: OSPF: Send DBD to 2.2.2.2 on Ethernet0 seq 0x13F5 opt 0x42 flag0x1 len 3209:58:48: OSPF: Rcv DBD from 2.2.2.2 on Ethernet0 seq 0x13F5 opt 0x42 flag0x0 len 32 mtu 1500 state EXCHANGE09:58:48: OSPF: Exchange Done with 2.2.2.2 on Ethernet009:58:48: OSPF: Synchronized with 2.2.2.2 on Ethernet0, state FULL09:58:48: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Ethernet0 from LOADINGto FULL, Loading Done09:58:48: OSPF: Build router LSA for area 23, router ID 172.23.23.3, seq0x8000000209:58:48: OSPF: Build network LSA for Ethernet0, router ID 172.23.23.309:58:53: OSPF: Neighbor change Event on interface Ethernet009:58:53: OSPF: DR/BDR election on Ethernet009:58:53: OSPF: Elect BDR 2.2.2.209:58:53: OSPF: Elect DR 172.23.23.309:58:53: DR: 172.23.23.3 (Id) BDR: 2.2.2.2 (Id)

debug ip ospf adjallows you to watch the adjacency formation process,and to spot problems preventing adjacency. In this example, you can seethe stages of OSPF adjacency, and see the DR and BDR election at the

end.


13/25

Ip ospf hello Ip ospf dead

R1#conf tR1(config)#int s0R1(config-if)#ip ospf hello 30R1(config-if)#ip ospf dead 100

OSPF hello and dead timers have different defaults on different networktypes; review the OSPF section of The Bryant Advantage Ultimate CCNAStudy Guide for a refresher on these.

No matter the network types, the default is that the OSPF deadtime is fourtimes the hello time. One way to change the deadtime is to change thehello time; no matter what you set the hello time to, the dead time willchange to four times the new hello value.

You can also set the dead time manually, as shown.

This is done on the interface level, and the timers must match on bothsides of the link. If you change the timers on one side and not the other,the adjacency will drop.

Ip ospf priority 0

R2#conf tR2(config)#int s0.123R2(config-subif)#ip ospf priority 0

OSPF hub-and-spoke networks are common, and require extra

configuration on both the hubs and the spokes.

In a hub-and-spoke configuration, the spokes cannot under anycircumstances become the Designated Router (DR) or BackupDesignated Router (BDR). The only way to do this is to set the spokesOSPF interface priority to zero, as shown above.

Since the OSPF default interface priority is 1, configuring this on allspokes will ensure that the hub becomes the DR and that no BDR will beelected.

Ip ospf network non-broadcast

R3#conf tR3(config)#int s0.31 point-to-pointR3(config-subif)#ip ospf network non-broadcast

Keep in mind that a major reason for OSPF neighbors not forming anadjacency is a mismatch in the network types. Serial interfaces default tonon-broadcast, but a point-to-point interface will always default to OSPFnetwork type point-to-point.

If you have a physical serial interface on one side of a link and a point-to-point interface on the other side, the adjacency will not form You canchange the OSPF network type as shown to allow the adjacency to form.


14/25

Router-id x.x.x.x

R1#conf tR1(config)#router ospf 1R1(config-router)#router-id 11.11.11.11Reload or use "clear ip ospf process" command, for this to take effect

R1#clear ip ospf processReset ALL OSPF processes? [no]: yes10:22:19: OSPF: Interface Serial0 going Down10:22:19: OSPF: 1.1.1.1 address 172.12.123.1 on Serial0 is dead, stateDOWN10:22:19: OSPF: Neighbor change Event on interface Serial0

First, what is the default OSPF Router ID (RID)? The rules are a little odd,so lets review them.

If a router running OSPF has one or more loopback addresses, thenumerically highest address is the OSPF RID, even if that interface isnot running OSPF.

If a router running OSPF has no loopback addresses, the numericallyhighest IP address of the physical interfaces is the OSPF RID, evenif that interface is not running OSPF.

I know its second nature to think the interface bearing the OSPF RIDmust be running OSPF, but its not true.

To change the RID, use the router-id command under the OSPF processas shown.

Note that to make this command take effect, the router prompts you toreload or run the clear ip ospf process command. That command isgoing to restart ALL your OSPF processes. In other words, dont try thisat work!

Also note that the prompted answer for reset ALL OSPF processes? isno. When the router default for a question is no, the routers trying to tellyou youre about to do something fairly drastic. I always take a secondlook before I answer yes to a question like that.

Show ip ospf

R1#show ip ospfRouting Process "ospf 1" with ID 11.11.11.11Supports only single TOS(TOS0) routesSupports opaque LSAIt is an area border routerSPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x000000Number of opaque AS LSA 0. Checksum Sum 0x000000Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 3. 3 normal 0 stub 0 nssaExternal flood list length 0 Area BACKBONE(0) Number of interfaces in this area is 1

Area has no authentication SPF algorithm executed 4 times Area ranges are Number of LSA 13. Checksum Sum 0x10123B


15/25

Number of opaque link LSA 0. Checksum Sum 0x000000 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 Area 1 Number of interfaces in this area is 1

Area has no authentication SPF algorithm executed 2 times Area ranges are Number of LSA 6. Checksum Sum 0x02FD14 Number of opaque link LSA 0. Checksum Sum 0x000000 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0

Flood list length 0

Theres a lot of output to this command, but the keys for CCNA and CCNPexam success are that you see the OSPF RID here, you see the router

type (this is an ABR), and you see the different areas and how many timesthe SPF algorithm has been executed.

Since the SPF algorithm (also known as the Dijkstra algorithm) only runson a network topology change, a constantly advancing counter hereindicates a flapping link in the network one that goes up and downcontinually, and which will make the SPF algorithm run every time it doesso.

Show ip ospf interface

R1#show ip ospf interface serial0

Serial0 is up, line protocol is up Internet Address 172.12.123.1/24, Area 0 Process ID 1, Router ID 11.11.11.11, Network Type NON_BROADCAST, Cost:64 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 11.11.11.11, Interface address 172.12.123.1 No backup designated router on this network Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5 Hello due in 00:00:08 Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 6 Last flood scan time is 4 msec, maximum is 8 msec Neighbor Count is 2, Adjacent neighbor count is 2 Adjacent with neighbor 172.23.23.3 Adjacent with neighbor 2.2.2.2 Suppress hello for 0 neighbor(s)

Note that this command shows you the RID, the network type, what thestate is (DR, BDR, DROTHER), the RID of the DR and BDR, and whatadjacencies this interface has formed.

Show ip ospf neighbor

R1#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

172.23.23.3 0 FULL/DROTHER 00:01:37 172.12.123.3 Serial02.2.2.2 0 FULL/DROTHER 00:01:53 172.12.123.2 Serial0172.23.23.3 1 FULL/ - 00:00:38 172.12.13.2 Serial1


16/25

A vital OSPF command, you see the RIDs of the routers OSPFneighbors, the state of the adjacency, the dead time (which in a healthyadjacency will decrement for while, then increment upon receipt of anOSPF Hello), the IP address of that neighbor, and the neighbors interfacewith which the adjacency has formed.

Note the state DROTHER. This means that the neighbor is neither theDR nor the BDR for that segment.

Note the state . This state is seen when the link is point-to-point.Since a point-to-point link by definition can only have two hosts, theres noneed for a DR or BDR. There is no DR or BDR election on a point-to-point link.

EIGRP Commands

NetworkR3#conf tR3(config)#router eigrp 100R3(config-router)#network 172.12.123.0 0.0.0.255

You enable EIGRP on router interfaces with the network command. Notethat the network command in EIGRP includes wildcard masks, just asOSPF does, but EIGRP does NOT require the wildcard mask. OSPFdoes.

No ip split-horizon eigrp

R1#conf tR1(config)#interface serial0R1(config-if)#no ip split-horizon eigrp 100

Split horizon is enabled by default on interfaces running EIGRP.(Remember that EIGRP is a hybrid; it has some characteristics ofdistance-vector protocols and some of link-state protocols. Split horizon isa distance-vector behavior.)

Occasionally, you may need to turn split horizon off in a hub-and-spoke

network to have full network reachability. You turn split horizon off at theinterface level as shown.

Router eigrp

R2#conf tR2(config)#router eigrp 100

Enable EIGRP on a router with the router eigrp command. The numberdefined is the Autonomous System number.

Show ip eigrp neighbors

R1#show ip eigrp neighborsIP-EIGRP neighbors for process 100


17/25

H Address Interface Hold Uptime SRTT RTO Q Seq Type (sec) (ms) Cnt Num0 172.12.123.3 Se0 13 00:01:53 52 312 0 51 172.12.123.2 Se0 149 00:03:18 51 306 0 2

EIGRP neighbors are shown for each EIGRP process with this singlecommand. Note that you can also see how long each adjacency hasbeen up.

Show ip eigrp topology

R1#show ip eigrp topologyIP-EIGRP Topology Table for AS(100)/ID(1.1.1.1)

Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status

P 3.3.3.3/32, 1 successors, FD is 2297856 via 172.12.123.3 (2297856/128256), Serial0

via 172.12.123.2 (2323456/409600), Serial0P 1.1.1.1/32, 1 successors, FD is 128256 via Connected, Loopback0P 2.2.2.0/24, 1 successors, FD is 2297856 via 172.12.123.2 (2297856/128256), Serial0 via 172.12.123.3 (2323456/409600), Serial0P 172.23.23.0/27, 2 successors, FD is 2195456 via 172.12.123.3 (2195456/281600), Serial0 via 172.12.123.2 (2195456/281600), Serial0P 172.12.123.0/24, 1 successors, FD is 2169856 via Connected, Serial0

To configure unequal-cost load-balancing with the variance command,you need to know the metrics of the less-desirable routes. With EIGRP,

this is easy if you know where to look. All these routes are kept in theEIGRP Topology Table.

The Successor (the best route) is seen here, and this is the route youllsee in the routing table with show ip route. The Feasible Successor (less-desirable, but still valid) is seen only in the topology table.

Exam Tip: EIGRP has three tables; the route table, seen with show iproute; the topology table, seen with show ip eigrp topology; and theneighbor table, seen with show ip eigrp neighbor.

Note that the routes in the topology table are seen as Passive, indicatedby the letter P. There are no active routes. At first glance, this may notseem good, but this is actually what you want.

Routes marked as Passive are not currently being calculated by DUAL(EIGRPs algorithm), and are available to carry data. Routes marked as

Active are being calculated by DUAL and cannot currently be used tocarry data.

In a perfectly working network, routes that go into Active dont stay therevery long. If you see one that stays there, the acronym used for that isSIA Stuck-In-Active.

Advanced TCP/IP Topics Command Summary


18/25


19/25

These two ACLs perform the same task. All traffic will match. (You couldput any address in for the source IP address as long as the wildcard maskis 255.255.255.255.)

The word any can be used in place of the source IP address and

wildcard mask 255.255.255.255.R1#conf tR1(config)#access-list 5 remark This ACL blocks telnet traffic.

Use the remark command to add comments to your ACL.

Extended Access Lists Configuration and Application

R1#conf tR1(config)#access-list 105 permit ip 172.50.50.0 0.0.0.255 210.1.1.00.0.0.255R1(config)#interface serial0R1(config-if)#ip access-group 105 out

Exam Tips:

Extended ACLs have numeric ranges of 100 199 and 2000 2699.

Extended ACLs can match against source IP address, destination IPaddress, protocol type, and well-known port number (for example, port 80to block web traffic).

Extended ACLs run from top to bottom; once a match is found, the ACLstops running.

Extended ACLs have an implicit deny at the end.

Extended ACLs are applied in the same fashion as standard ACLs.Watch the ip that the command begins with, and that the direction oftraffic this ACL will be matched against must be specified. Overall, youcan have two ACLs applied on an interface one applied to inboundtraffic and the other to outbound traffic.

The keywordshost and any can be used for the source, destination, orboth.

Named ACL Configuration And Application

R1#conf tR1(config)#ip access-list extended NO_WEB_TRAFFICR1(config-ext-nacl)#deny tcp any any eq wwwR1(config-ext-nacl)#permit ip any anyR1(config-ext-nacl)#interface ethernet0R1(config-if)#ip access-group NO_WEB_TRAFFIC inR1(config-if)#ip access-group NO_WEB_TRAFFIC out

Named ACLs can be either standard or extended, and this is definedwhen the ACL is created.

Here, an ACL blocking WWW traffic is created. The line permit ip anyany will permit any traffic, regardless of source or destination, as long asthe traffic didnt match the first line.


20/25

Named ACLs are applied to interfaces in much the same fashion asnumbered ACLs. Note that this ACL was applied to both inbound andoutbound traffic, which does require two separate lines; theres no bothoption.

Limiting Telnet Access With ACLs

R1#conf tEnter configuration commands, one per line. End with CNTL/Z.R1(config)#access-list 99 permit host 110.1.1.1R1(config)#line vty 0 4R1(config-line)#login% Login disabled on line 5, until 'password' is set% Login disabled on line 6, until 'password' is set% Login disabled on line 7, until 'password' is set% Login disabled on line 8, until 'password' is set% Login disabled on line 9, until 'password' is setR1(config-line)#password cisco

R1(config-line)#access-class 99 in

ACLs can be applied to the VTY lines (used for Telnet) to limit who cantelnet in to the router, regardless of whether they know the password ornot.

First, ACL 99 was written, and the host option is used to permit only theIP address 110.1.1.1. The implicit deny will deny all other sourceaddresses.

Login has been allowed and a password of cisco has been set. The ACLis now applied to the VTY lines with the access-class command. Notethat command its different than the command used to apply an ACL tointerfaces.

Tip: I entered login first to show you the message youll get if you enterthat command before setting the required Telnet password. As long asyou set a password after enabling login, theres no problem. There is noright or wrong order to use the login and password commands.

Route Summarization Commands

R1#conf tR1(config)#interface serial0R1(config-if)#ip summary-address rip 110.1.0.0 255.252.0.0

R1#conf tR1(config)#interface serial0R1(config-if)#ip summary-address eigrp 100 110.1.0.0 255.252.0.0

Route summarization is covered thoroughly in my Ultimate CCNA StudyGuide. Its the process of taking several network numbers andsummarizing them into one single routing update statement. It must be


21/25

done carefully. If youre not familiar with the subject, please refer toSection Ten of my CCNA Study Guide, which contains several clearlyillustrated examples.

The command to send the summarization is a little odd. It does not gounder the routing process configuration; its an interface-level command.Know how to perform this summarization before taking the CCNA exams,and be familiar with the syntax as well.

NAT

Static and dynamic NAT Pre-Configuration

R1#conf tR1(config)#interface serial0R1(config-if)#ip nat outsideR1(config-if)#interface ethernet0R1(config-if)#ip nat inside

Whether youre configuring static or dynamic NAT, youve got to defineyour inside and outside addresses.

The inside NAT interface is the one closest to the devices using RFC1918 addresses; usually, thats going to be an Ethernet interface.

The outside NAT interface is the one facing the Internet from theorganizations point of view; thats going to be a Serial interface.

Exam Tip: The addresses on the inside segment, represented by RFC

1918 addresses, are referred to as inside local addresses; the address onthe outside interface is the inside global address.

Static NAT configuration


R1#conf tR1(config)#ip nat inside source static 10.5.5.5 210.1.1.2R1(config)#ip nat inside source static 10.5.5.6 210.1.1.3

R1(config)#ip nat inside source static 10.5.5.7 210.1.1.4

Static mappings first name an inside local address, and map that addressdirectly to a inside global address. No other addresses will use NAT (youoften hear this referred to as an address or user being natted out).

To view the mappings, run show ip nat translations .

R3#show ip nat translationsPro Inside global Inside local Outside local Outside global--- 210.1.1.2 10.5.5.5 --- ------ 210.1.1.3 10.5.5.6 --- ------ 210.1.1.4 10.5.5.7 --- ---

To view the active translations and number of static


22/25

and dynamic mappings, run show ip nat statistics.

R3#show ip nat statisticsTotal active translations: 3 (3 static, 0 dynamic; 0 extended)Outside interfaces: Serial0Inside interfaces: Ethernet0Hits: 0 Misses: 0

Expired translations: 0

Dynamic NAT Configuration


R1#conf tR1(config)#ip nat inside source list 1 pool NATPOOL

R1(config)#ip nat pool NATPOOL 200.1.1.2 200.1.1.5 netmask 255.255.255.0R1(config)#access-list 1 permit 10.5.5.0 0.0.0.255

This looks like an intimidating configuration, but by taking it apart piece bypiece, you will see its not really complicated.

First, as with static NAT, the inside and outside addresses had to bedefined.

Next, the NAT inside addresses are defined by the ip nat inside sourcecommand. The next part of that command, list 1, refers to access-list 1.In this example, any inside host with an IP address in the 10.5.5.0 /24

network can use NAT. Finally, the pool of NAT addresses to be used isnamed the pool NATPOOL.

On the next line, the pool of NAT addresses is defined. The twoaddresses listed are the first and last addresses in the range to be used.Here, the valid NAT outside addresses are 200.1.1.2, 200.1.1.3,200.1.1.4, and 200.1.1.5. The subnet mask for these addresses isdefined with the netmask command.

Exam Tip: Take care not to include the actual IP address of the NAToutside interface in the NAT pool.

PAT Port Address Translation Configuration

R3#conf tEnter configuration commands, one per line. End with CNTL/Z.R3(config)#interface ethernet0R3(config-if)#ip nat insideR3(config-if)#interface serial0R3(config-if)#ip nat outsideR3(config-if)#ip nat inside source list 1 interface serial0 overloadR3(config)#access-list 1 permit 10.5.5.0 0.0.0.255

PAT uses a single outside IP address to allow multiple NAT session.(PAT uses port numbers to keep the conversations separate.) Theconfiguration for PAT is almost the same as it is for dynamic NAT; the


23/25

difference is that a NAT pool is not created; instead, the outside interfaceis indicated and the overload keyword is added.

Telnet Password Creation

R1#conf tR1(config)#line vty 0 4R1(config-line)#loginR1(config-line)#password CCNA

You add the login command and configure a password on the VTY lines toprotect Telnet with a password.

Telnet connections are required to be password protected. If a userattempts to connect to a router that does not have a VTY password set,the user will receive a message that says password required, but noneset.

Tip: Telnet allows five simultaneous connections, not four. (The lines are0, 1, 2, 3, and 4 thats five!

Setting The Enable Password And Enable Secret

R1#conf tR1(config)#enable password ciscoR1(config)#enable secret ccna

Both the enable password and enable secret protect privileged execmode, more commonly referred to as enable mode. There are several

keys to remember:

The enable secret is encrypted in the running-configuration by default,where the enable password is not. If both are configured, the enable secret takes precedence over theenable password. The enable password exists primarily for backwards compatibility.

Password Protecting The Console

R1#configure terminalR1(config)#line con 0R1(config-line)#login% Login disabled on line 0, until 'password' is setR1(config-line)#password cisco

The first line of defense (after physically securing your network, that is!) ispassword protecting your router console. To do so, configure login andthe password on line con 0.

Encrypting All Passwords In The Running-Config


24/25

R1#show config!enable secret 5 $1$F0NM$qmLAeyofJm/MxmeawGkEI1enable password cisco

Notice that the enable password is in clear text.The enable secret is always encrypted.

R1(config)#service password-encryption

R1#show configUsing 1842 out of 32762 bytes!enable secret 5 $1$F0NM$qmLAeyofJm/MxmeawGkEI1enable password 7 070C285F4D06

To encrypt all passwords in the running configuration, run servicepassword-encryption.

Cisco Discovery Protocol

cdp enablecdp runno cdp enableno cdp run

You need to have these four commands down cold. You must know howto enable and disable CDP at the interface level as well as globally.

CDP is enable globally and on all interfaces by default.

Interface-level commands:

R1#conf tR1(config)#interface serial0R1(config-if)#no cdp enableR1(config)#cdp enable

Global commands:

R1#conf tR1(config)#no cdp runR1(config)#cdp run

R1#show cdp neighborCapability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H -Host, I - IGMP, r - Repeater

Device ID Local Intrfce Holdtme Capability Platform Port IDR3 Ser 1 159 R 2500 Ser 1

R1#show cdp neighbor detail-------------------------Device ID: R3Entry address(es): IP address: 172.12.13.2

Platform: cisco 2500, Capabilities: RouterInterface: Serial1, Port ID (outgoing port): Serial1Holdtime : 154 sec


25/25

Version :Cisco Internetwork Operating System SoftwareIOS (tm) 2500 Software (C2500-D-L), Version 12.2(13), RELEASE SOFTWARE (fc1)Copyright (c) 1986-2002 by cisco Systems, Inc.Compiled Tue 19-Nov-02 20:25 by pwadeadvertisement version: 2

Note that while both show the directly connected devices, only the detailcommandreveals the IP address of the directly connected device.

Back To Index

Copyright 2011 The Bryant Advantage. All Rights Reserved.

Documents

05.CCNA Command Reference