6500 command logging in CLI

Question: Can I monitorir which commands have been applied in a switch/router?

Answer is yes, always have been possible with logging commands. The problem is that you always needed a syslog server otherwise the buffer logging would be overriden.

Now, you can do this is another way:

archive
log config
logging enable
logging size 200
notify syslog
hidekeys

Check the commands by typing:
show archive log config all

ASA Transparent Firewall Sample

: Saved
:
PIX Version 8.0(3)
!
firewall transparent
hostname pix-transp
enable password 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
!
interface Ethernet1
nameif inside
security-level 100
!
interface Ethernet2
shutdown
no nameif
no security-level
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list outside ethertype permit any
access-list inside ethertype permit any
access-list aclin_inside extended permit ip any any
access-list aclin_inside extended permit icmp any any
access-list aclin_outside extended permit ip any any
access-list aclin_outside extended permit icmp any any
pager lines 24
logging enable
logging buffered debugging
mtu inside 1500
mtu outside 1500
ip address 10.2.0.250 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image flash:/asdm
no asdm history enable
arp timeout 14400
access-group inside in interface inside
access-group aclin_inside in interface inside
access-group outside in interface outside
access-group aclin_outside in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.2.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:32b608ef458b708a14ea2858b1df25a2
: end
asdm image flash:/asdm
no asdm history enable

Format an IOS Flash

router1#
dir%Error opening disk0:/ (Invalid DOS media or no media in slot)
router1#show disk0:
Unformatted Partition, please format it.

router1#format disk0:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "disk0:". Continue? [confirm]
Primary Partition created...Size 64 MB
Drive communication & 1st Sector Write OK...
Writing Monlib sectors....
Monlib write complete
Format: All system sectors written. OK...
Format: Total sectors in formatted partition: 131040
Format: Total bytes in formatted partition: 67092480Format: Operation completed successfully.
Format of disk0: complete
router1#

Get Vlan Interface Index

sh vlan ifindex

will give you the relation between the mib ifindex and the interface itself.

Check FWSM Resources

show resource allocation detail
show resource allo
sh resource usage
sh resource usage all
show np pc
show np block
show np all status

Format IOS Flash

router1#dir
%Error opening disk0:/ (Invalid DOS media or no media in slot)router1#show disk0:Unformatted Partition, please format it.
router1#format disk0:
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "disk0:". Continue? [confirm]

Primary Partition created...Size 64 MB

Drive communication & 1st Sector Write OK...
Writing Monlib sectors....
Monlib write complete

Format: All system sectors written. OK...
Format: Total sectors in formatted partition: 131040
Format: Total bytes in formatted partition: 67092480
Format: Operation completed successfully.
Format of disk0: complete

router1#

How does DHCP relay redundancy works?

Having the following configuration:

interface X
ip helper-address 1.1.1.101
ip helper-address 1.1.1.102

This will configure DHCP relay in the router. It receives a broadcast DHCP request and converts it into a unicast message directed exclusivly to both DHCP servers.
The router "sees" the DHCPDISCOVER packet and forwards it to bothaddresses simultaneously. Then, both DHCP servers will make an offer (DHCPOFFER), if they are up and received the request.
The client will receive each offer at one time, one first then the other. if it finds the offer agreeable, itwill send another broadcast, a DHCPREQUEST, specifically requestingthose particular IP parameters. Why does the client broadcast therequest instead of unicasting it to the server? A broadcast is usedbecause the first message, the DHCPDISCOVER, may have reached more thanone DHCP server. If more than one server makes an offer, thebroadcasted DHCPREQUEST allows the other servers to know which offerwas accepted. The offer accepted is usually the first offer received.
Sometimes, in other to make one server responde faster then the other, you can configure the delay of response in the DHCP server.Also, for sincronization between DCHP server, either they support this feature or you will have to have your subnet divided betweenthe 2 servers without overlapping.

Continuous reload of standby unit - FWSM Failover Configuration Syncronization problem

The following error message can be printed on standby:
Config Sync Error: Following command could not be executed on standby

<>Context: <>
******REPLICATION OF CONFIGURATION FROM ACTIVE TO STANDBY UNIT IS INCOMPLETE, TO PREVENT THE STANDBY UNIT TAKING OVER AS ACTIVE WITH A PARTIAL CONFIGURATION, THE STANDBY UNIT WILL NOW REBOOT*******

The problem is that for some reason, the failover replication is stopped because one of the commands was not accepted on standby. For that reason and to avoid inconsistence states, it reloads.
In fact, the happens on version 2.3(2). On versions 3.X.X I believe that the problem will not occur. The problem is related to the configuration status on standby. When the maximum acl is achived on the blade (you can check it with thecommand "sh resource acl") the standby unit will also get to this state correctly synced. The problem in this situation was that when the active unit wanted to replicate the configuration in the limit acl config, the standby did not accept some of the rules and rejected at least one of the lines. This caused this situation.

How to fix it:

- Optimize your config and reduce your config size.

- If it does not sync correctly, clear the configuration on standby and sync it again.

Rack Unit Size

For Europeans information, the size of Rack Unit is:

1 Rack unit = 4.44500 centimeters

Vlan configuration mismatch on FWSM and pseudo-Standby state

There are some conditions that can lead fwsm failover pair to go to the pseudo-Standby state. This is caused because there is a vlan mismatch between the 2 fwsm in failover mode.

In the pseudo-standby blade, you will find when you try to activate the standby unit with the command:
failover

you get:

Detected an Active mate
Vlan configuration mismatch
Failover will be disabled

After checking the configuration on context system, verifying the firewall vlan-group on both supervisors, all the configurations are exactly the same.

The problem can only be seen if you type "show vlan" in the system context. This command will show you exactly which interfaces are used by the fwsm. You will find any inconsistence by comparing the output of "show vlan" in both system contexts.

To fix the problem, remove the vlan from the supervisor and add it again.
For example, if the inconsistence is with the vlan 10, do the following on both modules:

no firewall vlan-group 1 10
firewall vlan-group 1 10

After this compare again the "show vlan" command and verify that the inconsistence is gone.
Now , type the following command in the pseudo-standby one:
failover

You will see it syncing config.
The status will change in this sequence in the "show failover" (this happened in the primary unit):

This host: Primary - Cold Standby
..
This host: Primary - Sync Config
..
End configuration replication from mate.
..
This host: Primary - Bulk Sync
..
This host: Primary - Standby Ready

Good luck! :)

ASA Virtualization context configuration

ASA licensing will allow you or not to use virtual contexts.
In order to use them, will will have first to change the mode of the firewall:

firewall(config)# mode multiple
WARNING: This command will change the behavior of the device
WARNING: This command will initiate a Reboot
Proceed with change mode? [confirm] yes
After the reboot, just create your admin-context
firewall(config)#
firewall(config)# admin-context admin
Creating context 'admin'... Done. (13)

Alocating interfaces:
firewall(config)# context admin
firewall(config-ctx)# allocate-interface GigabitEthernet0/0.101
firewall(config-ctx)# allocate-interface GigabitEthernet0/1.102
firewall(config-ctx)# allocate-interface Management0/0
firewall(config-ctx)# config-url disk0:/admin.cfg

in FWSM you can add Vlans L3 as interfaces:
fwsm(config)# context Internet
fwsm(config-ctx)# allocate-interface Vlan1000
fwsm(config-ctx)# allocate-interface Vlan1001
fwsm(config-ctx)# config-url disk0:/internet.cfg

FWSM/ASA/PIX must have generated certicate for ssh session to be established

In order to iniciate an SSH session to the firewall , you must enter the following command:

Prior to version FWSM 2.X or PIX 6.X:
ca generate rsa key 1024

After those version use:
crypto key generate rsa modulus 1024

6513 Slot Usage for WS-67XX (WS-X6816-GBIC, WS-X6748-GE-TX, WS-X6704-10GE, WS-X6708-10GE-3C, WS-X6708-10GE-3CX, WS-X6748-SFP)

In Cisco Catalyst 6513, the dual fabric slots must be inserted in the module 9 - 13.
-WS-X6816-GBIC
- WS-X6748-GE-TX
- WS-X6704-10GE
- WS-X6708-10GE-3C
- WS-X6708-10GE-3CX
- WS-X6748-SFP
Only 9 - 13 are dual fabric as oposed to 1-6 which are single fabric.For the Cisco Catalyst 6509, all the slots are dual fabric.

IOS Extended Ping in a single line in CLI

Extended ping can be very annoying if you are doing it for several hours in a troubleshooting session.


ping vrf ip 10.0.0.10 data 0000 repeat 500 size 18000 validate source Vlan111

Check Switch Temperature

sh env all

FAN is OK
TEMPERATURE is OK
Temperature Value: 55 Degree Celsius
Temperature State: GREEN
Yellow Threshold : 56 Degree Celsius
Red Threshold : 66 Degree Celsius
SW PID Serial# Status Sys Pwr PoE Pwr Watts
-- ------------------ ---------- --------------- ------- ------- ----- 1 Fixed Good
SW Status RPS Name RPS Serial# RPS Port#
-- ------------- ---------------- ----------- ---------
1 Not Present <>