AOIP - Anything Over IP » Useful Commands

Password Recovery Procedure for Cisco Routers

Jay — Fri, 24 Jul 2009 08:00:26 +0000

Cisco offers a password recovery technique for almost every device they have available. In this post, I’m going to cover how to complete a password recovery on a Cisco router.

There are 2 things that have to be in place before a password recovery can be done.
1/ Physical access to the router
2/ A console connection to the router

Here are the steps which need to be followed carefully. Some of these steps if not followed correctly, will wipe your router clean and leave you with a fresh router with NO configuration!

Firstly, make sure the console connection is working and that you are receiving output from the device.
Secondly, reboot the device by doing a power cycle (Turn it off and turn it back on again)
You will have to break the boot sequence by pressing +C, you may have to do this several times to make sure the router receives your break signals at the correct time. This will force the router in rommon mode. From here you need to type the following

rommon 1> confreg 0×2142
This sets the routers configuration register to bypass the startup-configuration on boot up. The startup-configuration has the passwords in it, so by bypassing it, the router will look brand new and bring us to the “Would you like to enter initial configuration?” screen.

rommon 2 > initialize
This will reload the router
After the router has reloaded, you will be prompted with the “Would you like to enter initial configuration?” which you can bypass by pressing +C
Continue with the following configuration

Router> enable
Router# copy start run

WARNING!!!!!!! – DO NOT DO THIS THE WRONG WAY OUT OF HABBIT. Typing copy run start will erase EVERYTHING on the router and you will have to rebuild the router from scratch!!!
This command will copy the Startup-configuration into the running-configuration. Since you are already in enable mode, you will not be prompted for a password even though the configuration has now been put back.

AOIP.ORG# conf t
AOIP.ORG (config)# enable password new
AOIP.ORG (config)# enable secret new
You are now able to change any password that you have forgotten since you are already in enable mode

AOIP.ORG (config)# config-register 0×2102
This puts the routers configuration register back to normal (boot from the startup config)

AOIP.ORG (config)# do show ip interface brief
You will notice that all interfaces are in an “administratively down” state

AOIP.ORG (config)# interface f0/0
AOIP.ORG (config-if)#no shut
AOIP.ORG (config-if)# interface eth 1/0
AOIP.ORG (config-if)# no shut
AOIP.ORG (config-if)# interface bri 0/0
AOIP.ORG (config-if)# no shut
AOIP.ORG (config-if)# exit
AOIP.ORG (config)# exit
AOIP.ORG # show ip int brief
After no shutting all interfaces, the router is back to normal operations.

AOIP.ORG # copy run start
After all your changes, it’s time to save the new configuration, with the new passwords.

AOIP.ORG # reload
Last but not least, reload the router so the configuration register can take effect. After reboot, you are back to a full working solution and the password has now been reset.

Below are 2 live demo’s. The first is the configuration needed in rommon, the second is after the router has been reloaded from rommon.

If you can see this, then you might need a Flash Player upgrade or you need to install Flash Player if it's missing. Get Flash Player from Adobe.

IP Host

Jay — Wed, 15 Jul 2009 06:00:14 +0000

If you find yourself often connecting to the same devices and are looking a quicker way to telnet to them rather than constantly typing the entire IP address for each one. Or if you have a very large network and find it hard to remember every devices IP address, but you can remember the host name of the router, then the ‘ip host’ command is a saving grace.

Once defined you can now connect to each device on your network via telnet by just using the host name you have defined and linked to an IP address.

Below is a live demo showing the configuration of three routers with the ‘ip host’ command.

If you can see this, then you might need a Flash Player upgrade or you need to install Flash Player if it's missing. Get Flash Player from Adobe.

IP Domain-Lookup

Jay — Tue, 14 Jul 2009 06:00:20 +0000

Often when typing commands in a hurry, or just typing incorrect commands, Cisco routers will try to do a lookup to find out if the invalid command is the name of another device you are trying to connect to. This results in the router displaying ‘Translating “the command”…domain server (255.255.255.255)’ three times and not accepting any more commands until the lookup has completed and failed.

This feature can be disabled quickly and it’s one of the first commands I will put onto a router when first configuring it.

Below is a live demo demonstrating the problem, and the fix with the command ‘no ip domain-lookup’

If you can see this, then you might need a Flash Player upgrade or you need to install Flash Player if it's missing. Get Flash Player from Adobe.

Using the Pipe ‘|’ command

Jay — Tue, 23 Jun 2009 06:00:10 +0000

Using the Pipe ‘|’ is by far one of the most important things you can learn on a Cisco device. I never really appreciated this command when I started out in Cisco, as it seemed to take me longer to use it, and I didn’t get to see what I was looking for. In hind sight this was because I didn’t know how to use it correctly, and I was working on devices that didn’t have very large configuration files.

When I started working on larger scale enterprise networks, I became very frustrated that I could not find what I was looking for quickly. It was only then that I re-looked at this command and it made me far more efficient at my job. I often work on Cisco devices that over 3000 lines of configuration, so doing a standard ‘sh run’ just isn’t an option.

The pipe command can be used with any ‘show’ command. In the live demo below, I have demonstrated how it can be used with the ‘show run’ command. In order to use the pipe we need to first look at the syntax required for it and options it supports. The most common values for the pipe are ‘include’ ‘begin’ ‘exclude’. These enable us to use the ‘show’ command and have the device only display lines in the output that include a value, exclude a value, or display everything from the beginning of a value.

In the below demo I started by using the ‘sh run | in interface’ I have used the shortened version of the commands so the full command would have been “show running-config | include interface’ This has instructed the device to display only lines in the running-config that have the word ‘interface’

My second command is ‘sh run | in serial’ which will show me all lines in the configuration that have the word ‘serial’ in them. You will notice that I have used the same command again, but used ‘sh run | in Serial’ with a uppercase ‘S’ to illustrate that the command is case SeNsItIvE and you will notice the results are very different.

Lastly, I have demonstrated the ‘exclude’ command by issuing ‘sh run | ex interface’ to the device, and you will notice the entire running-config was displayed but every line that had the word ‘interface’ has been removed.

If you can see this, then you might need a Flash Player upgrade or you need to install Flash Player if it's missing. Get Flash Player from Adobe.

The “do” command

Jay — Mon, 22 Jun 2009 06:00:06 +0000

One of the most annoying things I kept doing when I started out in Cisco, was constantly typing ‘show’ commands when in the wrong level of the configuration.

By default, Cisco only allows you to do a ‘show’ command when you are in privileged mode (AOIP.ORG#). This can be frustrating when you are multiple levels deep and just want to see something quickly and don’t want to exit all the way back to the first level to use the ‘show’ command and then get back to the level you were in. Luckily, Cisco introduced the ‘do’ command which can be run from any level of the command line.

For example, if I have just configured an IP address on an interface and no shut the interface, the router would not allow me to type “show ip interface brief” from the interface level, however from the interface level I would be able to type “do show ip interface brief”. This would allow me to remain in interface level, have a quick look to see if my interface has gone “up up” and continue with my configuration.

Below is a live demo of trying to do the “show run” command from global configuration mode. You will see I receive an error when trying to use the ‘show’ command from this level, but with ‘do show run’ the command works.

If you can see this, then you might need a Flash Player upgrade or you need to install Flash Player if it's missing. Get Flash Player from Adobe.