Troubleshooting
sh run
sh ip int brief
sh vla brief
sh int trunk
sh int g0/0.13
sh cdp neighbors
sh cdp neighbors detail
sh cdp entry R1
sh lldp
sh lldp neighbors
sh lldp neighbors detail
sh controllers s2/0 (CDE - DTE)
sh mac address-table
sh ip route
sh acc
sh clock
sh clock detail
sh ntp associations
sh ip nat translations
sh ipv6 int br
sh ipv6 route
sh int g0/2 sw (for DTP for example)
sh vtp status
sh spanning-tree sum (check mode & protections & vlans)
sh spanning-tree (lowest bridge id is root)
Designated ports: int from root switch or from root path
Root ports: int going to root switch
Alt / Block: highest costs
sh eth sum
sh int f0/4 (duplex en speed check)
sh ipv6 ospf neighb
sh ipv6 route
sh standby (higher prio wins)
terminal no monitor (stop spamming)

Router on a stick
en
Conf t
int g0/0
no shut
int g0/0.13
encap dot1q 13
ip add 10.0.0.1 255.255.255.0

Trunk
sh int trunk
int g0/1
switchport mode trunk
switchport trunk nonegotiate
switchport trunk allowed vlan 5,6,7,8


CDP
cdp run
int range f0/3-4 (access ports)
cdp enable (default)
no cdp enable

LLDP
no cdp run
lldp run
sh lldp
sh lldp neighbors
prevent access lldp updates int f0/1
no lldp receive
no lldp transmit

Loopback
int l0
ip add 1.1.1.1 255.255.255.255
no shut

Port security
sh mac address-table
sh port-security
int f0/2
switchport mode access
switchport port-security (only on access port)
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky
switchport port-security ac-address mac-address 002.16E2.2193

Static route
sh ip route
ip route 192.168.2.0 255.255.255.0 10.0.0.2
ip route 192.168.2.0 255.255.255.0 g0/0
ip route 10.0.0.0 255.255.255.0 192.168.0.3 121 (backup route - floating)

RIP
router rip
network 192.168.1.0
network 10.0.0.0 (classfull so auto summarized in version 1)

RIPv2
router rip
version 2
no auto-summary
network 10.0.0.0
network 192.168.1.0
passive-interface g0/2 (access facing)

Standard ACLs
access-list 1 permit 192.168.1.0 0.0.0..255
do sh acc
int f0/0
ip access-group 1 out

access-list 1 deny host 192.168.2.14
access-list 1 permit any
do sh acc
int f0/0
ip access-group 1 out

Extended ACL's
access-list 100 permit ip host 192.168.1.11 host 192.168.3.100
access-list 100 deny ip any host 192.168.3.100
access-list 100 permit ip 192.168.2.0 0.0.0.255 host 192.168.3.101
access-list 100 deny ip any host 192.168.3.101
access-list 100 permit ip any any
int s2/0
ip access-group 100 out

Named ACL's
ip access-list standard 2to1
deny 192.168.2.0 0.0.0.255
permit any
int f0/0
ip access-group 2to1 out

ip access-list standard 1to2
deny 192.168.1.0 0.0.0.255
permit any
int f0/0
ip access-group 1to2 out

NTP
show clock
sh clock detail
sh ntp associations
clock timezone JST 9
clock set 12:00:00 Aug 21 2019
ntp master (set as master not server)
ntp authenticate
ntp authentication-key 1 md5 cisco1

set ntp client
clock timezone JST 9
ntp authenticate
ntp authentication-key 1 md5 cisco1
ntp trusted-key 1
ntp server 192.168.12.1 key 1

DHCP
ip dhcp pool 10pool
network 10.0.0.0 255.255.255.0
default-rotuer 10.0.0.1
dns-server 10.0.0.1
exit
ip dhcp excluded-address 10.0.0.1 10.0.0.10

int g0/1 (relay)
ip helper-address 192.168.12.1

DNS
on switch
ip default-gateway 192.168.1.1
ip name-server 20.0.0.100

Static NAT
int g0/0
ip nat inside
int s0/0
ip nat outside
ip nat inside source static 192.168.1.11 1.2.3.11

Dynamic NAT
sh ip nat translations
int g0/0
ip nat inside
int s0/3/0
ip nat outside
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool pool1 1.2.3.10 1.2.3.20 netmask 255.255.255.0
ip nat inside source list 1 pool pool1

PAT (port address translation)
int g0/0
ip nat inside
int s0/3/0
ip nat outside
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface s0/3/0 overload

syslog
service timestamps log datetime msec

Password recovery
reboot switch and in boot go to rommon
confreg 0x2142
reset
en
copy start run
conf t
enable secret ccna
int g0/0
no shut
exit
config-register 0x2102
wr
ping 192.168.1.100
copy startup-config tftp
server: 192.168.1.100

sh version (check version and image file)
copy tftp flash 192.168.1.100 and past filename
delete flash:oldfilename
show flash
reload

IPV6
ipv6 unicast-routing
int g0/0
ipv6 add 2001:db8:123:123::1/64
no shut
int g0/0

no shut
ipv6 add auto
do sh ipv6 int br


IPV6 static routes
ipv6 route 2001:db8:2:2::/64 2001:DB8:123:123:2D0:FFFF:FE69:3801

DTP
sh int g0/2 sw
int g0/2
switchport nonegotiate
int g0/1
switchport mode trunk
switchport nonegotiate
int range f0/1-2
switchport mode access
switchport access vlan13
switchport nonegotiate

VTP
sh vtp status
vtp mode server
vtp domain name CCNA
vtp version 2

VTP Middleman:
vtp mode transparant
vtp domain name CCNA
vtp version 2

Client:
vtp mode client
vtp domain name CCNA
vtp version 2

STP
sh spanning-tree sum (check mode & protections & vlans)
sh spanning-tree (lowest bridge id is root)
Designated ports: int from root switch or from root path
Root ports: int going to root switch
Alt / Block: highest costs

spanning-tree mode rapid-pvst
spanning-tree vlan 10 root primary
spanning-tree vlan 10 root secondary
spanning-tree portfast default (enable portfast on all acc ports)
int f0/1
spanning-tree portfast
spanning-tree bpduguard enable

Etherchannel
All ports must have same config (duplex, speed, native & allowed vlan, switchport mode)
sh eth sum
Layer 2 Eth Channel PAGP
int range f0/1 - 4
channel-group 1 mode desirable
int po1
switchport trunk encapsulation dot1q
switchport mode trunk

Layer 2 Eth Channel LACP
int range f0/1-4
channel-group 2 mode active
switchport trunk encap dot1q
switchport mode trunk

Layer 3 routing (static eth channel)
ip routing
int range g0/1-2
no shwitchport
channel-group 1 mode on
int po1
ip add 23.0.0.1 255.255.255.0

inter vlan routing (svi)
sh vlan brief
ip routing
int vlan 10
ip address 10.0.1.1 255.255.255.255.0
no shut
int vlan 20
ip add 10.0.2.1 255.255.255.0
no shut

inter vlan Roas
sh ip int brief
sh vlan brief

switch:
int g0/1
switchport mode trunk
R:
int g0/0
no shut
int g0/0.30
encap dot1q 30
ip add 10.0.3.1 255.255.255.0
int g0/0.40
encap dot1q 40
ip add 10.0.4.1 255.255.255.0

OSPF
sh ip ospf neighbor
sh ip prot
sh ip route
int l0
ip add 1.1.1.1 255.255.255.255
router ospf 1
network 12.0.0.0 0.0.0.255 area 0
network 1.1.1.1 0.0.0.0 area 0
passive-interface l0
auto-cost reference-bandwith 100000
modify cost on int (ip ospf cost 10000)

OSPF Multi Area
int l0
ip add 1.1.1.1 255.255.255.255
router ospf 1
network 10.12.0.0 0.0.0.255 area 1
passive -interface l0
auto-cost reference)bandwidth 100000

border router
router ospf 1
net 10.12.0.0 0.0.0.255 area 1
net 10.23.0.0. 0.0.0.255 area 0
area 0 range 10.0.0.0 255.0.0.0 (summary route send to area)
passive-interface l0
auto-cost reference-bandwidth 10000

OSPFv3
sh ipv6 ospf neighb
sh ipv6 route
int l0
ip add 1.1.1.1 255.255.255.255
ipv6 router ospf 1
int g0/0
ipv6 ospf 1 area 1
default route
ipv6 route ::/0 2001:db8:01:01::2
ipv6 router ospf 1
default-information originate

EIGRP
sh ip eigrp neigh
sh ip prot
sh ip int brief
int l0
ip add 1.1.1.1 255.255.255.255
router eigrp 100
network 10.12.0.0 0.0.255.255
network 1.1.1.1 0.0.0.0
passive-interface l0
no auto-summary
int f1/0
ip summary-address eigrp 100 10.0.0.0 255.0.0.0

EIGRP IPV6
int l0
ip add 1.1.1.1 255.255.255.255
ipv6 router eigrp 100
no shut
passive-interface g0/2
int g0/0
ipv6 eigrp 100

HSRP
sh standby (higher prio wins)
(preemt is activ after reboot)
terminal no monitor (stop spamming)
sh standby g0/1
int g0/1
standby 10 ip 10.10.10.1
standby 10 priority 110
standby 10 preemt

HSRP V2
int g0/1
standby 10 ip 10.10.10.1
standby version 2

PPP with PAP
L2 over wan
do sh ip int br
sh int s0/0
username Packet password Tracert
int s0/0
encap ppp
ppp authentication pap
ppp pap sent-username Cisco password CCNA
shut
no shut

PPP with CHAP
sh int s0/0 (check encap, hdlc and up / up down state)
username SPR2 password CCNA
int s0/0
shut
encap ppp
ppp auth chap
no shut
ip route 0.0.0.0/0 200.0.0.1 (to your wan)

PPPoE
username Packet password Tracer
int dialer 1
mtu 1492
encap ppp
ip add negotiated
pp auth pap
ppp pap sent-username Cisco password CCNA
dialer pool 1
do sh run int dialer 1
int g0/0
pppoe-client dial-pool-number 1
no shut
sh ip int brief (dialer1 check)

PPPoE CHAP instead of pap
username SPR2 password CCNA
int dialer 1
mtu 1492
encap ppp
ip add negotiated
ppp authentication chap
dialer pool 1
int g0/0
pppoe-client dial-pool-number 1
sh ip int brief
sh int dialer 1

MultiLink PPP
sh ppp all
sh ppp multilink

username Packet password Tracer
interface multilink 1
ppp multilink group 1
ppp authentication pap
ppp pap sent-username cisco password CCNA
ip address 100.0.0.2 255.255.255.252
do sh run int multi 1

int s1/0
encap ppp
ppp multilink group 1
no shut

int s1/1
encap ppp
ppp multi group 1
no shut

Site to Site VPN
1) draw necessary toplogy
2) configure ip addresses to the routers interfaces and pcs
3) configure ospf and test communication
router ospf 11
router-id 2.1.2.1
network 192.168.10.0 0.0.0.255 area 0
network 20.20.20.0 0.0.0.3 area 0

4) configure ipsec vpn
4.1) enable security technology package
license boot module c2900 technology-package securityk9
sh version (check for security and package)

4.2) configure extended acl permitting the target on each router
access-list 130 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255


4.3) configure the ike phase 1 isakmp policy on each router
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
exit
crypto isakmp key password4544646 30.30.30.2 (wan other side)
do wr

other side
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
exit
crypto isakmp key password45644646 20.20.20.2 (wan other side)
do wr


4.4) configure the ike phase 2 ipsec policy on each router
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
crypto map VPN-MAP 10 ipsec-isakmp
description THIS VPN CONNECTS SITE B
Set peer 30.30.30.2
set transform-set VPN-SET
match address 130
exit


Other side:
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
crypto map VPN-MAP 10 ipsec-isakmp
description THIS VPN CONNECTS TO SITE A
set peer 20.20.20.2
set transform-set VPN-SET
match address 130
exit

4.5) configure the crypto map on the outgoing interface
int serioal0/3/0
crypto map VPN-MAP
do wr

sh crypto ipsec sa

BGP
router bgp 65001
neighbor 10.10.10.2 remote-as 65001
network 192.168.0.0 mask 255.255.255.0

Advanced BGP
router bgp 65000
neighbor 192.168.0.0 mask 255.255.255.0
redistribute ospf 1