cisco清除交换机密码.doc

忘记Switch密码的处理方法：1. Press MODE button during startup.2. flash_init3. load_helper4. dir flash5. rename flash:config.text flash:config.old6. boot（找回原来的配置：）7. 先 show flash 看一下，再输入 rename flash:config.old flash:config.text8. copy flash:config.text running-config9. enable secret * （*为你要设的密码）10. copy running-config startup-configGood luck通过本实验了解CISCO交换机的验证方法，防止非法用户访问交换机初始配置SwitchConf tInt f 0/1No swIp ad 10.1.1.2 255.255.255.0EndRouterConf tInt e 0Ip ad 10.1.1.1 255.255.255.0No shutServer IP address 10.1.2.1/24测试sw1#ping 10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:.!Success rate is 80 percent (4/5), round-trip min/avg/max = 12/52/116 ms1， 在Router做TELNET 命令，访问SwitchSwitchConf tNo service password-recoveyEnable secret ccieLine vty 0 15LoginPassword ccieEnd在Router上校验R1#telnet 10.1.1.2Trying 10.1.1.2 . OpenUser Access VerificationPassword: 被隐藏sw1enPassword: 被隐藏sw1# 进入交换机特权模式sw1#quitConnection to 10.1.1.2 closed by foreign hostR1# 回到Router2， 配置username和password对这个配置使username 和password存储在本地交换机中，在switch上配置Conf tUsername cisco password ccieLine vty 0 15Login localEnd在Router上校验R1#telnet 10.1.1.2Trying 10.1.1.2 . OpenUser Access VerificationUsername: ciscoPassword: 被隐藏sw1enPassword: 被隐藏sw1#quitConnection to 10.1.1.2 closed by foreign hostR1#3， 配置多种特权等级在交换机上配置用户，并对用户单独进行授权Conf tUsername cisco privilege 2 password 0 ccie在Router上校验R1#telnet 10.1.1.2Trying 10.1.1.2 . OpenUser Access VerificationUsername: ciscoPassword: sw1#conf t % Invalid input detected at marker.为什么会出错呢？因为我们没有对此用户的访问进行授权，现在交换机上进一步配置Privilege exec level 2 conf tPrivilege configure level 2 interfacePrivilege interface level 2 no switchportPrivilege interface level 2 ip addressPrivilege interface level 2 no shut在Router上校验sw1#conf tEnter configuration commands, one per line. End with CNTL/Z.sw1(config)#int f 0/2sw1(config-if)#no swsw1(config-if)#ip ad 10.1.2.2 255.255.255.0sw1(config-if)#shutsw1(config-if)#no shutsw1(config-if)#Zsw1#quitConnection to 10.1.1.2 closed by foreign hostR1#4， 在交换机上配置本地Authentication和Authorization服务，在本地交换机上AAA验证Conf tAaa new-modelAaa authentication login default localAaa authorization exec default localAaa authorization network default localUsername cisco password ccie在Router上校验Username: ciscoPassword: sw1enPassword: sw1#config tEnter configuration commands, one per line. End with CNTL/Z.sw1(config)#Zsw1#quitConnection to 10.1.1.2 closed by foreign hostR1#下面来讨论TACACS+ SERVER和RADIUS SERVER的验证授权和统计。1， 配置TACACS+ SERVERConf tTacacs-server host 10.1.2.1 Aaa new-modelAaa group server tacacs+ group ciscoServer 10.1.2.1Exit2， 配置TACACS+登录验证aaa authentication login default group tacacs+Line vty 0 15Login authentication defaultexit3， 配置TACACS+的EXEC访问和network授权aaa authorization exec defaut group tacacs+ aaa authorization network defaut group tacacs+4， 配置TACACS+的统计Aaa accounting network default start-stop group tacacs+Aaa accounting exec default start-stop group tacacs+1， 配置RADIUS SERVERConf tRadius-server host 10.1.2.1Aaa new-modelAaa group server radius group ciscoServer 10.1.2.1Exit2， 配置RADIUS登录验证Aaa authentication login default group radiusLine vtp 0 15Login authentication defaultExit3，配置RADIUS的EXEC访问和network授权Aaa authorization network default group radiusAaa authorization exec default group radius3， 配置RADIUS的统计Aaa accounting network default start-stop