Router基本配置.doc

Router基本配置实验目的：l 学会cisco路由器命令行帮助l 配置路由器基本参数 实验拓扑图：实验步骤：1. 新路由器，无启动文件的路由器，配置寄存器值设置为0x2142的路由器启动时，会进入到系统初始化配置目前ISR系列路由器出厂时，有一些默认配置界面- System Configuration Dialog -% Please answer yes or no.Would you like to enter the initial configuration dialog? yes/no:no2. 输入 “no”，并回车进入路由器CLI界面Router? Router为此设备的主机名， “” 表示现在处于用户模式， “？”是帮助命令，显示目前可用的命令或者参数 Exec commands: access-enable Create a temporary Access-List entry access-profile Apply user-profile to interface clear Reset functions connect Open a terminal connection crypto Encryption related commands. disable Turn off privileged commands disconnect Disconnect an existing network connection emm Run a configured Menu System enable Turn on privileged commands ethernet Ethernet parameters exit Exit from the EXEC help Description of the interactive help system lock Lock the terminal login Log in as a particular user logout Exit from the EXEC mrinfo Request neighbor and version information from a multicast router mstat Show statistics after multiple multicast traceroutes mtrace Trace reverse multicast path from destination to source name-connection Name an existing network connection pad Open a X.29 PAD connection ping Send echo messages ppp Start IETF Point-to-Point Protocol (PPP) radius radius exec commands release Release a resource renew Renew a resource resume Resume an active network connection rlogin Open an rlogin connection set Set system parameter (not config) show Show running system information slip Start Serial-line IP (SLIP) ssh Open a secure shell client connection systat Display information about terminal lines tclquit Quit Tool Command Language shell tdm TDM telnet Open a telnet connection terminal Set terminal line parameters traceroute Trace route to destination tunnel Open a tunnel connection udptn Open an udptn connection webvpn WebVPN exec command where List active connections x28 Become an X.28 PAD x3 Set X.3 parameters on PADRouterRouterenable进入特权模式的命令（特权模式也叫做enable模式）Router#?表示目前处于特权模式，观察一下特权模式的命令是不是比用户模式的命令多Exec commands: access-enable Create a temporary Access-List entry access-profile Apply user-profile to interface access-template Create a temporary Access-List entry archive manage archive files audio-prompt load ivr prompt auto Exec level Automation beep Blocks Extensible Exchange Protocol commands bfe For manual emergency modes setting calendar Manage the hardware calendar call Voice call cd Change current directory clear Reset functions clock Manage the system clock cns CNS agents configure Enter configuration mode connect Open a terminal connection copy Copy from one file to another crypto Encryption related commands. debug Debugging functions (see also undebug) delete Delete a file dir List files on a filesystemRouter#config terminal进入到路由器配置模式，95路由器配置修改在此模式及其子模式内完成Enter configuration commands, one per line. End with CNTL/Z.Router(config)#配置模式提示符Router(config)#?Configure commands: aaa Authentication, Authorization and Accounting. aal2-profile Configure AAL2 profile access-list Add an access list entry alias Create command alias appfw Configure the Application Firewall policy application Define application archive Archive the configuration arp Set a static ARP entry ase Configure ASE async-bootp Modify system bootp parameters backhaul-session-manager Configure Backhaul Session Manager banner Define a login banner bba-group Configure BBA Group beep Configure BEEP (Blocks Extensible Exchange Protocol) bfd BFD configuration commands boot Modify system boot parameters bridge Bridge Group. buffers Adjust system buffer pool parameters busy-message Display message when connection to host fails call Configure Call parameters注:不同的命令需要在不同的模式下输入,请注意.3. 路由器的帮助命令使用Router#cl此处假设要设定系统时钟参数，只记得命令的开头是cl，直接回车% Ambiguous command以cl开头的命令不止一个，所以提示有争议性的命令: clRouter#Router#cl?不加空格，直接跟“？”，可以查看以cl开头的所有命令clear clock Router#clock ? 带空格的“？”帮助可以显示以clock命令的所有参数 read-calendar Read the hardware calendar into the clock set 参数部分 Set the time and date参数解释部分 update-calendar Update the hardware calendar from the clockRouter#clock set ? hh:mm:ss Current TimeRouter#clock set 17:28:50 ? Day of the month MONTH Month of the yearRouter#clock set 17:28:50 14 apr ? YearRouter#clock set 17:28:50 14 apr 2009 ? Router#clock set 17:28:50 14 apr 2009Router#show clock显示时钟命令17:28:55.427 UTC Tue Apr 14 20094. 路由器的基本配置Router#config terminalRouter(config)#hostname sannet 设置router名称 sannetrouter名称已改为sannet(config)# sannet(config)#banner motd # welcome to sannet #设置router设置登陆告警信息，为起始符及终结符sannet(config)#interface ethernet 0进入到ethernet0接口配置模式 sannet(config-if)#description Link to RD Department设置ethernet0端口描述sannet(config-if)#exit sannet(config)#exit退出全局配置模式到特权模式 sannet#sannet(config-if)#end也可以使用end命令，退出接口配置模式到特权模式sannet#exit退出路由器console接口sannet con0 is now available退出后，系统提示现在sannet设备的con0目前有效Press RETURN to get started.按回车键既可进入路由器命令行配置界面（CLI）welcome to sannet sannetsannetsannetenablesannet#sh int eth0Ethernet0 is administratively down管理性关闭，即此接口默认打了shutdown命令, line protocol is down Hardware is DEC21140, address is ca00.17ac.0000此为ethernet0口的MAC地址 (bia ca00.17ac.0000) Description: Link to RD Department MTU 1500 bytesMTU，max transport unit, BW 10000 Kbit/secBW，bandwidth带宽的缩写, DLY DLY，Delay延迟的缩写100 usec, reliability 255/255可靠性，100, txload 1/255输出负载, rxload 1/255输入负载 部分输出省略 5.可以给路由器的特权模式配置登录密码，当操作员要从用户模式进入到特权模式时则必须输入我们设定的密码。Cisco提供了两种密码模型：普通密码与MD5加密密码.sannetenablesannet#conf t此为缩写命令，当输入conf时，如果没有命令的前4个字母与此相同，就可以不用输入后面的字母，t同理sannet(config)# enable password sannet123可以通过show run命令查看到此口令，即明文保存。安全性差，会带来很大的安全隐患Sannet#sh run-部分输出省略-enable password sannet123sannet#conf tEnter configuration commands, one per line. End with CNTL/Z.sannet(config)#service password-encryption将password加密保存，show run是将看不到原密码，但是，这种所谓的加密的密文仍能非常简单的数学算法破解。 sannet(config)#sannet#sh run-部分输出省略-enable password 7 121A0C041104sannet#diasable退到用户模式 sannetenable 进入特权模式 password: 提示输入特权密码 sannet#sannet # config tsannet(config)#enable secret sannet12345使用这样的方法所配置的明文即无法使用命令查看到，也无法使用软件反破解回原文密码。安全性较高sannet#sh run-部分输出省略-enable secret 5 $1$.ejI$929cFq2DO5OfqrpNHD4ys/md5级加密的密码，并使原来的enable password作废 enable password 7 121A0C041106. 配置命令别名(Aliases)，以较简洁的命令来代替一个真实的命令sannet#configure terminal Enter configuration commands, one per line. End with CNTL/Z.sannet(config)#alias exec iib show ip interface brief输入 iib 代替 show ip interface briefsannet(config)#alias exec sa show arp输入 sa 代替 show arpsannet(config)#endsannet#sannet#show aliases Exec mode aliases: h help lo logout p ping r resume s show u undebug un undebug w where iib show ip interface brief sa show arpsannet#iib输入iib，结果等同show ip int briefInterface IP-Address OK? Method Status ProtocolFastEthernet0/0 unassigned YES NVRAM administratively down down Serial1/0 unassigned YES NVRAM administratively down down Serial1/1 unassigned YES NVRAM administratively down down Serial1/2 unassigned YES NVRAM administratively down down Serial1/3 unassigned YES NVRAM administratively down down SSLVPN-VIF0 unassigned NO unset up up 7. 备份和恢复Router的配置文件sannet#sh running-config显示目前路由器正在运行的配置Building configuration.Current configuration : 1130 bytes!upgrade fpd autoversion 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname sannet!boot-start-markerboot-end-marker!logging message-counter syslog!no aaa new-modelip source-routeip cef! multilink bundle-name authenticatedarchive log config hidekeys! interface FastEthernet0/0 description Link to RD Department no ip address shutdown duplex half!interface Serial1/0 no ip address shutdown no fair-queue serial restart-delay 0!interface Serial1/1 no ip address shutdown serial restart-delay 0!interface Serial1/2 no ip address shutdown serial restart-delay 0!interface Serial1/3 no ip address shutdown serial restart-delay 0!ip forward-protocol ndno ip http serverno ip http secure-server!logging alarm informational!control-planegatekeeper shutdown!banner motd C welcome to sannet Calias exec iib show ip interface briefalias exec sa show arp!line con 0 stopbits 1line aux 0 stopbits 1line vty 0 4 login!endsannet#copy running-config startup-config把运行的配置文件保存到启动文件中，即NVRAM中（write命令与此同），正常情况下路由器启动后将读取此配置文件sannet#dir nvram:列出nvram:内的文件目录Directory of nvram:/ 123 -rw- 1130 startup-config 124 - 24 private-config 125 -rw- 1130 underlying-config 1 - 49 persistent-datasannet#sh startup-config显示启动配置文件 Using 1130 out of 129016 bytes!upgrade fpd autoversion 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname sannet!boot-start-markerboot-end-marker!logging message-counter syslog!no aaa new-modelip source-routeip cef部分输出省略sannet#conf tEnter configuration commands, one per line. End with CNTL/Z.sannet(config)#hostname test配置被修改test(config)#end*Apr 14 20:43:59.023: %SYS-5-CONFIG_I: Configured from console by console系统日志信息test#copy start runCopy 启动文件到运行文件，即内存中Destination filename running-config? 1130 bytes copied in 1.560 secs (724 bytes/sec)sannet#配置被恢复8. 清除启动文件sannet#copy running-config startup-config保存配置sannet#sh start显示启动配置文件，默认情况下，路由器从此文件启动sannet# show startUsing 1130 out of 129016 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname sannet!no aaa new-modelip source-routeip cef! interface FastEthernet0/0 description Link to RD Department no ip address shutdown duplex half!interface Serial1/0 no ip address shutdown no fair-queue serial restart-delay 0!banner motd C welcome to sannet Calias exec iib show ip interface briefalias exec sa show arp!line con 0 stopbits 1line aux 0 stopbits 1line vty 0 4 login!Endsannet#delete nvram:startup-config删除启动配置文件Delete filename startup-config? Delete nvram:startup-config? confirmOKsannet#sannet#show startUsing 5 out of 129016 bytesend此时已无配置文件 sannet#reload重启路由器观察结果，是否又进入初始化配置模式9. 基本管理安全配置sannet(config)#line console 0进入console 线路配置模式sannet(config-line)# login允许输入密码登入sannet(config-line)# password sannet设置console口登录密码sannet (config-line)#endsannet#exitUser Access VerificationPassword: 要求输入密码 sannetenablesannet#sannet(config)#line vty 0 4进入虚拟终端配置模式，vty 0为第一个远程连接过来的user，vty 1为第二个远程连接过来的user，以此类推sannet(config-line)#login允许输入密码登录，如果是no login，则是指直接登录，不用输入密码sannet(config-line)#password sannetsannet(config-line)#exitsannet(config)#interface e0sannet(config-if)#ip address配置接口IP地址 验证：PC连接至sannet E0口，并配置IP:3/24开始 运行 输入 “cmd” telnet 10. 启用HTTP方式管理Routersannet(config)#ip http server启用HTTP方式管理Routersannet(config)#sannet#sannet(config)#ip http port 30修改http的默认80端口到30在PC上，IE浏览器 :30之后输入正确的口令，就可以打开内置的Web管理方式11. 手工创建主机名和IP地址映射sannet(config)#ip host PC 3定义PC的IP地址为3 sannet(config)#exitsannet#show hostsDefault domain is not setName/address lookup uses domain serviceName servers are 55Host Flags Age Type Address(es)PC (perm, OK) 0 IP 3sannet#ping PC直接ping主机名，而不是长长的IP地址Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 3, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 mssannet#sannet#pctestTranslating pctest.domain server (55)输入一个错命令时，路由器会当此命令为一主机名进行域名解析并尝试telnet此主机% Unknown command or computer name, or unable to find computer addresssannet#sannet(config)#no ip domain-lookup禁用IP域名解析sannet#helloTranslating hello此时不会解析，也不会卡住% Unknown command or computer name, or unable to find computer addresssannetr#12. 查看CPU Loadingsannet#show processes cpu查看cpu使用率 CPU utilization for five seconds: 2%最近5秒平均cpu使用率/0%; one minute: 2%;最近1分钟平均cpu使用率 five minutes: 2%最近1分钟平均cpu使用率 PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 1 12 79 151 0.00% 0.00% 0.00% 0 Chunk Manager 2 16 2281 7 0.00% 0.01% 0.00% 0 Load Meter 3 0 1 0 0.00% 0.00% 0.00% 0 chkpt message ha 4 0 1 0 0.00% 0.00% 0.00% 0 EDDRI_MAIN 5 8916 1403 6354 0.00% 0.15% 0.11% 0 Check heaps 6 8 2 4000 0.00%