Cisco on Nico Maas

Cisco 45xx Supervisor 6LE Defect

Fri, 27 Jan 2017 09:00:05 +0000

As I tend to work with some Cisco 4506 and similiar switches - equipped with WSX45SUP6LE / WS-X45-SUP6L-E Supervisor Engines, I had the unfortunate delight to seem those rebooting at random.

Cisco did put out an entry in their bug tool (“Sup6LE reloads silently (Reset State: 00000201) / watchdog CISR0: 0x80”) with the Bug Tracker ID CSCtf85481 - however, of the multiple accounts I had, I only found it on one of those. Other accounts did refuse my access to this file. As we confronted our Cisco Tech Support prior to finding the bug ourself, there was “no known error” which represented itself in rebooting the switch at random - so they said.

Cisco RAM Problem (Phone/Linecard)

Mon, 16 Jan 2017 09:00:28 +0000

As a matter of fact, I’ve been working for more than 8 years with Cisco equipment and continue to do so. I really like Ciscos products, especially in the router / switch sector and had the pleasure to work with products in the range of Switching, Routing, Communications / Phones, Wifi, Datacenter Connectivity and Security. However, I had 3 unpleasent events with Ciscos products and I want to take the time to talk about two of those, as they occured because of the same reason.

Cisco Prime Infrastructure 3.1 Cheat Sheet

Fri, 12 Aug 2016 07:18:30 +0000

A little cheat sheet for myself. All commands can be used via SSH or Shell:

Show Config: show run
Show Inventory: show inventory (Does show i.e. how many CPUs and RAM is installed. This does match normally to the Version of Cisco Prime. i.E. 8 vCPUs and 16 GB RAM -> Express Plus Type)

Show status of prime: ncs status

Backup OS and Application: backup PI311 repository defaultRepo
Backup Application only: backup PI311appOnly repository defaultRepo application NCS

[1841] Reset Password / Config, ROMMON Upgrade and Software Upgrade on Cisco 1841

Sun, 08 Feb 2015 15:35:45 +0000

1.) Reset Password / Config

Connect to the router via Serial Cable
Power on the router, but send a break during the first 60 seconds of boot time to get to the rommon CLI
enter confreg 0x2142 followed by a reset
Router is booting up, as soon as it does enter the system configuration dialog, answer the question with no
enable
conf t
config-register 0x2102
exit
wr mem (because I just want to overwrite the old config :)!)

2.) ROMMON Upgrade

IPv6 Primer \ Presentation

Wed, 14 Nov 2012 13:37:17 +0000

Following my work on IPv6/Dualstack EIGRP Routing on c3560 I did create an IPv6 Primer / Presentation for my staff and other technical interessted people. So if you are interessted in an little insight to my work and IPv6, feel free to download this file (German, about 1 MB): IPv6, Nico Maas (2012) PDF

[VSS] Upgrading Software on c6509e-VSS / Sup720-10GE

Thu, 14 Jul 2011 11:59:34 +0000

1.) Find an suitable image on cisco.com [i.e. s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin ]
2.) Copy the image to the CF of active Supervisor by TFTP or FTP

copy tftp://IP/images/s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin disk0:

3.) Verfiy the image against the MD5 and internal checksum

verify /md5 disk0:s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin  
verify disk0:s72033-adventerprisek9_wan-mz.122-33.SXJ1.bin

4.) Delete old Software on active Supervisor CF

del sw1-slot5-disk0:s72033-ipservicesk9_wan-mz.122-33.SXI5.bin

5.) Unconfigure other Boot Images

conf t  
no boot system  
config-register 0x2102  
boot system flash disk0:  
end  
copy running-config startup-config

6.) Reload active Supervisor

[IPv6] Dualstack EIGRP Routing on c3560

Wed, 29 Jun 2011 08:46:21 +0000

IPv6.

Everyone is talking about it.

And not too soon, ppl will need it.

As my corporation needs to switch to v6 soon, I’ll started to work into this hexadecimal notated nightmare ;-).

I’ll got some basic stuff written down already - but I’m not feeling like starting off IPv6 in my blog with too much boring theory.

So lets jump into a full blown network! ^^

Cisco PIX 506e Software Upgrade

Wed, 30 Mar 2011 12:49:48 +0000

Following the Hardware Upgrade, the Software needs to be renewed, too!
The latest PIX OS running on the 506e would be 6.3.5.125.
You can upgrade to that and use the pdm to configure the Device.
Or… you can go to ASA!
As described here ( http://www.rownet.co.uk/installing-v7-software-on-a-cisco-pix-506e/ ) you can do that quite easily.

But in short:

Boot into Pix
Start downloading an pdm file with copy tftp://Your_TFTP_Server_IP_Address/Your_pdmfile_name flash:pdm and disconnect the ethernet cable!
After disconnecting, the PIX will erase the pdm from your pix, clearing the flash space for pdm
clear flashfs
reload your PIX into Monitor Mode / RMON
activate your interface (interface 0 is E0, interface 1 E1)
enter ip addr of tftp server ( server ), filename ( tftp ), ip addr of your pix ( address ) and start downloading to pix
It will boot from tftp into ASA
Copy ASA Image: copy tftp://Your_TFTP_Server_IP_Address/pix712.bin flash:
Reload

Done, you got ASA.
No ASDM / PDM anymore, because not enough space, but ASA ^^

Cisco PIX 506e Hardware Upgrade

Sat, 19 Mar 2011 09:00:27 +0000

The Cisco PIX Series has been “the” well known and powerful firewall appliance of the last decade - and for some people, this decade ain’t over yet.
Cisco has released the successor “ASA” some years ago, but many people still got a PIX running.
Reasons are simple: The PIX Series has an Appliance for every problem and is rock solid.
My personal experience with that Firewall Series started with a “burned out” PIX 520 (that one is getting its own entry soon ^^).
After that, I got more into Security by doing my CCNA Security studies.
While doing the CCNAS I also bought the smallest PIX, the PIX 501 from Ebay for 70€ or so.
Sometime later, I discovered an dead PIX 506e in my Office - and I just couldn’t help myself and started taking it apart.

[79XX] Cisco IP Phone Factory Reset & Reboot

Wed, 08 Sep 2010 06:26:44 +0000

To Factory Reset a Cisco IP Phone do the following:

Press and hold #, disconnect and reconnect Power
The Phone will check through the Line LEDs, on an 7911 or similar it will just light up the both Menu Keys and the Reciever \ Handset LED - after that, let go of #
Enter following: 1 2 3 4 5 6 7 8 9 * 0 #
The Phone should start up and grab the latest config from your Callmanager

To just Reboot a Cisco IP Phone do following:

[CCNA] Cisco Networking Academy Material Error

Sun, 05 Sep 2010 10:37:43 +0000

If you open CCNA Material in the Internet Explorer, it does always Popup the Error that it doesn’t want to execute these Scripts as they might be dangerous. You can click that away and work with the Course Materials - but it just tends to go on to ones’ nerves. So to disable that: Internet Explorer, Extras, Internet Options, Advanced. Look for Security and enable “Execution of Interactive Content within Files on local Computer” and “Execution of Interactive Content within CDs on local Computer”.

[ATA186] How to Factory Reset / Update Firmware

Tue, 22 Jun 2010 06:50:37 +0000

Factoryreset:

Take phone off the hook
Press ATA Button
Dial 322873738# ( FACTRESET#)
Press * and again *
Hang up

IP Adress:

Take phone off the hook
Press ATA Button
Dial 80#

Version:
IP Adress:

Take phone off the hook
Press ATA Button
Dial 123#

Update:

Get Update Package
Run ata186us -any -d1 FirmwareFilename.zup
Take phone off the hook
Press ATA Button
Dial the Textstring the Program gives out ( i.e. 100#10*120*12*92*8000# -> 100#IP*in*Oct*et*Port# )
You’re done

Settings:
http://ipaddress/dev

Rooting CUCM7 & Giving BASH instead of the restricted CLI

Fri, 19 Feb 2010 13:03:55 +0000

Boot with gparted
cd /tmp
mkdir test
mount /dev/sda1 /tmp/test
chroot /dev/test /bin/bash
Change:

/etc/passwd:

root:x:0:0:root:/root:/sbin/nologin  
admin:x:591:503::/home/admin:/usr/local/platform/bin/cliscript.sh

to:

root:x:0:0:root:/root:/bin/bash  
admin:x:591:503::/home/admin:/bin/bash

/etc/shadow

root:!!:14657:0:99999:7:::

to:

root:$1$D2ISXWJF$urnCHPxcF20BUWWwvTZfX0:14657:0:99999:7:::

/etc/sudoers
add the Line for admin under the user privilege specification so that it looks like this:

# User privilege specification  
root    ALL=(ALL) ALL  
admin   ALL=(ALL) ALL

exit
cd /tmp
umount /tmp/test
umount /dev/sda1
reboot
login with admin and your password, you are in the bash shell, not in the cisco cli anymore
enter sudo su and your login password and you become root

XModem Flash Recovery of new c3560, c3560e, c3750, c3750e, etc...

Fri, 12 Feb 2010 16:47:32 +0000

Right at the moment I’m sitting in one of our wireclosets, watching an c3750 (hopefully) recovering its mind to its old function and behavior - through an XModem transfer of its current IOS. Because of an power failure on our campus the unit actually “bricked” - the flash system became corrupted and the unit did end up in the ROMMON Mode “switch:”.

Thats pretty bad - but not as bad as we couldn’t fix it.

Cisco AP1231 Autonomous LWAPP to Auto Downgrade

Tue, 09 Feb 2010 13:45:14 +0000

Downgrading an LWAPP Cisco Access Point which was used with this Wirless Controll System can be very time consuming. Can. Doesn’t need to. Cisco did some nice stuff to make life easier: An auto “downgrade” function. To use this you need to get following:

Tftpd32 Server or similar tftp Server
An autonomous IOS File for your Access Point (i.e. for the 1231 the file c1200-k9w7-tar.123-8.JEC.tar)

Setup your tftpserver and give it an ip out of the range 10.0.0.2 - 10.0.0.30 with the Subnetmask 255.0.0.0
Copy the IOS File to the tftpserver root, mostly called tftpboot in Linux
Rename the file from - for example c1200-k9w7-tar.123-8.JEC.tar to c1200-k9w7-tar.default
Plug in the Ethernet Port on your Access Point (direct Connection from PC to AP needs an Crossover Cable!), connect the AP also to the serial console if you want.
Press and hold the “Mode” Button on the AP and plug in power.
Wait until the orange blinking middle led turns solid red (ca. 30 sec) and then release the “Mode” Button
The AP will start downloading the firmware and reflash itself. DO NOT TURN IT OFF OR KILL THE CONNECTION!

c3560 Cheat

Thu, 27 Aug 2009 14:14:20 +0000

Hostname:

hostname test

Image Upgrade:

del /r /f flash:c3560-ipbase-mz.122-35.SE5  
copy tftp://192.168.2.1/images/c3560-ipbasek9-mz.122-46.SE.bin flash:

del - File
rm - Folder

Boot with other Image:

boot system c3560-advipservicesk9-mz.122-46.SE.bin

Portfast (on dhcpd Problems):

spanning-tree portfast

Switchport with Vlan 10:

interface FastEthernet0/1  
switchport access vlan 10  
switchport mode access  
description nativ  
macro description NATIV  
spanning-tree portfast

Description Vlan 10:

vlan 10 name testvlan

Trunkport:

interface GigabitEthernet0/1  
switchport trunk encapsulation dot1q  
switchport mode trunk  
ip dhcp snooping trust

DHCP Snooping:
Global Activate:

ip dhcp snooping vlan 1-4094  
no ip dhcp snooping information option  
ip dhcp snooping

Allow DHCP on Port:

c3560 Routing with Advanced IP Services

Thu, 27 Aug 2009 11:01:59 +0000

Problem: You got serval networks, you got an c3560 but no Router.
Solution: Get an c65e VSS
Following Problem: Insufficient Money, Power, Space,….
Solution: Get your c3560 to route these Networks with an Advanced IP Services Firmware
YOU DO NEED AN “advipservices” FIRMWARE ON YOUR c3560!

Assumption:
On f0/1 PC with 134.96.10.2 -> We want the Gateway to be 134.96.10.1
On f0/8 PC with 192.168.2.2 -> We want the Gateway to be 192.168.2.1

Using Cisco Vlans and Trunks on VMWare ESXi 3.5/4

Fri, 24 Jul 2009 07:17:40 +0000

Hello there,

are you one of these ppl using ESXi on a small server/pc under your desk to evaluate / develop software?
Are you one of these fitting the whole ESXi World into one machine, one one IDE / SATA drive and without any other VMWare Administrative Instances as your Vi\Vsphere Client? Are you one of these ppl that does not have one real 10 Gig Interface for each VM Machine into its server - but do desperatly need to connect an real pc to just one VM? No problem! Here we go! All we need is an Switch with vlan Trunking. I used an Cisco c3560-poe8 for this, as it is my main work switch.

c3560 DHCP Snooping

Thu, 16 Jul 2009 13:15:29 +0000

Global Activate:

ip dhcp snooping vlan 1-4094
no ip dhcp snooping information option
ip dhcp snooping

Allow DHCP on Port:

ip dhcp snooping trust

Using Spanningtree can cause Problems with DHCP, use portfast on Userside Ports, but NEVER on Trunk!