In this GNS3 topology, I have two routers, router 1 and router 2 which are connected to a
hub which in turn is connected to a cloud allowing me to have access to my local area network from these
two routers.
I've also got a Cisco iOS V layer 2 switch, which I haven't connected to other devices.
I'm going to talk briefly about locking down the console and then we'll discuss Telnet and SSH and
I'll use the same topology for those videos.
So firstly, I've connected to the console of this iOS V layer 2 switch and when I press enter, I'm
put into user mode and then I can type enable to go to privilege mode.
So exit, I'm shown that I'm on the console of the switch press enter and I am in user mode enable
and then I'm taken to privilege mode with no authentication.
I wasn't asked for a password.
In this example, I'm connecting to the console of a physical 3750 switch.
When I press enter, I'm put into user mode and once again, when I type enable, I can go to privilege
mode, but in this example, the switch is prompting for a password.
So notice the user experience is the same on a physical switch versus a virtual switch running in GNS
3.
So as an example, if I type enable password Cisco and then exit out of the switch,
press enter, I'm in user mode,
type enable, and now I have to enter a privilege password or secret password to go to privilege mode,
same as a physical switch.
Notice, please
I was not prompted for a password to get to user mode.
I was only prompted for a password when I typed enable.
There is no password by default on the console of a switch
or router, show run shows a lot of configuration, and if I scroll all the way down to the bottom,
I'll see a line like this line console 0.
So that's the console port of the switch.
I can put a password on that, by typing password and specifying some kind of password.
So I'm going to say Cisco and then I'm going to type login to indicate that we're using the password
on the line.
Not a local username and password database, so I'm going to say show run pipe begin con
or rather, con 0.
So as you can see, this is the configuration on the console, typed password Cisco
and login, type exit. Now in a press center, I'm asked for a password to get to user mode and then enable
will take me to privilege mode.
Now, I could create a local username and password database, so let's do something like this.
That makes no difference, however, in the current configuration, when logging out and pressing enter
I still have to put in my password of Cisco to get to user mode
and I have to put a password in to go to global config mode, and that's because at the moment,
the console is configured with password Cisco and login, if I changed that to line console 0
and type login local.
Notice the difference now when I type, exit and press enter.
I'm now asked for a username and a password, and now I gain access to user mode and then I have to type
enable
and my enable password or secret password to go to privilege mode, I can change that again by typing
username David whatever the user is, and using the privilege command.
So privilege and specifying the privileges of that user.
So I'll exit out of here.
press enter prompted for my username, prompted for my password, and notice I am taken immediately to
privilege mode, and that's because on the user.
In this case, David, a privilege of 15 was applied, so the user immediately gets full rights to the
switch upon login.
We don't have to type, enable and then password to go to the enable mode. Show run pipe again line con,
line con, rather.
Notice line console 0 has the command password Cisco, that's irrelevant now, so I could actually
remove that
and that's because login local is being used.
So show run, pipe begin line console or line con, I've only got login local on the line, type
exit, press enter, asked for my username straight into privilege mode.
So the password on the line is only used if logging is used.
Notice if I don't have a password and I specify login, I'm told that login is disabled until a password
is set.
So let's try that,
press enter I'm straight into user mode, exit press enter straight into user mode and I'm now asked to enter
and enable password.
So if I want to put that back to the way it was previously, on the line console, I need to specify a
password
and now when I login, I'm asked for the password on the line as well as my privileged password.
So just to recap,
login indicates that a password on the line is required to gain access to the console of a router or switch.
If you don't specify a password, login is ignored and you go straight into user mode.
If you specify login local here, the local username and password database is used.
So you'd be asked for your username as well as your password when logging into the console.
If you specify privilege and a privilege level, you don't have to put an enable password in you're taken
straight to the privilege level associated with your user account,
in this case, it's 15.
Now, if you want to play a trick on someone and I don't suggest you do this in production.
A console has an exact time out in minutes and in seconds you could specify something like this, so
exact time out 01 means that it'll time out after 1 second.
So notice when I press enter and try and gain access to my router, one second later I'm logged out.
So what you need to do to make this work or to fix this is you have to type very quickly or continually
press tab.
So I'm going to press tab with my one finger.
So it's continuously updated and then I'm going to try and type with my other finger
and try and specify the command required, so as you can see, I'm making a lot of typing mistakes,
but that's okay as long as I keep pressing tab.
So once again, this is not something you want to do, but if you do make a mistake, you should specify
00 as an example, which means don't time out.
So now I'm not logged out of the console.
You probably want to set that to some value that's realistic for your environment.
So, say, 5 minutes after 5minutes of inactivity, you'll be logged out of the console.
Another great command on a router is logging Synchronoss.
If I start typing a command like show IP interface brief, you'll notice the command is all over the
place and I have to press tab to see my command.
So once again, if I typed CONFT and press control Z and then type start typing Hello, you'll notice
it's all over the place.
Press tab.
My command is shown again.
So what we want to do is on the line console.
We want to use the command logging Synchronous, so line console 0 logging
synchronous.
Notice the difference now when I press control Z and then type hello, hello is automatically retyped.
So it becomes a lot easier to type commands and see what you're doing when you're getting a lot of output
on the screen, especially when doing debugging.
So don't forget the logging synchronous option on the console.
It's going to save you a lot of trouble.