pscp file to cisco router

I was trying to copy files to a cisco ASR 1001x router.

I was having issues due to internal FW rules etc. I could SSH so probably SCP would work.

I needed to enable the following command on the ASR router

ip scp server enable

However it still wasn't working.

I needed to run the pscp command on my server with the files with the -scp switch to force the old protocol

pscp -scp filename.bin username@x.x.x.x:filename.bin

I had to fill in the second filename.bin for the destination otherwise it would not work

enable advipservices license on ASR 1001-X

Check if its available in your image:

show license all

StoreIndex: 1   Feature: advipservices                     Version: 1.0

        License Type: EvalRightToUse

        License State: Active, Not in Use, EULA not accepted

            Evaluation total period: 8  weeks 4  days 

            Evaluation period left: 8  weeks 4  days 

            Period used: 0  minute  0  second  

        License Count: Non-Counted

        License Priority: None

Enable the license level you need, needs a reboot:

conf t

license boot level advipservices

Once you changed the boot variable, the CLI will ask you to change and accept the EULA agreement, so you need to enter YES, and then save configuration and perform a reload on the ASR.

Once the ASR boots up again, you should now see that the license level is advipservices and you can confirm that using the command “Router# show version | i Lice”

EVAL license will last for 60 days after that it will switch to right to use. You should buy the right license from cisco but it sounds like RTU will continue to work without but I have not tested it.

move from type 5 or 7 passwords to type 9 on cisco router

username admin algorithm-type scrypt secret cisco

(this is type 9 and best at time of writing) 

critical light on cisco router ASR 1001 x

Router was working fine but critical light on the front

Run:
sh facility-alarm status

Output:
Source                     Time                   Severity      Description [Index]
------                     ------                 --------      -------------------
xcvr container 0/0/0       May 02 2018 07:57:09   INFO          Transceiver Missing [0]
xcvr container 0/0/1       May 02 2018 07:57:09   INFO          Transceiver Missing [0]
xcvr container 0/0/5       May 02 2018 07:57:09   CRITICAL      Transceiver Missing - Link Down [1]
xcvr container 0/0/6       May 02 2018 07:57:09   INFO          Transceiver Missing [0]
xcvr container 0/0/7       Jul 05 2018 03:51:37   INFO          Transceiver Missing [0]
GigabitEthernet0           May 02 2018 07:57:06   INFO          Physical Port Administrative State Down [2]

However xcvr container 0/0/5 does not match up to gig0/0/5 as you might assume. I looked around the configured interfaces and found there was a port that was admin up but line down. It was a test port someone in IT had configured for their laptop.

Run
sh ip int br

Output:
GigabitEthernet0/0/0   x.x.x.x   YES NVRAM  up                    up    
GigabitEthernet0/0/1   y.y.y.y YES NVRAM  up                    up    
GigabitEthernet0/0/2   z.z.z.z      YES NVRAM  up                    up    
GigabitEthernet0/0/3   a.a.a.a     YES NVRAM   down down

We can see gig0/0/3 is the problem.

Fix
int gig0/0/3
shut

The critical light on the front went off. The problem was  we  had an interface configured and "no shut" but no cable plugged in.

setting up syslog on cisco router

Send commands typed to syslog
archive
 log config
  logging enable
  notify syslog contenttype plaintext
  hidekeys

Send debugging logs to syslog
Send our origin id as our ip
Set facility to local0
Set source interfaces to gig0/0
Set logging host IP address of the syslog server
Switch logging on for all destinations
logging trap debugging
logging origin-id ip
logging facility local0
logging source-interface GigabitEthernet0/0
logging host x.x.x.x
logging on

Make sure your have routes to your syslog server
Also firewall rules, you need syslog (udp 514 open)

packet capture on cisco router/switch

*** Setup ACL
ip access-list extended CAP_ACL
permit ip host x host y

*** Setup buffer
monitor capture buffer CAP_BUFF circular

*** Filter the buffer with the ACL
monitor capture buffer CAP_BUFF filter access-list CAP_ACL

*** Setup the cap point and on what interface
monitor capture point ip cef CAP_POINT fa0/0 both

*** Assign the buffer to point
monitor capture point associate CAP_POINT CAP_BUFF

*** Show the setup
show monitor capture buffer CAP_BUFF

*** Start the cap
monitor capture point start CAP_POINT

*** Send the test traffic
send test traffic ping or telnet on the port etc

*** Stop the cap
monitor capture point stop CAP_POINT

*** show brief
show monitor capture buffer CAP_BUFF brief

*** export the capture to tftp server
monitor capture buffer CAP_BUFF export tftp://10.50.50.22/mycap.pcap

*** Open the pcap in wireshark

For 3850 - but it didn't work for me

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/xe-16/epc-xe-16-book/nm-packet-capture-xe.html#GUID-DCB20ADF-1F8E-434B-AE97-54802879F34F

static port nat on cisco router

Label your interfaces
int dialer 1
ip nat outside

int inside
ip nat inside

ip nat inside source static tcp 192.168.4.10 8080 interface dialer 1 8080


This will nat the public IP of dialer1 port 8080 to 192.168.4.10 port 8080

configure netflow on cisco router

flow record NETFLOW_RECORD
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 match flow direction
 collect interface output
 collect counter bytes long
 collect counter packets long
!
!
flow exporter NETFLOW_EXPORT_TO_SOLARWINDS
 destination x.x.x.x
 source GigabitEthernet0/0
 transport udp 2055
!
flow monitor NETFLOW_MONITOR
record NETFLOW_RECORD
exporter NETFLOW_EXPORT_TO_SOLARWINDS
cache timeout active 60
cache timeout inactive 15
!
interface gig0/1
ip flow monitor NETFLOW_MONITOR input
ip flow monitor NETFLOW_MONITOR output
!
captures all incoming traffic
route or shortest path

Allow ssh access to a cisco router

Since you don't have ssh already setup you'll probably need to connect with the console cable

Stop the annoying logs interrupting you on the console
line con 0
logging sync

Setting up a host name and domain name on the router
conf t
hostname R1
ip domain name example.com

Generate your keys
conf t
crypto key generate rsa
Key length should be 1024 (Need at least 1024 for ssh version2)

Configure a username and password
username admin priv 15 secret mypassword
password mypassword will be stored in plain text
secret mypassword will be stored in md5 hash

Enable aaa
aaa new-model (make the router ask for a username and a password)

enable secret myenablepw

Turn off telnet
line vty 0 4 (on router)
line vty 0 15 (on switch)
line vty 0 4
transport input ssh

Named Access-list
*** Important to type ip in front of access-list if you are used to ASA ***
*** Don't for get to look for access lists under the vty lines ***
ip access-list extended MYACL_NAME permit tcp host s.s.s.s host d.d.d.d eq 22
int g0/0
ip access-group MYACL_NAME in

Numbered Access-list
access-list 150 permit tcp host s.s.s.s host d.d.d.d eq 22
int g0/0
ip acccess-group 150 in

Example ACL

ip access-list extended OUTSIDE_IN

    10 permit tcp host x.x.x any

    20 permit tcp host y.y.y.y any

    30 permit tcp z.z.z.z 0.0.0.15 (networks need to be added with wildcard)

    200 deny ip any any log

interface Dialer1

ip access-group OUTSIDE_in in