Port Forwarding a Range of Ports on Cisco IOS

One question that routinely comes up in a particular forum that we frequent is “How do I port forward a range of ports?”  Usually, this question is met with one of two answers:  1) you don’t, or 2) manually enter 10000 “ip nat …” statements.

The correct answer is actually number three.  It turns out that it is, indeed, possible to forward a range of ports in IOS.  We tested this in our lab and everything works just as we would want it to.  Here’s the topology:

We have a single router that we’re using.  The RFC1918 address block 192.168.0/24 is being used internally, and the router will NAT all internal addresses to its public address, 198.18.0.1, as it forwards it out FastEthernet 0/0.

The PC at 198.18.0.50 will represent a host on the Internet, attempting to access services on the PC at 192.168.0.50.  Since 192.168.0.50 falls in the RFC1918 address space, we’ll need to use Port Address Translation (PAT), or “port forwarding”, on the router.  This is nothing new and most of us probably do it all the time.  The problem arises, however, when we want to forward a large number of ports — typically ports 10000-20000 for Voice over IP (VoIP).

As we mentioned, there is a way to do this, and it’s easier than you think.

First, set up your basic NAT configuration (“ip nat inside”, “ip nat outside”, etc.).  Check out “Configuring Basic NAT with overloading”, if necessary.

Next, let’s create an IP NAT pool, for a single IP address (the IP address of the internal host, 192.168.0.50):

R6(config)# ip nat pool PORTFWD 192.168.0.50 192.168.0.50 netmask 255.255.255.0 type rotary

Then, create an access list (ACL) matching the ports you want forwarded.  In the case of 10000-20000/UDP for VoIP, we can use the “range” keyword to simplify things for us tremendously:

R6(config)# access-list 100 permit udp any any range 10000 20000

Last, we’ll tie our access-list 100 to the PORTFWD NAT pool that we created:

R6(config)# ip nat inside destination list 100 pool PORTFWD

Now, any UDP traffic coming into our router’s public interface (FastEthernet 0/0) with a destination port between 10000 and 20000 will be forwarded to the host at 192.168.0.50.  I was able to verify this by generating UDP traffic on my MacBook and having the router forward it to another laptop with a tcpdump capture up and running — it worked wonderfully.  I was running 12.4(10a) on a 2621XM.  Try it out and let me know if it works for you as well!

How to Set Up PAT (Port Address Translation) in the Cisco IOS?

PAT (Port Address Translation) is a special kind of Network Address Translation (NAT). It can provide an excellent solution for a company that has multiple systems that need to access the Internet but that has only a few public IP addresses. Let's take a look at the distinctions between NAT and PAT and see how they are typically used. Then, we will show you how to configure PAT on a Cisco router.

Understanding PAT and NAT

It is helpful to describe what NAT does in general before discussing PAT. NAT was designed to be a solution to the lack of public IP addresses available on the Internet. The basic concept of NAT is that it allows inside/internal hosts to use the private address spaces (10/8, 172.16/12, and 192.168/16 networks—see RFC1918), go through the internal interface of a router running NAT, and then have the internal addresses translated to the router's public IP address on the external interface that connects to the Internet.

If you dig into NAT a little deeper, you will discover that there are really three ways to configure it. From these configurations, you can perform a variety of functions. The three configurations are:

PAT
PAT is commonly known as “NAT overload” (or sometimes just “overload”). In this configuration, you have multiple clients on your inside network wanting to access an outside network (usually the Internet). You have few public IP addresses, many more than the number of clients, so you have to “overload” that real Internet IP address. In other words, you are mapping many inside clients to a single Internet IP address (many to one). For an illustration of PAT, see Figure as follows.

 

Pooled NAT
Pooled NAT is similar to PAT except you have the luxury of having a one-to-one mapping of addresses. In other words, you have just as many inside network clients as you do outside network IP addresses. You tell the NAT router the pool of IP addresses that are available, and each client receives its own IP addresses when it requests a NAT translation. The client does not get the same address each time it requests a translation; it merely gets the next available address from the pool. In the article "Set up NAT using the Cisco IOS", which explained how to configure Pooled NAT. For an illustration of Pooled NAT, see the following Figure.

 

Static NAT
Static NAT is the simplest form of NAT. The most likely example is a mail server on the inside of a private network. The private network connects to the public Internet. In between the two networks, a router performs NAT. For a dedicated server, like a mail server, you would want a static (not changing) IP address. This way, every time someone on the Internet sends e-mail to the mail server, that server has the same public IP address. For an illustration of Static NAT

 

You can perform a variety of functions with these three configurations. For the purpose of this article, we will focus on configuring PAT.

Configuring PATTo configure PAT/NAT correctly the first time, you need to understand the Cisco NAT terminology and how your IP networks/addresses map to each of the entities listed below:

• Inside Local—This is the local IP address of a private host on your network (e.g., a workstation's IP address).
• Inside Global—This is the public IP address that the outside network sees as the IP address of your local host.
• Outside Local—This is the local IP address from the private network, which your local host sees as the IP address of the remote host.
• Outside Global—This is the public IP address of the remote host (e.g., the IP address of the remote Web server that a workstation is connecting to).

You'll configure your Cisco router using seven commands. Let's assume that your Internet service provider gave you a 30-bit network containing two public IP addresses. This configuration would allow one address for your router and one address for your internal clients and devices. The first command you'll execute will tell the router which public IP address you want to use for PAT:
ip nat pool mypool 63.63.63.2 63.63.63.2 prefix 30

This command configures a pool (range) of IP addresses to use for your translation. In this case, we want only one address in our pool, which we will overload. We do this by assigning the same IP address (63.63.63.2) for the start and end of the pool.

The next command will tell your router which IP addresses it is allowed to translate:
access-list 1 permit 10.10.10.0 0.0.0.255

It's not a good idea to put “permit any” in the access list, even though you will occasionally see that as a recommendation in some sample configurations.

The next command is:
ip nat inside source list 1 pool mypool overload

This command puts the pool definition and the access list together. In other words, it tells the router what will be translated to what. The overload keyword turns this into a PAT configuration. If you left out overload, you would be able to translate only one IP address at a time, so only one client could use the Internet at a time.

Next, you need to tell PAT/NAT what interfaces are the inside network and what interfaces are the outside network. Here's an example:
interface ethernet 0
ip nat inside
interface serial 0
ip nat outside

With these commands, your PAT configuration is finished. You have told the Cisco IOS you are translating your network A into a single IP address from network B, that network A is on the ethernet 0 interface and network B is on the serial 0 interface, and that you want to allow the inside network to overload the single IP address on the outside network.

Finally, verify that NAT works. This can be as simple as doing a ping command from your inside local host to an outside global host. If the ping succeeds, chances are you have everything configured correctly. You can also use the following Cisco IOS commands to confirm and troubleshoot:
show ip nat translations [verbose]
show ip nat statistics

With the translations command, you should see the translation that was created from your ping test. But watch out: The translations will disappear after their time-out expires. If you have configured overload, these time-outs are configurable by traffic type.

NOTE: You should now understand the differences between PAT, Pooled NAT, and Static NAT, and you should be able to do a basic PAT configuration with the Cisco IOS. For more information, check out the links below.

How to Set up NAT Using the Cisco IOS?

Network address translation (NAT) is one of those rare information technology buzzwords that do exactly what its name implies. In this case, it translates one network address into another network address. The most popular use for NAT is to connect an internal network to the Internet. The proliferation of hosts that now connects to the Internet is causing a shortage of IP addresses, so NAT is a key tool for connecting corporate networks using private IP addresses to the Internet. Since Cisco provides the bulk of the routers that connects to the Internet, we’re going to show you how to set up NAT using the Cisco Internetwork Operating System (IOS).

Understanding NAT

Using NAT to connect to the Internet allows you to:

·Use only one public, registered IP address for Internet access for many thousands of private IP addresses at your site.

·Change Internet service providers (ISPs) easily, without readdressing the majority of hosts on your network.

·Hide the identity of hosts on your local network behind the single public IP address to keep outside hosts from easily targeting them.

The most difficult part of using NAT in the Cisco IOS is getting a handle on these four key terms:

·Inside Local—This is the local IP address of the private host on your network (i.e., your PC’s IP address).

·Inside Global—This is the public, legal, registered IP address that the outside network sees as the IP address of your local host.

·Outside Local—This is the local IP address from the private network, which your local host sees as the IP address of the remote host.

·Outside Global—This is the public, legal, registered IP address of the remote host (i.e., the IP address of the remote Web server that your PC is connecting to).

My first reaction after reading Cisco’s definitions for these terms was nearly total confusion, so don’t feel bad if you feel the same thing. But after seeing a diagram of these terms, it started to click for me. Take a look at Figure A for a logical diagram of these terms.

Figure A

Configuring NAT

To configure the standard NAT scenario I mentioned in the opening paragraph, refer to Figure B and then look at the simple steps that need to be taken if you are using a Cisco router between your local network and the Internet.

Figure B

·Configure your pool of legal, public IP addresses that the router can use to represent your local addresses on the Internet. This pool can contain as few as one or as many addresses as you would like to provide. For a small to medium-size network, one address is typically fine. The syntax is:

ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}

·Define an access-list to specify what range of IP addresses is allowed to be translated from your local network to the remote network. This is, basically, a security feature asking you, “Who (what range of IP addresses) can use the NAT service?” The syntax is:

Access-list access-list-number permit source [source-wildcard]

·Specify that you want a dynamic translation from the source IP address to the pool and that you want to overload the pool address (or addresses). The syntax is:

ip nat inside source list access-list-number pool name overload

·Specify which of the router’s interfaces will be the “inside” address. The syntax for the Ethernet 0 interface is:

int en0

ip nat inside

·Specify which of the router’s interfaces will be the “outside” address. The syntax for the Serial 0 interface is:

int s0

ip nat outside

·Add a static route to your router to send any traffic not destined for your local network to the Internet interface. (In our case, I will use a default route to send traffic out the serial interface.) Here’s the syntax:

ip route 0.0.0.0 0.0.0.0 serial0

Listing A shows the resulting configuration for the router. One way to examine this on your router would be to issue the command show run.

More Notes:

How is this Possible?

This configuration would allow any host on your local network (such as a desktop PC) to connect to the Internet using the single registered IP address that is being overloaded. Thus, any traffic from that local PC will have the source IP address of the router’s external interface.

If you think about this for a minute, you might wonder how multiple hosts can share the same IP address in the overload configuration, since we are taught that one IP address is assigned to one host and there is no sharing (any more than there is sharing of a social security number).

The answer to that question is that NAT gets around this rule by making an entry in a translation table for every host using a port. In this translation table, there is a map between the inside local, a port on the inside global, another port on the outside local and the outside global. By assigning these ports and keeping track of them in the table, the router is able to “overload” a single IP address with multiple hosts. This allows them to share a single IP address among them.

How to Configure NAT in Cisco IOS?

NAT (Network Address Translation), it in simple terms translates an IP address into another. Network Address Translation is of different types like

Static NAT (One to One)

Dynamic NAT (Many to Many)

Overloading (Many to One)

The main purpose of NAT is to hide the IP address (usually private) of a client in order to reserve the public address space. For example a complete network with 100 hosts can have 100 private IP addresses and still be visible to the outside world (internet) as a single IP address. Other benefits of NAT include security and economical usage of the IP address ranges at hand.

We will focus on Overloading form of NAT. This is called as Port Address Translation (PAT) or even Network Address Port Translation (NAPT). NAT Overloading translates many private IP addresses from a Local Area Network (LAN) onto a single registered legal Public IP address. Here, the source IP and the source port get translated to the Public IP and a different source port.

Typical network configuration would be on an Internet Router which enables all the hosts in the LAN to connect to the Internet using one single Public IP address.

The following procedure will help you to configure NAT Overload or Port Address Translation (PAT) in Cisco IOS:

NAT Inside Interface

Enable an interface on the router with an IP Address and mark it as nat inside interface. This is the interface that connects to your internal private network

WANRouter(config)# int fastethernet0/1

WANRouter(config-if)# ip address 192.168.1.1 255.255.255.0

WANRouter(config-if)# ip nat inside 

Enable NAT Outside Interface

WANRouter(config)# int serial0/0/0

WANRouter(config-if)# ip address 100.100.100.100 255.255.255.0

WANRouter(config-if)# ip nat outside

Configure NAT Pool

This will be a pool of legal Public IPs that is bought by the organisation. This could anything from one to many IP Address

WANRouter(config)# ip nat pool WANPOOL 100.100.100.10 100.100.100.10 netmask 255.255.255.0

This creates pool which has just one IP address. The syntax is

ip nat pool <pool name> startip endip {netmask netmask | prefix prefix-length}

Access List to Allow List of IP Addresses to NAT Translate

WANRouter(config)# ip access-list 10 permit 192.168.1.0 0.0.0.255

For more networks or hosts to overload the NAT pool simply add them to the access list

WANRouter(config)# ip access-list 10 permit 192.168.2.0 0.0.0.255
WANRouter(config)# ip access-list 10 permit 192.168.3.0 0.0.0.255

Instruct Router to NAT the Access list to the NATPool

WANRouter(config)# ip nat inside source list 10 pool WANPOOL overload

If this is an internet configuration then ensure that a default route on the IP to the outside IP address or outside interface

WANRouter(config)# ip route 0.0.0.0. 0.0.0.0 serial0/0/0

or

WANRouter(config)# ip route 0.0.0.0 0.0.0.0 100.100.100.100

Thats it. Job done!!!

The NAT setup is now complete.We have setup the router to translate LAN private IPs into the Internet public IPs.

To check the NAT status and statistics

WANRouter# show ip nat statistics

To see the active translations

WANRouter# show ip nat translations

We discussed NAT Overloading above: Cisco IOS NAT configuration. Here, we will configure a Static NAT on Cisco IOS Routers. Static NAT is rather straight forward as it is a one to one NATing between IP addresses as against the NAT Overloading or the Dynamic NAT where the IP addresses from the inside are NATed to a pool of IPs.

NAT Inside Interface

Enable an interface on the router with an IP Address and mark it as Nat inside interface. This is the interface that connects to your internal private network

WANRouter(config)# int fastethernet0/1

WANRouter(config-if)# ip address 192.168.1.1 255.255.255.0

WANRouter(config-if)# ip nat inside

Enable NAT Outside Interface

WANRouter(config)# int serial0/0/0

WANRouter(config-if)# ip address 100.100.100.100 255.255.255.0

WANRouter(config-if)# ip nat outside

Instruct Router to NAT the Source IP Address to that of a NATed IP.

WANRouter(config)# ip nat inside source static 10.1.1.11 172.1.1.11

WANRouter(config)# ip nat inside source static 10.1.1.12 172.1.1.12

WANRouter(config)# ip nat inside source static 10.1.1.13 172.1.1.13

Where 10.1.1.x IPs are NATed to 172.1.1.x

The syntax is

ip nat inside source static x.x.x.x y.y.y.y

That sets up the Static NATs. These can co-exist along with NAT Overloading or Dynamic NATs.

To Check the NAT Status and Statistics

WANRouter# show ip nat statistics

To See the Active Translations

WANRouter# show ip nat translations

Cisco IOS, The World’s leading Network Infrastructure Software

Cisco IOS (originally Internetwork Operating System) is the software used on the vast majority of Cisco Systems routers and current Cisco network switches. (Earlier switches ran CatOS.)

IOS is a package of routing, switching, internetworking and telecommunications functions tightly integrated with a multitasking operating system.

The IOS CLI provides a fixed set of multiple-word commands — the set available is determined by the “mode” and the privilege level of the current user. “Global configuration mode” provides commands to change the system’s configuration, and “interface configuration mode” provides commands to change the configuration of a specific interface. All commands are assigned a privilege level, from 0 to 15, and can only be accessed by users with the necessary privilege. Through the CLI, the commands available to each privilege level can be defined.

Cisco IOS is versioned using three numbers and some letters, in the general form a.b(c.d)e, where:

a is the major version number.

b is the minor version number.

c is the release number, which begins at one and increments as new releases in the same a.b train are released.

d (omitted from general releases) is the interim build number.

e (zero, one or two letters) is the release train identifier, such as none (which designates the mainline, see below), T (for Technology), E (for Enterprise), S (for Service provider), XA as a special functionality train, XB as a different special functionality train, etc.

Most Cisco products that run IOS also have one or more “feature sets” or “packages”, typically eight packages for Cisco routers and five packages for Cisco network switches. For example, Cisco IOS releases meant for use on Catalyst switches are available as “standard” versions (providing only basic IP routing), “enhanced” versions, which provide full IPv4 routing support, and “advanced IP services” versions, which provide the enhanced features as well as IPv6 support.

Each individual package corresponds to one service category, such as IP data, Converged voice and data, Security and VPN. More info visit White Paper: Cisco IOS and NX-OS Software Reference Guide

A&Q about Cisco IOS (from Yahoo Answer)

Q: Help needed to upgrade my cisco switch ios?

I have connected my switch via console cable, I have set up a tftp server on my PC when I try to update the ios it keeps timing out.

A: First, your computer with the tftp server and the switch need to be connected via the network. When the switch pulls the image, it’s not through the console cable, but rather an ethernet port.

Second, your new IOS image needs to be in the correct folder on your local hard drive so the tftp server can reach the file and serve it to clients that ask. This varies greatly by tftp server, so I can’t give you clear directions for how to do this.

Third, your switch needs an IP address assigned to a vlan interface. Typically, vlan 1 is used, but more advanced users can use a different one. The configuration usually looks like:

configure terminal

interface vlan 1

ip address w.x.y.z 255.255.255.0

no shut

end

To do a little troubleshooting, try pinging your computer from the switch and then ping the switch from your computer. Due to firewalls, this may or may not work, but it’s a good tool.

Lastly, once you are sure that connectivity is in place, you issue the command “copy tftp flash” from the switch. The switch will ask you the IP address of the tftp server, then the filename, and then it will probably ask you if you want to erase the flash. You should usually press “enter” to confirm “yes” to erase the flash, otherwise you’ll run out of room in the memory. If you do not receive the question to erase the flash, that means there is a connectivity issue.

Hope this helps.

Source(s): http://www.cisco.com/en/US/products/hw/switches/ps700

Q: How I can install IOS into cisco switch 3560 series?

In my cisco switch 3560 series hasn’t IOS system and I cann’t into priveleged EXEC mode. “enable” function cann’t run!

A: The first thing you need to do is recover the password so you can “enable” privileged mode – you need to “break” as the switch is about to load…

1/ Put the new IOS onto a tftp server (if you don’t have one, google for “tftp server free download”).

2/ Get the switch onto the same network as your tftp server.

3/ decide if you have enough room in either flash or RAM (depending on your switch) and

copy tftp flash

What’s the Order of Operations for Cisco IOS?

What’s the order in which IOS processes the running config between the following items?

ACL

Distrubute list,

Route map

Routing Protocol

Routing

What im looking for is the packet flow when it arrives thru an interface for better understanding?

Does it go to acl first then nat then routing logic then routing table…?

or

Is it something like…this is the running config…if something doesnt work check these areas: ACL Dist list Route map, Routing protocol routing table, etc, not necessarily in a particular order

What’s the way a CCIE thinks?”

—Q from the Cisco Learning Network

The Cisco IOS order of operations plays an important role in how a router processes traffic. The order of operations tells the router how to process traffic according to the configuration of different router features.

If you’re simply using the most basic features of the router, chances are good that you’ll never have to think about the order of operations. However, when configuring features such as Network Address Translation (NAT), Quality of Service (QoS), and encryption, it’s essential to understand the order of operations in order to configure these features successfully.

Using the Cisco IOS actually involves two different orders of operations tables: the NAT Order of Operations and the QoS Order of Operations. Let’s take a look at each.

NAT Order of Operations

Before you can understand the NAT Order of Operations list, you first need to understand NAT. In its most basic form, NAT translates one IP address to another IP address.

When the router uses this order of operations, it takes the inbound packet, starting at the top and moves down the list. If the packet is from a NAT inside-designated interface, it uses the inside-to-outside list. If the packet is from an outside-to-inside interface, it uses that list.

Here’s the order of operations for the inside-to-outside list:

• If IPSec, then check input access list
• Decryption—for Cisco Encryption Technology (CET) or IPSec
• Check input access list
• Check input rate limits
• Input accounting
• Policy routing
• Routing
• Redirect to Web cache
• NAT inside to outside (local to global translation)
• Crypto (check map and mark for encryption)
• Check output access list
• Inspect context-based access control (CBAC)
• TCP intercept
• Encryption

Here’s the order of operations for the outside-to-inside list:

• If IPSec, then check input access list
• Decryption—for CET or IPSec
• Check input access list
• Check input rate limits
• Input accounting
• NAT outside to inside (global to local translation)
• Policy routing
• Routing
• Redirect to Web cache
• Crypto (check map and mark for encryption)
• Check output access list
• Inspect CBAC
• TCP intercept
• Encryption

More details in a larger diagram

Let’s say that you have an IP packet coming in from an outside-to-inside interface. When translating that packet, you want to use an access control list to block traffic from certain IP addresses. Which IP address should you put in the ACL—the IP address before the packet’s translation (i.e., the public IP address), or the IP address after the packet’s translation (i.e., the private address)?

By checking the order of operations, you can determine that the “NAT outside to inside” operation occurs after the “Check input access list” task. Therefore, you would use the public IP address in the ACL because the packet hasn’t gone through NAT.

On the other hand, what if you want to create a static route for traffic going through NAT? Should you use the public (outside) or private (inside) IP address? In this case, you would use the private (inside) IP address because the traffic has already gone through NAT when it gets to the “Routing” operation.

QoS Order of Operations

The Quality of Service (QoS) order of operations is another important list to know. Of course, this is only really important if you’re using QoS. But if you are, you need to be familiar with it.

Here’s the order of operations for inbound traffic to the router:

• QoS Policy Propagation through Border Gateway Protocol (BGP)—or QPPB
• Input common classification
• Input ACLs
• Input marking—class-based marking or Committed Access Rate (CAR)
• Input policing—through a class-based policer or CAR
• IPSec
• Cisco Express Forwarding (CEF) or Fast Switching

Here’s the order of operations for outbound traffic from the router:

• CEF or Fast Switching
• Output common classification
• Output ACLs
• Output marking
• Output policing—through a class-based policer or CAR
• Queueing—Class-Based Weighted Fair Queueing (CBWFQ) and Low Latency Queueing (LLQ))—and Weighted Random Early Detection (WRED)

Being familiar with the order of operations is vital when it comes to understanding how the traffic within a router is flowing and how to control that traffic. In my experience, the NAT order of operations is most important when you’re using any combination of NAT, crypto, ACLs, routing, or other features on the list.

Without a proper understanding of the order of operations, you can spend an entire week troubleshooting a basic NAT and ACL combination—without any luck. Knowing about the order of operations can really make a difference.

Top 10 Cisco IOS Configuration Mistakes

There are a number of common mistakes that are made while learning something about Cisco IOS. In this article it covers the largest of these misconfiguration. This list is of course subjective, but it should provide a good reference for those learning Cisco IOS.

Cisco IOS Configuration Mistakes You May Commonly Make

1. Password Verification

One easily made mistake comes with the way that passwords are configured with IOS. Unlike almost every other password configuration tool available, the password commands on IOS do not confirm the password being entered. Imagine getting a new piece of equipment configured and put into the field, then later when remote management is required, attempting to access the device only to learn that the password was entered incorrectly. In most cases, the only way to fix this is to have you or someone else physically on-site. Take care when configuring IOS passwords to ensure the password is entered correctly.

2. Wildcard Masks

Of the many people that learn IOS, a large number don’t quite understand the concept of a wildcard mask (or a mask generally). It can be difficult enough to learn the fundamentals of a simple subnet mask; add in access lists (ACL) and Open Shortest Path First (OSPF) configurations, and throw in wildcard masks. The thing to remember about wildcard masks is, like subnet masks, they are easier to grasp when using binary. A wildcard in binary is just the inverse of the subnet mask; e.g. the subnet mask 255.255.255.0 uses an inverse mask of 0.0.0.255.

3. Clock Rate vs Bandwidth

Another topic that is often the center of confusion when learning IOS is the difference between clock rate and bandwidth. While practically these two would seem to mean the same thing, but when configuring IOS they are used for two different tasks. The clock rate command is used to set the physical speed of an interface (typically serial interfaces). The bandwidth command is used to set the bandwidth of the interface as used by a couple of system processes, including interface statistics and routing protocol metrics. This command is not used in any way to affect the physical speed of an interface.

4. Telnet vs SSH

For those new to networking, they may not know the major difference between using Telnet or SSH (Secure Shell) to manage a device. For many IOS devices, Telnet is used as the default remote management method. The problem with this is that Telnet is not a secure management method — often IOS devices are placed into easily accessed networks and the use of Telnet makes the capture of management passwords very simple (as they are transmitted in cleartext). Always take the time to implement SSH on any production IOS device that is going to be accessed remotely.

5. Ethernet Duplex

It can be easy to overlook the Ethernet duplex setting since on many devices it is configured to be automatically selected. But when using devices that have been statically configured it is important to note that half and full duplex Ethernet connections are not compatible.

6. Process-ID vs. Autonomous System Number

When learning about dynamic routing protocols, there is a common mistake that is made between the configuration of OSPF and EIGRP. When configuring OSPF, a process-id is used to identify the routing process. This process-id is only locally significant. When configuring EIGRP, an autonomous system number (ASN) is used to identify the routing process. This ASN is globally significant and must match between configured EIGRP devices.

7. EIGRP Auto-Summary

When configuring EIGRP on IOS pre-15 it was the default for EIGRP auto-summary to be enabled. This can cause routing problems in networks where the IP addressing is not contiguous and/or hieratical. With the release of IOS 15 the default changed so that EIGRP auto-summary was disabled. If implementing EIGRP on IOS pre-15; ensure that the auto-summary is configured as expected on all devices.

8. Split Horizon

A problem that can often be seen by new network engineers on multipoint WAN networks is a problem that resulted from the default setting of split horizon. Split horizon is a loop prevention mechanism that is used by both RIP and EIGRP on WAN interfaces. Basically, what it does is restrict the advertisement of a network out the same interface on which it was learned — as long as the “best” route (for a specific network) exists out that same interface. The problem here lies in interfaces that connect to multiple remote devices: In this case, the setting of split horizon can prevent the advertisement of routes between devices out the same interface. For example, if R1 connects to R2 and R3 off of the serial0/0/0 interface; if R2 sends an advertisement to a network, R1 will not advertise this network to R3 because it sees the advertisement coming in the serial0/0/0 interface.

9. Simple Management Network Protocol (SNMP) Communities

A common security problem occurs when someone sets up the Simple Management Network Protocol (SNMP) with the default communities (public – Read/Only, private – Read/Write). The alteration of these default settings is essential to maintain the security of SNMP (versions 1 and 2c), as the community is the only real security feature built into these versions of the protocol.

10. Switchport Security

When configuring Switchport port-security, it is important to know that the default maximum number of hosts off of a switchport is 1. What this means is that the first host that sends traffic will be allowed and that all other hosts traffic will be dropped by default. Be sure to customize these default settings to the reader’s expectations before leaving your management session.

These are 10 of common misconfigurations that I’ve seen over the years. Hopefully this article will help prevent young network engineers from making these same mistakes when working on production equipment.