Category Archives: CCNA

Did you know your Cisco router could send you an e-mail? Until recently, I would have said that it wasn’t possible, but today, I’ll show you how to do it. And we won’t stop there: I’ll tell you where to find some other scripts that you can use on your Cisco router. Let’s see how the Cisco IOS Tool Command Language (TCL) can make your Cisco administration easier.

A while ago, I wrote an article introducing TCL — “Get to know Cisco’s Tool Command Language (TCL)” — and I told you how you can create your own scripts using TCL. To run TCL, your router needs to be running Cisco IOS 12.3(2)T or later.

for more info on CCNA Training and CCNA Certification and more Cisco
exams log in to Certkingdom.com

While TCL offers many uses for your Cisco router, it needs to be able to communicate with the Cisco IOS. Traditionally, when an event happens on a Cisco router, it sends that event to a management station on your network for some subsequent action. However, with Cisco’s introduction of the Embedded Event Manager (EEM), Cisco routers now have more intelligence and can take actions on their own.

Cisco originally released EEM 1.0 in IOS versions 12.0(26)S and 12.3(4)T. Today, with IOS versions 12.4(2)T, 12.2(31)SB3, 12.2(33)SRB, we’re up to EEM version 2.2, and we’ve gained many features along the way. To learn more, check out Cisco’s Embedded Event Manager Overview.

I suspect that TCL and EEM sound only moderately interesting to most of you because, like any scripting language, it can be difficult to envision what you can do with it. To help you understand the power of EEM, Cisco has created the Embedded Event Manager (EEM) Scripting Community.

Thanks to this site, you can not only download many useful scripts, but you can also submit your own to share with other Cisco users. Kudos to Cisco for this excellent resource!
Send e-mail with your router

To better understand the uses of TCL and EEM, let’s look at an example. Here’s a simple demonstration of how a router can send an e-mail that contains the output of the show version command.

First, I went to the EEM Scripting Community and downloaded the Send Email script. I unzipped the script and ended up with a simple text file called Sendmail.tcl.

Next, I stated my TFTP server on my PC, and I used TFTP on the router to transfer the modified script from my PC to the router’s flash. Figure A shows you what it looked like.

Figure A

Figure A

Next, I ran the following command while in Global Configuration Mode:

Router(config)# event manager directory user policy flash:

Then, according to the instructions included in the script’s comments, I set the following environmental variables on the router to fit my particular configuration (still in Global Configuration Mode), as shown in Figure B:

Router(config)#

event manager environment _email_server 10.10.10.10

Router(config)#

event manager environment _email_from router-123@cisco.com

Router(config)#

event manager environment _email_to noc@cisco.com

Figure B

Figure B

Next, I registered the script using the following command:

Router(config)# event manager policy sendmail.tcl

Finally, I ran the script using the event manager run sendmail.tcl command. If all goes well, there’s no output. Figure C shows the e-mail message.

Figure C

Figure C

You can also modify this script to run on triggered events. For example, there’s a script called showtech that you can use to e-mail the output from the show tech-support command directly to Cisco or to yourself. For more information, check out Cisco’s video tutorials on using TCL/EEM router scripts.
More uses for TCL and EEM

While this article has focused on using TCL and EEM to send an e-mail with your router, I want to stress that there are so many more practical uses for TCL and EEM with the Cisco IOS. For example, one of the most useful things you can do with TCL and EEM is use a set of diagnostic scripts dubbed IOS Service Diagnostics. Such scripts are available for OSPF, BGP, and QoS.

With these scripts running on your router, when abnormal events occur (such as losing an OSPF Neighbor), your router can automatically attempt to diagnose the issue, perhaps take action to solve it, or, if nothing else, notify you of the issue along with all of the relevant information needed to resolve it. In other words, the scripts can provide for a shorter Mean Time To Repair (MTTR) — which equates to cost savings. In addition, the scripts can increase network uptime, quickly identify root causes, and automatically collect network troubleshooting data.

Here are some of the other interesting scripts available:

* Memory Health
* Power and Temperature Health
* Composite Device Health — Interface Errors
* HSRP State Change
* L3 Path Failure Detection — EIGRP Neighbor Change
* VPN Failure Detection
* WAN Load Alarm

Conclusion

According to Cisco’s IOS Service Diagnostic Web site, Cisco plans on introducing a management interface to help administrators manage these types of scripts on Cisco routers. I look forward to trying that out as soon as it’s available. In the meantime, we have a lot of powerful scripts available to test and learn about. In fact, you could even write your own!

What do you want your router to troubleshoot or notify you about today? Add your ideas in this article’s discussion.

Cisco on Monday rolled out its long-awaited vision of data center architecture, including multiple partners, a wire-once approach to link computing, virtualization, storage and networking and a call to lower costs. Let’s assess the winners and losers of this rack-by-rack data center battle.

See also: ZDNet’s coverage of the press conference and Cisco’s official statement
As background, Cisco’s Unified Computing System aims to unify components of the data center into one footprint. The goal is to cut the total cost of ownership by 20 percent in capital expenses and up to 30 percent in operating expenses.

for more info on CCNA Training and CCNA Certification and more Cisco
exams log in to Certkingdom.com

How did Cisco reach those savings figures? A Cisco spokesman said capital expenses will fall because fewer switches, adapters and cables are needed. Cables represent 15 percent of data center capital expenses. Cisco’s architecture only has one cable going in. The set-up is also expected to lower power, cooling and labor costs. Meanwhile, one management application can manage the entire system compared to seven with legacy systems.

As expected, Cisco also launched blade servers that are based on Intel’s Nehalem processors. Cisco’s design aims to create a single system that wires the blades and consolidates networking functions (local area, storage area and computing networks).

Cisco’s has taken a holistic approach to data center architecture and the ramifications could be big over time. However, the effects won’t be felt overnight. Cisco noted that it doesn’t expect a rip and replace of existing data center infrastructure in favor of its Unified Computing System. That said, Cisco will plan to win rack-by-rack as data center assets are replaced.

Here’s a look at the potential winners and losers:

Winner: Data center managers looking to find more productive uses for cable jockeys. For all of the moving parts of Cisco’s Unified Computing Center announcement for IT execs it really boils down to two words: Wires and cables. All of those wire and cables cost you money. Cables equal labor costs and Cisco’s new architecture has one wire going in.

Instead of this:

You have this:

Cisco is trying to bring sexy design to the data center. Jim Grant, BMC’s senior vice president of strategy and corporate development said the better wiring means IT managers can “wire once and reconfigure many in logical way rather than physical.”

Loser: Competitors that will need to bolster their data center architecture plans. In a blog post, Cisco said that its data center move is to add value and not take on entrenched players.

Cisco said:

This is not the ‘Clash of the Titans’ or us ‘coming after HP or IBM or Dell’. Some companies may choose to join us in this market, others may continue to operate the status quo.  We are certain over time we will not be alone in this market.

But Cisco’s design work here is substantial. As Cisco gains its footing and begins rack by rack warfare customers are going to start asking about the Unified Computing System approach. Other data center rivals will have to start answering questions about integration between functions, architecture and the potential savings. If anything just the buzz associated with Cisco’s move can dictate the conversation.

Winner: BMC Software. BMC and Cisco collaborated on the management software portion of the Unified Computing System. This deep integration means one app can manage the system. For BMC, the Cisco partnership “is preferential,” said Grant. BMC, which is already entrenched in data centers, will find itself in all of those next-gen data center conversations.

Winner: Intel. The chip maker gets its Nehalem processor to ride shotgun on the Cisco news. The positioning of Nehalem and next-generation data centers will be hard for AMD to match.

Loser: Hewlett-Packard. There are a few items to ponder here. On the hardware side of the equation, HP may see blade server margins squeezed. HP is also battling back with its networking gear. But there’s another hook here that may be overlooked: HP’s own automation and management software. HP acquired Opsware and the capabilities are similar to what BMC offers. Now that Cisco and BMC are partners on sales calls it could be more difficult for HP’s Opsware.

Winner: VMware. As part of Monday’s announcement, Cisco and VMware announced an original equipment manufacturer agreement. VMware, which is under fire from the likes of Microsoft, Red Hat and Citrix, gets another channel to push its virtualization platform. Cisco is a nice partner to have on board. “This is perhaps the only evolutionary road,” that is feasible right now, said Paul Maritz, the chief executive of VMware, that could lead to “revolutionary” new forms of computing.

Loser: Brocade. Brocade made a big move to acquire Foundry Networks to push its own data center vision. Cisco’s announcement will put pressure on Brocade to position its version as an alternative. Meanwhile, EMC is another big Cisco partner on its Unified Computing System.

Winner: Cisco. The company has the message and the business case to make a go of its Unified Computing System. In many respects, the company has changed the data center conversation and managed to crowbar itself into more discussions as infrastructure is replaced.

Get IT tips, news, and reviews delivered directly to your inbox by subscribing to TechRepublic’s free newsletters.

If I had to name some of my favorite Cisco routers, I would definitely include the Cisco 2800 Series on my list. Find out what you need to know about the Cisco 2800 Series, and learn why your organization might want to invest in this new line of routers.
The nitty-gritty

The Cisco 2800 Series is the replacement for the 2600 Series. In my opinion, the biggest advantage to the Cisco 2800 Series is its versatility; you can use a 2800 Series router in a small, midsize, or large organization. For most network administrators, I think the determining factor is the number and types of interfaces and not necessarily the throughput of the router.

for more info on CCNA Training and CCNA Certification and more Cisco
exams log in to Certkingdom.com

There are four models in the Cisco 2800 Series:

* 2801: 2 DSP, 2FE, 2HWIC, 2VWIC/VIC, 0NME (Network Module Enhanced), 1Rack unit (RU)
* 2811: 2 DSP, 2FE, 2HWIC, 4 HWIC, 1NME, 1RU
* 2821: 3 DSP, 2GE, 2HWIC, 4 HWIC, 1NME or 1NME-X, 2RU
* 2851: 3 DSP, 2GE, 2HWIC, 4 HWIC, 1NME or NMD/NME-X/NME-XD, 2RU

(Cisco Systems provides a 2800 model comparison on its site.)

The 2800 Series is the first router in the Cisco product line that supports network modules. This means that if there is a network module that you require for your topology or application, the 2800 Series is the least expensive Cisco router (that’s currently available) that you can install it into.

The 2800 Series supports a slew of Cisco interfaces and models. In a Cisco 2800 Series router, you can install a range of network modules, which include the following:

* 36 port Ethernet switch with PoE
* 32 port async
* 8 port voice/fax module
* Content engine with hard drive
* Cisco Intrusion Prevention System (IPS)
* Cisco Unity Express (voicemail)
* Cisco Network Analysis Module (NAM)
* 3G cellular WAN interface card
* Wireless LAN controller
* IP VSAT module
* 802.11a/b/g WLAN module
* 8 port HWIC module (to add 8 more HWIC cards)

For example, in a 2821 router, I could install 2 x 32 port Cisco Ethernet switch modules with PoE and use this router as a 64 port switch.

The 2800 Series supports the Cisco IOS, which provides options security (like the integrated stateful firewall), the Cisco Security Device Manager (SDM), 1500 VPN tunnels, Gig Ethernet, and redundant power (except for the 2801 router).
Why we bought the Cisco 2800 Series

At my company, we still have a lot of Cisco 2600 and 3600 Series routers. While not all my sites needed the power of these routers, we needed to use a network module card, and these router models were the first in the Cisco product line that supported those network modules. Specifically, we use NM-16A & NM-32A asynchronous serial modules to support serial devices at each location. The Cisco 2600 Series routers don’t have the CPU and RAM to support the latest IOS and to handle the current network traffic load. (Note: The last date to receive service and support for a 2600 Series is April 28, 2008.)

Figures A and B are photos of my new Cisco 2811 router that I just unpacked.

Figure A

Figure B

In my case, the Cisco 2800 Series is the ideal replacement for almost all our routers. We have been purchasing 2811 Series routers, installing a HWIC T1 card for MPLS WAN connectivity, and replacing existing routers at remote sites. We added a NM-16A or NM-32A modules to support the needs of our async devices. I have seen cases where putting in a 2800 Series immediately improved the performance for that remote location.

While I might be able to use a smaller router like an 1800, I need the NM slot from the 2800 Series, and I like the flexibility and power that the 2800 Series offers. Like the 2600 and 3600 Series routers, the 2800 Series has been extremely reliable; so far, not one 2800 Series has failed.

A downside to the Cisco 2800 Series is that it is loud. When I turned it on to configure it in my office, I couldn’t hear my coworkers or my phone.
Conclusion

If you are in the market for a new router (perhaps you’re looking to replace your aging 2600 and 3600 Series routers), I recommend taking a look at the Cisco 2800 Series. Based on my personal use, the Cisco 2800 Series is another rock solid router from Cisco that, like the 2600 and 3600 Series, will serve network admins for years to come.

The real case for the Cisco 2800 Series is that it offers a completely improved package: better performance, solid reliability, versatility of use, and a plethora of WAN interfaces and network modules that you can use to expand it. Also, since the 2600 Series will no longer be supported, the time to replace those routers with the 2800 is now.

A number of Cisco vulnerabilities have recently been made more dangerous by the public release of proof-of-concept code, which can be utilized to exploit these vulnerabilities. Anyone using one of the many vulnerable products needs to take immediate steps to fix the vulnerabilities or confirm that the vulnerabilities have already been fixed or mitigated.

There are also two recently announced vulnerabilities that require attention, but no published exploits have been released for these flaws.

Details
Older threats that now have public exploits
A number of exploits for known Cisco vulnerabilities have recently been published. Here is the list as taken from a Cisco Security Notice:

for more info on CCNA Training and CCNA Certification and more Cisco
exams log in to Certkingdom.com

* Cisco 677/678 Telnet Buffer Overflow Vulnerability DoS
* Cisco IOS Router DoS Vulnerability, Cisco IOS HTTP Server
* Cisco IOS HTTP Auth Vulnerability
* Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability, IOS HTTP Authorization Vulnerability
* Cisco Catalyst SSH Protocol Mismatch DoS Vulnerability
* Cisco 675 Web Administration DoS Vulnerability (“Cisco is currently researching this vulnerability further. Mitigation methods have been available for some time such as setting the Web server to listen on a different port.”)
* Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability
* Cisco IOS Software HTTP Request DoS Vulnerability
* Cisco 514 UDP Flood DoS Vulnerability, a vulnerability in the IOS Firewall feature set
* CiscoSecure ACS for Windows NT Server DoS Vulnerability

New threats
One of the new flaws to look out for is a Cisco Content Service Switch Management Port UDP remotely exploitable DoS vulnerability, which has been flagged by SecurityFocus. The relevant Cisco Security Bulletin contains more details.

The other new flaw is another DoS threat that comes in the form of a Cisco OpenSSL Vulnerability.

Applicability (new threats only)
Cisco Content Service Switch Management Port UDP

* Cisco CSS11000
* Cisco CSS11050
* Cisco CSS11150
* Cisco CSS11800
* Cisco CSS11100 (added in the Cisco Security Advisory revision)

OpenSSL vulnerability (taken from the Cisco Bulletin)

* Cisco IOS 12.2ZA
* Cisco IOS 12.2SY
* Cisco IOS 12.1E
* Cisco PIX Firewall
* Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series routers
* Cisco MDS 9000 Series Multilayer Switch
* Cisco Content Service Switch 11000 and 11500 series
* Cisco Global Site Selector 4480 and 4490
* Cisco Content Service Switch Secure Content Accelerator versions 1 and 2
* CiscoWorks Common Services 2.2 and CiscoWorks Common Management Foundation 2.1
* Cisco Access Registrar
* Cisco Call Manager
* Cisco Okena Stormwatch 3.2
* Cisco Application and Content Networking Software (ACNS)
* Cisco Threat Response

Fix
For the Cisco Content Service Switch Management Port UDP flaw, Cisco has made fixes available in the form of updates 05.0(04.07)S and later or 06.10(02.05)S and later. There are no workarounds.

For the OpenSSL flaw, some fixes are available now and some others have already been scheduled for release. The list is extensive and complicated (also subject to change); therefore, the best information available is found in the Cisco Bulletin. Here is a brief summary:

* Cisco IOS 12.2ZA—no fix date listed yet.
* Cisco IOS 12.2SY—patch available.
* Cisco IOS 12.1E—some fixed releases are scheduled.
* Cisco PIX Firewall—fixes available.
* Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series routers—fix available.
* Cisco MDS 9000 Series Multilayer Switch—no fix date scheduled.
* Cisco Content Service Switch 11000 and 11500 series—fix should be available by the time you read this.
* Cisco Global Site Selector 4480 and 4490—fix should be available by the time you read this.
* Cisco Content Service Switch Secure Content Accelerator versions 1 & 2—fix available.
* CiscoWorks Common Services 2.2 and CiscoWorks Common Management Foundation 2.1—no fix date listed yet.
* Cisco Access Registrar—fix available.
* Cisco Call Manager—fixes for some versions available, fix for version 4.0(2) not yet scheduled.
* Cisco Okena Stormwatch 3.2—no fix date listed yet.
* Cisco Application & Content Networking Software (ACNS)—fix available.
* Cisco Threat Response—no fix date listed yet.

All of the available fixes are updates to later versions. The workaround for this flaw is to disable the SSL Server.

Final word
For the older flaws that now have public exploits, administrators will need to take swift action to make sure their systems are protected. The new Cisco flaws can be addressed in the manner of your company’s standard process for handling security patches and updates.
Also watch for …

* Spim is the IM variant of spam and, according to a report from The Yankee Group as quoted in InformationWeek, message volume is expected to triple this year to nearly 1.2 billion messages. That’s a drop in the bucket compared to spam, but obviously it’s something you need to keep an eye on. Enterprise IM software blocks a lot of this, which is another incentive to install one and close down any of the “public” IM installations on your corporate network.

* Forrester Research is fueling the Microsoft vs. Linux/UNIX security debate with a recent study that had some surprising results, as described in TechWeb. The study itself was based on vulnerability reports from BugTraq, CERT, Bugzilla, and other public sources collected from June 1, 2002, to May 31, 2003. The metric used was “days-at-risk,” basically the time between disclosure and a fix, weighted by risk level and the number left unpatched. “During the year’s worth of vulnerabilities, Microsoft posted just 25 days at risk, while Red Hat and Debian tied for second, with 57 vulnerable days. MandrakeSoft’s Linux distribution came in dead last, with 82 at-risk days, more than triple Windows. Measuring each OS vendor’s thoroughness record, Forrester found that Microsoft again led the pack by patching all of the 128 severe problems discovered within Windows. Red Hat came in second at 99.6 percent (it let one vulnerability slip through the cracks), while Debian brought up the rear by fixing 96.2 percent of the high-rated vulnerabilities (Debian left 11 unpatched).”

Don’t bother flaming me. I’m just quoting Forrester’s research. Obviously there are other metrics to measure the security of operating systems. For example, if you simply counted the number of severe vulnerabilities, then Microsoft would have the most, by far. In part, the actual, real-world security level depends a lot on how quickly IT professionals can apply published patches. If Microsoft quickly published fixes but you didn’t apply them, your systems are insecure. On the other hand, Debian didn’t even offer fixes for some serious vulnerabilities, but they had fewer total, so if you don’t patch at all, then Debian was more secure during the time period measured.