All language subtitles for 11 - Switching - Base Configuration-eng

[Inaudible Remark]

>> You run to the door 'cause you know
that that sound means a delivery truck

and they're bringing the Cisco
switches that you ordered.

And sure enough, there's the delivery
guy unloading them from the truck,

bring them in on a little push cart
and you got them in your organization.

You pull them out of the
box and you look at them,

they smell great, they look good, now what?

That's going to be where we pick up here.

Two things I want to discuss,

one is understanding the physical connections
then we'll get into the base IOS configurations

to optimize how these switches operate.

So the first thing that you want to do with
that switch is get it physically connected.

Okay, now this is a piece that is actually
not much of the CCNA certification at all.

And I still I'm not completely sure as to why.

I have some ideas but for the most part,

Cisco assume somebody else does all the
physical connections which sometimes is true,

sometimes you have a cabling company
that comes in and does all this.

But if you're new into the
network world and you haven't seen,

at least seen how old this stuff
physically connects together,

this is a hugely valuable piece to understand.

A lot of you may have started here.

This is where you first got your feet wet
in the network world is doing cabling.

So, the computers in your
organizations, and servers, and printers,

and fill in the device here
that connects to the network,

everything all eventually
terminates to an Ethernet wire.

Even if you have a wireless device, you know,
here's you're iPad where you're scribbling

on the screen, it's going Wi-Fi,
well, that Wi-Fi eventually terminates

to a wireless access point which is
physically plugged into the network.

So it's essentially converting your wireless
communication down to some form of wire.

Now, if you look in an organization, you'll
see, you know, physically and walk around,

you will see Cat5, Cat6 cabling
wall jacks that are everywhere.

Now, inside of-- if you were to, you know,
I don't want to get down to this level

but you could actually take those
jacks out and physically look at them.

Actually, let me just bring
up a picture from MonoPrice.

This is what a wall jack looks like.

You have the play tray here
where this little widget,

the little connector just snaps right into it.

This is what it looks like.

So, really, this is kind of a small little punch
down block and what that means is if you look

at the back of this right here are
all the little punch down connection.

So, you take a cable which an Ethernet cable,

if you strip back the shielding
is eight individual wires

with specific color code, and you line them up.

You put wire 1, I can't draw.

You put wire 1 right there,
wire 2 right there, wire 3,

and you actually use something
called a punch down tool.

Actually, let me just-- make sure
I get all the pieces in place.

So let's see.

We've got-- there's-- there we are.

So, a punch down tool which this little
guy has a blade on-- man, I need my arrows.

This little guy has a blade on it where
he will actually take that little wire

and punch it down, thus the name, kind
of push it down into this slot and kind

of move that where all the way down.

Now, inside of the there, if you
were to somehow see the view inside,

you would see that there's very sharp metal
connectors in there that when the cable that--

or I shouldn't say the cable, the wire, the
individual wire from the cable gets pushed

down in there, it's strips off the shielding
of the wire and makes a physical metal

to metal connection allowing
the communication to flow.

So you do that with each one of the eight wires.

And you can see down at the
bottom, depending on the wall jack,

it will actually give you a little color code
of what that is and then this is just showing,

when you're done putting all the wires in
there's, you usually, I actually don't,

I'm kind of lazy, but you will usually
put these little protectors on there

that will peel off your fingernails
if you try and get them off,

to keep the wires from popping back out

and then you take this little
widget and push it on the wall jack.

So you physically have cabling that
are all running through the walls

that terminate those wall jacks and
those wall jacks are what plugged

in to your actual computer or
whatever device you want to do.

Now, if you were to follow it up the wall, it
would go up the dry wall through the ceiling

or whatever kind of environment you
have, however you're running that wire,

and eventually come down and
terminate into your IT room.

Now, not shown here and I got to give these
guys props, this is a beautiful looking network.

I always love seeing just a nice clean cabling,
you now, the spaghetti string, I loathe just so,

you know, I'm like I just want to clean it up.

I want to fix it.

You know, it's like, you know, some people
like the scenery, you know, you're like, "Oh,

the beautiful sunset," you know, shed a tear,
for me, I'm like, "Oh, look at that cabling."

You know, I'm going to cry,
tear, it's beautiful.

So, the cable comes out of the
wall and you're actually going to--

it's not shown here 'cause it's probably
not as pretty but you got a big old bundle

of cable coming out of the ceiling or
whatever usually wire-tied or whatever.

Bring it back down to behind of these guys.

Now these, these are not switches.

These are patch panels.

What the patch panels do is act
as a little termination point

where I can bring all the cable out of the
ceiling, you know, so it's running from the wall

through the ceiling, it comes
out right here and I actually,

if you were to flip these guys
around, here, I'll show you.

Okay, so here is a example of a
little 12 port patch panel, you know.

The ones that are on there are 24 port,
but if you flip that guy around actually,

let's do them in here, if you flip that
guy around, this is actually a whole bunch

of those little like, you know, if we go
back here or a whole bunch of these things.

It's not as zoomed in so we can't see it quite
as well but really, that's all these are.

It's a bunch of a little punch down.

So, all of that cabling, all that
cabling comes out of the ceiling

and gets punched into the magnets.

Does it take a long time?

Yeah. Does it hurt your fingers?

Yeah. So using that little punch down
tool effectively, what that tool does

that I showed you will actually punch
that wire in there and then if as long

as the blade is sharp enough,
we'll actually cut it off.

Like this one actually comes
with a small little punch

down tool right here that's
probably not going to work as well

but hey, it's free, might as well.

So this will push those wires into the--

each one of those little openings and now you
have all the wires connected a patch panel.

Now, patch panels are optional kind of.

You might say, "Well, can I just bring all
of these wires out of the ceiling and instead

of punching them into here, just put little Cat5
or Cat6 ends on them to where you got the wire

and now you clip a little end on them with--
that's actually backwards but put the little tip

on them that plugs in the computer.

Yes, you could.

You could actually bring those and then
plug those directly into the switch.

However, now you're stuck, if you
ever want to move your switches

around like let's say you put your switches
right here, that's where you mounted them

and that's where you cut the wires too.

And then you go, "Oh man,
because of, you know, something,

we have to move our switches over to this one."

Now you're stuck because you've got all these
wires with tips on them that are terminated

at that point and you can't, you
know, make them longer easily anyway.

So, you're stuck.

You have to leave your switches there
where if you've got patch panels,

patch panels are just dummy devices.

There's no power to them.

They're just kind of a coupler that take
the wire from the wall and move to a jack.

And then you can buy however long cables
you want to connect from the patch panel.

Now, these cables actually go up, you
know, through the nicely wire-tied conduit

that they have here and then run
down into the individual switches.

So down here are the switches.

The ones that came from the delivery truck and
you mounted into your rack so you take the cable

from the patch panel and plug it into
here and now you have full communication.

So that's a view of the physical
connections of the switch infrastructure.

Again, it's not typically
covered too much in the CCNA.

You probably won't to see it on the exam.

There-- Cisco of course, since they
don't really manufacture patch panels,

they're more interested in do
you know the switch itself.

So, here's what the Cisco switch looks like.

Now this one I can tell just because
I've owned a number of those,

that's a Cisco 3550 switch
which is a great switch.

It's a 10/100, it's not gigabit, but it's
a 10/100 switch great for a lab environment

because it actually does layer three switching.

It does all kinds of stuff.

So, this switch a lot of times, I
put a little arrow here 'cause many

of them will have a mode button.

And the mode button depending on
the switch will do different things.

So, not all switches have mode buttons
but it can switch between status

like is there something connected
to utilization to where you'll--

it's kind of like a radio equalizer
where you kind of get levels based

on how much the switch is being utilized
to duplex where you see different colors.

If one is full duplex, one
is half duplex into speed.

That's the bottom line.

Or you can see 10 megabit or a hundred
megabit or nowadays in more recent switches,

you get the gigabit connections or even
10 or 40 gigabit per second connection.

I mean, the speed just continues to
increase more and more and more and more.

So you can click that button
and go through those.

Also, something to be aware of is
if a Cisco switch has a button,

it may support a feature that
can erase the entire thing.

If you hold down that button for somewhere
around 10 seconds, just hold it down,

you'll actually see a blink a number of
times and the switch will reboot itself.

That will flush all configurations that you have
on the switch and reset it to factory default.

Wow! What does that tell you about
physical location of these switches?

Can we say locked door?

Yes, absolutely.

This room is behind a locked door because if
somebody can get to that, they can really mess

up your entire network just by holding
down a button for 10 seconds or so.

So this is the physical world.

Now, I want to reinforce that Cisco doesn't
usually focus on the physical connections

because normally, other companies
come in there and do that all for you.

They can do it faster, cheaper than a Cisco
engineer could 'cause they've got all the right

tools and all the right expertise to run the
cables to the wall and solve the patch panels

and essentially leave you at that point.

They'll say, "Okay, there you go, install
your switches right there and you're good.

Thanks. Bye-bye."

So, we pick up in the Cisco world
from an initial switch configuration.

Now, I've got behind the scenes, my Cisco switch
loading up so it's actually booting right now,

going through all its power and self-test.

So we'll let it do that.

In the meanwhile, I want
to first off re-emphasize,

I said this in the previous nugget,
switches will work out of the box.

So you pull those switches out of
box, you connect the cables to them

and they will do what a switch
does which is learn MAC addresses

and allow devices to communicate.

However, if you're going to leave it at
that, you might as well go by any switch.

I mean, there's no real advantage
other than getting the support in good,

really solid hardware from Cisco,
there's no real advantage to having Cisco

and the advantage comes in when you start
configuring it and enabling features.

So what you see on the screen right
now is a base configuration, meaning,

this will get you started to where you can
enable a lot more features on the Cisco switch.

So we'll work through this one by one.

Let's see if the switches booted.

Okay, good, it is.

Now, by the way, when the switch
boots, initially it might be--

a lot of times you will just sit there
staring at this going, okay, is it done,

you know, expecting this screen to clear.

There is no fear in pressing
the Enter key, right?

The Enter key is pretty much going to always
call up a new line in the Cisco device.

I guess there's fear of you type the
Enter key after the wrong command

but just enter on a blank line is harmless.

So, it's asking us, do you want to enter the
initial config dialog, you might remember

from the IOS basics nugget, the answer
to that is always no because it's going

to have you configure all
kinds of legacy old stuff

and we don't want to waste our time with that.

We just want to get into what we need to do.

The first thing is to name the switch.

So I'm sitting in privilege mode.

You remember, again, just some fly by review
from IOS basics, question mark gives me a list

of commands and the first thing I
need to do is to get into enable mode.

Now, if I want to finish the partially typed
command, you guys remember, tab key, right?

Enable now takes me straight
over to enable mode.

I know I'm there because of the pound symbol.

There was no password because
the switch has no configuration.

That's can be one of the things that we do here.

So I'm sitting at the switch with a pound symbol
and from here I can view all the configuration.

You remember the modes?

We start off in the user mode that
was the little right angle bracket.

We type in Enable and that will take us to
privilege mode where we have the pound symbol.

Now, from there we can view all the
configurations of the Cisco device

but we still can't configure anything unless
we move into global configuration mode.

So I'll put GC, global config, and we
do that by typing in configure terminal

or the shortcut is CONF T.
So I'll type in C-O-N-F--

I drop my pen, C-O-N-F T using the tab
key to finish that and hit the Enter key.

I'm now in global configuration mode.

Okay, great starting point because anything that
I type here globally affects the whole switch

and that does mean things
like the name of the device

which is the first thing that I have, host name.

Host name is the command
that will name the device.

So I'm sitting here, I can just type in
host name and I'll hit the question mark,

it says, "What is the system's name?"

And you might remember, I said anytime you see
something at all capitals where it says word,

it's saying there's no syntax for
this other than just type a word.

We don't know what you want to name your device.

So fill it in right here.

So we can type in the host name.

Now, different companies
will do different things.

You'll see some companies that
are like host name, Neo, you know,

and they start picking a
theme for their devices.

Then the next switch will be
Trinity and Morpheus and all that,

and then that's fine for smaller company.

But before long, it becomes paginal
because there's only one guy meaning you,

the network admin, who knows what's going
on, you know, a consulting coming in.

They're like, "I am on Morpheus right now."

What does that mean?

And they need the other guy to come
in and go, "Well, I'm Morpheus,

that's actually that switch over there."

So as you move into larger companies, you'll
find they start coming up with schemes.

It starts out simple to where some of
them will say, you know, third floor,

switch one, you know, something like that.

You can't use spaces in the name but, you
know, that way, you know, as the company grows,

they're like, "Okay, oh, so that's
the switch one on the third floor."

That makes sense.

And as you start getting into
the enormous companies, you know,

start talking about companies, the size of
Intel, Motorola, American Express, you know,

all these giant enterprise companies, they'll
have names, you'll see host names like,

you know, XJ500-L or X-LL1-, you know,
BB9 or, you know, I'm just making that up

but there's literally, you know a--

and so there's going to be a white paper that
they've produced where literally every character

of that host name means something like the
first letter might represent what region

of the world it's in.

X stands for an exciting
place, you know, whatever.

So, they'll actually have different
definitions so the technicians are trained

when they see these names, they're
able to quickly identify exactly

where the switch fits into the scheme.

So, just for this series, let's just
call this the CVT switch, right?

This will be our first switch.

So that's the host name of the switch.

You can see it's just a prompt.

It's just an identifier of what it is.

Now, before we go anywhere, I want to also
show you how to negate commands because a lot

of times, I mean, you saw
me, I type in host name Neo

and then I type in this and it overwrites that.

And then I type in this and it overwrites
that, it kind of replaces my old host name.

Well, not all commands are that way.

Sometimes when you type a command, it'll
stay there until you remove that command.

So, there's always the ability
to negate a command.

Cisco makes it really easy.

You just type in no and whatever command you
want to negate, and negate meaning remove.

So for instance, if I were to type in No Host
name, I don't even have to type in CVT switch,

I just hit Enter and notice the switch goes
back to its normal configuration of switch

because I've said, "Oh, nope,
there's no more host name anymore."

Hit the up arrow a few times in the key board,

recall that host name CVT
switch and I put that back in.

So the no command can be use for a lot of
stuff, a lot of stuff on the Cisco device.

You'll see it all over the place.

So, now let's start getting into the
pass-- I should be checking this, right?

Let's get in to the passwords.

There are three different passwords
that I want to show you on the device.

The first one is the console password.

Now, when we get into this
device, when we physically come up

and that's how I'm connected right now.

I've gone in.

If I were to go into-- let's see,
set up do the-- what would it be?

General, is that where it's--
yeah, so there we are.

I've got my general set up.

I'm using COM4 which is my serial port right now
attached to a USB to a serial adapter to connect

to the console port of the device.

So I'm configuring it through the console
board, and you saw when I got in here,

I booted the switch and poof, there I am.

Now if I-- let me exit out, and I
said, "Okay, you're logged out."

I hit Enter and I'm in, I'm in to at least user
mode and then I can get into privilege mode,

the global config mode, you know, it's very easy
for me to navigate 'cause there is no passwords.

So to set a console password, what I need to
do is go into the console configuration mode.

That's where we're going to
start seeing the different modes.

So we've gone in from user to privilege, right?

So here we have limited show
commands, all show commands.

We've gone from privilege to global config
where we can now configure global options,

but now we can start going to some of
the individual configuration modes.

The first one I want to show you is called
line console, a line con or line console.

Essentially, Cisco has created
a console mode of configuration.

Let me show you.

I can go in here and type in line, let me
just do a space question mark, it says, "Okay,

do you wan to configure VTY lines," which
we're going to talk about in just a second,

"or do you want to configure the console line."

So I'm going to say, "Console
line" and I hit the question mark.

And it says, "Well, which console
port are you talking about?"

Now, Cisco is just being kind of
trivial here because they know as well

as we know all Cisco devices
only have one console port.

You're never going to find one
that has multiple console ports

for redundancy or anything like that.

But nonetheless, they make you type it.

They say, "Okay, well, the
first line number is zero."

And by the way, you might-- 'cause
numbering in Cisco often starts from zero.

So the very first line, instead of
being one will be the number zero.

So the very first or essentially the
only console port is blank console zero.

So, now notice what happened here.

My mode changed.

I'm now-- I've gone from
config to config dash line.

Every command that I type right
now, right now I'm in this mode,

every single one of these commands deal
specifically with the console port.

If I were to exit out of this mode,
those commands would disappear.

They're no longer valid.

So inside of here is where I want to
use the command password and I type

in whatever I want my password to be.

So in this case, let's just-- I'm going to make
not a good practice but for a lab, hey, why not.

I want to make all of the passwords
Cisco, so all lower case password Cisco.

Now you notice, when I hit
question mark, initially it's going,

wow, this looks kind of confusing.

It says, I can put a zero here to specify
an unencrypted password will follow

or I can type a seven here to specify that
a hidden password will follow or I can type

in line, notice all capitals, where it says the
unencrypted clear text pass-- line password.

Now, what does all that mean?

Well, I typed in password Cisco but notice,
I could have typed in password space

and type the number zero space and then typed
in the unencrypted clear text line password.

So, huh? What?

Huh? What?

What's going on?

So, can I type in password zero Cisco and enter?

Yes I can.

Now, wait a sec, can I type in
password Cisco and hit enter?

Yes, you can.

There's actually two ways of
doing the same thing here.

You might be going, what's the difference?

Well, this just explicitly tells the device,
this will be in unencrypted password.

I'm going to paste it in.

A lot of times, if somebody copies and pastes
the config from a different Cisco device

and says here, it just kind of copy these
commands and paste them into your device.

It'll do it for you.

A lot of times, they'll specify zero here
because they know it's unencrypted, whereas,

they can also copy and paste a configuration

where they have an encrypted
flavor of the password.

Do you notice if I type in password space
seven like it's telling me to, it says, "Okay,

now you can type in word where the word
represents a hidden line password string?"

Meaning, if maybe-- maybe somebody didn't feel
really good about giving you configuration

with all their passwords and clear text.

So they said here, "I'm going to give
you an encrypted version of this password

that you can copy and paste in the
config and it'll still understand it."

So, that's where that comes in.

I'm getting a little deep a little
early but I just wanted to comfort you

if you are wondering what that all
meant when I hit question mark.

But Cisco realized this.

You know what?

People don't really want to type a number.

Let's just give them a shortcut.

You know what, if you just
want to type in password

and what your password is, you can do that.

It's the same thing as typing
password zero in your password but,

you know, we'll let you do it either way.

So I can type in password Cisco and that.

So what I've done at this point is
assign a password to the console port.

Let me type an end which will drop me back
out and then I'll type in exit to log out.

Watch this.

I'll hit the enter key and
[laughter] never mind.

Scratch that.

I forgot to do something.

Oh, yes. We did set of console password
but I want to show you something.

I want to do a show-- I'm
actually going to do a show command

where I'm going to do a show running config.

At first I was like, "Wow, that was one of
the most basic commands I could've done."

I'm going to scroll down and you
can just see there's all kinds

of stuff in this configuration.

This is its running configuration.

What's actually running and you can
see that underline console zero,

I have the password Cisco but
it's actually missing a command.

It's missing a command that is underneath a few
of these other ports which actually is log in.

Now, look at this.

I'll show it to you and then I'll explain it.

I'll do line console zero and I'm
going to type in log in and hit enter.

So, what did that do?

Let me exit back out here and
I'll do a show running config.

Now, what did that do?

Hang on, scroll down, show me that command.

Is it there now?

I hit the wrong button, stop the output.

Is it there now?

Yes it is.

It's underneath the counts for-- what's it do?

Let's find out.

Hit the enter key and now it's
asking me for a password, Cisco.

Okay, okay.

And then I get in and I'm in.

Okay, so now I have this password
prompt which was not previously there.

And what I did was type in log in.

Let me do a short run.

Let me just-- I'm going to do a
begin with line con, of course,

line con so I don't have
to scroll through all that.

So it's showing line console 0, password
Cisco log in, that command is there.

So wait a sec.

If I were to go in into the console port and
type in line console 0 and type in no log in,

to remove that command, now what happens?

Let's go back.

Let's look at the config and verify.

Let me do that again.

Verify, we've got password Cisco is
under the console port, exit back out,

enter the enter key, no log in required.

Is that-- is this starting
to put the pieces together?

So what-- let me ask you, if you were to give
a definition, what does the log in command do?

The log in command requires log-ins to that
port, meaning, I can type in passwords all day.

Let me do a show run begin line console.

I can type in passwords all day long under
that console port but they won't take affect

until I'm requiring somebody to log in.

So I'm going to go into global config, line
console 0, and let's just hit the question mark.

You can see that log in if we look at the
definition L log in, enable password checking.

That's the definition that they give it

and essentially enable this
console port to check the password.

So, let me type in log in, hit enter, and
now we are requiring console password, good.

Now, what about the telnet password?

Setting a telnet password is what allows
you to manage the switch remotely.

Meaning right now, I am connected if you were
to look at me right now, I have a cable plugged

in to that switch and, you know, I got
my laptop or whatever device I'm using.

I've got this console connected.

I'm looking down, I'm literally three feet away
from the switch standing here and that's great

for an initial configuration,
that's how we have to configure it.

But eventually, I want to get out
of this cold IT room and I walk back

to my desk or fly back to my office.

It could be thousands of miles away
and manage this switch remotely.

That is where the telnet password or you
should-- could also look at more modern,

more secure is an SSH password comes into play.

Now, these are also configured under the
line but the line is actually called VTY.

Let me get back to the problem.

So we're under the console part right now.

We don't want to do anything else from here.

For now, we'll come back here.

I'm going to exit out of the console port.

I'm going to type in line VTY space, well, let
me just question mark through the whole thing.

So line VTY that sends for a virtual terminal.

It's virtually as if I was standing
there next to the switch, right?

So virtual term, a VTY space and then it
says, okay, what is the first line number.

What's that mean?

Well, depending on your iOS version,

you will see different Cisco devices supporting
multiple telnet connections at a time.

So that means I can be remotely telnetted in
managing the switch, so can Bob, so can Sue,

so can Mary, so can Neil, you know, everybody
can actually be on that switch at the same time.

Whoa, wait a second, does that mean
we could make conflicting changes?

It does and you have to be careful about that.

But usually, you know, technicians communicate.

[laughter] Did I just say
"technicians communicate"?

Scratch that.

Policies dictate that technicians
are supposed to communicate

so that they don't make those
kind of conflicting changes.

But nonetheless, the Cisco
device supports everybody getting

on that device at the same time.

Now when I say everybody, I mean,
however many line numbers you configure.

Now this iOS version, this
Cisco device supports--

you can just by hitting the question mark,
it says, what is the first line number?

So I type in zero, that's going to be the first
one we commit on and I hit the question mark,

it says, "Well, what is the last line number?"

And I can go up to 15.

So what this allows me to do is configure a
whole bunch of VTY ports at the same time?

So if I were to type in 15, that now puts
me into the configuration mode for 16 total,

'cause I started counting from zero, right,
so that adds one more, so 16 total VTY ports

that I'm configuring all at the same time.

And then I can come under here and say
password and whatever I want my password to be.

We'll say password Cisco and hit the enter key.

And now I've created a password that says
whenever somebody accesses device remotely,

they're going to have to type in the password
Cisco before they are able to get to user mode.

Now, let me show you a couple quick things.

I'm going to bail out of this
mode and just do a show run.

And by the way, I've been typing this in a
couple of times just to get us straight there.

You can actually do a show running
config, this is how we verify.

It's saying, show me what configuration
is on this device that's running right now

and you can type in the pipe, it's the
character right above the enter key,

and then you can do some filtering commands.

You can say, I want to begin with the
line, I want to include the lines,

I want to exclude the line, so
what I have been typing all along,

I've been putting B there
which are like, what is that?

That's actually begin with the line where
I type in line and I just hit enter.

Begin with a line that says line because that
will move me down to the bottom so I don't have

to hit the spacebar through all that config
and I can just look directly at these ports.

So, I see my console port configuration,
right, everybody good with that,

and then below, I see my VTY configuration.

Now, a couple of things worth
mentioning, first off,

what's up with the 0 through 4 and then 515?

You know, and I also want
to talk about the syntax.

When you see 0 space 4, mentally
put a little dash in there.

They give it like 0 through 4
'cause that's really what it means.

So why did it break it into two?

Well, to understand it, you have to go
back into long, long history of Cisco.

Cisco has always had five telnet
ports, 0 through 4 on their devices.

Only recently and I say "recent" within
the last decade, it's been a long time.

But, you know, for as long as Cisco has been
around, I'd say recently, have they expanded

that to allow more to where you can go
up to 15 or I guess 16 total VTY ports.

But a lot of times people would take
configurations from one device and send it

over to another device and, you
know, kind of-- it's very common.

When you get a good base configuration with
Cisco to say, "Okay, I've got it," you know,

that's what we're doing right
now is a base configuration.

'Cause I've got it, let me now copy
and paste that into all my devices

so I don't have to do them all individually.

Well, if you have some older devices, they might
only support five telnet ports at the same time.

Whereas some newer devices might also expand
and support up to, you know, 16 telnet ports,

you know, for essentially 0 through 15.

So Cisco said, "Well, why don't we do this?"

We'll break it into two sections so that way if
you copy and paste a config from a new device

into an older device, so the new device
supporting all these telnet ports

and the older device supporting this, at least
it will take the commands for this piece of it.

You know, when it gets to this, the older device
would be like "I don't know what that means.

I don't have 16 telnet ports"
and it'll ignore those commands

but at least it will take this whereas if
we would have put them all as one big chunk,

if we were to put 0 space 15, then the older
device would say, "Well, I can't support that,"

and it would forget the commands completely.

At least by doing this, it gets
most of the configuration in there

and ignores the stuff that doesn't support.

So, I know a little longer explanation but you
we're to believe, how many times I have people

when I explain that to them and
they've been in Cisco for a while,

they're like, "Oh, that always confuse me."

So, I wanted to take the time right there.

So, second thing worth mentioning, notice
when I got under the VTY ports right here,

I typed in password Cisco, I never typed
the word log in and yet it's there.

Why? Well, if we back up, if we
look at the configuration before

when I was doing the console port, we saw that
the console port didn't have the log in command

and the VTY lines did before
I even got in there.

Well, that's Cisco's form of security.

They don't want you to be setting up your
switch and then you give it an IP address

and all of a sudden someone behind the scene
is like [laughs], you know, dives in there

and telnet is in before you have
the chance to set a password.

No. So what they do is they say,
"Require log-ins to this port."

But notice there's no password
set underneath the port, right?

So if somebody does happen to try and
sneak in there before you have the chance

to set a password, they'll
actually get the message

from the Cisco device and
here's the exact message.

I don't know why I remember this verbatim.

It will say, "Password required but none
set," click and it will disconnect them.

"Password acquired but none set."

What that's saying is "Hey, this log in
command is telling me, me being a Cisco device,

I need to require log-ins for this port."

So when somebody connects, it's like I need
to log you in but then it looks and it goes,

wait a second, I don't have
a password, thus the message.

Sorry, password required but there's none
set so you can't log in case I'm requiring.

Now, let me show you, let me
show you a bad thing to do.

If I were to go underline VTY 0 space
15 and type in the command, no log in,

hit the enter key, what do you think that does?

Careful, sometimes you're like, "Oh, okay," so
I'm not letting anyone log in, right, right?

That's a lot of times the initial feeling
is like, well, it says no log in so that--

well, careful, careful, remember the language.

No is the negating command.

So we're not saying no log in like
we're speaking English to each other,

like oh no, no, you can't log in.

What we're saying is no,
the log in is not required.

So before I was requiring log ins
and now I'm not, oh my goodness,

what this means is somebody can type in
telnet and the IP address of the switch

which thankfully we haven't given it one yet.

But they could type that in and bam,
they're immediately sitting in user mode

and then they type in enable and
now they're into the privilege mode.

It's creepy.

There is a few, there is
minor security mechanisms

like if you don't have an enabled password,
it might restrict you from doing that.

But oh my goodness, that's
not something you want to do.

So no log in does not say you can't log in.

It means no log in is required so that's why
you absolutely want to keep that one on there.

See how dangerous those commands can be.

Okay. So, are you feeling good so far?

I'm looking at the amount of time.

I'm like, good grief.

I'm spending a lot of time on this.

I thought I'd be able to
just blaze through this.

But then as I started talking,
I'm like, you know what,

this is really our first real
config of a Cisco device.

I want to spend the time with you.

I want to spend some time just to talk and
brainstorm and just think through a lot

of the questions that I know I've been
asked when I have explained this previously.

So, I'm probably-- here's what-- I'm
going to kind of divide this in half.

This will be part 1, this will be part 2.

We'll do all that in another nugget.

But let's-- that's the last one I
want to do is to set a password.

I want to set the enable password.

So, so far, we've now set
it up to where when I plug

in with the console port,
it's asking me for a password.

That's good to get into user mode.

If telnet or SSH which we'll talk about SSH
later, if I get into the switch that way,

it's going to ask me for
a password which is good.

So I'm kind of protecting it but now there's
this transition from virtually no access

or very limited access into full
access which is not protected at all.

And that's where the enable
password comes into play.

Now, the way that we do this is very similar
to the way that we've done everything.

I'm going to exit back out.

Now, there's no line for this, I
don't have to go under a line config

because the enable password is something
that applies to the whole switch.

It doesn't matter how you get on that switch
whether you've console in, telnet in, SSH in,

doesn't matter how you get there,

it has one global enable password
to protect that transition.

So it's something that we do from global config.

And the way that we do that is typing
in enable, there's actually two ways.

You can type in enable password
or enable secret.

Okay. So these two commands
do exactly the same thing.

They protect the privilege mode with a password.

So let me show you the first one first.

Let's do enable password and similar
to the console port, it says, you know,

what mode or anything and I would just say,
hey, at this point type it in, type in the line.

So I type in, the enable
password is Cisco, right?

So now when I exit out, what happens?

I hit the enter key, it's prompting me for a
console password which I type that in, Cisco.

I'm now in user mode, I'm like okay, great, I've
got limited access here so I type in enable,

hit the enter key, and now look at that.

Now we're prompted for a second
password which normally best practice,

you should make that a different password
than what your telnet password is.

Not everybody does but it is
much better security if you do.

And I'm in the privilege mode.

So okay, that's great.

You're probably thinking, well, what could
be different about the enable secret.

Well, let me show you.

I'm going to go back and verify my commands that
I've typed in the switch and I'm like, "Okay,

well, I'll just do a show run and whoa,
hey, stop looking over my shoulder.

Hey, no, no, yeah.

Look at that.

It's clear text."

Enable password means if somebody is looking
over your shoulder when you're doing a show run

or you happened to send your
running config to somebody,

right there is essentially
the key to your Cisco device.

The password is Cisco, that's scary.

So let's go back in here and type in
enable, hit the question mark, secret.

And let's-- I'm going to use a different
password and I'll explain why in a second.

So let's just do enable secrets
CBT nuggets, enter.

So I'm going to exit back out.

Let's do a show running config.

That's got to make you feel better.

Enable secret is [inaudible].

And it's just garbling moosh moosh.

And then underneath right
there is enable password Cisco,

okay, okay, that can't be good, right?

Okay, so what happens?

I type in exit and I'm here.

I type in Cisco and I'm in 'cause
that's the console password, right?

So now when I type in enable and I'm going
to say, okay, I'm going to try the password

of Cisco, wait, wait, maybe I mistyped in Cisco.

No, Cisco, no.

Enable is no longer allowing me to
use the password of Cisco anymore.

I actually have to use the password of
CBT nuggets and that will get me right in.

See, using the enable secret, the Cisco
device realizes, whoa, that's way better,

that's way more secure than the enable password.

I'm going to prefer that.

As a matter of fact, I'm going
to disable the enable password

because you have a more secure password typed in
that's enable secret and that's completely hash.

It's totally, think of it as encrypted.

They're like people can't get to that
password just by looking over your shoulder.

So, I know, if you're like me, the
questions are rattling your mind.

Okay, number 1, why does that enable
password exist, why is it there?

And then why do you have-- why does
it even let you type two of them in?

It seems like it would, you know, it would
just remove the other or something, right?

That's like our brainstorming [inaudible].

Well, let's go back.

Go back to the old devices.

Old devices, again, old being, again,
more than a decade old since they've come

out with enable secret, but long, long
ago, devices had only the enable password.

There was no enable secret command on
some of the original Cisco devices.

So Cisco said, "Let's keep it around.

Let's keep this in here."

Again, that way if somebody copy and paste their
configuration from a new device and they put it

in the old device, well, the old device when it
sees this command if you're copying and pasting,

it's going to be like, I don't
know what that command is.

I don't support that command
but it will support this.

And so you'll see this theme,
you get that feel, right?

So there are legacy commands
that still work on newer devices

but really Cisco has long
since developed better ways.

The only reason they keep those command around
is if you were to apply that configuration

to an older device or for example, maybe
I downgrade this iOS version, you know,

right now I'm running, you know, whatever
version, 12.2 on the Cisco switch,

what if I downgraded this iOS
version 2, really old version.

Well, when it boots up, it's going to start
seeing all these commands and it's like,

I don't get that, I don't understand this 'cause
my iOS version doesn't support that command.

So these commands will automatically
disappear from the config

because the switch doesn't support it and all
the old commands, the legacy commands will stay.

So, that will at least give you some
level of protection by doing that.

With all that being said, let me just
say this, Cisco nowadays recommends,

don't even worry about the enable password.

Enable secret has been out for a long time and
that's the way that you should probably go.

As a matter of fact, how would we
get rid of that enable password?

There's your pop quiz, no enable password.

It's gone, right?

Show running config, that
negating command removes everything

and now all I see that's
left is the enable secret.

Wow! What a good start.

So we can check this off thinking of
this as like core security if you will

on the left hand side to
get our device configured.

And I would say just getting really familiar
with kind of the feel of this Cisco switch.

So I'm going to put that dividing line
right there, line in the sand for now.

I'll start off the next nugget right
off-- right where we finished this one.

I'll kind of do a fly by review of where
we're at and then we'll dive into part 2

which will be setting up the rest
of the management of this device.

For now, I hope this has been informative for
you and I'd like to thank you for viewing.