NTP – Network Time Protocol
Manually Setting Cisco Clocks
Logs on cisco devices have a time stamp. If the time is not correct, the time log in the logs are wrong as well and you can not coordinate the events to see what’s the problem.
Setting the Clock with NTP
NTP -> network time protocol
The concept with NTP is that there is a server and a client. A server sends the time and a client receives the time. The STRATUM is a term to define how good is your time. A value of a STRATUM of 1 is an atomic time server, and that’s the best you can get. If you get your time of that time server, then you have a STRATUM of 2. If you give your time to another server, this server has a STRATUM of 3, and so on. The higher the number, the less accurate is your time.
DHCP – Dynamic Host Configuration Protocol
Configuring DHCP Services on Cisco Devices
The DORA process
- Discover
Client: “Hellou, i want a IP address” -> Broadcast message - Offer
Server: “Hey, here is you IP address” -> Client picks the first offer - Request
Client: “That’s the IP I want” - Acknowledge
Server: “Alright, got it” -> and sends all the DHCP options with it.
If your client from VLAN10 sends a DHCPDISCOVER message (broadcast) but your DHCP server is in VLAN50, how do you get this message to the right destination?
That’s the job of a DHCP relay agent. If the broadcast enters the switch or router it gets redirected with the source of whatever interface it got in. So if the router receives a message on 10.0.18.1, this would be the source. This is important, because the DHCP cannot know from which pool it has to give out an IP if the source address is not given! So if the DHCP server now gets a message with the source of 10.0.18.1 it exactly knows from which pool it has to give out an ip. It gives out the ip sends the message to the router and the router sends it back to the client.
DNS – Domain Name System
Using DNS on a Cisco Devices
Because DNS is request / response protocol there is error checking built-in it. So UDP 53 is not THAT unreliable as you might think. DNS is the number one places where problems happen, because everyone is using it (except us network engineers).
DNS can also impact your network speed! Keep remembering that!
| Recordname | Explanation |
| CNAME | Conical name, this is a pointer to another DNS record. For example if you internally use Microsoft and for Outlook usage you can put in a CNAME record for Autodiscover.testdomain.com which points to Autodiscover.outlook.com and your internal Outlook clients can now communicate with M365 (or Exchange online). |
| A | Address record, is a host record, points to an ip address, so a host is reachable under that name. For example A-record test.testdomain.org is set to 192.168.1.13, whitch this record set you can now reach that webinterface in your browser over test.testdomain.org and you don’t have to remember the ip address. |
| MX | Mail record, this points to the mail server this environment uses. |
| NS | Nameserver record, this ip address set in this records tells other clients in your domain, that this is the place to ask questions like “who is that?” |
Most of the time you want to build your own DNS server but sometimes it can also be done on a cisco device.
Configuring SSH (Secure Shell) on Cisco Devices
Telnet is unencrypted, so passwords and every information get transferred in clear-text. This is bad! But it is not that bad, as it sounds. Because in order to get that informationen read the attacker has to be in your network and pull-off a MIM (man-in-the-middle) attack, and these attacks are not that easy to make.
How SSH works
SSH works with something called PKI (public key infrastructure). That means it uses a public and a private key set to talk. We generate a set of encryption keys, these are generated on the same device. You encrypt something on device one and it can only be decrypted bei the other device nobody else.
Configuration process
- Create user
- Generate encryption key
- Enable SSH
- Login local
- Transport input
- Username <WORD> secret <PASSWORD>
- Crypto key generate RSA
you will see the name of the key and this key is bound to your device, if you change the routers name it will invalidate your key!
Keys have to be bound to a domain name!
How many bits: -> 2048 - Ip ssh version 2
turns on SSH on the router - Live vty 0 4
login local -> i wanna use the local user database for the logins - Transport input ssh
telnet is no langer allowed to access the router
Cisco IOS commands learned in this lesson
| Command | Subcommand | Explanation |
| Show clock | Shows the clock | |
| Clock set <hh:mm:ss> <day_of_month> <MONTH> <year> | Sets the time to the given value | |
| Clock summer-time | Set the time range where is summer time and substract and adds 1 hour if needed | |
| Ntp master | Configured on a router, this router provides the time for your network | |
| Ntp source | Point it at the loopback interface so the system uses this server every time | |
| Ntp server | Lets you define the ntp server for that device | |
| Show ntp status | Lets you see the status of ntp | |
| Show ntp associations | Lits the ntp assoiciations like which time server you configured etc. | |
| Ip | Name-server <IP> | Sets the name server to the specific ip. |
| Ip | Dns server | Sets the router as the dns server. |
| Ip | Domain name <WORD> | Sets the default domain |
| Ip | Host <WORD> <IP> For example: plex.cafe.local 10.1.1.5 | Creates an A record for that specific name and IP you can reach your plex server now over the name you created. |
| Show hosts | Shows the host entries | |
| Ip | Dhcp expluded addresses <IP> | Excludes IP addresses from the pool, useful for static assigned ip addresses |
| Debug | Ip dhcp server packets | Lists you the packets which get exchanged in the dhcp process |
| Ip dhcp pool <NAME> | Options (bootfile, domain name etc.) | Lets you set the options for DHCP. |
| Ip address | Dhcp | Sets the interface to get a ip from DHCP. |
| Interface Eth<0/0> | Ip helper-address <IP> | That’s set up a dhcp relay agent to the defined ip. |
| Username <WORD> secret <PASSWORD> | Creates a username with password | |
| Crypto key generate RSA | Creates a crypto key | |
| Ip ssh version 2 | Enables SSH with version 2 | |
| Live vty 0 4 | Gos into your remote lines | |
| login local | Defines that logins should be processed with the local userdatabase | |
| Transport input ssh | Only allows SSH via remote login |