Core Knowledge Questions Removed from the CCIE Security and CCIE Storage Exams

Effective August 15, 2011, CCIE Security Lab Exam and CCIE Storage Networking Lab Exam, in all global locations, will no longer include the four open-ended Core Knowledge questions.  The removal of Core Knowledge questions allow candidates to utilize the total lab time for configuration and troubleshooting. The total lab time will remain eight hours.

NAT 0 statement in Cisco FIrewall (PIX/ASA)

NAT 0 STATEMENT:

nat (inside_interface_name) 0

NAT 0 has two affects:
   

1. nat (inside_interface_name) 0 access-list 101 
   
   This works exactly the same way as static, except it bypasses NAT.  It does not require the connection to be initiated from the higher security interface before the host on the lower security interface can create a connection to the host on the higher security level interface.
2. nat (inside_interface_name) 0 0.0.0.0 0.0.0.0 
   
   This bypasses NAT, but requires the host on the higher security interface to first initiate a connection to the host on the lower security interface before the host on the lower security interface can initiate
   a connection.

NAT Order of Operation in Cisco Firewall (ASA/PIX)

1. nat 0 access-list (nat-exempt)
2. match against existing xlates
3. static statements
   
      
   1. static nat with and without access-list (first match)
   2. static pat with and without access-list (first match) 
      
4. nat
      
   1. nat access-list (first match) 
      
      Note: The nat 0 access-list command is not part of this command.
   2. nat (best match) 
      
      Note: When choosing a global address from multiple pools with the same NAT ID, this order is attempted:
             
      1. If the ID is 0, create an identity xlate.
      2. Use the global pool for the dynamic NAT.
      3. Use the global pool for the dynamic PAT.      
      

Automatic Backup of Cisco Router Configuration using KRON

About KRON:

The Command Scheduler (KRON) Policy for System Startup features enables support for Command Scheduler upon system startup.

Command Scheduler allows customers to schedule fully-qualified EXEC mode CLI commands to run once, at specified intervals, at specified calendar dates and times, or upon system startup. Originally designed to work with CNS commands, Command Scheduler has a broader application. Using the CNS image agent feature, remote routers residing outside a firewall or using Network Address Translation (NAT) addresses can use Command Scheduler to launch CLI at intervals to update the image running in the router.

Command Scheduler has two basic processes. A policy list is configured containing lines of fully-qualified EXEC CLI commands to be run at the same time or interval. One or more policy lists are then scheduled to run after a specified interval of time, at a specified calendar date and time, or upon system startup. Each scheduled occurrence can be set to run once only or on a recurring basis. 

Commands

RX2(config)# kron policy-list netx

RX2(config-kron-policy)# cli sh running-config | redirect tftp://172.16.1.150/backup-cfg

RX2(config-kron-policy)#  exit

RX2(config)#  kron occurrence netx-kron at 10:00 recurring

RX2(config-kron-occurrence)#  policy-list netx

RX2(config-kron-occurrence)#  exit

Verification:

RX2#sh kron schedule

Kron Occurrence Schedule

netx-kron inactive, will run again in 0 days 21:03:06 at 10:00 on

The above configuration can be used to schedule automatic backup of Cisco Router Configuration. As per the configuration given, Router is scheduled to take backup at 10:00AM everyday to TFTP Server specified.

Automatic Backup of Cisco Router Configuration using Archive

RX2(config)#archive

RX2(config-archive)#  path tftp://172.16.1.150/backup-cfg

RX2(config-archive)#  time-period 1440

RX2(config-archive)#  write-memory

RX2(config-archive)#  exit

The above configuration can be used to schedule automatic backup of Cisco Router Configuration. As per the configuration given, Router is scheduled to take backup every 24hrs as well as when ever user saves the changes using write-memory command to TFTP Server specified in path command.

Configuration Change Notification and Logging

About Configuration Log

The Configuration Change Notification and Logging feature tracks changes made to the Cisco IOS software running configuration by maintaining a configuration log. This configuration log tracks changes initiated only through the command-line interface (CLI) or HTTP. Only complete commands that result in the invocation of action routines are logged. The following types of entries are not logged:

•Commands that result in a syntax error message

•Partial commands that invoke the router help system

For each configuration command that is executed, the following information is logged:

•The command that was executed

•The configuration mode in which the command was executed

•The name of the user that executed the command

•The time at which the command was executed

•A configuration change sequence number

•Parser return codes for the command

You can display information from the configuration log through the use of the show archive log config command, with the exception of the parser return codes, which are for use by internal Cisco IOS applications only.

About Configuration Change Notifications and Config Change Logging

You can configure the Configuration Change and Notification Logging feature to send notification of configuration changes to the Cisco IOS software system logging (syslog) process. Syslog notifications allow monitoring of the configuration log information without performing polling and information gathering tasks.

The Configuration Change Notification and Logging feature allows the tracking of configuration changes entered by users on a per-session and per-user basis. This tool allows administrators to track any configuration change made to the Cisco IOS software running configuration, and identify the user that made that change. 

Commands

RX2(config)#archive

RX2(config-archive)#  log config

RX2(config-archive-log-cfg)#  hidekeys

RX2(config-archive-log-cfg)#  logging  enable

RX2(config-archive-log-cfg)#  notify syslog

RX2(config-archive-log-cfg)#  exit

Keyword “hidekeys” suppresses output of password while logging. 

Verification:

RX2#sh archive log config all

 idx   sess           user@line      Logged command

    1     1        console@console  |  logging enable

    2     1        console@console  |  notify syslog

    3     1        console@console  |  exit

    4     1        console@console  |   exit

    5     2        console@console  |router rip

    6     2        console@console  | exit

    7     2        console@console  |no router rip

     8    2        console@console  |enable password *****

Configuring SSH on Cisco Router

SSH Configuration:

RX1(config)#int f0/0
RX1(config-if)#ip address 10.1.1.1 255.0.0.0
RX1(config-if)#no shut
RX1(config-if)#exit
RX1(config)#ip domain-name networkexpert.co.in
RX1(config)#crypto key generate rsa general-keys modulus 1024
The name for the keys will be: RX1.networkexpert.co.in

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

RX1(config)#
*Mar  1 04:06:34.874: %SSH-5-ENABLED: SSH 1.99 has been enabled
RX1(config)#username netx password netx
RX1(config)#line vty 0 4
RX1(config-line)#login local
RX1(config-line)#transport input ssh

RX1(config-line)#exit

SSH from a Router to RX1:
RX3(config)#int f0/0
RX3(config-if)#ip address 10.1.1.2 255.0.0.0
RX3(config-if)#no shut
RX3(config-if)#end
RX3#ssh -l netx 10.1.1.1
Password:*****
RX1>enable
Password:*****
RX1#exit

[Connection to 10.1.1.1 closed by foreign host]
RX3#

Link:
Configuring Secure Shell on Routers and Switches Running Cisco IOS