In my last Daily Drill Down, I introduced you to the fundamentals of the Cisco Internetwork Operating System (IOS). This time around, we will dig just a little deeper and discuss the Cisco command-line help system, configuration modes, and the bootstrap process. After reading this Daily Drill Down, you should be ready to move on to the actual set up of your Cisco router.
And now a few words about the help function, which has been built into the IOS command-line interface (CLI) since IOS version 8.3: Cisco's IOS help is pretty intuitive, but I'll show you a few basic features that will allow you to work more efficiently. Several features of the IOS CLI enable you to enter commands correctly. First, however, I’ll show you how to get a brief description of how to use help. Simply type help at a command prompt, as shown here:
Help may be requested at any point in a command by entering a question mark (?). If nothing matches, the help list will be empty and you must back up until entering a ? shows the available options. Two styles of help are provided:
- Full help is available when you are ready to enter a command argument (e.g., show ?) and describes each possible argument.
- Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g., show pr?).
Context-sensitive help can be obtained by typing a question mark (?). The IOS determines the context by the command mode and then displays appropriate help text. The error-messaging system in Cisco is quite wide and, you might say, smart, so it can easily be used as an add-on to the help system. When you type a question mark at the end of a command line, there’s no need to press [Enter]. The question mark is interpreted as the end of the command line, and help is immediately displayed if it is available, as shown in the following example:
*p=ping pad ping ppp
For very high-level help, typing a question mark by itself on a command line tells the IOS to display a list of all of the commands allowed on the current mode command line. Here’s an example for standard (not restricted) user mode:
<1-99> Session number to resume
access-enable Create a temporary Access-List entry
clear Reset functions
connect Open a terminal connection
disable Turn off privileged commands
disconnect Disconnect an existing network connection
enable Turn on privileged commands
exit Exit from the EXEC
help Description of the interactive help system
lock Lock the terminal
login Log in as a particular user
logout Exit from the EXEC
mrinfo Request neighbor and version information
from a multicast router
mstat Show statistics after multiple multicast
mtrace Trace reverse multicast path from
destination to source
name-connection Name an existing network connection
pad Open a X.29 PAD connection
ping Send echo messages
ppp Start IETF Point-to-Point Protocol (PPP)
resume Resume an active network connection
rlogin Open an rlogin connection
show Show running system information
slip Start Serial-line IP (SLIP)
systat Display information about terminal lines
telnet Open a telnet connection
terminal Set terminal line parameters
traceroute Trace route to destination
tunnel Open a tunnel connection
where List active connections
x3 Set X.3 parameters on PAD
I'd like to mention, however, that a command can be available in some modes but not listed in the output. This is a bug, and Cisco is aware of it, but you, as potential network engineers, should know about it. Unfortunately, because of this bug, a lot of routers have a weak point, so you must consider this flaw before enabling an account for a user on your router. Hackers can glean quite a bit of pretty harmful information by exploiting this bug. Here’s a sample using the show logging command:
% Unrecognized command
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: level debugging, 8008 messages logged
Monitor logging: level debugging, 0 messages logged
Trap logging: level informational, 8012 message lines logged
The show logging command should not be available in user mode, but it is and that is extremely bad.
Every mode has such a help system built in. You can use the magic question mark in user mode as well as in sub-configuration mode. You'll find it very useful, I assure you. Since the help context is rather large, I'll skip the sample output screens for all modes.
The help messages are easy enough. The following value types can appear in the first column of help text:
- Lowercase text (indicating that the text itself can be typed)
- Uppercase text (indicating that alphanumeric text, but not just a number, can be typed)
- Various combinations of uppercase and lowercase text
- A range of numbers in angle brackets (indicating that a numeric value within the range can be typed)
- The text <CR> (indicating that no further arguments are required)
Okay, now that we have the ability to make changes to router configurations, let’s find out how to actually make changes.
The IOS configuration modes are used for entering IOS configuration commands that affect the way the IOS runs on a router. First, we enter the so-called main configuration mode. From this configuration mode, we can enter the sub-configuration modes. The configuration mode required for a command depends on what is being configured and what command is being entered. All commands that are entered in a configuration mode affect the running configuration, and configuration commands take effect immediately when they are entered.
It goes without saying that we can get to configuration mode only through privileged mode. (Besides, user-mode and privileged-mode commands are not accepted in the configuration modes.)
The first configuration mode is the main configuration mode. In this configuration mode, we can make changes that affect the overall, or global, operation of the IOS. For example, we can enter commands that change a router's hostname, start processes or services, and set some of the passwords.
You can configure a Cisco router by a number of different methods, such as from NV memory or from a TFTP network host or terminal. The most useful way is configuring from the terminal.
The configure terminal command is a privileged-mode command used to enter configuration mode if you’re using a terminal for configuration commands. The IOS will accept the command only in privileged mode. Here’s some sample output:
Enter configuration commands, one per line. End with CNTL/Z.
The (config) string in the command prompt indicates that you have successfully entered configuration mode. To exit from it, you can press [Ctrl]Z, type exit, or type end to return to privilege mode. I'd like to mention that the [Ctrl]Z key combination is not quite the same as the exit command, but it is the same as the end command. [Ctrl]Z forces the terminal to switch back to privileged mode immediately—it doesn't care whether you're in configuration mode or sub-configuration mode.
From the main configuration mode, you can move to the other configuration modes. You can enter the main configuration commands in any of the configuration modes.
The sub-configuration modes are used to configure individual components such as interfaces, lines, controllers, or processes. The command to enter a sub-configuration mode varies based on the component being configured. For example, if you want to configure an interface, you must get into interface configuration mode. To get into interface configuration mode, you must enter the interface command in global configuration mode. The interface command requires the full interface name, followed by the type and number. Here’s an example:
Enter configuration commands,(one per line, and end with CNTL/Z).
core-rtr1(config)#interface ethernet 1/0
In the above example, we entered the Ethernet interface configuration mode. The (config-if) string in the command prompt indicates that we successfully entered a sub-configuration mode.
There are some 20 sub-configuration modes, including access-list configuration mode, APPN command mode, controller configuration mode, hex input mode, and so on. I won’t list all of them now, but we'll master them eventually.
The last mode I'm going to discuss today is ROM monitor mode. It isn’t really an IOS mode; it’s more of a mode that a router can be in if the IOS is not running. If a router attempts to boot and cannot find a good IOS image to run, then the router will enter ROM monitor mode. In other words, the system will enter read-only memory monitor mode in order to let you boot the device or perform diagnostic tests. You can also purposely cause the router to enter ROM monitor mode by sending a break signal, [Ctrl][Shift][F6], from the console terminal within 60 seconds of the start of the router's boot sequence. Purposely entering ROM monitor mode is usually done only as one of the steps for recovering a lost password.
ROM monitor mode has commands that allow you to manually boot a router by loading a valid IOS image. The exact commands and prompt vary by router model. The command prompt is usually just a greater-than sign (>).
To return to user EXEC mode from ROM mode, type continue. To initialize the router or access server, type an i command; this will cause the bootstrap program to re-initialize the hardware, clear the contents of memory, and boot the system. Cisco specialists advise issuing the i command before running any tests or booting software.
The Cisco bootstrap process
Now, let’s go through the Cisco bootstrap process. Here's a sample output, which, as you can see, accesses a router through a CON (console) port.
System Bootstrap, Version 11.1(7)AX [kuong (7)AX], EARLY DEPLOYMENT
RELEASE SOFTWARE (fc2)
Copyright (c) 1994-1996 by Cisco Systems, Inc.
C3600 processor with 65536 Kbytes of main memory
Main memory is configured to 64 bit mode with parity disabled
program load complete, entry point: 0x80008000, size: 0x7c37d8
Self decompressing the image : #################################### [OK]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco Internetwork Operating System Software
IOS (tm) 3600 Software (C3640-IS-M), Version 12.0(7)T,
RELEASE SOFTWARE (fc2)
Copyright (c) 1986-1999 by Cisco Systems, Inc.
Compiled Wed 08-Dec-99 01:53 by phanguye
Image text-base: 0x600088F0, data-base: 0x60E02000
Processor board ID 05251448
R4700 CPU at 100Mhz, Implementation 33, Rev 1.0
Channelized E1, Version 1.0.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
Primary Rate ISDN software, Version 1.1.
1 FastEthernet/IEEE 802.3 interface(s)
60 terminal line(s)
2 Channelized E1/PRI port(s)
DRAM configuration is 64 bits wide with parity disabled.
125K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)
Press RETURN to get started!
Let me comment on this output from the top down. First, the router boots with an IOS 11.1(7)AX, which is precompiled. It's used for loading direct-boot images from Cisco flash memory, from a TFTP server, or from somewhere else. After that, we see how the router loads an image (in this instance, from flash memory). Most modern IOS images contain many functions and are very large in size. For this reason, you should use compression to load these images. A # sign appears to indicate the process of self-decompressing an image.
When an image has been successfully decompressed, as indicated by the [OK] message, the router shows the license. Then, it boots the IOS image and tries to build its configuration from a previously saved configuration.
The “Press RETURN to get started!” message means that the router booted, loaded, and is ready to run.
Once you have read and tried all the examples mentioned in this Daily Drill Down, you should be ready to start a real-world configuration process (such as upgrading an IOS, changing the name of the router, or configuring an Ethernet interface). But do yourself a favor before starting to do anything serious—make sure you are familiar with at least the basics of Cisco's command-line help system and interface. This will help keep you safe.
The authors and editors have taken care in preparation of the content contained herein but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.