But what if we want to track what we actually drop as a result of this powerful implicit deny all effect? Well, a clever trick is to end the list with an explicit deny statement and log the result. In this post, we will examine this technique.

Let’s create a named, standard ACL that permit packets sourced from the 10.x.x.x address space.

ip access-list standard AL_PERMIT_10
permit 10.0.0.0 0.255.255.255

Now I will apply this ACL inbound to a router interface and generate some traffic that matches this statement. When we run the command show access-lists, we can see from the “hit counter” that the permit has caught some matches. But what about packets that have failed?

R1(config-std-nacl)#int fa0/0
R1(config-if)#ip access-group AL_PERMIT_10 in
R1(config-if)#end
R1#
R1#show access-lists
Standard IP access list AL_PERMIT_10
10 permit 10.0.0.0, wildcard bits 0.255.255.255 (57 matches)

In order to be alerted about packets that hit the implicit deny all, we need to create an explicit one. If we are really concerned about packets that do not match any permits, we can add the log option so we can be alerted at the command line, in addition to being notified when we do the show access-list command.

R1(config)#ip access-list standard AL_PERMIT_10
R1(config-std-nacl)#deny any log

After this configuration change, watch what happens when someone from 1.1.1.1 tries to ping into R1 through our interface:

R1#
*Mar  1 00:12:23.251: %SEC-6-IPACCESSLOGNP: list AL_PERMIT_10 denied 0 1.1.1.1 -> 10.0.0.1, 1 packet
R1#show access-lists
Standard IP access list AL_PERMIT_10
10 permit 10.0.0.0, wildcard bits 0.255.255.255 (117 matches)
20 deny   any log (5 matches)

One question I often get from students at this point is: why did we only get one notification (of one packet) via the command line system message, but there were in fact 5 packets that were blocked (as depicted in the show command output)?

The answer is that the IOS is being smart here and it will batch up the log messages so that the system is not overwhelmed in trying to show us all of these matches in real time.

I hope you are enjoying CCNA studies here at INE!

<!--[if !supportLists]-->1)    <!--[endif]--> Are passwords required on vty lines?

<!--[if !supportLists]-->2)    <!--[endif]--> How do you configure vty passwords?

Here we look at 4 options:

<!--[if !supportLists]-->1)    <!--[endif]--> Line passwords

<!--[if !supportLists]-->2)    <!--[endif]--> Local username passwords

<!--[if !supportLists]-->3)    <!--[endif]--> No login

<!--[if !supportLists]-->4)    <!--[endif]--> AAA

By default, when you telnet to the vty line of a router or switch, you will see the following output:

           C:\>telnet 10.1.2.1

           Password required, but none set

           [Connection to 10.1.2.1 closed by foreign host]

The router/switch will drop your connection as a password is required for access to the router/switch. So by default you can see that a password is required to telnet to the vty lines of a router or switch.

Line passwords:

A password can be used on the line for access. This is easy to setup as there is only one password, but it not very secure because everyone shares that single password and it is difficult to track who has made changes.

This is configured as follows:

           Router>enable

          Router#configure terminal

           Router(config)#line vty 0 4

           Router-2(config-line)#login

           % Login disabled on line 2, until 'password' is set

           % Login disabled on line 3, until 'password' is set

           % Login disabled on line 4, until 'password' is set

           % Login disabled on line 5, until 'password' is set

           % Login disabled on line 6, until 'password' is set

           Router(config-line)#password configureterminal.com

 When a telnet connection is now made to the router, the router will prompt for a password:

            C:\>telnet 10.1.2.1

           User Access Verification

           Password:

Enter your password and you are now in user mode:

           Router>

Local usernames:

This is better than using a line password as different users have their own individual passwords. Each use is required to enter their own passwords rather than using a shared password. This helps with logging which user has made changes to the router.

           Router>enable

           Router#configure terminal

           Router(config)#username david password configureterminal.com

           Router(config)#line vty 0 4

           Router-2(config-line)#login local

Testing:

           C:\>telnet 10.1.2.1

           User Access Verification

           Username:david

           Password:

Enter your password and you are now in user mode:

           Router>

 No password (not recommended):

It is possible to set up a router to allow vty connections without authentication. This is not a good idea for the real world, but in a lab environment it can save time.

           Router>enable

           Router#configure terminal

           Router(config)#line vty 0 4

           Router-2(config-line)#no login

Testing:

           C:\>telnet 10.1.2.1

           Router>

Notice that no authentication was required. You are taken directly to user mode.

 AAA servers:

This is the most secure and scalable way of implementing authentication. This uses a central server where all usernames and passwords are stored. A windows 2000/2003 server could be used for example, so that users use the same passwords on windows and routers/switches.

           Router>enable

           Router#configure terminal

           Router(config)#aaa new-model

           Router(config)#aaa authentication login default group tacacs+

           Router(config)#line vty 0 4

           Router(config)#login authentication default

Testing:

C:\>telnet 10.1.2.1

           User Access Verification

           Username: david

           Password:

           Router>

As you can see, there are various ways to secure the vty lines on routers & switches. 

What is Cisco's macro implementation?

The smartport macro feature was introduced in IOS version 12.1(20)EA1.  Default templates are stored on your device, to view the commands stored in the macros execute the following command:

         show parser macro

Each macro is a set of CLI commands that are defined and "wrapped-up".  When a macro is applied the commands are simply dumped at that level.  Global and interface specific macro's can be created but we are going to focus on creating custom interface macro's.

General guidelines:

Creating a macro is very similar to creating a banner, a character has to be used to identify the start and end of the macro - for example "@" is used by default.
Names are case sensitive.  When a macro is applied all existing configuration is maintained, if more than one macro is applied a description is amended to record a basic history.  Macros are stored in running-configuration until saved to startup-configuration, if a macro is amended the changes aren't sent to interfaces which have the macro applied - the macro would need re-applying.

How to create a custom macro:

         configure terminal
         !=== Enter global configuration mode

         macro name macro-name
         !=== Create macro

         "Enter macro commands one per line.  End with the character '@'."
         cli command 1
         cli command 2
         cli command 3
         !=== Enter commands
         @
         !=== Finish macro

Apply macro:

         configure terminal
         interface FastEthernet0/1
         !=== Enter interface configuration
         macro apply macro-name
         !=== Apply macro

Verify:

         show running-configuration | be macro
         !=== Shortcut to first instance of the string "macro"

         macro name macro-name
         cli command 1
         cli command 2
         cli command 3
         @
         !=== Verify macro exists in config
         /FastEthernet0/1
         !=== Shortcut to string "FastEthernet0/1"
         cli command 1
         cli command 2
         cli command 3
         !=== Verify commands exist on interface

Parameters:

Not all IOS commands are fixed, for example when applying the command "switchport access vlan ?" ? represents a value which can change depending on the individual switchport.  Cisco included the ability to define a parameter in a macro which when applied can be used to specify what the variable is.

For example:

         configure terminal
         macro name changevlan
         switchport access vlan $access
         @
         !=== Create macro

         interface FastEthernet 0/1
         macro apply changevlan $access 100
         !=== Apply macro - variable = 100 - put interface in vlan 100


Handy custom macro templates:

If some of the commands below don't make any sense whatsoever don't panic, a layer 2 security ebook covering many of them is in the first stages of creation.

         macro name data
         switchport
         switchport mode access
         switchport access vlan $access
         switchport port-security
         switchport port-security maximum 1
         switchport port-security aging time 2
         switchport port-security aging type inactivity
         switchport port-security violation protect
         spanning-tree portfast
         spanning-tree bpduguard enable
         spanning-tree bpdufilter enable
         ip dhcp snooping limit rate 10
         storm-control broadcast level 20.00
         storm-control multicast level 50.00
         storm-control unicast level 30.00
         storm-control action trap
         no cdp enable
         no snmp trap link-status
         @

         macro name datavoice
         switchport
         switchport mode access
         switchport access vlan $access
         switchport voice vlan $voice
         switchport port-security
         switchport port-security maximum 3
         switchport port-security aging time 2
         switchport port-security aging type inactivity
         switchport port-security violation protect
         srr-queue bandwidth share 10 10 60 20
         srr-queue bandwidth shape  10  0  0  0
         mls qos trust device cisco-phone
         mls qos trust cos
         auto qos voip cisco-phone
         spanning-tree portfast
         spanning-tree bpduguard enable
         spanning-tree bpdufilter enable
         ip dhcp snooping limit rate 10
         storm-control broadcast level 20.00
         storm-control multicast level 50.00
         storm-control unicast level 30.00
         storm-control action trap
         cdp enable
         no snmp trap link-status
         @

         macro name uplink
         switchport trunk encapsulation dot1q
         switchport mode trunk
         switchport trunk native vlan $native
         switchport trunk allowed vlan all
         switchport nonegotiate
         auto qos voip trust
         mls qos trust dscp
         spanning-tree link-type point-to-point
         ip arp inspection trust
         ip dhcp snooping trust
         ip dhcp snooping limit rate 100
         ip dhcp relay information trusted
         flowcontrol receive desired
         udld port
         cdp enable
         snmp trap link-status
         @

Handy tips

A macro may contain the entire configuration wanted on an interface, if this is the case and you want to ensure that the interface configuration is blank use the default command first:

         configure terminal
         default interface FastEthernet0/1
         interface FastEthernet0/1
         macro apply data $access 100

To apply a macro to more than one interface simply use the interface range command:

          configure terminal
          interface range FastEthernet 0/1 - 24
          macro apply data $access 100

If AAA is offloaded to a TACACS server for config-command authorization applying a macro to an interface range can fail due to the delay created by the request and approval procedure for each command.  I have found that although it's a little naughty the following can get around this:

          configure terminal
          no aaa new-model
          default interface range FastEthernet0/1 - 24
          interface range FastEthernet0/1 - 24
          macro apply data $access 100
          exit
          aaa new-model

Macro descriptions can be managed like a normal interface description:

          configure terminal
          interface FastEthernet0/1
          no macro description
          macro description data

"macro trace macro-name" instead of "macro apply macro-name" will display commands as they are entered

Modifying of macro's isn't possible, creating a macro with the same name will overwrite the existing macro (ensure all commands are present)

Don't use exit or end within a macro, this can cause commands to be executed at a different level.

I have found that macro configuration cannot be rolled out to devices using certain management tools so bear this in mind.