Config AAA, CoPP, SSH

Question 1

What are the commands to set a password on a router’s console port (two commands)?

Answer 1

Router(config)# line console 0
Router(config-line)# password {the-password}

Question 2

What are the commands to set a password on a router’s auxiliary port (two commands)?

Answer 2

Router(config)# line aux 0
Router(config-line)# password {the-password}

Question 3

What are the commands to set a password on a router’s ssh/telnet ports (two commands)?

Answer 3

Router(config)# line vty 0 4
Router(config-line)# password {the-password}

Question 4

What is the command to create a local username and password on a router?

Answer 4

Router(config)# username {user} [privilege {0-15}] algorithm-type {md5 | sha256 | scrypt} secret {the-password}

Example:
Router(config)# username adminxx privilege 15 algorithm-type sha256 secret p@$$W0rd!

Question 5

What is the command to specific use of the local username and password for logging into a telnet or ssh session?

Answer 5

Router(config-line)# login local

Question 6

What is the command to set a session timeout on a telnet/ssh port?

Answer 6

Router(config)# line vty 0 4
Router(config-line)# exec-timeout {number in minutes}

Question 7

What are the commands to setup SSH on a router including local login? (7 commands)

Answer 7

Router(config)# username {user} password {password}
Router(config)# ip domain-name {domain.com}
Router(config)# crypto key generate rsa modulus {bits}
Router(config)# ip ssh version 2
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local

Question 8

When configuring privilege levels for a user account, what do the built-in privilege levels 0, 1, and 15 mean?

Answer 8

0 - only allows five commands: logout, enable, disable, help and exit.
1 - read only and “ping”
15 - full access to all commands

Question 9

What is the command to set a CLI command to a custom privilege level?

Answer 9

Router(config)# privilege {mode-name} level {#} {command}

Examples:
Router(config)# privilege exec level 5 configure terminal
Router(config)# privilege configure level 5 interface
Router(config)# privilege interface level 5 shutdown

Question 10

When configuring privilege levels for a user account, what do levels 2 through 14 do?

Answer 10

Privilege 2 through 14 are custom configurable levels. In theory the higher levels would have more access but this depends on what was configured.

Question 11

What command enables AAA services on a Cisco device?

Answer 11

Router1(config)# aaa new-model

Question 12

What are the commands to set a TACACS server on a Cisco device?
(3 commands)

Answer 12

Router1(config)# tacacs server NAME
Router1(config-server-tacacs)# address ipv4 {ip-address}
Router1(config-server-tacacs)# key {key-string}

Question 13

What are the commands to create a TACACS server group?
(2 commands)

Answer 13

Router1(config)# aaa group server tacacs+ GROUP-NAME
Router1(config-sg-tacacs+)# server name SERVER-NAME

Question 14

What is the command to set AAA authentication to look at the TACACS group for all interface types (con, aux, vty)?

Answer 14

Router1(config)# aaa authentication login default group GROUP-NAME [local]

Question 15

What is the command to set AAA authorization for exec mode to look at the TACACS group for all interface types (con, aux, vty)?

Answer 15

Router1(config)# aaa authorization exec default group TACACS-GRP1 [if-authenticated]

Question 16

What is the command to set AAA authorization for privileged exec mode to look at the TACACS group for all interface types (con, aux, vty)?

Answer 16

Router1(config)# aaa authorization enable default group TACACS-GRP1 [local] [enable]

Question 17

What are the 3 main pieces of MQC?

Answer 17

• Class-Map: identify traffic
• Policy-Map: take action/police traffic
• Service-Policy: where to apply the policy (for CoPP its the control plane)

Question 18

What are the commands to create a class-map and match on an ACL that was created named ICMP_ACL? (2 commands)

Answer 18

Router(config)# class-map match-any CLASS_NAME
Router(config-cmap)# match access-group name ACL_NAME

Question 19

What is the command to create a policy map?

Answer 19

R1(config)# policy-map POLICY_NAME

Question 20

What is are the commands to add treatment to a class-map inside a policy map?

Answer 20

R1(config-pmap)# class CLASS_NAME
R1(config-pmap-c)# police {target-bps} conform-action {action} exceed-action {action} violate-action {action}

Example:

R1(config-pmap)# class ICMP_CLASS
R1(config-pmap-c)# police 8000 conform-action transmit exceed-action drop violate-action drop

Question 21

What are the commands to apply the policy map to the control plane on a Cisco device? (2 commands)

Answer 21

R1(config)# control-plane
R1(config-cp)# service-policy input POLICY_NAME

Question 22

What command can you use to verify the service policy applied to a control plane?

Answer 22

R1# show policy-map control-plane input