Cisco Catalyst の設定テンプレート的な情報
前書き
プログラミングに関する知識ではないけど、Catalyst(Cisco のレイヤー2スイッチ)の設定に関するメモ。
ゼロから設定する機会はあまりないが、いざ設定しようとすると「何を設定すべきなんだっけ?」って調べてる気がするので、よく使うテンプレート的な設定をメモ書き。
テンプレート
!
no ip domain-lookup
!
username xxxxx privilege 15 secret xxxxx
enable secret xxxxx
!
aaa new-model
aaa authentication login VTY local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa session-id common
!
line con 0
exec-timeout 30 0
login authentication CONSOLE
exec prompt timestamp
transport preferred none
transport output telnet ssh
!
access-list 10 remark --- VTY ---
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
line vty 0 4
access-class 10 in
exec-timeout 30 0
login authentication VTY
exec prompt timestamp
transport input ssh
transport output telnet ssh
line vty 5 15
no login
no exec
!
ip routing
no ipv6 cef
ip cef
!
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
hostname xxxxx
logging buffered 65535
clock timezone JST 9 0
!
no errdisable detect cause all
!
vlan xxxxx
!
vtp mode transparent
spanning-tree mode rapid-pvst
spanning-tree extend system-id
no spanning-tree vlan XXXXX
spanning-tree vlan xxxxx priority xxxxx
!
interface range xxx - xxx
description xxxx
switchport access vlan xxxxx
switchport mode access
load-interval 30
storm-control broadcast level 5.00
storm-control action shutdown
spanning-tree portfast
logging event link-status
logging event spanning-tree status
no cdp enable
no shutdown
!
interface GigabitEthernet xxx
description xxxx
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport mode trunk
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
channel-protocol lacp
channel-group 1 mode active
!
interface Port-channel 1
description xxxx
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
!
interface Vlan xxxxx
ip address xx.xx.xx.xx xx.xx.xx.xx
no ip redirects
no ip proxy-arp
standby version 2
standby 1 ip xx.xx.xx.xx
standby 1 timers 1 3
standby 1 priority 110
standby 1 authentication md5 key-string xxxxx
standby 1 preempt delay minimum 60
standby 1 track xx decrement 20
no shutdown
!
ip default-gateway xx.xx.xx.xx
ip route 0.0.0.0 0.0.0.0 Vlan xxx xx.xx.xx.xx
!
no ip http server
no ip http secure-server
!
no cdp run
!
logging facility local xx
logging source-interface Vlan xxxxx
logging xx.xx.xx.xx
!
ip ssh version 2
!
access-list 20 remark --- SNMP ---
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
snmp-server community xxxxx RO 20
snmp-server trap-source Vlan xxx
snmp-server enable traps snmp xxxxx
!
access-list 30 remark --- NTP ---
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
ntp access-group peer 30
ntp master
ntp server xx.xx.xx.xx prefer
ntp server xx.xx.xx.xx
ntp server xx.xx.xx.xx
!
解説
!
no ip domain-lookup
!
username xxxxx privilege 15 secret xxxxx
enable secret xxxxx
!
aaa new-model
aaa authentication login VTY local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa session-id common
!
line con 0
exec-timeout 30 0
login authentication CONSOLE
exec prompt timestamp
transport preferred none
transport output telnet ssh
!
access-list 10 remark --- VTY ---
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
line vty 0 4
access-class 10 in
exec-timeout 30 0
login authentication VTY
exec prompt timestamp
transport input ssh
transport output telnet ssh
line vty 5 15
no login
no exec
!
ip routing
no ipv6 cef
ip cef
!
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
hostname xxxxx
logging buffered 65535
clock timezone JST 9 0
!
no errdisable detect cause all
!
vlan xxxxx
!
vtp mode transparent
spanning-tree mode rapid-pvst
spanning-tree extend system-id
no spanning-tree vlan XXXXX
spanning-tree vlan xxxxx priority xxxxx
!
interface range xxx - xxx
description xxxx
switchport access vlan xxxxx
switchport mode access
load-interval 30
storm-control broadcast level 5.00
storm-control action shutdown
spanning-tree portfast
logging event link-status
logging event spanning-tree status
no cdp enable
no shutdown
!
interface GigabitEthernet xxx
description xxxx
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport mode trunk
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
channel-protocol lacp
channel-group 1 mode active
!
interface Port-channel 1
description xxxx
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
!
interface Vlan xxxxx
ip address xx.xx.xx.xx xx.xx.xx.xx
no ip redirects
no ip proxy-arp
standby version 2
standby 1 ip xx.xx.xx.xx
standby 1 timers 1 3
standby 1 priority 110
standby 1 authentication md5 key-string xxxxx
standby 1 preempt delay minimum 60
standby 1 track xx decrement 20
no shutdown
!
ip default-gateway xx.xx.xx.xx
ip route 0.0.0.0 0.0.0.0 Vlan xxx xx.xx.xx.xx
!
no ip http server
no ip http secure-server
!
no cdp run
!
logging facility local xx
logging source-interface Vlan xxxxx
logging xx.xx.xx.xx
!
ip ssh version 2
!
access-list 20 remark --- SNMP ---
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
snmp-server community xxxxx RO 20
snmp-server trap-source Vlan xxx
snmp-server enable traps snmp xxxxx
!
access-list 30 remark --- NTP ---
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
ntp access-group peer 30
ntp master
ntp server xx.xx.xx.xx prefer
ntp server xx.xx.xx.xx
ntp server xx.xx.xx.xx
!
書こうかと思ったけどやめたw
個人的なメモな感じもあるし、ググった方が詳しい解説出てきますよね。。。
人から突っ込みもらったので、やっぱり頑張って書く。
-
no ip domain-lookup
- Cisco機器の多く(?)は、存在しないコマンドを入力すると、DNS名前解決しようと頑張っちゃいます
- DNSサーバの設定してなくても、ブロードキャストで問い合わせしたりして頑張っちゃう
- なので、
hoge
とか間違えて入力してもDNS問い合わせのタイムアウトを待たないといけなくなる - その機能を止めるおまじない
-
username xxxxx privilege 15 secret xxxxx
- 言わずと知れたユーザ名とパスワードの設定
-
privilege 15
しておくと、ログイン後に enable 状態になれる- 大多数の人は、ログインすると何をするにしても
enable
しちゃいますよね? - だったら最初から :)
- 大多数の人は、ログインすると何をするにしても
- 自動
enable
させたくないユーザは、privilege
設定しなけりゃいい
-
enable secret xxxxx
- ユーザに
priviledge 15
設定したとして、なんかの際には必要になる -
disable
コマンドでenable
状態を抜けたりしたときとか
- ユーザに
-
aaa new-model
,aaa session-id common
- 認証系の機能を有効化するのに必要
-
aaa authentication xxx xxx
辺りを使うのに必要 - それぞれの詳しい意味は忘れたw 気になる人は各自調べてくだせえ
aaa authentication login CONSOLE local
line con 0
login authentication CONSOLE
- 上記設定部分
- シリアルコンソールからのログインで、local の認証を使うようにする
- こうしておくと、ユーザ名の変更・追加だけで全てのログインアカウントを変更できる
- console 用パスワード、telnet,ssh 用アカウントを別に用意・設定するのは嫌いです
aaa authentication login VTY local
line vty 0 4
login authentication VTY
-
上記設定部分
- telnet, ssh ログインで、local の認証を使うようにする
- 上記したコンソール部分と同じ
-
aaa authorization exec default local
- デフォルトは、コンソールログインの認証は無効化されてるんじゃなかったっけか
- シンプルすぎる設定だと、
line con 0
にパスワードだけ設定されてますよね - あれを、アカウント認証にするための設定だった気がする
以下、これから説明頑張る
!
line con 0
exec-timeout 30 0
exec prompt timestamp
transport preferred none
transport output telnet ssh
!
access-list 10 remark --- VTY ---
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 10 permit xx.xx.xx.xx xx.xx.xx.xx
line vty 0 4
access-class 10 in
exec-timeout 30 0
login authentication VTY
exec prompt timestamp
transport input ssh
transport output telnet ssh
line vty 5 15
no login
no exec
!
ip routing
no ipv6 cef
ip cef
!
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
hostname xxxxx
logging buffered 65535
clock timezone JST 9 0
!
no errdisable detect cause all
!
vlan xxxxx
!
vtp mode transparent
spanning-tree mode rapid-pvst
spanning-tree extend system-id
no spanning-tree vlan XXXXX
spanning-tree vlan xxxxx priority xxxxx
!
interface range xxx - xxx
description xxxx
switchport access vlan xxxxx
switchport mode access
load-interval 30
storm-control broadcast level 5.00
storm-control action shutdown
spanning-tree portfast
logging event link-status
logging event spanning-tree status
no cdp enable
no shutdown
!
interface GigabitEthernet xxx
description xxxx
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport mode trunk
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
channel-protocol lacp
channel-group 1 mode active
!
interface Port-channel 1
description xxxx
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan xxx
switchport nonegotiate
logging event link-status
logging event trunk-status
logging event bundle-status
logging event spanning-tree status
load-interval 30
!
interface Vlan xxxxx
ip address xx.xx.xx.xx xx.xx.xx.xx
no ip redirects
no ip proxy-arp
standby version 2
standby 1 ip xx.xx.xx.xx
standby 1 timers 1 3
standby 1 priority 110
standby 1 authentication md5 key-string xxxxx
standby 1 preempt delay minimum 60
standby 1 track xx decrement 20
no shutdown
!
ip default-gateway xx.xx.xx.xx
ip route 0.0.0.0 0.0.0.0 Vlan xxx xx.xx.xx.xx
!
no ip http server
no ip http secure-server
!
no cdp run
!
logging facility local xx
logging source-interface Vlan xxxxx
logging xx.xx.xx.xx
!
ip ssh version 2
!
access-list 20 remark --- SNMP ---
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 20 permit xx.xx.xx.xx xx.xx.xx.xx
snmp-server community xxxxx RO 20
snmp-server trap-source Vlan xxx
snmp-server enable traps snmp xxxxx
!
access-list 30 remark --- NTP ---
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
access-list 30 permit xx.xx.xx.xx xx.xx.xx.xx
ntp access-group peer 30
ntp master
ntp server xx.xx.xx.xx prefer
ntp server xx.xx.xx.xx
ntp server xx.xx.xx.xx
!
Author And Source
この問題について(Cisco Catalyst の設定テンプレート的な情報), 我々は、より多くの情報をここで見つけました https://qiita.com/2zk/items/56c01e5398c8545dbc39著者帰属:元の著者の情報は、元のURLに含まれています。著作権は原作者に属する。
Content is automatically searched and collected through network algorithms . If there is a violation . Please contact us . We will adjust (correct author information ,or delete content ) as soon as possible .