Set up SNMP v3 on Cisco IOS

conf t
snmp-server group group_name v3 priv
snmp-server group group_name v3 priv read secure_ro write secure_rw access 5
snmp-server view secure_ro internet included
snmp-server view secure_rw mgmt included
snmp-server user snmp_user iksecure v3 auth md5 auth_password priv des56 priv_password

access-list 5 permit host x.x.x.x
access-list 5 deny any log


show snmp group
show snmp user

How to Span a Port on a Cisco Switch

Analyzing network traffic on network segments is an interest and goal of all Network Administrators, Network Security Engineer, or System Administrators. A switch creates virtual connections between hosts connected to the switch. In order to analyze all traffic on a Vlan, you'll need to 'mirror', or in Cisco parlance, 'SPAN' a port. What this means is that the traffic of all private virtual connections made between all ports belonging to a given Vlan is mirrored or 'span'ned to a designated port on the switch. Typically, you'd connect an IDS or system with a sniffer/traffic analyzer to the 'span'ned port.

# monitor session 1 source vlan 1
# monitor session 1 destination interface gi0/44

Show spanned ports:

# show monitor

To terminate the span:

# no monitor session 1


If you're really serious about analyzing traffic, especially in large volumes, you'd want to buy a "network tap". Here is a little more detail.

Here's a tap reseller.

 

Configuring NTP in Cisco IOS

ntp server 69.60.124.59
ntp server 98.172.32.171
ntp server 208.113.193.9
ntp server 216.184.20.83
ntp server 66.250.45.2
clock timezone PST -8

Using Native VLAN's for improved security and redundancy

We have three zones. Public, DMZ, and Inside. I created vlan 20 for Public, 30 for DMZ, and vlan 40 for Inside. Then i created vlan dummy_vlan2, dummy_vlan3, and dummy_vlan4, then i went into the vlan database and suspended each. Then, I went to each access port (via the interface-range qualifier) and assigned the native vlan and set the vlan membership explicitly, nearly the same as you showed in your article (you showed an example of allowing all vlans). Finally, I explicited allowed only vlans 20,30, and 40 on the Trunk.

I hope this is the appropriate place for it, but here is how I set it up, straight from the documentation I wrote.

——

+ Set up the Aggregated Ports

Set up PAGP on Switch01 side

# conf t
(config)# interface range gi 1/43 - 44
(config-if-range)# channel-group 1 mode desirable

Set up PAGP on Switch02 side

(config)# interface range gi 1/43 - 44
(config-if-range)# channel-group 1 mode desirable

port-channel 1 is the resulting virtual interface

The following command will verify what has been set up.
# show etherchannel summary

Set up the IEEE 802.1Q Trunk

SW02

(config)# interface port-channel 1
(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk

SW01

(config)# interface port-channel 1
(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk

+ Configure VTP

SW01

(config)# vtp mode server
(config)# vtp domain xxxxxxx
(config)# vtp password xxxxxxxxxxxxxxx

SW02

(config)# vtp mode server
(config)# vtp domain xxxxxxx
(config)# vtp password xxxxxxxxxxxxxxx

+ Vlan Configuration

SW01
Create Dummy VLANs

(config)# vlan 2
(config-vlan)# name dummy_vlan2
(config)# vlan 3
(config-vlan)# name dummy_vlan3
(config)# vlan 4
(config-vlan)# name dummy_vlan4
(config)# end

Suspend dummy_vlan’s

#vlan database
#vlan 2 state suspend
#vlan 3 state suspend
#vlan 4 state suspend

Create Active VLAN’s

#vlan 20
#name PUBLIC_VLAN
#interface range 1/1 - 4
#switchport access vlan 20
#switchport trunk native vlan 2

#vlan 30
(config-vlan)#name DMZ_VLAN
(config-vlan)#interface range 1/17 - 32
(config-vlan)#switchport access vlan 30
(config-vlan)#switchport trunk native vlan 3

#vlan 40
(config-vlan)#name INSIDE_VLAN
(config-vlan)#interface range 1/33 - 35
(config-vlan)#switchport access vlan 40
(config-vlan)#switchport trunk native vlan 4

Configure Trunk Interface

(config)# interface port-channel 1
(config-if)# switchport trunk allowed vlan 20,30,40
(config-if)#end
# wr mem

Configuring SSH in Cisco IOS

To Configure SSH

1. Configure AAA
2. Configure SSH
3. Configure VTY


Configure AAA
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local


Configure SSH
hostname
ip domain-name somedomain.com
crypto key generate rsa
ip ssh version 2
no ip ssh timeout


Configure VTY
line vty 0 4
login
transport input ssh
password 0


Check SSH Configuration

show ssh
show ip ssh
show ip ssh vty