Is there a command standard you wish Cisco would apply to every router? Every administrator has their own set of “correct” commands for configuring each router. The ten commands in this article are what I believe you should configure on every router, in no particular order.
1. Configure a Login Account on the Router
I strongly recommend configuring a real username and password account on routers and switches. Doing this means you need a user and password to gain access.
In addition, I suggest using a secret password for the username instead of just a regular password. It encrypts the password using the MD5 encryption method, which greatly enhances security. For example:
Router(config)#user name root secret My$Password
After configuring the username, you must enable the ports that use this username. For example:
Router(config)# line con 0
Router(config-line)#login local
Router(config)#line aux 0
Router(config-line)#login local
Router(config)#line vty 0 4
Router(config-line)#login local
2. Set a Hostname on the Router
I guess the default hostname on a router is router. You can keep this default, and the router will still run fine. However, it makes sense to rename the router and identify it uniquely. For example:
Router(config)#hostname Router-Branch-23
Additionally, you can configure a domain name on the router so it knows which DNS domain it belongs to. For example:
Router-Branch-23(config)#ip domain name TechRepublic.com
3. Set a Password for Privileged Mode
When it comes to setting a password for entering privileged mode, many people think of using the enable password command. However, instead of using this command, I strongly recommend using the enable secret command.
This command encrypts the password using the MD5 encryption method, so the prompt is not displayed in plain text. For example:
Router(config)#enable secret My$Password
4. Encrypt Router Passwords
Cisco routers, by default, do not encrypt passwords in the configuration. However, you can easily change this. For example:
Router(config)#service password-encryption
5. Disable Web Service
Cisco routers also have the web service enabled by default, which is a security risk. If you do not plan to use it, it is best to turn it off. For example:
Router(config)#no ip http server
6. Configure DNS, or Disable DNS Lookup
Let’s discuss what I personally consider a minor annoyance in Cisco routers: by default, if you mistype a command in privileged mode, the router assumes you are trying to Telnet to a remote host. However, it performs a DNS lookup on what you typed.
If you have not configured DNS on the router, the command prompt will hang until the DNS lookup fails. For this reason, I recommend using one of the two methods below.
One option is to disable DNS. Here is how:
Router(config)#no ip domain-lookup
Alternatively, you can properly configure DNS to point to a real DNS server.
Router(config)#ip name-server
7. Configure Command Aliases
Many network administrators know about configuring command abbreviations (i.e., aliases) on a router. For example:
Router(config)#alias exec s sh run
This means you can now enter s instead of having to type the full show running-configuration command.
8. Set the Router Clock, or Configure an NTP Server
Most Cisco devices do not have an internal clock. When they boot up, they do not know what time it is. Even if you set the time, if you power off or restart the router, it will not retain that information.
First, set your timezone and daylight saving time. Examples are as follows:
Router(config)#clock timezone CST -6
Router(config)#clock summer-time CDT recurring
Then, to ensure the router’s event messages display the correct time, set the router’s clock, or configure an NTP server. An example of setting the clock is as follows:
Router# clock set 10:54:00 Oct 5 2005
If you already have an NTP server in your network (or a router that can access the Internet), you can instruct the router to use it as a time source. This is your best option; when the router boots up, it will set the clock via the NTP server. For example:
Router(config)# ntp server 132.163.4.101
9. Stop Log Messages from Disturbing Your Configuration Process
Another minor annoyance I find in Cisco IOS is that log messages constantly pop up on the console interface (which could be the console port, AUX port, or VTY port) while I am configuring the router. To prevent this, you can do the following.
So, on every port line, I use the logging synchronous command. For example:
Router(config)#line con 0
Router(config-line)#logging synchronous
Router(config)#line aux 0
Router(config-line)#logging synchronous
Router(config)#line vty 0 4
Router(config-line)#logging synchronous
In addition, you can modify the exec-timeout for these ports. For instance, let’s say you want to disable the default ten-minute timeout on VTY lines. Use the exec-timeout 0 0 command in line configuration mode to make the router never time out.
10. Log System Messages in the Router Buffer or to a Syslog Server
Capturing router errors and events as well as monitoring the console is key to troubleshooting. By default, the router does not send buffered event logs to the router’s memory.
However, you can configure the router to send buffered event logs to memory. For example:
Router(config)#logging buffered 16384