Chapter 38 - Device Management Protocols

Question 1

What command(s) are used to enable logging for users logged in via a terminal emulator (Telnet, SSH)?

Answer 1

‘logging monitor’
‘terminal monitor’ (by the user when logged in each session)

Question 2

What methods are there of viewing log messages?

Answer 2

• They can appear on the Console Lines:
  - Log messages will be displayed in the CLI when connected via the console port.
  - This is enabled using the ‘logging console’ command.
• They can appear on the VTY Lines:
  - Log messages will be displayed in the CLI when connected via Telnet/SSH.
  - Disabled by default.
  - This is enabled using the ‘logging monitor’ command.
  - The users will then need to use ‘terminal monitor’ once they have logged in.
• They can be stored in RAM:
  - This is enabled using the ‘logging buffered’ command.
  - A user can then use the ‘show logging’ command to view the stored messages.
• They can be stored on a syslog server:
  - This is configured using the ‘logging host <ip>' command.
  - Syslog uses UDP 514.
  - This can then be inspected in the remote syslog server.</ip>

Question 3

What command(s) can you use to enable timestamps for IOS logging messages?

Answer 3

‘service timestamps’ from global config

Question 4

What command(s) can you use to enable sequence numbers for IOS logging messages?

Answer 4

‘service sequence-numbers’ from global config

Question 5

What are the different keywords and numbers that Cisco IOS uses to identify log message severity levels?

Answer 5

• 0 - Emergency - System Unusable (Severe)
• 1 - Alert - Immediate Action Required (Severe)
• 2 - Critical - Critical Event (Highest of 3) (Impactful)
• 3 - Error - Error Event (Middle of 3) (Impactful)
• 4 - Warning - Warning Event (Lowest of 3) (Impactful)
• 5 - Notification/Notice - Normal, More Important (Normal)
• 6 - Informational - Normal, Less Important (Normal)
• 7 - Debug - Requested by User (Debug)

Question 6

What command(s) are used to enable different levels of logging on different services?

Answer 6

• Console - ‘logging console <level-name>'</level-name>
• Monitor (SSH/Telnet) - ‘logging monitor <level-name>'</level-name>
• Buffered (Store locally) - ‘logging buffered <level-name>'</level-name>
• Syslog (Store remotely) - ‘logging trap <level-name>' to config level
  ‘logging host <ip>’ to config syslog server</ip></level-name>

Question 7

What command can you use to clear Buffered log messages?

Answer 7

‘clear logging’

Question 8

What does the ‘debug’ command do?

Answer 8

Enables Debug (severity level 7) messages to be sent for specific events (e.g. ‘debug ip ospf hello’ will display all hello messages sent and received on OSPF enabled interfaces)

Question 9

What command can you use to display current CPU load on an IOS device?

Answer 9

‘show process cpu’

• Useful when enabling debug level logging as it can have an impact on CPU depending on what it is being enabled for

Question 10

What is NTP?

Answer 10

• Network Time Protocol
• Gives network devices a sense of time and date and allows networks to sync their clocks so they all have the correct times and dates when compared to each other
• Important for things such as logging to ensure the time on log entries is correct.

Question 11

Best practice before enabling a device to contact an NTP server

Answer 11

• Set the time, date, timezone, and daylight savings status to as close to the current time as possible. This will make it easier for the device to synchronise to the NTP server.
• Set the timezone and daylight savings status before setting the time and date.

Question 12

What command(s) do you use to set the timezone and daylight savings status for an IOS device?

Answer 12

• Timezone - ‘clock timezone <timezone (e.g. BST)> <how many hours compared to UTC (e.g. -5)>’
  - The timezone parameter can be any value. It is best to set this to the name of the timezone the device is
  in.
  - The parameter after this defines how many hours behind Universal Coordinated Time the device is.
• Daylight savings - ‘clock summer-time <timezone> <recurring>'
  - The timezone parameter can be any value. It is best to set this to the name of the daylight savings
  timezone the device is in.
  - The 'recurring' parameter tells the device to go forward/backward by an hour over the coming years
  when the timezones change from/to daylight savings.
  - At the end of the command, you can also add when daylight savings time begins and ends in your
  timezone. '<week> <day> <month> <time>'. The end parameters are entered in the same order after the start parameters.</time></month></day></week></recurring></timezone>

Question 13

What command(s) do you use to manually set the time/date of an IOS device?

Answer 13

‘clock set <time (hh:mm:ss)> <date (Day Month Year)>’ - Software clock
‘calendar set <time (hh:mm:ss)> <date (Day Month Year)>’ - hardware clock

Question 14

What command(s) do you use to make a device an ntp server only (NTP Server mode)?

Answer 14

• ‘ntp master <stratum>'</stratum>
• Causes the device to only act as a server
• Hands out the time based on the device’s own internal clock

Question 15

What command(s) do you use to make a device an ntp client?

Answer 15

• ‘ntp server <address or hostname>’
• Causes the device to act as a client and a server
• Will first act as a client to synchronise with a reference clock.
• Once synchronised, will then act as a server to hand out the time to other clients.

Question 16

When using the ‘ntp associations’ command, what part of the output determines what NTP server the device is currently synchronised with?

Answer 16

An ‘*’ before the association

Question 17

What is the Stratum level of a NTP server?

Answer 17

• How accurate the NTP source is believed to be.
• The lower the number, the more accurate the NTP source.
• It starts at 0 and increases by 1 on the local device for each NTP server hop away from the reference clock the local device is.
  - For example, R1 (server with stratum 0), connects to R2 (client), which connects to R3 (client). The
  stratum on R3 for reference clock R1 will be 2 if R3 uses R2 as its server. If R3 just decides to use R1 then
  it will be stratum 1.

Question 18

What stratum level do Cisco routers and switches use for their internal clock by default?

Answer 18

• 8
• This is the reference clock for a router when the ‘ntp master’ command is used.
• In ‘ntp associations’ it will show as 7

Question 19

What is the range of stratum levels for Cisco routers and switches?

Answer 19

1-15

Question 20

What would happen if a client device calculated an NTP source’s stratum to be 16?

Answer 20

The client would consider this time data to be unusable and would not trust it.

Question 21

What information does the ‘show ntp associations’ command display?

Answer 21

• Address - Address of an NTP server
• Ref Clock - Reference clock of an NTP server
• St - Stratum of an NTP server to its reference clock

Question 22

What is an NTP Primary Server and Secondary Server?

Answer 22

• NTP Primary Server is a device that gets its time directly from a reference clock.
• NTP Secondary Server is a device that acts as an NTP Client and Server and gets its time from other NTP servers. This is configured using the ‘ntp server’ command.

Question 23

What is a useful way of configuring NTP redundancy?

Answer 23

• Use the ‘ntp server’ command to associate with an external reference clock (e.g. an atomic clock)
• Use the ‘ntp master’ command to allow the devices’ internal clock to be used as a reference clock with a higher stratum level than that of the external reference clock.

Question 24

What command can you use to force a device to send NTP client messages from a specific IP?

Answer 24

‘ntp source <interface>'</interface>

Question 25

What is CDP?

Answer 25

- Cisco Discovery Protocol - Cisco Proprietary - Type of Layer 2 neighbor discovery protocol - Learns information about and shares information with neighboring devices such as: - Host name - IP and MAC addresses on the device - The interface at the other end of the link that sent the CDP advertisement - Information on what type of device is at the other end of the link (e.g. router) - The model of device and what OS it is running

Question 26

What commands can you use to view CDP neighbor information learned by an IOS device?

Answer 26

- 'show cdp neighbors' - Lists a one line summary of information learned about neighbors (e.g. hostname, local interface discovered via, hold time, capability, platform (model), remote interface) . Can also add the interface on the end to only list this information learned from a specific interface - 'show cdp neighbors detail' - Lists a large set of information about neighbors. - 'show cdp entry ' - Lists the same information as the 'detail' command but only about a specific neighbor.

Question 27

True or False. The same CDP commands can be used on routers and switches.

Answer 27

True.

Question 28

What MAC address are CDP messages sent to?

Answer 28

01:00:0C:CC:CC:CC (Multicast)

Question 29

True or False. A device will forward CDP messages that it receives from other devices.

Answer 29

False. It will process the message and then discard it. This is why a device will only learn about neighbors that are directly connected.

Question 30

What command can you use to enable CDP globally on an IOS device?

Answer 30

'cdp run'

Question 31

How often are CDP messages sent by default?

Answer 31

- 60 seconds - Can be changed with the 'cdp timer ' command in global config

Question 32

What is the default Hold Time for CDP and what does it do?

Answer 32

- 180 seconds - The hold time tells the router how long it should wait after no longer hearing CDP messages from a device before removing it from its CDP database. - Can be changed with the 'cdp holdtime ' command in global config

Question 33

What is LLDP?

Answer 33

- Link Layer Discovery Protocol - IEEE 802.1AB - Type of Layer 2 neighbor discovery protocol - Learns information about and shares information with neighboring devices such as: - Host name - IP and MAC addresses on the device - The interface at the other end of the link that sent the LLDP advertisement - Information on what type of device is at the other end of the link (e.g. router) - The model of device and what OS it is running

Question 34

Differences between information provided by CDP and LLDP.

Answer 34

- LLDP uses 'B' (for bridge) as the capability code for a switch. CDP uses 'S' (for switch). - LLDP doesn't list IGMP as one of the discoverable capability codes. CDP does. - CDP lists the device's platform (device model) whereas LLDP doesn't - LLDP lists only enabled capabilities of a device. CDP lists all potential capabilities of a device. You can view all potential capabilities of a device learned by LLDP using the 'show lldp neighbors detail' or 'show lldp entry' commands. - CDP can convey VTP information, LLDP cant

Question 35

True or False. Show commands are identical for CDP and LLDP.

Answer 35

True.

Question 36

What MAC address are LLDP messages sent to?

Answer 36

01:80:C2:00:00:0E

Question 37

True or False. LLDP is enabled by default on Cisco devices.

Answer 37

False. It is disabled by default

Question 38

True or False. CDP is enabled by default on Cisco devices.

Answer 38

True.

Question 39

What commands need to be used to enable LLDP?

Answer 39

- 'lldp run' - Enables lldp globally - 'lldp transmit' - Enables an interface to transmit LLDP messages - 'lldp receive' - Enables an interface to receive LLDP messages

Question 40

True or False. LLDP can be configured to only transmit or receive messages on a particular interface.

Answer 40

True. Using the 'lldp transmit' and 'lldp receive' commands on an interface(s).

Question 41

How often are LLDP messages sent by default?

Answer 41

- 30 seconds - Can be changed with the 'lldp timer ' command in global config

Question 42

What is the default Hold Time for LLDP and what does it do?

Answer 42

- 120 seconds - The hold time tells the router how long it should wait after no longer hearing LLDP messages from a device before removing it from its LLDP database. - Can be changed with the 'lldp holdtime ' command in global config

Question 43

What commands can you use to view LLDP neighbor information learned by an IOS device?

Answer 43

- 'show lldp neighbors' - Lists a one line summary of information learned about neighbors (e.g. hostname, local interface discovered via, holdtime, capability, remote interface). Can also add the interface on the end to only list this information learned from a specific interface. - 'show lldp neighbors detail' - Lists a large set of information about neighbors. - 'show lldp entry ' - Lists the same information as the 'detail' command but only about a specific neighbor.

Question 44

What is the default logging level for the console?

Answer 44

Debug (7)

Question 45

What information could you only find about a device if you used the 'show cdp/lldp neighbors entry ' or 'show cdp/lldp neighbors detail' command?

Answer 45

- For CDP; The model number and OS version of the device - For LLDP; The potential capabilities of the device

Question 46

What command can you use to see the time and date on an IOS device?

Answer 46

'show clock' 'show clock detail' will also show the time source

Question 47

What is the default timezone of an IOS device?

Answer 47

UTC

Question 48

What command(s) can you use to sync the hardware clock to the software clock and vice versa?

Answer 48

'clock update-calendar' to sync hardware (calendar) to software (clock) 'clock read-calendar to sync software (clock) to hardware (calendar)

Question 49

What is a Reference Clock?

Answer 49

- Extremely accurate time keeping device (e.g. atomic clock) - Stratum 0

Question 50

What is Symmetric Active NTP mode?

Answer 50

- When NTP servers peer with other NTP servers at the same stratum level to provide a more accurate time and redundancy. - Configured using the 'ntp peer command

Question 51

True or False. NTP updates the hardware (calendar) and software (clock) clocks.

Answer 51

False. It only updates the software clock so it's a good idea to do 'clock update-calendar' after first connecting to an NTP server. You can make NTP update the hardware clock by using the 'ntp update-calendar' command in global config.

Question 52

What is the hardware clock of a device?

Answer 52

- Normally a battery powered time keeping device that maintains the time even if the device is restarted. - The software clock is synchronised to the hardware clock upon boot.

Question 53

What is NTP authentication?

Answer 53

- Optional on Cisco devices - Used to ensure that clients can only sync with the intended servers. Their passwords must match. - To enable use the below commands 'ntp authenticate' - Enable it on the client and server 'ntp authentication-key md5 ' - Create the key(s) on the client and server 'ntp trusted-key ' - Specify trusted keys on the client and server 'ntp server key ' - Specify which key to use for which server on the client - Can also add authentication to NTP peering by using the 'ntp peer key command

Question 54

What is Static Client NTP mode?

Answer 54

- When a device acts as an NTP client and server - Configured using the 'ntp server command

Question 55

What information does the 'show cdp' command show?

Answer 55

- CDP timer - CDP hold timer - CDP version

Question 56

What is the LLDP reinitialisation timer?

Answer 56

- Delays the initialisation of LLDP when it is enabled. - 2 seconds by default - Configured using 'lldp reinit '

Question 57

Mnemonic for remembering syslog levels

Answer 57

Every - Emergency - 0 Awesome - Alert - 1 Cisco - Critical - 2 Engineer - Error - 3 Will - Warning - 4 Need - Notification/Notice - 5 Ice cream - Informational - 6 Daily - Debugging - 7

Question 58

What is the format of a log message?

Answer 58

:: %--: - Sequence - Identifier - Time stamp - Time the event occurred - Facility - Where the event occurred (e.g. OSPF for OSPF, LINK for interface) - Severity - How urgent the issue is - Mnemonic - Brief description - Description - Full description

Question 59

What does the 'logging synchronous' command do?

Answer 59

Stops log messages in the console or vty login lines from splitting your configuration lines

Question 60

True or False. A device can have multiple NTP servers configured.

Answer 60

True. It will sync to the server with the best response times at that moment. ' ntp server prefer' will cause this server to be the preferred NTP source.

Question 61

What is an SNMP Engine ID?

Answer 61

- 10 character hex string that identifies an SNMP server. Local ID is configured automatically. - Configuring the remote engine ID on a local device tells it what server it will connect to - Configuring the local engine ID on a local device is what other devices will connect to by configuring their remote engine id