Creating an Instant Windows FTP Server

As part of my consulting work, I regularly find myself in need of a quick and efficient way to transfer files between different operating systems, like Windows and Linux. This is especially the case when I’m trying to deal with a Windows system that won’t boot and I need to recover data. When faced with this situation, I generally boot into Linux, mount the hard drive, and then transfer user data to my Windows desktop. Rather than deal with the hassles associated with SMB/SAMBA connections, I prefer to transfer the files via FTP.

While Windows XP Pro does sport an FTP server in the form of IIS, I find it overkill for my needs. In cases where I want an FTP server up and running instantly, I rely on a basic but effective (and very small) utility called FTPDMIN.

FTPDMIN is described by its author as an “ad-hoc” FTP server and the description fits the bill – it’s best suited to temporary connections only, not meant as a dedicated always-on server. After downloading the file to an appropriate location, you simply double-click to get the server up and running (or run it from a command line). It will then wait for a connection from FTP clients, allowing you to upload and download files as required. Client connections are handled anonymously, so all you need to supply in the username anonymous and an email address as your password to connect.

Available startup options allow you to control whether users can upload files, specify the server’s listening port, and more. As a slender 65K file, FTPDMIN in a tool that every admin should keep in their utility pouch.

Backing Up and Restoring Cisco Switch Settings

Much like with Cisco routers, it’s generally a good idea to back up the configuration of your switches as well. The syntax to copy the configuration of a Catalyst 1900 series to a TFTP server is different than on a router, although it does following a similar “copy from to” format. The example below shows the configuration of a Catalyst 1912 being backed up to a TFTP server at address 192.168.1.31.

Cisco1912#copy nvram tftp://192.168.1.31/config-1912
Configuration upload is successfully completed

In this example, the contents of NVRAM (the configuration file) are copied to a TFTP server at 192.168.1.31, with a filename of config-1912. The command to copy this same configuration file from the TFTP server back to the switch is shown below.

Cisco1912#copy tftp://192.168.1.31/config-1912 nvram
TFTP successfully downloaded configuration file

Unlike with a Cisco router, a Cisco 1900 series switch does not allow you to upload its IOS image to a TFTP server. However, it does allow you to download a new IOS image from a TFTP server. The command to do so is listed below.

Cisco1912#copy tftp://192.168.1.31/cat1900EN_9_00.bin opcode

In this example, the image to be downloaded from the TFTP server is named cat1900EN_9_00.bin. The opcode command is used to instruct the switch to download the file into Flash memory.

Configuring Spanning Tree Protocol Costs on a Cisco Switch

The purpose of the Spanning Tree Protocol (STP) is to prevent loops on a switched or bridged network. STP is enabled on Catalyst 1900 series switches by default. In fact, one instance of Spanning Tree is enabled for each and every VLAN.

In earlier articles we examined some of the default settings relating to the Spanning Tree Protocol, including bridge priorities, port costs, and port priorities. These settings can all be changed from their default values if required.

The cost or priority of a switch interface is changed using the spantree command from interface configuration mode. Notice that the cost associated with a port can range between 1 and 65536, while the priority of a port can be set to any number between 0 and 255.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#interface f0/27
Cisco1912(config-if)#spantree ?
cost Change an interface's spanning tree path cost
priority Change an interface's spanning tree priority
start-forwarding Allow a change from blocking to forwarding
Cisco1912(config-if)#spantree cost ?
<1-65535> Change an interface's spanning tree path cost
Cisco1912(config-if)#spantree priority ?
<0-255> Change an interface's spanning tree priority

In order to simplify the configuration of Spanning Tree on a switch, global settings are configured using what are known as Spanning Tree templates. These templates include settings such as bridge priority, hello interval, and so forth. On a Cisco 1900 switch, up to four templates can be defined. Ultimately, these templates can be applied to different VLANs, allowing you to configure STP settings once for many different VLANs. By default, all VLANs have the first Spanning Tree template applied, as shown below.

Cisco1912#show span?
Spantree spantree-option spantree-template
Cisco1912#show spantree-template 1

Bridge Template 1
Bridge Priority : 32768 (8000 hex)
Max age when operating as root : 20 second(s)
Hello time when operating as root : 2 second(s)
Forward delay when operating as root : 15 second(s)
VLANs assigned to option : 1-1005

Some of the default values shown above should look familiar. Notice that the default bridge priority is set to 32768, and that the hello interval is set to 2 seconds by default.
If you wanted a particular switch to become the root bridge, it would be a good idea to lower its priority value. This is accomplished using the spantree-template 1 priority command, as shown below. In this case, I have set the priority value to 1000.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#spantree-template 1 ?
forwarding-time Set a Spanning Tree FORWARD Interval
hello-time Set a Spanning Tree HELLO Interval
max-age Set a Spanning Tree MAX AGE Interval
priority Set a Spanning Tree PRIORITY
vlan Assign up to ten VLANs to a bridge template
Cisco1912(config)#spantree-template 1 priority 1000
Cisco1912(config)#exit
Cisco1912#show spantree-template 1

Bridge Template 1
Bridge Priority : 1000 (3E8 hex)
Max age when operating as root : 20 second(s)
Hello time when operating as root : 2 second(s)
Forward delay when operating as root : 15 second(s)
VLANs assigned to option : 1-1005

There may of course be times where you want to turn Spanning Tree off, for example if your network topology is loop-free. This is accomplished by issuing the no spantree command from global configuration mode, followed by the VLAN number for which you want Spanning Tree disabled. To re-enable Spanning Tree, simply remove the no option.

Cisco1912(config)#no spantree 100
Cisco1912(config)#spantree 100

Enabling and Configuring VLAN Trunking Protocol (VTP) on Cisco 1900 Switches

The VLAN Trunking Protocol (VTP) is used to manage the configuration of switches that are part of a VTP management domain, as we learned in Chapter 3. Recall that three VTP modes exist – server, client, and transparent mode. Once a VTP server is configured, any changes made (such as adding or removing VLANs) will be propagated throughout the VTP domain. Remember that all members of the same VTP management domain must be configured with the same VTP password.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#vtp ?
client VTP client
domain Set VTP domain name
password Set VTP password
pruning VTP pruning
server VTP server
transparent VTP transparent
trap VTP trap
Cisco1912(config)#vtp server
Cisco1912(config)#vtp domain ?
WORD Name of the VTP management domain
Cisco1912(config)#vtp domain 2000trainers.com
Cisco1912(config)#vtp password cisco999
Cisco1912(config)#
Cisco1912#show vtp
VTP version: 1
Configuration revision: 1
Maximum VLANs supported locally: 1005
Number of existing VLANs: 6
VTP domain name : 2000trainers.com
VTP password : cisco999
VTP operating mode : Server
VTP pruning mode : Disabled
VTP traps generation : Enabled
Configuration last modified by: 192.168.1.100 at 00-00-0000 00:00:00

VTP pruning was also discussed in Chapter 3. When VTP pruning is enabled, traffic will not be passed to another switch across a trunk link unless that switch has ports configured for a given VLAN. For example, imagine SwitchA has VLANs 1, 2, and 3 configured, and a trunk link to SwitchB. If VTP pruning is enabled, and SwitchB has no ports on VLAN 2, traffic for VLAN 2 will not passed to it. VLAN pruning is enabled using the command vtp pruning enable.

Cisco1912(config)#vtp pruning ?
disable Disable VTP pruning
enable Enable VTP pruning
Cisco1912(config)#vtp pruning enable

Recall from earlier in this appendix that while the command delete nvram erases the configuration of a switch, it does not delete the VTP database. To delete VTP information from a Cisco 1900 switch, you must issue the delete vtp command, which also requires the switch to reload.

Cisco1912#delete ?
nvram NVRAM configuration
vtp Reset VTP configuration to defaults
Cisco1912#delete vtp

This command resets the switch with VTP parameters set to factory defaults.
All other parameters will be unchanged.

Reset system with VTP parameters set to factory defaults, [Y]es or [N]o? Yes

Configuring ISL Trunk Links

Earlier in Chapter 3, we looked at ways to connect switches with trunk links, such that VLANs could span multiple switches. The two main ways to accomplish this are via the Inter-Switch Link (ISL) and 802.1q frame tagging methods. The Cisco 1900 series does not support 802.1q, leaving ISL as the only option for creating trunk connections with other Cisco switches.

Recall that two main types of links exist between switches – access links, which provide a link for only a single VLAN, and trunk links, which are capable of carrying the traffic of many VLANs through the use of a tagging method like ISL. ISL can only be configured on switch ports with speeds of 100 Mbps and above. On a Cisco 1900, this means that only ports 26 and 27 can be used to define ISL trunk links.

The command to configure a trunk port is simply trunk, followed by the state of the port. There are five states into which you can place a trunk port, as shown below.

  • auto – Will configure the port as a trunk link if the connected system is set to on or auto.
  • desirable – Port will negotiate to become a trunk link if the other system is set to auto, desirable, or on.
  • nonegotiate – Port will become a permanent trunk link, will not negotiate the connection.
  • off – Disables the trunk port and negotiates with the connected system to turn trunking off.
  • on – Configures the port as a permanent ISL trunk link, and negotiates with the other system to convert their port to trunk mode.

In this example we’ll configure port e0/26 as a trunk port, turning ISL on.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#int f0/26
Cisco1912(config-if)#trunk ?
auto Set DISL state to AUTO
desirable Set DISL state to DESIRABLE
nonegotiate Set DISL state to NONEGOTIATE
off Set DISL state to OFF
on Set DISL state to ON
Cisco1912(config-if)#trunk on

Once trunking is configured for a given port, that port will trunk traffic for all configured VLANs. However, it is also possible to deny traffic from certain VLANs from being trunked by issuing the no trunk-vlan command. In the example below, traffic from VLAN 50 will not be trunked across the port 26 link.

Cisco1912(config-if)#no trunk-vlan 50

Once trunk links have been configured, their state can be viewed using the show trunk command, followed by a letter associated with that link. Since port 0/26 is the first FastEthernet port, it is known as trunk A, while port 0/27 would be known as trunk B.

Cisco1912#show trunk ?
A Trunk A
B Trunk B
Cisco1912#show trunk A
DISL state: On, Trunking: On, Encapsulation type: ISL

Going a step further, you can also view which VLANs are allowed to use the trunk link by appending the command to include allowed-vlans, as shown below.

Cisco1912#show trunk a allowed-vlans
1-49, 51-1005

Configuring VLANs on a Cisco Catalyst 1900 Switch

A VLAN is essentially a broadcast domain, assigned according to switch ports. By default, all ports on a Cisco 1900 are assigned to VLAN 1, sometimes referred to as the management or administrative VLAN. In order to implement additional VLANs, you will first need to define them, and then add ports to that VLAN. New VLANs are created from global configuration mode by using the vlan command and specifying both a VLAN number and name. For example, let’s say that we want to create a new VLAN for our Human Resources department (VLAN 100), and one for executives, VLAN 50.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#vlan 100 name HR
Cisco1912(config)#vlan 50 name Executives

To view all VLANs configured on a switch, use the show vlan command.

Cisco1912#show vlan

VLAN Name Status Ports
--------------------------------------
1 default Enabled 1-12, AUI, A, B
50 Executives Enabled
100 HR Enabled
1002 fddi-default Suspended
1003 token-ring-defau Suspended
1004 fddinet-default Suspended
1005 trnet-default Suspended
--------------------------------------

Notice that currently, all ports on our Catalyst 1912 switch are still part of VLAN 1. The next step involves adding ports to the newly configured VLAN. This is done from interface configuration mode, using the vlan-membership static command. In this case, we’ll add Ethernet ports 0/2 and 0/8 to VLAN 100.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#int e0/2
Cisco1912(config-if)#vlan-membership static 100
Cisco1912(config-if)#int e0/8
Cisco1912(config-if)#vlan-membership static 100

To confirm that the ports are now part of VLAN 100, use the show vlan command. An individual VLAN can be viewed by specifying the VLAN number after this command.

Cisco1912#show vlan

VLAN Name Status Ports
--------------------------------------
1 default Enabled 1, 3-7, 9-12, AUI, A, B
50 Executives Enabled
100 HR Enabled 2, 8
1002 fddi-default Suspended
1003 token-ring-defau Suspended
1004 fddinet-default Suspended
1005 trnet-default Suspended
--------------------------------------

Cisco Discovery Protocol on Catalyst 1900 Switches

The Cisco Discovery Protocol (CDP) is used to gather information about neighboring Cisco devices. Cisco 1900 series switches also run CDP, with the same default parameters as a CDP-enabled router. The show cdp command shows the current CDP version, as well as CDP timer and holdtime intervals. The show cdp neighbors command will display a table with information about neighboring devices. Details on a specific device can be obtained by issuing the show cdp neighbors detail command.

Cisco1912#show cdp
Global CDP information :
CDP version: 2
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
Cisco1912#show cdp neigh
Capability Codes: R – Router, T – Trans Bridge, B – Source Route Bridge
S – Switch, P – Repeater, H – Host, I – IGMP
DeviceID IP Addr Local Port Capability Platform Remote Port

CDP holdtime and timer values can be changed from global configuration mode by issuing the appropriate cdp command, as shown below.

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#cdp ?
advertise-v2 CDP sends version-2 advertisements
holdtime Specify the holdtime (in sec) to be sent in packets
timer Specify the rate at which CDP packets are sent (in sec)

Configuring Cisco Switch MAC Address and Security Settings

A switch makes forwarding decisions based on the entries stored in its MAC address table. This table is built as the switch inspects the source addresses of frames as they enter the switch from devices connected to a given port. By default, a Catalyst 1900 switch can store up to 1024 entries in its MAC address table. These entries, which are added to the table automatically, are known as dynamic entries. They will exist in the MAC table until the table is manually cleared, or until a certain host is not heard from for a certain period of time – the default is 300 seconds. It is also possible to add permanent entries to the MAC address table, as we’ll see shortly.

To view the MAC address table on a Cisco 1900, issue the show mac-address-table command. The table shows not only the MAC addresses of connected devices, but also the port number they are associated with, and whether these entries are dynamic or permanent.

Cisco1912#show mac-address-table
Number of permanent addresses : 1
Number of restricted static addresses : 0
Number of dynamic addresses : 2

Address Dest Interface Type Source Interface List
----------------------------------------------------------------------
0000.1223.30A5 Ethernet 0/5 Permanent All
0000.2456.110A Ethernet 0/2 Dynamic All
0000.2456.134A Ethernet 0/3 Dynamic All

Entries can be cleared from a switch’s MAC address table by issuing the clear mac-address-table command. This command has three options, including the ability to clear permanent, dynamic, and restricted entries.

Cisco1912#clear mac-address-table ?
dynamic Clear 802.1d dynamic address
permanent Clear 802.1d permanent addresses
restricted Clear 802.1d restricted static address

A common way to implement security on a Layer 2 switch is by adding permanent MAC address entries to a switch port. Although this can sometimes be a great deal of work, it does make sense in cases where you want to be sure that unknown systems can’t just plug into a switch port (probably via a wall jack) and gain access to your network. When a permanent entry is configured, only the MAC addresses entered into the table are capable of communicating via that port. The mac-address-table command is used to add permanent entries to the MAC address table, as shown below.

Cisco1912(config)#mac-address-table permanent ?
H.H.H 48 bit hardware address
Cisco1912(config)#mac-address-table permanent 0000.1234.5678 ?
Ethernet IEEE 802.3
FastEthernet FastEthernet IEEE 802.3
Cisco1912(config)#mac-address-table permanent 0000.1234.5678 e0/7

Notice that in order to add a permanent entry, you will need to supply both the MAC address of the system that will be connected, as well as the port to which this permanent entry applies.

If a dynamic MAC address entry in the table isn’t heard from within 300 seconds, the entry is flushed. The example below shows how this setting can be changed from global configuration mode.

Cisco1912(config)#mac-address-table aging-time ?
<10-1000000> Aging time value
Cisco1912(config)#mac-address-table aging-time 600

The Cisco 1900 series also includes a feature that allows you to control how many MAC addresses are allowed to be connected to a given switch port, without specifying individual MAC addresses as permanent entries. For example, let’s say that you want to avoid there ever being more than 4 systems connected on any given port. While one system per port might be optimal, this isn’t always possible based on cost factors. The maximum number of connections that can be specified per port is 132.

To configure a port such that it only allows a certain number of connections, use the port secure max-mac-count command. This command is issued from interface configuration mode.

Cisco1912(config)#interface e0/4
Cisco1912(config-if)#port secure max-mac-count ?
<1-132> Maximum mac address count for this secure port
Cisco1912(config-if)#port secure max-mac-count 4

One other option for securing a switch is to disable unused ports using the shutdown command. The command is issued in the example below, followed by the show int command. Notice that port e0/6 is listed as Disabled-management.

Cisco1912(config)#interface e0/6
Cisco1912(config-if)#shutdown
Cisco1912(config-if)#
Cisco1912#show int e0/6

Ethernet 0/6 is Disabled-management
Hardware is Built-in 10Base-T
Address is 0050.F05F.2506
MTU 1500 bytes, BW 10000 Kbits
802.1d STP State: Disabled Forward Transitions: 1
Port monitoring: Disabled
Unknown unicast flooding: Enabled
Unregistered multicast flooding: Enabled
Description:
Duplex setting: Half duplex
Back pressure: Disabled

Configuring Cisco Switch Ports

A Cisco 1900 is basically a plug-and-play switch. This means that you can treat a 1900 much like a hub by simply plugging computers (or other hubs) into its ports and allowing them to communicate. One reason this works is that all ports are part of the same VLAN by default. However, you may want to change some of the switch’s default settings. For example, all 10baseT ports are configured for half-duplex by default. You may want to change some to full duplex, or configure some ports to be part of a different VLAN. For the time being, we’ll concentrate on accessing individual ports, configuring port duplex settings, and finally adding descriptions to port interfaces. Recall that the port speeds on a Cisco 1900 switch cannot be changed – the port speeds are fixed at either 10 or 100 Mbps.

A Cisco 1912 switch includes 15 ports in total. 12 of these ports are 10BaseT, found on the front of the switch. 2 of the ports are usually 100BaseT (although other possibilities exist), also found on the front of the switch, towards the right-hand side. The back of a 1912 provides one last port – an AUI interface, which can be used to connect a transceiver, and ultimately another network.

From global configuration mode, individual interfaces are accessed using the interface command, followed by the interface type and number. The Cisco 1900 series follows the slot/port convention for accessing interfaces. For example, to access the first Ethernet interface on a 1912, the command would be:

Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#int ethernet 0/1

Don’t be confused by the preceding slot number – on a Cisco 1900 series, the slot number is always 0.

Interface configuration mode is identified by the familiar config-if prompt. To view a list of available commands, use the help function.

Cisco1912(config-if)#?
Interface configuration commands:
cdp Cdp interface subcommands
description Interface specific description
duplex Configure duplex operation
exit Exit from interface configuration mode
help Description of the interactive help system
no Negate a command or set its defaults
port Perform switch port configuration
shutdown Shutdown the selected interface
spantree Spanning tree subsystem
vlan-membership VLAN membership configuration

Let’s start off by configuring the duplex settings for port e0/1. This is accomplished using the duplex command, followed by a duplex type.

Cisco1912(config-if)#duplex ?
auto Enable auto duplex configuration
full Force full duplex operation
full-flow-control Force full duplex with flow control
half Force half duplex operation

Remember that in order for the switch port to communicate in full duplex, only a single system can be attached. If you are attaching a hub to this switch port, leave it configured for half duplex. In this case, we’ll set the port to full duplex. The auto option will attempt to autonegotiate the duplex of the connection, but will only work if the network card of the connected system is also capable of auto-negotiation.

Cisco1912(config-if)#duplex full

It can be helpful to set a description on a port in order to keep track of its purpose. For example, you may be using this switch port as a trunk connection to another switch, or to connect a server. The description command allows you to assign a description to an interface. One caveat here – you cannot use spaces in the description, so you’ll need to use a special character such as an underscore or dash to combine multiple words. The example below configures a description for port e0/1, which will ultimately connect Fileserver3.

Cisco1912(config-if)#description Fileserver3

To view the configuration of a specific port after making changes, use the show interface command, as shown below.

Cisco1912#show int ?
Ethernet IEEE 802.3
FastEthernet FastEthernet IEEE 802.3

Cisco1912#show int ethernet ?
<0-0> IEEE 802.3
Cisco1912#show int ethernet 0/?
<1-25> IEEE 802.3
Cisco1912#show int e0/1
Ethernet 0/1 is Suspended-no-linkbeat
Hardware is Built-in 10Base-T
Address is 0050.F05F.2504
MTU 1500 bytes, BW 10000 Kbits
802.1d STP State: Forwarding Forward Transitions: 1
Port monitoring: Disabled
Unknown unicast flooding: Enabled
Unregistered multicast flooding: Enabled
Description: Fileserver3
Duplex setting: Full duplex
Back pressure: Disabled

--More--

One thing that you may have noticed during the interface configuration process is that even on a Catalyst 1912, there appears to be 25 Ethernet ports available. This is due to the fact that a Catalyst 1924 has 25 configurable Ethernet ports – 24 on the front of the switch, with the 25th being the AUI port on the rear. On a 1912, that rear port is still known as port 25. In the same way, a switch that provides 2 fast Ethernet ports references those as ports 26 and 27 respectively.

To configure FastEthernet ports, use the command int fastethernet followed by the slot and port number. For example, to access the first FastEthernet port, the command would be:

Cisco1912(config)#int fastethernet 0/26

By default, FastEthernet ports are configured to auto duplex, meaning that they will attempt to auto-negotiate duplex parameters with connected devices.

Remember that the configuration of interfaces can be viewed using both the show interface and show run commands.

Configuring Switching Methods on a Catalyst 1900 or 2820

Recall from Chapter 3 that Cisco switches support three major switching methods – FragmentFree, Cut-Through, and Store-and-Forward. The Catalyst 1900 series supports only two of these methods, FragmentFree and Store-and-Forward. FragmentFree is the method configured by default.

To view the current switching method enabled on a switch, use the show port system command. To change the switching method, use the switching-mode command followed by either fragment-free or store-and-forward. In the example below, I have changed the switching method to Store-and-Forward.

Cisco1912#show port system
Switching mode: FragmentFree
Use of store and forward for multicast: Disabled
Network port: None
Half duplex backpressure (10 Mbps ports): Disabled
Enhanced Congestion Control (10 Mbps ports): Disabled
Default port LED display mode: Port Status
Cisco1912#config t
Enter configuration commands, one per line. End with CNTL/Z
Cisco1912(config)#switching-mode store-and-forward
Cisco1912(config)#