Cisco-like команды

Консоль ввода команд

Запуск консоли

Удаленная настройка по SSH

Интерфейс пользователя

Специальные команды редактирования

Особенности ввода числовых значений

Команды cs-console

Команды входа в режимы настроек

configure terminal

enable

Команды выхода из режимов настроек

end

exit (EXEC)

exit (global)

disable

Команды вывода информации (информационные команды)

show version

show version csp

show privilege

show load-message

show running-config

show terminal

show ip route

show ipv6 route

show clock

show crypto isakmp sa

show crypto ipsec sa

show crypto isakmp policy

show substitution gui

show interfaces

show ip interface

show ip interface brief

show access-lists

show ip access-lists

show ipv6 access-lists

show ip access-lists interface

show ipv6 access-lists interface

show object-group

show vrrp

show vrrp statistics

show vrrp sla

show ntp associations

show ntp status

Команды настройки терминала

terminal width

terminal length

terminal terminal-type

Команды вызова системных команд и системные команды

run

ping

set clock

Команды работы с файлами

dir

more

delete

copy

copy terminal-input

Команды работы с конфигурацией

clear running-config

copy running-config

configure replace

Команды назначения паролей на вход в привилегированный режим

enable password

enable secret

Команды создания пользователей, назначения паролей, уровня привилегий

username password

username secret

username privilege

Команды настройки протоколирования событий

logging

logging console

logging facility

logging trap

logging on

Команды настройки SNMP

snmp-server community

snmp-server location

snmp-server contact

snmp-server host

snmp-server enable traps

snmp-server trap-source

snmp-server polling address

snmp-server polling udp-port

Команды для назначения имени хоста и настройки DNS-клиента

hostname

ip domain name (ip domain-name)

ip name-server

Команды для настройки NTP-клиента

ntp server

ntp default servers

Команды для работы с таблицей маршрутизации

ip route

ipv6 route

ipv6 unicast-routing

Команды для работы с сертификатами

crypto pki trustpoint

crl query

crl download group

crl download time

no crl download

revocation-check

crypto pki certificate chain

certificate

crypto identity

dn

fqdn

Настройки идентификационной информации

crypto isakmp profile

set policy

match identity

match certificate

set identity mapping

self-identity

self-certificate

ca trust-point

keyring

crypto pki certificate map

alt-issuer-name

alt-subject-name

fingerprint-md5

fingerprint-sha1

issuer-name

subject-name

serial-number

Команды для работы с предварительно распределённым ключом

crypto isakmp key

ip host

crypto keyring
  pre-shared-key

crypto key import

crypto key remove

show crypto isakmp key

Команды создания и редактирования списков доступа

access-list (standard)

access-list (extended)

ip access-list

permit (standard)

permit (extended)

deny (standard)

deny (extended)

remark

ip access-list resequence

ipv6 access-list

permit (ipv6 access-list)

deny (ipv6 access-list)

sequence (ipv6 access-list)

remark

Команды создания групп объектов сети и групп сервисов

object-group network

object-group v6-network

object-group service

object-group v6-service

Команды создания IKE политики

crypto isakmp identity

crypto isakmp keepalive

crypto isakmp keepalive retry-count

crypto isakmp fragmentation

crypto isakmp session-time-max

crypto isakmp initiator-sessions-max

crypto isakmp responder-sessions-max

crypto isakmp local-port

crypto isakmp remote-port

crypto isakmp nat-traversal local-port

crypto isakmp nat-traversal remote-port

crypto isakmp first-answer-time-max

crypto isakmp policy

authentication (IKE policy)

encryption (IKE policy)

hash (IKE policy)

group (IKE policy)

lifetime (IKE policy)

set lifetime kilobytes (IKE policy)

set lifetime sessions (IKE policy)

crypto isakmp peer

set aggressive-mode client-endpoint

set aggressive-mode password

Команды создания IKEv2 политики

crypto ikev2 session-timeout

crypto ikev2 response-time-max

crypto ikev2 send-retries

crypto ikev2 retry-time-base

crypto ikev2 retry-time-max

crypto ikev2 cookie-challenge

crypto ikev2 nat-keepalive-interval

crypto ikev2 nat-keepalive-retain

crypto ikev2 fragment-size-ipv4

crypto ikev2 fragment-size-ipv6

crypto ikev2 policy

proposal (ikev2 policy)

lifetime (ikev2 policy)

crypto ikev2 proposal

encryption (ikev2 proposal)

group (ikev2 proposal)

prf (ikev2 proposal)

lifetime (ikev2 proposal)

crypto ikev2 lifetime

seconds (IKEv2 lifetime)

kilobytes (IKEv2 lifetime)

packets (IKEv2 lifetime)

connections (IKEv2 lifetime)

Команды настройки IKEv2 IPsec политики

crypto ikev2 ipsec-proposal

lifetime (ipsec proposal)

esp encryption (ipsec proposal)

pfs (ipsec proposal)

crypto map

set ikev2-profile

set ikev2-ipsec-proposal

set mode

Команды настройки IKEv2 аутентификации

crypto ikev2 authentication pre-share

identity (ikev2 authentication pre-share)

lifetime (ikev2 authentication pre-share)

pre-shared-key (ikev2 authentication pre-share)

crypto ikev2 authentication sig

identity (ikev2 authentication sig)

lifetime (ikev2 authentication sig)

certificate (ikev2 authentication sig)

ca trust-point (ikev2 authentication sig)

set send-cert (ikev2 authentication sig)

set send-cert-request (ikev2 authentication sig)

set identity mapping (ikev2 authentication sig)

Команды, устанавливающие IKEv2-профиль

crypto ikev2 profile

dpd (ikev2 profile)

authentication local (ikev2 profile)

authentication remote (ikev2 profile)

set policy (ikev2 profile)

set bind-to-interface (ikev2 profile)

Команды, устанавливающие время жизни SA

crypto ipsec security-association lifetime

crypto isakmp security-association lifetime delta

Команды формирования набора преобразований IPsec

crypto ipsec transform-set

mode (IPsec)

Команды для работы с IKECFG пулом

ip local pool

crypto isakmp client configuration address-pool local

crypto map client configuration address

crypto dynamic-map client configuration address

Команды создания и редактирования криптографических карт

crypto map (global IPsec)

match address (crypto map)

match ipv6 address (crypto map)

set ip access-group

set ipv6 access-group

set peer shuffle

set peer (crypto map)

set peer ipv6 (crypto map)

set local-address (crypto map)

set local-address ipv6 (crypto map)

set certificate local credential (crypto map)

set pfs (crypto map)

set pool (crypto map)

set identity (crypto map)

set isakmp-profile (crypto map)

set ikecfg-request (crypto map)

set pre-fragmentation (crypto map)

set nat-transparency udp-encapsulation (crypto map)

set packets- assemble (crypto map)

set security-association lifetime (crypto map)

set security-association mtu (crypto map)

set security-association replay disable (crypto map)

set security-association mss-fix in (crypto map)

set security-association mss-fix out (crypto map)

set transform-set (crypto map)

set dns (crypto map)

set domain (crypto map)

set client authentication xauth (crypto map)

set client authentication list (crypto map)

set client forced-username (crypto map)

set client username (crypto map)

set client authentication forced-password (crypto map)

set accounting (crypto map)

set re-route (crypto map)

set tcp-encapsulation (crypto map)

set dead-connection history off (crypto map)

set ikev2-profile (crypto map)

set ikev2-ipsec-proposal (crypto map)

set mode (crypto map)

set dscp

reverse-route (crypto map)

crypto dynamic-map

Команды настройки контекстной фильтрации

ip port-map

ip inspect name

ip inspect alert-off

ip inspect audit-trail

ip inspect tcp synwait-time

ip inspect tcp finwait-time

ip inspect tcp idle-time

ip inspect tcp sessions-max

ip inspect tcp strictness-level

ip inspect udp sessions-max

ip inspect udp not-established-timeout

ip inspect udp established-timeout

ip inspect max-incomplete high

ip inspect max-incomplete low

ip inspect one-minute high

ip inspect one-minute low

Команды QoS

class-map

match access-group

match any

match dscp

match precedence

policy-map

class

set dscp

set precedence

set adjust-mss

Команды настройки сетевых интерфейсов

crypto ipsec df-bit (global)

interface

shutdown (interface)

ip address (interface)

ipv6 address (interface)

ip access-group (interface)

ipv6 access-group (interface)

crypto map (interface)

ip inspect (interface)

service-policy (interface)

crypto ipsec df-bit (interface)

crypto ipsec stream-id (interface)

mtu (interface)

description (interface)

Команды настройки GRE-интерфейсов

tunnel source (interface Tunnel)

tunnel destination (interface Tunnel)

tunnel ignore-df (interface Tunnel)

tunnel key (interface Tunnel)

tunnel mode gre (interface Tunnel)

tunnel path-mtu-discovery (interface Tunnel)

tunnel tos (interface Tunnel)

tunnel ttl (interface Tunnel)

offloading tx-checksumming (interface Tunnel)

Команды групповой настройки сетевых интерфейсов

interface range

Команды управления параметрами логирования сообщений Firewall

ip access-list logging interval

ip access-list log-update threshold

Команды управления соединениями

clear crypto sa

clear crypto isakmp

clear crypto session

Команды управления расписанием

time-range

absolute

periodic

Команды настройки VRRP

vrrp ip route и vrrp ipv6 route

vrrp notify

fhrp version vrrp v3

vrrp track sla

mode

host

rechability

source

tos

data-size

fall

rise

timeout

interval

Команды для настройки VRRP-интерфейса из контекста настройки сетевого интерфейса

vrrp VRID authentication (interface)

vrrp VRID ip (interface)

vrrp VRID preempt (interface)

vrrp VRID priority (interface)

vrrp VRID sync-group (interface)

vrrp VRID timers advertise (interface)

vrrp VRID timers garp (interface)

vrrp VRID state (interface)

vrrp VRID track interface (interface)

vrrp VRID track processes-group (interface)

vrrp VRID track sla (interface)

Команды для настройки VRRP-интерфейса из контекста настройки VRRP-интерфейса

vrrp VRID address-family ipv4 (interface)

vrrp VRID address-family ipv6 (interface)

address (IPV4)

address (IPV6)

authentication

description

preempt

priority

sync-group

timers advertise

timers garp

track processes-group

track sla

track interface

Команды настройки RADIUS-клиента (v4.3)

aaa new-model

radius-server host

radius-server key

radius-server retransmit

radius-server timeout

aaa authentication login

aaa authentication banner

aaa accounting network

aaa accounting update periodic

crypto map client accounting list

crypto dynamic-map client accounting list

Команды настройки RADIUS-клиента (v5.0)

aaa new-model

aaa authentication login

aaa accounting network

radius server

address

key name

retransmit

timeout

aaa group server radius

server

deadtime

Команды crypto isakmp profile для настройки аутентификационной информации RADIUS-сервера

client authentication xauth

client authentication list

client authentication banner

client accounting list

client accounting update periodic

client password name

client username

set send-cert

set send-cert-request

Игнорируемые команды

Приложение

Файл cs_vrrp.ini

Описание секций и параметров

Секция [scripts]

Секция [settings]

Секции[track_processes_group_<NUMBER>]

Секция [output]

Содержимое файла cs_vrrp.ini по умолчанию

Редактирование файла cs_vrrp.ini

Обработка ошибок файла cs_vrrp.ini консолью cisco-like