I have configured ssh on a 2960 to use public key authentication. Now that I can securely log into ssh without a password Is it possible to disable password authentication so that it is impossible to login without the key?
View 2 RepliesDisable ports looping Users connect the network cable at two points in the network generating looping. which command to disable two ports of a Cisco 2960 when they are connected at the same time with the same network cable?
View 2 Replies View RelatedI have upgraded a couple of 2960G switches to 12.2.52SE and now discovered that TCP port 4786 is open on the switches.
I have looked in the document{URL}, trying to find a way to disable this function/port, but didn't find anything useful. Any way to disable this function/port?
I am testing 2960 24 S with storm-control and Errdisable Port timer interval 60s , connected HUB on fa0/17 to make traffic / loop.After Strom Control detection the interface goes down thats ok after 60s they will try to recover the interface and going up although the loop is still there.For my understanding if the interface detect still a loop on that interface they will disable the port again for 60s and will check again. [code]
View 7 Replies View RelatedI am looking to simply monitor Port-Security , Error-Disable and HSRP. I would like to receive an email when any of these are triggered.
Port Security - Port Is shut down
Err-Disable - Port goes into err-disable state (securedown)
HSRP - When HSRP standyby changes are detected
I need to receive emails with any of the able are triggered. What is the easiest way to do this? I know SNMP is the main option but I have never worked with SNMP and dont understand it too much.
Equipment:
2x Cisco 1921 series routers
3x Cisco 2960 POE switches stacked
I am seeing the following behavior when computers move from one switch to another with dot1x ONLY when there is a 'stupid' switch in between.
computer -------- 'stupid' switch ------- 2960
dot1x is working fine but when the computer is disconnected, the port still shows the authentication session id so when the computer connects to another port or switch, authentication succeeds but traffic doesn't pass. While I'm almost certain that the culprit is the 'stupid' switch that doesn't clear the session id, I have already tried another one and the problem remains so I'm actually just asking for a confirmation that all these 'stupid' switches present this behavior and if there is a workaround in this case.
I am trying configure tacacs authentication for http in Cisco 2960 with IOS 15.0.1.SE. [code] But the device is not authenticating. It ask the credentials (user and pass) but not authenticates.
View 7 Replies View RelatedI am trying to get to work Web-based authentication on Catalyst 2960 and 3560 for clients that don't support dot1x. I followed this guide. Here's the problem: Client (win7) joins the network, opens the web browser and tries to navigate to any http site. The switch forces him the "login" page in which he has to enter credentials. After the client enters credentials, the switch sends http 500 internal server error page and nothing happens. Doesn't matter if the credentials were correct or not. Also i checked radius logs for requests, the switch doesn't even ask radius.
The configuration:
sh ip admission configuration
Authentication Proxy Banner not configured
Consent Banner is not configured
[Code].....
I have a customers Catalsyt 2950 switch come in for the configuration to be cleaned to factoy default, using the link below removed the customers banner and login information whitch worked
[URL]
When i restart the switch and enter Enable mode I'm prompted with the password which i used when following the link above,
I want to remove all passwords so when the switch is redeployed to the next site who ever the engineer is that is going to be reconfiguring the switch is able to access privlage mode with out the password promt.
I have a Catalyst 2960 switch (2960-8TC-L) and running Software version 12.2(53)SE1.I mange to configure SSH to the switch and add addition user as well.Now I need to configure this switch password less log in with public key SSH authentication.
I configured several Linux servers and Workstations for the public key SSH authentication.So far I could not figure out how to do this in CISCO switch. Following link {URL} how to do this.But ip ssh pub key- chain command never work showed invalid command.
I have a cisco 2960 switch. Trying to recover a password. Have tried several different ways to recover it. I have let the switch load completely, then pressing the mode button waiting for the light to turn amber and then green. I also have held the mode button down, plugged the switch back in until the mode light turns from amber to green. Either way I will type flash_init. Then when I type load_helper I get a invalid command response. The command load_helper isn't even listed.
View 3 Replies View RelatedCurrently Being Moderated password recovery
View 3 Replies View RelatedI just received a Catalyst 2960-C (WS-C2960C-8TC-L R) switch and I am unable to sign into its web GUI in order to configure it. I've tried both the Cisco Network Assistant and Internet Explorer and I am unable to log in either way. The documentation provided by Cisco states that the default password is simply cisco and that a username is unnecessary. Needless to say, it doesn't work. I've also Googled for other default passwords (such as cisco-cisco as the username-password), none of which worked either. I've also tried resetting the switch back to its factory default a few times.
View 8 Replies View RelatedI have an existing stack of 4 x 2960-S switches connected by stack cables.I would like to add another 2960-S switch to the stack but am unable to as the 2960-S will only allow 4 x 2960-S switches per stack.how I would add the 5th 2960-S switch to the existing stack of 4 x 2960-S switches.
View 12 Replies View RelatedI have a 24 port 2960-S that is not communicating with a 2960-LST that it is directly connected to over fiber. The link is up on the LST but will not come up on the -S. What command should I use to bring up this link? I have tried no shut from the (Config-if)# prompt.
View 3 Replies View RelatedI want to disable the MAC authentication that is configured in my Aironet 1200 Cisco Access Point, now set to "Local list only". I want that any wireless device can connect if the user knows the wep password.
I cannot find the option to disable the MAC authentication.
I would like to disable NAC policy control from my ACS 4.0.I would like only 802.1x AAA on my switch ports.Also I'd like to assign a different VLAN to different MAB devices by RADIUS user attribute, in order to differentiate vlan for printers, clocks and so on. Any document for ACS 4.0?
View 1 Replies View Relatedthe following information before:
Switch: WS-C3750X-48P (Stack with 2 Members)
IOS: 12.2(58)SE2
Lic: IPBASEK9
[Code]....
Since i added another Member to the Stack, i'm facing the following problem: When i login with my tacacs user account, i will not be asked for the password. The same thing is for the tacacs account of my colleague, after entering the username he is logged in. It seems for me, that the passwords are cached only for this Switch.
I have port on cisco 3560 goes to error-disable,what is the cause of this issue,pls be noted this interface has BPDU Guard enable
View 3 Replies View Related#sh run | inc user
!
username USER0 secret 5 $1$passwordusername USER1 privilege 15 secret 5 $1$passwordusername USER2 privilege 15 secret 5 $1$password
!
#sh run | inc aaa
!
aaa new-modelaaa authentication login local_authen localaaa authentication login radius_authen group radius localaaa authorization consoleaaa authorization exec local_author localaaa authorization exec radius_author group radius localaaa session-id common
!
#sh run | begin line vty
!
line vty 0 4access-class 3 inexec-timeout 15 0authorization exec radius_authorlogging synchronouslogin authentication radius_authentransport input sshline vty 5 15!sh verCisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(55)SE6, RELEASE SOFTWARE (fc1)
the intent of the above is that management connections will only be accepted via SSH, and all of those will be authenticated via RADIUS, unless it's down, then it will use the local username/pw combinations, most of which are given Privledge level 15. Telnet should never work.SSH works as expected (authenticates via RADIUS), but the problem is that Telnet also works, will ONLY use the local database (never RADIUS), and, for some reason, leaves the users at Privledge level 1, instead of the configured 15.Essentially, it seems that at every point I have told it to do something that isn't the default with regards to telnet, it ignores me.Prior to a recent IOS upgrade, the switch didn't support SSH, so the previous config was Telnet with RADIUS, and that worked fine.
I have several SF300 switches deployed (SF300-08, SF300-24P). They are connected to IP Telephones (NEC) which communicate with the switch for auto voice VLAN on LLDP. The problem I am experiencing is that periodically the IP telephones are rebooted by the telephone vendor and when they do the switch puts that port into "Locked" port security mode and discards all traffic to the port. The IP telephones of course do not work. In other switch models, I have seen the ability to enable / disable port security switch wide or on a port by port basis. This model does not appear to have this feature. How to disable or why the phones would cause the switch ports to "lock"? There is usually one PC attached to each phone.
View 1 Replies View RelatedCan you confirm that if I want to disable temporarily a dhcp pool on a 4500, I need just to shutdown the interface VLAN corresponding to a specific dhcp pool?
ip dhcp pool test
network 10.X.27.0 255.255.255.0
default-router 10.15.27.250
[Code].....
I have a Cisco 4500 as my core switch and there are two sup eng in this core. However, I noticed that the redundant sup is in diable mode rather than Hot Standby.
I have tired to enable the module but I am not able to do that.
The sup of my core is: WS-X45-SUP6L-E
I am trying to Disable Telnet and enable SSH in CatOS for 6500 .
View 12 Replies View RelatedI have configured the cisco 2960 switch with AAA & the radius server is free radius. I am able to login into the switch when radius server is working.But when radius server is not reachable, in that particular condition the switch doesn't move to local authentication configured on the switch.
aaa new-modelaaa group server radius radiuss server 10.1.0.215 auth-port 1812 acct-port 1813!aaa authentication login default group radiuss enableaaa authentication login CONSOLE localaaa authentication enable default group radiusaaa authorization exec default group radius if-authenticated
radius-server host 10.1.0.215 auth-port 1812 acct-port 1813 key 7 071F285C422948514117171
radius-server retransmit 2
line con 0 exec-timeout 5 0 privilege level 15 password 7 14341B1B7D6F0417626173455E47060F login authentication CONSOLEline vty 0 4 access-class 91 in exec-timeout 5 0 password 7 106D004F2C3B7B7F757E6A64812812d transport input sshline vty 5 15 access-class 91 in exec-timeout 5 0 password 7 106D000A061845jsajtqwkd327E6A64 transport input ssh
Ask this question, if someone came across a 6513, one of the RJ45 ports are constantly falling.The question is how to disable logging on a specific portno logging event link-status does not work.
View 1 Replies View RelatedIn my ongoing project i need to monitor cisco 3750-X port status (uplink/downlink) i.e. whenever there is some problem at a specific port. I need to monitor it through an OPC server and right now what i am doing is as follows: i am using Kepserver and i have added SNMP driver in it for that purpose i am not a networking expert but what i have learnt till now is that SNMP agent (that resides in switch) delivers the status of MIBs to SNMP manager ( which in my case is kepserver (opc server)) for the above purpose i am adding IF-MIB to monitor OID 1.3.6.1.2.1.2.2.1.8 (which shows port statuses) but when i add that in OPC server then it indicated that this OID is not available in the Switch ( it might be disabled) so i need to ask if there is any way to enable OID's in a switch,
View 0 Replies View RelatedI have a Cisco 2960G switch and one of the ports was configured with srr-queue bandwidth limit 90 - I need to remove this bandwidth limiting from this interface. [code]
View 2 Replies View RelatedWe have a number of 3750 stacks used as access layer switches connecting Siemens VOIP phones and then a PC that connects to the phone.
For example if I plug PC A to the phone that connects to port 13 I pick up an IP addressand all works as predicted now if I plug in PC A to any other VOIP phone that connect to another port on the same switch it goes in error disable state ITs like the switch is holding my PC mac address and locks it down with the port which in my case is Gi2/0/13.
interface GigabitEthernet2/0/13
switchport access vlan 726
switchport mode access
[Code].....
I`m looking to automate some functions in a web application.Functions like enable/disable interfaces on a Cisco 3550 switch.
View 5 Replies View RelatedI am cascading one new switch 3750G (int Gi1/0/1) with an existing 3750G (int fa1/0/26) switch.. But the interface fa1/0/26 goes in err-disable state even after NO SH.. also i have diable Spanning treebpdu guard and disable spanning tree portfast. But still the issue is not resolved.
View 6 Replies View RelatedI have an issue with a Cisco 857w. When I connect on via SDM I get a message saying "SDM has detected enabled debugs on the router. Because debugs degrade the performance of the router and of SDM, it is recommended that they be disabled". I've connected onto the router via telnet and ran the show debug command which indicates that dot11 debugging is on and when I run the command no debugging all it turns it off. I then do a copy run start and reboot the router and it comes back on. how I permanently disable it?
View 1 Replies View RelatedI have stacked WS-C3750E-24PD with Ten Gigabit Ethernet ports configured under ether-channel. It has c3750e-universalk9-mz.122-55.SE1.bin IOS installed on it. One of the Ten Gigabit Ethernet ports, goes to err-disable mode with following errors on that specific ports.
%SFF8472-5-THRESHOLD_VIOLATION: Te1/0/2: Tx power low alarm; Operating value: -31.0 dBm, Threshold value: -9.0 dBm.
%SFF8472-5-THRESHOLD_VIOLATION: Te1/0/2: Tx power low alarm; Operating value: -31.0 dBm, Threshold value: -9.0 dBm. (DROmx-1-1)
I have gone through some of CSC forums like {URL}. The workaround is to "Remove the X2 or SFP from the inactive up link port" which is not in my case.