Managing the Cisco IOs is an important part of your role as a network engineer. You will also be configuring routers and switches from scratch. Occasionally, you will need to perform disaster recovery such as forgotten passwords, failed IOS upgrades, and power outages. This knowledge will then become essential.
Router Architecture
For the CCNA exam, you must be very familiar with the types of memory used by Cisco routers and how it is utilized. You should also understand the router boot sequence and what can go wrong.
Router Memory
Cisco routers ship with several different types of memory. Each memory module performs a specific function, and you will be expected to know which does what for the exam.
ROM
Read-only memory is used to store a tiny operating system called the bootstrap. This helps the router boot up and then pull the main operating system, or IOS, into memory from flash. ROM chips cannot usually be upgraded because they are soldered onto the motherboard.
Boot ROM is a special kind of EEPROM that houses files that are used to load the IOS and to present the ROMmon mode as a fallback, in case there is no IOS file present or it is corrupted. In the ROMmon mode, limited commands are allowed to recover the router and load another IOS. You can see the router is in ROMmon mode via one of the prompts below, depending on your router model:
>
Rommon>
ROM can sometimes contain an RXBOOT image. This contains a Mini-IOS, which can then be used to upload a full IOS. It is also referred to as the boot loader, and it is primarily used to perform some router maintenance activities. You will see RXBOOT on old models of Cisco routers, such as the 2500 Series.
DRAM
Dynamic RAM (random-access memory) is used by a router to store the running configuration, which describes the active configuration state of the router. This comprises the commands and instructions the router is currently using. Any changes you make to the router’s configuration are automatically stored in DRAM. They will all be lost when the router is powered down, which makes this type of memory volatile. In order to save the instructions, you have to tell the router to save the running configuration in NVRAM (non-volatile RAM) and rename it startup-config.
R1#copy running-config startup-config
Destination filename [startup-config]?
Of course, you would shorten this to copy run start.
DRAM is also used as a buffer to temporarily store packets and routing tables. The main system image (also called IOS) is also loaded into DRAM while the router is running. You can see how the split is made when you issue the show version command, which shows the DRAM divided into two numbers. For example, my router (see below) has 16 MB DRAM split into 14 MB and 2 MB (14 MB is for the IOS, running configuration, and routing tables, and 2 MB is for buffering packets that cannot be yet processed).
A memory split is normal in most models of Cisco routers, and it can be changed with the memory size command. This change is not recommended unless under the direction of a Cisco TAC. You can read their IOS guide here.
When you issue a show version command on a router, you can see the DRAM memory split:
14336 KB / 2048 KB of memory
FIG 3.1 – 16 MB DRAM stick
Flash Memory
Flash is used by the router to store the main operating system, or IOS. Flash memory is normally in the form of EEPROM SIMM chips on the motherboard. Flash memory can also be added to the router in the form of PCMCIA cards on some router models. Modern routers also have USB ports available for storing multiple IOS files, as well as router configurations.
FIG 3.2 – Two 8 MB sticks of flash memory
When the router boots, the IOS is decompressed out of flash memory and loaded into DRAM. An example of a flash image stored on the router can be seen below. Your output will differ if you use the dir flash: command.
Router#show flash
System flash directory:
Length Name/status
c2900-universalk9-mz.SPA.151-1.M4.bin.
[output truncated]In this output, “c2900” refers to the model of the router (the 29xx Series), which is running a universal IOS image. The “K9” image consists of strong cryptographic features such as AES/3DES encryption. Next, “mz” indicates that it’s stored in RAM (m) in Zipped (z) format. “SPA” stands for digitally Signed Production version and A is the key version used to sign the software. Finally, “151-1.M4” is the version and release within that version.
You can view the internetwork operating system (IOS) on a router with the show flash or the show version command, although this may differ depending on your router model. You can delete the files in flash memory with the delete flash:[filesystem] command:
RouterA#delete flash:c2900-universalk9-mz.SPA.151-4.M4.bin
If you accidentally delete a flash file system, you can recover it with the undelete command. The specific steps depend on the type of file system you have on your router.
NVRAM
Non-volatile RAM is used by the router to store the router’s startup configuration. Imagine having to reconfigure the router every time you wanted to reload it. Because NVRAM is non-volatile, it will not lose information when power is off. The startup configuration is transferred to DRAM every time you reload the router and is renamed running config.
You can compress it with the service compress-config command if you have a very large configuration file in NVRAM. It will, however, take longer for the image to decompress into DRAM.
Router(config)#service compress-config
The command to copy files from a TFTP server to the flash memory of a router is copy tftp flash. You will then be prompted to enter the IP address of the other host where the new flash file is, as shown below (not that we aren’t in configuration mode):
RouterA#copy tftp flash
Address or name of remote host []? 10.10.10.1
You will then have to enter the name of the flash image on the other router:
Source filename []? / c2900-universalk9-mz.SPA.151-4.M4.bin
Destination filename [c2900-universalk9-mz.SPA.151-4.M4.bin]?
If you have an older model router, you may be prompted to erase the flash memory on your router before copying and transferring the file. You can actually store multiple IOS images in flash memory. You should issue a show version or dir flash: command before you initiate an IOS upgrade to ensure that you have sufficient space (flash and DRAM) available. If you don’t do this first, you may find that the router will erase the current IOS and then the upgrade will fail, leaving you with no IOS image on your router.
The output below shows the results of a dir flash: command. You can see that there is an IOS file present but there is also 221896413 bytes free. You need to be able to work out what this is in MB. I tend to count six across from the right and the number before that usually is the number of MB, so from the output below, you still have 221 MB free.
Router#dir flash:
Directory of flash0:/
3 -rw- 33591768 <no date> c2900-universalk9-mz.SPA.151-4.M4.bin
2 -rw- 28282 <no date> sigdef-category.xml
1 -rw- 227537 <no date> sigdef-default.xml
255744000 bytes total (221896413 bytes free)
When the router reloads, your new flash image should be present.
Other options are to issue the copy flash tftp command if you want to store a backup copy or the copy running config tftp command if you want to back up your running configuration file.
You can run a debug on TFTP traffic with the debug tftp command. The output below shows more options for TFTP:
Router#copy tftp ?
flash: Copy to flash: file system
running-config Copy configuration from system
startup-config Copy startup configuration from system
Table 3-1: Router memory and configuration file location
| Memory | Usage |
| ROM | Bootstrap IOS |
| DRAM | Running config/routing tables/buffers |
| EEPROM/Flash | IOS storage |
| NVRAM | Startup config |
CPU
The CPU is where all of the processing takes place on the router. Cisco CPUs are generally not upgradeable. You can easily see the CPU type and how much memory you have on your router by typing the show version command at the router prompt. Some of the output below has been truncated:
Router#show version
Cisco IOS Software, 3700 Software (C3725-ADVENTERPRISEK9-M), Version 15.1(4)M7, RELEASE SOFTWARE (fc3)
Copyright (c) 1986-2008 by Cisco Systems, Inc.
ROM: ROM: 3700 Software (C3725-ADVENTERPRISEK9-M), Version 15.1(4)M7, RELEASE SOFTWARE (fc3) – ROM code
BOOTLDR: 3000 Bootstrap Software (IGS-BOOT-R), Version 11.0(10c)
System image file is flash: c3725-adventerprisek9-mz.151-4.M7 – Flash Image
Cisco 3725 (R7000) processor (revision 0.1) with 124928K/6144K bytes of memory. – DRAM
Processor board ID 18086064, with hardware revision 00000003 – CPU
32K bytes of non-volatile configuration memory. – NVRAM
16384K bytes of ATA System CompactFlash (Read/Write) – EEPROM/FLASH
You can actually check the contents of your router or switch memory with the dir command. Note from the output below that you need to add a colon (:) to the file system that you want to check.
Router#dir ?
/all: List all files
/recursive: List files recursively
all-filesystems: List files on all filesystems
archive: Directory or file name
cns: Directory or file name
flash: Directory or file name
null: Directory or file name
nvram: Directory or file name
system: Directory or file name
tar: Directory or file name
tmpsys: Directory or file name
usbflash0: Directory or file name
xmodem: Directory or file name
ymodem: Directory or file name
|: Output modifiers
[cr]
Router#dir usbflash0:
Directory of usbflash0:/
1 -rw- 47438932 Jun 19 2014 13:03:46 +00:00 c1841-adventerprisek9-mz.151-4.M7.bin
You can also check the USB device attached with the commands below:
Router#show usb?
controllers
device USB Device information
driver USB Driver information
port USB Port information
tree USB Device Tree
Router#show usb device
Host Controller: 1
Address: 0x1
Device Configured: YES
Device Supported: YES
Description: Disk
Manufacturer: USB
Router Boot-up Sequence
When you power on a Cisco IOS router, it performs a series of verifications and processes before the IOS (operating system) is loaded and started. The standard sequence of steps is as follows:
- On power on, the router first performs the POST (power-on self-test). The purpose of this verification test is to check that all the components of the router are present and operating correctly (processor, memory, fans, interfaces, modules, etc.). The POST procedure is stored in ROM (read-only memory). The system then checks the configuration register setting. 0x2102 means check the startup configuration file for any commands directing from where to load the IOS. 0x2142 means check flash and TFTP, in that order, and if nothing is found, boot from ROM.
- The bootstrap loads the Cisco IOS software. The bootstrap is a program in ROM used to activate other software components. It is responsible for finding the IOS versions available on the device and loading the proper one. The IOS is loaded from flash memory.
- The IOS looks for a valid configuration file in NVRAM (the startup configuration) if the configuration register is set to 0x2102.
- If the IOS successfully finds a valid startup configuration file in NVRAM, it will load the file and run it, making the router operational. If the IOS does not find a valid startup configuration file in NVRAM, it will start in setup mode, allowing the user to define basic configuration settings before the IOS is fully operational. Any additional modifications to the configuration will be stored in RAM. The updated configuration can be saved to the startup configuration in NVRAM using the following command: copy running-config startup-config.
Figure 3.3 below shows you the boot-up process in full. Ensure that you can draw this from memory for the exam.
FIG 3.3 – Router boot-up sequence
Setup mode was described earlier in this guide. You will recognize it from the output below:
Would you like to enter the initial configuration dialog? [yes/no]:
% Please answer “yes” or “no”.
Remember also that you should never type yes because you will enter the Q-and-A mode where the router will attempt to configure itself based on your replies to certain questions. Figure 3.4 below shows which memory types are accessed during boot stages.
FIG 3.4 – Router booting sequence
Managing the IOS
We all know how important it is to back up our network servers. Most companies have robust backup procedures in place. However, in my time working for the Cisco core team, I discovered that a great many companies do not back up their router and switch configurations. Even expert-level Cisco engineers were unfamiliar with the backup and recovery procedures, leaving their network extremely vulnerable in the case of a memory failure. Many network disasters can be avoided or easily resolved by performing and storing regular backups of configuration and IOS files.
Whenever a change is made to the running configuration, the change is stored in volatile DRAM. After you are comfortable with the changes made, you should copy the configuration to NVRAM using the copy run start command. When you issue the copy start run command, the contents of NVRAM are transferred into DRAM. If you fail to do this, the router is rebooted using the configuration originally left in NVRAM.
An easy way to save the configuration to a location in the network is to use TFTP. You need to have reachability to the device that has the TFTP software installed. The command to do this is copy running-config tftp:
Router#copy running-config tftp: – You need to include the colon
FIG 3.5 – Screenshot of the copy running-config tftp command
You also could have copied the startup-config file if you wanted to. Here are some options for the running configuration file:
Router#copy running-config ?
flash: Copy to flash file
ftp: Copy to current system configuration
startup-config Copy to startup configuration
tftp: Copy to current system configuration
Similarly, you can copy an IOS image onto a TFTP server. It is useful to back up IOS images before upgrading to a newer version. Because the IOS image is located in flash memory, the command to do this is shown below:
Router#copy flash tftp:
The router will prompt for the TFTP server, which should be a reachable server with TFTP software installed. An example of TFTP software is 3cDaemon. The router will also prompt you for the source and destination filenames.
The general syntax for copy commands is copy [source] [destination], so if you want to reverse the order, the command would be:
Router#copy tftp flash:
You should practice these commands until you know them by heart. They are very useful in emergency scenarios when you need to upgrade a device.
 |
Backing up your files and configurations is absolutely vital. Many companies have gone out of business because they did not bother to back up their startup configurations. By the time they get back on line, they may have lost a huge sum of money. Do not ever let this happen to you or your client. |
Booting Options
Although the router will usually boot using one image contained in flash, you can actually instruct it to boot from an image held in a network server or from one of the multiple images held in flash. Sometimes an IOS image may be too large to store in flash, so you would host it on a server and boot from that.
The commands differ slightly depending on which boot options you want to configure. Try all of the options on your own Cisco router. It’s important for the exam and in the real world that you know which options you have to boot your router from. Flash is the most common, but you can also use a TFTP server if you are directly connected.
Router(config)#boot system ?
WORD TFTP filename or URL
flash Boot from flash memory
ftp Boot from a server via ftp
mop Boot from a Decnet MOP server
rcp Boot from a server via rcp
tftp Boot from a tftp server
For flash:
Router(config)#boot system flash ?
WORD System image filename
[cr]
For TFTP:
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#boot system tftp c1841-adventerprisek9-mz.151-4.M7.bin?
Hostname or A.B.C.D Address from which to download the file
[cr]
Router(config)#boot system tftp c1841-adventerprisek9-mz.151-4.M7.bin
For USB:
Router(config)#boot system flash usbflash0: c1841-adventerprisek9-mz.151-4.M7.bin
The router will usually boot the system IOS from flash memory or a TFTP server if need be.
The standard practice of copying or recovering router configurations and IOS files was via TFTP, which offers no security whatsoever. Cisco offers, and now expects you to understand, other available methods, including SCP and FTP, as well as being able to verify the file with MD5, which will be covered in a lab shortly.
Regarding FTP, which has already been discussed, if you want to send or recover a router file from an FTP server, you will usually need to add the FTP username and password to the router, which in turn will be used as authentication credentials on the FTP server:
R1(config)#ip ftp username test
R1(config)#ip ftp password cisco
R1#copy startup-config ftp:
Address or name of remote host []? 192.168.1.2
Destination filename [r1-confg]?
You can also copy files using Secure Copy Protocol (SCP), which uses SSH for transportation. In addition to configuring SSH, you will need to configure AAA for authentication, and add the command below on the router if you want it to provide server-side functionality:
R1(config)#ip scp server enable
Upgrading the IOS
As with any operating system, the IOS on Cisco routers and switches occasionally needs to be updated. The updated IOS may support new protocols or technologies you need to use, deal with vulnerabilities, or contain bug fixes for issues on your network.
Most companies using Cisco equipment also have a support contract of some sort with Cisco Systems. You can usually log a ticket to ask whether the IOS you intend to use is appropriate. Cisco may ask you for some router outputs before giving you advice to check available memory and any modules currently in use.
Enterprise networks require that any IOS upgrades be planned in advance, as well as have plans in place if there are any issues. IOS upgrades usually require that the router be rebooted.
Before performing any IOS upgrades, it is important to check that your router has sufficient Flash and DRAM present (with the show flash command). When you check with Cisco or their IOS tool, you will see the memory requirements. If you have a testbed environment at work, you can test the upgrade there first. Note the similarities and differences between the show flash and dir flash commands in the output below:
Router#show flash
System flash directory:
File Length Name/status
3 33591768 c1900-universalk9-mz.SPA.151-4.M4.bin
2 28282 sigdef-category.xml
1 227537 sigdef-default.xml
[33847587 bytes used, 221896413 available, 255744000 total]
249856K bytes of processor board System flash (Read/Write)
Router#dir flash
Directory of flash0:/
3 -rw- 33591768 <no date> c1900-universalk9-mz.SPA.151-4.M4.bin
2 -rw- 28282 <no date> sigdef-category.xml
1 -rw- 227537 <no date> sigdef-default.xml
255744000 bytes total (221896413 bytes free)
Router#
Early versions of Cisco routers only allowed IOS upgrades over the network or using the console port (in the case of an emergency). Now you can use a USB port as well as a TFTP or FTP server on the network, as shown in the output below:
R1#copy flash: ?
flash: Copy to flash: file system
ftp: Copy to ftp: file system
http: Copy to http: file system
https: Copy to https: file system
nvram: Copy to nvram: file system
running-config Update (merge with) current system configuration
scp: Copy to scp: file system
slot0: Copy to slot0: file system
startup-config Copy to startup configuration
syslog: Copy to syslog: file system
tftp: Copy to tftp: file system
xmodem: Copy to xmodem: file system
ymodem: Copy to ymodem: file system
[output truncated]When you begin to perform the IOS upgrade, the router will prompt you for various values, such as the IP address of the FTP or TFTP server and whether you want to erase the current IOS.
Cisco offers the facility to verify your IOS image to determine whether it has been interfered with by hackers and that it is authentic. This process runs the MD5 algorithm and can verify several file locations:
R1#verify /md5 ?
flash: File to be verified
ftp: File to be verified
http: File to be verified
https: File to be verified
nvram: File to be verified
slot0: File to be verified
system: File to be verified
tar: File to be verified
tftp: File to be verified
[output truncated]
R1#verify /md5 flash:/c3550-ipbasek9-mz.122-51.SE2.bin
…………………………………………………………………….Done!
verify /md5 (flash:/ c3550-ipbasek9-mz.122-51.SE2.bin) = ecc86b1de4eb8e37cc3310c40d895445e
Mini-lab – Upgrading the IOS
Unless you have a home lab set up, it will be easiest to complete this lab using Packet Tracer.
FIG 3.6 – Mini-lab: Upgrading the IOS
Add an IP address to the router interface and Ethernet on the server (in the same subnet) and connect with a crossover cable. Ping the server from the router to ensure IP connectivity:
Router#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
.!!!!
On the server, you will have to tick a box to enable management software in order to run TFTP services (see Figure 3.7 below).
FIG 3.7 – Enabling management software to run TFTP services
You can check the IOS files available on the server and choose one that is not already on your router (see Figure 3.8 and the following output below).
FIG 3.8 – IOS files available on the server
Router#dir flash:
Directory of flash:/
3 -rw- 33591768 <no date> c1841-advipservicesk9-mz.124-15.T1.bin
2 -rw- 28282 <no date> sigdef-category.xml
1 -rw- 227537 <no date> sigdef-default.xml
64016384 bytes total (30168797 bytes free)
I chose the “ipbase-mz” image to install. Make sure that you have dragged the correct router model to the work area.
Router#copy tftp: flash:
Address or name of remote host []? 192.168.1.2
Source filename []? c1841-ipbase-mz.123-14.T7.bin
Destination filename [c1841-ipbase-mz.123-14.T7.bin]?
Accessing tftp://192.168.1.2/c1841-ipbase-mz.123-14.T7.bin…
Loading c1841-ipbase-mz.123-14.T7.bin from 192.168.1.2: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK – 13832032 bytes]
13832032 bytes copied in 0.264 secs (3587614 bytes/sec)
Router#
You can now see both IOS images in the flash memory. You can use a boot system command to determine which one to boot from:
Router#dir flash:
Directory of flash:/
3 -rw- 33591768 <no date> c1841-advipservicesk9-mz.124-15.T1.bin
4 -rw- 13832032 <no date> c1841-ipbase-mz.123-14.T7.bin
2 -rw- 28282 <no date> sigdef-category.xml
1 -rw- 227537 <no date> sigdef-default.xml
64016384 bytes total (16336765 bytes free)
Router(config)#boot system flash c1841-ipbase-mz.123-14.T7.bin
[END OF MINI-LAB]Password Recovery
My first job at Cisco TAC was working on the architecture team, which involved supporting router hardware and disaster recovery, including loss of IOS and password recovery. I was actually shocked at how many network administrators forgot their password, leaving them with a serious and embarrassing problem.
Without knowing the enable password, you cannot configure the router. The only way to recover it is to be physically present AND reboot the device, which is often out of the question on an enterprise network where outages have to be planned weeks in advance.
There is no generic system for recovering passwords because procedures differ from router to router, as well as switch to switch. For switches, they usually have to be rebooted with a certain button held down, but with a router, a break sequence has to be sent through the keyboard. This sequence differs depending on the operating system, making the process even trickier.
Please Google your particular model for procedures, but generally you would do the following:
- Connect a console cable to the router.
- Power cycle the router.
- Use the keyboard to send a break sequence (usually Control+Alt+Delete).
- Router will boot into the Rommon> prompt.
- Change the configuration register to 0x2142 to ignore startup config.
- Power cycle the router once more.
- Router will boot with a black config file.
- Go to the enable mode and copy startup config to running config.
- Remove the enable password and type in another one.
- Save the running config to startup config.
- Change the configuration register back to 0x2102.
End of Chapter Questions
Please visit www.howtonetwork.com/ccnasimplified to take the free Chapter 3 exam.
