|
|
This chapter provides detailed descriptions of commands used to configure the router for additional file transfer functions.
| Old Command | New Command |
|---|---|
tftp-server system | tftp-server |
For configuration information and examples, refer to the "Configuring Additional File Transfer Functions" chapter in the Configuration Fundamentals Configuration Guide.
To configure extended BOOTP requests for asynchronous interfaces as defined in RFC 1084, use the async-bootp global configuration command. Use the no form of this command to restore the default.
async-bootp tag [:hostname] data
tag | Item being requested; expressed as filename, integer, or IP dotted-decimal address. See Table 42 for possible keywords. |
:hostname | (Optional) This entry applies only to the host specified. The argument :hostname accepts both an IP address and a logical host name. |
data | List of IP addresses entered in dotted-decimal notation or as logical host names, a number, or a quoted string. |
| Keyword | Description |
|---|---|
bootfile | Specifies use of a server boot file from which to download the boot program. Use the optional :hostname and data arguments to specify the filename. |
subnet-mask mask | Dotted-decimal address specifying the network and local subnetwork mask (as defined by RFC 950). |
time-offset offset | Signed 32-bit integer specifying the time offset of the local subnetwork in seconds from Universal Coordinated Time (UTC). |
gateway address | Dotted-decimal address specifying the IP addresses of gateways for this subnetwork. A preferred gateway should be listed first. |
time-server address | Dotted-decimal address specifying the IP address of time servers (as defined by RFC 868). |
IEN116-server address | Dotted-decimal address specifying the IP address of name servers (as defined by IEN 116). |
nbns-server address | Dotted decimal address specifying the IP address of Windows NT servers. |
DNS-server address | Dotted-decimal address specifying the IP address of domain name servers (as defined by RFC 1034). |
log-server address | Dotted-decimal address specifying the IP address of an MIT-LCS UDP log server. |
quote-server address | Dotted-decimal address specifying the IP address of Quote of the Day servers (as defined in RFC 865). |
lpr-server address | Dotted-decimal address specifying the IP address of Berkeley UNIX Version 4 BSD servers. |
impress-server address | Dotted-decimal address specifying the IP address of Impress network image servers. |
rlp-server address | Dotted-decimal address specifying the IP address of Resource Location Protocol (RLP) servers (as defined in RFC 887). |
hostname name | The name of the client, which may or may not be domain qualified, depending upon the site. |
bootfile-size value | A two-octet value specifying the number of 512-octet (byte) blocks in the default boot file. |
If no extended BOOTP commands are entered, the Cisco IOS software generates a gateway and subnet mask appropriate for the local network.
Global configuration
This command first appeared in Cisco IOS Release 10.0.
Use the EXEC command show async-bootp to list the configured parameters. Use the no async-bootp command to clear the list.
The following example illustrates how to specify different boot files: one for a PC, and one for a Macintosh. With this configuration, a BOOTP request from the host on 172.30.1.1 results in a reply listing the boot filename as pcboot. A BOOTP request from the host named mac results in a reply listing the boot filename as macboot.
async-bootp bootfile :172.30.1.1 "pcboot" async-bootp bootfile :mac "macboot"
The following example specifies a subnet mask of 255.255.0.0:
async-bootp subnet-mask 255.255.0.0
The following example specifies a negative time offset of the local subnetwork of -3600 seconds:
async-bootp time-offset -3600
The following example specifies the IP address of a time server:
async-bootp time-server 128.128.1.1
You can use the master indexes or search online to find documentation of related commands.
To configure the router to use only passive FTP connections, use the ip ftp passive global configuration command. To allow all types of FTP connections, use the no form of this command.
ip ftp passiveThis command has no arguments or keywords.
All types of FTP connections are allowed.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
The following example configures the router to use only passive FTP connections:
ip ftp passive
You can use the master indexes or search online to find documentation of related commands.
ip ftp password
ip ftp source-interface
ip ftp username
To specify the password to be used for FTP connections, use the ip ftp password global configuration command. Use the no form of this command to return the password to its default.
ip ftp password [type] password
type | (Optional) Type of encryption to use on the password. A value of 0 disables encryption. A value of 7 indicates proprietary encryption. |
password | Password to use for FTP connections. |
The router forms a password username@routername.domain. The variable username is the username associated with the current session, routername is the configured host name, and domain is the domain of the router.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
The following example configures the router to use the username red and the password blue for FTP connections:
ip ftp username red ip ftp password blue
You can use the master indexes or search online to find documentation of related commands.
ip ftp password
ip ftp source-interface
ip ftp username
To specify the source IP address for FTP connections, use the ip ftp source-interface global configuration command. Use the no form of this command to use the address of the interface where the connection is made.
ip ftp source-interface interface
interface | The interface type and number to use to obtain the source address for FTP connections. |
The FTP source address is the IP address of the interface the FTP packets use to leave the router.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
Use this command to set the same source address for all FTP connections.
The following example configures the router to use the IP address associated with the Ethernet 0 interface as the source address on all FTP packets, regardless of which interface is actually used to transmit the packet:
ip ftp source-interface ethernet 0
You can use the master indexes or search online to find documentation of related commands.
ip ftp passive
ip ftp password
ip ftp username
To configure the username for FTP connections, use the ip ftp username global configuration command. To configure the router to attempt anonymous FTP, use the no form of this command.
ip ftp username username
username | Username for FTP connections. |
The Cisco IOS software attempts an anonymous FTP.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
The remote username must be associated with an account on the destination server.
The following example configures the router to use the username red and the password blue for FTP connections:
ip ftp username red ip ftp password blue
You can use the master indexes or search online to find documentation of related commands.
ip ftp passive
ip ftp password
ip ftp source-interface
Use the ip rarp-server interface configuration command to enable the router to act as a Reverse Address Resolution Protocol (RARP) server. Use the no form of this command to restore the interface to the default of no RARP server support.
ip rarp-server ip-address
ip-address | IP address that is to be provided in the source protocol address field of the RARP response packet. Normally, this is set to whatever address you configure as the primary address for the interface. |
Disabled
Interface configuration
This command first appeared in Cisco IOS Release 10.0.
This feature makes diskless booting of clients possible between network subnets where the client and server are on separate subnets.
RARP server support is configurable on a per interface basis, so that the router does not interfere with RARP traffic on subnets that do not need RARP assistance.
The Cisco IOS software answers incoming RARP requests only if both of the following two conditions are met:
Use the show ip arp EXEC command to display the contents of the IP ARP cache.
Sun Microsystems, Inc. makes use of RARP and UDP-based network services to facilitate network-based booting of SunOS on their workstations. By bridging RARP packets and using both the ip helper-address interface configuration command and the ip forward-protocol global configuration command, the Cisco IOS software should be able to perform the necessary packet switching to enable booting of Sun workstations across subnets. Unfortunately, some Sun workstations assume that the sender of the RARP response, in this case the router, is the host that the client can contact to TFTP load the bootstrap image. This causes the workstations to fail to boot.
By using the ip rarp-server feature, the Cisco IOS software can be configured to answer these RARP requests, and the client machine should be able to reach its server by having its TFTP requests forwarded through the router that acts as the RARP server.
In the case of RARP responses to Sun workstations attempting to diskless boot, the IP address specified in the ip rarp-server interface configuration command should be the IP address of the TFTP server. In addition to configuring RARP service, the Cisco IOS software must also be configured to forward UDP-based Sun portmapper requests to completely support diskless booting of Sun workstations. This can be accomplished using configuration commands of the form:
ip forward-protocol udp 111 interface interface name
ip helper-address target-address
RFC 903 documents the Reverse Address Resolution Protocol.
The following partial example configures a router to act as a RARP server. The router is configured to use the primary address of the specified interface in its RARP responses.
arp 172.30.2.5 0800.2002.ff5b arpa interface ethernet 0 ip address 172.30.3.100 255.255.255.0 ip rarp-server 172.30.3.100
In the following example, a router is configured to act as a RARP server, with TFTP and portmapper requests forwarded to the Sun server:
! Allow the router to forward broadcast portmapper requests ip forward-protocol udp 111 ! Provide the router with the IP address of the diskless sun arp 172.30.2.5 0800.2002.ff5b arpa interface ethernet 0 ! Configure the router to act as a RARP server, using the Sun Server's IP ! address in the RARP response packet. ip rarp-server 172.30.3.100 ! Portmapper broadcasts from this interface are sent to the Sun Server. ip helper-address 172.30.3.100
You can use the master indexes or search online to find documentation of related commands.
ip forward-protocol
ip helper-address
Use the ip rcmd domain-lookup global configuration command to enable Domain Name System (DNS) security for rcp and rsh. To bypass DNS security for rcp and rsh, use the no form of this command.
ip rcmd domain-lookupThis command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 10.3.
If you do not want to use DNS for rcmd queries, but DNS has been enabled with the ip domain-lookup command, use the no ip rcmd domain-lookup command.
This command will turn off DNS lookups for rsh and rcp only. The no ip domain-lookup command takes precedence over the ip rcmd domain-lookup command. If ip domain-lookup is disabled with the no ip domain-lookup command, DNS will be bypassed for rcp and rsh, even if ip rcmd domain-lookup is enabled.
The following example enables DNS security is for rcp and rsh:
ip rcmd domain-lookup
You can use the master indexes or search online to find documentation of related commands.
ip domain-lookup
This command has no arguments or keywords.
To ensure security, the router is not enabled for rcp by default.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
To allow a remote user to execute rcp commands on the router, you must also create an entry for the remote user in the local authentication database.
The no ip rcmd rcp-enable command does not prohibit a local user from using rcp to copy system images and configuration files to and from the router.
To protect against unauthorized users copying the system image or configuration files, the router is not enabled for rcp by default.
The following example shows how to enable the router for rcp:
rcp-enable
You can use the master indexes or search online to find documentation of related commands.
To create an entry for the remote user in a local authentication database so that remote users can execute commands on the router using rsh or rcp, use the ip rcmd remote-host global configuration command. Use the no form of this command to remove an entry for a remote user from the local authentication database.
ip rcmd remote-host local-username {ip-address | host} remote-username [enable [level]]
local-username | Name of the user on the local router. You can specify the router host name as the username. This name needs to be communicated to the network administrator or the user on the remote system. To be allowed to remotely execute commands on the router, the remote user must specify this value correctly. |
ip-address | IP address of the remote host from which the local router will accept remotely executed commands. Either the IP address or the host name is required. |
host | Name of the remote host from which the local router will accept remotely executed commands. Either the host name or the IP address is required. |
remote-username | Name of the user on the remote host from which the router will accept remotely executed commands. |
enable level | (Optional) Enables the remote user to execute privileged EXEC commands using rsh or to copy files to the router using rcp. The range is 1 to 15. The default is 15. For information on the enable level, refer to the privilege level global configuration command in the Security Command Reference. |
There are no entries in the local authentication database.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
A TCP connection to a router is established using an IP address. Using the host name is valid only when you are initiating an rcp or rsh command from a local router. The host name is converted to an IP address using DNS or host-name aliasing.
To allow a remote user to execute rcp or rsh commands on a local router, you must create an entry for the remote user in the local authentication database. You must also enable the router to act as an rsh or rcp server.
To enable the router to act as an rsh server, issue the ip rcmd rsh-enable command. To enable the router to act as an rcp server, issue the ip rcmd rcp-enable command.The router cannot act as a server for either of these protocols unless you explicitly enable the capacity.
A local authentication database, which is similar to a UNIX .rhosts file, is used to enforce security on the router through access control. Each entry that you configure in the authentication database identifies the local user, the remote host, and the remote user. To permit a remote user of rsh to execute commands in privileged EXEC mode or to permit a remote user of rcp to copy files to the router, specify the enable keyword and level. For information on the enable level, refer to the privilege level global configuration command in the Security Command Reference.
An entry that you configure in the authentication database differs from an entry in a UNIX .rhost file in the following aspect. Because the .rhosts file on a UNIX system resides in the home directory of a local user account, an entry in a UNIX .rhosts file does not need to include the local username; the local username is determined from the user account. To provide equivalent support on a router, specify the local username along with the remote host and remote username in each authentication database entry that you configure.
For a remote user to be able to execute commands on the router in its capacity as a server, the local username, host address or name, and remote username sent with the remote client request must match values configured in an entry in the local authentication file.
A remote client host should be registered with DNS. The Cisco IOS software uses DNS to authenticate the remote host's name and address. Because DNS can return several valid IP addresses for a host name, the Cisco IOS software checks the address of the requesting client against all of the IP addresses for the named host returned by DNS. If the address sent by the requester is considered invalid, that is, it does not match any address listed with DNS for the host name, then the software will reject the remote-command execution request.
Note that if no DNS servers are configured for the router, then that device cannot authenticate the host in this manner. In this case, the Cisco IOS software sends a broadcast request to attempt to gain access to DNS services on another server. If DNS services are not available, you must use the no ip domain-lookup command to disable the attempt to gain access to a DNS server by sending a broadcast request.
If DNS services are not available and, therefore, you bypass the DNS security check, the software will accept the request to remotely execute a command only if all three values sent with the request match exactly the values configured for an entry in the local authentication file.
The following example allows the remote user netadmin3 on a remote host with the IP address 172.16.101.101 to execute commands on router1 using the rsh or rcp protocol. User netadmin3 is allowed to execute commands in privileged EXEC mode.
ip rcmd remote-host router1 172.16.101.101 netadmin3 enable
You can use the master indexes or search online to find documentation of related commands.
ip rcmd rcp-enable
ip rcmd rsh-enable
no ip domain-lookup
To configure the remote username to be used when requesting a remote copy using rcp, use the ip rcmd remote-username global configuration command. To remove from the configuration the remote username, use the no form of this command.
ip rcmd remote-username username | Caution The remote username must be associated with an account on the destination server. |
username | Name of the remote user on the server. This name is used for rcp copy requests. All files and images to be copied are searched for or written relative to the directory of the remote user's account, if the server has a directory structure, for example, as do UNIX systems. |
If you do not issue this command, the Cisco IOS software sends the remote username associated with the current TTY process, if that name is valid, for rcp copy commands. For example, if the user is connected to the router through Telnet and the user was authenticated through the username command, then the software sends that username as the remote username.
If the username for the current TTY process is not valid, the Cisco IOS software sends the host name as the remote username. For rcp boot commands, the Cisco IOS software sends the access server host name by default.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
The rcp protocol requires that a client send the remote username on an rcp request to the server. Use this command to specify the remote username to be sent to the server for an rcp copy request. If the server has a directory structure, as do UNIX systems, all files and images to be copied are searched for or written relative to the directory of the remote user's account.
The following example configures the remote username to netadmin1:
ip rcmd remote-username netadmin1
You can use the master indexes or search online to find documentation of related commands.
boot network rcp
boot system rcp
copy
This command has no arguments or keywords.
To ensure security, the router is not enabled for rsh by default.
Global configuration
This command first appeared in Cisco IOS Release 10.3.
Use this command to enable the router to receive rsh requests from remote users. In addition to issuing this command, you must create an entry for the remote user in the local authentication database to allow a remote user to execute rsh commands on the router.
The no ip rcmd rsh-enable command does not prohibit a local user of the router from executing a command on other routers and UNIX hosts on the network using rsh. It disables a router that is enabled for rsh.
The following example enablse a router as an rsh server:
ip rcmd rsh-enable
You can use the master indexes or search online to find documentation of related commands.
To identify the type of device sending MOP sysid messages and request program messages, use the mop device-code global configuration command. Use the no form of this command to set the identity to the default value.
mop device-code {cisco | ds200}
cisco | Denotes a Cisco device code. |
ds200 | Denotes a DECserver 200 device code. |
Cisco device code
Global configuration
This command first appeared in Cisco IOS Release 10.0.
The sysid messages and request program messages use the identity information indicated by this command.
The following example identifies a DECserver 200 device as sending MOP sysid and request program messages:
mop device-code ds200
You can use the master indexes or search online to find documentation of related commands.
mop sysid
To configure the length of time that the Cisco IOS software waits before retransmitting boot requests to a MOP server, use the mop retransmit-timer global configuration command. Use the no form of this command to reinstate the default value.
mop retransmit-timer seconds
seconds | Sets the length of time, in seconds, that the software waits before retransmitting a message. The value is a number from 1 to 20. |
4 seconds
Global configuration
This command first appeared in Cisco IOS Release 10.0.
By default, when the software transmits a request that requires a response from a MOP boot server and the server does not respond, the message is retransmitted after 4 seconds. If the MOP boot server and router are separated by a slow serial link, it might take longer than 4 seconds for the software to receive a response to its message. Therefore, you might want to configure the software to wait longer than 4 seconds before retransmitting the message if you are using such a link.
The following example, if the MOP boot server does not respond within 10 seconds after the router sends a message, the server will retransmit the message:
mop retransmit-timer 10
You can use the master indexes or search online to find documentation of related commands.
mop device-code
mop enabled
To configure the number of times the Cisco IOS software will retransmit boot requests to a MOP server, use the mop retries global configuration command. Use the no form of this command to reinstate the default value.
mop retries count
count | Indicates the number of times the software will retransmit a MOP boot request. The value is a number from 3 to 24. |
8 times
Global configuration
This command first appeared in Cisco IOS Release 10.0.
In the following example, the software will attempt to retransmit a message to an unresponsive host 11 times before declaring a failure:
mop retries 11
You can use the master indexes or search online to find documentation of related commands.
mop device-code
mop enabled
mop retransmit-timer
To execute a command remotely on a remote rsh host, use the rsh privileged EXEC command.
rsh {ip-address | host} [/user username] remote-command
ip-address | IP address of the remote host on which to execute the rsh command. Either the IP address or the host name is required. |
host | Name of the remote host on which to execute the command. Either the host name or the IP address is required. |
/user username | (Optional) Remote username. |
remote-command | Command to be executed remotely. This is a required parameter. |
If you do not specify the /user keyword and argument, the Cisco IOS software sends a default remote username. As the default value of the remote username, the software sends the username associated with the current TTY process, if that name is valid. For example, if the user is connected to the router through Telnet and the user was authenticated through the username command, then the software sends that username as the remote username. If the TTY username is invalid, the software uses the host name as the both the remote and local usernames.
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
For security reasons, the software does not default to a remote login if no command is specified, as does UNIX. Instead, the router provides Telnet and connect services that you can use rather than rsh.
The following command specifies that user sharon attempts to remotely execute the UNIX ls command with the -a argument on the remote host mysys.cisco.com. The command output resulting from the remote execution follows the command example:
Router1# rsh mysys.cisco.com /user sharon ls -a
. .. .alias .cshrc .emacs .exrc .history .login .mailrc .newsrc .oldnewsrc .rhosts .twmrc .xsession jazz
To display the extended BOOTP request parameters that have been configured for asynchronous interfaces, use the show async-bootp privileged EXEC command.
show async-bootpThis command has no arguments or keywords.
Privileged EXEC
This command first appeared in Cisco IOS Release 10.0.
The following is sample output from the show async-bootp command:
Router# show async-bootp
The following extended data will be sent in BOOTP responses: bootfile (for address 192.168.1.1) "pcboot" bootfile (for address 172.16.1.111) "dirtboot" subnet-mask 255.255.0.0 time-offset -3600 time-server 192.168.1.1
Table 43 describes significant fields shown in the display.
| Field | Description |
|---|---|
bootfile... "pcboot" | Boot file for address 192.168.1.1 is named pcboot. |
subnet-mask 255.255.0.0 | Subnet mask. |
time-offset -3600 | Local time is one hour (3600 seconds) earlier than UTC time. |
time-server 192.168.1.1 | Address of the time server for the network. |
You can use the master indexes or search online to find documentation of related commands.
To configure a router or a Flash memory device on the router as a TFTP server, use one of the following tftp-server global configuration commands. This command replaces the tftp-server system command. To remove a previously defined filename, use the no tftp-server command with the appropriate filename.
tftp-server flash [partition-number:]filename1 [alias filename2] [access-list-number] (all others)
flash | Specifies TFTP service of a file in Flash memory. |
rom | Specifies TFTP service of a file in ROM. |
filename1 | Name of a file in Flash or in ROM that the TFTP server uses in answering TFTP Read Requests. |
alias | Specifies an alternate name for the file that the TFTP server uses in answering TFTP Read Requests. |
filename2 | Alternate name of the file that the TFTP server uses in answering TFTP Read Requests. A client of the TFTP server can use this alternate name in its Read Requests. |
access-list-number | (Optional) Basic IP access-list number. Valid values are 0 to 99. |
partition-number: | (Optional) Specifies TFTP service of a file in the specified partition of Flash memory. If the partition number is not specified, the file in the first partition is used. For the Cisco 1600 series and Cisco 3600 series, you must enter a colon (:) after the partition number if a filename follows it. |
device: | Specifies TFTP service of a file on a Flash memory device in the Cisco 1600 series, Cisco 3600 series and Cisco 7000 family. The colon (:) is required. Valid devices are as follows: · flash---Internal Flash memory on the Cisco 1600 series and Cisco 3600 series. This is the only valid device for the Cisco 1600. · bootflash---Internal Flash memory in the Cisco 7000 family. · slot0---First PCMCIA slot on the Cisco 3600 series and Cisco 7000 family. · slot1---Second PCMCIA slot on the Cisco 3600 series and Cisco 7000 family. · slavebootflash---Internal Flash memory on the slave RSP card of a Cisco 7507 or Cisco 7513 configured for HSA. · slaveslot0---First PCMCIA slot of the slave RSP card on a Cisco 7507 or Cisco 7513 configured for HSA. · slaveslot1---Second PCMCIA slot of the slave RSP card on a Cisco 7507 or Cisco 7513 configured for HSA. |
filename | Name of the file on a Flash memory device that the TFTP server uses in answering a TFTP Read Request. Use this argument only with the Cisco 1600 series, Cisco 3600 series, Cisco 7000 series or Cisco 7500 series. |
Disabled
Global configuration
This command first appeared in Cisco IOS Release 11.0.
You can specify multiple filenames by repeating the tftp-server command. The system sends a copy of the system image contained in ROM or one of the system images contained in Flash memory to any client that issues a TFTP Read Request with this filename.
If the specified filename1 or filename2 exists in Flash memory, a copy of the Flash image is sent. On systems that contain a complete image in ROM, the system sends the ROM image if the specified filename1 or filename2 is not found in Flash memory.
Images that run from ROM cannot be loaded over the network. Therefore, it does not make sense to use TFTP to offer the ROMs on these images.
On the Cisco 7000 family, the system sends a copy of the file contained on one of the Flash memory devices to any client that issues a TFTP Read Request with its filename.
In the following example, the system uses TFTP to send a copy of the version-10.3 file located in Flash memory in response to a TFTP Read Request for that file. The requesting host is checked against access list 22.
tftp-server flash version-10.3 22
In the following example, the system uses TFTP to send a copy of the ROM image gs3-k.101 in response to a TFTP Read Request for the gs3-k.101 file:
tftp-server rom alias gs3-k.101
In the following example, the system uses TFTP to send a copy of the version-11.0 file in response to a TFTP Read Request for that file. The file is located on the Flash memory card inserted in slot 0.
tftp-server flash slot0:version-11.0
The following example enables a Cisco 3600 series router to operate as a TFTP server. The source file c3640-i-mz is in the second partition of internal Flash memory:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z. router(config)# tftp-server flash flash:2:dirt/gate/c3640-i-mz
In the next example, the source file is in the second partition of the Flash memory PC card in slot 0 on a Cisco 3600 series:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z. router(config)# tftp-server flash slot0:2:dirt/gate/c3640-j-mz
The following example enables a Cisco 1600 series router to operate as a TFTP server. The source file c1600-i-mz is in the second partition of Flash memory:
router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z. router(config)# tftp-server flash flash:2:dirt/gate/c1600-i-mz
You can use the master indexes or search online to find documentation of related commands.
access-list
The tftp-server system command has been replaced by the tftp-server command. See the tftp-server command for further details.
|
|