1. Configure an IP address on the ethernet interface
cisco(config)# int fa0/0
cisco(config-if)# ip add 192.168.1.50 255.255.255.0
cisco(config-if)# no shut

2. Create a loopback interface
cisco(config)# int lo0
cisco(config-if)# ip add 1.1.1.1 255.0.0.0

3. Configure the line based on the “show line” output.
* If enabled, the port will be accessible through the network on TCP port 20xx where xx is the TTY of the port on the router
cisco(config)# line 1 16
cisco(config-line)# no exec  //unwanted signals from the attached device do not launch.
cisco(config-line)# exec-timeout 0 0 //disable the line timeout period
cisco(config-line)# logging synchronous
cisco(config-line)# transport input all

4. Configure default route
cisco(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.1
cisco(config)# ip default-gateway 192.168.1.1 
// ip default-gateway is configured as well in case routing is not enabled. E.g. the terminal server is in ROMMON mode as a result of a bad reboot after power outage.

5. Enable telnet line
cisco(config)# line vty 0 4
cisco(config-line)# password cisco
cisco(config-line)# login

6. Configure host and line mapping
*e.g. Router A is connected to line 1
cisco(config)# ip host RouterA 2001 1.1.1.1

Assuming the IP address, enable password and default route are in place, the additional steps needed are as follows:

1. Configure a domain name
cisco(config)# ip domain-name cisco.com

2. Configure the RSA key generation for encryption
cisco(config)# crypto key generate rsa
* it may prompt user for the key length generated in the range of 360 to 2048. Default is 512-bit.

3. Configure authentication method
a) Using local database
cisco(config)# username cisco password cisco

OR

b) Using Radius server
cisco(config)# aaa new-model
cisco(config)# aaa authentication login Radius_Server group radius
cisco(config)# radius-server host 192.168.1.155

4. Configure the terminal line
cisco(config)# line vty 0 4
cisco(config-line)# login local                                            // using local database

OR

cisco(config-line)# login authentication Radius_Server          //using radius server
cisco(config-line)# transport input ssh

Network Address Translation (NAT) was introduced to overcome these addressing problems that occurred with the rapid expansion of the Internet. Basically NAT allows a single network device (e.g a router, firewall etc) to act as an agent between a private local area network and a public network such as the Internet. The purpose of this NAT device is to translate the source IP addresses of the internal network hosts into public routable IP addresses in order to communicate with the Internet.

::Advantages::

• NAT helps to mitigate the depletion of the global public IP address space
• Networks can now use the RFC 1918 private address space internally and still have a way to access the Internet using NAT.
• NAT increases security by hiding the internal network topology and addressing scheme.

1. Define the DHCP address pool,

Router(config)#ip dhcp pool POOLNAME

Router(dhcp-config)#network XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY

where,

XXX.XXX.XXX.XXX is the network address to be used by the DHCP pool

YYY.YYY.YYY.YYY is the subnet mask for the network.

You can replace the subnet mask by a (/PREFIX) to provide the subnet mask.

2. Configure the parameters to be sent to the client,

Router(dhcp-config)#dns-server XXX.XXX.XXX.XXX

To provide the DNS server IP address

Router(dhcp-config)#default-router XXX.XXX.XXX.XXX

To provide the IP address of the default gateway

Router(dhcp-config)#domain-name NAME

To provide the name of the domain of the network (if in a domain environment)

Router(dhcp-config)#netbios-name-server XXX.XXX.XXX.XXX

To provide the IP address of the NetBIOS name server

Router(dhcp-config)#lease DAYS HOURS MINUTES

To define the lease time of the addresses given to the client. You can make it infinite by using this command instead; lease infinite

There is a large group of settings that you can configure to be sent to the clients, and I have only mentioned the most frequently used.

3. Configure the IP addresses to be excluded from the pool. This is usually done to avoid the conflicts caused by the DHCP with servers and printers. Remember to give ALL servers and network printers static IP addresses in the same range of the DHCP pool. And then exclude these addresses from the pool to avoid conflicts.

Router(config)#ip dhcp excluded-address XXX.XXX.XXX.XXX

Use the command in the previous form to excluded a single address. You can repeat it as much as you see fit for the IP addresses you want to exclude. Or,

Router(config)#ip dhcp excluded-address YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

where,

YYY.YYY.YYY.YYY is the start of the range to be excluded from the pool

ZZZ.ZZZ.ZZZ.ZZZ is the end of the range

This way you can exclude a range or ranges of IP addresses and reserve them for static addresses use.

4. Enable the DHCP service in the router

Router(config)#service dhcp

To disable it use

Router(config)#no service dhcp

Usually the DHCP service is enabled by default on your router.

5. Use the following commands to check the DHCP operation on the router:

Router#show ip dhcp binding

This command shows the current bindings of addresses given to clients

Router#show ip dhcp server statistics

This command show the DHCP server statistics.

Router#debug ip dhcp server

This debug command is used to troubleshoot DHCP issues.

Implementation notes:

1. If you have a DHCP server other than the router, and you would like to let the router to forward the DHCP requests from a certain LAN to the DHCP server laying outside that LAN, go to the Ethernet interface that does not have the DHCP server and type the following command:

Router(config-if)#ip helper-address XXX.XXX.XXX.XXX

where XXX.XXX.XXX.XXX is the IP address of the server laying outside this LAN.

2. You can create a DHCP database agent that stores the DHCP binding database. A DHCP database agent is any host, for example, an FTP, TFTP, or RCP server that stores the DHCP bindings database. You can configure multiple DHCP database agents and you can configure the interval between database updates and transfers for each agent. To configure a database agent and database agent parameters, use the following command in global configuration mode:

Router(config)#ip dhcp database url [timeout seconds | write-delay seconds]

An example url is this

ftp://user:password @ 192.168.0.3/router-dhcp (remove the spaces before implementing)

If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP server. To disable DHCP address conflict logging, use the following command in global configuration mode:

Router(config)#no ip dhcp conflict logging

3. DHCP service uses port 67 and 68. So, if you are using a firewall, remember to open these ports.

4. To clear DHCP server variables, use the following commands as needed:

Router#clear ip dhcp binding *

If you want to clear a certain binding not all of them, replace the * in the previous command with the IP address to be cleared.

Router#clear ip dhcp server statistics

If you ever lose a password on a PIX Firewall and need to recover it, follow these steps:

if you ever need to recover a password on the PIX
here are the steps:

Requirements:

* You will need a console connection from the PIX to your machine
* You will need a TFTP server application running on your machine
(I personally use tftpd32, which can be downloaded for free
at http://tftpd32.jounin.net/)

1) Connect the console cable to your serial port and plug the RJ45 end
into the PIX port marked "Console". You can use Hyperterm (which comes
with Windows) or any other console program of your choice. I use
TeraTerm Pro, found at http://www.ayera.com/teraterm/.

2) Find out what version of software is running on your PIX. If you're
not sure, you can find out very easy in the following way. If you
are connected to the PIX via a console connection, simply reboot the
PIX and watch for the output. It will tell you which version is
running.

3) Download the corresponding helper binary file from Cisco, depending
on which software version is running on the PIX. For example, if you
were running version 6.3(x) you could use the file called np63.bin found
here: http://www.cisco.com/warp/public/11... If you were running
6.2 you could simply change the last characters on the above url to be
np62.bin. Download that file and save it to the root directory of your
TFTP application.

4) Next, reboot the PIX again and immediately after the reboot as it is
coming back up and displaying text in your console send a break sequence
with your keyboard. If you are using Hyperterminal with Windows the break
sequence is Ctrl-Break.

5) This will send the PIX into "Monitor" status and you will see the following
prompt on the PIX:

monitor>

6) Patch your computer into the inside or outside interface on the PIX via a
standard CAT 5 cable (i.e. patch from your computers NIC to one of the PIX's
interfaces).

7) Give your computer an IP address. For this example, let's use 10.0.0.1
with a gateway of 255.0.0.0

8) Start up your TFTP server program and keep it running.

9) Tell the PIX which interface you will be connecting to, as follows:

monitor> interface 1

*note interface 1 is inside, interface 0 is outside, but you remember that
from reading the ebook right? :)

10) Give the PIX a temporary IP address on the same network as your computer,
as follows:

monitor> address 10.0.0.2

11) Tell the PIX the IP address of the TFTP server (your computer)

monitor> server 10.0.0.1

12) Tell the PIX which file to copy:

monitor> file np63.bin

13) Start the TFTP copy

monitor> tftp

14) It should copy very quickly. If it does not you will get
an error message on the PIX and potentially on the TFTP server
software. If you do get an error, you likely have a cabling
issue or perhaps a typo of one of the above commmands.

15) Once the file is copied to the PIX, the PIX will ask if you are
sure you want to reset the password. Type "Y" for yes, and the PIX
will reboot.

16) After the reboot the PIX will now have a default telnet password
of "cisco" (no quotes) and no enable password.

That's about it. About 10 minutes of downtime and you and your PIX Firewall are back in action!

A brief guide on how to properly add a second (or third) router to an existing LAN that already has a SOHO router connected to the internet.

The general setup of SOHO Router's is similar.  While some use a different subnet, every one I've worked with uses a Class C Private IP Addressing Scheme.  I'm going to use the basic Class C private for this tutorial (192.168.0.0)

I'm going to give two setup guides:

Your company is connected to the Internet, right? (everyone nod your head yes) So what WAN protocol do you use to connect to the Internet? Chances are, that if you have a T1 leased line to the Internet or a private network between locations, you use one of these three WAN Protocols: HDLC, PPP, or Frame-relay. Let’s explore the differences and similarities of these protocols.

What is HDLC?

HDLC stands for High-Level Data Link Control protocol. Like the two other WAN protocols mentioned in this article, HDLC is a Layer 2 protocol. HDLC is a simple protocol used to connect point to point serial devices. For example, you have point to point leased line connecting two locations, in two different cities. HDLC would be the protocol with the least amount of configuration required to connect these two locations. HDLC would be running over the WAN, between the two locations. Each router would be de-encapsulating HDLC and turning dropping it off on the LAN.

What is PPP?

• PPP is not proprietary when used on a Cisco router
  
  
• PPP has several sub-protocols that make it function.
  
  
• PPP is feature-rich with dial up networking features
  

• Link quality management monitors the quality of the dial-up link and how many errors have been taken. It can bring the link down if the link is receiving too many errors.
  
  
• Multilink can bring up multiple PPP dialup links and bond them together to function as one.
  
  
• Authentication is supported with PAP and CHAP. These protocols take your username and password to ensure that you are allowed access to the network you are dialing in to.
  

What is Frame-Relay?

• Ability to have a single circuit that connects to the “frame relay cloud” and gain access to all other sites (as long as you have PVCs). As the number of locations grow, you would save more and more money because you don’t need as many circuits as you would if you were trying to fully-mesh your network with point to point leased lines.
  
  
• Improved disaster recovery because all you have to do is to order a single circuit to the cloud and PVC’s to gain access to all remote sites.
  
  
• By using the PVCs, you can design your WAN however you want. Meaning, you define what sites have direct connections to other sites and you only pay the small monthly PVC fee for each connection.
  

• LMI = local management interface. LMI is the management protocol of frame relay. LMI is sent between the frame relay switches and routers to communicate what DLCI’s are available and if there is congestion in the network.
  
  
• DLCI = data link connection identifier. This is a number used to identify each PVC in the frame relay network.
  
  
• CIR = committed information rate. This is the amount bandwidth you pay to guarantee you will receive, on each PVC. Generally you have much less CIR than you have port speed. You can, of course, burst above your CIR to your port speed but that traffic is marked DE.
  
  
• DE = discard eligible. Traffic marked DE (that was above your CIR) CAN be discarded by the frame-relay network if there is congestion.
  
  
• FECN & BECN = forward explicit congestion notification & backward explicit congestion notification. These are bits set inside LMI packets to alert the frame-relay devices that there is congestion in the network.
  

::::Summary::::

A useful management tool available in IOS is the one that gives you the ability to assign levels of
privilege. Privilege levels are assigned to both users and commands. The privilege levels range
from 0 to 15. By default, commands are assigned either level 1 or level 15. Those commands that
need to be executed in privileged EXEC mode are level 15 commands. With a few exceptions,
those commands that can be executed in user EXEC mode are level 1 command. A small number
of commands are level 0 commands. These commands include enable, disable, exit, logout, and
help. Level 0 commands can be executed at any level.

A user operating in privileged EXEC mode is a level 15 user. A user operating in user EXEC
mode is a level 1 user. Commands and users can be assigned a privilege level different from their
default. The way the privileges work is a higher level has the same rights as the lower levels
beneath it. For instance, a level 10 user (if you set one up) can do everything users at levels 9
through 0 can do. Level 15 users can execute all commands.

Commands can be reassigned a different level of privilege as well. You can raise or lower the
level of privilege on any command. Privilege levels on commands are assigned using the
Privilege command; the command syntax is as follows. Use global configuration mode for this
command.

    privilege level <0 – 15>

This feature is quite useful as it allows us to create various levels of users with custom rights to
IOS commands. Imagine if you had a number of administrators with limited knowledge of the
workings of IOS. But you need their help with certain specific tasks such as shutting down and
re-enabling an interface or adding users to an access server. You can configure the router or
access server so that depending upon the password provided, the user will be assigned a specific
level of privilege and will only be allowed to use commands assigned to that level and below.

Privilege levels for users can be set in a number of ways via the IOS. They can be set
permanently on a line using the privilege level command; at the command prompt using the
enable command; or when logging in using the username command.

To set the default privilege level for a line, use the privilege level command in line configuration
mode. The syntax is as follows: privilege level <0 – 15>.

To interactively reset the level of privilege from the command line, use the enable command.
The command syntax is enable <0 – 15>. The command can be executed in any EXEC mode. If
you leave off the level number, the router assumes you mean 15. It is advisable to set up an
“enable secret” password for each level of privilege. Be sure each level’s password is different
and that the passwords are only known to users within the appropriate level. The syntax for this
command is enable secret level <1-15> .

The most common way to assign levels of privilege is to do so based on the user’s username.
The IOS allows you to create and use username/password pairs in your router configuration for
authentication purposes. Along with the authentication process, the user can be assigned as level
of privilege.

Examples:

In the example below, we have created three custom user levels using level numbers 2, 3, and 4.
Level 2 users can do show commands as well as all commands in levels below. By default, level
1 users can do most show commands. But after issuing the command privilege exec level 2
show in our configuration, it will no longer be possible. Level 3 users are permitted to issue the
command show ip route, but level 2 users cannot. Level 4 and above users can issue the show
access-list command as well as any command in levels below.

    Router(config)# privilege exec level 2 show
    Router(config)# privilege exec level 3 show ip route
    Router(config)# privilege exec level 4 show access-list

The example below shows us assigning level 2 to any user that enters the router via telnet. It
assigns level 3 to any user that enters via the auxiliary port. And it assigns level 4 to anyone that
enters via the console port.

    Router(config)# line vty 0 4
    Router(config-line)# privilege level 2
    Router(config-line)# line aux 0
    Router(config-line)# privilege level 3
    Router(config-line)# line console 0
    Router(config-line)# privilege level 4

The example below creates a separate password for each custom level of privilege. If a user
issues the command enable 2, that user will be prompted for the password “twopass”. A level
three request will require the level three password and so on.

    Router(config)# enable secret level 2 twopass
    Router(config)# enable secret level 3 threepass
    Router(config)# enable secret level 4 fourpass

The example below creates three users: bob, fred, and sam. Bos is a level 2 user. Fred is a level 3
user. Sam is a level 4 user. To have the router prompt for username and password when logging
in, use the command login local in your line configuration mode.

    Router(config)# username bob privilege 2 password bobpass
    Router(config)# username fred privilege 3 password fredpass
    Router(config)# username sam privilege 4 password sampass
    Router(config)# line vty 0 4
    Router(config-line)# login local

Theres no real intro needed to this tutorial. This is literally going to be a step by step, just
as the title suggests. However, before I go on, I think it important to know WHY and HOW
this works as well as it can be applied somewhat to other devices/situations.

Cisco routers work like this:
ROM > NVRAM > FLASH > DRAM
lets break it down:

ROM:
This is your Basic IOS. (thats Internetworking Operating System for those who dont know)
Think of it kind of like CMOS with the exception that you cannot flash or alter it. The ROM
contains the /BOOTP as well.

The Bootp has a value which defines how the device will boot.
They are as follows:
0x2102 <-- normal boot sequence
0x2142 <-- skips NVRAM
0x2101 <-- skips FLASH
0x2000 <-- diagnostic mode

NVRAM:
Non Volatile RAM. This is like a hard drive being that the memory is non-volatile meaning
that the info in it stays after a reboot. This contains the startup-config which contains the
PWs to the device.

FLASH:
This is your IOS.

DRAM:
Think of this as RAM, because thats what it is. Its volatile memory that contains the
running-config. Any changes you make to the system are saved to the running config but
being its volatile, once the system is rebooted for whatever reason, those changes are gone.
This is why you "copy run start" to save the changes in the running config to the startup
config so that they are applied if/when the device is rebooted.

(pardon the abbreviation of the commands, but as anyone thats used Ciscos IOS knows,
you can abbreviate any command or subcommand pretty well, so no need to write it all out.
"cop ru st" will so the same thing as "copy run start". Blah blah blah, you get the idea, no
need to get into this now.)

Moving on.
Now that Ive explained all that and you hopefully have an understanding of how the
devices boot sequence works, on to the password recovery.

1. Reboot the device.

2. press control + break within 60 seconds of the reboot.
this brings you to the basic IOS.
Now you can change the value in the BOOTP from 0x2102 to 0x2142, which skips
NVRAM, which contans the startup-config, which contains the password.

3. Reset.
Ok, so now that this point the device will boot up and due to the change in the bootp will
bypass the NVRAM and bring you into the IOS.

4. At the prompt:
Router> enable
Router# copy start run
ROUTERNAME#config t
here is where you either view or change the password. You may be able to view it if the
administrator hasnt encrypted it. If thay have, you can crack it or easier still just assign a
new one.
ROUTERNAME(config)#config 0x2102
this changes the boot sequence back to normal.
ROUTERNAME#copy run start
This copies the DRAM to the NVRAM... thus saving the changes you made.

5. Reboot.
Done. The device will then reboot and prompt you for the password that you just set. Enter
it and its all good.
Hope you enjoyed this tutorial.

1. Configuration Manual Resolution:

Cisco Router Show Commands

Cisco Router Basic Operations

Cisco Router Copy Commands

Cisco Router Debug Commands

There are few simple things that might help administrators in utilizing their time working with Cisco routers. I gathered the most important ten things, in my point of view, and wrote them down.


1. The best sequence of configuring a Cisco router, as I see it, is the following:

a. Setup the hostname with the ‘hostname XXXXXX’ command.

b. Setup the secret password (or enable password) with the ‘enable secret XXXXX’ command.

c. Setup console and telnet passwords (use the ‘logging synchronous’ command at the console) with the ‘password XXXXX’ and ‘login’ commands.

d. Encrypt the un-encrypted passwords with ‘service password-encryption’ command and don’t forget to turn it off after you ‘show run’.

e. Setup the interfaces (IP addresses, description, bandwidth, etc) with ‘ip address’, ‘bandwidth’, and ‘description’ commands

f. Setup the Routing protocols (or static routes)

g. Test the connectivity with ‘ping’ and ‘traceroute’

h. Setup the access-lists

i. Test the connectivity (again)

2. Be as descriptive as possible.

Use the ‘description’ command on ALL interfaces. And give useful description in it. Describe the network to which this interface is connected, the bandwidth of the link, the duplex settings, and any other information that you might think useful. Use ‘remark’ in writing the access-lists so you would identify the access-list according to its function. And if you find it necessary, use banners.

Examples:

RouterA(config-if)#description This link is connected to the Accounting Lan

RouterA(config)#access-list 101 remark This list stops the telnet to the Marketing net

RouterA(config)#banner motd #This router is connected to the marketing and accounting LANS#

3. Use hotkeys.

There are many useful hotkeys in the configuration command line environment. Few of the most important are:

Control P Recalls the previous command in the history buffer

Control N Recalls the next command in the history buffer

Control E Goes to the end of the line

Control A Goes to the beginning of the line

4. Stop the router from looking-up DNS server for wrong commands.

When you misspell a command and hit the ‘Enter’ key, the router does not recognize the command and thinks that it might be a host name. The router, then, tries to contact the DNS server to resolve the name to an IP address so it would telnet it. This would take a large amount of time, especially when you have not setup a valid DNS server (because the router will broadcast the request and waits for a DNS server to reply). To turn this off, use the ‘transport preferred none’ command in the console and vty lines.

Example:

RouterA(config)#line con 0

RouterA(config-line)#transport preferred none

5. Setup the Bandwidth of serial interfaces.

Use the ‘bandwidth’ command for setting the bandwidth of ALL serial interfaces to guarantee the correct calculation of routing table. The bandwidth of a serial link is dependant on the type of WAN connection you are using. And unlike Ethernet or FastEthernet, serial interfaces cannot automatically detect the bandwidth of the link. And the bandwidth of the actual link might be different from the small link between the serial interface and the modem or CSU/DSU device you are using. And remember to write the bandwidth after the ‘bandwidth’ command in Kilobits.

Example:

RouterA(config)#int serial 0

RouterA(config-if)#bandwidth 1024       >> This means the link bandwidth is 1Mbit/second

6. Turn off Auto-summarization of routing updates when using subnetted addresses.

If you are using subnetting, remember use the ‘no auto-summary’ command to turn off auto-summarization. This is when using routing protocols that support it, like OSPF.

Example:

RouterA(config)#no auto-summary

7. Turn off split-horizon in two cases.

The first is when you are doing inter-VLAN routing. This is because updates from one VLAN can not pass to other VLANs. And the second case is when you are using frame-relay to connect one site to multiple sites.

Example:

RouterA(config-if)#no ip split-horizon

8. The ‘show’ command is your best friend.

Whenever you’re in trouble, or even if you’re not in trouble yet, you best friend comes up; the ‘show’ command. The most widely used ‘show’ commands are the following:

show version - Shows some good information like the IOS version, the configuration-register value and the interfaces available.

show ip route - Shows the routing table

show ip interface - Shows the access-lists applied to interfaces

show access-list - Shows the contents of access-lists

show ip protocols - Shows information about the routing protocols currently running.

show cdp neighbor detail - Shows detailed information about neighboring devices.

show interface - Show status information about interfaces.

show run - Shows the running configuration, i.e., all the commands now in action.

9. Keep the IP addresses of servers and printers out of the DHCP pool.

When using the router as a DHCP server, do NOT forget to exclude the addresses of server and printers off the DHCP pool.

Example:

RouterA(config)#ip dhcp excluded-address 192.168.0.1

RouterA(config)#ip dhcp excluded-address 192.168.0.1 192.168.0.10
You can use a single IP address in this command or a start-IP and end-IP to define a range.

10. Keep a scheduled ‘reload’ when configuring a router remotely.

When you are configuring a router remotely, you might do something wring and loose the connectivity with the router. In this case, you will need to restart the router physically. There are chances that no one is around the router to restart it for you. You can solve this by yourself by using the ‘reload in xx’ command. This command schedules a reload after xx minutes. So, before you start nosing around the router remotely, issue this command and schedule a reload. If something goes wrong and you loose the connectivity with the router, the router will reload and you get back in business. And if things go smooth and you don’t need to reload after all, you can issue a ‘reload cancel’ command to stop the scheduled restart from happening.

I hope you find these tips useful in getting you out of trouble or getting you away from it. 

When would you need this: When you are creating a WAN link. And also when the other end of a WAN link is NOT a Cisco router. Point-to-Point Protocol can be used in synchronous, asynchoronous, HSSI, and ISDN links.

Special Requirements: None.



1. Get to the interface configuration mode and issue the following command,

Router(config-if)#encapsulation ppp

2. If you want to configure authentication (which is almost always the case), go through the following steps:

a. Choose the authentication type; Password Authentication Protocol (PAP), or Challenge Handshake Authentication Protocol (CHAP).

Router(config-if)#ppp authentication XXX

where XXX is the authentication type which can be: pap, chap, pap chap, or chap pap. The last two choices are to use the other authentication type when the first one fails.

CHAP is strongly recommended over PAP for two reasons. First, PAP sends the username and password in plaintext, while CHAP sends hashed challenges only. Second is that CHAP does an operation similar to periodic re-authentication in the middle of the communication session such that it provides more security than PAP.

b. Set a username and a password that the remote router would use to connect to your local router. You can define many username-password pairs for many PPP connections to the same router.

Router(config)#username USER password PASS

where USER is the host name of the remote router, and PASS is its password. Issue this command once for each PPP connection. For example if you are connecting RouterA to RouterB and RouterC, on RouterA issue this command once for each remote router.

c. Now you can set the username and password that you local router would use to access the remote router. For PAP authentication, you can specify the username and password that the local router will send to the remote router for authentication using the following command,

Router(config-if)#ppp pap sent-username USER passwrod PASS

For CHAP, two commands are used,

Router(config-if)#ppp chap hostname USER

Router(config-if)#ppp chap password PASS

The usernames and passwords are case sensitive, so be careful when writing them. This way, you will have to write the hostname and secret password of the remote router in your local router and write the hostname and secret password of your local router into your remote using the 'username' command.

If you do not set the username and password that will be sent from the local router to the remote router for authentication, the router will use its hostname and secret password instead.

3. You can monitor the quality of the serial link that is using PPP with the following command,

Router(config-if)#ppp quality PERCENT

where PERCENT is the minimum accepted link quality. If the link quality drops below PERCENT, the link will be shutdown and considered bad.

4. If the available bandwidth is small, you might consider compressing the data being transmitted using the following command,

Router(config-if)#ppp compress YYY

where YYY is the compression type which can be predictor or stacker.

Note: The compression might affect the system performance because it increases the CPU load. Check the CPU load with ‘show process cpu’ and disable the compression if the CPU load is over 65%.

5. To troubleshoot PPP, you can use the following commands,

Router#debug ppp negotioations

Router#debug ppp packets

Router#debug ppp errors

Router#debug ppp authentication