The Edge Router — Cisco 3640 It’s 1999. One T1 to the world, the whole town behind it. Type real IOS.

IOS is modal, and the prompt tells you where you are:

gw>                  user EXEC      — look, don't touch
gw#                  privileged EXEC — "enable" got you here; show/save/reload
gw(config)#          global config   — "configure terminal"
gw(config-if)#       interface config — "interface FastEthernet0/0"
gw(config-line)#     line config      — "line vty 0 4"

enable climbs from user to privileged; configure terminal enters config; exit drops one level; end (or Ctrl-Z) jumps straight back to privileged EXEC.

Everything you type in config mode edits the running-config live — it takes effect the instant you press Enter. That is powerful and a little scary, which is the whole point of the last work-order item.

This router has two sides. The LAN side (FastEthernet0/0) is the default gateway every server in the rack points at — 156.46.191.1. The WAN side (Serial0/0) is the T1 out to the upstream provider.

interface FastEthernet0/0
 ip address 156.46.191.1 255.255.255.0
 no shutdown

Cisco interfaces ship administratively down. You can set the address perfectly and still have a dead port because you never typed no shutdown. show ip interface brief is your friend: you want up / up, not administratively down.

The T1 to the upstream is a point-to-point serial link. You give it an address on the little /30 the provider assigned, set the encapsulation, and bring it up:

interface Serial0/0
 ip address 207.0.55.2 255.255.255.252
 encapsulation ppp
 no shutdown

Then one static route says “anything I don’t have a better path for, send to the provider”:

ip route 0.0.0.0 0.0.0.0 207.0.55.1

That 0.0.0.0 0.0.0.0 is the default route — the “gateway of last resort.” Without it the router knows about its own two networks and nothing else, and the whole town can reach each other but not the internet. show ip route should show a S* default.

Remember the bandwidth graphs on the Solaris box? MRTG draws them by polling this router’s interface counters over SNMP every five minutes. For that to work the router has to answer to the community string MRTG uses:

snmp-server community public RO

RO = read-only (MRTG only needs to read counters, never change anything). Forget this line and the graph over on home flatlines — the poll just times out. This is the other half of the cron/MRTG ticket in the Solaris Boot Camp.

A router with a public IP and no passwords is a gift to the internet. You set an enable secret (encrypted), a console password, and a password on the vty lines (that’s telnet):

enable secret pNet99
line con 0
 password console99
 login
line vty 0 4
 password telnet99
 login

Two more 1990s essentials. Directed broadcasts were how the smurf denial-of-service attack worked — turn them off on the LAN interface:

interface FastEthernet0/0
 no ip directed-broadcast

And restrict who may even try to telnet in, with an access list applied to the vty lines:

access-list 10 permit 156.46.191.0 0.0.0.255
line vty 0 4
 access-class 10 in

In 1998 an open, directed-broadcast-enabled router wasn’t just yours to lose — it got conscripted to attack other people. no ip directed-broadcast later became the default, precisely because of smurf.

There are two configs. The running-config is what the router is doing right now, in RAM. The startup-config is what it loads from NVRAM when it boots. Editing config changes running only.

copy running-config startup-config      (or just:  write memory )

Do an hour of perfect work, skip that one command, and the first power blip — or one reload — throws all of it away and the router boots back to the last saved version. Every network engineer has done this exactly once. The last work-order item makes you do it on purpose so you never do it by accident. Try reload before you save and see what happens.