Working with Your Access Server for the First Time

This chapter will familiarize you with critical components of Cisco access servers while you configure the product for the first time. Spending a few minutes in this chapter when you first sit down to configure your access server will save you more than a few minutes later.

Complete the tasks in this chapter if you are not familiar with any of the following components and configuration tasks on a Cisco access server:

• The EXEC facility

• Line versus interface configuration tasks

• Different command modes in the command line interface

• Context-sensitive help

• How to view your configuration and Cisco IOS software release version

• The components that need to be configured on an access server to enable users to dial in from remote locations and access resources on your network (such as file servers and printers)

This chapter assumes you have already referred to your product's hardware installation configuration guide, software configuration guide, or other documents for your product to perform the following tasks:

• Starting up your access server

• Connecting to the console port of your access server

• Displaying an EXEC prompt (Router>) on your terminal screen (or being able to display it)

Complete these tasks before you perform the tasks in this chapter. (Refer to the documentation that accompanied your access server for more information about these tasks.)

Specifically, this chapter describes the following:

• Sample Dial Scenarios Using Access Servers--This section provides a description of the two networks that this guide aims to build using Cisco dial technologies.

• Working with the EXEC Facility, Lines, and Interfaces--This section provides important background information.

• First-Time Router Configuration Procedures--This section provides five lessons that enable you to learn while you configure the access server.

Sample Dial Scenarios Using Access Servers

Access servers are used in a variety of dial networking topologies.

Figure 1-1 shows the Cisco 2511 access server providing access for remote clients using modems. The clients place analog calls into the enterprise via a fixed number of asynchronous dial-in access ports on the Cisco 2511. In this chapter, lessons 1 through 5 provide concise step-by-step instructions for configuring low-end access servers, such as the Cisco 2511.

Figure 1-2 shows the Cisco AS5200 accepting incoming calls from a Cisco 766, Cisco 1604, and an individual remote client such as a standalone laptop in a hotel room. The chapter "Enabling ISDN and Analog Calls through Access Servers" provides step-by-step configuration information for this scenario.

Working with the EXEC Facility, Lines, and Interfaces

This section describes the following information:

• Choosing a Method of Connecting to the Network

• Accessing Different Command Modes

• Getting Context Sensitive Help

• Configuring Asynchronous Ports

Choosing a Method of Connecting to the Network

The prompt that appears when you first log in to an access server (Router>) is called the EXEC prompt. When you access the EXEC prompt, you are accessing the EXEC facility and you start an EXEC session. You can log in through the following ports on an access server:

• Console port

• LAN or WAN interface

• Asynchronous interface

The focus of this guide is on how you configure (via the console port) the access server to permit remote clients to dial in through asynchronous interfaces to access network resources (such as printers and file servers).

You have two options when you enable remote clients to dial in and access network resources:

• Have them access the EXEC facility and then access to network resources via the EXEC session

• Have them connect directly to the network and bypass the EXEC facility

In general, you should give system administrators access to the EXEC facility, but give dial-in clients access only to the network. The next section "Permitting Users to Connect Directly to the Network" describes how to enable users to log in to the network without ever seeing the access server.

Permitting Users to Connect Directly to the Network

When a user dials in to the access server, the Cisco IOS software running on the access server can detect the incoming protocol automatically if you configure it to autoselect the protocol. You autoselect a protocol by issuing the autoselect ppp or autoselect arap line configuration commands. If the Cisco IOS software detects that the remote device is using one of these protocols, it can launch Point-to-Point Protocol (PPP) or AppleTalk Remote Access (ARA) sessions automatically.

Figure 1-3 shows the authentication process when autoselect is used.

Time Saver If you issue the autoselect ppp line configuration command, you must first issue the async mode interactive asynchronous interface configuration command. The async mode interactive command enables the interface to select a protocol type dynamically. If you do not enter the async mode interactive command before you issue the autoselect ppp command, the following warning message appears: "%Autoselect w/o the interface command 'Async mode interactive' is useless." Refer to the chapter "Enabling Remote Clients to Dial In to IP, IPX, and AppleTalk Networks" chapter for more information.

Figure 1-4 and Figure 1-5 show examples of what clients (dial in PC or Macintosh users) see on their monitors when they connect to the network using PPP and ARA.

After users connect to the network via ARA, they have access to all AppleTalk network resources, including AppleShare servers, the public folders of colleagues, and printers. They can also use ARA as the transport protocol to run IP applications. For more information, refer to the chapter "Enabling Remote Clients to Dial In to IP, IPX, and AppleTalk Networks."

Connecting to the EXEC Facility

If you permit users to dial in to the EXEC facility, they can use terminal services (such as Telnet), run an asynchronous protocol over the line, or use one of many other access services. For example, you can enter the ppp command to initiate a PPP session to a device on the network.

To enable users to log in to the EXEC facility, you issue the autoselect during-login line configuration command. When the Cisco IOS software detects a carriage return, the user is connected to the EXEC facility. You also access the EXEC facility any time you log in to the access server through the access server to configure it.

There are two primary levels to the EXEC facility:

• User level EXEC mode, which is what you see when you first log in to the access server, whether from a remote client, or through of a console-port connection:

Router>

• Privileged level EXEC mode, which provides access to configuration mode. To enter privileged level EXEC mode, you issue the enable command, enter the enable password, and press Return, as shown in the following example:

Router> enable 
Password:
Router# 

As the network administrator for an access server, you protect privileged level EXEC mode with a password that only network administrators know. You give dialin users access only to user-level EXEC mode so that they can issue commands to connect with other network devices (such as the ppp command).

For an overview of configuration mode, refer to the next section, "Accessing Different Command Modes." For information about configuring security, refer to the "Security Configuration" chapter in this guide.

Accessing Different Command Modes

In addition to the EXEC facility, you can access several different command modes on the access server. Each different command mode permits you to configure different components on the access server. Table 1-1 lists the most common components and configuration modes. You configure global parameters in global configuration mode, interface parameters in interface configuration mode, and line parameters in line configuration mode. For information about what you typically configure in line mode versus interface mode, refer to the section "Configuring Asynchronous Ports."

Getting Context Sensitive Help

You can get help in any of the command modes listed in Table 1-1. The help available in the Cisco IOS software describes the syntax for each command or displays the complete name of the command.

To get context sensitive help, type ? (a question mark) at the prompt. There are two types of help available: full help and partial help.

• Full help--Type a ? at the configuration prompt or after entering part of a command followed by a space. The configuration parser displays options available with the command. For example, if you were in global configuration mode, typed the command arap, and wanted to see all the keywords and arguments for that command, you would type arap ?. The following example shows the resulting output:

Router(config)# arap ?
  callback  Enable callback of ARAP connections
  logging   Turn on logging of ARAP connections
  network   Internal Appletalk Network For Arap Clients
Router(config)# arap 

• Partial help--Type part of the name of a command, then a ?, without an intervening space. The configuration parser identifies the rest of the command being entered. For example, if you were in global configuration mode and wanted to see the complete spelling of the command, you could type ar?. The following example shows the resulting output:

Router(config)# ar?
arap   arp
Router(config)#

You can also type ? at the command prompt and the Cisco IOS software displays all available commands for that command mode. The following example shows sample output for the commands available in privileged EXEC mode:

Router# ? 
Exec commands:
  access-enable    Create a temporary Access-List entry
  access-template  Create a temporary Access-List entry
  bfe              For manual emergency modes setting
  clear            Reset functions
...
  write            Write running configuration to memory, network, or terminal
  x3               Set X.3 parameters on PAD
  xremote          Enter XRemote mode

Refer to the chapter "Configuring the User Interface" in the Configuration Fundamentals Configuration Guide for more information about any aspect of working with the user interface in the Cisco IOS software. The Configuration Fundamentals Configuration Guide is part of the Cisco IOS documentation in Cisco IOS Releases 11.1 and later.

Configuring Asynchronous Ports

On the back of your access server are asynchronous ports to which you connect modems. Remote clients dial in to the network through these asynchronous ports.

To enable clients to dial in, you configure two components of each asynchronous port: lines and interfaces. Asynchronous interfaces correspond to physical terminal (TTY) lines. For example, asynchronous interface 1 corresponds to TTY line 1.

Generally, commands entered in asynchronous interface mode enable you to configure protocol-specific parameters for asynchronous interfaces, whereas commands entered in line configuration mode permit you to configure the physical aspects for the same port. In Figure 1-6, which shows the show line output on a Cisco 2511, TTY line 1 corresponds with asynchronous interface 1, TTY line 16 corresponds with asynchronous interface 16, and so on.

Asynchronous Lines

Asynchronous line configuration commands configure ports for the following options:

• Physical layer options (such as modem configuration)

• Security for EXEC mode

• ARA protocol configuration (PPP is configured in interface configuration mode)

• Autoselect to detect incoming protocols (ARA and PPP)

To enter line configuration mode, first connect to the console port of the access server and enter privileged EXEC mode. Then enter global configuration mode and finally enter line configuration mode for the asynchronous lines that you want to configure. The following example shows the process of entering line configuration mode for lines 1 through 16:

2511> enable
2511# configure terminal 
2511(config)# line 1 16
2511(config-line)#

Asynchronous Interfaces

Generally, interfaces enable the Cisco IOS software to use routing functions. Specifically, you configure asynchronous interfaces to support PPP connections. You configure interfaces on an access server for the following functions:

• Network protocol support (such as IP, IPX, or AppleTalk)

• Encapsulation support (such as PPP)

• IP client addressing options (default and/or dynamic)

• IPX network addressing options

• PPP authentication

• ISDN BRI and PRI configuration

Line-Specific Issues on the Cisco AS5200 Access Server

On the Cisco AS5200 access server, each TTY line maps directly to an integrated AS5200 modem as shown in Table 1-2. The TTY lines 1 through 24 directly connect to modems 1/0 through 1/23, which are installed in the first chassis slot. The TTY lines 25 through 48 directly connect to modems 2/0 through 2/23, which are installed in the second chassis slot. For more information, refer to the Cisco AS5200 Universal Access Server Software Configuration Guide.

Configuring Group Asynchronous Interfaces

To configure multiple asynchronous interfaces at the same time (with the same parameters), you can assign each asynchronous interface to a group and then configure the group. Configurations throughout this guide configure group asynchronous interfaces, rather than configuring each interface separately.

To configure a group asynchronous interfaces, specify the group async number (an arbitrary number) and the group range (beginning and ending asynchronous interface number). The following example shows the process of creating a group asynchronous interface for asynchronous interfaces 1 through 16 on a Cisco 2511 access server:

2511(config)# interface group-async 1
2511(config-if)# group-range 1 16 
Building configuration...
2511(config-if)#

At this point, you have configured asynchronous interfaces 1 through 16 as part of the same group and you are in interface configuration mode for the group asynchronous interface.

First-Time Router Configuration Procedures

If you have never configured a Cisco router (or have, but want more information about configuring one), perform the tasks in this section. This section will familiarize you with the Cisco IOS software while you configure some fundamental parameters to enable PC and Macintosh clients to dial into your network to access resources, such as file servers and printers.

This section assumes you have referred to the user guide or installation and configuration guide that accompanied your router and that you have access to user level EXEC mode (Router>).

Each step in the subsequent sections show information that appears on the screen before and after you type each command. On-screen text and system responses appear in screen font. Commands that you are instructed to type appear in examples as boldface screen font.

What You Will Learn

The five lessons, and their content, are shown in the following list:

• Lesson 1, Configuration Basics

  • Understanding Cisco's command line interface

  • Moving between different configuration modes

  • What to do if the EXEC facility times out while you are configuring the system

  • How to get help in the Cisco IOS software

  • How to view your configuration (running and startup)

  • How to copy a running configuration to a startup configuration

• Lesson 2, Modem Configuration

• Lesson 3, PPP and ARA Configuration

• Lesson 4, IP and AppleTalk Protocol Support

• Lesson 5, Basic System Security

After you complete the tasks in all five lessons, you will have enabled remote PC and Macintosh users to dial in and access IP or AppleTalk resources on your network.

Total time to complete all five lessons can range from 30 minutes to more than an hour. Each lesson takes approximately 10 minutes.

Prerequisites

Before you begin, make sure you perform the following tasks:

• Write down the IP address of your Ethernet (LAN) interface.

• Write down the set of available IP addresses to be assigned to dialin IP clients. If you do not have this information, you can use the sample addresses provided in the examples in these lessons.

• Your modem has already been connected to the access server. Refer to the hardware installation guide, user guide, or installation and configuration guide that accompanied your access server for more information about connecting modems and cables.

• Write down the maximum supported transmission rate of your modems or have your modem manual available.

• If you are configuring access to an AppleTalk network by Macintosh clients, write down your AppleTalk zone, cable range, and your ARA network number and name.

Lesson 1, Configuration Basics

In this lesson, you will configure some basic parameters and learn how to work with the command line interface of the Cisco IOS software. This section requires 10 to 15 minutes to complete.

Time Saver Always make sure you are in the correct command mode before you enter a command. If you are not in the correct command mode when you enter a command, one of two problems occurs: either the command has no effect, or it has an unexpected (and possibly detrimental) effect.

Enter the commands in Table 1-3 through Table 1-5 to practice configuring basic parameters.

2511# show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-J-L), Version 11.3(1.0) RELEASED SOFTWARE
Copyright (c) 1986-1997 by cisco Systems, Inc.
Compiled Mon 13-Oct-97 15:26 
Image text-base: 0x0000144C, data-base: 0x007E8DDC
ROM: System Bootstrap, Version (3.3), SOFTWARE
enkidu uptime is 5 hours, 19 minutes
System restarted by reload
System image file is "eschaffe/c2500-j-l.113", booted via tftp from 161.69.1.129
cisco 2511 (68030) processor (revision A) with 16384K/2048K bytes of memory.
Processor board ID 01244583, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Ethernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
16 terminal line(s)
32K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read/Write)

2511(config)# ?
Configure commands:
  aaa                         Authentication, Authorization and Accounting.
  access-list                 Add an access list entry
  alias                       Create command alias
  appletalk                   Appletalk global configuration commands
  arap                        Appletalk Remote Access Protocol
... (some output deleted for brevity)
  username                    Establish User Name Authentication
  vines                       VINES global configuration commands
  vpdn                        Virtual Private Dialup Network
  vty-async                   Enable virtual async line configuration
  x25                         X.25 Level 3
  x29                         X29 commands
  xremote                     Configure XRemote
2511(config)#

2511# show startup-config
Using 419 out of 32762 bytes
!
version 11.3
service udp-small-servers
service tcp-small-servers
!
hostname 2511
!
enable secret 5 $1$oiqW$zIoVcK4tkGdpoBarDXcFz0
username jim password 7 04091E020A
!
interface Ethernet0
 no ip address
 shutdown
!
interface Serial0
 no ip address
 shutdown
 no fair-queue
!
no ip classless
!
!
line con 0
line 1 8
line aux 0
line vty 0 4
 login
!
end

Lesson 2, Modem Configuration

In this lesson, you will configure some line parameters to enable the access server to work with a modem. This section requires 5 to 7 minutes to complete. For more information about any of the parameters in this lesson, refer to the "Configuring Modems" chapter later in this guide.

At the end of Lesson 1, the 2511# prompt appeared, and this is where you start Lesson 2. Enter the commands in Table 1-6 to configure the line and modems.

Lesson 3, PPP and ARA Configuration

In this lesson, you will configure basic PPP and ARA dialin parameters. This section requires 10 to 15 minutes to complete. For more information about any of the parameters in this lesson, refer to the "Enabling Remote Clients to Dial In to IP, IPX, and AppleTalk Networks" chapter later in this guide.

At the end of Lesson 2, the 2511(config-line)# prompt appeared, and this is where you start Lesson 3. Enter the commands in Table 1-7 to enable clients to dial in using PPP or ARA.

Lesson 4, IP and AppleTalk Protocol Support

In this lesson, you will configure IP and AppleTalk protocol support, which will allow users to dial in to your network. This section requires 10 to 15 minutes to complete.

For more information about any of the parameters in this lesson, refer to the "Enabling Remote Clients to Dial In to IP, IPX, and AppleTalk Networks" chapter in this guide.

At the end of Lesson 3, the 2511(config-line)# prompt appeared, and this is where you start Lesson 4. Enter the commands in Table 1-8 to configure IP and AppleTalk support.

Lesson 5, Basic System Security

This lesson uses the authentication, authorization, and accounting (AAA) facility to configure basic local authentication. Local authentication means that an internal username database authenticates users, rather than a remote user authentication (security) server. This section requires 10 to 15 minutes to complete.

For more information about any of the parameters in this lesson, refer to the "Security Configuration" chapter in this guide.

At the end of Lesson 4, the 2511(config-if)# prompt appeared, and this is where you start Lesson 5. Enter the commands in Table 1-9 to configure basic system security.

You have configured PPP dialin to an IP network, ARA dialin to an AppleTalk network, and security. Each task in these lessons is described in much greater detail in the subsequent chapters in this guide.

Refer to the next section "Sample Access Server Configuration" to view the configuration resulting from the 5 lessons.

Sample Access Server Configuration

The following Cisco 2511 configuration shows the results of Lessons 1 through 5. This configuration is typically sufficient to enable remote users to dial in as a node on a local IP or AppleTalk network. For additional information, refer to the subsequent chapters in this guide.

2511# show running-config 
Building configuration...
Current configuration:
!
version 11.3
service udp-small-servers
service tcp-small-servers
!
hostname 2511
!
aaa new-model
aaa authentication login default local
aaa authentication arap default local
aaa authentication ppp default local
enable secret 5 $1$ltBE$Slq0BUs/5mwqw6B4DOapg/
!
username jim password 7 02150C5A110702
!
appletalk routing
arap network 2500 Mac-dialup
!
ip address-pool local
!
interface Ethernet0
 ip address 172.16.42.24 255.255.255.0
 appletalk cable-range 1-2
 appletalk zone Corporate
 no mop enabled
!
interface Serial0
 no ip address
 shutdown
!
interface group-async1
 ip unnumbered Ethernet0
 encapsulation ppp
 async mode interactive
 ip tcp header-compression passive
 peer default ip-address pool default
 no cdp enable
 ppp authentication chap
 group-range 1 16
!
router rip
 network 172.16.42.0
!
ip local pool default 172.16.42.1 172.16.42.16
no ip classless
!
line con 0
 login
 transport input all
 login authentication default
!
line 1 16
 arap enable
 login
 modem InOut
 modem autoconfigure discovery 
 autoselect arap
 autoselect ppp
 transport input all
 speed 115200
 flowcontrol hardware
 arap authentication default 
 login authentication default
line aux 0
line vty 0 4
 login authentication default
!
ip domain-name eapp.com
ip name-server 172.16.42.128
!
end