Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was configuring/testing a Cisco router (sorry, I don't know the model since I was using NETLAB), and I had RIPv2 updates propagating/updating correctly. I then used the auto secure command to harden it, but it doesn't seem like they're being sent any more.

Below is the config for one of the problem routers. It contains some of my own commands as well as those put there by auto secure.

version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname R2
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
logging buffered 4096 debugging
logging console critical
enable secret 5 $1$uXB4$cDJCPm41SKo3DgjSMrfxx/
enable password 7 01160805590703
!
aaa new-model
!
!
aaa authentication login local_auth local
!
aaa session-id common
no ip source-route
no ip gratuitous-arps
!
!
ip cef
!
!
no ip bootp server
ip domain name sit377
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
login block-for 120 attempts 5 within 120
!
frame-relay switching
!
voice-card 0
 no dspfarm
!
!
key chain RIP_KEY
 key 1
   key-string 7 05080F1C2243
!
!
!
!
!
!
!
!
!
!
!
!
!
username R1 password 7 121A0C041104
username R2 password 7 01100F175804
archive
 log config
  logging enable
!
!
ip tcp intercept list autosec_tcp_intercept_list
ip tcp intercept connection-timeout 3600
ip tcp intercept watch-timeout 15
ip tcp intercept max-incomplete low 450
ip tcp intercept max-incomplete high 550
ip tcp intercept drop-mode random
ip ssh time-out 60
ip ssh authentication-retries 2
! 
!
!
!
!
interface FastEthernet0/0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 shutdown
 duplex auto
 speed auto
 no mop enabled
!
interface FastEthernet0/1
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 shutdown
 duplex auto
 speed auto
 no mop enabled
!
interface Serial0/0/0
 ip address 10.1.1.2 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip rip authentication mode md5
 ip rip authentication key-chain RIP_KEY
 encapsulation ppp
 ppp authentication chap
 no shutdown
!
interface Serial0/0/1
 ip address 10.2.2.1 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip rip authentication mode md5
 ip rip authentication key-chain RIP_KEY
 encapsulation frame-relay
 clock rate 64000
 frame-relay map ip 10.2.2.1 203
 frame-relay map ip 10.2.2.2 302 broadcast
 frame-relay intf-type dce
 no shutdown
!
router rip
 version 2
 passive-interface default
 no passive-interface Serial0/0/0
 no passive-interface Serial0/0/1
 network 10.0.0.0
 no auto-summary
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
logging trap debugging
logging facility local2
access-list 100 permit udp any any eq bootpc
no cdp run
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
banner motd ^CBanner message^C
!
line con 0
 exec-timeout 5 0
 password 7 060506324F41
 logging synchronous
 login authentication local_auth
 transport output telnet
line aux 0
 exec-timeout 15 0
 login authentication local_auth
 transport output telnet
line vty 0 4
 password 7 110A1016141D
 logging synchronous
 login authentication local_auth
 transport input telnet ssh
line vty 5 15
 password 7 01100F175804
 logging synchronous
 login authentication local_auth
 transport input telnet ssh
!
scheduler allocate 20000 1000
!
end
share|improve this question

1 Answer 1

up vote 0 down vote accepted

Turns out it was NETLAB itself screwing things up.

As it was loading the router config, it would get into the key chain commands, but not exit from there. So when it got down to setting up the users for CHAP on one of the links, it failed since it wasn't in global config mode.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.