Install Cisco IOS on Switches Using XModem

-

There comes a point in every engineers life where you find yourself having to load software onto a Cisco switch. More often than not we find ourselves doing this in 2019 to Cisco switches that are now used for labbing or even on Cisco switches that are still used in a production environment.


The problem I’ve seen is that, we (as engineers) have some much to remember, we often forget the little things or better yet, we lose the skills we don’t use but fear not, this article hopes to bring back at least one of those skills!
Whether a switch is corrupted with the wrong image or you’ve simply purchased a switch that doesn’t have a software image loaded, there isn’t a way to provide IP connectivity in order to load a new image so we have to do things a slightly different way…and that way is XMODEM.

Now I’m not going to jump into the details of this ancient protocol because no doubt if you’re an engineer you’ll know all about it right 😉 but I will provide a link to more details on xmodem for those avid readers Read More Here.
Now let’s take a look at how we can transfer a Cisco IOS image to a switch using xmodem. The following demonstration was performed on a Cisco 3560 switch.

What you need to get started

  1. Console Cable
  2. Direct Access to the switch
  3. Tera Term
  4. Windows machine to run the Tera Term application
  5. Compatible Cisco IOS image for your device
  6. Time

Next…

  1. Connect your console cable to the Windows machine and console port of the Cisco switch. This needs to be direct and not via any terminal servers, I tried this and it didn’t work when changing the baud.
  2. Open Tera Term and connect to the serial port of the switch. With the switch powered-on you should be presented with the following syntax:
Switch:
  1. Initalize your switches flash by entering the following command. Some switches will already have this enabled and you will be notified of the result once you’ve pressed enter.
flash_init
  1. Check that you don’t have any image already installed in your flash and verify your storage.

dir flash:

  1. On the switch, set the baud rate (speed). Follow the steps to the end because you will be required to change this back when the image has been successfully transferred.

set BAUD 115200

  1. Now change the baud rate on Tera Term to match that of the switch. Setup > Serial Port > 115200 It might seem as though your terminal session has frozen but this isn’t the case, press enter a few times and it should come back.
  2. Enter the following command to start the image transfer.

copy xmodem: flash:<image name file>.bin

  1. Staying on Tera Term, select the file to transfer navigate to File > Transfer > XMODEM > Send and select the image file. The file should begin transferring to the switch. The waiting game begins! It can take a minimum 30 minutes depending on the size of the image file.
  2. Once the image has been transferred, change the BAUD rate back on the switch and then Tera Term using the same method already mentioned above.
  3. Boot into your new image.
boot flash:<image name file>.bin

And that’s all there is to it!
Thank you for reading and I hope that you’ve found this article useful.
 
#Cisco #LabEverday #ciscoxmodem #Ciscoswitchxmodem #CIscoSwitches #CiscoIOSinstallTeraTerm #CiscoTeraTerm #LabEveryday #InstallCiscoIOSxmodem #TeraTermCisco
Kelvin Charles - Network and Cyber Security Professional.

Popular Posts

Capturing EAPOL and RADIUS Using Wireshark

-
Image
In this article we are going to take a look at how to capture Extensible Authentication Protocol Over LAN (EAPOL) and Remote Authentication Dial-In User Service (RADIUS) packets using Wireshark. This article can be useful for troubleshooting 802.1x within your environment and can also be used for learning purposes. The following topology has been used to gather the required output for this article. Note: This article will only cover the switch configurations that are required to gather EAPOL and RADIUS configuration. Overview of the Topology The supplicant is configured to perform 802.1x using EAP-TLS as the authentication method The user certificate on the supplicant will be used for authentication The supplicant has Wireshark installed Cisco ISE is used for authentication and authorisation The supplicant is assigned to VLAN 10 upon authentication and all other endpoint ports are assigned to VLAN 99 Sniffer device is running Wireshark in order to capture RADIUS flows via SPAN 802.1x
Read more

Configuring Cisco Smart License Software

-
In this article, I would like to demonstrate how to configure Cisco Smart Licensing on the virtual Cisco Adaptive Security Appliance (ASAv). This post assumes that readers already have access to there own Smart Account and would like to know the process of applying licenses. Step 1: Generate ID Token Sign into your Cisco Software Portal: software.cisco.com and navigate to “Smart Software Licensing” You will now need to create an ID token for your device, this is required for communication between the device and the licensing authority. Follow the steps below to create a new token. Click Inventory >>> General >>> New Token and select your preferred options and enter a description for your token. Once you are happy with your token settings click Create Token . You should now have a token created which can be copied over to the device you wish to license. All commands and output from this point will be related to the ASA so please seek out further advice if you wish
Read more

Cisco :: FXOS Authentication Using TACACS

-
In this article, I will describe how to enable authentication and authorization for Firepower eXtensible Operating System (FXOS) devices. The use case presented in this document illustrates how Cisco Identity Services Engine (ISE) can be utilised with attribute-value pairs (AV-Pairs) to authenticate and authorize users accessing the Firepower Chassis Manager (FCM) or FXOS platforms via TACACS+. At the time of writing this post, I found that limited documentation existed and of that documentation that did exist, the examples given weren’t as straightforward. In an effort to make this process easier for my colleagues and customers to understand I have put together the following instructions based on a previous use case given to me. Extracts of this document have been taken from a wider document I am currently creating. I will update this article with the complete document when it has been finalized. Requirements A ‘Device Administration’ license is required in order to use TACACS+ with
Read more

Configuring Remote Access VPN on Firepower

-
Image
In this article we are going to take a look at how to configure remote access VPN's on Firepower devices. This demonstration is based on the following lab environment: Cisco Virtual Firepower Management Center Cisco Virtual Firepower Threat Defense Cisco ISE 2.6 Windows host with AnyConnect VPN Windows Server 2019 (CA Server) All Firepower devices are running version 6.5 Note: ISE is used for authentication and authorization in the following lab however the configuration elements of ISE are out of scope for this demonstration. Generate a CSR for Remote Access VPN's Those accessing your network remotely need to trust the service you're running. Without the correct trust users could face issues connecting via VPN. With access to the FMC navigate to Objects > Object Management > PKI > Cert Enrollment Assuming you are opting for manual enrollment, select 'Manual' in Enrollment Type and copy the CA Certificate BASE-64 into the field. Now select the 'Certifi
Read more

Kali Linux :: CAM Table Overflow Attack Demonstration

-
Image
As part of my on-going studying for the CCNA Security 210 – 260 certification I have been exploring different types of network attacks, one of which is CAM table overflow attacks. In this article I would like to share what I have learnt and provide a demonstration of the attack carried out in a lab environment. To understand my demonstration, you first need to understand how a CAM table overflow attack works and what happens as a result of the attack.   Switches build Content Addressable Memory (CAM) tables based on mac-addresses and port numbers. When a switch receives a frame it checks the table to see if the source mac-address is already known, if the source mac-address is unknown the switch will add the mac-address to the table along with the port number. The switch then checks the destination layer two frame and if no entry exists the switch broadcasts the frame out of all ports except the port in which the frame was received. Presuming the destination mac-address wants to respond
Read more