博客

目前的是2道，一道關於switch的，一個配置OSPF的：

首先說switch的，總結有以下幾種問題

1：給你一個mac地址，問你連接到哪個端口。
解答：用show mac查找對應mac地址的端口回答即可

2：說有一個原來存在的switch被拿走，修改了配置然後又拿回來，和Sw-AC3相連，給出了show vtp stat和show vlan的顯示，問你會發生什麼情況
解答：使用show vtp stat查看Sw-AC3的，如果configuration revision比拿回來的那個小，那麼Sw-AC3的配置會被移除，如果比拿回來的大，則SwX的會被替換成Sw-AC3的

3：問你vlan 1的root bridge
解答：用show span，則能夠看到每個vlan的詳細信息，如果本switch為root bridge，則會有英文告訴你本switch就是root，如果不是的話，在這個vlan信息下面能顯示出rootid連接的端口，然後使用show cdp neighbor就能找到對應的root bridge

4：問你從哪接受vlan更新信息
解答：使用show vtp stat，可以看到本機就是vtp server狀態，則選擇local即可。本機不是server，目前還沒想到怎麼做，不過試驗似乎沒出現過這樣的。

5：給你一個source MAC address和destination MAC address，問你switch如何處理
解答：使用show mac，如果destination MAC address在顯示中，那麼就選擇發送到相對應的端口，如果不在，則看source MAC address所對應的那項，最前面會顯示vlan的號碼，選擇同樣號碼對應的端口即可。這裡我今天遇到了，用show mac和show vlan所顯示的vlan端口分配不一致，這裡使用show mac的比較保險。

6：問你哪個port跟router相連
解答：使用show cdp nei

7：問哪些port是trunk端口
解答：show int trunk或者用show vlan看哪些port沒有在列表中

8：給你一個port，問連接的default-gateway是什麼
解答：show vlan，看給你的port屬於哪個vlan，然後根據圖中所顯示的路由器子接口IP信息即可回答。

9：問switch接收到一個IP packet如果目標地址不在本地，從哪個port出去
解答：經過與router相連的port出去，使用show cdp nei吧

10：switch接收到一個IP packet含有目標IP地址為192.0.2.24的MAC address是多少
解答：目標不在任何一個vlan中，則肯定目標MAC地址是路由器的MAC地址，使用show arp

目前似乎只有這10種不同的問題，我的解答不知道正確不正確，我今天考得是前5個，肯定是正確的。後面的應該也沒什麼問題，有錯誤了請大家指出來。

關於OSPF配置

首先，考試已經替你配好了一切的IP地址還有OSPF協議，但是有一些router的協議是不正確的，你要找出來，清除掉重新配即可。清除的命令是XXX(config)#no router ospf 2，錯誤可能是ospf 1配成了ospf 2，或者wild card錯誤，或者area錯誤。最後配置好了別忘了copy run start！

ITCERT提供的廣告：

When you started studying for your CCNA certification exam, one of the very first things you learned was the major difference between the enable password and the enable secret – the enable secret is encrypted by default, where the enable password is just sitting there in clear text, waiting to be read!

When you look at the enable secret in a Cisco router configuration, it looks like it would be impossible to guess. 640-802:Cisco Certified Network Associate(CCNA) After setting the enable secret on this router to the word security, here’s how it appears in the configuration:enable secret 5 $1$24me$gVFxUOI4gYp0IQbhtH8Rz0

That password has been encrypted by MD5, the Message Digest 5 algorithm. The result of the MD5 algorithm being applied to the password is a 32-character hexadecimal value.

That password is hard to guess, but not terribly hard to crack. Anyone looking over your shoulder would not be able to come up with that password, but there are readily-available password cracking software devices that can crack that encryption in a matter of minutes. That’s true of any MD5-encrypted password, not just those on Cisco routers.So what can we do about this? We can add SALT to our MD5.

The salt itself is simply a string of random characters that are added to the encryption process. Salting makes it much more difficult for a hacker to come up with the password; each bit added by the salt process literally makes it twice as difficult for the password to be compromised. A recent Wikipedia entry states that if a password was one of 200,000 words, a 32-bit salt would require 800 trillion hashes for a full-blown brute force attack.

The actual creation and application of a salt is beyond the scope of the CCNA Security exam, but once you’ve earned that valuable certification – or maybe while you’re preparing for it – do a Google search on “salt md5” and read up on this powerful security tool. In the meantime, look for more CCNA Security tutorials on the site you’re on now as well as my website!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of over 100 free certification exam tutorials, including Cisco CCNA certification test prep articles. His exclusive Cisco CCNA study guide and Cisco CCNA training is also available! Visit his blog and sign up for Cisco Certification Central, a daily newsletter packed with CCNA, Network+, Security+, A+, and CCNP certification exam practice questions! A free 7-part course, “How To Pass The CCNA”, is also available, and you can attend an in-person or online CCNA boot camp with The Bryant Advantage!