One of my readers has asked an interesting question: can you reload a router when pinging a specific IP address from it fails? While there are other ways of dealing with stuck interfaces or routing processes, sometimes such a drastic measure is the only workaround, so here's how you do it:

By default, IOS routers use enable passwords to authenticate incoming HTTP (web) requests. You could also use local usernames as the authentication mechanism, or you could deploy full-blown AAA-based solution.

The Tcl procedures used to execute IOS commands in Embedded Event Manager (cli_open, cli_write …) don’t work when you start Tcl shell from command line interface. To execute IOS commands in this context, use:

• exec command to execute an exec-level command, for example exec “show ip route”
• ios_config mode command to configure the router

If the first parameter of the ios_config command is a global configuration command, you shall omit the second parameter (for example, ios_config “hostname router”). To configure a parameter in one of the sub-configuration modes (for example, interface state), use the first parameter to specify the configuration mode and the second parameter as the actual configuration command (for example, ios_config “interface loop 0” “no shutdown”).

TL&DR: Don’t.

EIGRP computes its composite metric from five parameters, one of them being interface load, therefore raising the theoretical possibility of having route metrics that include interface load. However, tweaking EIGRP K-values with the metric weights command to include interface load in metric calculations is highly discouraged – every change in interface load could lead to network instability.

The more command display the specified file as a hex dump if the contents don't look like a text file. In my example, it didn't like the CR/LF pairs in the Autorun.inf file written on an USB token by a Windows PC, but you could also dump an IOS image or a tar archive used by SDM (or other web-based applications). To force the display format, use the /ascii, /binary or /ebcdic (for IBM/SNA gurus) parameters. Cool feature ... IOS is obviously full of hidden gems :)

router#more usbflash1:Autorun.inf
00000000:  5B617574 6F72756E 5D0D0A6F 70656E3D    [aut orun ]..o pen=
00000010:  496E7374 616C6C65 722E6578 650D0A69    Inst alle r.ex e..i
00000020:  636F6E3D 496E7374 616C6C65 722E6578    con= Inst alle r.ex
00000030:  650D0A41 6374696F 6E3D4C61 756E6368    e..A ctio n=La unch
00000040:  20496E73 74616C6C 65722066 6F722047     Ins tall er f or G
00000050:  6F6F676C 65204170 706C6963 6174696F    oogl e Ap plic atio
00000060:  6E73200D 0AXXXXXX XXXXXXXX XXXXXXXX    ns . .XXX XXXX XXXX

I've always wanted to be able to execute a show command while configuring a router (I'm never good at remembering subinterface numbers). A while ago Cisco introduced the do configuration command that allows you to execute any exec-level command (including telnetting to another device) without leaving the current configuration mode.

Cisco routers preconfigured for SDM have default username/password cisco/cisco. As many users forget to disable or change the default username after configuring their router with SDM, they could end up with an exposed router.

Cisco has patched this vulnerability in IOS release 12.4(11)T that includes the one-time password/secret option of the username command, allowing you to define a username/password combination that can be used only once.

You might have wondered what happens with output produced by Tcl procedures (for example, with the puts command) when you use Tcl in Embedded Event Manager (EEM) or Embedded Syslog Manager (ESM). If the Tcl procedure executes in context of a line (console or virtual terminal), the output is sent straight to the attached line, otherwise it's processed by the logging manager (resulting in a syslog message).

There are two scenarios where Tcl would execute in context of a line: if you start a Tcl procedure with the tclsh command or if it's an EEM policy registered with the event_register_cli with sync parameter set to yes.

This should be a no-brainer for anyone preparing for the CCIE lab exam (I'll not elaborate why, but you could guess), but here it is for the benefits of everyone else: if you want to enable AAA on Cisco IOS but still retain local usernames (at least for the console access), this is how you do it:

• Define local usernames with username xxx password yyy command (I would prefer the secret option if your IOS supports it).
• Configure aaa new-model.
• Configure a named AAA authentication list with the aaa authentication login MyList local.
• Attach the named AAA authentication list to the console line with the login authentication MyList command.

If you want to use the local usernames only as a fallback mechanism in case the AAA servers fail or become unreachable, you could use the aaa authentication login MyList group [radius|tacacs+|name] local command.

Note: this article is part of You've asked for it series.

There are two ways you can configure local usernames without a password:

• By using the username user command without the password option, you create a username that has a blank password (the operator has to press ENTER at the Password: prompt)
• With the username user nopassword command, you create a user where the operator will not be prompted for the password at all.

Hopefully, you would use such usernames only with the autocommand option to give guest users a short overview of the router's operation (for example, display the interface status).

Note: this article is part of You've asked for it series.