This chapter provides information and commands concerning the following topics:
• Security Device Manager: Connecting with CLI
• Security Device Manager: Connecting with GUI
• SDM Express Wizard with no CLI preconfiguration
• Resetting the router to factory defaults using SDM
• SDM user interfaces
— Configuring interfaces using SDM
— Configuring routing using SDM
• SDM monitor mode
• Using SDM to configure a router to act as a DHCP server
• Using SDM to configure an interface as a DHCP client
• Using SDM to configure NAT/PAT
• What to do if you lose SDM connectivity because of an erase startup-config command
NOTE: Cisco recommends that you use the Cisco Router and Security Device Manager (SDM) to configure your router. However, Cisco also realizes that most implementations of a router with SDM will be to use the command- line interface (CLI) for initial configuration; then, after the routers have been added to the network, all future configuration will take place using SDM.
If you have a router that has the SDM files already installed on it, console into the router and power the router on. If there is no configuration on the router, the Startup Wizard will appear.
Cisco Router and Security Device Manager (SDM) is installed on this device. This feature requires the one-time use of the username “cisco” With the password “cisco”. The default username and password have a privilege level of 15
Please change the publicly known initial credentials using SDM or the CLI.
Here are the cisco IOS commands
Username
privilege 15
secret 0
No username cisco
Replace and with the username and password you want to use.
For more information about SDM please follow the instructions in the QUICK START GUIDE for
your router or go to http://www.cisco.com/go/sdm
User Access Verification
Username:cisco
(Enter username cisco)
Password:xxxxx
(Enter password cisco)
yourname#
(Now at CLI prompt)
yourname#configure terminal
(Moves to global configuration mode.)
yourname(config)#username scott
privilege 15 secret 0 tower
Sets the local username and password for working with SDM. This takes effect after you save the configuration to NVRAM and reload the router.
yourname(config)#no username cisco
Removes the default username of cisco from the configuration.
yourname(config)#hostname 2821
Sets the host name of the router
2821(config)#no ip http access-class 23
Removes ACL 23 from the configuration
NOTE: Access list 23 is an access control list (ACL) that permits only addresses from the 10.10.10.0/29 subnet to access the router through the GUI. This ACL was part of the default configuration of the router when it was shipped from Cisco. If you are going to change the IP address of the LAN interface and then use the GUI to configure the rest of the router, you need to remove this ACL so that using the GUI will work.
2821(config)#interface gigabitethernet 0/0
Moves to interface configuration mode
2821(config-if)#ip address 192.168.100.1 255.255.255.0
Sets the IP address and netmask
2821(config-if)#no shutdown
Enables the interface
2821(config-if)#exit
Returns to global configuration mode
2821(config)#exit
Returns to privileged mode
2821#copy running-config startup-config
Saves the configuration to NVRAM
From here, you can either continue configuring the router with the CLI or you can connect to the router using the GUI and continue the configuration using SDM, which is explained in the next section.
Security Device Manager: Connecting with GUISDM has, by default, a one-time username and password set on a router. This one-time username/password combination is cisco/cisco. Plug your router’s first Fast Ethernet (or Gigabit Ethernet) port into a switch. Plug your PC into the same switch. Configure your PC’s IP address to be 10.10.10.2/29 (10.10.10.2 with a subnet mask of 255.255.255.248). Open your PC’s Internet browser and enter the following command in the browser’s address bar:
http://10.10.10.1/You will see a screen similar to the one shown in Figure 29-1. This is where you will use the username/password combination of cisco/cisco.
NOTE: If you have begun your configuration through the CLI, as shown in the previous section, you need to set your PC’s address to 192.168.100.2/24 or something else in the 192.168.100.0/24 network. You cannot use 192.168.100.1/24 because that was the address you set on your router’s Fast Ethernet or Gigabit Ethernet interface. You also use the username and password credentials that you have previously configured from the CLI, and not the default credentials
Figure 29-1 Connect to Router Challenge Window
From here, you will see a pop-up asking you whether you want to use HTTP or HTTPS, as shown in Figure 29-2. Click OK to use HTTPS, or click Cancel to use HTTP. This example uses HTTPS.
Figure 29-2 HTTP or HTTPS
You might be asked to enter your username/password combination again or to accept a digital signature from Cisco IOS Software. If you are challenged, go ahead and enter cisco/cisco or the username/password configured in CLI. If you are asked to verify a digital signature, click OK.
NOTE: If you have already started your configuration from the CLI, you do not need to go through the next section.
SDM Express Wizard with No CLI PreconfigurationIf you are connecting to the router through the GUI and there is no configuration on the router, you are taken to the first screen of the Cisco SDM Express Wizard, shown in Figure 29-3. Click Next to continue, or click Cancel to exit the wizard.
Figure 29-3 Welcome to the Cisco SDM Express Wizard
Figure 29-4 shows the first screen of the SDM Express Wizard—the basic configuration. Here, you enter such information as your router’s name, the domain to which the router belongs, the username and password of the device, and the enable secret password.
Figure 29-4 Basic Configuration
Figure 29-5 shows the next screen—Router Provisioning. Here, you provision (set up) this router using one of two choices—SDM Express or a CNS Server. Continue using SDM Express by leaving that radio button checked and clicking Next to continue.
Figure 29-5 Router Provisioning
The screen in Figure 29-6 asks you to configure the LAN interface on the router. The router
in this example is a 2821, so you have Gigabit Ethernet LAN interfaces, along with VLAN
1 to choose from. If you are using a 2811, you have Fast Ethernet interfaces to choose from.
Change the IP address on the LAN from the default 10.10.10.1 to 192.168.100.1/24, and
then click Next.
Figure 29-6 LAN Interface Configuration
Figure 29-7 shows the DHCP Server Configuration screen, where you can configure the router to act as a DHCP server for other hosts on the LAN. For the purposes of this example, you are not going to configure the DHCP server, so click Next.
Figure 29-7 DHCP Server Configuration
The next item to set up on the router is the WAN interface. Although you have three possible
WAN interfaces, as shown in Figure 29-8, you are allowed to configure only one interface through the SDM Express Wizard. For the interface you want to configure, highlight that
interface and click Add Connection. From here, you are taken to another window asking
you to configure each interface—IP address, encapsulation type, subnet mask, and so on.
Figure 29-9 and Figure 29-10 show the screens where you enter this information. Enter all
the appropriate information in each screen, click OK, and then click Next when done.
Figure 29-8 WAN Configuration
Figure 29-9 Add Serial Connection
Figure 29-11 shows the Advanced Options for the Internet (WAN) interface, where you are
asked to set up a default route for your router. Enter the appropriate information, if needed,
or uncheck the Create Default Route box if you do not want a default route set; then
click Next.
Figure 29-10 Add Gigabit Ethernet Connection
Figure 29-11 Internet (WAN)—Advanced Options
The next screen of the SDM Express Wizard asks whether you want to enable Network
Address Translation (NAT) on this router. Figure 29-12 shows the main screen, and
Figure 29-13 shows the pop-up window that appears when you want to add an address
translation rule. When you have finished entering your NAT information, click Next.
Figure 29-12 Internet (WAN)—Private IP Addresses
Figure 29-13 Add Address Translation Rule
Figure 29-14 shows the Security Configuration Screen, where you can select different security settings for the router. If you are unsure about what to select, leave the default settings of everything checked, and then click Next.
Figure 29-14 Security Configuration
Figure 29-15 shows a summary for the SDM Express configuration. Here, you can scroll up
and down to see the summary of changes that you made to the router. If you are satisfied with the changes, click Finish. If not, click Back and make your changes.
Figure 29-15 Cisco SDM Express Configuration
Cisco SDM Express provides final instructions on how to reconnect to the router if you made changes to the LAN interface, as shown in Figure 29-16.
Figure 29-16 Reconnection Instructions
After resetting your PC’s address to one in the same subnet as the router’s LAN interface,
restart your Internet browser and enter the router’s LAN interface address in the address bar.
You might be asked to select either HTTP or HTTPS, as shown in Figure 29-2. Depending
on your browser setup, you might be asked for your username/password again, or be asked
to disable pop-ups. SDM needs pop-ups enabled to function.
Figure 29-17 shows the screen that appears when SDM is loading up into the browser. You
might be asked to enter your username/password combination again, or to accept a digital
signature from Cisco IOS Software. If you are challenged, go ahead and enter your new
username and password. If you are asked to verify a digital signature, click OK.
Figure 29-18 shows the home screen of the SDM. From here, you can go to other screens
to configure and monitor the status of the router.
Figure 29-17 Loading Cisco SDM
Figure 29-18 Cisco SDM Home Page
Resetting the Router to Factory Defaults Using SDMStarting at the SDM home page, to reset the router back to factory defaults, first click the
Configure button at the top of the SDM screen, and then clickAdditional Tasks on the left
side of the screen under the Tasks column. Depending on the resolution of your desktop,
you might have to scroll down on the left side of the screen to see the Additional Tasks
button.
The Additional Tasks screen contains a section called Configuration Management, as
shown in Figure 29-19. One of the options here is Reset to Factory Defaults. This screen
shows you how to reconnect to the router after resetting it. Click the Reset Router button
to start the process. A pop-up will appear asking you to confirm your desire to reset the
router. Clicking Yes resets the router. Another pop-up will appear asking you to relaunch
SDM to continue, as shown in Figure 29-20.
Figure 29-19 Resetting the Router
Figure 29-20 Relaunch SDM to Continue
