Cisco IOS
Cisco Internetwork Operating System is a family of network operating systems used on many Cisco Systems routers and current Cisco network switches. Earlier, Cisco switches ran CatOS. IOS is a package of routing, switching, internetworking and telecommunications functions integrated into a multitasking operating system. Although the IOS code base includes a cooperative multitasking kernel, most IOS features have been ported to other kernels such as QNX and Linux for use in Cisco products.
Not all Cisco products run IOS. Notable exceptions include ASA security products, which run a Linux-derived operating system, carrier routers which run IOS-XR and Cisco's Nexus switch and FC switch products which run Cisco NX-OS.
History
The IOS network operating system was developed in the 1980s for routers that had only 256 kB memory and low CPU processing power. Through modular extensions IOS has been adapted to increasing hardware capabilities and new networking protocols. When IOS was developed, Cisco Systems' main product line were routers. The company acquired a number of young companies that focused on network switches, such as the inventor of the first Ethernet switch Kalpana, and as a result Cisco switches did not run the IOS. The Cisco Catalyst series would for some time run the CatOS. In early modular chassis network switches from Cisco, modules with layer 3 routing functionalities were separate devices that ran IOS, while the layer 2 switch modules ran CatOS. Cisco eventually introduced the native mode for chassis, so that they only run one operating system. For the Nexus switches Cisco developed NX-OS, which is similar to IOS, except that it is Linux-based.Command-line interface
The IOS command-line interface provides a fixed set of multiple-word commands. The set available is determined by the "mode" and the privilege level of the current user. "Global configuration mode" provides commands to change the system's configuration, and "interface configuration mode" provides commands to change the configuration of a specific interface. All commands are assigned a privilege level, from 0 to 15, and can only be accessed by users with the necessary privilege. Through the CLI, the commands available to each privilege level can be defined.Most builds of IOS include a Tcl interpreter. Using the embedded event manager feature, the interpreter can be scripted to react to events within the networking environment, such as interface failure or periodic timers.
Available command modes include:
- User EXEC Mode
- Privileged EXEC Mode
- Global Configuration Mode
- ROM Monitor Mode
- Setup Mode
- More than 100 configuration modes and submodes.
Architecture
The Cisco IOS monolithic kernel does not implement memory protection for the data of different processes. The entire physical memory is mapped into one virtual address space. The Cisco IOS kernel does not perform any memory paging or swapping. Therefore the addressable memory is limited to the physical memory of the network device on which the operating system is installed. IOS does however support aliasing of duplicated virtual memory contents to the same physical memory. This architecture was implemented by Cisco in order to ensure system performance and minimize the operational overheads of the operating system.
The disadvantage of the IOS architecture is that it increases the complexity of the operating system, data corruption is possible as one process can write over the data of another, and one process can destabilize the entire operating system or even cause a software-forced crash. In the event of an IOS crash, the operating system automatically reboots and reloads the saved configuration.
Routing
In all versions of Cisco IOS, packet routing and forwarding are distinct functions. Routing and other protocols run as Cisco IOS processes and contribute to the Routing Information Base. This is processed to generate the final IP forwarding table, which is used by the forwarding function of the router. On router platforms with software-only forwarding, most traffic handling, including access control list filtering and forwarding, is done at interrupt level using Cisco Express Forwarding or dCEF. This means IOS does not have to do a process context switch to forward a packet. Routing functions such as OSPF or BGP run at the process level. In routers with hardware-based forwarding, such as the Cisco 12000 series, IOS computes the FIB in software and loads it into the forwarding hardware, which performs the actual packet forwarding function.Interface descriptor block
An Interface Descriptor Block, or simply IDB, is a portion of memory or Cisco IOS internal data structure that contains information such as the IP address, interface state, and packet statistics for networking data. Cisco's IOS software maintains one IDB for each hardware interface in a particular Cisco switch or router and one IDB for each subinterface. The number of IDBs present in a system varies with the Cisco hardware platform type.Packages and feature sets
IOS is shipped as a unique file that has been compiled for specific Cisco network devices. Each IOS Image therefore include a feature set, which determine the command-line interface commands and features that are available on different Cisco devices. Upgrading to another feature set therefore entails the installation of a new IOS image on the networking device and reloading the IOS operating system. Information about the IOS version and feature-set running on a Cisco device can be obtained with the show version command.Most Cisco products that run IOS also have one or more "feature sets" or "packages", typically eight packages for Cisco routers and five packages for Cisco network switches. For example, Cisco IOS releases meant for use on Catalyst switches are available as "standard" versions, "enhanced" versions, which provide full IPv4 routing support, and "advanced IP services" versions, which provide the enhanced features as well as IPv6 support.
Beginning with the 1900, 2900 and 3900 series of ISR Routers, Cisco revised the licensing model of IOS. To simplify the process of enlarging the feature-set and reduce the need for network operating system reloads, Cisco introduced universal IOS images, that include all features available for a device and customers may unlock certain features by purchasing an additional software license. The exact feature set required for a particular function can be determined using the . Routers come with IP Base installed, and additional feature pack licenses can be installed as bolt-on additions to expand the feature set of the device. The available feature packs are:
- Data adds features like BFD, IP SLAs, IPX, L2TPv3, Mobile IP, MPLS, SCTP.
- Security adds features like VPN, Firewall, IP SLAs, NAC.
- Unified Comms adds features like CallManager Express, Gatekeeper, H.323, IP SLAs, MGCP, SIP, VoIP, CUBE.
Versioning
Cisco IOS is versioned using three numbers and some letters, in the general form a.be, where:- a is the major version number.
- b is the minor version number.
- c is the release number, which begins at one and increments as new releases in a same way a.b train are released. "Train" is Cisco-speak for "a vehicle for delivering Cisco software to a specific set of platforms and features."
- d is the interim build number.
- e is the software release train identifier, such as none, T, E, S, XA as a special functionality train, XB as a different special functionality train, etc.
Interim releases – Are usually produced on a weekly basis, and form a roll-up of current development effort. The Cisco advisory web site may list more than one possible interim to fix an associated issue.
Maintenance releases – Rigorously tested releases that are made available and include enhancements and bug fixes. Cisco recommend upgrading to Maintenance releases where possible, over Interim and Rebuild releases.
Trains
Cisco says, "A train is a vehicle for delivering Cisco software to a specific set of platforms and features."Until 12.4
Before Cisco IOS release 15, releases were split into several trains, each containing a different set of features. Trains more or less map onto distinct markets or groups of customers that Cisco targeted.- The mainline train is intended to be the most stable release the company can offer, and its feature set never expands during its lifetime. Updates are released only to address bugs in the product. The previous technology train becomes the source for the current mainline train — for example, the 12.1T train becomes the basis for the 12.2 mainline. Therefore, to determine the features available in a particular mainline release, look at the previous T train release.
- The T – Technology train, gets new features and bug fixes throughout its life, and is therefore potentially less stable than the mainline. Cisco doesn't recommend usage of T train in production environments unless there is urgency to implement a certain T train's new IOS feature.
- The S – Service Provider train, runs only on the company's core router products and is heavily customized for Service Provider customers.
- The E – Enterprise train, is customized for implementation in enterprise environments.
- The B – broadband train, supports internet based broadband features.
- The X* – Special Release train, contains one-off releases designed to fix a certain bug or provide a new feature. These are eventually merged with one of the above trains.
Since 15.0
Starting with Cisco IOS release 15, there is just a single train, the M/T train. This train includes both extended maintenance releases and standard maintenance releases. The M releases are extended maintenance releases, and Cisco will provide bug fixes for 44 months. The T releases are standard maintenance releases, and Cisco will only provide bug fixes for 18 months.Security and vulnerabilities
Because IOS needs to know the cleartext password for certain uses, passwords entered into the CLI by default are weakly encrypted as 'Type 7' ciphertext, such as "Router#username jdoe password 7 0832585B1910010713181F". This is designed to prevent "shoulder-surfing" attacks when viewing router configurations and is not secure – they are easily decrypted using software called "getpass" available since 1995, or "ios7crypt", a modern variant, although the passwords can be decoded by the router using the "key chain" command and entering the type 7 password as the key, and then issuing a "show key" command; the above example decrypts to "stupidpass". However, the program will not decrypt 'Type 5' passwords or passwords set with the enable secret command, which uses salted MD5 hashes.Cisco recommends that all Cisco IOS devices implement the authentication, authorization, and accounting security model. AAA can use local, RADIUS, and TACACS+ databases. However, a local account is usually still required for emergency situations.
At the Black Hat Briefings conference in July 2005, Michael Lynn, working for Internet Security Systems at the time, presented information about a vulnerability in IOS.
Cisco had already issued a patch, but asked that the flaw not be disclosed.
Cisco filed a lawsuit, but settled after an injunction was issued to prevent further disclosures.