Using the Cisco Discovery Protocol

Using the Cisco Discovery Protocol

Problem

You want to see summary information about what is connected to your router's interfaces.

Solution

You can selectively enable or disable Cisco Discovery Protocol (CDP) on the entire router, or on individual interfaces:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#cdp run
Router1(config)#interface Serial0/0
Router1(config-if)#cdp enable
Router1(config-if)#exit
Router1(config)#interface FastEthernet0/0
Router1(config-if)#no cdp enable
Router1(config-if)#exit
Router1(config)#interface FastEthernet1/0
Router1(config-if)#cdp enable
Router1(config-if)#end
Router1#

Discussion

CDP is enabled by default on the router, and on all interfaces. If you have previously disabled it, as discussed in Recipe 2.6, and you want to re-enable CDP on the router, you can issue the cdp run global configuration command:

Router1(config)#cdp run

This turns on CDP processing on all supported interfaces by default. If you don't want to run CDP on a particular interface, you can use the no cdp enable command, as we did for the serial interface in the example:

Router1(config)#interface Serial0/0
Router1(config-if)#no cdp enable

CDP is a Cisco proprietary protocol that allows Cisco devices to identify one another and exchange useful identifying information. The show cdp neighbors command gives a summary of information about adjacent devices that also happen to be running CDP:

Router1#show cdp neighbors 
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                 S - Switch, H - Host, I - IGMP, r - Repeater

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
Router2          Ser 0/0            179          R        2621      Ser 0/1
Switch1          Fas 1/0            152         T S       WS-C2924  2/2
Router1#

As you can see, this output tells you the name and type of device of each neighbor, including the model number. It also includes both the interface on this router that connects to each neighbor and the corresponding interface on the neighbor device.

Notice that the last of the devices listed is actually a Cisco Catalyst Ethernet switch. This switch points out one of the most useful features of CDP. While other mechanisms such as the ARP cache, routing protocols, or even simple PING tests can tell you things about the Layer 3 neighbors, CDP gives you information about the Layer 2 neighbors. This is true even when the Layer 2 neighbor does not have an IP addresses configured.

You can see additional information about these neighboring devices by adding the detail keyword:

Router1#show cdp neighbors detail
-------------------------
Device ID: Router2
Entry address(es):
 IP address: 10.1.1.2
Platform: cisco 2621,  Capabilities: Router
Interface: Serial0/0,  Port ID (outgoing port): Serial0/1
Holdtime : 136 sec

Version :
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-IK9O3S-M), Version 12.2(13), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Tue 19-Nov-02 22:27 by pwade

advertisement version: 2


Device ID: Switch1
Entry address(es):
 IP address: 172.25.1.4
Platform: WS-C2924,  Capabilities: Trans-Bridge Switch
Interface: FastEthernet1/0,  Port ID (outgoing port): FastEthernet0/12
Holdtime : 116 sec
        
Version :
Cisco Internetwork Operating System Software
IOS (tm) C2900XL Software (C2900XL-C3H2S-M), Version 12.0(5)WC3b, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Fri 15-Feb-02 10:14 by antonino

advertisement version: 2
Duplex: full

Router1#

There is a lot of information in this output. It tells you the IP addresses of the adjacent interfaces on the neighbor devices. It also gives details about the Cisco IOS or CatOS version.

Both of these neighbor devices support CDP Version 2. In IOS Version 12.0(3)T, Cisco introduced this new version of CDP, which includes three new fields that are quite useful on LANs: VTP Domain Name, 802.1Q Native VLAN, and duplex. As you can see in the above output, the router and switch agree that they are operating at full duplex. Please refer to Chapter 16 for discussions of both 802.1Q and Ethernet Duplex configuration.

This new duplex option in particular is extremely useful because the router and switch can now automatically detect duplex mismatches. We deliberately created a duplex problem by changing the switch's setting to half duplex for the port facing this router. The router was able to detect the problem through CDP and issue the following log message:

Feb  6 11:36:11: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on
FastEthernet1/0 (not half duplex), with 003541987 (switch) FastEthernet0/12 (half duplex).

CDP Version 2 is enabled by default on all IOS versions 12.0(3)T and higher. You can globally disable Version 2 support on a router, allowing only Version 1, by issuing the following global configuration command:

Router1(config)#no cdp advertise-v2

However, it is not entirely clear what purpose this would serve. We know of no interoperability problems between CDP Version 1 and Version 2. And, while there are security problems, which we will discuss in Recipe 2.6, they are better addressed by disabling CDP altogether.

You can see global information about the router's CDP configuration with the show cdp command:

Router1#show cdp
Global CDP information:
       Sending CDP packets every 60 seconds
       Sending a holdtime value of 180 seconds
       Sending CDPv2 advertisements is  enabled
Router1#

Here you can see that this router sends out CDP advertisement packets every 60 seconds, which is the default. The holdtime parameter is the length of time the router will wait to hear the next CDP advertisement from one of its neighbors. If it doesn't receive this advertisement packet within this time period, the router will flush the corresponding entry from its CDP neighbor table.

You can adjust these parameters globally for the entire router as follows:

Router1(config)#cdp timer 30
Router1(config)#cdp holdtime 240

Both of these commands accept an argument in seconds. The advertisement timer can have any value between 5 and 254 seconds, while the hold timer must be between 10 and 255 seconds.

See Also

Tuning Router Buffers

Tuning Router Buffers

Problem

You want to change your default buffer allocations to improve router efficiency.

Solution

The router maintains two different sets of buffers: public buffers and interface buffers. The router uses these as temporary storage while processing packet data. You can tune the public buffer pools as follows:

Router1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#buffers big initial 100
Router1(config)#buffers big max-free 200
Router1(config)#buffers big min-free 50
Router1(config)#buffers big permanent 50
Router1(config)#end
Router1#

And you can adjust the interface buffer pools by using a similar set of commands:

Router1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#buffers Ethernet0 initial 200
Router1(config)#buffers Ethernet0 max-free 300
Router1(config)#buffers Ethernet0 min-free 50
Router1(config)#buffers Ethernet0 permanent 50
Router1(config)#end
Router1#

Discussion

Before we start this discussion, we need to offer three notes of caution on tuning buffers. First, adjusting your router's buffers is usually not necessary. Second, a poor set of buffer parameters can cause serious performance problems on your router and for traffic passing through the router. Third, if you do find that you need to adjust these parameters, the necessary adjustments will be unique to your network, and perhaps even to each router, so we unfortunately can only offer general guidance, but can't really recommend appropriate parameters.

The router maintains two different sets of buffers: public pools that the router can use for anything, and interface specific pools that it can use only for processing packets on that interface.

The public buffers fall into several different pools, according to their size. They are shown in Table 2-1.

Table 2-1. Public buffer pools

Buffer size	Buffer pool name
104 bytes	Small buffers
600 bytes	Middle buffers
1,536 bytes	Big buffers
4,520 bytes	VeryBig buffers
5,024 bytes	Large buffers
18,024 bytes (default)	Huge buffers

Note that the Huge buffers are 18,024 bytes by default. But unlike the other public buffer pools, you can actually change the size of the buffers in this pool as follows:

Router1(config)#buffers huge size 36048

You can configure any size between 18,024 and 100,000 bytes for your Huge buffers. However, we should mention that it is extremely rare to find that you need to change this buffer size. Since the router can use memory only in buffer-sized chunks, having extremely large buffers can be useful if you find that you need to manipulate extremely large packets for some reason. However, the default value of 18,024 should be large enough to handle the largest MTU values for all standard interface types. So it is extremely rare to find that you actually have to adjust this parameter. The remaining buffer sizes are all fixed and cannot be adjusted.

There are four different parameters that you can adjust on each of the public buffer pools:

Router1(config)#buffers big initial 100
Router1(config)#buffers big max-free 200
Router1(config)#buffers big min-free 50
Router1(config)#buffers big permanent 50

The first of these commands sets the number of buffers of this type that the router will allocate at boot time. If this router is in an extremely high traffic environment, it may take a while to allocate enough buffers to handle the load. So you may find that the router has a few buffer failures right after booting. You can resolve this problem by increasing the number of initial buffers.

The second command uses the keyword max-free to set the maximum number of free buffers of this type that the system should keep. In the router's normal functioning, it will see periodic bursts of activity that may force it to allocate more buffers. When the burst is over, setting a relatively low value for max-free will ensure that the router frees this extra memory to make it available for other purposes. But if you set it too low in an extremely bursty environment, the router may not be able to allocate new buffers quickly enough to meet the demand.

In the third command, we have applied the min-free keyword to take care of the opposite side of the same problem. In order to help ensure that the router is able to handle the rising demand for packets, as soon as the router finds that it has fewer than min-free more unused buffers of a particular type, it will start allocating more from system memory. If you specify a min-free value that is large enough, the router will be able to cope with any demands. But making the value too large will force the router to do additional work by allocating additional buffers that it will never need.

In the final command we set the minimum number of buffers of this type by using the keyword permanent. The router will allocate this many buffers at boot time, and it will not return their memory to the general pool of memory. A good value for this parameter is high enough to reduce the amount of work that the router has to do allocating and trimming buffers, but not so high as to waste precious memory resources.

As you can see from the second example, the parameters for tuning the interface buffer pools are exactly the same as the ones we have just described for the public pools:

Router1(config)#buffers Ethernet0 initial 200
Router1(config)#buffers Ethernet0 max-free 300
Router1(config)#buffers Ethernet0 min-free 50
Router1(config)#buffers Ethernet0 permanent 50

The best way to tell whether your buffers need adjusting is to look at the output of the show buffers command:

Router1>show buffers
Buffer elements:
   498 in free list (500 max allowed)
   760166 hits, 0 misses, 0 created

Public buffer pools:
Small buffers, 104 bytes (total 50, permanent 50):
   50 in free list (20 min, 150 max allowed)
   265016 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)
Middle buffers, 600 bytes (total 25, permanent 25, peak 49 @ 1d09h):
   23 in free list (10 min, 150 max allowed)
   40749 hits, 10 misses, 30 trims, 30 created
   0 failures (0 no memory)
Big buffers, 1536 bytes (total 50, permanent 50):
   50 in free list (5 min, 150 max allowed)
   33780 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)
VeryBig buffers, 4520 bytes (total 10, permanent 10):
   10 in free list (0 min, 100 max allowed)
   0 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)
Large buffers, 5024 bytes (total 0, permanent 0):
   0 in free list (0 min, 10 max allowed)
   0 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)
Huge buffers, 18024 bytes (total 0, permanent 0):
   0 in free list (0 min, 4 max allowed)
   0 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)

Interface buffer pools:
Ethernet0 buffers, 1524 bytes (total 32, permanent 32):
   8 in free list (0 min, 32 max allowed)
   24 hits, 0 fallbacks
   8 max cache size, 8 in cache
   30963 hits in cache, 0 misses in cache
Serial0 buffers, 1524 bytes (total 32, permanent 32):
   4 in free list (0 min, 32 max allowed)
   54 hits, 3 fallbacks
   8 max cache size, 7 in cache
   172593 hits in cache, 32 misses in cache
Serial1 buffers, 1524 bytes (total 32, permanent 32):
   7 in free list (0 min, 32 max allowed)
   25 hits, 0 fallbacks
   8 max cache size, 8 in cache
   0 hits in cache, 0 misses in cache


Router1>

First, let us zoom in on one of the public buffer pools to explain what the fields mean:

Small buffers, 104 bytes (total 50, permanent 50):
   50 in free list (20 min, 150 max allowed)
   265016 hits, 0 misses, 0 trims, 0 created
   0 failures (0 no memory)

This section looks at Small buffers, which are 104-byte chunks of memory. The router currently has allocated a total of 50 of these buffers; all 50 of them are permanent, meaning that the router will not attempt to return any of them to the pool of generally available memory.

In the second line, you can see that all 50 of these buffers are currently in the free list, meaning that they are all unused. The numbers 20 and 150 in this line are the min-free and max-free parameters that we discussed above.

In the third line, the number of hits indicates how many times the router has successfully allocated buffers from this pool. The number of misses indicates how many times the router successfully allocated a buffer from this pool, but in doing so had to allocate additional buffers. The field called trims counts the number of dynamically allocated buffers that the router has subsequently returned. And the created field shows how many buffers the router has actually created in response to miss events.

The last line shows serious problems, which are the only reason that you should alter your buffer parameters. The failures field counts the number of times that the router has attempted to allocate a buffer and failed, causing it to drop the packet. The last field is labeled "no memory." It counts the number of times a failure happened because the router had no memory from which to allocate additional buffers. This is clearly an extremely serious problem, which is usually best treated by adding memory to the router.

It is also important to remember that if the router tries and fails to allocate a buffer from one pool, it will request a buffer from the next largest pool. So, for example, if the router is unable to get a Big buffer to handle a 1,500 byte packet, it will use one from the VeryBig pool. This is why you can sometimes see buffer hits in the VeryBig pool, even if every interface on the router has an MTU of 1,500 bytes. So it is a good idea to allocate a few permanent buffers from the pool larger than your highest MTU.

Now let's look at the interface buffers:

Ethernet0 buffers, 1524 bytes (total 32, permanent 32):
   8 in free list (0 min, 32 max allowed)
   24 hits, 0 fallbacks
   8 max cache size, 8 in cache
   30963 hits in cache, 0 misses in cache

This shows a similar set of values to what we just discussed for the public buffer pools, but there are a few differences. The first difference is the fallbacks field. This counts the number of times that the router has needed additional buffers on this interface, and has allocated them from the corresponding public buffer pool of the appropriate size. In this case, the Ethernet buffers are 1,524 bytes, so the router would allocate additional buffers from the big buffer public pool.

The router keeps a cache of buffers on each interface that are effectively in use whether there is data or not. This field varies somewhat depending on the hardware type. But once again, you should watch out for misses. As long as the number of misses and fallbacks are low, there is no need to adjust the interface buffers.

We would like to offer one final warning about adjusting buffers. Always be sure to look at your router's free memory with the show memory before and after making any adjustment:

Router1#show memory 
              Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)
Processor     17DA4C    13112756     2308632    10804124    10577100    10663072
    I/O     E00000     2097152      336980     1760172     1740988     1759812

Keep close track of how much the Free memory in particular changes when you adjust your router's buffers. Both the Processor and the I/O memory can be affected by these changes. If you inadvertently over allocate your buffers while trying to improve system performance, you may find that the router does not have enough memory to operate properly when the load increases.

Managing the Router's ARP Cache

Managing the Router's ARP Cache

Problem

You want to adjust the ARP table timeout value.

Solution

To modify the ARP timeout value, use the arp timeout configuration command:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#interface Ethernet0
Router1(config-if)#arp timeout 600
Router1(config-if)#end
Router1#

Discussion

Every LAN device has an Address Resolution Protocol (ARP) cache. This is a table that the device uses to map Layer 2 MAC addresses to Layer 3 IP addresses. Without this mapping, the device could build its IP packets, but couldn't build the Layer 2 frames to carry these packets.

Devices discover the information in the ARP cache dynamically. If a device needs to send a packet to an IP destination, and it doesn't have a corresponding MAC address, it sends out a broadcast ARP request packet. This packet reaches every device on the LAN segment, and the one that "owns" the IP address in question sends back an ARP response packet to complete the process.

Many LAN devices also automatically send a gratuitous ARP packet when they first connect to the network. A gratuitous ARP is a broadcast packet that is effectively an unsolicited ARP response. Every device on the LAN segment will receive this packet so it can update its ARP cache in case there is ever a need to talk to this new device.

The ARP request and response process obviously takes time to complete, introducing a delay in packet processing. Furthermore, because the ARP request packets are broadcasts, they go to every device on the LAN segment, where they interrupt whatever that device was doing. If there are too many of these packets on the segment, it can cause traffic congestion and CPU loading on the connected devices.

So to keep the ARP traffic down, all IP devices maintain a cache of these ARP entries. Old entries that are no longer valid need to be periodically removed. The router needs to flush out old ARP cache entries faster in environments where devices frequently change their address, such as when there are very short DHCP lease times. In some cases there are so many devices that the ARP cache table becomes unwieldy, taking up too much memory or too much CPU time to support. But you need to maintain a balance between removing old invalid entries and keeping the amount of ARP traffic down.

By default, Cisco routers use an ARP cache timeout period of four hours. This means that if the router hasn't sent or received any packets with a particular address for the last four hours, it will flush the ARP entry from its cache. This period usually works well on Ethernet networks. However, there are special situations when you can improve network performance by adjusting this period.

The example in this recipe reduces the ARP timeout period to 600 seconds (10 minutes):

Router1(config-if)#arp timeout 600 

Of course, you could just as easily use this command to increase the default ARP timeout period. In general we don't recommend using an ARP timeout period of less than about five minutes because it tends to cause too much CPU and network loading.

The show ip arp command prints out the current contents of the router's ARP cache:

Router1#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.25.1.5              8   0001.9670.b780  ARPA   Ethernet0
Internet  172.25.1.7              -   0000.0c92.bc6a  ARPA   Ethernet0
Internet  172.25.1.1              9   0010.4b09.5700  ARPA   Ethernet0
Internet  172.25.1.3              2   0010.4b09.5715  ARPA   Ethernet0
Router1#

Notice that this output includes the IP address, Age in minutes, MAC address, and the Interface information for each ARP entry. The router resets the ARP age counter to zero whenever it sees valid traffic from the corresponding device. This ensures that the addresses of active devices are never flushed out of the cache, no matter how long they have been known.

You can specify a particular IP address with the show ip arp command. This can be useful when you are only interested in particular entries in a large cache table. On a large LAN core router, there could be hundreds or even thousands of ARP entries in the cache, which is too many to scan by eye:

Router1#show ip arp 172.25.1.5
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.25.1.5              2   0001.9670.b780  ARPA   Ethernet0
Router1#

The same command can also display the ARP information for a particular MAC address, as follows:

Router1#show ip arp 0010.4b09.5715
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.25.1.3              3   0010.4b09.5715  ARPA   Ethernet0
Router1#

And you can even get a listing of ARP information for a particular router interface:

Router1#show ip arp Ethernet0
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.25.1.5              4   0001.9670.b780  ARPA   Ethernet0
Internet  172.25.1.7              -   0000.0c92.bc6a  ARPA   Ethernet0
Internet  172.25.1.1              2   0010.4b09.5700  ARPA   Ethernet0
Internet  172.25.1.3              4   0010.4b09.5715  ARPA   Ethernet0
Router1#

When you are having an ARP problem, or when there are stale entries that you need to remove immediately, it can be useful to clear the entire cache. To manually clear the router's entire ARP cache, use the clear arp command:

Router1#clear arp
Router1#

Unfortunately, there is no way to remove a single ARP entry. If you need to manually clear an entry, you must erase the entire table. Doing this will cause a brief spike in ARP traffic as the router attempts to rebuild the ARP cache for the active device, so we recommend that you use this command very sparingly.

The show interface command includes information about the ARP timeout setting for a particular interface:

Router1#show interface Ethernet0
Ethernet0 is up, line protocol is up
 Hardware is Lance, address is 0000.0c92.bc6a (bia 0000.0c92.bc6a)
 Internet address is 172.25.1.7/24
 MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255
 Encapsulation ARPA, loopback not set, keepalive set (10 sec)
 ARP type: ARPA, ARP Timeout 00:10:00
 

Cisco Discovery Protocol (CDP)

This chapter, like the previous one, looks at system management issues on the router. But unlike the previous chapter, which looked primarily at general system administration issues such as filesystem management, here we will talk about how to manage and tune issues related to router performance, as well as deal with disaster scenarios such as creating exception dumps.

Cisco's IOS supports a variety of special-purpose protocols and services. Some of them are useful for network management and administration, while others are more useful for testing purposes. One of the most useful of these features is the Cisco Discovery Protocol (CDP), which allows you to see useful information about the Layer 2 connections between Cisco devices. This chapter shows how to use CDP, but it also discusses some of the well known security problems with the protocol. It is best to simply disable this service.

Disabling is often the best strategy for several of the other services. Some, like the HTTP management interface and the various test protocols lumped together under the title of the TCP and UDP small servers, serve no real purpose in most production networks, so they are disabled by default. But others, like DNS, do have useful functions, and are enabled by default.

We will discuss several important administrative features, such as different methods for handling the hostnames of other network devices and command aliases that make complex commands easier to remember and type. The chapter concludes with a set of four useful scripts for gathering important information from your network devices.

Locking Configuration Access

Locking Configuration Access

Problem

You want to prevent multiple concurrent users from making configuration changes at the same time.

Solution

To automatically prevent other users from making configuration changes at the same time as you, use the following command:

Router1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#configuration mode exclusive auto
Router1(config)#end
Router1#

To enable the ability to lock the configuration file, on an as-needed basis, use the following command:

Router1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#configuration mode exclusive manual
Router1(config)#end                                
Router1#

This feature was introduced in IOS Version 12.3(14)T.

Discussion

By default, the router running IOS software allows multiple concurrent users to change the running configuration files at once. In some operating environments, preventing multiple concurrent users from making changes is beneficial. Being able to prevent two users attempting to modify the same portion of the configuration file is desired. By enabling this feature, you temporarily prevent multiple users from modifying the router configuration at the same time.

Essentially, this feature allows only a single user to enter the configuration mode at a time. All other users on the router are effectively locked out of the configuration mode until the first user exits it. As we've seen in our examples, this feature runs in two modes, auto and manual. In auto mode, the configuration mode is automatically locked each time a user enters the configuration mode. In manual mode, users have the ability to manually lock the configuration mode each time they change the router configuration by using the lock keyword:

Router1#configure terminal lock
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#

If you don't issue the lock keyword, then the router will not lock the configuration mode and the router will function as normal. In auto mode, you don't need to issue the lock keyword, since it is implicitly enabled.

If you attempt to enter the configuration mode and someone has already locked it, then you will receive the following message informing you that the configuration mode is locked and by whom:

Router1#configure terminal
Configuration mode locked exclusively by user 'ijbrown' process '31' from terminal '162'. Please try later.
Router1#

You can always show the status of the configuration lock by issuing the following command:

Router1#show configuration lock
Parser Configure Lock
---------------------
Owner PID        : 31
User             : ijbrown
TTY              : 162
Type             : EXCLUSIVE
State            : LOCKED
Class            : EXPOSED
Count            : 1
Pending Requests : 0
User debug info  : configure terminal lock
Router1#

If you absolutely need to change the router configuration and someone has locked you out, then you always have the option of terminating his or her session. Notice that user ijbrown has currently locked the configuration mode, and he is using TTY 162. In the next example, we will clear the TTY session and view the status of the configuration lock:

Router1#clear line 162
[confirm] 
[OK]
Router1#show configuration lock
Parser Configure Lock
---------------------
Owner PID        : -1
User             : unknown
TTY              : -1
Type             : NO LOCK
State            : FREE
Class            : unknown
Count            : 0
Pending Requests : 0
User debug info  :
Router1#

Notice that once we clear the user's session, the lock is removed and we are then free to make configuration changes. In addition, once someone does lock the configuration mode, a system message is sent to inform all other users:

Sep  2 22:39:03.304 EDT:  Configuration mode locked exclusively. The lock will be cleared once you exit out of configuration mode using end/exit