Essential Cisco Command Cheat Sheet for Device Configuration

Introduction

The Cisco IOS (Internetwork Operating System) provides admins with the means to manage and configure Cisco devices. While Cisco's command structure is proprietary, it exemplifies fundamental concepts in network device management that are applicable across various vendors. Similar command-line interfaces (CLIs) and configuration principles can be found in systems from other major networking companies like Aruba, Juniper and Broadcom, allowing network professionals to apply their skills across different platforms with some adaptation.

This article provides a cheat sheet that you can use as a quick command guide for managing and configuring Cisco network devices. Screenshots are provides to show some commands step by step in action; they were taken using a console connection to the router or switch.

Overview of Command-Line Interface (CLI) Structure

Command Modes

The Cisco IOS command-line interface (CLI) is structured hierarchically with the following command modes:

• User EXEC mode — This is the default mode when logging into a Cisco device. It offers limited access, allowing only basic monitoring commands and restricting the ability to make configuration changes. It is identifiable by a prompt ending with >.
• Privileged EXEC mode — This elevated mode grants access to all show commands and system-level operations. It provides complete visibility into the system but no configuration access. It also enables users to perform device diagnostics and file management tasks. This mode is denoted by a prompt ending with #.
• Global Configuration mode — This highly privileged mode allows you to make system-wide configuration changes and provides access to various sub modes for specific configurations, such as interface settings. In this mode, the prompt includes (config)#.

Moving Between Command Modes

When you first log into a Cisco router or switch, you will be in User EXEC mode. Use the following commands to switch to more privileged modes:

• enable — Used to access Privileged Exec mode
• config terminal (or simply config t) — Used to access Global Configuration mode

These commands are shown in the screenshot below:

Global Configuration mode can be further divided into several sub-modes that permit you to configure different components. Here are those sub-modes and the commands to access them:

Now that you know the commands to move to the higher privileged modes, here are the commands to work your way back out of them. 

• exit — Used to move back one level in the configuration mode hierarchy. The following screenshot shows the admin returning to Privileged Exec mode:

• end — Used to immediately return to Privileged EXEC mode from any configuration mode. This is useful for quickly exiting nested configuration levels.

Displaying System Configuration

After logging onto a Cisco device, you probably want to view its basic system settings. This is easily done by typing show running-config or simply show run. This command displays the active configuration stored in the device's memory.

Notice in the screenshot below that we first tried the command while in User Exec mode, where it failed due to insufficient privileges. The screenshot shows only a portion of the running config. 

Other commands related to configuration include the following:

Shortcuts and Command History

Here are a few additional commands for quick navigation: 

• Ctrl+Z — Use this key combination at any time to instantly exit any configuration mode and return to Privileged EXEC mode
• Tab key — Use this key to auto-complete partial commands or show possible completion options.
• Up & down arrow keys — Use these keys to cycle through previous commands.
• show history — Use this command to display the command history buffer.

Device Setup and Basic Configuration

Renaming a Device

The running config displayed in the earlier screenshot showed router as the hostname. This is the default name for a Cisco router, just as switch is the default name for a Cisco switch. The device’s name appears in the command prompt.

Use the hostname command to change a device’s name. Select a unique name for each device to ensure easy identification within the network. In the example below, we changed the router’s name to NorthOfficeRouter. Notice how the new name is a part of the final prompt. 

Assigning an IP Address

You will also want to assign an IP address to the device to remotely manage it. Choose the interface you want to assign the IP address to and complete the following steps:

1. Enter Interface Configuration mode:

interface <interface-name>

1. Assign an IP address and subnet mask:

ip address <IP-address>

1. Enable the interface:

no shutdown

Here is what this procedure looks like in the Cisco IOS. Note that config-if indicates that you are in Interface Configuration sub-mode. 

Configuring Passwords 

Because we logged onto a new device, we didn’t have to enter a password. Here are the commands for enabling passwords to enhance security: 

Configuring Banners

There are also a variety of banners you can configure:

• Message of the day (motd) banner:

banner motd #Unauthorized access prohibited#

• Login banner:

banner login #Please enter your credentials#

• Exec banner:

banner exec #Welcome to the network#

Switch Configuration

Switches serve a different purpose than routers and therefore utilize different commands. Here are some key concepts to understand:

• Switchport mode — The switchport mode determines how the port handles VLAN traffic. The three main modes are access mode, trunk mode and dynamic mode.
• Duplex speed — Duplex settings determine whether the port can send and receive data simultaneously. You can assign half, full or auto. Auto allows the switch to negotiate the duplex setting with the connected device.
• Speed — This setting determines the port's data transmission rate. Depending on the switch's capabilities, the speed can be set to 10 Mbps, 100 Mbps, 1000 Mbps (1 Gbps) or auto.

VLAN Configuration

VLAN configuration is a crucial aspect of network segmentation and management. In Global Configuration mode, you can use the following commands:

The screenshot below shows the commands for basic port configuration:

Spanning Tree Protocol (STP) Commands

Spanning Tree Protocol is a feature of Cisco switches that can help prevent network loops. STP is enabled by default on Cisco switches for all VLANs. You can modify STP settings globally for the entire switch, or apply specific configurations to individual interfaces or VLANs for fine-tuned control over the STP behavior across different parts of your network. The command is as follows:

spanning-tree mode rapid-pvst

Configuring Trunk Ports

Ports that need to carry multiple VLAN traffic need to be trunked. You first need to trunk the port and then assign the VLANs. Here are the commands:

switchport trunk native vlan <vlan-id>

Configuring trunk ports on Cisco switches involves using the switchport trunk and switchport trunk allowed vlan commands. Here are more details on these commands:

The screenshot below shows these VLAN commands in action:

Networking Fundamentals

IP Addressing and Subnetting

The following commands are used for IP addressing and subnetting:

The screenshot below shows the output from the show ip interface brief command:

Configuring Routing Protocols 

You can use the following commands to configure routing protocols:

The screenshot below shows the configuration of one static route and the configuration of a default route for all other networks:

Configuring Network Address Translation (NAT)

Use the following commands to configure NAT, which allows private IP addresses on a local network to be translated into public IP addresses before being sent over the internet:

Troubleshooting and Diagnostics

Below are commands to help you troubleshoot and perform basic diagnostics:

Security Configuration

You can configure access lists to restrict and allow traffic to and from your Cisco device. Use the following commands:

The screenshot below shows commands for an extended ACL:

Configuring SSH and Remote Access

Use the following commands to configure SSH and remote access:

The screenshot below shows the generation of the RSA keys:

Implementing Port Security 

Use the following commands to implement port security:

The screenshot below shows the process of configuring port security on a switch port.

Managing User Accounts

You can use the following commands to manage user accounts:

DHCP Configuration

Use the following commands to configure DHCP:

The screenshot below shows a basic DHCP configuration on a Cisco router:

Monitoring and Logging

The following commands are useful for monitoring and logging:

Backup, Restore and Upgrade

Use the following commands are for backup, restores and upgrades:

The screenshot below shows the running config being backed up to the startup config.

Configuring Authentication, Authorization and Accounting 

The following commands are used to configure authentication, authorization and accounting (AAA):

Common Use Cases 

A common use case for Cisco switches is network segmentation and quality control through VLANs. By creating separate VLANs for wireless, phones, cameras and printers, you segment and can prioritize different traffic types (e.g., prioritizing voice over printing).

Cisco routers also enable network segmentation using standard or extended access control lists. These can restrict traffic from specific sources or limit certain traffic types entering or exiting router segments.

Here is a step-by-step guide for configuring a Cisco router for a network segment:

1. Configure the router hostname and enable a secret password.
2. Assign IP addresses to the router interfaces.
3. Either configure static routing information or configure a routing protocol to route traffic for the attached network segments.
4. Configure DHCP to distribute IP address and other DHCP options to clients that connect to the network.
5. Configure ACLs to shore up security and restrict incoming and outgoing traffic.
6. Configure NAT for internet access.
7. Enable logging.
8. Save the configuration.

Common Problem Scenarios and Troubleshooting Tips

Here are some common issues for Cisco routers and switches and tips for resolving them:

Scenario: Devices unable to communicate across VLANs or subnets

• Check VLAN configurations and trunking on switches.
• Verify the IP addresses and subnet masks.
• Check the routing table and ensure routes exist.
• Test connectivity with ping and traceroute.
• Verify that ACLs are not blocking traffic.

Scenario: Interface is down or flapping

• Check physical connections and cable integrity.
• Verify the interface configuration with show interface.
• Shut down and re-enable the interface.
• Test different speed and duplex settings.

Scenario: Unauthorized access attempts or suspicious traffic

• Review logs and use show logging.
• Check ACL configurations and hit counts.
• Verify AAA and TACACS+ settings.
• Implement port security on switches.

Bonus Tips

The following tips can help you manage your Cisco devices more efficiently:

• If you aren’t familiar with Cisco IOS, be sure to take advantage of the context-sensitive help — simply type ? at any point in a command to get suggestions and available
• Save time with command shortcuts and tab completion. For example, type  sh run instead of show running-config.
• Use the up and down arrows (or Ctrl+P and Ctrl+N) to quickly access recent commands.
• If you don’t have access to a Cisco router, there are multiple Cisco device simulators available for download that will allow you to practice and become familiar with the commands.

Always make security a top priority: 

• Limit who can access your Cisco devices.
• Ensure that all accounts use encrypted long passwords.
• Enforce the principle of least privilege when assigning roles.
• Create access control lists to restrict different traffic origins and types.
• Enable logging and use a third-party monitoring solution to get alerted if your configurations are altered, either accidentally or maliciously.