장치 구성을 위한 필수 Cisco 명령 치트 시트

enable

Enter privileged EXEC mode

configure terminal

Enter global configuration mode

show running-config

View the device's active configuration

interface gigabitethernet 0/1

Select an interface to configure

vlan 10

Create or select VLAN 10

switchport mode access

Set a port to access mode

ip route 0.0.0.0 0.0.0.0 <next-hop>

Add a default static route

router ospf 1

Start an OSPF routing process

show ip route

View the routing table

show ip interface brief

Check interface status and IP addresses at a glance

ping <address>

Test connectivity to a device

show version

Check IOS version and uptime

Interface Configuration mode

interface [interface-type] [interface-number]

Subinterface Configuration mode

interface [interface-type] [interface-number].[subinterface-number]

Router Configuration mode

router [routing-protocol]

Line Configuration mode

line [line-type] [line-number]

show startup-config

Displays the saved configuration stored in the device's NVRAM, which will be loaded when the device starts up

copy running-config startup-config

Replaces the startup config with the active config when the Cisco network device initializes

copy startup-config running-config

Merges the startup config with the currently active config in RAM

write erase erase startup-config

Deletes the startup config

enable password <pass-value>

Defines the password required when using the enable command1

enable secret <pass-value>

Sets the password required for any user to enter enable mode and encrypts it

service password-encryption

Directs the Cisco IOS software to encrypt the passwords, CHAP secrets and similar data saved in its configuration file

vlan <vlan-id>

Creates a VLAN

Vlan <vlan-name>

Assigns a name to the VLAN

vlan switchport access vlan <vlan-id>

Sets the VLAN that the interface belongs to

no vlan <vlan-id>

Deletes a VLAN

show vlan

Display the VLAN configuration

switchport trunk native vlan <vlan-id>

Enables trunk mode for the port and sets the native VLAN for untagged traffic on the trunk

switchport trunk allowed vlan <vlan-id>

Adds the specified VLANs to the current list

switchport trunk allowed vlan remove <vlan-id>

Removes the specified VLANs from the allowed list

ip address <ip-value> <bnet-value>

Assigns an IP and subnet mask

show ip interface <interface-number>

Displays the status of a network interface as well as a detailed listing of its IP configurations and related characteristics

show ip interface brief

Provides a concise summary of the IP interface status and configuration

ip address <ip-value> <subnet-value> secondary

Assigns a secondary IP address

no ip address

Removes an IP address

ip route <network-number> <network-mask> {<ip-address> | <exit-interface>}

Sets a static route in the IP routing table

ip route 0.0.0.0 0.0.0.0 {next-hop-ip | exit-interface}

Configures a default route

no ip route {network} {mask} {next-hop-ip | exit-interface}

Removes a route

router rip

Enables a Routing Information Protocol (RIP) routing process, which places you in Router Configuration mode

no auto-summary

Disables automatic summarization

version 2

Configures the software to receive and send only RIP version 2 packets

network ip-address

Associates a network with a RIP routing process

passive-interface interface

Sets the specified interface to passive RIP mode, which means RIP routing updates are accepted by, but not sent out of, the interface

show ip rip database

Displays the contents of the RIP routing database

default-information originate

Generates a default route into RIP

ip nat [inside | outside]

Specifies whether the NAT operation is applied to traffic entering or leaving the router’s network

ip nat inside source {list{access-list-number | access-list-name}} interface type number[overload]

Establishes dynamic source translation. Use the list keyword to specify an ACL to identify the traffic that will be subject to NAT. The overload option enables the router to use one global address for many local addresses

ip nat inside source static local-ip global-ip

Establishes a static translation between an inside local address and an inside global address

ping {hostname | system-address} [source source-address]

Reveals basic network connectivity

traceroute {hostname | system-address} [source source-address]

Traces the route that packets take to reach a destination

show interfaces

Displays detailed information about interface status, settings and counters

show ip route

Shows the routing table of the device

show interface status

Displays the interface line status

show interfaces trunk

Lists information about the currently operational trunks and the VLANs supported by those trunks

show version

Displays information about the IOS version, uptime and hardware configuration

show running-config

Displays the current active configuration on the device

show tech-support

Generates a comprehensive report of the device's configuration and status (useful for advanced troubleshooting)

show cdp

Shows whether CDP is enabled globally

show cdp neighbors [detail]

Lists summary (or detailed) information about each neighbor connected to the device

cdp run
no cdp run

Enables or disables Cisco Discovery Protocol (CDP) for the device

show mac address-table

Displays the MAC address table

show vtp status

Lists the current VLAN Trunk Protocol (VTP) status, including the current mode

password <pass-value>

Lists the password that is required if the login command (with no other parameters) is configured

username name password <pass-value>

Defines one of possibly multiple user names and associated passwords used for user authentication. It is used when the login local line configuration command has been used.

enable password <pass-value>

Defines the password required when using the enable command

enable secret <pass-value>

Sets the password required for any user to enter enable mode

service password-encryption

Directs the Cisco IOS software to encrypt the passwords, CHAP secrets and similar data saved in its configuration file

ip access-list {standard | extended} {acl-name | acl-number

Creates a standard or extended ACL

permit source <source-wildcar>

Adds permit rules for a Standard ACL

deny source <source-wildcard>

Adds deny rules for an Extended ACL

ip access-group {acl-name | acl-number} {in | out}

Applies an ACL to an interface

show access-lists [acl-name | acl-number]

Displays ACL configuration

no ip access-list {standard | extended} {acl-name | acl-number}

Removes an ACL

ip domain-name name

Configures a DNS domain name

crypto key generate rsa

Creates and stores (in a hidden location in flash memory) the keys that are required by SSH

transport input {telnet | ssh}

Defines whether Telnet or SSH access is allowed into this switch. Both values can be specified in a single command to allow both Telnet and SSH access, which are the default settings

ntp peer <ip-address>

Configures the software clock to synchronize a peer or to be synchronized by a peer

hostname <name>

Sets a hostname (if not already configured)

ip domain-name [domain-name]

Configures an IP domain name

crypto key generate rsa

Generates an RSA key pair for SSH

ip ssh version 2

Configures SSH version 2

username [username] privilege [level] secret [password]

Creates a local user account

Router(config)# line vty [line-range]

Router(config-line)# transport input ssh

Router(config-line)# login local

Configures VTY lines for SSH access

switchport port-security

Enables port security on the interface

switchport port-security maximum <number>

Sets the maximum number of secure MAC addresses on the port

switchport port-security mac-address {mac-addr | {sticky [mac-addr]}}

Adds a MAC address to the list of secure MAC addresses and optionally configures them as sticky on the interface

switchport port-security violation {shutdown | restrict | protect}

Sets the action to be taken when a security violation is detected

show port security [interface interface-id]

Displays information about security options configured on the interface

username <username> privilege <level> secret <password>

Creates a local user account

show users

Displays current user sessions

no username <username>

Removes a user account

security passwords min-length <length>

Sets password complexity requirements

ip address dhcp

Acquires an IP address on an interface via DHCP

ip dhcp pool <pool-name>

Configures a DHCP address pool on a DHCP server and enters DHCP Pool Configuration mode

domain-name <domain>

Specifies the domain name for a DHCP client

network network-number [mask]

Configures the network number and mask for a DHCP address pool primary or secondary subnet on a Cisco IOS DHCP server

ip dhcp excluded-address ip-address [last-ip-address]

Specifies IP addresses that a DHCP server should not assign to DHCP clients

ip helper-address address

Enables forwarding of UDP broadcasts, including BOOTP, received on an interface

default-router address [address2 ... address8]

Specifies the default gateway for a DHCP client

logging on

Enables logging globally

logging host {ip-address | hostname}

Configures logging to a syslog server

logging trap level

Sets the logging severity level

terminal monitor

Sends a copy of all syslog messages, including debug messages, to the Telnet or SSH user who issues this command

snmp-server community <community-string> [RO|RW]

Enables SNMP

snmp-server location <location-string>

Configures the SNMP server location

snmp-server enable traps

Enables SNMP traps

copy running-config startup-config

Saves the running configuration to startup configurationEnables logging globally

copy running-config tftp

Copies the running configuration to a TFTP server

copy startup-config tftp

Copies the startup configuration to a TFTP server

copy tftp: running-config

Copies the configuration from a TFTP server to the device

copy running-config flash:<file name>

Copies the configuration to flash

copy {ftp: flash:}

Copies a new IOS image to the device using TFTP or FTP

aaa new-model

Enables AAA

radius-server host {ip-address | hostname} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string]

Configures the RADIUS server

radius-server key {0 string | 7 string | string}

Sets the RADIUS key

aaa authentication login {default | list-name} method1

Configures AAA authentication

aaa authorization {network | exec | commands level | reverse-access | configuration} {default | list-name} method1

Configures AAA authorization

aaa accounting {system | network | exec | connection | commands level} {default | list-name} {start-stop | stop-only | none} [method1

Configures AAA accounting