Cisco IOS Commands
IOS has three places you type: user mode, privileged mode and configuration mode, and every command belongs to one of them. Learn the mode first and the prompt tells you where you are. The show commands below are the ones that answer most troubleshooting questions before any configuration changes.
Cisco IOS Commands · firsttry.app/cheatsheets/cisco-ios-commands · original reference written from published exam objectives. Not affiliated with any certification body.
Modes and navigation
| Command | What it does |
|---|---|
| enable | User EXEC to privileged EXEC (prompt changes from > to #) |
| configure terminal | Enter global configuration mode |
| interface GigabitEthernet0/1 | Enter interface configuration |
| line vty 0 4 | Enter configuration for the five remote terminal lines |
| exit | Up one level |
| end | Straight back to privileged EXEC from any config level |
| do show ip interface brief | Run a privileged command from inside config mode |
| copy running-config startup-config | Save the running configuration to NVRAM |
| write memory | Older equivalent of the copy command above |
| reload | Reboot the device |
Show commands that answer most questions
| Command | What it shows |
|---|---|
| show running-config | The active configuration |
| show startup-config | The saved configuration in NVRAM |
| show ip interface brief | Every interface, its address, and up/down state |
| show interfaces | Counters, errors, duplex and speed per interface |
| show ip route | The routing table with the code letter for each route source |
| show vlan brief | VLANs and the access ports assigned to each |
| show interfaces trunk | Trunk ports, encapsulation, native and allowed VLANs |
| show mac address-table | Learned MAC addresses and the port each was seen on |
| show ip arp | The IP-to-MAC mappings the device has resolved |
| show cdp neighbors | Directly connected Cisco devices and the ports between them |
| show spanning-tree | STP role and state per port, root bridge identity |
| show ip ospf neighbor | OSPF adjacencies and their state |
| show access-lists | Every ACL with per-line match counts |
| show version | IOS version, uptime, and the configuration register |
Interface, VLAN and trunk configuration
| Command | What it does |
|---|---|
| ip address 192.168.1.1 255.255.255.0 | Assign an IPv4 address and mask to an interface |
| no shutdown | Bring an interface up (router interfaces start shut down) |
| description Uplink to core | Label the interface |
| vlan 10 | Create VLAN 10 (then name with the name command) |
| switchport mode access | Make a port an access port |
| switchport access vlan 10 | Assign the access port to VLAN 10 |
| switchport mode trunk | Make a port a trunk |
| switchport trunk native vlan 99 | Set the untagged VLAN on a trunk |
| switchport trunk allowed vlan 10,20 | Restrict which VLANs cross the trunk |
| interface vlan 10 | Create the switched virtual interface for VLAN 10 |
| ip default-gateway 192.168.1.1 | Gateway for a Layer 2 switch's management traffic |
Routing
| Command | What it does |
|---|---|
| ip route 0.0.0.0 0.0.0.0 203.0.113.1 | Default static route via a next hop |
| ip route 10.2.0.0 255.255.0.0 10.1.1.2 | Static route to a network via a next hop |
| router ospf 1 | Start OSPF process 1 |
| network 10.0.0.0 0.255.255.255 area 0 | Put matching interfaces into OSPF area 0 (wildcard mask) |
| router-id 1.1.1.1 | Set the OSPF router ID explicitly |
| passive-interface GigabitEthernet0/2 | Advertise the network without forming adjacencies on that port |
| ip ospf cost 10 | Set the interface cost OSPF uses for path selection |
Access control lists
| Command | What it does |
|---|---|
| access-list 10 permit 192.168.1.0 0.0.0.255 | Standard numbered ACL matching a source network |
| ip access-list extended WEB | Create a named extended ACL |
| permit tcp any host 10.1.1.10 eq 443 | Allow TCP to one host on port 443 |
| deny ip any any | Explicit deny (an implicit one ends every ACL anyway) |
| ip access-group WEB in | Apply the ACL inbound on the current interface |
| access-class 10 in | Apply a standard ACL to VTY lines |
Device access and security basics
| Command | What it does |
|---|---|
| hostname CORE1 | Set the device name |
| enable secret Str0ngPass | Hashed privileged-mode password |
| service password-encryption | Obscure plaintext passwords in the configuration |
| username admin secret Str0ngPass | Local account with a hashed password |
| ip domain-name example.com | Needed before generating RSA keys for SSH |
| crypto key generate rsa | Generate the key pair SSH uses |
| transport input ssh | On VTY lines, accept SSH only |
| login local | On VTY lines, authenticate against local usernames |
| banner motd #Authorized access only# | Message shown before login |
Exams covered
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
6-5Automation and Programmability
Device configuration is exchanged over NETCONF. How is the configuration data encoded?
Architecture
From how many of the four character classes must an access point global password draw?
3-2Network Operations
A switch sends unsolicited alerts to the manager when a link drops. Which UDP port receives those?
Five free questions on every practice exam. No account, no card.