Commands To Move Between These Six Modes:

Command Mode Description

enable U Moves from User to Privileged mode.
logout U Exit User mode.
configure <terminal> P Moves from Privileged to Configure mode.
disable P Exit user mode.
Interface <interface description> G Enter interface configuration mode.
vlan vlan-id G Moves to configure vlan mode.
Vlan database P Enter vlan database from Privilege mode.
line G Enter line from Global configuration mode.
exit
G, R, L, V return to previous mode.
end

2. Fundamentals — Basic Configuration

The following are the fundamental Cisco IOS commands. These commands give you the necessary
base to move to more advanced and specific commands.

Command Mode Description

show version U,P Display information about IOS and router.
show interfaces U,P Display physical attributes of the router’s interfaces.
show ip route U,P Display the current state of the routing table.
show access-lists P Display current configured ACLs and their contents.
show ip interface brief P Displays a summary of the status for each interface.
show running-config P Display the current configuration.
show startup-config P Display the configuration at startup.
enable U Acces Privilege mode
config terminal P Access Configuration mode.
interface <int> G Enter interface configuration.
ip address <ip address> <mask> I Assign an IP address to the specified interface.
shutdown
I Turn off or turn on an interface. Use both to reset.
no shutdown

description <name-string> I Set a description to the interface.

show ip interface <type number>
show running-config interface
interface <slot/number>
hostname <name>
enable secret <password>
copy running-config startup-config
Displays the usability status of the protocols for the
U,P
interfaces.
Displays the running configuration for a specific
P
interface.
G Set a hostname for the Cisco device.
G Set an “enable” secret password.
P Saves the current (running) configuration in the startup

copy startup-config running-config P
copy from-location to-location
erase nvram
reload
erase startup-config
3. Network Access
This section covers all popular Cisco’s network access protocols. From how to configure and verify
VLANs, trunks, to Layer 2 discovery protocols like CDP and LLDP. We’ll also cover simple
Etherchannel, Rapid PVST+ Spanning Tree Protocol configuration.
Command
cdp run
no cdp run
show cdp
show cdp neighbors
lldp run
no lldp run
show lldp
show lldp neighbors
show mac address-table
spanning-tree mode rapid-pvst
spanning-tree vlan <1-4094>
priority <0-61440>
spanning-tree vlan <1-4094> root
primary
no spanning-tree vlan <1-4094>
show spanning-tree summary
show spanning-tree detail
show vlan
configuration into the NVRAM. The command saves
the configuration so when the device reloads, it loads
the latest configuration file.
It saves (overwrites) the startup configuration into the
running configuration.
It copies a file (or set of files) from a location to
P
another location.
Delete the current startup configuration files. The
G
command returns the device to its factory default.
Reboot the device. The NVRAM will take the latest
G
configuration.
Erase the NVRAM filesystem. The command achieves
G
the similar outcome as “erase nvram”
Mode Description
The “cdp run” command enables Cisco Discovery
P
Protocol. The “no cdp run” disables it.
P Display global information for CDP.
P Display all CDP neighbors.
The “lldp run” command enables the LLDP Protocol.
P
The “no lldp run” disables it.
P Displays global information for LLDP
P Show all LLDP neighbors.
P Display all the MAC address entries in a table.
A global configuration command that configures the
G
device for Rapid Per VLAN Spanning Tree protocol.
G Manually set the bridge priority per vlan.
G Make the switch the root of the SP.
G Disable SP on the specific VLAN.
P Show a summary of all SP instances and ports.
Show detailed information of each port in the
P
spanning-tree process.
Lists each VLAN and all interfaces assigned to that
P
VLAN. The output does not include trunks.
show vlan brief
show interfaces switchport
show interfaces trunk
vlan <1-4094>
name <name>
switchport mode access
switchport access vlan <>
interface range < >
channel-group <number>
no switchport access vlan <>
show vtp status
vtp mode <server | client |
transparent>
switchport mode trunk
switchport trunk native vlan <>
switchport trunk allowed vlan <>
switchport trunk encapsulation
dot1q
4. IP Connectivity
This section includes some of the most simple yet useful ip connectivity IOS commands. From
displaying a routing table, creating static, to default route. We also include dynamic routes with OSPF.
Command
Show ip route
Show ip route ospf
ip default-gateway <ip_address>
ip route <network> <mask> <next
hop>
no ip route <network> <mask>
<next hop>
ip route 0.0.0.0 0.0.0.0 <nex thop>
router ospf <process ID>
show ip ospf interface
P Displays vlan information in brief
Display configuration settings about all the switch port
P
interfaces.
Display information about the operational trunks along
P
with their VLANs.
Enter VLAN configuration mode and create a VLAN
G
with an associated number ID.
Within the VLAN configuration mode, assign a name
V
to the VLAN
In the interface configuration mode, the command
I
assigns the interface link type as an access link.
I Assign this interface to specific VLAN.
Access interface range configuration mode from
I – range
Interface Configuration.
Assign the Etherchannel. Set the interface range to a
I – range
channel group.
Remove VLAN assignment from interface. It returns to
I
default VLAN 1
P Display all vtp status
In the global configuration mode, set the device as
G
server, client, or transparent vtp mode.
An interface configuration mode. Set the interface link
I
type as a trunk link.
I Set native VLAN to a specific number.
I Allow specific VLANs on this trunk.
I Sets the 802.1Q encapsulation on the trunk link.
Mode Description
P Show the routing table.
P Show routes created by the OSPF protocol.
G Set the default gateway for the router.
G Create a new static route
G Remove a specific static route.
G Configure a default route
Enable OSPF with an ID. The command will
G
open the router configuration mode.
P Display all the active OSPF interfaces
5. IP Services
This section shows the common commands for configuring NAT, DHCP, and DNS services. It also
includes simple and useful SNMP and Syslog commands for monitoring and logging.
Command
ip nat <inside | outside>
ip nat inside source <ACL No.>
<pool | static IP> <overload>
ip nat inside source static <local
IP> <global IP>
ip nat outside source static <ACL
No.> <pool | static IP>
ntp peer <ip-address>
ip dhcp excluded-address <first-ip-
G
address> <last-ip-address>
ip dhcp pool <name>
network <network ID> <mask>
default-router <IP address>
dns-server <IP address>
ip helper-address <ip address>
show ip dhcp pool
show ip dhcp binding
ip dns server
ip domain-lookup
ip name-server <IP address |
domain name>
snmp-server community
<community-string> ro
snmp-server community
<community-string> rw
snmp-server host <ip-address>
version <community-string>
Mode Description
Specific whether the interface is the inside or outside
I
of NAT.
Configure dynamic NAT. It instructs the router to
translate all addresses identified by the ACL on the
G
pool. To configure Port Address Translation (PAT) use
the “overload” at the end.
Create a static NAT from inside (local IP) to outside
G
(global IP)
Create a static NAT from outside (ACL) to inside (IP
G
pool)
Configure the time by synchronizing it from an NTP
G
server.
The IP addresses that the DHCP server should not
assign to the DHCP client.
Enters the DHCP pool configuration mode and creates
G
a new DHCP pool.
Inside the DHCP configuration mode. Define the
G – DHCP
address pool for the DHCP server.
Set the default gateway IP address for the DHCP
G – DHCP
clients.
G – DHCP Set the DNS server IP address for the DHCP clients.
Turns an interface into a DHCP bridge. The interface
I
redirects DHCP broadcast packets to a specific IP.
P Display information about the DHCP pool
Display information about all the current DHCP
P
bindings.
G Enable DNS service.
G Enable domain lookup service. DNS client
G Set a public DNS server.
G Enable SNMP Read-Only public community strings.
G Enable SNMP Read-Only private community strings.
G Specific the hosts to receive the SNMP traps
logging <ip address>
logging trap level
show logging
terminal monitor
sh ip ssh
6. Security
In this section, we include the most basic AAA configuration commands for Cisco IOS. We’ll also
include basic standard and extended ACLs and port security configuration commands.
Command
enable secret <password>
line vty 0 4
line console 0
password <password>
Login local
username <username> privilege
<level> secret <password>
service password-encryption
crypto key generate rsa
access-list
ip access-list
access-list access-list-number
<deny | permit}> source <source>
[log]
access-list access-list-number
<deny | permit}> protocol <> source
<source [ports]>destination
<destination [ports]> [Options]
ip access-class <access-list-name> L
<in | out>
no ip access-group <access-list-
G Determines the Syslog server to send log messages.
G Limit Syslog messages based on severity level
Shows the state logging (syslog). Shows the errors,
P events, and host addresses. It also shows SNMP
configuration and activity.
Enables debug and system’s error messages for the
P
current terminal.
P Verify SSH access into the device.
Mode Description
Set an “enable” secret password. Enable secret
G
passwords are hashed via the MD5 algorithm.
A global configuration command to access the virtual
terminal configuration. VTY is a virtual port used to
G
access the device via SSH and Telnet. 0 4 to allow five
simultaneous virtual connections
A global configuration command to access the console
G
configuration.
Once in line mode, set a password for those remote
L
sessions with the “password” command.
The authentication uses only locally configured
credentials.
Require a username with a specific password. Also
G
configure different levels of privilege.
Makes the device encrypt all passwords saved on the
G
configuration file.
Generate a set of RSA key pairs for your device. These
G
keys may be used for remote access via SSH.
G Defined a numbered ACL
G Defined an IPv4 ACL.
G Create a standard ACL.
G Create an extended ACL.
A line configuration command mode. It restricts
incoming and outgoing connections to a particular vty
line. Use “no” to remove the restriction.
name> <in | out>
show ip access-list
switchport mode access
switchport port-security
switchport port-security maximum
<max value>
switchport port-security mac-
address <mac-address | sticky
[mac-address]>
switchport port-security violation
<shutdown | restrict | protect>
show port security
7. Troubleshooting Commands
In the final section of this cheat sheet we’ll include basic troubleshooting commands. We already
included some of these commands on previous sections, but they are also very useful when it comes
to troubleshooting.
Command
ping <target IP | hostname>
<repeat Count [5]> <source [IP |
interface]
traceroute <target IP |
P connectivity on a hop by hop
hostname><source [IP | interface]
telnet
show interface
speed <10 | 100 | 1000 | auto>
duplex <auto | full | half>
show interface | include
fastethernet | input errors
show ip interface
P Show all IPv4 ACLs
From the interface configuration mode, this command
assigns the interface link type as an access link.
I
I enable dynamic port security on the specific interface.
Specify the maximum number of secure MAC
I
addresses on the specific interface.
Force a specific mac-address to the interface. Also use
I the “sticky” option to make the interface remember the
first mac-address connected to the interface.
Define the action to be taken when a violation is
I
detected on the port.
P Display the port security configuration on each interface.
Mode Description
Diagnose connectivity with
P extended ping. Check reachability,
RRTs, and packet loss.
Use traceroute to diagnose
basis.
Use Telnet to check for listening
P ports (1 to 65535) on a remote
device.
Use this command to discover the
physical attributes; find duplex,
P link types, and speed mismatches.
Both ends must match. Also use
this command to find errors.
Set the speed of an interface. Or
I
configure it as auto.
I Set the interface duplex.
This command searches across
P all interfaces and outputs the ones
that include input errors.
P Use this command to discover the
status for all the protocols on that
 interface.
shutdown
Interface configuration mode.
I
no shutdown Restart an interface

This command is useful for

show ip route P determining the route of ip
packets.
Discover basic information about
show cdp neighbors P neighboring Cisco’s routers and
switches
Display the contents of the mac-
show mac address-table P
address table.
Show vlan
Find vlan status and interfaces
P
Show vlan brief assigned to the vlans.

Use this command to discover the

show vtp status P
current VTP mode of the device.
Check the allowed VLANs on both
show interfaces trunk P
ends of the trunk.
If Netflow is enabled, this
show ip flow top-talkers P command is very useful to
troubleshoot top talkers.