I’ve spent enough late nights in a lab (and in production, where mistakes actually hurt) typing the same Cisco IOS commands over and over that I finally decided to put everything I actually use into one place. This isn’t a copy-paste of a Cisco documentation page — it’s the cheat sheet I wish I’d had when I was studying for my CCNA and later when I was troubleshooting a flapping OSPF neighbor at 2 AM. Whether you’re prepping for a certification exam, configuring a new switch stack, or trying to figure out why a router won’t pass traffic, this guide covers the commands, syntax, and real-world context you need.
I’ll walk through IOS modes, interface and VLAN configuration, routing protocols, switching, security, NAT, and troubleshooting — with tables you can scan quickly and explanations for when I actually reach for each command.
Table of Contents
- Cisco IOS Command Modes
- Basic Navigation and Help Commands
- Device Configuration Basics
- Interface Configuration
- VLAN and Trunking Configuration
- Spanning Tree Protocol (STP)
- IP Addressing and Static Routing
- Dynamic Routing Protocols (RIP, EIGRP, OSPF)
- Access Control Lists (ACLs)
- NAT and PAT Configuration
- Security Hardening Commands
- Show Commands for Troubleshooting
- Debug Commands
- Saving, Backing Up, and Restoring Configurations
- Best Practices
- Common Mistakes I See Beginners Make
- Troubleshooting Workflow
- FAQs
- Interview Questions
- Printable Quick-Reference Summary
- Official Documentation Links
1. Cisco IOS Command Modes
Before I touch a single interface, I make sure I understand which mode I’m in — this trips up more beginners than anything else. Every IOS device has a hierarchy of modes, and the prompt tells you exactly where you are.
| Mode | Prompt Example | Purpose |
|---|---|---|
| User EXEC | Router> | Limited, view-only mode. Basic monitoring. |
| Privileged EXEC | Router# | Full view access, no config changes yet. |
| Global Configuration | Router(config)# | Device-wide settings. |
| Interface Configuration | Router(config-if)# | Settings for a specific interface. |
| Line Configuration | Router(config-line)# | Console, VTY, AUX line settings. |
| Router Configuration | Router(config-router)# | Routing protocol settings. |
| VLAN Configuration | Router(config-vlan)# | VLAN database settings. |
I move between them like this:
Router> enable
Router# configure terminal
Router(config)# interface gigabitethernet0/1
Router(config-if)# exit
Router(config)# exit
Router#
end or Ctrl+Z takes me straight back to privileged EXEC from anywhere in the config hierarchy, which I use constantly instead of typing exit multiple times.
2. Basic Navigation and Help Commands
| Command | What It Does |
|---|---|
? | Lists available commands at current mode |
command ? | Shows valid keywords/arguments for a command |
Tab | Auto-completes a partial command |
Ctrl+A | Move cursor to beginning of line |
Ctrl+E | Move cursor to end of line |
Ctrl+C | Cancels current command |
Ctrl+Shift+6 | Breaks a hung ping/traceroute |
show history | Shows command history buffer |
terminal history size 256 | Increases history buffer size |
no prefix | Negates/removes a command (e.g., no shutdown) |
One habit I picked up early: typing command ? before I commit to a full line saves me from guessing syntax, especially on ACLs and routing protocol commands where the keyword order matters.
3. Device Configuration Basics
These are the first commands I run on any new device, physical or virtual.
Router# configure terminal
Router(config)# hostname CoreSW01
CoreSW01(config)# enable secret MyStrongP@ss123
CoreSW01(config)# service password-encryption
CoreSW01(config)# banner motd #Authorized Access Only#
CoreSW01(config)# no ip domain-lookup
hostname— renames the device so I can identify it instantly in a topology full of similarly-configured boxes.enable secret— sets an MD5-hashed privileged mode password (always use this overenable password, which is stored in plaintext).service password-encryption— weakly obfuscates other plaintext passwords in the running config. It’s not real encryption, but it stops shoulder-surfing.no ip domain-lookup— I add this immediately because without it, IOS tries to DNS-resolve every mistyped command, which means a 10+ second hang every time I fat-finger something.
4. Interface Configuration
| Command | Purpose |
|---|---|
interface gi0/1 | Enter interface config mode |
ip address 192.168.1.1 255.255.255.0 | Assign IP address |
no shutdown | Enable the interface (interfaces are disabled by default on routers) |
shutdown | Administratively disable the interface |
description Uplink-to-Core | Add a text label for documentation |
duplex full | Set duplex mode |
speed 1000 | Set interface speed |
switchport mode access | Set switch port as access port |
switchport access vlan 10 | Assign access port to VLAN 10 |
Example — configuring a router interface:
Router(config)# interface gigabitethernet0/0
Router(config-if)# description WAN-Link-ISP
Router(config-if)# ip address 203.0.113.5 255.255.255.252
Router(config-if)# no shutdown
Expected output when it comes up:
%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
If I only see the first message and not the second, I know Layer 1 is fine but something at Layer 2 (encapsulation mismatch, keepalives, etc.) is wrong.
5. VLAN and Trunking Configuration
VLANs are where I spend a huge chunk of my switching time, so I keep this section handy.
Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
Assigning an access port:
Switch(config)# interface fastethernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Configuring a trunk port (802.1Q):
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 99
I always change the native VLAN away from VLAN 1 (native vlan 99 above) as a basic security measure — leaving it default makes VLAN hopping attacks easier.
| Command | Purpose |
|---|---|
show vlan brief | Lists VLANs and assigned ports |
show interfaces trunk | Shows active trunk links |
switchport nonegotiate | Disables DTP so the port won’t auto-negotiate trunking |
6. Spanning Tree Protocol (STP)
Loop prevention is non-negotiable in any switched network with redundant links.
| Command | Purpose |
|---|---|
show spanning-tree | Displays STP status per VLAN |
spanning-tree mode rapid-pvst | Enables Rapid PVST+ |
spanning-tree vlan 10 root primary | Forces this switch to be root bridge for VLAN 10 |
spanning-tree portfast | Speeds up port transition for access ports (end devices only) |
spanning-tree bpduguard enable | Disables port if it receives a BPDU (protects against rogue switches) |
I only ever enable portfast and bpduguard together on access ports connecting to end-user devices — never on uplinks to other switches.
7. IP Addressing and Static Routing
Router(config)# ip route 192.168.20.0 255.255.255.0 192.168.10.2
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
The second line is a default route — I use it constantly on edge routers so any traffic not matching a more specific route heads out to the ISP.
| Command | Purpose |
|---|---|
ip route <dest-net> <mask> <next-hop> | Static route |
ip route <dest-net> <mask> <exit-interface> | Static route via interface |
show ip route | Displays routing table |
show ip interface brief | Quick view of interfaces, IPs, and status |
8. Dynamic Routing Protocols
RIP (rarely used today, but still shows up on exams)
Router(config)# router rip
Router(config-router)# version 2
Router(config-router)# network 192.168.1.0
Router(config-router)# no auto-summary
EIGRP
Router(config)# router eigrp 100
Router(config-router)# network 192.168.1.0 0.0.0.255
Router(config-router)# no auto-summary
OSPF
Router(config)# router ospf 1
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# router-id 1.1.1.1
| Command | Purpose |
|---|---|
show ip protocols | Shows configured routing protocols and timers |
show ip ospf neighbor | Verifies OSPF adjacency states |
show ip eigrp neighbors | Verifies EIGRP neighbor table |
show ip route ospf | Filters routing table to OSPF-learned routes |
When an OSPF neighbor won’t form an adjacency, I check — in this order — matching subnet/mask, matching area number, matching authentication (if configured), and matching hello/dead timers. Nine times out of ten it’s a mismatched area or subnet.
9. Access Control Lists (ACLs)
Standard ACL (filters by source IP only):
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any
Router(config)# interface gi0/1
Router(config-if)# ip access-group 10 in
Extended ACL (filters by source, destination, protocol, port):
Router(config)# access-list 110 permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config)# access-list 110 deny ip any any
Named ACL (easier to read and edit):
Router(config)# ip access-list extended BLOCK-TELNET
Router(config-ext-nacl)# deny tcp any any eq 23
Router(config-ext-nacl)# permit ip any any
I always remember that ACLs have an implicit deny any at the end — if I forget my final permit, I’ve just blocked everything.
| Command | Purpose |
|---|---|
show access-lists | Displays all configured ACLs and hit counters |
show ip interface gi0/1 | Shows which ACL is applied to an interface |
10. NAT and PAT Configuration
Static NAT:
Router(config)# ip nat inside source static 192.168.1.10 203.0.113.10
Dynamic NAT with a pool:
Router(config)# ip nat pool MYPOOL 203.0.113.20 203.0.113.30 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool MYPOOL
PAT (overload, most common in small offices):
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface gi0/0 overload
Router(config)# interface gi0/1
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# interface gi0/0
Router(config-if)# ip nat outside
| Command | Purpose |
|---|---|
show ip nat translations | Shows current NAT table |
show ip nat statistics | Shows NAT hits/misses and pool usage |
clear ip nat translation * | Clears the NAT table |
11. Security Hardening Commands
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local
Router(config-line)# exit
Router(config)# username admin privilege 15 secret StrongPass!
Router(config)# ip domain-name mynetwork.local
Router(config)# crypto key generate rsa modulus 2048
| Command | Purpose |
|---|---|
transport input ssh | Disables Telnet, allows only SSH on VTY lines |
login local | Requires local username/password for login |
service password-encryption | Encrypts plaintext passwords in config |
ip ssh version 2 | Forces SSHv2 instead of the weaker SSHv1 |
access-class 10 in | Restricts VTY access to hosts matching ACL 10 |
I disable Telnet on every device I touch that has any exposure beyond an isolated lab — it sends credentials in plaintext, which is indefensible in 2026.
12. Show Commands for Troubleshooting
| Command | What It Tells Me |
|---|---|
show running-config | Active configuration in memory |
show startup-config | Configuration saved to NVRAM |
show ip interface brief | Interface status and IP addresses at a glance |
show interfaces | Detailed interface stats, errors, drops |
show cdp neighbors | Directly connected Cisco devices |
show cdp neighbors detail | Adds IP address and platform info |
show version | IOS version, uptime, hardware, license info |
show ip route | Full routing table |
show mac address-table | Switch MAC-to-port mappings |
show vlan brief | VLAN-to-port assignments |
show spanning-tree | STP topology and root bridge info |
show processes cpu | CPU utilization by process |
show logging | Recent system log messages |
13. Debug Commands
Debugging is powerful but I treat it with respect — running debug commands on a production router with high traffic can spike CPU and cause an outage.
| Command | Purpose |
|---|---|
debug ip packet | Logs IP packet details (use sparingly) |
debug ip routing | Shows routing table changes in real time |
debug ip ospf adj | Troubleshoots OSPF adjacency issues |
debug eigrp packets | Shows EIGRP packet exchange |
undebug all or u all | Turns off all active debugging immediately |
My rule: always pair a debug with a plan to undebug all right after, and never run broad debugs on a device with heavy production traffic without a maintenance window.
14. Saving, Backing Up, and Restoring Configurations
Router# copy running-config startup-config
Router# copy running-config tftp
Router# copy tftp running-config
Router# write memory
Router# erase startup-config
Router# reload
copy running-config startup-config(or the shortcutwr/write memory) — I run this after every change I intend to keep. IOS does not auto-save.copy running-config tftp— backs the config up off-box, which I do before any major change.erase startup-configfollowed byreload— resets a device to factory defaults; I use this when decommissioning or repurposing hardware.
15. Best Practices
- Always back up the running config before major changes —
copy run tftptakes ten seconds and can save hours. - Use
enable secret, never the olderenable password. - Document every interface with a
description. - Standardize VLAN numbering and naming across the network so any engineer can jump in and understand the layout.
- Disable unused ports and put them in an unused/quarantine VLAN.
- Use SSH, never Telnet, for remote management.
- Set up logging to a central syslog server so you’re not relying on a device’s small local buffer during an incident.
- Version-control your configs (even a simple Git repo with exported configs beats nothing).
- Test ACL changes on a single interface before applying network-wide.
16. Common Mistakes I See Beginners Make
- Forgetting
no shutdownon router interfaces — they’re disabled by default, unlike switch ports. - Assuming
copy run starthappens automatically — it doesn’t; a power loss without saving wipes your changes. - Writing an ACL without a final explicit
permitand being surprised when everything gets blocked by the implicit deny. - Mismatching subnet masks between
networkstatements in a routing protocol and the interface’s actual address. - Leaving the native VLAN on trunk ports as VLAN 1 by default.
- Applying an ACL in the wrong direction (
invsout) relative to the router. - Using
enable passwordinstead ofenable secretand assuming it’s secure. - Not testing connectivity with
pingandtraceroutebefore assuming a routing protocol is broken.
17. Troubleshooting Workflow
When something’s not working, I follow the same mental checklist every time, working up the OSI model:
- Physical — Is the interface up/up? Check
show ip interface briefand cabling. - Data Link — Correct VLAN, trunk encapsulation, STP not blocking the port?
- Network — Correct IP address, subnet mask, and routing table entry? Can I
pingthe next hop? - Transport/Application — Is an ACL or NAT rule blocking the specific port or protocol?
- Compare configs —
show running-configagainst a known-good backup to spot unintended changes. - Check logs —
show loggingoften points straight at the problem (interface flaps, ACL denies, etc.).
18. FAQs
What’s the difference between enable password and enable secret? enable secret is hashed with MD5 by default and always takes priority over enable password, which stores the password in plaintext in the config. Always use enable secret.
Why won’t my router interface come up even after no shutdown? Check the physical cable, confirm the interface isn’t in error-disabled state (show interfaces status), and verify duplex/speed settings match on both ends.
Do I need to save my config after every command? No — but if you don’t run copy run start (or write memory) before a reload or power loss, all unsaved changes are lost.
What’s the difference between a router and a Layer 3 switch? A Layer 3 switch can perform routing between VLANs at wire speed using ASICs, while a traditional router (or Layer 3 switch with limited ports) is typically used more for WAN connectivity and complex routing policies. Functionally, both can route IP traffic.
Why use OSPF over RIP? RIP is a distance-vector protocol limited to 15 hops with slow convergence. OSPF is link-state, converges much faster, supports much larger networks, and uses cost (based on bandwidth) instead of hop count.
What does the implicit deny at the end of an ACL mean? Every ACL ends with an unwritten deny any (or deny ip any any for extended ACLs). If traffic doesn’t match any permit statement, it’s dropped.
19. Interview Questions
- Explain the difference between
running-configandstartup-config. - Walk through what happens, step by step, when a switch receives a frame with an unknown destination MAC address.
- What’s the difference between a trunk port and an access port?
- How does STP prevent Layer 2 loops, and what’s the role of the root bridge?
- Compare distance-vector and link-state routing protocols.
- What’s the difference between NAT overload (PAT) and static NAT?
- How would you troubleshoot two routers that won’t form an OSPF neighbor relationship?
- What’s the purpose of
bpduguardand where would you enable it? - Explain the three-way TCP handshake and how an ACL might interact with it.
- What is VLAN hopping and how do you prevent it?
20. Printable Quick-Reference Summary
| Task | Command |
|---|---|
| Enter privileged mode | enable |
| Enter global config | configure terminal |
| Set hostname | hostname <name> |
| Set enable password | enable secret <password> |
| Configure interface IP | ip address <ip> <mask> |
| Enable interface | no shutdown |
| Create VLAN | vlan <id> then name <name> |
| Assign access port | switchport access vlan <id> |
| Configure trunk | switchport mode trunk |
| Static route | ip route <net> <mask> <next-hop> |
| Enable OSPF | router ospf <id> then network <net> <wildcard> area <id> |
| Standard ACL | access-list <#> permit/deny <src> |
| PAT/NAT overload | ip nat inside source list <acl> interface <int> overload |
| Enable SSH only | transport input ssh |
| Save config | copy running-config startup-config |
| View interfaces | show ip interface brief |
| View routing table | show ip route |
| View neighbors | show cdp neighbors detail |
| View VLANs | show vlan brief |
21. Official Documentation Links
- Cisco IOS Configuration Fundamentals: https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-software-releases-listing.html
- Cisco Command Reference Guides: https://www.cisco.com/c/en/us/support/index.html
- Cisco IOS Security Command Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/config_library/config-library.html
- Cisco Learning Network (certification resources): https://learningnetwork.cisco.com/
I keep coming back to this cheat sheet myself whenever I’m setting up a new environment or refreshing for an exam — bookmark it, print it, or drop it into your own notes. Networking is one of those skills where muscle memory matters, and typing these commands enough times is what actually makes them stick.