Ultimate Cisco Commands Cheat Sheet: IOS Configuration, Networking, and Troubleshooting

I’ve spent enough late nights in a lab (and in production, where mistakes actually hurt) typing the same Cisco IOS commands over and over that I finally decided to put everything I actually use into one place. This isn’t a copy-paste of a Cisco documentation page — it’s the cheat sheet I wish I’d had when I was studying for my CCNA and later when I was troubleshooting a flapping OSPF neighbor at 2 AM. Whether you’re prepping for a certification exam, configuring a new switch stack, or trying to figure out why a router won’t pass traffic, this guide covers the commands, syntax, and real-world context you need.

I’ll walk through IOS modes, interface and VLAN configuration, routing protocols, switching, security, NAT, and troubleshooting — with tables you can scan quickly and explanations for when I actually reach for each command.

Table of Contents

1. Cisco IOS Command Modes
2. Basic Navigation and Help Commands
3. Device Configuration Basics
4. Interface Configuration
5. VLAN and Trunking Configuration
6. Spanning Tree Protocol (STP)
7. IP Addressing and Static Routing
8. Dynamic Routing Protocols (RIP, EIGRP, OSPF)
9. Access Control Lists (ACLs)
10. NAT and PAT Configuration
11. Security Hardening Commands
12. Show Commands for Troubleshooting
13. Debug Commands
14. Saving, Backing Up, and Restoring Configurations
15. Best Practices
16. Common Mistakes I See Beginners Make
17. Troubleshooting Workflow
18. FAQs
19. Interview Questions
20. Printable Quick-Reference Summary
21. Official Documentation Links

1. Cisco IOS Command Modes

Before I touch a single interface, I make sure I understand which mode I’m in — this trips up more beginners than anything else. Every IOS device has a hierarchy of modes, and the prompt tells you exactly where you are.

Mode	Prompt Example	Purpose
User EXEC	Router>	Limited, view-only mode. Basic monitoring.
Privileged EXEC	Router#	Full view access, no config changes yet.
Global Configuration	Router(config)#	Device-wide settings.
Interface Configuration	Router(config-if)#	Settings for a specific interface.
Line Configuration	Router(config-line)#	Console, VTY, AUX line settings.
Router Configuration	Router(config-router)#	Routing protocol settings.
VLAN Configuration	Router(config-vlan)#	VLAN database settings.

I move between them like this:

Router> enable
Router# configure terminal
Router(config)# interface gigabitethernet0/1
Router(config-if)# exit
Router(config)# exit
Router#

end or Ctrl+Z takes me straight back to privileged EXEC from anywhere in the config hierarchy, which I use constantly instead of typing exit multiple times.

2. Basic Navigation and Help Commands

Command	What It Does
?	Lists available commands at current mode
command ?	Shows valid keywords/arguments for a command
Tab	Auto-completes a partial command
Ctrl+A	Move cursor to beginning of line
Ctrl+E	Move cursor to end of line
Ctrl+C	Cancels current command
Ctrl+Shift+6	Breaks a hung ping/traceroute
show history	Shows command history buffer
terminal history size 256	Increases history buffer size
no prefix	Negates/removes a command (e.g., no shutdown)

One habit I picked up early: typing command ? before I commit to a full line saves me from guessing syntax, especially on ACLs and routing protocol commands where the keyword order matters.

3. Device Configuration Basics

These are the first commands I run on any new device, physical or virtual.

Router# configure terminal
Router(config)# hostname CoreSW01
CoreSW01(config)# enable secret MyStrongP@ss123
CoreSW01(config)# service password-encryption
CoreSW01(config)# banner motd #Authorized Access Only#
CoreSW01(config)# no ip domain-lookup

• hostname — renames the device so I can identify it instantly in a topology full of similarly-configured boxes.
• enable secret — sets an MD5-hashed privileged mode password (always use this over enable password, which is stored in plaintext).
• service password-encryption — weakly obfuscates other plaintext passwords in the running config. It’s not real encryption, but it stops shoulder-surfing.
• no ip domain-lookup — I add this immediately because without it, IOS tries to DNS-resolve every mistyped command, which means a 10+ second hang every time I fat-finger something.

4. Interface Configuration

Command	Purpose
interface gi0/1	Enter interface config mode
ip address 192.168.1.1 255.255.255.0	Assign IP address
no shutdown	Enable the interface (interfaces are disabled by default on routers)
shutdown	Administratively disable the interface
description Uplink-to-Core	Add a text label for documentation
duplex full	Set duplex mode
speed 1000	Set interface speed
switchport mode access	Set switch port as access port
switchport access vlan 10	Assign access port to VLAN 10

Example — configuring a router interface:

Router(config)# interface gigabitethernet0/0
Router(config-if)# description WAN-Link-ISP
Router(config-if)# ip address 203.0.113.5 255.255.255.252
Router(config-if)# no shutdown

Expected output when it comes up:

%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

If I only see the first message and not the second, I know Layer 1 is fine but something at Layer 2 (encapsulation mismatch, keepalives, etc.) is wrong.

5. VLAN and Trunking Configuration

VLANs are where I spend a huge chunk of my switching time, so I keep this section handy.

Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit

Assigning an access port:

Switch(config)# interface fastethernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Configuring a trunk port (802.1Q):

Switch(config)# interface gigabitethernet0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 99

I always change the native VLAN away from VLAN 1 (native vlan 99 above) as a basic security measure — leaving it default makes VLAN hopping attacks easier.

Command	Purpose
show vlan brief	Lists VLANs and assigned ports
show interfaces trunk	Shows active trunk links
switchport nonegotiate	Disables DTP so the port won’t auto-negotiate trunking

6. Spanning Tree Protocol (STP)

Loop prevention is non-negotiable in any switched network with redundant links.

Command	Purpose
show spanning-tree	Displays STP status per VLAN
spanning-tree mode rapid-pvst	Enables Rapid PVST+
spanning-tree vlan 10 root primary	Forces this switch to be root bridge for VLAN 10
spanning-tree portfast	Speeds up port transition for access ports (end devices only)
spanning-tree bpduguard enable	Disables port if it receives a BPDU (protects against rogue switches)

I only ever enable portfast and bpduguard together on access ports connecting to end-user devices — never on uplinks to other switches.

7. IP Addressing and Static Routing

Router(config)# ip route 192.168.20.0 255.255.255.0 192.168.10.2
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

The second line is a default route — I use it constantly on edge routers so any traffic not matching a more specific route heads out to the ISP.

Command	Purpose
ip route <dest-net> <mask> <next-hop>	Static route
ip route <dest-net> <mask> <exit-interface>	Static route via interface
show ip route	Displays routing table
show ip interface brief	Quick view of interfaces, IPs, and status

8. Dynamic Routing Protocols

RIP (rarely used today, but still shows up on exams)

Router(config)# router rip
Router(config-router)# version 2
Router(config-router)# network 192.168.1.0
Router(config-router)# no auto-summary

EIGRP

Router(config)# router eigrp 100
Router(config-router)# network 192.168.1.0 0.0.0.255
Router(config-router)# no auto-summary

OSPF

Router(config)# router ospf 1
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# router-id 1.1.1.1

Command	Purpose
show ip protocols	Shows configured routing protocols and timers
show ip ospf neighbor	Verifies OSPF adjacency states
show ip eigrp neighbors	Verifies EIGRP neighbor table
show ip route ospf	Filters routing table to OSPF-learned routes

When an OSPF neighbor won’t form an adjacency, I check — in this order — matching subnet/mask, matching area number, matching authentication (if configured), and matching hello/dead timers. Nine times out of ten it’s a mismatched area or subnet.

9. Access Control Lists (ACLs)

Standard ACL (filters by source IP only):

Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any
Router(config)# interface gi0/1
Router(config-if)# ip access-group 10 in

Extended ACL (filters by source, destination, protocol, port):

Router(config)# access-list 110 permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config)# access-list 110 deny ip any any

Named ACL (easier to read and edit):

Router(config)# ip access-list extended BLOCK-TELNET
Router(config-ext-nacl)# deny tcp any any eq 23
Router(config-ext-nacl)# permit ip any any

I always remember that ACLs have an implicit deny any at the end — if I forget my final permit, I’ve just blocked everything.

Command	Purpose
show access-lists	Displays all configured ACLs and hit counters
show ip interface gi0/1	Shows which ACL is applied to an interface

10. NAT and PAT Configuration

Static NAT:

Router(config)# ip nat inside source static 192.168.1.10 203.0.113.10

Dynamic NAT with a pool:

Router(config)# ip nat pool MYPOOL 203.0.113.20 203.0.113.30 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool MYPOOL

PAT (overload, most common in small offices):

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface gi0/0 overload
Router(config)# interface gi0/1
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# interface gi0/0
Router(config-if)# ip nat outside

Command	Purpose
show ip nat translations	Shows current NAT table
show ip nat statistics	Shows NAT hits/misses and pool usage
clear ip nat translation *	Clears the NAT table

11. Security Hardening Commands

Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local
Router(config-line)# exit
Router(config)# username admin privilege 15 secret StrongPass!
Router(config)# ip domain-name mynetwork.local
Router(config)# crypto key generate rsa modulus 2048

Command	Purpose
transport input ssh	Disables Telnet, allows only SSH on VTY lines
login local	Requires local username/password for login
service password-encryption	Encrypts plaintext passwords in config
ip ssh version 2	Forces SSHv2 instead of the weaker SSHv1
access-class 10 in	Restricts VTY access to hosts matching ACL 10

I disable Telnet on every device I touch that has any exposure beyond an isolated lab — it sends credentials in plaintext, which is indefensible in 2026.

12. Show Commands for Troubleshooting

Command	What It Tells Me
show running-config	Active configuration in memory
show startup-config	Configuration saved to NVRAM
show ip interface brief	Interface status and IP addresses at a glance
show interfaces	Detailed interface stats, errors, drops
show cdp neighbors	Directly connected Cisco devices
show cdp neighbors detail	Adds IP address and platform info
show version	IOS version, uptime, hardware, license info
show ip route	Full routing table
show mac address-table	Switch MAC-to-port mappings
show vlan brief	VLAN-to-port assignments
show spanning-tree	STP topology and root bridge info
show processes cpu	CPU utilization by process
show logging	Recent system log messages

13. Debug Commands

Debugging is powerful but I treat it with respect — running debug commands on a production router with high traffic can spike CPU and cause an outage.

Command	Purpose
debug ip packet	Logs IP packet details (use sparingly)
debug ip routing	Shows routing table changes in real time
debug ip ospf adj	Troubleshoots OSPF adjacency issues
debug eigrp packets	Shows EIGRP packet exchange
undebug all or u all	Turns off all active debugging immediately

My rule: always pair a debug with a plan to undebug all right after, and never run broad debugs on a device with heavy production traffic without a maintenance window.

14. Saving, Backing Up, and Restoring Configurations

Router# copy running-config startup-config
Router# copy running-config tftp
Router# copy tftp running-config
Router# write memory
Router# erase startup-config
Router# reload

• copy running-config startup-config (or the shortcut wr / write memory) — I run this after every change I intend to keep. IOS does not auto-save.
• copy running-config tftp — backs the config up off-box, which I do before any major change.
• erase startup-config followed by reload — resets a device to factory defaults; I use this when decommissioning or repurposing hardware.

15. Best Practices

• Always back up the running config before major changes — copy run tftp takes ten seconds and can save hours.
• Use enable secret, never the older enable password.
• Document every interface with a description.
• Standardize VLAN numbering and naming across the network so any engineer can jump in and understand the layout.
• Disable unused ports and put them in an unused/quarantine VLAN.
• Use SSH, never Telnet, for remote management.
• Set up logging to a central syslog server so you’re not relying on a device’s small local buffer during an incident.
• Version-control your configs (even a simple Git repo with exported configs beats nothing).
• Test ACL changes on a single interface before applying network-wide.

16. Common Mistakes I See Beginners Make

• Forgetting no shutdown on router interfaces — they’re disabled by default, unlike switch ports.
• Assuming copy run start happens automatically — it doesn’t; a power loss without saving wipes your changes.
• Writing an ACL without a final explicit permit and being surprised when everything gets blocked by the implicit deny.
• Mismatching subnet masks between network statements in a routing protocol and the interface’s actual address.
• Leaving the native VLAN on trunk ports as VLAN 1 by default.
• Applying an ACL in the wrong direction (in vs out) relative to the router.
• Using enable password instead of enable secret and assuming it’s secure.
• Not testing connectivity with ping and traceroute before assuming a routing protocol is broken.

17. Troubleshooting Workflow

When something’s not working, I follow the same mental checklist every time, working up the OSI model:

1. Physical — Is the interface up/up? Check show ip interface brief and cabling.
2. Data Link — Correct VLAN, trunk encapsulation, STP not blocking the port?
3. Network — Correct IP address, subnet mask, and routing table entry? Can I ping the next hop?
4. Transport/Application — Is an ACL or NAT rule blocking the specific port or protocol?
5. Compare configs — show running-config against a known-good backup to spot unintended changes.
6. Check logs — show logging often points straight at the problem (interface flaps, ACL denies, etc.).

18. FAQs

What’s the difference between enable password and enable secret? enable secret is hashed with MD5 by default and always takes priority over enable password, which stores the password in plaintext in the config. Always use enable secret.

Why won’t my router interface come up even after no shutdown? Check the physical cable, confirm the interface isn’t in error-disabled state (show interfaces status), and verify duplex/speed settings match on both ends.

Do I need to save my config after every command? No — but if you don’t run copy run start (or write memory) before a reload or power loss, all unsaved changes are lost.

What’s the difference between a router and a Layer 3 switch? A Layer 3 switch can perform routing between VLANs at wire speed using ASICs, while a traditional router (or Layer 3 switch with limited ports) is typically used more for WAN connectivity and complex routing policies. Functionally, both can route IP traffic.

Why use OSPF over RIP? RIP is a distance-vector protocol limited to 15 hops with slow convergence. OSPF is link-state, converges much faster, supports much larger networks, and uses cost (based on bandwidth) instead of hop count.

What does the implicit deny at the end of an ACL mean? Every ACL ends with an unwritten deny any (or deny ip any any for extended ACLs). If traffic doesn’t match any permit statement, it’s dropped.

19. Interview Questions

• Explain the difference between running-config and startup-config.
• Walk through what happens, step by step, when a switch receives a frame with an unknown destination MAC address.
• What’s the difference between a trunk port and an access port?
• How does STP prevent Layer 2 loops, and what’s the role of the root bridge?
• Compare distance-vector and link-state routing protocols.
• What’s the difference between NAT overload (PAT) and static NAT?
• How would you troubleshoot two routers that won’t form an OSPF neighbor relationship?
• What’s the purpose of bpduguard and where would you enable it?
• Explain the three-way TCP handshake and how an ACL might interact with it.
• What is VLAN hopping and how do you prevent it?

20. Printable Quick-Reference Summary

Task	Command
Enter privileged mode	enable
Enter global config	configure terminal
Set hostname	hostname <name>
Set enable password	enable secret <password>
Configure interface IP	ip address <ip> <mask>
Enable interface	no shutdown
Create VLAN	vlan <id> then name <name>
Assign access port	switchport access vlan <id>
Configure trunk	switchport mode trunk
Static route	ip route <net> <mask> <next-hop>
Enable OSPF	router ospf <id> then network <net> <wildcard> area <id>
Standard ACL	access-list <#> permit/deny <src>
PAT/NAT overload	ip nat inside source list <acl> interface <int> overload
Enable SSH only	transport input ssh
Save config	copy running-config startup-config
View interfaces	show ip interface brief
View routing table	show ip route
View neighbors	show cdp neighbors detail
View VLANs	show vlan brief

21. Official Documentation Links

• Cisco IOS Configuration Fundamentals: https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-software-releases-listing.html
• Cisco Command Reference Guides: https://www.cisco.com/c/en/us/support/index.html
• Cisco IOS Security Command Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/config_library/config-library.html
• Cisco Learning Network (certification resources): https://learningnetwork.cisco.com/

I keep coming back to this cheat sheet myself whenever I’m setting up a new environment or refreshing for an exam — bookmark it, print it, or drop it into your own notes. Networking is one of those skills where muscle memory matters, and typing these commands enough times is what actually makes them stick.