The Intro left you at a prompt with a router that has no addresses and every port switched off. This page turns it into a network you can use: one Ethernet cable from your laptop to the router, an IP address on each end, a successful ping, then the router handing out addresses by itself, and finally SSH — so the console cable goes back in the drawer. Each step is one idea, in the order you'd discover it. Same laptop, same router, one extra cable.
Here's the whole lab for this page. Two devices, two cables:
The console cable stays plugged in the whole time — it's how you type commands. The new Ethernet cable is the actual network. By Step 06 the network will be good enough that you won't need the console any more.
Every device on a network needs a number so the others can find it, the way every house on a street needs a number. An IP address like 192.168.10.1 is four numbers from 0 to 255 with dots between them. The first three (192.168.10) are the street; the last one (1) is the house. Devices on the same street can talk to each other directly. That's it — everything else on this page is either giving a device a house number or checking two devices are on the same street.
The subnet mask is how you tell the router where the street part ends. 255.255.255.0 means “the first three numbers are the street, the last one is the house.” You'll also see it written as /24, which means the same thing (24 bits — three numbers of eight bits each). For this whole series the street is 192.168.10 and the mask is always 255.255.255.0. Memorise that pair and you won't have to think about it again.
Addresses starting 192.168., 10., or 172.16–31. are reserved for private networks — they're never used on the public Internet, so anyone can use them at home without asking. Your home router almost certainly hands out 192.168.0.x or 192.168.1.x. This series uses 192.168.10.x deliberately, so the lab can never collide with your real home network.
Your laptop is 192.168.10.50 and the router is 192.168.10.1, both with mask 255.255.255.0. A friend asks why they can talk to each other but a laptop at 192.168.20.50 couldn't. Explain it using the street-and-house idea.
The mask says the first three numbers are the street name. 192.168.10.50 and 192.168.10.1 are both on the street called 192.168.10, so they're neighbours and can shout across the road. 192.168.20.50 lives on a different street, 192.168.20. To reach a different street you need something that sits on both — a router with one address on each — and right now there isn't one. Same street: direct. Different street: needs a router in between.
Plug an ordinary Ethernet cable from your laptop's Ethernet port into GE 0/1 on the router. (If your laptop has no Ethernet port, a USB-to-Ethernet adapter is all you need.) Nothing happens yet — the port's light stays off — because Cisco ships every port shut down. Now, at the console, go into that interface and set it up:
configure terminal interface GigabitEthernet0/1 description LAN - to laptop ip address 192.168.10.1 255.255.255.0 no shutdown end
Four things to notice:
(config-if)# — interface configuration mode. Everything you type now applies to GE 0/1 only, until you exit or end.description is a label for humans. The router ignores it, but six months from now show ip interface brief with descriptions is how you'll remember what's plugged in where. Always add one.no shutdown is the on switch. Most Cisco commands are undone by putting no in front, and a port is off by default (shutdown), so turning it on is no shutdown. Everyone abbreviates it no shut.Confirm it with the command from Part 1:
show ip interface brief
up / up is the pair you're after. If it says up / down, the cable is in but the laptop's side isn't talking — check the laptop's Ethernet adapter is enabled. If it says administratively down, you forgot no shutdown.
Either port would work, but this series uses GE 0/1 for your local network and keeps GE 0/0 for the Internet connection later. That's the convention on the 1921 & C2960L Setup page too, so sticking to it now means nothing has to be re-cabled in Part 3.
The router has a house number; the laptop doesn't yet. Normally a laptop gets one automatically from whatever it's plugged into, but the router doesn't know how to hand them out yet (that's Step 05). So for now you type one in. Use 192.168.10.50 — same street, a house number nothing else will use.
192.168.10.50, Subnet mask 255.255.255.0 (on Windows 11 this box may be labelled Subnet prefix length and want 24), Gateway 192.168.10.1, Preferred DNS 192.168.10.1. Save.Then open PowerShell and check it took:
ipconfig
192.168.10.50, Subnet mask 255.255.255.0, Router 192.168.10.1. Click OK.ifconfig en0 | grep inet
(en0 is usually the built-in Ethernet; a USB adapter may be en5 or similar — ifconfig alone lists them all. 0xffffff00 is 255.255.255.0 in hexadecimal.)
Find the interface name with ip link — it's eth0, enp3s0, or similar. Then, until the next reboot:
sudo ip addr add 192.168.10.50/24 dev eth0 sudo ip link set eth0 up ip addr show eth0
If NetworkManager is running (any desktop distribution), it may fight you for the interface; nmcli con mod "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.10.50/24 ipv4.gateway 192.168.10.1 followed by nmcli con up "Wired connection 1" is the version it will respect.
Your laptop is now on two networks at once: Wi-Fi to your home router and Internet, and the Ethernet cable to the 1921. That's fine and normal — the two streets have different names, so the laptop knows which cable to use for which. You can keep browsing while you work. Just remember to switch the Ethernet adapter back to Automatic at the end of Step 05, or the next time you plug into a real network it won't get an address.
ping sends a tiny “are you there?” packet and waits for the reply. It's the first thing anyone types when a network misbehaves, and the first thing to do when a network is new. From the router console:
ping 192.168.10.50
Each ! is a reply; each . is a timeout. The first one being a dot is normal and not a fault: the router didn't yet know the laptop's hardware (MAC) address, so it spent the first attempt asking for it — that's a protocol called ARP — and the ping timed out while it waited. Run it again and you'll get !!!!!, 100 percent. Now from the laptop, the other direction:
ping 192.168.10.1
(Windows stops after four; on Mac and Linux it runs until you press Ctrl-C.) Replies in both directions mean the network works. Everything else on this page is built on this.
192.168.10.), both masks are 255.255.255.0, and show ip interface brief says up / up. Nine times out of ten it's a typo in one of the addresses.One more command, because it shows you something real. The router keeps a table of every device it's talked to on each port:
show arp
That second line is your laptop: its IP address, its hardware address, and which port it's on. When someone tells you “the network can't see my machine,” this table is where you look first.
The router's first ping to the laptop always shows .!!!! — one miss, then four hits. A friend says the network must be flaky. Explain what actually happened during that first dot.
An IP address is like a name; to actually hand a packet to a device on the same cable, the router needs its hardware address, like a face. The first time, the router didn't know the laptop's face, so it shouted “whoever is 192.168.10.50, tell me your hardware address!” and waited. The laptop answered, but the reply came back after the first ping had already given up — hence the dot. The router wrote the answer in its table (that's show arp), and the remaining four went straight through. Nothing was flaky: the first packet paid for a lookup the others got for free.
Typing an address into every laptop is fine for one. It's absurd for twenty, and it breaks the moment a visitor plugs in. Every real network has a DHCP server — a device that keeps a list of free house numbers and gives one to anything that asks. Your home router does this. The 1921 can too, and it's six lines:
configure terminal ip dhcp excluded-address 192.168.10.1 192.168.10.10 ip dhcp pool LAN_POOL network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 1.1.1.1 8.8.8.8 lease 7 end
excluded-address 192.168.10.1 192.168.10.10 — never hand out .1 through .10. The router is .1; the rest are reserved for things you'll want at a fixed address later (a switch, a printer, a server). Everyone else gets .11 and up.ip dhcp pool LAN_POOL — create a pool named LAN_POOL (any name works) and drop into (dhcp-config)# mode to describe it.network 192.168.10.0 255.255.255.0 — the street. Note it's .0, not .1: this names the whole street, not a house.default-router 192.168.10.1 — tell each laptop “when you need a different street, send it to me.” No effect yet with no Internet attached, but it's the line that makes Part 3 work.dns-server 1.1.1.1 8.8.8.8 — who turns names like google.com into addresses. Also not usable until there's Internet, but harmless now.lease 7 — an address is yours for 7 days before you have to ask again.Undo Step 03: put the laptop's Ethernet back to Automatic (DHCP) — Windows: Settings → Ethernet → IP assignment → Edit → Automatic; Mac: Configure IPv4 → Using DHCP; Linux: sudo ip addr flush dev eth0 && sudo dhclient eth0, or set the connection back to Automatic in NetworkManager. Within a few seconds the laptop has an address it didn't type. Check on the laptop with ipconfig (Windows) or ifconfig/ip addr, and on the router:
show ip dhcp binding
The laptop got .11 — the first address after the excluded range — for seven days. Ping the router again from the laptop to prove nothing broke. From now on, anything you plug into GE 0/1 (or, in Part 3, into a switch hanging off it) gets an address on its own.
That's the address an operating system gives itself when it asked for one and nobody answered. It means the DHCP request never reached the router or the pool didn't match. Check show running-config | section dhcp for typos — the network line must be the same street as the interface address — and that the port is still up / up. Then on the laptop, disable and re-enable the Ethernet adapter to make it ask again.
Your laptop just got 192.168.10.11 without you typing anything. Explain to a friend what conversation happened over the cable, and why the router never handed out .5.
The laptop had no address, so it shouted to the whole cable: “Anyone here give out addresses?” The router answered, “Yes — want .11?” The laptop said “yes,” the router said “it's yours for a week, and by the way I'm .1 if you need to leave the street,” and wrote it in its list. That list is show ip dhcp binding. It never offered .5 because you told it to skip .1 through .10 — those are kept back for devices you'll want at an address that never changes, so you can find them without looking anything up.
You have a working network between laptop and router, so there's no reason to keep managing the router over a serial cable at 9600 baud. SSH gives you the same prompt over the network, encrypted, from any machine on the street. It takes a short block of config, and every line has a job:
configure terminal ip domain-name lab.local crypto key generate rsa modulus 2048 ip ssh version 2 username admin privilege 15 secret AdminPass! line vty 0 4 transport input ssh login local exec-timeout 10 0 end write memory
ip domain-name lab.local — SSH keys are named after hostname.domain, so the router insists on having a domain first. Any name works; it doesn't have to exist anywhere.crypto key generate rsa modulus 2048 — make the encryption key. This is the step that needs hostname and ip domain-name already set; on a 1921 it takes a few seconds.ip ssh version 2 — refuse the old, insecure version 1.username admin privilege 15 secret AdminPass! — an account to log in with. Privilege 15 means it lands straight at #, no enable needed. Pick your own password.line vty 0 4 — the five “virtual terminal” lines, numbered 0 to 4. Each is one remote login session. (The console cable was line console 0 in Part 1; same idea, different door.)transport input ssh — only SSH may come in through these lines; not Telnet, which sends passwords in plain text.login local — check logins against the username list on this router.exec-timeout 10 0 — log an idle session out after 10 minutes 0 seconds.Windows: open PuTTY, leave the connection type on SSH this time, host name 192.168.10.1, port 22, Open. Or, in PowerShell — Windows 10 and 11 have an SSH client built in:
ssh admin@192.168.10.1
The “authenticity can't be established” question appears once, the first time you talk to any new SSH server; answer yes. Then your password, then R1# — the same prompt as the console, over the network. Try show ip interface brief to prove it. Type exit to hang up.
A 1921 runs IOS 15, and its SSH speaks an older dialect than a 2024-era laptop is willing to use by default. If ssh refuses with no matching key exchange method or no matching host key type, tell your client to allow the older algorithms just for this host:
ssh -o KexAlgorithms=+diffie-hellman-group14-sha1 -o HostKeyAlgorithms=+ssh-rsa admin@192.168.10.1
PuTTY handles this without complaint, which is one reason it's still the Windows default for Cisco work. It's a lab router on a private cable; the older algorithms are fine here.
Now unplug the console cable. Really — do it. Reconnect over SSH and run show running-config. Everything you configured on this page is in there, and you got to it without the serial port. That's the milestone: from here on, the console cable is for emergencies and for Part 1's Step 12, and nothing else.
Explain to a friend what the console cable and SSH have in common, what's different, and why you needed the cable before you could set up SSH.
Both give you the same thing: a prompt where you type commands to the router. The console is a direct wire that works with zero setup, but you have to be sitting next to the box. SSH goes over the network, so you can be anywhere on it — but the network has to exist first: the router needs an address, the port has to be on, and a login has to be defined. All of that is configuration, and configuration needs a prompt. The console is how you get the first prompt; SSH is what you build with it. Chicken, then egg.
Three commands that show the same network from three angles. Learn to read them now, while you know exactly what's connected, so they make sense later when you don't.
show ip route
A router's job is deciding where to send packets, and this table is the whole decision. Right now it knows one street: C for connected — 192.168.10.0/24 is reachable out of GE 0/1 because that's where its own address is. The L line is just the router's own house number. Gateway of last resort is not set means “and for anything else, I have no idea” — which is why there's no Internet yet. Part 3 sets it.
show interfaces GigabitEthernet0/1
Your description is there, which is why you wrote it. Full-duplex, 1000Mb/s confirms the cable negotiated gigabit. And the two lines with errors in them should say 0 — a rising count of CRC or input errors is a bad cable, nearly always.
show running-config | section dhcp
The | is a filter, exactly like a Linux pipe. | section dhcp shows only the blocks mentioning dhcp; | include ip address shows only lines containing that text; | begin interface starts the output at the first match. On a config that's grown to three hundred lines, these save you the --More-- key a hundred times a day.
Last thing, and you already know why:
write memory
The router has an address, a port that's on, a DHCP server, and SSH. That's a real network with one machine on it. The next page makes it a real network with many machines and the Internet.
Add a 24-port switch so more than one device fits, plug GE 0/0 into your home router or modem, and turn on NAT so the whole street reaches the Internet. It repeats this page's DHCP and SSH blocks at speed, so they'll look familiar.
Deeper on the two ideas Part 3 introduces: sharing one public address, and splitting one switch into separate streets.
Every command from Parts 1 and 2, plus the ones you'll meet next, on one page for when you've forgotten the exact spelling.