Cisco IOS Command Reference

CLI Navigation & Modes

Router & Switch

IOS has three main privilege levels: User EXEC (>), Privileged EXEC (#), and Global Configuration ((config)#). Sub-modes nest inside global config.

Command	From Prompt	What It Does
`enable`	`Router>`	Enter privileged EXEC mode
`configure terminal`	`Router#`	Enter global configuration mode
`end` or Ctrl+Z	any config mode	Return to privileged EXEC immediately
`exit`	any mode	Go up one level in mode hierarchy
`write memory`	`Router#`	Save running config to NVRAM (same as `copy run start`)
`reload`	`Router#`	Reboot the device
`?`	any	Context-sensitive help — list available commands
`show version`	`Router#`	IOS version, uptime, hardware info

Tab completion: Press Tab to complete any unambiguous command. Press ? after a partial command to see matching options. IOS accepts unique abbreviations: conf t = configure terminal.

Essential Show Commands

Router & Switch

The most important read-only commands for viewing device state. These never change configuration — use them freely to investigate any problem.

Command	What You See
`show running-config`	Current config in RAM (what is active right now)
`show startup-config`	Saved config in NVRAM (what loads on boot)
`show ip interface brief`	All interfaces: IP, status, protocol — one line each
`show interfaces`	Detailed stats and error counters for every interface
`show ip route`	IP routing table
`show arp`	ARP cache (IP ↔ MAC mappings)
`show mac address-table`	Switch MAC address table
`show cdp neighbors detail`	Directly connected Cisco devices
`show processes cpu`	CPU utilization by process
`show flash`	Flash memory contents (IOS image files)

Interface Configuration

Router & Switch

Configure IP addresses, speed, duplex, and state on router and switch interfaces.

! Assign an IP address to a router interface
Router(config)# interface GigabitEthernet 0/0
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# description LAN — Staff Network
Router(config-if)# no shutdown
Router(config-if)# exit

! Force speed and duplex (useful for older or mismatched devices)
Router(config-if)# speed 100
Router(config-if)# duplex full

! Shut down an interface
Router(config-if)# shutdown

! View detailed interface stats and error counters
Router# show interfaces GigabitEthernet 0/0
      

Abbreviations: IOS accepts unique abbreviations. int g0/0, interface gi0/0, and interface GigabitEthernet 0/0 are all equivalent.

Static & Default Routes

Cisco 1921

Static routes are manually configured paths. A default route (0.0.0.0/0) is the gateway of last resort — traffic with no matching route is sent here.

! Default route — send unknown traffic to ISP gateway
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

! Static route to a specific network via next-hop IP
Router(config)# ip route 10.10.0.0 255.255.0.0 192.168.1.254

! Static route via exit interface (floating)
Router(config)# ip route 10.10.0.0 255.255.0.0 GigabitEthernet 0/1

! Remove a static route
Router(config)# no ip route 10.10.0.0 255.255.0.0 192.168.1.254

! Verify routing table
Router# show ip route
      

Code	Meaning
`C`	Connected — directly attached network
`L`	Local — the router's own interface IP (/32)
`S`	Static — manually configured
`S*`	Static default route — gateway of last resort
`O`	OSPF learned
`D`	EIGRP learned

VLAN Commands

C2960L

Quick reference for creating VLANs, assigning ports, and configuring trunks on a Cisco Catalyst switch. See the full VLAN guide for step-by-step setup.

Command	What It Does
`vlan 10`	Create VLAN 10 (in global config)
`name Staff`	Name the VLAN (in vlan config mode)
`show vlan brief`	All VLANs and their assigned ports
`switchport mode access`	Set port to access mode (one VLAN, untagged)
`switchport access vlan 10`	Assign port to VLAN 10
`switchport mode trunk`	Set port to trunk mode (multiple VLANs, tagged)
`switchport trunk allowed vlan 10,20,30`	Restrict trunk to specific VLANs
`switchport trunk allowed vlan add 40`	Add VLAN 40 to existing trunk allowed list
`show interfaces trunk`	All trunk ports and their allowed VLANs
`show mac address-table vlan 10`	MACs learned on VLAN 10

NAT Commands

Cisco 1921

Configure and verify Network Address Translation. See the full NAT Configuration Guide for step-by-step setup including PAT, static NAT, and port forwarding.

Command	What It Does
`ip nat inside`	Mark interface as inside NAT (LAN side)
`ip nat outside`	Mark interface as outside NAT (WAN side)
`ip nat inside source list LAN_ACL interface Gi0/0 overload`	PAT — map all LAN IPs to WAN interface IP
`ip nat inside source static 192.168.10.20 203.0.113.5`	Static NAT — permanent 1:1 IP mapping
`show ip nat translations`	Active NAT translation table
`show ip nat statistics`	Translation counts and miss counters
`clear ip nat translation *`	Flush all NAT translations
`debug ip nat`	Real-time NAT events (use with caution)

Access Control Lists (ACLs)

Cisco 1921

ACLs filter traffic. Standard ACLs match source IP only. Extended ACLs match source, destination, protocol, and port — much more powerful.

! Named standard ACL — permit a subnet
Router(config)# ip access-list standard PERMIT_LAN
Router(config-std-nacl)# permit 192.168.10.0 0.0.0.255
Router(config-std-nacl)# deny any
Router(config-std-nacl)# exit

! Named extended ACL — block Telnet from Guests to Servers
Router(config)# ip access-list extended BLOCK_GUEST_TELNET
Router(config-ext-nacl)# deny tcp 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 eq 23
Router(config-ext-nacl)# permit ip any any
Router(config-ext-nacl)# exit

! Apply ACL inbound on sub-interface for VLAN 20
Router(config)# interface GigabitEthernet 0/0.20
Router(config-subif)# ip access-group BLOCK_GUEST_TELNET in

! Verify ACLs
Router# show ip access-lists
      

Wildcard masks: ACLs use wildcard masks — the inverse of subnet masks. Wildcard for /24 is 0.0.0.255. An implicit deny any exists at the end of every ACL.

DHCP Commands

Cisco 1921

The 1921 can act as a DHCP server, relay agent, or client. These are the most common commands for configuring and verifying DHCP pools.

Command	What It Does
`ip dhcp excluded-address 192.168.10.1 192.168.10.10`	Reserve IPs — won't be handed out by DHCP
`ip dhcp pool STAFF`	Create and name a DHCP pool
`network 192.168.10.0 255.255.255.0`	Subnet the pool serves (in dhcp-config mode)
`default-router 192.168.10.1`	Gateway sent to DHCP clients
`dns-server 8.8.8.8`	DNS server sent to clients
`lease 7`	Lease duration in days (default is 1)
`show ip dhcp binding`	All active DHCP leases
`show ip dhcp pool`	Pool stats: total, leased, available
`clear ip dhcp binding *`	Revoke all leases (forces devices to re-request)
`ip helper-address 10.0.0.1`	Relay DHCP requests to a remote DHCP server

Basic Security Commands

Router & Switch

Secure console, VTY (SSH/Telnet), and privileged EXEC access. Disable services you don't need — the fewer attack surfaces, the better.

! Set encrypted enable password
Router(config)# enable secret Str0ng_P@ss!

! Encrypt all plaintext passwords in running-config
Router(config)# service password-encryption

! Secure console port with login timeout
Router(config)# line console 0
Router(config-line)# password C0ns0le!
Router(config-line)# login
Router(config-line)# exec-timeout 5 0
Router(config-line)# exit

! Restrict VTY lines to SSH only
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local
Router(config-line)# exec-timeout 10 0
Router(config-line)# exit

! Create local user for SSH and enable SSHv2
Router(config)# username admin privilege 15 secret Str0ng_P@ss!
Router(config)# ip domain-name yourdomain.local
Router(config)# crypto key generate rsa modulus 2048
Router(config)# ip ssh version 2

! Disable unused services
Router(config)# no ip http server
Router(config)# no ip http secure-server
Router(config)# no cdp run
      

Troubleshooting Commands

Router & Switch

Diagnose connectivity issues with ping, traceroute, and debug. Always disable debug when finished — it can consume significant CPU on production devices.

! Ping from the router itself
Router# ping 8.8.8.8

! Extended ping — specify source interface or IP
Router# ping 8.8.8.8 source GigabitEthernet 0/0
Router# ping 8.8.8.8 source 192.168.10.1

! Traceroute — show each hop to destination
Router# traceroute 8.8.8.8

! Debug IP ICMP — watch ping packets in real time
Router# debug ip icmp
Router# no debug all

! View syslog messages
Router# show logging
      

Debug warning: debug commands generate high CPU load. Always run no debug all (or undebug all) when finished. On a live router, prefer show commands first.

Ping Symbol	Meaning
`!`	Success — reply received within 2 seconds
`.`	Timeout — no reply within 2 seconds
`U`	Destination unreachable (ICMP message returned)
`N`	Network unreachable
`Q`	Source quench (rate limiting)

Cisco IOS CommandReference

CLI Navigation & Modes

Essential Show Commands

Interface Configuration

Static & Default Routes

VLAN Commands

NAT Commands

Access Control Lists (ACLs)

DHCP Commands

Basic Security Commands

Troubleshooting Commands

Cisco IOS Command
Reference