The most-used Cisco IOS CLI commands for routers and switches, in ten categories so you can find the right one fast. Every block is copy-ready: the prompts are shown for context but aren't copied, and ! comments are stripped too. Where a topic has its own guide on this site — setup, NAT, VLANs — the section says so and links to it.
IOS has three main privilege levels: User EXEC (>), Privileged EXEC (#), and Global Configuration ((config)#). Sub-modes nest inside global config.
| Command | From Prompt | What It Does |
|---|---|---|
enable | Router> | Enter privileged EXEC mode |
configure terminal | Router# | Enter global configuration mode |
end or Ctrl+Z | any config mode | Return to privileged EXEC immediately |
exit | any mode | Go up one level in mode hierarchy |
write memory | Router# | Save running config to NVRAM (same as copy run start) |
reload | Router# | Reboot the device |
? | any | Context-sensitive help — list available commands |
show version | Router# | IOS version, uptime, hardware info |
You spent an hour configuring a router, unplugged it, and it came back blank. Explain the difference between show running-config and show startup-config, and which one command would have saved you.
The running config is the router's working memory — every command you type changes it instantly, and it lives in RAM, which empties when the power goes. The startup config is the copy on the tiny flash chip that survives a reboot. Nothing copies one to the other for you. write memory (the same as copy running-config startup-config) is that copy. Type it after every change you want to keep, and reading both configs side by side tells you exactly what is still unsaved.
Press Tab to complete any unambiguous command. Press ? after a partial command to see matching options. IOS accepts unique abbreviations: conf t = configure terminal.
The most important read-only commands for viewing device state. These never change configuration — use them freely to investigate any problem.
| Command | What You See |
|---|---|
show running-config | Current config in RAM (what is active right now) |
show startup-config | Saved config in NVRAM (what loads on boot) |
show ip interface brief | All interfaces: IP, status, protocol — one line each |
show interfaces | Detailed stats and error counters for every interface |
show ip route | IP routing table |
show arp | ARP cache (IP ↔ MAC mappings) |
show mac address-table | Switch MAC address table |
show cdp neighbors detail | Directly connected Cisco devices |
show processes cpu | CPU utilization by process |
show flash | Flash memory contents (IOS image files) |
Configure IP addresses, speed, duplex, and state on router and switch interfaces.
! Assign an IP address to a router interface Router(config)# interface GigabitEthernet 0/0 Router(config-if)# ip address 192.168.1.1 255.255.255.0 Router(config-if)# description LAN — Staff Network Router(config-if)# no shutdown Router(config-if)# exit ! Force speed and duplex (useful for older or mismatched devices) Router(config-if)# speed 100 Router(config-if)# duplex full ! Shut down an interface Router(config-if)# shutdown ! View detailed interface stats and error counters Router# show interfaces GigabitEthernet 0/0
IOS accepts unique abbreviations. int g0/0, interface gi0/0, and interface GigabitEthernet 0/0 are all equivalent.
Static routes are manually configured paths. A default route (0.0.0.0/0) is the gateway of last resort — traffic with no matching route is sent here.
! Default route — send unknown traffic to ISP gateway Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 ! Static route to a specific network via next-hop IP Router(config)# ip route 10.10.0.0 255.255.0.0 192.168.1.254 ! Static route via exit interface (floating) Router(config)# ip route 10.10.0.0 255.255.0.0 GigabitEthernet 0/1 ! Remove a static route Router(config)# no ip route 10.10.0.0 255.255.0.0 192.168.1.254 ! Verify routing table Router# show ip route
| Code | Meaning |
|---|---|
C | Connected — directly attached network |
L | Local — the router's own interface IP (/32) |
S | Static — manually configured |
S* | Static default route — gateway of last resort |
O | OSPF learned |
D | EIGRP learned |
Quick reference for creating VLANs, assigning ports, and configuring trunks on a Cisco Catalyst switch. See the full VLAN guide for step-by-step setup.
| Command | What It Does |
|---|---|
vlan 10 | Create VLAN 10 (in global config) |
name Staff | Name the VLAN (in vlan config mode) |
show vlan brief | All VLANs and their assigned ports |
switchport mode access | Set port to access mode (one VLAN, untagged) |
switchport access vlan 10 | Assign port to VLAN 10 |
switchport mode trunk | Set port to trunk mode (multiple VLANs, tagged) |
switchport trunk allowed vlan 10,20,30 | Restrict trunk to specific VLANs |
switchport trunk allowed vlan add 40 | Add VLAN 40 to existing trunk allowed list |
show interfaces trunk | All trunk ports and their allowed VLANs |
show mac address-table vlan 10 | MACs learned on VLAN 10 |
Configure and verify Network Address Translation. See the full NAT Configuration Guide for step-by-step setup including PAT, static NAT, and port forwarding.
| Command | What It Does |
|---|---|
ip nat inside | Mark interface as inside NAT (LAN side) |
ip nat outside | Mark interface as outside NAT (WAN side) |
ip nat inside source list LAN_ACL interface Gi0/0 overload | PAT — map all LAN IPs to WAN interface IP |
ip nat inside source static 192.168.10.20 203.0.113.5 | Static NAT — permanent 1:1 IP mapping |
show ip nat translations | Active NAT translation table |
show ip nat statistics | Translation counts and miss counters |
clear ip nat translation * | Flush all NAT translations |
debug ip nat | Real-time NAT events (use with caution) |
ACLs filter traffic. Standard ACLs match source IP only. Extended ACLs match source, destination, protocol, and port — much more powerful.
! Named standard ACL — permit a subnet Router(config)# ip access-list standard PERMIT_LAN Router(config-std-nacl)# permit 192.168.10.0 0.0.0.255 Router(config-std-nacl)# deny any Router(config-std-nacl)# exit ! Named extended ACL — block Telnet from Guests to Servers Router(config)# ip access-list extended BLOCK_GUEST_TELNET Router(config-ext-nacl)# deny tcp 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 eq 23 Router(config-ext-nacl)# permit ip any any Router(config-ext-nacl)# exit ! Apply ACL inbound on sub-interface for VLAN 20 Router(config)# interface GigabitEthernet 0/0.20 Router(config-subif)# ip access-group BLOCK_GUEST_TELNET in ! Verify ACLs Router# show ip access-lists
ACLs use wildcard masks — the inverse of subnet masks. Wildcard for /24 is 0.0.0.255. An implicit deny any exists at the end of every ACL.
Every ACL ends with an invisible deny any. If you only wrote deny lines, you just blocked everything.
The 1921 can act as a DHCP server, relay agent, or client. These are the most common commands for configuring and verifying DHCP pools.
| Command | What It Does |
|---|---|
ip dhcp excluded-address 192.168.10.1 192.168.10.10 | Reserve IPs — won't be handed out by DHCP |
ip dhcp pool STAFF | Create and name a DHCP pool |
network 192.168.10.0 255.255.255.0 | Subnet the pool serves (in dhcp-config mode) |
default-router 192.168.10.1 | Gateway sent to DHCP clients |
dns-server 8.8.8.8 | DNS server sent to clients |
lease 7 | Lease duration in days (default is 1) |
show ip dhcp binding | All active DHCP leases |
show ip dhcp pool | Pool stats: total, leased, available |
clear ip dhcp binding * | Revoke all leases (forces devices to re-request) |
ip helper-address 10.0.0.1 | Relay DHCP requests to a remote DHCP server |
Secure console, VTY (SSH/Telnet), and privileged EXEC access. Disable services you don't need — the fewer attack surfaces, the better.
! Set encrypted enable password Router(config)# enable secret Str0ng_P@ss! ! Encrypt all plaintext passwords in running-config Router(config)# service password-encryption ! Secure console port with login timeout Router(config)# line console 0 Router(config-line)# password C0ns0le! Router(config-line)# login Router(config-line)# exec-timeout 5 0 Router(config-line)# exit ! Restrict VTY lines to SSH only Router(config)# line vty 0 4 Router(config-line)# transport input ssh Router(config-line)# login local Router(config-line)# exec-timeout 10 0 Router(config-line)# exit ! Create local user for SSH and enable SSHv2 Router(config)# username admin privilege 15 secret Str0ng_P@ss! Router(config)# ip domain-name yourdomain.local Router(config)# crypto key generate rsa modulus 2048 Router(config)# ip ssh version 2 ! Disable unused services Router(config)# no ip http server Router(config)# no ip http secure-server Router(config)# no cdp run
Diagnose connectivity issues with ping, traceroute, and debug. Always disable debug when finished — it can consume significant CPU on production devices.
! Ping from the router itself Router# ping 8.8.8.8 ! Extended ping — specify source interface or IP Router# ping 8.8.8.8 source GigabitEthernet 0/0 Router# ping 8.8.8.8 source 192.168.10.1 ! Traceroute — show each hop to destination Router# traceroute 8.8.8.8 ! Debug IP ICMP — watch ping packets in real time Router# debug ip icmp Router# no debug all ! View syslog messages Router# show logging
debug commands generate high CPU load. Always run no debug all (or undebug all) when finished. On a live router, prefer show commands first.
| Ping Symbol | Meaning |
|---|---|
! | Success — reply received within 2 seconds |
. | Timeout — no reply within 2 seconds |
U | Destination unreachable (ICMP message returned) |
N | Network unreachable |
Q | Source quench (rate limiting) |
Initial device configuration from scratch: identity, interfaces, DHCP, NAT, SSH.