Cisco IOS is the backbone software that powers many of Cisco's network devices. For professionals working with these systems, knowing the right commands is crucial.
This article provides a Cisco commands cheat sheet, outlining the most common Cisco IOS commands for configuring, securing and troubleshooting Cisco network equipment. It includes the list of Cisco switch commands, a Cisco router commands list and Cisco network commands. Being familiar with the basic Cisco console commands will aid network administrators in managing Cisco devices efficiently and in line with best practices.
See Also
Easy Ways to Enable a Port on a Cisco Switch: 8 StepsModify Port ModeExtreme SLX-OS Layer 2 Switching Configuration Guide, 20.4.1Default Port and VLAN Configuration/Behavior on Cisco IOS switchesCisco IOS has several command modes that fall into further categories such as operational and configuration. Each mode serves a slightly unique purpose. For instance, Setup Mode provides the user with an interactive menu guide the user to create an initial configuration file for the device.
See Also
Switchport modesMode Control Commands | |
Command | Description |
| enable | Moves a userfrom user exec modeinto Privileged EXEC mode. Privileged exec mode is indicated by the # symbol in the command prompt. |
| configure terminal | Logsthe user into Global Configuration mode |
| interfacefastethernet/number | Enters interface configuration mode for the specified fast ethernet interface |
Basic Configuration Commands List | |
| reload | Reboots the Cisco switch or router |
| hostnamename | Sets a host name to the current Cisco network device |
| copyfrom-location to-location | Copies files from one file location to another |
| copy running-config startup-config | Replaces the startup configwith the active configwhen the Cisco network device initializes |
| copy startup-config running-config | Merges the startup config with the currently active config in RAM |
| write erase erase startup-config | Deletes the startup config |
| ip addressip-address mask | Assignsthe specified IP address and subnet mask |
| shutdown no shutdown | Shuts the interface down (shutdown) orbrings it up (no shutdown) |
| ip default-gatewayip_address | Sets the default gateway onthe Cisco device |
| show running-config | Displays the current configuration of the device |
| show startup-config | Displays the saved configuration stored in the device's NVRAM, which will be loaded when the device starts up |
| descriptionstring | Assigns the specified description to an interface |
| show running-configinterfaceinterface slot/number | Displays the running configuration forthe specified interface |
| show ip interface[type number] | Displays the status of a network interface as well as a detailed listing of its IP configurations and related characteristics. |
| ip name-serverserverip-1 serverip-2 | Sets the IP address of or more DNS servers that the device can use to resolve hostnames to IP addresses. |
Troubleshooting Cisco Commands List | |
| ping{hostname|system-address} [sourcesource-address] | Used to diagnose basic network connectivity |
| speed{10 | 100 | 1000 | auto} | Either configures the transmission speed of a network interface to the specified value in megabits per second (Mbps), or enables automatic speed detection for the port |
| duplex{auto | full | half} | Sets duplex to half, full or auto |
| cdp run no cdp run | Enables or disables Cisco Discovery Protocol (CDP) for the device |
| show mac address-table | Displays the MAC address table |
| show cdp | Shows whether CDP is enabled globally |
| show cdp neighbors[detail] | Lists summary (or detailed) information about each neighbor connected to the device |
| show interfaces | Displays detailed information about interface status, settings and counters |
| show interface status | Displays the interface line status |
| show interfaces switchport | Displays many configuration settings and current operational status, including VLAN trunking details |
| show interfaces trunk | Lists information about the currently operational trunks and the VLANs supported by those trunks |
| show vlan show vlan brief | Lists each VLAN and all interfaces assigned to that VLAN but does not include trunks |
| show vtp status | Lists the current VLAN Trunk Protocol (VTP) status, including the current mode |
Routing and VLAN Commands | |
| show ip route | Displays the current state of the IP routing of all known routes that are either statically configured or learned dynamically through a routing protocol |
| ip route network-number network-mask {ip-address | interface} | Sets a static route in the IP routing table |
| router rip | Enables a Routing Information Protocol (RIP) routing process, which places you in router configuration mode |
| networkip-address | Associates a network with a RIP routing process |
| version 2 | Configures the software to receive and send only RIP version 2 packets |
| no auto-summary | Disables automatic summarization |
| default-information originate | Generates a default route into RIP |
| passive-interfaceinterface | Sets the specified interface to passive RIP mode, which means RIP routing updates are accepted by, but not sent out of, the interface |
| show ip rip database | Displays the contents of the RIP routing database |
| ip nat[inside|outside] | Configure Network Address Translation (NAT), which allows private IP addresses on a local network to be translated into public IP addresses before being sent over the internet |
| ip nat inside source{list{access-list-number|access-list-name}}interfacetype number[overload] | Establishes dynamic source translation. Use of the“list”keyword enables you to use an ACL to identify the traffic that will be subject to NAT. The“overload”option enables the router to use one global address for many local addresses. |
| ip nat inside source staticlocal-ip global-ip | Establishes a static translation between an inside local address and an inside global address |
| vlan | Creates a VLAN and enters VLAN configuration mode for further definitions |
| switchport access vlan | Sets the VLAN that the interface belongs to. |
| switchport trunk encapsulation dot1q | Specifies 802.1Q encapsulation on the trunk link. |
| switchport access | Configures a specific Ethernet port on a switch to operate in access mode to accommodate an end device such as a computer, server or printer. The port must then be assigned to a single VLAN. |
| vlanvlan-id[name vlan-name] | Configures a specific VLAN name (1 to 32 characters) |
| switchport mode{ access | trunk} | Configures the VLAN membership mode of a port. The access port is set to access unconditionally and operates as a non-trunking, single VLAN interface that sends and receives non-encapsulated (non-tagged) frames. An access port can be assigned to only one VLAN. The trunk port sends and receives encapsulated (tagged) frames that identify the VLAN of origination. A trunk is a point-to-point link between two switches or between a switch and a router. |
| switchport trunk{encapsulation { dot1q } | Sets the trunk characteristics when the interface is in trunking mode. In this mode, the switch supports simultaneous tagged and untagged traffic on a port. |
| encapsulation dot1qvlan-id | Defines the matching criteria to map 802.1Q frames ingress on an interface to the appropriate service instance |
| show spanning-tree | Provides detailed information about the Spanning Tree protocol for all VLANs |
DHCP Commands | |
| ip address dhcp | Acquires an IP address on an interface via DHCP |
| ip dhcp poolname | Used to configure a DHCP address pool on a DHCP server and enter DHCP pool configuration mode |
| domain-namedomain | Specifies the domain name for a DHCP client |
| networknetwork-number[mask] | Configures the network number and mask for a DHCP address pool primary or secondary subnet on a Cisco IOS DHCP server |
| ip dhcp excluded-addressip-address[last-ip-address] | Specifies IP addresses that a DHCP server should not assign to DHCP clients |
| ip helper-addressaddress | Enables forwarding of UDP broadcasts, including BOOTP, received on an interface |
| default-routeraddress[address2 ... address8] | Specifies the default routers for a DHCP client |
Security Commands | |
| password pass-value | Lists the password that is required if thelogincommand (with no other parameters) is configured |
| usernamenamepasswordpass-value | Defines one of possibly multiple user names and associated passwords used for user authentication. It is used when thelogin localline configuration command has been used |
| enable passwordpass-value | Defines the password required when using theenablecommand |
| enable secret pass-value | Sets the password required for any user to enter enable mode |
| service password-encryption | Directs the Cisco IOS software to encrypt the passwords, CHAP secrets and similar data saved in its configuration file |
| ip domain-namename | Configures a DNS domain name |
| crypto key generate rsa | Creates and stores (in a hidden location in flash memory) the keys that are required by SSH |
| transport input{telnet | ssh} | Defines whether Telnet or SSH access is allowed into this switch. Both values can be specified in a single command to allow both Telnet and SSH access (default settings) |
| access-listaccess-list-number{deny | permit}source[source-wildcard] [log] | Defines a standard IP access list |
| access-class | Restricts incoming and outgoing connections between a particular VTY (into a basic Cisco device) and the addresses in an access list |
| ip access-list{standard|extended} {access-list-name|access-list-number} | Defines an IP access list by name or number |
| permitsource[source-wildcard] | Allows a packet to pass a named IP ACL. To remove a permit condition from an ACL, use the“no”form of this command. |
| denysource[source-wildcard] | Used to set conditions in a named IP ACL that will deny packets. To remove a deny condition from an ACL, use the“no”form of this command. |
| ntp peer<ip-address> | Configures the software clock to synchronize a peer or to be synchronized by a peer |
| switchport port-security | Enables port security on the interface |
| switchport port-security maximummaximum | Sets the maximum number of secure MAC addresses on the port |
| switchport port-security mac-address{mac-addr| {sticky [mac-addr]}} | Adds a MAC address to the list of secure MAC addresses. The “sticky” option configures the MAC addresses as sticky on the interface |
| switchport port-security violation{shutdown|restrict|protect} | Sets the action to be taken when a security violation is detected |
| show port security[interface interface-id] | Displays information about security options configured on the interface |
Monitoring and Logging Commands | |
| loggingip address | Configures the IP address of the host that will receive the system logging (syslog) messages |
| logging traplevel | Used to limit messages that are logged to the syslog servers based on severity. Specify the number or name of the desired severity level at which messages should be logged |
| show logging | Displays the state of system logging (syslog) and the contents of the standard system logging buffer |
| terminal monitor | Sends a copy of all syslog messages, including debug messages, to the Telnet or SSH user who issues this command |
