Home›Guides›Cisco IOS Command Reference

Cisco IOS Commands — Complete Cheat Sheet

10 min readUpdated June 2026CLI Reference

Cisco IOS (Internetwork Operating System) is the firmware that runs on most Cisco routers and switches. All configuration happens through a hierarchical CLI — knowing which mode you're in and which commands belong to which mode is the foundation of everything that follows.

Exam relevance

CompTIA Network+ (N10-009) tests CLI concepts conceptually — you won't type commands but you must recognise output from show commands and understand what each does. CCNA tests actual configuration, so both syntax and purpose matter.

IOS Modes

IOS uses a privilege hierarchy. You move down into sub-modes to configure specific features, and back up with exit or all the way back to privileged EXEC with end.

Router>                    ! User EXEC — limited read-only commands
Router> enable             ! → Privileged EXEC (requires enable password/secret)

Router#                    ! Privileged EXEC — full show commands, copy, reload
Router# configure terminal ! → Global configuration mode
Router# disable            ! ← Back to User EXEC
Router# exit               ! Disconnect session

Router(config)#            ! Global configuration — hostname, routing, ACLs
Router(config)# interface GigabitEthernet0/0   ! → Interface sub-mode
Router(config)# router ospf 1                  ! → Router sub-mode
Router(config)# line vty 0 4                   ! → Line sub-mode

Router(config-if)#         ! Interface sub-mode
Router(config-if)# exit    ! ← One level up (back to global config)
Router(config-if)# end     ! ← All the way back to privileged EXEC
Router(config-if)# Ctrl+Z  ! Same as end

Management & Saving

! Set device hostname
Router(config)# hostname SW1

! Set privileged EXEC password (encrypted — always prefer this over 'enable password')
SW1(config)# enable secret Cisco123!

! Encrypt all plaintext passwords in running-config
SW1(config)# service password-encryption

! Set a login banner
SW1(config)# banner motd # Authorised access only. #

! Save running config to NVRAM (survives reboot)
SW1# copy running-config startup-config
SW1# write memory          ! Shorthand for the same thing

! View configs
SW1# show running-config   ! Active config in RAM
SW1# show startup-config   ! Config that loads on boot

! Reboot the device
SW1# reload

! Show device info (IOS version, uptime, hardware)
SW1# show version

running-config vs startup-config

Changes take effect immediately in running-config (RAM) but are lost on reboot unless you save them to startup-config (NVRAM). Always copy run start after making changes you want to keep.

Interface Configuration

! Enter interface (shorthand notation works: gi0/0, fa0/1, se0/0/0)
Router(config)# interface GigabitEthernet0/0

! Assign IP address and subnet mask
Router(config-if)# ip address 192.168.1.1 255.255.255.0

! Enable the interface (Cisco interfaces are shutdown by default on routers)
Router(config-if)# no shutdown

! Disable the interface
Router(config-if)# shutdown

! Add a human-readable description
Router(config-if)# description Link to Core-SW1

! Set duplex and speed (usually left on auto)
Router(config-if)# duplex full
Router(config-if)# speed 1000

! Configure a loopback (always up, used for router-id and management)
Router(config)# interface Loopback0
Router(config-if)# ip address 1.1.1.1 255.255.255.255

! Useful show commands for interfaces
Router# show interfaces                    ! Detailed stats for all interfaces
Router# show interfaces GigabitEthernet0/0 ! Single interface detail
Router# show ip interface brief            ! Summary table: IP, status, protocol
Router# show interfaces status             ! (Switches) Port, VLAN, duplex, speed

📡

Practice in NetForge

OSI & Protocol Data Units — understand the layers behind these commands →

Static Routing

! Syntax: ip route <network> <mask> <next-hop-ip OR exit-interface>
Router(config)# ip route 10.0.2.0 255.255.255.0 10.0.1.2

! Default route (send all unknown traffic to this next hop)
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

! Floating static route (higher AD = used only if primary route disappears)
Router(config)# ip route 10.0.2.0 255.255.255.0 10.0.1.3 200

! View the routing table
Router# show ip route
Router# show ip route static
Router# show ip route 10.0.2.0    ! Show best match for specific prefix

Administrative Distance

AD is the trustworthiness of a routing source. Connected = 0, Static = 1, OSPF = 110, RIP = 120, EBGP = 20. Lower wins. A floating static route uses a higher AD so a dynamic route takes precedence when available.

OSPF

! Enable OSPF process (process-id is local only — doesn't need to match peers)
Router(config)# router ospf 1

! Advertise a network into OSPF (wildcard mask = inverse of subnet mask)
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# network 10.0.0.0 0.255.255.255 area 0

! Set a stable router ID (loopback IP is preferred automatically)
Router(config-router)# router-id 1.1.1.1

! Prevent OSPF hellos on an interface (stub networks, LANs)
Router(config-router)# passive-interface GigabitEthernet0/1

! Useful OSPF show commands
Router# show ip ospf neighbor           ! Neighbour table and state
Router# show ip ospf interface brief    ! Which interfaces run OSPF
Router# show ip ospf database           ! LSDB contents
Router# show ip route ospf              ! Only OSPF-learned routes

🌐

Practice in NetForge

OSPF Visualiser Lab — watch neighbour formation and SPF live →

VLANs & Switching

! Create a VLAN and give it a name (on a switch)
Switch(config)# vlan 10
Switch(config-vlan)# name Sales

Switch(config)# vlan 20
Switch(config-vlan)# name Engineering

! Access port — assigns a single VLAN to an end-device port
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Trunk port — carries multiple VLANs between switches / to routers
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q  ! (required on older IOSv)
Switch(config-if)# switchport trunk allowed vlan 10,20   ! Restrict which VLANs

! Show VLAN info
Switch# show vlan brief               ! VLAN IDs, names, and assigned ports
Switch# show interfaces trunk         ! Trunk ports and allowed VLANs
Switch# show interfaces GigabitEthernet0/1 switchport  ! Port mode detail

! Router-on-a-stick inter-VLAN routing (sub-interfaces on a router)
Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

🔀

Practice in NetForge

VLAN Configuration Lab — configure access/trunk ports interactively →

Access Control Lists (ACLs)

ACLs filter traffic. Standard ACLs match on source IP only; extended ACLs match source, destination, protocol, and port. Place standard ACLs close to the destination, extended ACLs close to the source.

! Standard numbered ACL (1–99, 1300–1999)
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any   ! Implicit deny exists anyway

! Extended numbered ACL (100–199, 2000–2699)
! Syntax: access-list <number> <permit|deny> <protocol> <src> <dst> [operator port]
Router(config)# access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80
Router(config)# access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config)# access-list 101 deny ip any any

! Named ACL (easier to edit — can delete individual lines)
Router(config)# ip access-list extended BLOCK-TELNET
Router(config-ext-nacl)# deny tcp any any eq 23
Router(config-ext-nacl)# permit ip any any

! Apply ACL to an interface (in = inbound traffic, out = outbound)
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 101 in
Router(config-if)# ip access-group BLOCK-TELNET out

! View ACLs
Router# show ip access-lists          ! All ACLs with hit counts
Router# show ip interface GigabitEthernet0/0  ! Which ACLs applied to interface

SSH & Remote Access

! Configure SSH (requires hostname + domain name first)
Router(config)# hostname R1
Router(config)# ip domain-name netforge.lab
Router(config)# crypto key generate rsa modulus 2048
Router(config)# ip ssh version 2

! Set VTY lines to accept SSH only (lines 0–4 = 5 simultaneous sessions)
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local

! Create a local user for SSH login
Router(config)# username admin privilege 15 secret Cisco123!

! Disable Telnet on console for security
Router(config)# line console 0
Router(config-line)# login local
Router(config-line)# exec-timeout 10 0   ! Auto-logout after 10 min idle

Troubleshooting Commands

! Connectivity tests
Router# ping 8.8.8.8
Router# ping 192.168.1.1 source GigabitEthernet0/0   ! Ping from specific interface
Router# traceroute 8.8.8.8

! CDP — discover directly connected Cisco devices
Router# show cdp neighbors            ! Summary table
Router# show cdp neighbors detail     ! IPs and IOS versions

! ARP table
Router# show arp
Router# show ip arp

! MAC address table (switches)
Switch# show mac address-table
Switch# show mac address-table address 00aa.bbcc.ddee

! Spanning Tree
Switch# show spanning-tree             ! STP state for all VLANs
Switch# show spanning-tree vlan 10     ! Specific VLAN

! Debug (use carefully — high CPU on production devices)
Router# debug ip icmp                 ! Show ICMP activity in real time
Router# debug ip ospf events          ! OSPF state changes
Router# no debug all                  ! Turn off ALL debugs (or 'undebug all')

! Logging and timestamps
Router# show logging                  ! View buffered syslog
Router(config)# service timestamps log datetime msec

Debug warning

debug commands generate output for every matching event and can overwhelm a busy router's CPU. Always turn off with no debug all immediately after you've captured what you need, especially on production equipment.