Cisco IOS CLI Reference¶
A single lookup table for every Cisco IOS command referenced across this wiki. Each section links to the page with the full explanation and context — this page is for when you already know what you're doing and just need the syntax.
Essentials¶
The commands reached for constantly, in one place:
| Command | Description |
|---|---|
copy running-config startup-config (or write memory / wr) |
Save the config — no change survives a reload without this |
conf t |
Enter global configuration mode |
end |
Back to privileged EXEC from any config level |
show running-config |
The live configuration |
show ip int brief |
Fast status of every port and IP |
shut / no shut |
Disable / enable an interface (interface config mode) |
ping <ip> |
Reachability test |
do <command> |
Run any show/EXEC command from inside config mode (e.g. do show run) |
Console Connection¶
On your laptop's terminal (macOS/Linux) — not on the switch:
ls /dev/*usb* # Check for TTY port
screen [pasted tty] 9600 # Connect (9600 baud for most Cisco switches)
Use tab completion liberally — it saves typing and helps confirm you're using a valid command.
Show Commands (Verification & Troubleshooting)¶
| Command | Description |
|---|---|
show interfaces status |
Port connection status, port speed & VLAN assignment |
show ip int brief |
Brief summary of port config status, open/closed, IP assignment |
show vlan |
VLAN summary |
show interface summary |
Traffic summary across ports |
show power inline |
POE assignment |
show mac address-table |
Full MAC address table — see MAC Addresses & ARP |
show mac address-table interface Gi0/1 |
MACs learned on a specific port |
show arp |
IP-to-MAC mappings — see MAC Addresses & ARP |
show interfaces trunk |
Trunk state, native VLAN, allowed/active VLANs — see VLANs & Inter-VLAN Routing |
show cdp neighbors detail |
Check for native VLAN mismatches between adjacent switches |
show spanning-tree |
Root bridge, port roles/states, per-VLAN — see Spanning Tree Protocol |
show spanning-tree vlan 10 |
STP detail for a specific VLAN |
show spanning-tree summary |
Quick per-VLAN root/mode summary |
show ip route |
Routing table — see Cisco IOS Routing Fundamentals |
show ip route 0.0.0.0 |
Confirm the active default route |
show ip route ospf / show ip route eigrp |
Routes learned via a specific dynamic protocol |
show ip protocols |
Confirm a dynamic routing protocol is running and what it's advertising |
show ip ospf neighbor |
OSPF adjacency state (should be FULL) |
show ip eigrp neighbors |
EIGRP adjacency state |
show ip nat translations |
Active NAT translation table — see NAT & Private IP Ranges |
show ip nat statistics |
NAT hits, active translations, inside/outside interfaces |
show version |
IOS version, uptime, config register — see Configuration Management & Recovery |
show flash: |
Files in flash (IOS image, vlan.dat, etc.) |
show running-config / show startup-config |
Live config / saved config |
show boot |
Which image the switch will boot next |
show vtp status |
VTP mode and configuration revision — see VLANs & Inter-VLAN Routing |
show port-security |
Port-security status and violation counts — see Security Hardening |
show storm-control |
Storm-control thresholds and current levels |
show etherchannel summary |
Bundle status and member-port flags — see EtherChannel |
show monitor session 1 |
Active SPAN session config — see Port Mirroring |
show logging |
Local log buffer and logging config — see Syslog |
show env all |
Temperature, fans, power (where supported) — see Monitoring Commands |
show processes cpu sorted |
CPU usage by process, hungriest first |
show memory statistics |
Memory usage and free space |
show lldp neighbors |
LLDP-speaking devices per port (LLDP is off by default) — see Interface Management |
show tech-support |
Everything at once, for records/escalation — see Monitoring Commands |
Global Configuration Mode¶
| Command | Description |
|---|---|
conf t |
Enter configure terminal |
hostname SW01 |
Set switch name to SW01 |
enable secret <password> |
Set the privileged EXEC password |
ip default-gateway <ip> |
Management gateway on a Layer 2 switch (no ip routing) — see Device Setup Fundamentals |
vlan 99 |
Create VLAN 99 |
no vlan 99 |
Delete VLAN 99 |
int fa0/1 |
Configure a single port |
int range g1/0/1-24 |
Configure a range of ports |
logging buffered 16384 |
Size the local log buffer — see Syslog |
service timestamps log datetime msec localtime show-timezone |
Readable, local-time log timestamps (needs clock timezone) |
mls qos |
Enable QoS globally — read the warning on QoS first: ports default to untrusted |
monitor session 1 source interface Gi0/10 both + monitor session 1 destination interface Gi0/11 |
Mirror a port — see Port Mirroring |
no monitor session 1 |
Tear down the SPAN session (the destination port is dead to normal traffic until removed) |
VLANs & Trunking¶
Full context: VLANs & Inter-VLAN Routing
! Access port
interface Gi0/5
switchport mode access
switchport access vlan 10
! Trunk port
interface Gi0/48
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 999
! Inter-VLAN routing (SVIs)
ip routing
interface Vlan10
ip address 10.0.10.1 255.255.255.0
no shutdown
! VTP
vtp domain OFFICE-NET
vtp mode server
vtp password <shared-secret>
Interface Commands¶
| Command | Description |
|---|---|
shut |
Disable port |
no shut |
Enable port |
switchport access vlan 99 |
Assign port to VLAN 99 |
description <text> |
Label the port (shows in show interfaces status) |
speed auto / speed 1000 |
Port speed — see Interface Management |
duplex auto / duplex full |
Duplex — mismatches cause late collisions/CRC errors |
channel-group 1 mode active |
Add port to an LACP EtherChannel — see EtherChannel |
mls qos trust dscp |
Trust incoming DSCP markings — see QoS |
power inline never |
Disable POE |
power inline auto |
Enable POE |
Routing¶
Full context: Cisco IOS Routing Fundamentals
! Static / default / floating static routes
ip route <destination-network> <subnet-mask> <next-hop-ip>
! Default route
ip route 0.0.0.0 0.0.0.0 10.0.99.1
! Floating backup (AD 200)
ip route 0.0.0.0 0.0.0.0 10.0.98.1 200
! OSPF
router ospf 1
network 10.0.10.0 0.0.0.255 area 0
! EIGRP
router eigrp 100
network 10.0.10.0 0.0.0.255
no auto-summary
DHCP¶
Full context: DHCP Fundamentals
! DHCP relay, on the client-side SVI
interface Vlan20
ip helper-address 10.0.99.5
! Local DHCP server pool
ip dhcp excluded-address 10.0.10.1 10.0.10.10
ip dhcp pool OFFICE
network 10.0.10.0 255.255.255.0
default-router 10.0.10.1
dns-server 8.8.8.8
lease 7
NAT¶
Full context: NAT & Private IP Ranges
Router-only IOS commands, kept for reference alongside the NAT concepts page — Catalyst switches don't support NAT. On a network fronted by a pfSense firewall, NAT is handled there (Firewall → NAT).
interface Gi0/1
ip nat inside
interface Gi0/48
ip nat outside
ip access-list standard NAT_SOURCES
permit 10.0.10.0 0.0.0.255
ip nat inside source list NAT_SOURCES interface Gi0/48 overload
Security Hardening¶
Full context: Security Hardening
! Port security
interface Gi0/5
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
! SSH-only management (prerequisites first — do these before the vty lines,
! or you lose remote access: transport input ssh + login local with no
! username and no RSA keys = console-only switch)
! Requires a non-default hostname (see hostname SW01 above)
username admin secret <password>
ip domain-name <your-domain>
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
transport input ssh
login local
access-list 1 permit 10.0.99.0 0.0.0.255
line vty 0 4
access-class 1 in
! BPDU Guard
interface Gi0/5
spanning-tree bpduguard enable
spanning-tree portfast
! Root bridge priority
! On the switch that should be root:
spanning-tree vlan 10 root primary
! On a DIFFERENT switch, the backup root:
spanning-tree vlan 10 root secondary
! DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
! Switch is L2-only: stop inserting option 82, or the DHCP server may drop client requests
no ip dhcp snooping information option
interface Gi0/48
ip dhcp snooping trust
! Dynamic ARP Inspection
ip arp inspection vlan 10,20,30
ip arp inspection validate src-mac dst-mac ip
interface Gi0/48
ip arp inspection trust
! Storm control
interface Gi0/5
storm-control broadcast level 10
storm-control multicast level 10
storm-control action trap
! Extended ACL
ip access-list extended GUEST_POLICY
deny ip 10.0.20.0 0.0.0.255 10.0.10.0 0.0.0.255
permit ip any any
interface Vlan20
ip access-group GUEST_POLICY in
! ACL filtering by TCP/UDP port
ip access-list extended MGMT_ONLY
permit tcp any host 10.0.99.10 eq 22
deny tcp any host 10.0.99.10 eq 23
! Logging & SNMP
logging 10.0.99.5
logging source-interface Vlan99
logging trap informational
snmp-server community <read-only-string> RO
snmp-server enable traps
snmp-server host 10.0.99.5 version 2c <read-only-string>
Caution: after applying the SSH-only management stanza, verify you can open a new SSH session and log in before closing your existing console or telnet session.
Diagnostics¶
Full context: Diagnostic Commands. All privileged EXEC:
| Command | Description |
|---|---|
ping <ip> |
Reachability |
traceroute <ip> |
Path taken, hop by hop |
telnet <ip> <port> |
Quick TCP port-reachability test |
clear counters Gi0/1 |
Zero interface counters, so new errors stand out from old ones |
clear arp-cache |
Flush stale ARP entries after re-addressing a device — see MAC Addresses & ARP |
terminal monitor |
Show log/debug output in an SSH session (console gets it by default; terminal no monitor to stop) |
debug ip icmp |
Example debug — ICMP to/from the switch itself. Run undebug all when done |
verify /md5 flash:<image> |
Checksum an IOS image after copying, before reload — see Configuration Management & Recovery |
Saving, Resetting & Recovery¶
Full context: Configuration Management & Recovery
| Command | Description |
|---|---|
copy running-config startup-config (or write memory / wr) |
Save current config |
copy startup-config running-config |
Merge NVRAM config back into running-config |
copy running-config tftp://<host>/<file> |
Backup config to a TFTP server |
copy tftp://<host>/<file> startup-config |
Restore config from TFTP |
reload |
Reboot and reload config from saved (startup-config) |
erase nvram / erase startup-config |
Erase current config and reload factory setup |
delete vlan.dat |
Wipe the separately-stored VLAN database (needed for a true factory reset) |
boot system flash:<image> |
Point the boot process at a specific IOS image |
Hold Mode button while reconnecting power, then flash_init / rename flash:config.text flash:config.text.old / boot (at the switch: boot loader prompt) |
Boot without startup-config — password recovery on Catalyst fixed-config switches (2960/3560 family, incl. 3560-CX) |
rename flash:config.text.old flash:config.text then copy flash:config.text system:running-config |
Restore the real config after password recovery — then set new passwords and write memory |
Caution:
erase nvram/erase startup-configfollowed byreloadwipes the switch's saved configuration. Confirm you have a backup or are intentionally factory-resetting before running these on a live device.