Cisco router commands: interfaces, routing, ACLs and NAT
In short: A quick reference of the Cisco IOS commands used to configure and secure a router. Commands only.
Commands only. Replace values in angle brackets such as <ip> with your own. Only run commands on systems you own or are authorised to manage.
Interfaces and inter-VLAN routing
interface gigabitEthernet 0/0
description LINK-TO-ISP
ip address <public-ip> <mask>
no shutdown
interface gigabitEthernet 0/1
no shutdown
interface gigabitEthernet 0/1.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/1.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0Static and dynamic routing
ip route 0.0.0.0 0.0.0.0 <isp-gateway>
ip route 10.20.0.0 255.255.0.0 <next-hop>
router ospf 1
router-id 1.1.1.1
network 192.168.10.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
passive-interface gigabitEthernet 0/1.10Access control lists
ip access-list standard MGMT-ONLY
permit 192.168.99.0 0.0.0.255
line vty 0 4
access-class MGMT-ONLY in
ip access-list extended STAFF-IN
permit tcp 192.168.10.0 0.0.0.255 any eq 443
permit udp 192.168.10.0 0.0.0.255 any eq 53
deny ip any any log
interface gigabitEthernet 0/1.10
ip access-group STAFF-IN inNAT and DHCP
interface gigabitEthernet 0/0
ip nat outside
interface gigabitEthernet 0/1.10
ip nat inside
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface gigabitEthernet 0/0 overload
ip nat inside source static tcp 192.168.10.5 443 interface gigabitEthernet 0/0 443
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp pool STAFF
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server <dns-ip>Hardening and management services
no ip http server
no cdp run
no ip source-route
login block-for 120 attempts 3 within 60
security passwords min-length 10
ntp server <ntp-ip>
service timestamps log datetime msec
logging host <syslog-ip>
logging trap warnings
snmp-server group ADMINS v3 priv
snmp-server user snmpadmin ADMINS v3 auth sha <auth-pass> priv aes 128 <priv-pass>Verification commands
| Command | Purpose |
|---|---|
show ip interface brief | Interfaces, IP addresses and up/down status |
show ip route | Routing table |
show ip ospf neighbor | OSPF neighbours and state |
show access-lists | ACLs with hit counters |
show ip nat translations | Active NAT translations |
show ip dhcp binding | Addresses leased by the DHCP server |
show ntp status | NTP synchronisation state |
show logging | Logging settings and local buffer |
show version | IOS version, uptime and hardware |
ping <ip> source <interface> | Ping from a chosen interface |
traceroute <ip> | Trace the path from the router |
Real-world example: setting up a new branch office router
A charity opened a second office and needed it connected to the internet and to head office. The network volunteer configured the branch router in a set order. She addressed the LAN interface as 192.168.20.1/24 and the WAN interface with the address from the ISP, then added a default route to the ISP. NAT overload let the office PCs share the single public address, and the router's DHCP pool gave the PCs their settings.
An extended ACL on the WAN side blocked inbound traffic except replies and the site-to-site VPN. She enabled SSH, disabled Telnet and HTTP management, and set a login banner. Before leaving, she verified each step with show ip interface brief, show ip route and show ip nat translations, and saved the configuration. The office was online and documented the same afternoon.
Key takeaways
- Use subinterfaces with dot1Q for router-on-a-stick inter-VLAN routing.
- Place extended ACLs near the source and restrict VTY access with access-class.
- PAT (overload) lets inside hosts share the outside interface address.
- Disable unused services, rate-limit logins, and send time-stamped logs to syslog.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.