Cisco IOS CLI and basic device configuration: modes, help, switch management IP and router as a host

Finding your way around the CLI

Most Cisco routers and switches run IOS or IOS XE, and both use the same command line interface (CLI). You reach it through the console port on a new device, or over SSH once it has an address. The CLI is arranged in modes. Each mode only accepts the commands that make sense there, and the prompt shows which mode you are in.

You start in user EXEC mode (>), type enable to reach privileged EXEC mode (#), then configure terminal to change settings. From global configuration you enter sub-modes such as interface GigabitEthernet0/1 or line vty 0 4. exit goes up one level and end (or Ctrl+Z) returns straight to privileged EXEC.

Help, shortcuts and filters

• Question mark: ? lists the commands available in the current mode; show ip ? lists what can follow; sh? lists commands starting with those letters.
• Abbreviations: any unique start of a command works, so conf t means configure terminal. Tab completes the word for you.
• History: the up arrow recalls earlier commands. Ctrl+A and Ctrl+E jump to the start and end of a line.
• The no form: putting no in front of a configuration command removes or reverses it.
• Running show commands while configuring: prefix them with do, for example do show ip interface brief.
• Filtering output: add | include, | exclude, | begin or | section to cut long output down to the lines you need.

Changes take effect immediately in the running-config, which lives in RAM. They are lost on reload unless you copy them to the startup-config in NVRAM with copy running-config startup-config (or the older write memory).

A management IP address on a Layer 2 switch

A Layer 2 switch forwards frames without needing any IP address at all. You only give it one so that you can manage it over the network. The address goes on an SVI (switch virtual interface) in the management VLAN, and because the switch is not routing, it uses ip default-gateway to reach other subnets.

vlan 99
 name MGMT
interface Vlan99
 description Management
 ip address 10.10.99.11 255.255.255.0
 no shutdown
ip default-gateway 10.10.99.1
interface GigabitEthernet0/24
 switchport mode trunk

The SVI only comes up if VLAN 99 exists and at least one port in that VLAN (or a trunk carrying it) is up. On a Layer 3 switch with ip routing enabled, use a default route instead of ip default-gateway.

Basic router configuration, and the router as a host

Router interfaces are shut down by default and each one sits in a different subnet. A minimal configuration gives each interface an address and a description, then brings it up:

hostname BR1-RTR
interface GigabitEthernet0/0
 description LAN
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface GigabitEthernet0/1
 description Internet
 ip address dhcp
 no shutdown
ip route 0.0.0.0 0.0.0.0 dhcp

Check the result with show ip interface brief, show ip route and show running-config interface g0/0. Interface status "administratively down" means you forgot no shutdown; "down/down" usually means a cable or far-end problem.

A router can also behave like a simple host. With no ip routing it stops forwarding packets between interfaces and uses ip default-gateway, just like a PC. Labs use this to save equipment: one router plays the part of several client PCs. In the other direction, a router can act as a small server, handing out DHCP leases, answering NTP requests or serving as an SSH target for testing.

ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool LAN
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.10.5

Real-world example: commissioning a shop's first managed switch

A small furniture shop replaces an unmanaged switch with a 24-port managed one. The IT contractor connects a console cable, creates VLAN 99 for management, gives the switch 10.10.99.11 with the router as default gateway, sets SSH access and saves the configuration. Later, a till keeps dropping off the network. Instead of driving to the shop, the contractor logs in over SSH, runs show interfaces status | include connected and show mac address-table interface g0/7, and finds that the till cable was moved to a port in the wrong VLAN. The fix takes two minutes remotely. For the security settings to add on day one, see first-time device configuration.