Cisco IOS: Essential Commands You Need to Know
Mastering essential Cisco IOS/IOS-XE commands is critical for any network engineer working with Catalyst, Nexus (similar NX-OS), ISR, or ASR platforms. This guide covers commands by category: basic configuration, VLANs, routing, QoS, security, and troubleshooting. A practical 2026 reference.
CLI Modes and Navigation
- enable: enter privileged mode (the prompt changes from > to #)
- configure terminal: enter global configuration mode
- interface GigabitEthernet1/0/1: configure an interface
- end or Ctrl+Z: return to privileged mode
- exit: move up one level
- ?: access context-sensitive help at any time
Initial Configuration
- hostname SW-PARIS-01: set the switch name
- enable secret Cisco123!: set the privileged-mode password
- service password-encryption: encrypt cleartext passwords
- ip domain-name optinoc.local: set the domain name for SSH
- crypto key generate rsa modulus 2048: generate a 2048-bit SSH key
- ip ssh version 2: enable SSH v2 only
- line vty 0 15 ; transport input ssh ; login local: allow SSH access only
VLANs and Interfaces
- vlan 10 ; name DATA: create VLAN 10
- interface vlan 10 ; ip address 192.168.10.1 255.255.255.0 ; no shut: configure an SVI
- interface range gi1/0/1-24: configure multiple interfaces
- switchport mode access ; switchport access vlan 10: configure an access port in VLAN 10
- switchport mode trunk ; switchport trunk allowed vlan 10,20,30: configure a trunk
- switchport trunk native vlan 99: set the native VLAN on a trunk (≠ default 1)
Routing
- ip routing: enable L3 routing (often disabled by default)
- ip route 0.0.0.0 0.0.0.0 192.168.1.254: configure a default route
- router ospf 1 ; network 10.0.0.0 0.255.255.255 area 0: configure OSPF area 0
- router bgp 65001 ; neighbor 10.0.0.2 remote-as 65002: configure a BGP peer
- show ip route: display the routing table
- show ip route bgp: display BGP routes only
QoS
- class-map match-any VOICE ; match dscp ef: define a voice traffic class
- policy-map MARK-VOICE ; class VOICE ; set dscp ef: configure a policy
- interface gi1/0/1 ; service-policy input MARK-VOICE: apply the policy
- mls qos: enable QoS (required on older series)
- show policy-map interface gi1/0/1: verify QoS counters
Security
- ip access-list extended ALLOW-WEB ; permit tcp any any eq 80: configure an L4 ACL
- interface gi1/0/1 ; ip access-group ALLOW-WEB in: apply the ACL
- switchport port-security maximum 2: allow a maximum of 2 MAC addresses per port
- switchport port-security violation shutdown: place the port in err-disabled state upon a violation
- dot1x system-auth-control ; aaa new-model: enable 802.1X globally
- interface gi1/0/1 ; authentication port-control auto: configure an 802.1X port
Essential Troubleshooting
- show running-config: display the current configuration
- show startup-config: display the boot configuration
- write memory or copy running startup: save the configuration
- show interface gi1/0/1: display interface status and CRC counters
- show mac address-table: display learned MAC addresses
- show vlan brief: display configured VLANs
- show cdp neighbors detail: display detailed information about Cisco neighbors
- show lldp neighbors detail: display detailed information about LLDP neighbors (multi-vendor)
- debug ip icmp: debug ICMP traffic (use caution in production)
- undebug all or u all: stop all debugging
File Management and IOS Upgrades
- dir flash:: list files
- copy tftp flash: download IOS from TFTP
- boot system flash:c9300-uni-08.12.01.bin: define the IOS boot image
- reload: restart the device
- show boot: display the IOS image that will boot
IOS-XE-Specific Commands
- show version: display the IOS version and uptime
- install add file ...: use install mode for IOS-XE
- install activate: activate the new version
- install commit: permanently commit the installation
- show install summary: display the installation status
NX-OS (Nexus) vs IOS: Key Differences
- NX-OS uses feature <name> to enable protocols (e.g., feature bgp)
- Interface Ethernet1/1 instead of GigabitEthernet
- show running-config interface Eth1/1 (no shorthand)
- Default VRF: 'default', not 'global'
- Native checkpoints and rollback (commit-style)
Order from OPTINOC
All Cisco Catalyst and Nexus switches are available new or refurbished from OPTINOC. Free IOS command training is available to customers. Expert French-speaking technical support.
