CCNA guide

Basic Cisco IOS Commands (CCNA Cheat Sheet)

Q: What is the difference between enable password and enable secret?

Both protect access to privileged mode, but enable secret stores the password as a hash that can't be read back, while enable password keeps it in clear text or with weak encryption. If both are configured, enable secret is used.

Q: What do I need to configure for SSH access to a Cisco router?

A hostname other than the default, a domain name (ip domain-name), an RSA key pair (crypto key generate rsa), a local user (username ... secret ...), then on the vty lines: transport input ssh and login local. ip ssh version 2 is also recommended.

Q: How do I quickly exit configuration mode?

With end or Ctrl+Z you go straight to privileged EXEC mode (the prompt with #). The exit command only goes up one level.

Q: How do I run a show command from configuration mode?

Put do in front of it, for example do show ip interface brief. That way you don't have to leave and re-enter configuration mode.

The Routerel team Updated: November 5, 2026 13 min read

This cheat sheet collects the Cisco IOS commands you need every day in the lab and in the exam: how to move between CLI modes, how to configure a router or switch from scratch, how to set passwords and SSH, how to configure interfaces, how to save, and what each show command tells you. It's designed for quick scanning: tables, short examples, explanations only where they matter.

In the Networking Academy CCNA v8 courses, the basic commands are taught in CCNA 1 · ITN: initial configuration in module 7, securing access (passwords, SSH) in module 16, connectivity testing in module 13 and troubleshooting in module 17. In CCNA 2 · IEN, module 1 revisits switch and router management at a more advanced level.

All examples use interface names from devices common in labs (for example GigabitEthernet0/0/0 on routers and FastEthernet0/1 on switches). Numbering may differ on your device; check it with show ip interface brief.

CLI modes and prompts

The prompt always tells you where you are. It's the first thing to look at when a command doesn't work.

Mode	Prompt	How you get there	What you can do
User EXEC	`R1>`	you connect (console, SSH)	a few `show` commands, `ping`
Privileged EXEC	`R1#`	`enable`	all `show` commands, `copy`, `reload`, `debug`
Global configuration	`R1(config)#`	`configure terminal`	device-wide settings
Interface	`R1(config-if)#`	`interface GigabitEthernet0/0/0`	settings for one interface
Subinterface	`R1(config-subif)#`	`interface GigabitEthernet0/0/0.10`	subinterfaces (for example for VLANs)
Interface range	`S1(config-if-range)#`	`interface range FastEthernet0/1 - 10`	several ports at once
Line	`R1(config-line)#`	`line console 0` or `line vty 0 4`	console or remote access
VLAN	`S1(config-vlan)#`	`vlan 10`	a VLAN's name and settings
Router	`R1(config-router)#`	`router ospf 1`	the routing protocol

Moving between modes

Command / key	Effect
`enable`	from user EXEC to privileged EXEC
`disable`	back to user EXEC
`configure terminal` (`conf t`)	enter global configuration
`exit`	go up one level (from `config-if` to `config`)
`end` or Ctrl+Z	jump straight to privileged EXEC from any configuration mode
`do <command>`	run an EXEC command from configuration mode: `do show ip interface brief`

Help and abbreviations

? shows what you can type at that point: show ? lists every option, cl? lists the commands starting with "cl".
<cr> in the help list means "the command is complete, you can press Enter".
Tab completes a partially typed word, if it's unique.
Any command can be abbreviated as long as it stays unique: sh ip int br = show ip interface brief, copy run start = copy running-config startup-config, no shut = no shutdown.
no in front of a command negates it: no shutdown, no ip address, no vlan 20.

Error messages you'll see often:

Message	What it means
`% Ambiguous command`	the abbreviation matches several commands; type a few more letters
`% Incomplete command.`	an argument is missing; add `?` after the command
`% Invalid input detected at '^' marker.`	you made a mistake where the `^` points (or you're in the wrong mode)

Where the configuration lives

Memory	What it holds	Lost at power-off?
RAM	the active configuration (running-config), tables (ARP, routing)	yes
NVRAM	the saved configuration (startup-config)	no
Flash	the IOS operating system (and, on switches, `vlan.dat`)	no
ROM	the bootstrap and diagnostic program	no

Everything you type in configuration mode takes effect immediately, in the running-config. If you don't save, you lose it all on reboot.

Basic router or switch configuration

A typical initial configuration (replace the uppercase text with your own values):

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# no ip domain-lookup
R1(config)# enable secret ENABLE_PASSWORD
R1(config)# line console 0
R1(config-line)# password CONSOLE_PASSWORD
R1(config-line)# login
R1(config-line)# logging synchronous
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit
R1(config)# service password-encryption
R1(config)# security passwords min-length 10
R1(config)# banner motd # Authorized access only. #
R1(config)# end
R1# copy running-config startup-config

Command	Why you use it
`hostname R1`	the device name; it shows in the prompt and is required for SSH
`no ip domain-lookup`	a mistyped command is no longer treated as a name to resolve through DNS (otherwise you wait tens of seconds)
`enable secret ...`	the privileged mode password, stored as a hash
`line console 0` + `password` + `login`	the console port password; without `login`, the password isn't requested
`logging synchronous`	system messages no longer break up the command you're typing
`exec-timeout 5 0`	disconnects after 5 minutes and 0 seconds of inactivity
`service password-encryption`	hides clear-text passwords in the configuration (weak type 7 encryption)
`security passwords min-length 10`	minimum length for passwords configured from now on
`banner motd # ... #`	the message shown at login; `#` is the delimiter and must not appear in the text

Two things the exam asks about often:

enable secret beats enable password. If you have both, only enable secret is used. Always use it.
service password-encryption isn't real security. Type 7 encryption can be cracked in seconds; it only protects you from shoulder surfing.

To block repeated password-guessing attempts: login block-for 120 attempts 3 within 60 (blocks logins for 120 seconds after 3 failed attempts within 60 seconds).

Remote access with SSH

Telnet sends everything in clear text, including the password. SSH encrypts the session and is the only acceptable option today. The steps, in order:

R1(config)# ip domain-name example.local
R1(config)# crypto key generate rsa general-keys modulus 2048
R1(config)# ip ssh version 2
R1(config)# username admin privilege 15 secret ADMIN_PASSWORD
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# exec-timeout 10 0
R1(config-line)# end
R1# copy running-config startup-config

Step	Important detail
`hostname` (if not set yet)	must be different from the default; RSA keys can only be generated then
`ip domain-name`	the domain name becomes part of the key name; on recent IOS XE the command shows in the configuration as `ip domain name`; both forms are accepted (the same goes for `no ip domain lookup`)
`crypto key generate rsa ... modulus 2048`	creates the keys and starts the SSH server; SSH v2 needs at least 768-bit keys on classic IOS; use 2048 or more today
`ip ssh version 2`	disables version 1, which is old and insecure
`username ... secret ...`	the local user, with the password stored as a hash
`transport input ssh`	the vty lines accept only SSH, not Telnet
`login local`	authentication uses the local users, not the line password

On switches there are usually 16 vty lines, so you type line vty 0 15. On routers the number varies by model; line vty 0 4 is the classic form. See how many vty lines your device has with line vty 0 ? or show running-config | section line vty, and configure all of them.

Verification: show ip ssh (the SSH version and settings) and show ssh (the sessions currently connected). From another Cisco device you connect with ssh -l admin 192.168.1.1.

A switch's management address

A Layer 2 switch has no IP addresses on its ports. To manage it remotely, you give it an address on a virtual interface (SVI) and a default gateway:

S1(config)# interface vlan 99
S1(config-if)# ip address 192.168.99.11 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.99.1

VLANs, access ports and trunks have their own guide: VLANs and trunks explained.

Configuring interfaces

R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# description To the floor 1 LAN
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# ipv6 address 2001:db8:acad:10::1/64
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ipv6 unicast-routing

Command	Effect
`description ...`	a note for humans; doesn't change how anything works
`ip address <address> <mask>`	the IPv4 address; the mask is written in dotted decimal, not as a prefix
`ipv6 address <address>/<prefix>`	the IPv6 address; here you do use a prefix
`ipv6 address fe80::1 link-local`	replaces the automatically generated link-local address
`no shutdown`	enables the interface
`shutdown`	disables the interface
`ipv6 unicast-routing`	(global) enables IPv6 routing on the router

The rule that catches many beginners: router interfaces are shut down by default and need no shutdown. Switch ports are enabled by default. For IPv6 addresses and how to abbreviate them, see IPv6 addresses explained; for IPv4 masks and subnets, subnetting step by step.

Saving and managing the configuration

Command	What it does
`copy running-config startup-config`	saves the active configuration to NVRAM
`write memory` (or `wr`)	same effect, the older form, still accepted
`show running-config`	the active configuration
`show startup-config`	the saved configuration
`erase startup-config` or `write erase`	erases the saved configuration (after `reload`, the device boots empty)
`reload`	restarts the device
`copy running-config tftp:`	backup to a TFTP server
`copy startup-config running-config`	merges the saved configuration into the active one; it doesn't replace it

Broke something and haven't saved? A reload without saving (answer "no" when it asks whether to save) takes you back to the last saved configuration. On a switch, VLANs live in vlan.dat, so for a full reset you delete that file too: delete flash:vlan.dat.

Show commands cheat sheet

Command	What it shows you
`show version`	IOS version, uptime, model, memory, interfaces, configuration register
`show running-config`	the active configuration
`show startup-config`	the saved configuration
`show ip interface brief`	every interface, its IPv4 address and status (Status / Protocol), one per line
`show ipv6 interface brief`	the same for IPv6, with link-local and global addresses
`show interfaces g0/0/0`	Layer 1 and 2 details: MAC, speed, duplex, MTU, errors, CRC, collisions
`show ip interface g0/0/0`	Layer 3 details: the address, applied ACLs and other IP settings
`show ip route`	the IPv4 routing table (C = connected, L = local address, S = static, O = OSPF)
`show ipv6 route`	the IPv6 routing table
`show arp` (or `show ip arp`)	the ARP table: IP → MAC
`show mac address-table`	(switch) learned MAC addresses, per port and per VLAN
`show vlan brief`	(switch) VLANs and the access ports in each
`show interfaces trunk`	(switch) trunks, native VLAN, allowed VLANs
`show cdp neighbors`	directly connected Cisco neighbors: name, local port, remote port, model
`show cdp neighbors detail`	the same, plus the neighbors' IP addresses and IOS version
`show lldp neighbors`	neighbors via LLDP, the standard protocol (must be enabled with `lldp run`)
`show ip protocols`	active routing protocols and their settings
`show protocols`	interface status and their Layer 3 addresses
`show history`	the last commands typed in the current session
`show users`	who is connected to the device
`show clock`	the device's date and time
`show flash:`	the files in flash memory, including the IOS image
`show ip ssh`	whether SSH is enabled and which version it uses
`show logging`	system messages kept in memory

Filtering output

Long output can be filtered with the pipe:

Filter	Example	Effect
`include`	`show running-config \| include hostname`	only lines containing the text
`exclude`	`show ip interface brief \| exclude unassigned`	hides lines containing the text
`begin`	`show running-config \| begin line vty`	starts output at the first line containing the text
`section`	`show running-config \| section interface`	whole matching blocks

terminal length 0 turns off paging (--More--) for the current session, handy when you're copying a whole configuration.

Troubleshooting: ping, traceroute and interface status

ping

R1# ping 192.168.20.10
R1# ping 192.168.20.10 source GigabitEthernet0/0/0
R1# ping 192.168.20.10 repeat 100
R1# ping

The last form, ping with no arguments, starts an extended ping, which asks you step by step for the destination, packet count, size and source address.

Symbol	Meaning
`!`	a reply came back
`.`	timed out, no reply
`U`	a router along the path replied that the destination is unreachable

The first ping to a new destination often loses the first packet (.!!!!): the device first waits for the ARP reply. That's normal.

traceroute

traceroute 203.0.113.10 shows every router along the path and the time to reach it. A * means that hop didn't reply in time. On Windows the equivalent command is tracert. Where the list stops is a good clue to where the problem is.

Interface status (show ip interface brief)

Status	Protocol	What it means	What you do
up	up	all good	nothing
administratively down	down	the interface has `shutdown`	`no shutdown`
down	down	physical problem: cable unplugged or faulty, the other end shut down	check the cable and the other end
up	down	Layer 2 problem (especially on serial links: mismatched encapsulation at the two ends, missing `clock rate` on the DCE end)	check the configuration at both ends

In show interfaces, the counters help too: lots of CRC errors point to a bad cable or interference, while late collisions usually point to a duplex mismatch. clear counters resets them to zero so you can see whether they keep climbing.

debug (carefully)

R1# terminal monitor
R1# debug ip icmp
R1# undebug all

debug shows what the device is doing in real time, but it uses CPU. On a production device it can slow everything down or even hang it. Keep it as targeted and as short as possible, and always turn it off with undebug all (or no debug all). terminal monitor is needed to see the messages when you're connected over SSH rather than the console. show debugging shows which debugs are active.

On a PC (Windows)

Command	What it shows you
`ipconfig /all`	IP address, mask, gateway, DNS servers, MAC
`ping`	connectivity
`tracert`	the path to the destination
`arp -a`	the PC's ARP table
`nslookup`	resolving a name through DNS

Keyboard shortcuts

Key	Effect
Tab	completes the command
?	context-sensitive help
Up arrow / Ctrl+P	previous command in history
Down arrow / Ctrl+N	next command in history
Ctrl+A	moves the cursor to the start of the line
Ctrl+E	moves the cursor to the end of the line
Ctrl+W	deletes the word to the left of the cursor
Ctrl+R	redisplays the current line (useful after a system message)
Ctrl+Z	leaves configuration, straight to privileged EXEC
Ctrl+C	cancels the current line or leaves configuration
Ctrl+Shift+6	interrupts a long-running ping, traceroute or DNS lookup
Space (at `--More--`)	next page
Enter (at `--More--`)	next line
any other key (at `--More--`)	stops the output

How to learn them without rote memorization

Configure a router and a switch from scratch, from memory: hostname, passwords, SSH, interfaces, save. Repeat until it takes you under 10 minutes.
After every configuration command, verify with a show command. That's how you learn the pairs: ip address ↔ show ip interface brief, vlan ↔ show vlan brief, SSH ↔ show ip ssh.
Break things on purpose, then fix them: a forgotten shutdown, a wrong mask, a missing login on the console.
Tie commands to the layers: show interfaces is Layers 1–2, show ip route is Layer 3. See OSI vs TCP/IP.

Practice Cisco IOS commands in the Routerel app

Routerel has over 1,900 questions for CCNA 1 · ITN, CCNA 2 · IEN and CCNA 3 · CEN, including questions with zoomable configurations and show output, each with an explanation right after you answer. Your mistakes come back automatically through spaced repetition until you've mastered them, and the timed exam simulation shows you where you stand. New subscribers get a 7-day free trial with full access.

Discover the app

Frequently asked questions

What is the difference between running-config and startup-config?

The running-config is the active configuration, held in RAM; it's lost on reboot unless you save it. The startup-config is the configuration saved in NVRAM and loaded at boot. You sync them with copy running-config startup-config.

What is the difference between enable password and enable secret?

Both protect access to privileged mode, but enable secret stores the password as a hash that can't be read back, while enable password keeps it in clear text or with weak encryption. If both are configured, enable secret is used.

What do I need to configure for SSH access to a Cisco router?

A hostname other than the default, a domain name (ip domain-name), an RSA key pair (crypto key generate rsa), a local user (username ... secret ...), then on the vty lines: transport input ssh and login local. ip ssh version 2 is also recommended.

What does service password-encryption do?

It hides clear-text passwords in the configuration (for example the console and vty passwords) using weak type 7 encryption. It protects you from shoulder surfing, but the passwords are easy to decrypt, so it's no substitute for enable secret and users configured with secret.

How do I quickly exit configuration mode?

With end or Ctrl+Z you go straight to privileged EXEC mode (the prompt with #). The exit command only goes up one level.

How do I run a show command from configuration mode?

Put do in front of it, for example do show ip interface brief. That way you don't have to leave and re-enter configuration mode. For a complete study plan, see our guide to CCNA.

Routerel is an independent app and is not affiliated with, sponsored by or endorsed by Cisco Systems, Inc. Cisco, CCNA, Cisco IOS and Networking Academy are trademarks of Cisco Systems, Inc.