CCNA Command Cheat Sheet
The essential Cisco IOS commands every CCNA needs, condensed to one page across device setup, interfaces, VLANs, routing, ACLs, NAT, DHCP, and SSH. Values in <angle brackets> are yours to supply; see the topic-specific cheat sheets for full depth.
1. Device setup & access
SSH prerequisite order: hostname, then ip domain-name, then generate keys. Keys will not generate until a hostname and domain name are set.
| Command | What it does |
|---|---|
hostname <name> | Name the device (global config); required before RSA key generation. |
enable secret <password> | Set the hashed privileged-EXEC (enable) password. |
username <user> secret <password> | Create a local account for SSH login (add 'privilege 15' for full admin). |
ip domain-name <domain> | Set the DNS domain; required before RSA keys can be created. |
crypto key generate rsa modulus <bits> | Generate the RSA key pair used by SSH (use 2048 or higher). |
line vty 0 4 | Enter VTY line config; then set 'login local' and 'transport input ssh' to require SSH. |
ip ssh version 2 | Force SSHv2 only (disable the weaker SSHv1). |
2. Interfaces & IP
Interfaces stay administratively down until 'no shutdown'.
| Command | What it does |
|---|---|
interface <type/number> | Enter interface config, e.g. GigabitEthernet0/1. |
ip address <ip> <mask> | Assign an IPv4 address and subnet mask. |
no shutdown | Administratively enable (bring up) the interface. |
description <text> | Add a label describing the link. |
interface range <type/first - last> | Configure several interfaces at once, e.g. Fa0/1 - 12. |
ipv6 address <ipv6>/<prefix> | Assign an IPv6 address (needs global 'ipv6 unicast-routing' to route). |
3. VLANs & trunking
On switches that also support ISL, run 'switchport trunk encapsulation dot1q' before 'switchport mode trunk'.
| Command | What it does |
|---|---|
vlan <id> | Create/enter a VLAN in the VLAN database. |
name <vlan-name> | Name the VLAN (inside vlan config). |
switchport mode access | Set the port to a single-VLAN access port. |
switchport access vlan <id> | Place the access port in a VLAN. |
switchport mode trunk | Set the port to carry tagged traffic for multiple VLANs. |
switchport trunk allowed vlan <vlan-list> | Restrict which VLANs cross the trunk (e.g. 10,20,30). |
switchport trunk native vlan <id> | Set the untagged (native) VLAN; must match both trunk ends. |
4. Inter-VLAN routing
SVI method needs 'ip routing' on a Layer 3 switch; router-on-a-stick uses one dot1Q subinterface per VLAN over a single trunk link.
| Command | What it does |
|---|---|
ip routing | Enable IPv4 routing on a multilayer switch so SVIs can route between VLANs. |
interface vlan <id> | Create an SVI; add 'ip address <ip> <mask>' and 'no shutdown' as the VLAN gateway. |
interface <type/number>.<subif> | Create a router subinterface (router-on-a-stick), one per VLAN. |
encapsulation dot1q <vlan-id> | Tag the subinterface for a VLAN (append 'native' for the native VLAN). |
ip address <ip> <mask> | Address the SVI/subinterface as that VLAN's default gateway. |
5. Routing (static, default, OSPF, EIGRP)
Wildcard = inverse mask (0.0.0.255 for /24). OSPF process-id is locally significant; EIGRP AS number must match on all neighbors.
| Command | What it does |
|---|---|
ip route <network> <mask> <next-hop-ip> | Static route; next-hop is resolved recursively via the routing table. |
ip route <network> <mask> <exit-interface> | Static route out an interface; relies on proxy-ARP (use on point-to-point links). |
ip route 0.0.0.0 0.0.0.0 <next-hop-ip> | Default route (gateway of last resort). |
router ospf <process-id> ; network <ip> <wildcard> area <area-id> | OSPF one-liner: start the process, then advertise interfaces into an area. |
router eigrp <as-number> ; network <ip> <wildcard> | EIGRP one-liner: start the AS, then advertise networks. |
no auto-summary | Disable classful auto-summarization (needed for discontiguous EIGRP/RIP networks). |
6. ACLs (standard, extended, apply)
Every ACL ends with an implicit 'deny any'. Standard 1-99/1300-1999 match source only, place near the destination; extended 100-199/2000-2699 match src+dst+port, place near the source.
| Command | What it does |
|---|---|
access-list <1-99> {permit|deny} <source> <wildcard> | Numbered standard ACL entry (source address only). |
access-list <100-199> {permit|deny} <protocol> <src> <src-wc> <dst> <dst-wc> [eq <port>] | Numbered extended ACL entry (protocol, source, destination, port). |
ip access-list {standard|extended} <name> | Enter named-ACL config, then add permit/deny lines beneath. |
ip access-group <acl> {in|out} | Apply the ACL to an interface in a direction. |
access-class <acl> in | Apply an ACL to the VTY lines to restrict SSH/Telnet access. |
7. NAT / PAT
Mark exactly one side inside and the other outside. 'overload' = PAT (many private hosts share one public IP via ports).
| Command | What it does |
|---|---|
ip nat inside | Mark the LAN-facing interface as NAT inside. |
ip nat outside | Mark the WAN-facing interface as NAT outside. |
ip nat inside source list <acl> interface <if> overload | PAT: translate ACL-matched hosts to the outside interface IP. |
ip nat inside source list <acl> pool <name> overload | PAT using a defined pool of public addresses. |
ip nat inside source static <inside-ip> <outside-ip> | Static one-to-one NAT (e.g. publish an internal server). |
ip nat pool <name> <start-ip> <end-ip> netmask <mask> | Define a pool of public addresses for dynamic NAT/PAT. |
8. DHCP (server)
Set 'ip dhcp excluded-address' (global) BEFORE the pool so the gateway and static IPs are never leased.
| Command | What it does |
|---|---|
ip dhcp excluded-address <first-ip> <last-ip> | Reserve a range so it is not handed out (global config). |
ip dhcp pool <name> | Create/enter a DHCP address pool. |
network <network> <mask> | Subnet the pool leases addresses from. |
default-router <gateway-ip> | Hand clients their default gateway. |
dns-server <ip> | Hand clients the DNS server address(es). |
lease <days> <hours> <minutes> | Set lease duration (default is 1 day). |
9. Save & verify
| Command | What it does |
|---|---|
copy running-config startup-config | Save the running config to NVRAM (alias: 'write memory'). |
show ip interface brief | Quick table of interface IPs plus line/protocol status. |
show ip route | Full routing table (codes C=connected, S=static, O=OSPF, D=EIGRP). |
show running-config | Display the active (unsaved) configuration. |
show vlan brief | List VLAN IDs, names, and assigned access ports. |
show ip protocols | Summarize running routing protocols and advertised networks. |
show cdp neighbors [detail] | Discover directly connected Cisco devices (add 'detail' for IPs/IOS). |
10. Subnet mask & wildcard quick reference
Usable hosts = 2^(32-prefix) - 2 (/31 = 2 per RFC 3021, /32 = 1). Wildcard = 255.255.255.255 - mask. Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
| CIDR | Subnet mask | Wildcard | Usable hosts |
|---|---|---|---|
/24 | 255.255.255.0 | 0.0.0.255 | 254 |
/25 | 255.255.255.128 | 0.0.0.127 | 126 |
/26 | 255.255.255.192 | 0.0.0.63 | 62 |
/27 | 255.255.255.224 | 0.0.0.31 | 30 |
/28 | 255.255.255.240 | 0.0.0.15 | 14 |
/29 | 255.255.255.248 | 0.0.0.7 | 6 |
/30 | 255.255.255.252 | 0.0.0.3 | 2 |
/31 | 255.255.255.254 | 0.0.0.1 | 2 (P2P) |
/32 | 255.255.255.255 | 0.0.0.0 | 1 (host) |
Frequently asked questions
What's the difference between a standard and an extended ACL, and where do I apply each?
A standard ACL (numbered 1-99 or 1300-1999) matches the source IP only, so you place it close to the destination to avoid dropping traffic too early. An extended ACL (100-199 or 2000-2699) matches source, destination, protocol, and port, so you place it close to the source to filter unwanted traffic before it crosses the network. Apply either to an interface with 'ip access-group <acl> {in|out}', and remember every ACL ends with an implicit 'deny any'.
How do I turn on SSH for a Cisco switch or router?
Set a 'hostname', set 'ip domain-name <domain>', then generate keys with 'crypto key generate rsa modulus 2048'. Create a local login ('username <user> secret <pw>'), and on 'line vty 0 4' set 'login local' and 'transport input ssh'; finish with 'ip ssh version 2'. The RSA keys will not generate until both the hostname and domain name are configured.
What's the difference between a next-hop and an exit-interface static route?
'ip route <net> <mask> <next-hop-ip>' does a recursive lookup — the router resolves the next-hop IP through its routing table before forwarding. 'ip route <net> <mask> <exit-interface>' sends packets straight out the named interface and depends on proxy-ARP at the far end, so it is best on true point-to-point links. A default route is just the all-zeros version: 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Stop memorizing — practice on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Start with the free sample.