Cisco IOS Commands Cheat Sheet
The Cisco IOS commands every CCNA candidate needs, grouped by task: moving between modes, setting up a new device, bringing up interfaces, locking down SSH access, saving your work, and verifying it. Values in <angle brackets> are what you supply; everything else is exact IOS syntax.
Modes & navigation
Prompt tells you where you are: > = user EXEC, # = privileged EXEC, (config)# = global config, (config-if)# = interface.
| Command | What it does |
|---|---|
enable | Enter privileged EXEC mode from user EXEC (disable goes back). |
configure terminal | Enter global configuration mode. |
interface <type> <num> | Enter interface config context, e.g. interface Gi0/1. |
line <console|vty> <num> | Enter a line config context, e.g. line console 0. |
exit | Drop back one mode/context level. |
end | Jump straight to privileged EXEC from any config context (same as Ctrl+Z). |
do <exec-command> | Run a privileged EXEC command without leaving config mode, e.g. do show ip interface brief. |
? | Context-sensitive help: list valid commands or the next argument. |
<Tab> | Auto-complete a partially typed keyword. |
show history | Show recently entered commands for this session. |
Basic device setup
clock set is privileged EXEC; ntp server is global config. Prefer NTP over manually setting the clock.
| Command | What it does |
|---|---|
hostname <name> | Set the device name shown in the prompt. |
enable secret <password> | Set the privileged EXEC password as a non-reversible hash (use this, not enable password). |
service password-encryption | Apply weak type-7 encryption to cleartext passwords in the config (obscures only). |
banner motd <delim> <message> <delim> | Login banner; pick a delimiter char not used in the text, e.g. #. |
no ip domain-lookup | Disable DNS lookups so a mistyped command doesn't hang trying to resolve. |
clock set <hh:mm:ss> <day> <month> <year> | Set the software clock (privileged EXEC), e.g. clock set 14:30:00 2 Jul 2026. |
ntp server <ip-address> | Synchronize the clock from an NTP server (global config). |
Interface configuration
switchport commands apply on Catalyst switch ports; ip address applies on routed interfaces and SVIs.
| Command | What it does |
|---|---|
interface <type> <num> | Enter interface config, e.g. interface GigabitEthernet0/1. |
interface range <type> <first> - <last> | Configure several ports at once, e.g. interface range Gi0/1 - 12. |
ip address <address> <mask> | Assign an IPv4 address and mask to a routed interface or SVI. |
no shutdown | Enable (bring up) the interface; router interfaces are shut down by default. |
description <text> | Label the interface (appears in show interfaces / show run). |
speed <10|100|1000|auto> | Fix port speed; default is auto. |
duplex <auto|full|half> | Fix duplex; default is auto. |
switchport mode access | Make the switch port an access (single-VLAN) port. |
switchport access vlan <vlan-id> | Place the access port in a VLAN. |
switchport mode trunk | Make the port a trunk (carries multiple VLANs). |
switchport trunk allowed vlan <vlan-list> | Restrict which VLANs the trunk carries, e.g. 10,20,30. |
Console/VTY & SSH
Set hostname and ip domain-name BEFORE generating RSA keys (the FQDN labels the key). For SSH logins use login local (not bare login).
| Command | What it does |
|---|---|
line console 0 | Enter the console line config context. |
line vty 0 4 | Enter the VTY (remote-access) lines 0-4. |
password <password> | Set the line password (used with the login command). |
login local | Authenticate against the local username database (required for SSH with usernames). |
username <name> secret <password> | Create a local user with a hashed password. |
ip domain-name <domain> | Set the domain name used to name the RSA key pair. |
crypto key generate rsa modulus 2048 | Generate a 2048-bit RSA key pair to enable SSH (needs hostname + ip domain-name set first). |
transport input ssh | On the VTY lines, permit SSH only (deny Telnet). |
ip ssh version 2 | Force SSHv2, which is more secure than v1. |
exec-timeout <minutes> <seconds> | Idle-session timeout for the line, e.g. exec-timeout 5 0. |
Saving, files & reload
Running-config lives in RAM and is lost on reload until you copy it to startup-config in NVRAM.
| Command | What it does |
|---|---|
copy running-config startup-config | Save the running config to NVRAM so it survives a reload. |
write memory | Older shorthand for the same save (abbreviate as wr). |
show startup-config | Display the saved configuration in NVRAM. |
reload | Reboot the device (prompts to save if there are unsaved changes). |
erase startup-config | Delete the saved config; the next reload starts from defaults. |
copy tftp running-config | Load a config from a TFTP server (prompts for server IP + filename). |
copy running-config tftp | Back up the running config to a TFTP server. |
dir flash: | List files (including the IOS image) stored in flash. |
Core verification
Your first-look commands: interface status, config, routing, and neighbors.
| Command | What it does |
|---|---|
show ip interface brief | One line per interface: IP, plus status/protocol (up/up, admin down, etc.). |
show running-config | Show the active in-RAM configuration. |
show version | IOS version, model, uptime, config register, and serials. |
show ip route | The IPv4 routing table (connected, static, and learned routes). |
show cdp neighbors detail | Directly connected Cisco neighbors, including their IP and IOS. |
show interfaces <type> <num> | Detailed interface state: errors, drops, negotiated speed/duplex. |
show vlan brief | On a switch, VLANs and their assigned access ports. |
show ip ssh | Confirm SSH is enabled and which version is active. |
Frequently asked questions
What's the difference between enable secret and enable password?
enable secret stores the privileged-EXEC password as a non-reversible hash (type 5 MD5, or type 8/9 on newer IOS), while enable password stores it in cleartext or, with service password-encryption, weak type-7 encryption that is trivially reversible. If both are set, IOS uses enable secret. Always use enable secret.
How do I enable SSH on a router or switch?
Set a hostname and a domain name (ip domain-name <domain>), generate keys with crypto key generate rsa modulus 2048, create a local login with username <name> secret <password>, then on line vty 0 4 apply login local and transport input ssh. Add ip ssh version 2 to force SSHv2. Verify with show ip ssh.
Why does show ip interface brief show my interface as 'administratively down'?
That status means the port is disabled in the config. Enter interface config and run no shutdown to bring it up. 'administratively down' = you disabled it; 'down/down' = enabled but no link (cable, speed/duplex, or the far end); 'up/up' = operational. Router interfaces default to shutdown, so no shutdown is required after addressing them.
Stop memorizing — practice on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Start with the free sample.