Cisco IOS and IOS XE commands cheat sheet

Enter privileged EXEC mode from user EXEC mode.

The prompt changes from > to #. Use disable to go back to user EXEC.

Enter global configuration mode.

The prompt becomes (config)#. Commands take effect in the running configuration as soon as you enter them.

Return to privileged EXEC mode from any configuration mode.

Ctrl-Z does the same. exit moves up only one level, for example from (config-if)# to (config)#.

List the commands, keywords or arguments available at this point.

Type part of a word followed by ? (for example sh?) to list the commands that start with it.

Run a show or other EXEC command without leaving configuration mode.

do cannot run configure terminal.

Show only the output lines that match a pattern.

Use | begin to start at the first match and | exclude to hide matching lines. Patterns are case sensitive.

Set the device name shown in the prompt.

Start with a letter and use only letters, digits and hyphens, up to 63 characters.

Set the password for privileged EXEC mode, stored as a one-way hash.

Use enable secret rather than enable password. If both exist, enable secret wins.

Create a local admin account with a hashed password.

Privilege 15 gives the user privileged EXEC access. Use secret, not password, so it is not stored reversibly.

Set the default DNS domain name of the device.

A hostname and domain name are needed before you can generate the RSA key for SSH. Older releases use ip domain-name.

Generate the RSA key pair that turns on the SSH server.

Use 2048 bits or more. If SSH commands are rejected, the key was not generated.

Accept only SSH version 2 connections.

Without this command the SSH server runs in compatibility mode and also accepts SSH version 1. Check with show ip ssh.

Enter configuration mode for the virtual terminal (SSH and Telnet) lines.

The number of lines varies by platform (Catalyst 9000 switches have more). Apply SSH-only settings to every line.

Make the selected lines check logins against the local username database.

If aaa new-model is configured, AAA method lists control login instead.

Allow only SSH, not Telnet, on the selected lines.

Set the message of the day shown to everyone who connects.

<c> is any delimiter character that does not appear in the message.

Sync the device clock with an NTP server.

Add prefer to the server you want used first when several are configured.

Send syslog messages to a remote syslog server.

Repeat for more servers. logging trap <level> sets the lowest severity sent; the default is informational.

Enter configuration mode for one interface.

Abbreviations such as gi1/0/1 also work.

Configure several interfaces at once.

Put a space before the hyphen. Separate several ranges with a comma.

Label an interface so its purpose shows in the configuration and show output.

Assign an IPv4 address to a routed interface or SVI.

On a switch, use it on an SVI (interface vlan) or on a physical port first turned into a routed port with no switchport.

Administratively disable an interface.

The interface shows as administratively down until you enter no shutdown.

Enable an interface that was shut down.

Check the result with show ip interface brief.

Create or edit a switched virtual interface (SVI) for a VLAN.

Give it an IP address to manage the switch or to route between VLANs (with ip routing).

Create a VLAN and enter VLAN configuration mode.

Valid IDs are 1 to 4094. The prompt becomes (config-vlan)#.

Give the VLAN a name.

Without a name the VLAN is called VLAN followed by its zero-padded ID, such as VLAN0010.

Make the port an access port that carries one untagged VLAN.

Put an access port in a VLAN.

If the VLAN does not exist yet, the switch creates it.

Make the port an 802.1Q trunk that carries several tagged VLANs.

Set the VLAN used for untagged traffic on a trunk.

The default is VLAN 1. Use the same native VLAN on both ends of the trunk or spanning-tree loops can result.

Set the exact list of VLANs a trunk may carry.

This replaces the existing list. Use ranges like 10-20 with no spaces. All VLANs are allowed by default.

Add VLANs to a trunk's allowed list without replacing it.

The same command takes remove, except, all and none.

List VLANs with their names, status and access ports.

Show trunk ports with their native VLAN and allowed and active VLANs.

For one port's mode, native VLAN and allowed list, use show interfaces <interface> switchport.

Turn on IPv4 routing on a Layer 3 switch.

Catalyst switches start in Layer 2 mode with IP routing disabled.

Add a static route.

Set a distance higher than your routing protocol's to make a floating backup route. Remove it with no ip route.

Add a default route (gateway of last resort).

Start an OSPF process and enter router configuration mode.

The process ID is local to the device and does not have to match neighbors.

Run OSPF on interfaces whose addresses match the range and place them in an area.

Uses a wildcard (inverse) mask, not a subnet mask. Every area must connect to backbone area 0.

Show the routing table, including the gateway of last resort.

Codes at the start of each line show the source, for example C connected, S static, O OSPF.

List OSPF neighbors and their adjacency state.

Add detail for more. Neighbors that exchange routes reach FULL; DROTHER pairs on a LAN stay at 2WAY.

Show the software version, uptime and hardware model.

Show the configuration currently in use.

Add interface <interface> to see just one interface.

List interfaces with their IP address and up or down status in one line each.

Status administratively down means the interface is shut down.

List switch ports with description, status, VLAN, duplex, speed and type.

Show detailed status and counters for an interface, including errors.

Reset the counters with clear counters <interface>.

List directly connected Cisco devices and the ports that link them.

detail adds IP address, software version and native VLAN. CDP must be enabled (cdp run).

Show the MAC addresses the switch has learned and the port and VLAN for each.

Filter with address <mac>, interface <interface>, vlan <vlan-id> or dynamic.

Send ICMP echo requests to test reachability.

! means a reply and . means a timeout. Type ping alone in privileged EXEC mode for extended ping (source, count, size).

Show the hops packets take to reach a destination.

* means a probe timed out.

Print live diagnostic messages for a feature.

Debug output can load the CPU heavily on a busy device. On an SSH session, run terminal monitor to see it.

Turn off all debugging.

Same as no debug all. Turning off console logging only hides output; it does not stop the debug.

Save the running configuration so it survives a reload.

Short form of copy system:running-config nvram:startup-config.

Save the running configuration to NVRAM.

Same result as copy running-config startup-config.

Show the saved configuration the device will load at the next boot.

Restart the device.

Warning: Drops all traffic through the device while it boots, and any unsaved changes in the running configuration are lost. Answer no at the save prompt only if you mean to discard them.

Schedule a restart after a number of minutes.

Warning: The device restarts and loses unsaved changes when the timer runs out. Useful as a safety net before risky remote changes; cancel it with reload cancel once you know you still have access.

Delete the saved startup configuration.

Warning: The saved configuration is gone and cannot be restored on most platforms. After the next reload the device boots with no configuration. Back it up first.

Delete the saved startup configuration (older form of erase nvram:).

Warning: Same effect as erase startup-config: the saved configuration is lost and the device boots unconfigured after a reload. Cisco documents erase nvram: as the replacement.