Cisco IOS CLI: Navigation and Basic Configuration

Cisco IOS CLI: Navigation and Basic Configuration

What the IOS CLI Is

Cisco IOS (Internetwork Operating System) is the software that runs on most Cisco switches and routers. You control the device entirely through a text-based command-line interface (CLI). Unlike a graphical interface, the CLI requires exact commands typed at a prompt. This precision is what makes the CLI fast and scriptable — and also why accuracy matters from your first keystroke.

You reach the CLI by connecting a laptop or lab PC to the device's console port using a rollover (console) cable and a terminal emulator such as PuTTY or Tera Term. Set the serial connection to 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. This out-of-band connection works even when the device has no IP address yet.

The Three Core Privilege Modes

Cisco IOS uses a hierarchy of modes, each with its own prompt and set of allowed commands.

User EXEC Mode is the first mode you see after logging in. The prompt ends with a right angle bracket: `Switch>`. From here you can run a limited set of read-only commands such as `ping` and `show version`. You cannot change any configuration here.

Privileged EXEC Mode (also called "enable mode") gives you full read access and the ability to save or reload the device. Enter it by typing `enable` at the User EXEC prompt. The prompt changes to a pound sign: `Switch#`. You protect this mode with an enable secret password, which is stored in hashed (encrypted) form.

Global Configuration Mode is where you make configuration changes that affect the whole device. Enter it from Privileged EXEC by typing `configure terminal` (or `conf t`). The prompt becomes `Switch(config)#`. From Global Configuration Mode you can drop into sub-modes such as interface configuration (`Switch(config-if)#`) or line configuration (`Switch(config-line)#`).

To move back up one level, type `exit`. To jump all the way back to Privileged EXEC from any sub-mode, type `end` or press Ctrl+Z.

Setting a Hostname

The hostname is the device's identity in the CLI prompt and in log messages. A good hostname identifies the location and role of the device (for example, `SW-Lab1-A`). Configure it in Global Configuration Mode:

```

Switch(config)# hostname SW-Lab1-A

SW-Lab1-A(config)#

```

The prompt updates immediately. Hostnames must begin with a letter, contain only letters, digits, and hyphens, and be 63 characters or fewer.

Securing the Device with Passwords

Leaving a device unsecured means anyone with physical access can reconfigure it. At minimum you must set two passwords:

1. Enable secret — protects Privileged EXEC Mode. Always use `enable secret` rather than the older `enable password` because `enable secret` is stored as a salted MD5 hash, not plain text.

```

SW-Lab1-A(config)# enable secret Cisco1234!

```

2. Console line password — protects the console port itself. Enter line configuration mode for console line 0, enable login, and set the password:

```

SW-Lab1-A(config)# line console 0

SW-Lab1-A(config-line)# password Lab@Pass1

SW-Lab1-A(config-line)# login

SW-Lab1-A(config-line)# exit

```

The `login` command tells IOS to actually prompt for the password; without it, the password setting has no effect.

For additional protection, encrypt all plain-text passwords in the config file with:

```

SW-Lab1-A(config)# service password-encryption

```

Configuring a MOTD Banner

A Message of the Day (MOTD) banner appears on the screen before login. Legally, banners should warn unauthorized users that access is monitored and restricted — never use a welcoming message like "Welcome!" because courts have sometimes interpreted such messages as permission to enter. A proper banner reads more like: "Authorized users only. Unauthorized access is prohibited and monitored."

Configure a MOTD banner in Global Configuration Mode using a delimiter character (any character not in your message text) to mark the start and end of the message:

```

SW-Lab1-A(config)# banner motd #

Enter TEXT message. End with the character '#'.

Authorized users only. All activity is logged.

#

```

Saving the Configuration

Cisco devices store two configurations: the running-config in RAM (lost on power-off) and the startup-config in NVRAM (loaded at boot). After making changes, always save:

```

SW-Lab1-A# copy running-config startup-config

Destination filename [startup-config]? [Enter]

```

Alternatively, `write memory` (or `wr`) produces the same result on most IOS versions.

Verifying with Show Commands

The `show` family of commands is your primary troubleshooting and verification toolkit. Run them in User EXEC or Privileged EXEC Mode:

• `show version` — IOS version, uptime, hardware model, memory
• `show running-config` — current active configuration in RAM
• `show startup-config` — configuration stored in NVRAM
• `show interfaces` — status and statistics for all interfaces
• `show mac address-table` — MAC-to-port mappings on a switch
• `show ip interface brief` — quick summary of interface IP addresses and status
• `show cdp neighbors` — directly connected Cisco devices

Get comfortable piping output: `show running-config | include hostname` filters for lines containing "hostname."

Safety and Workspace Practices

Cisco switches operate at standard AC voltages internally and should never be opened in this lab. Do not stack equipment unsafely on benches; dropped switches can injure feet and damage ports. Console and Ethernet cables are low-voltage signal cables posing no electrical shock hazard under normal conditions, but keep work areas clear of trip hazards from cable runs. Follow lab rules about food, drink, and electrostatic discharge (ESD) — ground yourself before handling expansion modules or memory. Back up any pre-existing device configuration before overwriting it; in a production environment, unauthorized changes to switch or router configs can take down live services.