LearnCCNA

Search

Appendix B

Command Reference

This appendix gathers the Cisco IOS and IOS-XE commands used throughout the guide, grouped by topic, with a one-line purpose for each. The prompt column shows the mode in which the command is entered: # is privileged EXEC, (config)# is global configuration, (config-if)# is interface configuration, and so on.

Basic device setup

Command Mode Purpose
enable > Enter privileged EXEC mode
configure terminal # Enter global configuration mode
hostname SW1 (config)# Set the device name
enable secret Cisco123 (config)# Set the encrypted privileged EXEC password (preferred over enable password)
service password-encryption (config)# Weakly encrypt (type 7) plaintext passwords in the config
banner motd #Authorized users only# (config)# Set the message-of-the-day login banner
no ip domain-lookup (config)# Stop the device trying to DNS-resolve mistyped commands
line console 0 (config)# Enter console line configuration
line vty 0 4 (config)# Enter configuration for virtual terminal (Telnet/SSH) lines 0-4
password cisco (config-line)# Set the line password
login (config-line)# Require the line password at login
login local (config-line)# Authenticate the line against the local username database
exec-timeout 5 0 (config-line)# Log out an idle session after 5 minutes 0 seconds
logging synchronous (config-line)# Stop log messages from interrupting typed commands
username admin privilege 15 secret Cisco123 (config)# Create a local user with full privilege and a hashed password
ip default-gateway 192.168.1.1 (config)# Set the default gateway for a Layer 2 switch’s management traffic
interface vlan 1 (config)# Enter the switch virtual interface used for management
ip address 192.168.1.2 255.255.255.0 (config-if)# Assign an IPv4 address and mask to an interface
no shutdown (config-if)# Administratively enable an interface
copy running-config startup-config # Save the running configuration to NVRAM
write memory # Older alias for saving the configuration
erase startup-config # Delete the saved configuration
reload # Reboot the device
clock set 14:30:00 8 Sep 2026 # Set the system clock manually
do show running-config (config)# Run an EXEC command from within configuration mode

Interfaces

Command Mode Purpose
interface GigabitEthernet0/1 (config)# Enter interface configuration mode
interface range GigabitEthernet1/0/1 - 24 (config)# Configure many interfaces at once
description Uplink to CORE (config-if)# Document the interface’s purpose
speed 1000 (config-if)# Force interface speed (or speed auto)
duplex full (config-if)# Force duplex (or duplex auto)
mdix auto (config-if)# Enable automatic crossover detection
ipv6 enable (config-if)# Enable IPv6 and generate a link-local address without a global address
ipv6 address 2001:DB8:1::1/64 (config-if)# Assign a static IPv6 address
ipv6 address 2001:DB8:1::/64 eui-64 (config-if)# Assign an IPv6 address with an EUI-64 interface ID
ipv6 address FE80::1 link-local (config-if)# Set a manual link-local address
ipv6 address autoconfig (config-if)# Obtain an address by SLAAC
ipv6 unicast-routing (config)# Enable IPv6 routing on a router (required for RA and forwarding)
ip address dhcp (config-if)# Make the interface a DHCP client
shutdown (config-if)# Administratively disable an interface

VLANs and trunks

Command Mode Purpose
vlan 10 (config)# Create VLAN 10 and enter VLAN config mode
name Sales (config-vlan)# Name the VLAN
switchport mode access (config-if)# Make the port a static access port
switchport access vlan 10 (config-if)# Assign the access port to VLAN 10
switchport voice vlan 20 (config-if)# Assign the voice VLAN for an attached IP phone
switchport mode trunk (config-if)# Make the port a static 802.1Q trunk
switchport trunk encapsulation dot1q (config-if)# Set trunk encapsulation on switches that also support ISL (required before mode trunk there)
switchport trunk native vlan 99 (config-if)# Set the untagged native VLAN on the trunk
switchport trunk allowed vlan 10,20,30 (config-if)# Limit which VLANs the trunk carries (add, remove, except, all keywords exist)
switchport nonegotiate (config-if)# Disable DTP negotiation frames
switchport mode dynamic desirable (config-if)# DTP: actively try to form a trunk
switchport mode dynamic auto (config-if)# DTP: form a trunk only if the neighbor asks
interface GigabitEthernet0/0.10 (config)# Create a router subinterface for router-on-a-stick
encapsulation dot1q 10 (config-subif)# Tag the subinterface with VLAN 10 (add native for the native VLAN)
ip routing (config)# Enable IPv4 routing on a multilayer switch
interface vlan 10 (config)# Create an SVI for inter-VLAN routing on a Layer 3 switch
no switchport (config-if)# Make a multilayer switch port a routed (Layer 3) port
vtp mode transparent (config)# Stop the switch from participating in VTP VLAN propagation

Layer 2 discovery (CDP and LLDP)

Command Mode Purpose
cdp run / no cdp run (config)# Enable or disable CDP globally
cdp enable / no cdp enable (config-if)# Enable or disable CDP on one interface
cdp timer 60 (config)# Set the CDP advertisement interval (default 60 s)
cdp holdtime 180 (config)# Set the CDP hold time (default 180 s)
lldp run (config)# Enable LLDP globally (off by default)
lldp transmit / lldp receive (config-if)# Control LLDP per interface direction
lldp timer 30 (config)# Set the LLDP advertisement interval (default 30 s)
lldp holdtime 120 (config)# Set the LLDP hold time (default 120 s)

EtherChannel

Command Mode Purpose
interface range GigabitEthernet1/0/1 - 2 (config)# Select the member links
channel-group 1 mode active (config-if)# LACP; actively negotiate (pairs with active or passive)
channel-group 1 mode passive (config-if)# LACP; respond only
channel-group 1 mode desirable (config-if)# PAgP; actively negotiate (pairs with desirable or auto)
channel-group 1 mode auto (config-if)# PAgP; respond only
channel-group 1 mode on (config-if)# Static EtherChannel, no negotiation protocol (both sides must be on)
interface port-channel 1 (config)# Configure the logical bundle interface
lacp rate fast (config-if)# Request LACP PDUs every 1 s instead of 30 s
port-channel load-balance src-dst-ip (config)# Set the load-balancing hash method
no switchport (on port-channel and members) (config-if)# Create a Layer 3 EtherChannel

Spanning Tree

Command Mode Purpose
spanning-tree mode rapid-pvst (config)# Run Rapid PVST+ (older Catalyst default is pvst; Catalyst 9000 defaults to rapid-pvst)
spanning-tree vlan 10 root primary (config)# Make this switch the root for VLAN 10 (priority 24576 or lower as needed)
spanning-tree vlan 10 root secondary (config)# Set priority 28672 to become the backup root
spanning-tree vlan 10 priority 4096 (config)# Set the bridge priority manually (multiples of 4096)
spanning-tree vlan 10 cost 4 (config-if)# Change the port cost for VLAN 10
spanning-tree vlan 10 port-priority 64 (config-if)# Change the port priority (default 128)
spanning-tree portfast (config-if)# Skip listening/learning on an access port
spanning-tree portfast default (config)# Enable PortFast on all access ports
spanning-tree bpduguard enable (config-if)# Err-disable the port if a BPDU arrives
spanning-tree portfast bpduguard default (config)# Enable BPDU Guard on all PortFast ports
spanning-tree bpdufilter enable (config-if)# Stop sending and receiving BPDUs on the port
spanning-tree guard root (config-if)# Block a superior BPDU from making a downstream switch the root
spanning-tree guard loop (config-if)# Loop Guard: block a port that stops receiving BPDUs
spanning-tree loopguard default (config)# Enable Loop Guard globally
errdisable recovery cause bpduguard (config)# Automatically recover err-disabled ports (default interval 300 s)

Static routing

Command Mode Purpose
ip route 10.2.0.0 255.255.0.0 192.168.12.2 (config)# Static route to a network via a next-hop address
ip route 10.2.0.0 255.255.0.0 Serial0/0/0 (config)# Static route via an exit interface (point-to-point links)
ip route 10.2.0.0 255.255.0.0 Gi0/1 192.168.12.2 (config)# Fully specified static route (interface and next hop)
ip route 0.0.0.0 0.0.0.0 203.0.113.1 (config)# Default route (gateway of last resort)
ip route 10.9.9.9 255.255.255.255 192.168.12.2 (config)# Host route (/32)
ip route 10.2.0.0 255.255.0.0 192.168.13.2 200 (config)# Floating static route with AD 200 (backup)
ipv6 route 2001:DB8:2::/64 2001:DB8:12::2 (config)# IPv6 static route via next hop
ipv6 route 2001:DB8:2::/64 Gi0/1 FE80::2 (config)# IPv6 static route via link-local next hop (interface required)
ipv6 route ::/0 2001:DB8:12::2 (config)# IPv6 default route
ip default-network (rarely used) (config)# Legacy way to set a gateway of last resort

OSPFv2

Command Mode Purpose
router ospf 1 (config)# Start OSPF process 1 (process ID is locally significant)
router-id 1.1.1.1 (config-router)# Set the router ID manually (requires process restart to take effect)
network 10.1.1.0 0.0.0.255 area 0 (config-router)# Enable OSPF on interfaces matching the wildcard, in area 0
passive-interface GigabitEthernet0/1 (config-router)# Advertise the interface’s network but send no hellos on it
passive-interface default (config-router)# Make all interfaces passive, then no passive-interface selected ones
default-information originate (config-router)# Advertise the router’s default route into OSPF
auto-cost reference-bandwidth 100000 (config-router)# Set the reference bandwidth in Mbps (default 100)
ip ospf 1 area 0 (config-if)# Enable OSPF directly on an interface (alternative to network)
ip ospf cost 10 (config-if)# Set the interface cost manually
ip ospf priority 0 (config-if)# Prevent the router from becoming DR/BDR (default priority 1)
ip ospf network point-to-point (config-if)# Change the network type (no DR/BDR election)
ip ospf hello-interval 10 (config-if)# Set the hello timer (default 10 s broadcast, 30 s NBMA)
ip ospf dead-interval 40 (config-if)# Set the dead timer (default 4 x hello)
bandwidth 10000 (config-if)# Set the interface bandwidth in kbps (affects OSPF cost)
clear ip ospf process # Restart OSPF (needed for a new router ID)

First hop redundancy (HSRP)

Command Mode Purpose
standby version 2 (config-if)# Use HSRPv2 (supports IPv6, group numbers 0-4095)
standby 1 ip 192.168.1.1 (config-if)# Set the virtual IP for HSRP group 1
standby 1 priority 110 (config-if)# Set priority (default 100; highest wins)
standby 1 preempt (config-if)# Allow a higher-priority router to take over the active role
standby 1 track GigabitEthernet0/0 20 (config-if)# Decrement priority by 20 if the tracked interface fails
standby 1 timers 1 3 (config-if)# Set hello to 1 s and hold to 3 s (defaults 3 and 10)
standby 1 authentication md5 key-string Cisco (config-if)# Authenticate HSRP messages
vrrp 1 ip 192.168.1.1 (config-if)# Configure VRRP group 1 (classic IOS syntax)
glbp 1 ip 192.168.1.1 (config-if)# Configure GLBP group 1

NAT

Command Mode Purpose
ip nat inside (config-if)# Mark an interface as inside
ip nat outside (config-if)# Mark an interface as outside
ip nat inside source static 10.1.1.10 203.0.113.10 (config)# Static one-to-one NAT
ip nat pool PUBLIC 203.0.113.20 203.0.113.30 netmask 255.255.255.0 (config)# Define a pool of public addresses
access-list 1 permit 10.1.1.0 0.0.0.255 (config)# Define which inside addresses are translated
ip nat inside source list 1 pool PUBLIC (config)# Dynamic NAT using the pool
ip nat inside source list 1 pool PUBLIC overload (config)# PAT using the pool
ip nat inside source list 1 interface GigabitEthernet0/0 overload (config)# PAT using the outside interface address
clear ip nat translation * # Clear all dynamic translations

DHCP

Command Mode Purpose
ip dhcp excluded-address 192.168.1.1 192.168.1.10 (config)# Reserve addresses the server must not hand out
ip dhcp pool LAN (config)# Create a DHCP pool
network 192.168.1.0 255.255.255.0 (dhcp-config)# Define the subnet the pool serves
default-router 192.168.1.1 (dhcp-config)# Default gateway offered to clients
dns-server 8.8.8.8 8.8.4.4 (dhcp-config)# DNS servers offered to clients
domain-name example.com (dhcp-config)# Domain name offered to clients
lease 0 12 (dhcp-config)# Lease time of 0 days 12 hours (default 1 day)
ip helper-address 10.1.1.100 (config-if)# DHCP relay: forward client broadcasts to the server as unicast
ip address dhcp (config-if)# Make the router interface a DHCP client
no service dhcp (config)# Disable the DHCP server/relay service

NTP

Command Mode Purpose
ntp server 10.1.1.100 (config)# Synchronize to an NTP server (client mode); add prefer for a preferred server
ntp master 3 (config)# Act as an authoritative NTP server at stratum 3
ntp source Loopback0 (config)# Source NTP packets from an interface
ntp authenticate (config)# Enable NTP authentication
ntp authentication-key 1 md5 Cisco (config)# Define an NTP key
ntp trusted-key 1 (config)# Trust the key
clock timezone CST -6 (config)# Set the time zone
clock summer-time CDT recurring (config)# Enable daylight saving time

Syslog and SNMP

Command Mode Purpose
logging host 10.1.1.200 (config)# Send syslog messages to a server (also logging 10.1.1.200)
logging trap informational (config)# Send severity 0-6 messages to the syslog server
logging console warnings (config)# Console shows severity 0-4 only
logging monitor debugging (config)# Set the level for terminal (vty) lines
logging buffered 16384 informational (config)# Keep messages in RAM buffer with size and level
terminal monitor # Display log messages on the current SSH/Telnet session
service timestamps log datetime msec (config)# Add timestamps to log messages
service sequence-numbers (config)# Add sequence numbers to log messages
logging source-interface Loopback0 (config)# Source syslog from an interface
snmp-server community public RO (config)# SNMPv2c read-only community
snmp-server community private RW (config)# SNMPv2c read-write community
snmp-server location Dallas DC (config)# Set the sysLocation value
snmp-server contact netops@example.com (config)# Set the sysContact value
snmp-server host 10.1.1.201 version 2c public (config)# Send traps to a manager
snmp-server enable traps (config)# Enable all trap types
snmp-server group ADMIN v3 priv (config)# SNMPv3 group with authentication and encryption
snmp-server user bob ADMIN v3 auth sha Pass123 priv aes 128 Key123 (config)# SNMPv3 user with SHA auth and AES-128 privacy

SSH and device security

Command Mode Purpose
ip domain-name example.com (config)# Domain name required before generating RSA keys
crypto key generate rsa modulus 2048 (config)# Generate the RSA key pair used by SSH
ip ssh version 2 (config)# Allow SSHv2 only
ip ssh time-out 60 (config)# SSH negotiation timeout in seconds
ip ssh authentication-retries 3 (config)# Maximum login attempts
transport input ssh (config-line)# Allow only SSH on the vty lines (transport input none blocks all)
access-class 10 in (config-line)# Restrict vty access using ACL 10
login block-for 120 attempts 3 within 60 (config)# Block logins for 120 s after 3 failures in 60 s
security passwords min-length 10 (config)# Enforce minimum password length
aaa new-model (config)# Enable AAA
tacacs server ISE / address ipv4 10.1.1.50 / key Cisco123 (config)# Define a TACACS+ server
radius server ISE / address ipv4 10.1.1.50 auth-port 1812 acct-port 1813 / key Cisco123 (config)# Define a RADIUS server
aaa authentication login default group tacacs+ local (config)# Use TACACS+ for login, fall back to local users
ssh -l admin 10.1.1.1 # SSH from IOS to another device

Access control lists

Command Mode Purpose
access-list 10 permit 192.168.1.0 0.0.0.255 (config)# Standard numbered ACL (1-99, 1300-1999); matches source only
access-list 10 deny any (config)# Explicit deny (an implicit deny any always exists at the end)
access-list 100 permit tcp 10.1.1.0 0.0.0.255 any eq 443 (config)# Extended numbered ACL (100-199, 2000-2699); protocol, source, destination, ports
access-list 100 deny icmp any any echo (config)# Block ping requests
ip access-list standard MGMT (config)# Create a named standard ACL
ip access-list extended WEB-ONLY (config)# Create a named extended ACL
10 permit tcp host 10.1.1.5 any eq www (config-ext-nacl)# Named ACL entry with sequence number
remark Allow web from server (config-ext-nacl)# Add a comment inside the ACL
ip access-group 100 in (config-if)# Apply the ACL to an interface inbound (or out)
ipv6 access-list BLOCK-TELNET (config)# Create an IPv6 ACL (always named)
ipv6 traffic-filter BLOCK-TELNET in (config-if)# Apply an IPv6 ACL to an interface
no access-list 100 (config)# Delete the entire numbered ACL

Port security, DHCP snooping, and Dynamic ARP Inspection

Command Mode Purpose
switchport port-security (config-if)# Enable port security (port must be a static access or trunk port first)
switchport port-security maximum 2 (config-if)# Allow up to 2 MAC addresses (default 1)
switchport port-security mac-address 0050.56AB.1234 (config-if)# Statically allow a MAC
switchport port-security mac-address sticky (config-if)# Learn MACs dynamically and write them to the running config
switchport port-security violation shutdown (config-if)# Violation action: err-disable (default); alternatives restrict, protect
switchport port-security aging time 10 (config-if)# Age out secure MACs after 10 minutes
shutdown then no shutdown (config-if)# Recover an err-disabled port manually
errdisable recovery cause psecure-violation (config)# Auto-recover port-security err-disabled ports
ip dhcp snooping (config)# Enable DHCP snooping globally
ip dhcp snooping vlan 10,20 (config)# Enable snooping on specific VLANs
ip dhcp snooping trust (config-if)# Trust the port (toward the real DHCP server or uplinks)
ip dhcp snooping limit rate 10 (config-if)# Limit DHCP messages per second on an untrusted port
no ip dhcp snooping information option (config)# Stop inserting option 82 (needed when the relay/server rejects it)
ip arp inspection vlan 10,20 (config)# Enable Dynamic ARP Inspection on VLANs
ip arp inspection trust (config-if)# Trust the port for DAI (uplinks)
ip arp inspection validate src-mac dst-mac ip (config)# Add extra ARP validation checks
ip arp inspection limit rate 15 (config-if)# Limit ARP packets per second (default 15 on untrusted ports)

Verification (show) commands

Command Purpose
show running-config Current configuration in RAM
show startup-config Saved configuration in NVRAM
show version IOS version, uptime, hardware, configuration register, license
show ip interface brief One-line status (IP, up/down, protocol) for every interface
show ipv6 interface brief Same for IPv6 addresses
show interfaces GigabitEthernet0/1 Detailed counters, speed/duplex, errors, collisions, CRC
show interfaces status Switch port status, VLAN, duplex, speed, type
show interfaces trunk Trunk ports, encapsulation, native VLAN, allowed VLANs
show interfaces GigabitEthernet0/1 switchport Access/trunk mode, DTP, native and voice VLAN
show interfaces description Interface descriptions and status
show controllers Physical layer details (cable type, DCE/DTE on serial)
show vlan brief VLANs and their assigned access ports
show mac address-table MAC-to-port table (add dynamic, vlan 10, address xxxx)
show cdp neighbors Directly connected Cisco devices (add detail for IP and IOS)
show lldp neighbors LLDP neighbors (add detail)
show etherchannel summary Port-channel status flags (SU = Layer 2 in use, RU = Layer 3 in use)
show etherchannel port-channel Details on each bundle
show spanning-tree Root bridge, bridge ID, port roles/states/costs per VLAN
show spanning-tree vlan 10 STP details for one VLAN
show spanning-tree summary Mode and global STP features (PortFast, BPDU Guard, Loop Guard)
show ip route IPv4 routing table (add ospf, static, connected)
show ip route 10.1.1.1 The specific route the router would use for an address
show ipv6 route IPv6 routing table
show ip protocols Running routing protocols, router ID, networks, timers, neighbors
show ip ospf OSPF process details, router ID, areas, SPF runs
show ip ospf neighbor Neighbor state (FULL, 2WAY), DR/BDR role, dead timer
show ip ospf interface brief OSPF interfaces, area, cost, state, neighbor count
show ip ospf interface GigabitEthernet0/0 Hello/dead timers, network type, DR/BDR, priority
show ip ospf database The LSDB
show standby (add brief) HSRP state, virtual IP, active/standby routers, priority
show vrrp brief / show glbp brief VRRP and GLBP status
show ip nat translations Current NAT table
show ip nat statistics NAT hits, misses, inside/outside interfaces, pool usage
show ip dhcp binding Addresses leased by the DHCP server
show ip dhcp pool Pool ranges and utilization
show ip dhcp conflict Addresses detected as already in use
show ntp status Synchronized or not, stratum, reference clock
show ntp associations Configured servers and their reachability
show clock Current time (asterisk means not authoritative)
show logging Logging settings and buffered messages
show snmp SNMP statistics and contact/location
show snmp community Configured communities
show ip ssh SSH version and status
show ssh Active SSH sessions
show users Logged-in users and lines
show access-lists All ACLs with hit counts
show ip access-lists 100 One IPv4 ACL
show ip interface GigabitEthernet0/0 ACLs applied to the interface, helper addresses
show port-security Port security summary for all ports
show port-security interface GigabitEthernet0/1 Port security state, violation mode, count, last MAC
show port-security address Secure MAC addresses
show ip dhcp snooping DHCP snooping settings and trusted ports
show ip dhcp snooping binding The MAC/IP/VLAN/port binding table
show ip arp inspection DAI status and statistics per VLAN
show ip arp / show arp The router’s ARP cache
show interfaces GigabitEthernet0/1 counters errors Error counters only
show processes cpu CPU utilization
show flash: Files in flash memory
show history Recently entered commands
ping 10.1.1.1 / ping 10.1.1.1 source Loopback0 Test reachability (extended ping with ping alone)
traceroute 10.1.1.1 Hop-by-hop path
debug ip ospf adj / undebug all Debug OSPF adjacency formation; stop all debugging