Cisco IOS Essential Commands Cheat Sheet
A compact command reference for experienced administrators covering inspection, interface and VLAN configuration, routing, SSH, ACLs, logging, saving configuration and troubleshooting — with risk levels and verification commands throughout.
This cheat sheet lists the most commonly needed Cisco IOS and IOS XE commands, organised by task. Every command shows its required mode, risk level and a verification command. Exact syntax, available options and command behaviour vary by device model and software release — verify support before applying any configuration to a production device.
Configuration changes can interrupt connectivity, lock out administrators or expose the network if applied incorrectly. Back up the configuration and confirm console access before changing a production device.
Command Modes
| Mode | Prompt | How to enter | Purpose |
|---|---|---|---|
| User EXEC | hostname> | Default on login | Limited inspection |
| Privileged EXEC | hostname# | enable | Full inspection, diagnostics, entry to config |
| Global Configuration | hostname(config)# | configure terminal | Device-wide configuration changes |
| Interface Configuration | hostname(config-if)# | interface <INTERFACE> | Per-interface settings |
| Line Configuration | hostname(config-line)# | line vty 0 4 or line con 0 | Console and VTY settings |
| Router Configuration | hostname(config-router)# | router <PROTOCOL> | Routing protocol settings |
| VLAN Configuration | hostname(config-vlan)# | vlan <VLAN-ID> | VLAN name and settings |
exit moves back one level. end or Ctrl+Z returns to Privileged EXEC mode from any sub-mode.
Device Inspection — Read-Only
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show version | Privileged EXEC | Platform, software release, uptime, hardware | LOW |
| show running-config | Privileged EXEC | Active configuration in RAM | LOW — output is sensitive |
| show startup-config | Privileged EXEC | Saved configuration in NVRAM | LOW — output is sensitive |
| show clock | Privileged EXEC | Device time | LOW |
| show ntp associations | Privileged EXEC | NTP synchronisation status | LOW |
| show users | Privileged EXEC | Active management sessions | LOW |
| show logging | Privileged EXEC | Buffered device logs | LOW |
| show cdp neighbors detail | Privileged EXEC | Directly connected Cisco devices (where CDP is enabled) | LOW |
| show lldp neighbors detail | Privileged EXEC | Directly connected devices via LLDP (vendor-neutral) | LOW |
Interface Status
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show ip interface brief | Privileged EXEC | Compact view of addresses and status for all interfaces | LOW |
| show interfaces | Privileged EXEC | Detailed statistics, errors and counters | LOW |
| show interfaces <INTERFACE> | Privileged EXEC | Status and counters for one interface | LOW |
| show interfaces status | Privileged EXEC | Switch port state, VLAN, duplex and speed (where supported) | LOW |
VLANs
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show vlan brief | Privileged EXEC | VLANs and port membership | LOW |
| show mac address-table | Privileged EXEC | Learned MAC addresses and ports | LOW |
| vlan <VLAN-ID> | Global Config | Create VLAN and enter VLAN config mode | MEDIUM |
| name <VLAN-NAME> | VLAN Config | Assign a descriptive name to the VLAN | MEDIUM |
| interface <INTERFACE> | Global Config | Enter interface config | MEDIUM |
| switchport mode access | Interface Config | Set port as access port | MEDIUM |
| switchport access vlan <VLAN-ID> | Interface Config | Assign port to VLAN | MEDIUM — verify the VLAN exists first |
Trunk Ports
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show interfaces trunk | Privileged EXEC | Active trunks and permitted VLANs | LOW |
| switchport mode trunk | Interface Config | Set port as trunk | HIGH — can affect multiple VLANs |
| switchport trunk native vlan <VLAN-ID> | Interface Config | Set native VLAN for untagged traffic | HIGH — mismatch causes problems |
| switchport trunk allowed vlan <VLAN-LIST> | Interface Config | Replace the full permitted VLAN list | HIGH — verify before use |
| switchport trunk allowed vlan add <VLAN-LIST> | Interface Config | Add VLANs to permitted list without replacing it | HIGH |
Spanning Tree
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show spanning-tree | Privileged EXEC | STP status across VLANs | LOW |
| show spanning-tree vlan <VLAN-ID> | Privileged EXEC | STP status for one VLAN | LOW |
| show spanning-tree interface <INTERFACE> detail | Privileged EXEC | STP detail for one port | LOW |
Routing
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show ip route | Privileged EXEC | Full routing table | LOW |
| show ip route connected | Privileged EXEC | Directly connected routes | LOW |
| show ip route static | Privileged EXEC | Statically configured routes | LOW |
| ping <DESTINATION> | Privileged EXEC | Basic connectivity test | LOW |
| traceroute <DESTINATION> | Privileged EXEC | Path and hop latency | LOW |
| ip route <NETWORK> <SUBNET-MASK> <NEXT-HOP> | Global Config | Add static route | HIGH — verify next-hop and reverse path first |
Connectivity Testing
ping and traceroute confirm reachability and path. Use ping <DESTINATION> source <SOURCE-INTERFACE> to test from a specific interface where supported. A successful ping from the device does not confirm client reachability if NAT, ACLs or routing asymmetry is involved.
SSH Configuration and Inspection
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show ip ssh | Privileged EXEC | SSH version and status | LOW |
| show running-config | section line vty | Privileged EXEC | VTY line configuration | LOW — output is sensitive |
| hostname <HOSTNAME> | Global Config | Set device hostname (required for SSH key generation) | MEDIUM |
| ip domain name <DOMAIN> | Global Config | Set domain name (required for key generation) | MEDIUM |
| crypto key generate rsa modulus 2048 | Global Config | Generate RSA keys for SSH | MEDIUM — verify current Cisco guidance for minimum key size |
| ip ssh version 2 | Global Config | Enforce SSH version 2 | MEDIUM |
| username <USERNAME> privilege <LEVEL> secret <STRONG-UNIQUE-SECRET> | Global Config | Create local user with hashed secret | MEDIUM |
| line vty 0 4 | Global Config | Enter VTY line configuration | MEDIUM |
| login local | Line Config | Authenticate using local user database | MEDIUM |
| transport input ssh | Line Config | Allow only SSH (not Telnet) on VTY lines | MEDIUM |
| exec-timeout <MINUTES> <SECONDS> | Line Config | Set session idle timeout | MEDIUM |
SSH protects the connection; it does not by itself make the account secure. A hostname and domain name must be configured before RSA keys can be generated. Verify with show ip ssh after configuration.
Users and Sessions
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show users | Privileged EXEC | Active sessions and lines in use | LOW |
| show running-config | include username | Privileged EXEC | List local user accounts | LOW — output is sensitive |
| no username <USERNAME> | Global Config | Remove a local user account | HIGH — do not remove the account you are using |
| security passwords min-length <LENGTH> | Global Config | Enforce minimum password length for line passwords | MEDIUM |
ACL Inspection
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show access-lists | Privileged EXEC | All ACLs and hit counters | LOW |
| show ip interface <INTERFACE> | Privileged EXEC | Confirm ACL applied to interface and direction | LOW |
An incorrectly applied ACL can immediately block legitimate users, management access or business traffic. Confirm management access before applying any ACL to an interface.
DHCP Inspection
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show ip dhcp pool | Privileged EXEC | Configured DHCP pools | LOW |
| show ip dhcp binding | Privileged EXEC | Active DHCP leases and assigned addresses | LOW |
| show ip dhcp conflict | Privileged EXEC | Addresses with detected conflicts | LOW |
NAT Inspection
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show ip nat translations | Privileged EXEC | Active NAT translation table | LOW |
| show ip nat statistics | Privileged EXEC | NAT hit counts and pool usage | LOW |
| show ip interface <INTERFACE> | Privileged EXEC | Confirm NAT inside or outside designation on interface | LOW |
Logging
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show logging | Privileged EXEC | Buffered logs and logging configuration | LOW |
| logging host <SYSLOG-SERVER> | Global Config | Send logs to a remote syslog server | MEDIUM |
| logging trap <LEVEL> | Global Config | Set minimum severity level for remote logging | MEDIUM |
| service timestamps log datetime msec | Global Config | Add accurate timestamps to log entries | MEDIUM |
| terminal monitor | Privileged EXEC | Display live syslog in current session — use with care | LOW |
Configuration Saving
| Command | Mode | Purpose | Risk |
|---|---|---|---|
| show running-config | Privileged EXEC | Active configuration in RAM | LOW |
| show startup-config | Privileged EXEC | Saved configuration in NVRAM | LOW |
| copy running-config startup-config | Privileged EXEC | Save running configuration to NVRAM | MEDIUM — verify the configuration is correct first |
Configuration changes take effect in running-config immediately. They are lost after a restart unless saved. Save only after verifying the change.
Secure Backup
Configuration files may contain credentials, shared secrets, ACLs and infrastructure details. Store and transmit them securely. SCP or a protected network configuration-management platform is preferred where supported. TFTP and FTP provide no transport encryption and should be used only in formally accepted and isolated environments.
Troubleshooting Sequence
- 1Physical — check cables, SFPs, port LEDs, PoE where relevant
- 2Interface — show interfaces status, show interfaces <INTERFACE>
- 3IP addressing — show ip interface brief, verify address and mask
- 4VLAN — show vlan brief, confirm port membership
- 5Trunk — show interfaces trunk, confirm VLAN allowed and native VLAN
- 6Routing — show ip route, confirm route exists and next-hop is reachable
- 7ACL — show access-lists, show ip interface <INTERFACE>
- 8Application or service — confirm server-side, firewall and DNS after Layer 1–4 checks pass
Troubleshooting should move from physical state, to interface state, to addressing, to VLANs, to routing, to policy.
High-Risk Commands
The following commands can erase configuration, disconnect administrators or reload the device. Do not run them without a current backup, console access and an approved change plan.
- write erase / erase startup-config — deletes the saved configuration
- reload — restarts the device, applying the startup configuration
- configure replace — replaces running configuration from a file
- default interface <INTERFACE> — resets interface to defaults
- no vlan <VLAN-ID> — removes a VLAN and disconnects associated ports
- shutdown — administratively disables an interface
- no commands that remove routing, ACL or security configuration
Want the full explanation?
The full Technology Intelligence article covers each of these sections in depth, with security modernisation guidance, troubleshooting workflows by symptom, DHCP, NAT, port security, AAA, Spanning Tree safeguards and an Administrator Technical Note covering advanced hardening topics.
Essential Cisco IOS Commands for Network Configuration and Troubleshooting →
Plain-English Takeaway
Confirm the command mode, inspect before changing, verify the result and save only what has been tested. Prefer SSH, named accounts, SNMPv3 and secure backup methods. Back up the configuration before any production change and keep console access available at all times.
Downloadable guide
Download the Cisco IOS Essential Commands Cheat Sheet
A printable A4 PDF covering IOS modes, inspection commands, VLAN, trunk, routing, SSH, ACLs, logging, configuration saving, troubleshooting sequence and security warnings.
Download Cheat SheetFree download. No email address required.
Want the full business explanation?
The Technology Intelligence article covers why this matters, where it helps and what to watch out for.
Read the full Technology Intelligence articleRelated Knowledge Centre resources
Cyber Resilience Readiness Guide
Review your critical systems, IT suppliers, incident response, backups and business-continuity arrangements.
View guide