Cisco IOS and IOS XE Command Catalog
Each command family lists syntax, options, valid mode, use case, examples, verification, and warnings.
Catalog order:
CLI and help
Show commands
Interfaces
VLANs
STP
Routing
Services
ACLs
Management
Save and reload
Search the command catalog:
Search checks command syntax, options, mode, explanation, examples, verification, and warnings. Press Esc to clear.
Catalog rule: Start with the command family. Read the valid CLI mode, syntax, options, use case, example, verification command, and warning before use.
Packet Tracer and older IOS images do not implement every command shown here.
How to read syntax: Replace
<angle-bracket values>. Square brackets mean optional. Braces and vertical bars mean choose one value. Use ? at any point to verify the exact syntax supported by your image.Command families
CLI modes, navigation, help, and undo(21)terminal and session commands(6)show: system, configuration, files, and sessions(24)show: interfaces and Layer 1 status(16)show: VLANs, MAC, STP, trunks, EtherChannel, and neighbors(23)show: ARP, CEF, routes, and routing protocols(17)show: DHCP, NAT, ACL, SSH, NTP, and SNMP(17)hostname, credentials, banners, time, and line behavior(11)interface and physical-port commands(14)vlan and VLAN database commands(3)switchport commands(15)spanning-tree commands(12)channel-group and port-channel commands(7)IP addressing, SVIs, subinterfaces, and routing enablement(10)ip route and ipv6 route commands(8)router ospf, ip ospf, and OSPFv3 commands(13)standby commands for HSRP(4)ip dhcp and ip helper-address commands(11)DNS client and local host commands(3)ip nat commands(7)access-list, ip access-list, and ACL application commands(14)SSH, login, line, and AAA commands(13)switchport port-security commands(4)DHCP snooping, DAI, IP Source Guard, and storm control(4)CDP and LLDP commands(6)NTP, logging, and SNMP commands(11)ping, traceroute, Telnet testing, and debug commands(8)clear commands(6)copy, save, backup, file, boot, and reload commands(20)configuration cleanup commands(1)
Recommended lookup method
- Find the root command, such as
switchport,spanning-tree, orip route. - Check the valid CLI mode.
- Read every placeholder and option.
- Apply the command only in the correct interface, VLAN, line, or routing context.
- Use the listed show command before saving.
Entries: 329 unique command forms.
terminal and session commands
Controls command history, paging, output width, and live syslog display for the current terminal session.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show history |
Privileged EXEC | No variable options in this command form. | Displays commands stored in the current session history. Example Device# show history |
terminal history size <0-256> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Changes command history depth for the current terminal session. Example Device# terminal history size 100 Important: Range can vary. |
terminal length 0 |
EXEC | No variable options in this command form. | Disables paging for the current session. Example Device# terminal length 0 Important: Useful before copying long output. Restore with terminal length 24 or reconnect. |
terminal width <columns> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Changes output width for the current session. Example Device# terminal width 200 Important: Support varies. |
terminal monitor |
EXEC | No variable options in this command form. | Displays syslog messages in an SSH or Telnet session. Example Device# terminal monitor |
terminal no monitor |
EXEC | No variable options in this command form. | Stops live syslog display in the remote terminal. Example Device# terminal no monitor |
show: system, configuration, files, and sessions
Read-only commands for platform identity, software, configuration, resources, logs, users, and storage.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show running-config | include <regex> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Shows lines that match a pattern. Example Device# show running-config | include ^hostname|^interface|ip address |
show running-config | exclude <regex> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Hides lines that match a pattern. Example Device# show running-config | exclude ^! |
show running-config | begin <text> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Starts output at the first matching line. Example Device# show running-config | begin line vty |
show running-config | section <regex> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Shows matching configuration sections. Example Device# show running-config | section ^interface Important: Section filtering support and behavior vary by release. |
show clock [detail] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Displays device time and time source details. Example SW1# show clock detail |
show running-config |
Privileged EXEC | No variable options in this command form. | Displays the active configuration in RAM. Example SW1# show running-config |
show startup-config |
Privileged EXEC | No variable options in this command form. | Displays the saved boot configuration. Example SW1# show startup-config |
show version |
Privileged EXEC | No variable options in this command form. | Displays IOS/IOS XE version, uptime, image, hardware, memory, and configuration register details. Example SW1# show version |
show inventory |
Privileged EXEC | No variable options in this command form. | Displays chassis, module, serial number, and product identifiers. Example SW1# show inventory |
show license summary |
Privileged EXEC | No variable options in this command form. | Summarizes license state on supported IOS XE platforms. Example SW1# show license summary Important: Licensing commands vary substantially by release and platform. |
show environment all |
Privileged EXEC | No variable options in this command form. | Displays temperature, fan, and power information. Example SW1# show environment all Important: Platform-dependent. |
show processes cpu sorted |
Privileged EXEC | No variable options in this command form. | Displays processes ordered by CPU use. Example SW1# show processes cpu sorted |
show processes memory sorted |
Privileged EXEC | No variable options in this command form. | Displays processes ordered by memory use. Example SW1# show processes memory sorted |
show logging |
Privileged EXEC | No variable options in this command form. | Displays logging configuration and buffered messages. Example SW1# show logging |
show users |
Privileged EXEC | No variable options in this command form. | Displays active console and remote sessions. Example SW1# show users |
show line |
Privileged EXEC | No variable options in this command form. | Displays console, AUX, and VTY line state. Example SW1# show line |
show tech-support |
Privileged EXEC | No variable options in this command form. | Collects a large diagnostic bundle. Example SW1# show tech-support Important: Output can be very large and may expose configuration details. Capture securely. |
show logging |
Privileged EXEC | No variable options in this command form. | Displays destinations, severity levels, counters, and local buffered logs. Example SW1# show logging |
show file systems |
Privileged EXEC | No variable options in this command form. | Lists available storage and network file systems. Example SW1# show file systems |
show boot |
Privileged EXEC | No variable options in this command form. | Shows boot variables and next-boot configuration. Example SW1# show boot |
show version | include System image|INSTALL |
Privileged EXEC | No variable options in this command form. | Identifies the running image or install mode clues. Example SW1# show version | include System image|INSTALL |
show running-config interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows the running configuration for one interface. Example Device# show running-config interface gigabitEthernet1/0/10 Verify with: Compare the output with show interfaces <interface> switchport or show ip interface <interface>.Important: Support varies on older releases. Use a section filter when unavailable. |
show power inline [interface] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Shows Power over Ethernet allocation, device class, and port power state. Example SW1# show power inline gigabitEthernet1/0/10 Verify with: Compare available and used power with the switch power budget.Important: PoE syntax and fields vary by Catalyst platform. |
show reload |
Privileged EXEC | No variable options in this command form. | Shows whether a reload is scheduled and when it will occur. Example Device# show reload Verify with: Use reload cancel after successful change verification.Important: Command support varies by release. |
show: interfaces and Layer 1 status
Read-only interface commands for link state, addressing, speed, duplex, counters, errors, and switchport details.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show ip interface brief |
Privileged EXEC | No variable options in this command form. | Shows IPv4 address, administrative status, and line protocol status. Example R1# show ip interface brief |
show ipv6 interface brief |
Privileged EXEC | No variable options in this command form. | Shows IPv6 addresses and interface status. Example R1# show ipv6 interface brief |
show interfaces description |
Privileged EXEC | No variable options in this command form. | Shows descriptions and interface status in a compact view. Example SW1# show interfaces description |
show interfaces <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows counters, errors, speed, duplex, MTU, and line state. Example SW1# show interfaces gigabitEthernet1/0/1 |
show interfaces status |
Privileged EXEC | No variable options in this command form. | Shows switchport state, VLAN, duplex, speed, and media type. Example SW1# show interfaces status Important: Common on Catalyst switches. |
show interfaces <interface> switchport |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Displays administrative and operational switchport mode, access VLAN, voice VLAN, native VLAN, and allowed VLANs. Example SW1# show interfaces gigabitEthernet1/0/10 switchport |
show interfaces trunk |
Privileged EXEC | No variable options in this command form. | Shows operational trunks, native VLANs, allowed VLANs, and forwarding VLANs. Example SW1# show interfaces trunk |
show interfaces <interface> switchport |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows administrative and operational trunk details for one port. Example SW1# show interfaces gigabitEthernet1/0/48 switchport |
show interfaces port-channel <number> |
Privileged EXEC | number: Replace with the required numeric identifier. | Shows logical interface counters and status. Example SW1# show interfaces port-channel 1 |
show ip interface brief | include Vlan |
Privileged EXEC | No variable options in this command form. | Shows SVI address and line state. Example DSW1# show ip interface brief | include Vlan |
show ip interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows IPv4 ACLs applied inbound and outbound. Example R1# show ip interface gigabitEthernet0/0/1 |
show interfaces counters errors |
Privileged EXEC | No variable options in this command form. | Shows physical and data-link error counters across switch interfaces. Example SW1# show interfaces counters errors Important: Common on Catalyst switches. |
show controllers <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows hardware/controller details and low-level counters. Example R1# show controllers serial0/0/0 Important: Output and syntax vary greatly by interface type. |
show ip interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows addressing, ACLs, redirects, proxy ARP, and interface IP behavior. Example R1# show ip interface gigabitEthernet0/0/1 |
show interfaces <interface> | include error|drop|collision|rate |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Filters interface output for common failure counters. Example SW1# show interfaces gigabitEthernet1/0/10 | include error|drop|collision|rate |
show interfaces status err-disabled |
Privileged EXEC | No variable options in this command form. | Lists switchports currently in the error-disabled state. Example SW1# show interfaces status err-disabled Verify with: show errdisable recovery and show loggingImportant: Common on Catalyst switches. Correct the cause before bouncing the port. |
show: VLANs, MAC, STP, trunks, EtherChannel, and neighbors
Read-only Layer 2 commands used to verify forwarding, loop prevention, bundled links, redundancy, and neighbor discovery.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show vlan brief |
Privileged EXEC | No variable options in this command form. | Shows VLAN state and access-port membership. Example SW1# show vlan brief |
show mac address-table |
Privileged EXEC | No variable options in this command form. | Displays learned, static, and system MAC addresses. Example SW1# show mac address-table |
show mac address-table dynamic interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows dynamically learned MAC addresses on one port. Example SW1# show mac address-table dynamic interface gigabitEthernet1/0/10 |
show mac address-table address <mac> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Locates a specific MAC address. Example SW1# show mac address-table address 0011.2233.4455 |
show dtp interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Displays DTP state and negotiation details. Example SW1# show dtp interface gigabitEthernet1/0/48 Important: Platform-dependent. |
show spanning-tree |
Privileged EXEC | No variable options in this command form. | Displays STP roots, costs, roles, states, and timers. Example SW1# show spanning-tree |
show spanning-tree vlan <id> |
Privileged EXEC | id: Replace with the required VLAN, process, or object identifier. | Displays STP details for one VLAN. Example SW1# show spanning-tree vlan 20 |
show spanning-tree inconsistentports |
Privileged EXEC | No variable options in this command form. | Shows ports blocked by STP consistency protections. Example SW1# show spanning-tree inconsistentports |
show etherchannel summary |
Privileged EXEC | No variable options in this command form. | Shows port-channel protocol, state flags, and member ports. Example SW1# show etherchannel summary |
show etherchannel port-channel |
Privileged EXEC | No variable options in this command form. | Shows detailed port-channel state. Example SW1# show etherchannel port-channel |
show lacp neighbor |
Privileged EXEC | No variable options in this command form. | Shows LACP partner information. Example SW1# show lacp neighbor |
show pagp neighbor |
Privileged EXEC | No variable options in this command form. | Shows PAgP neighbor information. Example SW1# show pagp neighbor |
show standby brief |
Privileged EXEC | No variable options in this command form. | Shows HSRP group, state, active peer, standby peer, and virtual IP. Example DSW1# show standby brief |
show port-security interface <interface> |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows secure MAC state, violations, and action. Example SW1# show port-security interface gigabitEthernet1/0/10 |
show port-security address |
Privileged EXEC | No variable options in this command form. | Shows secure MAC addresses. Example SW1# show port-security address |
show errdisable recovery |
Privileged EXEC | No variable options in this command form. | Shows error-disable causes and automatic recovery settings. Example SW1# show errdisable recovery |
show cdp neighbors |
Privileged EXEC | No variable options in this command form. | Shows directly connected Cisco neighbors. Example SW1# show cdp neighbors |
show cdp neighbors detail |
Privileged EXEC | No variable options in this command form. | Shows remote management address, platform, software, and port details. Example SW1# show cdp neighbors detail |
show lldp neighbors |
Privileged EXEC | No variable options in this command form. | Shows directly connected LLDP neighbors. Example SW1# show lldp neighbors |
show lldp neighbors detail |
Privileged EXEC | No variable options in this command form. | Shows detailed LLDP neighbor information. Example SW1# show lldp neighbors detail |
show spanning-tree detail | include ieee|occurr|from|is exec |
Privileged EXEC | No variable options in this command form. | Filters STP details for topology-change clues. Example SW1# show spanning-tree detail | include ieee|occurr|from|is exec Important: The exact filter text is release-dependent. |
show spanning-tree summary |
Privileged EXEC | No variable options in this command form. | Summarizes the active STP mode, root information, PortFast, and protection features. Example SW1# show spanning-tree summary Verify with: Use show spanning-tree vlan <id> for per-VLAN detail.Important: Output fields vary by STP mode and platform. |
show spanning-tree interface <interface> detail |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Shows the STP role, state, cost, timers, and edge behavior for one interface. Example SW1# show spanning-tree interface gigabitEthernet1/0/10 detail Verify with: Confirm the expected VLAN instances are forwarding.Important: Use this when a port is unexpectedly blocking or not operating as an edge port. |
show: ARP, CEF, routes, and routing protocols
Read-only Layer 3 commands used to verify next-hop resolution, forwarding decisions, routing tables, and OSPF.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show ip route connected |
Privileged EXEC | No variable options in this command form. | Shows connected routes created by active Layer 3 interfaces and SVIs. Example DSW1# show ip route connected |
show ip arp |
Privileged EXEC | No variable options in this command form. | Displays IPv4-to-MAC mappings. Example R1# show ip arp |
show arp |
Privileged EXEC | No variable options in this command form. | Displays ARP entries. Output can include non-IP protocol fields on older platforms. Example R1# show arp |
show ipv6 neighbors |
Privileged EXEC | No variable options in this command form. | Displays IPv6 neighbor cache entries and states. Example R1# show ipv6 neighbors |
show ip cef <destination> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Shows the CEF forwarding entry and selected next hop. Example R1# show ip cef 10.30.0.10 |
show adjacency <interface> detail |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Displays Layer 2 rewrite and adjacency details. Example R1# show adjacency gigabitEthernet0/0/0 detail Important: Advanced and platform-dependent output. |
show ip route |
Privileged EXEC | No variable options in this command form. | Displays the IPv4 routing table and route codes. Example R1# show ip route |
show ip route <destination> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Shows the longest-prefix route selected for a destination. Example R1# show ip route 10.30.0.25 |
show ipv6 route |
Privileged EXEC | No variable options in this command form. | Displays the IPv6 routing table. Example R1# show ipv6 route |
show ip ospf neighbor |
Privileged EXEC | No variable options in this command form. | Shows OSPFv2 neighbor state and adjacency. Example R1# show ip ospf neighbor |
show ip ospf interface brief |
Privileged EXEC | No variable options in this command form. | Summarizes OSPF-enabled interfaces, areas, process IDs, costs, and neighbor counts. Example R1# show ip ospf interface brief |
show ip ospf database |
Privileged EXEC | No variable options in this command form. | Displays the OSPF link-state database. Example R1# show ip ospf database |
show ip route ospf |
Privileged EXEC | No variable options in this command form. | Shows routes learned through OSPF. Example R1# show ip route ospf |
show ipv6 ospf neighbor |
Privileged EXEC | No variable options in this command form. | Shows classic OSPFv3 neighbors. Example R1# show ipv6 ospf neighbor |
show ip arp inspection |
Privileged EXEC | No variable options in this command form. | Shows DAI configuration and counters. Example SW1# show ip arp inspection |
show protocols |
Privileged EXEC | No variable options in this command form. | Summarizes routed protocol and interface status. Example R1# show protocols |
show ip protocols |
Privileged EXEC | No variable options in this command form. | Displays dynamic routing process settings and participating networks. Example R1# show ip protocols |
show: DHCP, NAT, ACL, SSH, NTP, and SNMP
Read-only service and security commands used to verify leases, translations, policy counters, management access, and monitoring.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
show ip dhcp pool |
Privileged EXEC | No variable options in this command form. | Shows pool utilization and configuration. Example R1# show ip dhcp pool |
show ip dhcp binding |
Privileged EXEC | No variable options in this command form. | Shows active DHCP leases. Example R1# show ip dhcp binding |
show ip dhcp conflict |
Privileged EXEC | No variable options in this command form. | Shows addresses marked as conflicting. Example R1# show ip dhcp conflict |
show hosts |
Privileged EXEC | No variable options in this command form. | Displays cached, static, and learned host mappings. Example R1# show hosts |
show ip nat translations [verbose] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Shows current and permanent NAT translations. Example R1# show ip nat translations |
show ip nat statistics |
Privileged EXEC | No variable options in this command form. | Shows NAT counters, interfaces, pools, and rules. Example R1# show ip nat statistics |
show access-lists [name|number] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Shows ACL entries and match counters. Example R1# show access-lists USERS-IN |
show ipv6 access-list |
Privileged EXEC | No variable options in this command form. | Shows IPv6 ACL entries and counters. Example R1# show ipv6 access-list |
show ip ssh |
Privileged EXEC | No variable options in this command form. | Displays SSH server version and settings. Example R1# show ip ssh |
show ssh |
Privileged EXEC | No variable options in this command form. | Displays active SSH sessions. Example R1# show ssh |
show ip dhcp snooping |
Privileged EXEC | No variable options in this command form. | Shows DHCP snooping configuration and trusted ports. Example SW1# show ip dhcp snooping |
show ip dhcp snooping binding |
Privileged EXEC | No variable options in this command form. | Shows learned IP, MAC, VLAN, and interface bindings. Example SW1# show ip dhcp snooping binding |
show ntp associations |
Privileged EXEC | No variable options in this command form. | Shows configured peers, reachability, and selected source. Example SW1# show ntp associations |
show ntp status |
Privileged EXEC | No variable options in this command form. | Shows synchronization state, stratum, and reference clock. Example SW1# show ntp status |
show snmp user |
Privileged EXEC | No variable options in this command form. | Shows configured SNMPv3 users without revealing secrets. Example SW1# show snmp user |
show access-lists |
Privileged EXEC | No variable options in this command form. | Shows ACL entries and match counters. Example R1# show access-lists |
show ip nat statistics |
Privileged EXEC | No variable options in this command form. | Shows NAT configuration and hit/miss counters. Example R1# show ip nat statistics |
hostname, credentials, banners, time, and line behavior
Commands normally used during initial device setup.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
hostname <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Sets the device hostname and CLI prompt. Example Device(config)# hostname SW1 |
no ip domain-lookup |
Global config | No variable options in this command form. | Stops mistyped commands from triggering a DNS lookup. Example SW1(config)# no ip domain-lookup Important: Keep DNS lookup enabled on production devices that use hostnames for NTP, syslog, TACACS+, or other services. |
enable secret <secret> |
Global config | secret: Replace with a strong secret. Do not type the angle brackets. | Protects privileged EXEC access with a hashed secret. Example SW1(config)# enable secret <strong-secret> Important: Do not use enable password when enable secret is available. |
username <name> privilege <level> secret <secret> |
Global config | name: Use a locally meaningful name without angle brackets. secret: Replace with a strong secret. Do not type the angle brackets. | Creates a local user with a hashed secret. Example SW1(config)# username netadmin privilege 15 secret <strong-secret> |
service password-encryption |
Global config | No variable options in this command form. | Obscures plaintext passwords stored in the configuration. Example SW1(config)# service password-encryption Important: Traditional Type 7 obfuscation is reversible. It does not make weak line passwords secure. |
banner motd <delimiter>message<delimiter> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Displays a message before login. Example SW1(config)# banner motd #Authorized access only.# |
ip domain name <domain> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the device domain name. RSA key generation commonly requires it. Example SW1(config)# ip domain name lab.example |
logging synchronous |
Line config | No variable options in this command form. | Redraws interrupted commands after console log messages. Example SW1(config)# line console 0 SW1(config-line)# logging synchronous |
exec-timeout <minutes> <seconds> |
Line config | Replace each value inside angle brackets. Do not type the angle brackets. | Disconnects idle management sessions. Example SW1(config-line)# exec-timeout 10 0 Important: exec-timeout 0 0 disables the timeout and is unsafe outside a controlled lab. |
clock timezone <zone> <hours-offset> [minutes-offset] |
Global config | Square brackets mark an optional keyword or argument. | Sets the standard timezone offset. Example SW1(config)# clock timezone UTC 0 0 |
clock set HH:MM:SS MONTH DAY YEAR |
Privileged EXEC | No variable options in this command form. | Sets the software clock manually. Example SW1# clock set 13:30:00 AUG 5 2026 Important: Prefer NTP for managed devices. |
interface and physical-port commands
Selects interfaces and controls descriptions, administrative state, speed, duplex, and logical bandwidth.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
interface <type><slot/port> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Enters one interface configuration context. Example R1(config)# interface gigabitEthernet0/0/0 |
interface range <range> |
Global config | range: Select multiple interfaces, such as gi1/0/1-4. | Selects multiple interfaces for one repeated configuration. Example SW1(config)# interface range gigabitEthernet1/0/1-4 Important: Verify the selected range before applying shutdown or VLAN changes. |
description <text> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Documents the connected device, circuit, or purpose. Example SW1(config-if)# description USER-PC-23 / Room 104 |
no shutdown |
Interface config | No variable options in this command form. | Administratively enables the interface. Example R1(config-if)# no shutdown Verify with: show ip interface brief |
shutdown |
Interface config | No variable options in this command form. | Administratively disables the interface. Example R1(config-if)# shutdown Important: Causes an outage on the connected link. |
speed {auto|10|100|1000|...} |
Interface config | speed: choose a hardware-supported speed or autonegotiation. | Sets or negotiates physical speed. Example SW1(config-if)# speed auto Important: Available values depend on hardware. |
duplex {auto|half|full} |
Interface config | duplex: choose autonegotiation, half duplex, or full duplex. | Sets or negotiates duplex. Example SW1(config-if)# duplex auto Important: A duplex mismatch causes late collisions, FCS errors, and poor performance. |
bandwidth <kilobits> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the logical bandwidth used by routing metrics and reporting. Example R1(config-if)# bandwidth 100000 Important: This command normally does not change physical link speed. |
interface port-channel <number> |
Global config | number: Replace with the required numeric identifier. | Enters the logical EtherChannel interface. Example SW1(config)# interface port-channel 1 |
interface vlan <id> |
Global config | id: Replace with the required VLAN, process, or object identifier. | Creates or enters a switched virtual interface. Example SW1(config)# interface vlan 99 |
interface <physical>.<subinterface> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Creates a logical router subinterface. Example R1(config)# interface gigabitEthernet0/0/0.20 |
shutdown / no shutdown |
Interface config | No variable options in this command form. | Manually recovers an interface after correcting an error-disable cause. Example SW1(config-if)# shutdown SW1(config-if)# no shutdown Important: Do not bounce the port until the root cause is corrected. |
default interface <interface> |
Global config | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Returns an interface to platform defaults. Example SW1(config)# default interface gigabitEthernet1/0/10 Important: Removes VLAN, security, description, shutdown state, and other interface-specific configuration. |
power inline {auto|never} |
Interface config | Braces with vertical bars mean choose one listed value. | Enables automatic PoE detection or disables PoE on one switchport. Example SW1(config-if)# power inline auto Verify with: show power inline <interface>Important: Changing PoE can restart or power off the attached device. |
vlan and VLAN database commands
Creates, names, and removes VLANs.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
vlan <1-4094> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Creates a VLAN and enters VLAN configuration mode. Example SW1(config)# vlan 20 |
name <name> |
VLAN config | name: Use a locally meaningful name without angle brackets. | Assigns a descriptive VLAN name. Example SW1(config-vlan)# name USERS |
no vlan <id> |
Global config | id: Replace with the required VLAN, process, or object identifier. | Deletes a VLAN from the local VLAN database. Example SW1(config)# no vlan 20 Important: Ports assigned to a deleted VLAN become inactive until the VLAN exists again or the ports are reassigned. |
switchport commands
Controls Layer 2 access mode, trunk mode, VLAN membership, voice VLANs, DTP, and Layer 2 versus Layer 3 operation.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
no switchport |
Interface config | No variable options in this command form. | Converts a capable switchport into a routed Layer 3 port. Example DSW1(config-if)# no switchport Important: Supported on multilayer switches, not all switch models. |
switchport |
Interface config | No variable options in this command form. | Converts a capable routed port back to a Layer 2 switchport. Example DSW1(config-if)# switchport Important: Existing Layer 3 addressing can be removed. |
switchport mode access |
Interface config | No variable options in this command form. | Forces a Layer 2 interface to operate as a static access port. Example SW1(config-if)# switchport mode access |
switchport access vlan <id> |
Interface config | id: Replace with the required VLAN, process, or object identifier. | Assigns untagged access traffic to one VLAN. Example SW1(config-if)# switchport access vlan 20 Verify with: show interfaces switchport |
switchport voice vlan <id> |
Interface config | id: Replace with the required VLAN, process, or object identifier. | Advertises a separate voice VLAN to a supported IP phone. Example SW1(config-if)# switchport voice vlan 30 Important: The data VLAN remains the access VLAN. Voice traffic is normally tagged by the phone. |
switchport trunk encapsulation dot1q |
Interface config | No variable options in this command form. | Selects IEEE 802.1Q trunk encapsulation. Example SW1(config-if)# switchport trunk encapsulation dot1q Important: Older or multi-encapsulation platforms only. Many modern Catalyst switches support only 802.1Q and reject this command. |
switchport mode trunk |
Interface config | No variable options in this command form. | Forces the interface into static trunk mode. Example SW1(config-if)# switchport mode trunk |
switchport trunk native vlan <id> |
Interface config | id: Replace with the required VLAN, process, or object identifier. | Sets the VLAN used for untagged frames on the trunk. Example SW1(config-if)# switchport trunk native vlan 999 Important: Configure the same native VLAN on both ends. Native VLAN mismatches can leak traffic and generate warnings. |
switchport trunk allowed vlan <list> |
Interface config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Replaces the trunk allowed-VLAN list. Example SW1(config-if)# switchport trunk allowed vlan 10,20,30,999 Important: Without add, this command replaces the existing list. |
switchport trunk allowed vlan add <list> |
Interface config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Adds VLANs without replacing the current list. Example SW1(config-if)# switchport trunk allowed vlan add 40,50 |
switchport trunk allowed vlan remove <list> |
Interface config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Removes VLANs from the allowed list. Example SW1(config-if)# switchport trunk allowed vlan remove 1,100 |
switchport nonegotiate |
Interface config | No variable options in this command form. | Disables DTP negotiation frames. Example SW1(config-if)# switchport nonegotiate Important: Use when the trunk is statically configured and the neighbor does not require DTP. |
switchport mode dynamic desirable |
Interface config | No variable options in this command form. | Actively negotiates a trunk using DTP. Example SW1(config-if)# switchport mode dynamic desirable Important: Useful for exam knowledge. Static trunks are clearer and safer in most managed networks. |
switchport mode dynamic auto |
Interface config | No variable options in this command form. | Passively waits for DTP negotiation. Example SW1(config-if)# switchport mode dynamic auto Important: Two dynamic auto ports do not form a trunk. |
no switchport |
Interface config | No variable options in this command form. | Converts a physical switch interface to a routed port. Example DSW1(config-if)# no switchport |
spanning-tree commands
Controls STP mode, root placement, edge behavior, costs, priorities, and loop protections.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
spanning-tree portfast |
Interface config | No variable options in this command form. | Moves a host-facing access port rapidly to forwarding. Example SW1(config-if)# spanning-tree portfast Important: Use only on edge ports that should not connect to another switch or bridge. |
spanning-tree bpduguard enable |
Interface config | No variable options in this command form. | Error-disables an edge port if it receives a BPDU. Example SW1(config-if)# spanning-tree bpduguard enable Important: Use with PortFast on end-device ports. |
spanning-tree mode {pvst|rapid-pvst|mst} |
Global config | STP mode: choose classic PVST+, Rapid PVST+, or Multiple Spanning Tree. | Selects the spanning-tree mode. Example SW1(config)# spanning-tree mode rapid-pvst Important: Changing STP mode affects the entire Layer 2 domain. Plan and verify interoperability. |
spanning-tree vlan <list> root primary |
Global config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Lowers bridge priority to make the switch the likely root. Example DSW1(config)# spanning-tree vlan 10,20 root primary Important: Verify the resulting priority and root after configuration. |
spanning-tree vlan <list> root secondary |
Global config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Sets a backup root priority. Example DSW2(config)# spanning-tree vlan 10,20 root secondary |
spanning-tree vlan <id> priority <0-61440> |
Global config | id: Replace with the required VLAN, process, or object identifier. | Sets bridge priority in increments of 4096. Example DSW1(config)# spanning-tree vlan 20 priority 24576 |
spanning-tree vlan <id> cost <value> |
Interface config | id: Replace with the required VLAN, process, or object identifier. | Overrides STP path cost for one VLAN on one port. Example SW2(config-if)# spanning-tree vlan 20 cost 10 |
spanning-tree vlan <id> port-priority <value> |
Interface config | id: Replace with the required VLAN, process, or object identifier. | Changes the port-ID tiebreaker. Example SW2(config-if)# spanning-tree vlan 20 port-priority 64 Important: Values use platform-defined increments, commonly 16. |
spanning-tree portfast default |
Global config | No variable options in this command form. | Enables PortFast by default on nontrunking access ports. Example SW1(config)# spanning-tree portfast default Important: Review all access ports before global use. |
spanning-tree portfast bpduguard default |
Global config | No variable options in this command form. | Enables BPDU Guard on PortFast-enabled ports. Example SW1(config)# spanning-tree portfast bpduguard default |
spanning-tree guard root |
Interface config | No variable options in this command form. | Blocks a port if superior BPDUs would make the neighbor root. Example SW1(config-if)# spanning-tree guard root Important: Use on designated ports where a downstream switch must never become root. |
spanning-tree loopguard default |
Global config | No variable options in this command form. | Enables Loop Guard globally on eligible point-to-point links. Example SW1(config)# spanning-tree loopguard default Important: Do not combine Loop Guard and Root Guard on the same port. |
channel-group and port-channel commands
Builds LACP, PAgP, or static EtherChannels and controls the logical port-channel.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
channel-group <number> mode active |
Interface range config | number: Replace with the required numeric identifier. | Creates or joins an LACP EtherChannel and actively negotiates. Example SW1(config-if-range)# channel-group 1 mode active |
channel-group <number> mode passive |
Interface range config | number: Replace with the required numeric identifier. | Creates or joins an LACP EtherChannel and waits for LACP. Example SW2(config-if-range)# channel-group 1 mode passive Important: At least one side must use active. |
channel-group <number> mode desirable |
Interface range config | number: Replace with the required numeric identifier. | Actively negotiates a Cisco PAgP EtherChannel. Example SW1(config-if-range)# channel-group 2 mode desirable |
channel-group <number> mode auto |
Interface range config | number: Replace with the required numeric identifier. | Passively waits for PAgP negotiation. Example SW2(config-if-range)# channel-group 2 mode auto Important: At least one side must use desirable. |
channel-group <number> mode on |
Interface range config | number: Replace with the required numeric identifier. | Creates a static EtherChannel without negotiation. Example SW1(config-if-range)# channel-group 3 mode on Important: Both sides must match exactly. No protocol detects cabling or configuration mistakes. |
port-channel load-balance <method> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Selects fields used to choose a member link. Example SW1(config)# port-channel load-balance src-dst-ip Important: Methods vary by platform. One flow normally stays on one member link. |
no interface port-channel <number> |
Global config | number: Replace with the required numeric identifier. | Deletes a logical port-channel interface. Example SW1(config)# no interface port-channel 1 Important: Remove channel-group membership from physical ports as part of cleanup. |
IP addressing, SVIs, subinterfaces, and routing enablement
Assigns IPv4 or IPv6 addresses, creates router subinterfaces, and enables routing.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip address <address> <mask> |
Interface config | address: Use an IPv4 address in dotted-decimal notation. mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. | Assigns a primary IPv4 address. Example R1(config-if)# ip address 10.10.10.1 255.255.255.0 |
ip address dhcp |
Interface config | No variable options in this command form. | Obtains an IPv4 address through DHCP. Example R1(config-if)# ip address dhcp Important: Common on lab or WAN edge interfaces. Production behavior depends on the design. |
ipv6 address <prefix>/<length> |
Interface config | prefix/length: Use CIDR notation, such as 2001:db8:10::1/64. | Assigns an IPv6 global unicast address. Example R1(config-if)# ipv6 address 2001:db8:10::1/64 |
ipv6 address <prefix>/<length> eui-64 |
Interface config | prefix/length: Use CIDR notation, such as 2001:db8:10::1/64. | Builds the interface ID automatically from the device identifier. Example R1(config-if)# ipv6 address 2001:db8:10::/64 eui-64 |
ipv6 enable |
Interface config | No variable options in this command form. | Enables IPv6 processing and a link-local address without a global address. Example R1(config-if)# ipv6 enable |
ip address <address> <mask> |
Interface config | address: Use an IPv4 address in dotted-decimal notation. mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. | Assigns an IPv4 address to the SVI. Example SW1(config-if)# ip address 10.99.0.11 255.255.255.0 |
ip default-gateway <address> |
Global config | address: Use an IPv4 address in dotted-decimal notation. | Sets the management default gateway on a Layer 2 switch. Example SW1(config)# ip default-gateway 10.99.0.1 Important: Use when IP routing is disabled. A routing-enabled multilayer switch uses a default route instead. |
ip routing |
Global config | No variable options in this command form. | Enables IPv4 routing on a capable multilayer switch. Example DSW1(config)# ip routing Important: Platform and license support vary. |
ipv6 unicast-routing |
Global config | No variable options in this command form. | Enables IPv6 packet forwarding. Example R1(config)# ipv6 unicast-routing |
encapsulation dot1Q <vlan-id> [native] |
Subinterface config | Square brackets mark an optional keyword or argument. | Maps a router subinterface to an 802.1Q VLAN. Example R1(config-subif)# encapsulation dot1Q 20 |
ip route and ipv6 route commands
Creates connected-next-hop, default, and floating static routes.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip route <network> <mask> <next-hop> |
Global config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. next-hop: The reachable Layer 3 address of the next router. | Creates an IPv4 static route using a next-hop address. Example R1(config)# ip route 10.30.0.0 255.255.255.0 10.12.0.2 |
ip route <network> <mask> <exit-interface> |
Global config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. | Creates an exit-interface static route. Example R1(config)# ip route 10.30.0.0 255.255.255.0 serial0/0/0 Important: Best suited to point-to-point links. On Ethernet, a next-hop address is usually clearer. |
ip route <network> <mask> <exit-interface> <next-hop> |
Global config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. next-hop: The reachable Layer 3 address of the next router. | Creates a fully specified static route. Example R1(config)# ip route 10.30.0.0 255.255.255.0 gigabitEthernet0/0/1 10.12.0.2 |
ip route 0.0.0.0 0.0.0.0 <next-hop> |
Global config | next-hop: The reachable Layer 3 address of the next router. | Creates an IPv4 default route. Example R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 |
ip route <network> <mask> <next-hop> <AD> |
Global config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. next-hop: The reachable Layer 3 address of the next router. | Creates a floating static route with a higher administrative distance. Example R1(config)# ip route 10.30.0.0 255.255.255.0 10.13.0.3 200 |
ipv6 route <prefix>/<length> <next-hop> |
Global config | next-hop: The reachable Layer 3 address of the next router. prefix/length: Use CIDR notation, such as 2001:db8:10::1/64. | Creates an IPv6 static route. Example R1(config)# ipv6 route 2001:db8:30::/64 2001:db8:12::2 |
ipv6 route ::/0 <next-hop> |
Global config | next-hop: The reachable Layer 3 address of the next router. | Creates an IPv6 default route. Example R1(config)# ipv6 route ::/0 2001:db8:ff::1 |
ipv6 router ospf <process-id> |
Global config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. | Creates a classic OSPFv3 process used by many CCNA labs and Packet Tracer images. Example R1(config)# ipv6 router ospf 1 Important: Modern IOS XE also supports router ospfv3 address-family syntax. |
router ospf, ip ospf, and OSPFv3 commands
Creates OSPF processes, enables interfaces, controls passive interfaces, costs, and default-route advertisement.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
router ospf <process-id> |
Global config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. | Creates or enters an OSPFv2 process. Example R1(config)# router ospf 1 Important: The process ID is locally significant and does not need to match neighbors. |
router-id <A.B.C.D> |
OSPF config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the OSPF router ID. Example R1(config-router)# router-id 1.1.1.1 Important: Changing a live router ID can require clear ip ospf process or a reload. |
network <address> <wildcard> area <area-id> |
OSPF config | address: Use an IPv4 address in dotted-decimal notation. wildcard: A 0 bit must match and a 1 bit can vary. area-id: OSPF area number, commonly 0 for the backbone. | Enables OSPF on matching interfaces and assigns them to an area. Example R1(config-router)# network 10.12.0.0 0.0.0.3 area 0 |
ip ospf <process-id> area <area-id> |
Interface config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. area-id: OSPF area number, commonly 0 for the backbone. | Enables OSPFv2 directly on an interface. Example R1(config-if)# ip ospf 1 area 0 |
passive-interface default |
OSPF config | No variable options in this command form. | Stops OSPF hellos on all OSPF-enabled interfaces by default. Example R1(config-router)# passive-interface default |
no passive-interface <interface> |
OSPF config | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Allows OSPF neighbor formation on a selected transit interface. Example R1(config-router)# no passive-interface gigabitEthernet0/0/1 |
default-information originate [always] |
OSPF config | always: Optional. Advertise the OSPF default even when no default route exists locally. | Advertises a default route into OSPF. Example R1(config-router)# default-information originate Important: Without always, a default route normally must already exist in the routing table. |
auto-cost reference-bandwidth <Mbps> |
OSPF config | Replace each value inside angle brackets. Do not type the angle brackets. | Changes the reference bandwidth used to calculate OSPF interface cost. Example R1(config-router)# auto-cost reference-bandwidth 100000 Important: Use the same value on all OSPF routers. |
ip ospf cost <value> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Overrides OSPF cost on one interface. Example R1(config-if)# ip ospf cost 10 |
ipv6 ospf <process-id> area <area-id> |
Interface config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. area-id: OSPF area number, commonly 0 for the backbone. | Enables classic OSPFv3 on an interface. Example R1(config-if)# ipv6 ospf 1 area 0 |
router ospfv3 <process-id> |
Global config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. | Creates a modern OSPFv3 process with address families. Example R1(config)# router ospfv3 1 Important: Command availability varies by image. |
ospfv3 <process-id> ipv6 area <area-id> |
Interface config | process-id: Locally identifies the routing process. OSPF neighbors do not need matching process IDs. area-id: OSPF area number, commonly 0 for the backbone. | Enables modern OSPFv3 IPv6 on an interface. Example R1(config-if)# ospfv3 1 ipv6 area 0 Important: Use the syntax supported by the device image. Do not mix lab methods without understanding the process. |
network <network> <mask> |
DHCP pool config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. | Defines the subnet served by the pool. Example R1(dhcp-config)# network 10.20.0.0 255.255.255.0 |
standby commands for HSRP
Creates a redundant first-hop default gateway and controls active/standby election.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
standby <group> ip <virtual-ip> |
Interface config | group: HSRP or SNMP group identifier, depending on the command. | Creates an HSRP IPv4 virtual gateway. Example DSW1(config-if)# standby 10 ip 10.10.10.1 |
standby <group> priority <0-255> |
Interface config | group: HSRP or SNMP group identifier, depending on the command. | Sets HSRP election priority. Example DSW1(config-if)# standby 10 priority 110 |
standby <group> preempt |
Interface config | group: HSRP or SNMP group identifier, depending on the command. | Allows a higher-priority device to retake the active role. Example DSW1(config-if)# standby 10 preempt |
standby <group> track <object> decrement <value> |
Interface config | group: HSRP or SNMP group identifier, depending on the command. | Reduces priority when a tracked object fails. Example DSW1(config-if)# standby 10 track 1 decrement 20 Important: Tracking configuration varies by design and platform. |
ip dhcp and ip helper-address commands
Creates DHCP scopes, exclusions, options, leases, and DHCP relay.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip dhcp excluded-address <low> [high] |
Global config | Square brackets mark an optional keyword or argument. | Prevents the DHCP server from leasing reserved addresses. Example R1(config)# ip dhcp excluded-address 10.20.0.1 10.20.0.20 |
ip dhcp pool <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Creates a DHCP pool and enters DHCP pool mode. Example R1(config)# ip dhcp pool VLAN20-USERS |
default-router <address> [address...] |
DHCP pool config | address: Use an IPv4 address in dotted-decimal notation. | Provides default gateway option 3. Example R1(dhcp-config)# default-router 10.20.0.1 |
dns-server <address> [address...] |
DHCP pool config | address: Use an IPv4 address in dotted-decimal notation. | Provides DNS server option 6. Example R1(dhcp-config)# dns-server 10.0.0.53 1.1.1.1 |
domain-name <domain> |
DHCP pool config | Replace each value inside angle brackets. Do not type the angle brackets. | Provides the client DNS domain name. Example R1(dhcp-config)# domain-name lab.example |
lease <days> [hours] [minutes] |
DHCP pool config | Square brackets mark an optional keyword or argument. | Sets the lease duration. Example R1(dhcp-config)# lease 7 |
ip helper-address <server-ip> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Relays UDP broadcasts, including DHCP, to a server. Example DSW1(config-if)# ip helper-address 10.0.0.50 Important: Place it on the client-facing Layer 3 interface or SVI, not on the server interface. |
ip dhcp snooping |
Global config | No variable options in this command form. | Enables DHCP snooping globally. Example SW1(config)# ip dhcp snooping |
ip dhcp snooping vlan <list> |
Global config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Enables DHCP snooping for selected VLANs. Example SW1(config)# ip dhcp snooping vlan 10,20 |
ip dhcp snooping trust |
Interface config | No variable options in this command form. | Trusts DHCP server messages on an uplink or server-facing port. Example SW1(config-if)# ip dhcp snooping trust Important: Do not trust normal user ports. |
ip dhcp snooping limit rate <pps> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Limits DHCP messages on an untrusted access port. Example SW1(config-if)# ip dhcp snooping limit rate 15 |
DNS client and local host commands
Configures resolvers, lookup behavior, and local hostname mappings on the Cisco device.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip name-server <address> [address...] |
Global config | address: Use an IPv4 address in dotted-decimal notation. | Sets DNS resolvers used by the Cisco device. Example R1(config)# ip name-server 10.0.0.53 1.1.1.1 |
ip domain lookup |
Global config | No variable options in this command form. | Enables hostname resolution by the device. Example R1(config)# ip domain lookup |
ip host <name> <address> |
Global config | address: Use an IPv4 address in dotted-decimal notation. name: Use a locally meaningful name without angle brackets. | Creates a local static hostname mapping. Example R1(config)# ip host syslog1 10.0.0.60 |
ip nat commands
Marks NAT boundaries and creates dynamic NAT, PAT, static NAT, and port translations.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip nat inside |
Interface config | No variable options in this command form. | Marks an interface as the NAT inside boundary. Example R1(config-if)# ip nat inside |
ip nat outside |
Interface config | No variable options in this command form. | Marks an interface as the NAT outside boundary. Example R1(config-if)# ip nat outside |
ip nat inside source list <acl> interface <outside-interface> overload |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Creates PAT using the outside interface address. Example R1(config)# ip nat inside source list 1 interface gigabitEthernet0/0/0 overload |
ip nat pool <name> <start> <end> netmask <mask> |
Global config | mask: Use an IPv4 subnet mask, not a wildcard mask, unless the command explicitly says wildcard. name: Use a locally meaningful name without angle brackets. | Defines a pool of inside global addresses. Example R1(config)# ip nat pool PUBLIC 203.0.113.10 203.0.113.14 netmask 255.255.255.248 |
ip nat inside source list <acl> pool <name> [overload] |
Global config | name: Use a locally meaningful name without angle brackets. overload: Optional. Enables many-to-one port address translation. | Creates dynamic NAT or PAT using a pool. Example R1(config)# ip nat inside source list 1 pool PUBLIC overload |
ip nat inside source static <inside-local> <inside-global> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Creates a one-to-one static translation. Example R1(config)# ip nat inside source static 10.10.10.10 203.0.113.10 |
ip nat inside source static tcp <inside-local> <local-port> <inside-global|interface> <global-port> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Creates a static TCP port translation. Example R1(config)# ip nat inside source static tcp 10.10.10.10 443 interface gigabitEthernet0/0/0 443 Important: Syntax support for the interface keyword varies. |
access-list, ip access-list, and ACL application commands
Creates IPv4 or IPv6 ACLs, adds ACEs, documents them, applies them, and restricts VTY sources.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
access-list <standard-number> permit <inside-network> <wildcard> |
Global config | wildcard: A 0 bit must match and a 1 bit can vary. | Matches inside local addresses to translate. Example R1(config)# access-list 1 permit 10.0.0.0 0.255.255.255 Important: This ACL classifies addresses for NAT. It is not applied to an interface. |
ip access-list standard <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Creates a named standard IPv4 ACL that matches source IPv4 addresses. Example R1(config)# ip access-list standard MGMT-SOURCES |
[sequence] permit|deny {host <ip>|<network> <wildcard>|any} [log] |
Standard ACL config | wildcard: A 0 bit must match and a 1 bit can vary. Braces with vertical bars mean choose one listed value. | Adds a standard ACL entry. Example R1(config-std-nacl)# 10 permit 10.99.0.0 0.0.0.255 |
ip access-list extended <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Creates a named extended IPv4 ACL. Example R1(config)# ip access-list extended USERS-IN |
[sequence] permit|deny <protocol> <source> <destination> [operator port] [log] |
Extended ACL config | Square brackets mark an optional keyword or argument. | Matches protocol, source, destination, and optional Layer 4 ports. Example R1(config-ext-nacl)# 10 permit tcp 10.20.0.0 0.0.0.255 host 10.50.0.10 eq 443 |
remark <text> |
ACL config | Replace each value inside angle brackets. Do not type the angle brackets. | Adds documentation inside an ACL. Example R1(config-ext-nacl)# remark Allow users to HTTPS application |
no <sequence> |
ACL config | Replace each value inside angle brackets. Do not type the angle brackets. | Deletes one ACE by sequence number. Example R1(config-ext-nacl)# no 20 |
ip access-list resequence <name> <start> <increment> |
Global config | name: Use a locally meaningful name without angle brackets. | Renumbers ACE sequence values. Example R1(config)# ip access-list resequence USERS-IN 10 10 |
ip access-group <name|number> {in|out} |
Interface config | in/out: Choose the direction relative to the interface. In enters the interface. Out leaves it. | Applies an IPv4 ACL to an interface direction. Example R1(config-if)# ip access-group USERS-IN in Important: In means packets entering the interface. Out means packets leaving the interface. |
access-class <standard-acl> in |
Line config | Replace each value inside angle brackets. Do not type the angle brackets. | Restricts source addresses allowed to open VTY management sessions. Example R1(config-line)# access-class MGMT-SOURCES in |
ipv6 access-list <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Creates a named IPv6 ACL. Example R1(config)# ipv6 access-list V6-USERS-IN |
[sequence] permit|deny <protocol> <source-prefix|any> <destination-prefix|any> [operator port] [log] |
IPv6 ACL config | Square brackets mark an optional keyword or argument. | Adds an IPv6 ACL entry. Example R1(config-ipv6-acl)# 10 permit tcp 2001:db8:20::/64 host 2001:db8:50::10 eq 443 |
ipv6 traffic-filter <name> {in|out} |
Interface config | name: Use a locally meaningful name without angle brackets. in/out: Choose the direction relative to the interface. In enters the interface. Out leaves it. | Applies an IPv6 ACL to an interface direction. Example R1(config-if)# ipv6 traffic-filter V6-USERS-IN in |
no ip access-list standard|extended <name> |
Global config | name: Use a locally meaningful name without angle brackets. | Deletes a named IPv4 ACL. Example R1(config)# no ip access-list extended USERS-IN Important: Remove references from interfaces or lines first when practical. |
SSH, login, line, and AAA commands
Enables encrypted remote management and controls authentication.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
crypto key generate rsa modulus <bits> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Generates RSA keys and enables the SSH server. Example R1(config)# crypto key generate rsa modulus 2048 Important: Some releases use crypto key generate rsa general-keys modulus 2048. Key-size requirements and supported algorithms vary. |
ip ssh version 2 |
Global config | No variable options in this command form. | Restricts the SSH server to SSH version 2. Example R1(config)# ip ssh version 2 |
ip ssh time-out <seconds> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the SSH authentication timeout. Example R1(config)# ip ssh time-out 60 |
ip ssh authentication-retries <count> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Limits SSH authentication retries. Example R1(config)# ip ssh authentication-retries 3 |
login local |
Line config | No variable options in this command form. | Uses the local username database for line authentication. Example R1(config-line)# login local |
transport input ssh |
Line config | No variable options in this command form. | Allows inbound SSH and blocks inbound Telnet on the line. Example R1(config-line)# transport input ssh |
transport output ssh |
Line config | No variable options in this command form. | Restricts outbound line transport to SSH. Example R1(config-line)# transport output ssh Important: Usually not required for basic management. |
ssh -l <username> <host> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Starts an SSH client session from the Cisco device. Example R1# ssh -l netadmin 10.99.0.11 |
login block-for <seconds> attempts <count> within <seconds> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Temporarily blocks login attempts after repeated failures. Example R1(config)# login block-for 120 attempts 3 within 60 Important: Validate emergency access before enabling in production. |
aaa new-model |
Global config | No variable options in this command form. | Enables the AAA access-control framework. Example R1(config)# aaa new-model Important: High risk on remote devices. An incomplete AAA configuration can lock out administrators. |
aaa authentication login default local |
Global config | No variable options in this command form. | Uses the local user database for default AAA login authentication. Example R1(config)# aaa authentication login default local Important: Configure and test a local user before applying AAA to remote access. |
line console 0 |
Global config | No variable options in this command form. | Enters configuration mode for the local console line. Example Device(config)# line console 0 Verify with: show running-config | section line conImportant: Console line numbering is normally 0. |
line vty <first> <last> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Selects virtual terminal lines used for SSH or Telnet management. Example Device(config)# line vty 0 15 Verify with: show running-config | section line vtyImportant: The available VTY range varies by platform and image. |
switchport port-security commands
Restricts MAC addresses allowed on static access ports.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
switchport port-security |
Interface config | No variable options in this command form. | Enables switchport port security on a static access port. Example SW1(config-if)# switchport port-security |
switchport port-security maximum <count> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the maximum secure MAC addresses. Example SW1(config-if)# switchport port-security maximum 2 |
switchport port-security mac-address sticky |
Interface config | No variable options in this command form. | Learns secure MAC addresses and writes sticky entries into running-config. Example SW1(config-if)# switchport port-security mac-address sticky |
switchport port-security violation {protect|restrict|shutdown} |
Interface config | violation mode: protect drops silently, restrict drops and counts/logs, shutdown error-disables the port. Braces with vertical bars mean choose one listed value. | Sets violation behavior. Example SW1(config-if)# switchport port-security violation restrict Important: shutdown is commonly the default and places the port in err-disabled state. |
DHCP snooping, DAI, IP Source Guard, and storm control
Protects access VLANs from rogue DHCP, forged ARP, source spoofing, and excessive Layer 2 traffic.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ip arp inspection vlan <list> |
Global config | list: Use a comma-separated list and hyphens for ranges, such as 10,20,30-40. | Enables Dynamic ARP Inspection for selected VLANs. Example SW1(config)# ip arp inspection vlan 10,20 Important: DAI normally depends on valid DHCP snooping bindings or configured ARP ACLs. |
ip arp inspection trust |
Interface config | No variable options in this command form. | Trusts ARP messages on an uplink. Example SW1(config-if)# ip arp inspection trust |
ip verify source |
Interface config | No variable options in this command form. | Enables IP Source Guard using valid source bindings. Example SW1(config-if)# ip verify source Important: Support and prerequisites vary. Commonly requires DHCP snooping. |
storm-control broadcast level <high> <low> |
Interface config | Replace each value inside angle brackets. Do not type the angle brackets. | Limits broadcast traffic by configured thresholds. Example SW1(config-if)# storm-control broadcast level 1.00 0.50 Important: Threshold units and supported syntax vary. Test values before production use. |
CDP and LLDP commands
Enables, disables, and controls neighbor discovery protocols.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
cdp run |
Global config | No variable options in this command form. | Enables CDP globally. Example SW1(config)# cdp run |
no cdp run |
Global config | No variable options in this command form. | Disables CDP globally. Example SW1(config)# no cdp run |
no cdp enable |
Interface config | No variable options in this command form. | Disables CDP on one interface. Example SW1(config-if)# no cdp enable |
lldp run |
Global config | No variable options in this command form. | Enables standards-based LLDP globally. Example SW1(config)# lldp run |
no lldp transmit |
Interface config | No variable options in this command form. | Stops LLDP advertisements on one interface. Example SW1(config-if)# no lldp transmit |
no lldp receive |
Interface config | No variable options in this command form. | Stops LLDP processing on one interface. Example SW1(config-if)# no lldp receive |
NTP, logging, and SNMP commands
Synchronizes time and exports operational data to management systems.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ntp server <address> [prefer] |
Global config | address: Use an IPv4 address in dotted-decimal notation. | Synchronizes time from an NTP server. Example SW1(config)# ntp server 10.0.0.40 prefer |
ntp source <interface> |
Global config | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Sets the source interface for NTP packets. Example SW1(config)# ntp source vlan 99 |
ntp master [stratum] |
Global config | Square brackets mark an optional keyword or argument. | Makes the device act as an NTP master using its local clock. Example R1(config)# ntp master 8 Important: Use mainly in isolated labs. Do not advertise an unsynchronized clock as authoritative in production. |
service timestamps log datetime msec localtime show-timezone |
Global config | No variable options in this command form. | Adds detailed local timestamps to log messages. Example SW1(config)# service timestamps log datetime msec localtime show-timezone |
logging buffered <bytes> <severity> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Stores messages in the local logging buffer. Example SW1(config)# logging buffered 65536 informational |
logging host <address> |
Global config | address: Use an IPv4 address in dotted-decimal notation. | Sends syslog messages to a remote server. Example SW1(config)# logging host 10.0.0.60 |
logging trap <severity> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets the minimum severity sent to syslog servers. Example SW1(config)# logging trap warnings Important: Lower numeric severity is more urgent. warnings is severity 4. |
logging source-interface <interface> |
Global config | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Uses a stable source address for syslog. Example SW1(config)# logging source-interface vlan 99 |
snmp-server community <string> RO [acl] |
Global config | Square brackets mark an optional keyword or argument. | Creates an SNMPv2c read-only community. Example SW1(config)# snmp-server community <community> RO MGMT-SOURCES Important: SNMPv2c communities are plaintext shared secrets. Prefer SNMPv3. |
snmp-server group <group> v3 priv |
Global config | group: HSRP or SNMP group identifier, depending on the command. | Creates an SNMPv3 group that requires authentication and privacy. Example SW1(config)# snmp-server group NMS v3 priv |
snmp-server user <user> <group> v3 auth sha <auth-secret> priv aes 128 <privacy-secret> |
Global config | group: HSRP or SNMP group identifier, depending on the command. | Creates an authenticated and encrypted SNMPv3 user. Example SW1(config)# snmp-server user nmsuser NMS v3 auth sha <auth-secret> priv aes 128 <privacy-secret> Important: Supported hash and encryption algorithms vary by platform and security policy. |
ping, traceroute, Telnet testing, and debug commands
Tests the path or displays live control-plane events. Debug commands require caution.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
ping <destination> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Tests IP reachability with ICMP echo. Example R1# ping 10.30.0.10 |
ping |
Privileged EXEC | No variable options in this command form. | Starts extended ping with source, repeat count, size, timeout, and other options. Example R1# ping Protocol [ip]: Target IP address: 10.30.0.10 Source address or interface: 10.10.0.1 |
traceroute <destination> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Shows Layer 3 hops toward a destination. Example R1# traceroute 10.30.0.10 |
telnet <host> <port> |
EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Tests a TCP connection or opens a Telnet session. Example R1# telnet 10.50.0.10 443 Important: Telnet management is insecure. Use it only as a basic TCP reachability test where supported. |
debug ip ospf adj |
Privileged EXEC | No variable options in this command form. | Displays OSPF adjacency events. Example R1# debug ip ospf adj Important: Debugging can consume CPU and flood the terminal. Use briefly and during a controlled window. |
debug ip dhcp server events |
Privileged EXEC | No variable options in this command form. | Displays DHCP server events. Example R1# debug ip dhcp server events Important: Use briefly and stop after capture. |
undebug all |
Privileged EXEC | No variable options in this command form. | Disables all debugging. Example R1# undebug all |
ping <destination> source <source-interface-or-address> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Tests reachability while forcing the packet source. Example R1# ping 10.30.0.10 source 10.10.0.1 Verify with: Confirm the return path routes back to the selected source.Important: Useful for testing the same path used by an SVI, loopback, or routed interface. |
clear commands
Clears learned or dynamic state so the device can rebuild it. These commands can disrupt active traffic.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
clear mac address-table dynamic [interface <interface>] |
Privileged EXEC | interface: Replace with the actual interface, such as GigabitEthernet1/0/10. | Clears dynamic MAC entries so the switch relearns them. Example SW1# clear mac address-table dynamic interface gigabitEthernet1/0/10 Important: Traffic can flood briefly while entries are relearned. |
clear arp-cache |
Privileged EXEC | No variable options in this command form. | Clears dynamic ARP entries. Example R1# clear arp-cache Important: Causes temporary ARP resolution and can increase broadcast traffic. |
clear ipv6 neighbors |
Privileged EXEC | No variable options in this command form. | Clears IPv6 neighbor cache entries. Example R1# clear ipv6 neighbors Important: Syntax can vary by release. |
clear ip ospf process |
Privileged EXEC | No variable options in this command form. | Restarts the local OSPF process. Example R1# clear ip ospf process Important: Disruptive. All local OSPF adjacencies drop and reform. |
clear ip dhcp binding <address|*> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Deletes one or all DHCP bindings. Example R1# clear ip dhcp binding 10.20.0.101 Important: The client can continue using its address until renewal or link reset. Clearing all bindings can cause churn. |
clear ip nat translation * |
Privileged EXEC | No variable options in this command form. | Clears dynamic translations. Example R1# clear ip nat translation * Important: Breaks active translated sessions. Static configuration remains. |
copy, save, backup, file, boot, and reload commands
Saves configuration, backs up files, schedules rollback reloads, manages flash, and controls boot behavior.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
copy running-config startup-config |
Privileged EXEC | No variable options in this command form. | Saves the active configuration for the next boot. Example SW1# copy running-config startup-config Verify with: show startup-config |
write memory |
Privileged EXEC | No variable options in this command form. | Legacy shorthand that usually saves running-config to startup-config. Example SW1# write memory Important: Use copy running-config startup-config in procedures because the source and destination are explicit. |
copy running-config flash:<file> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Creates a local configuration backup in flash. Example SW1# copy running-config flash:prechange.cfg Verify with: dir flash: |
copy running-config tftp: |
Privileged EXEC | No variable options in this command form. | Copies the active configuration to a TFTP server. Example SW1# copy running-config tftp: Important: TFTP is unencrypted. Prefer SCP or SFTP where supported. |
copy running-config scp: |
Privileged EXEC | No variable options in this command form. | Copies the active configuration to an SCP destination. Example SW1# copy running-config scp: Important: Requires SSH/SCP support and destination credentials. |
copy flash:<file> running-config |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Merges a saved configuration into the active configuration. Example SW1# copy flash:prechange.cfg running-config Important: This is a merge, not a full replacement. Old commands can remain. |
configure replace flash:<file> force |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Replaces the running configuration with a saved configuration. Example SW1# configure replace flash:prechange.cfg force Important: Platform-dependent. Test in a lab. A replacement can immediately break management access. |
reload in <minutes> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Schedules a reload as a remote-change safety net. Example SW1# reload in 10 Important: Confirm that the startup-config contains the known-good state before scheduling the reload. |
reload cancel |
Privileged EXEC | No variable options in this command form. | Cancels a scheduled reload after successful verification. Example SW1# reload cancel |
reload |
Privileged EXEC | No variable options in this command form. | Reloads the device. Example SW1# reload Important: Causes an outage. Save only the configuration you intend to keep. |
erase startup-config |
Privileged EXEC | No variable options in this command form. | Deletes the saved startup configuration. Example SW1# erase startup-config Important: Destructive. On switches, VLAN data can remain in vlan.dat. |
dir [filesystem:] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Lists files and free space. Example SW1# dir flash: |
more <filesystem:file> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Displays a text file. Example SW1# more flash:prechange.cfg |
copy <source> <destination> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Copies a file between supported locations. Example SW1# copy tftp: flash: Important: Confirm destination filename and free space. |
delete <filesystem:file> |
Privileged EXEC | Replace each value inside angle brackets. Do not type the angle brackets. | Deletes one file. Example SW1# delete flash:old-image.bin Important: Destructive. Verify the active and next-boot image before deleting software. |
verify /md5 <filesystem:file> [expected-hash] |
Privileged EXEC | Square brackets mark an optional keyword or argument. | Calculates or validates an MD5 file hash. Example SW1# verify /md5 flash:cat9k_iosxe.bin Important: Use the vendor-published hash. Some releases also support stronger hash options. |
boot system flash:<image> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Sets an IOS image boot statement on platforms that use bundle-style boot variables. Example R1(config)# boot system flash:isr-image.bin Important: IOS XE install mode uses different workflows. Follow the exact platform release guide. |
delete flash:vlan.dat |
Privileged EXEC | No variable options in this command form. | Deletes the persistent VLAN database on many Catalyst switches. Example SW1# delete flash:vlan.dat Important: Destructive and platform-dependent. Required with erase startup-config for a full lab reset on many switches. |
erase startup-config |
Privileged EXEC | No variable options in this command form. | Deletes the startup configuration. Example SW1# erase startup-config |
reload |
Privileged EXEC | No variable options in this command form. | Reloads and applies the reset state. Example SW1# reload Important: Causes an outage. Answer no if prompted to save the configuration you are intentionally discarding. |
configuration cleanup commands
Removes feature configuration or resets a lab device.
| Command and syntax | Mode | Options and placeholders | Use case, example, and verification |
|---|---|---|---|
no <feature-command> |
Global config | Replace each value inside angle brackets. Do not type the angle brackets. | Removes one configured feature or statement. Example R1(config)# no router ospf 1 Important: Review dependencies before removing routing, AAA, NAT, or management commands. |