CLI Configuration Use Cases

Ordered tutorials for building a Cisco lab or small routed and switched network.

Stages: Baseline Access port Trunk STP EtherChannel Inter-VLAN OSPF DHCP NAT ACL Save

Procedure order: Configure the smallest required scope, verify the expected result, test forwarding, then save. Use the Troubleshooting page when a verification step fails.

Tutorial contents

1. Create a safe baseline on a new lab switch
2. Configure a user access port
3. Configure a phone and attached PC port
4. Configure a static 802.1Q trunk
5. Enable Rapid PVST+ and set root placement
6. Build an LACP EtherChannel trunk
7. Configure a management SVI on a Layer 2 switch
8. Configure inter-VLAN routing on a multilayer switch
9. Configure router-on-a-stick
10. Configure a default route and floating backup
11. Configure single-area OSPF
12. Configure a Cisco IOS DHCP server scope
13. Configure DHCP relay
14. Configure Internet PAT using the WAN interface address
15. Build and apply an extended IPv4 ACL
16. Enable SSH-only management
17. Configure sticky port security
18. Enable DHCP snooping and Dynamic ARP Inspection
19. Troubleshoot a host that cannot reach its gateway
20. Use a timed reload as a remote-change safety net
21. Save and back up the configuration
22. Reset a lab switch

Procedure rule

Confirm prerequisites and current state.
Back up the configuration before risky changes.
Enter one command at a time.
Read errors instead of pasting through them.
Verify operational state before saving.
Keep rollback commands available.

1. Create a safe baseline on a new lab switch

Use when: Use this before normal switching configuration.

Before you start: Console access and a planned hostname, domain name, and local administrator secret.

Warning: Replace every placeholder. Do not use shared or weak lab secrets on production equipment.

Step	Command	Why you use it
1	`enable`	Enter privileged EXEC mode.
2	`configure terminal`	Enter global configuration mode.
3	`hostname SW1`	Set the hostname and prompt.
4	`no ip domain-lookup`	Prevent lab typos from causing long DNS lookup delays.
5	`enable secret <ENABLE-SECRET>`	Protect privileged EXEC mode.
6	`username netadmin privilege 15 secret <ADMIN-SECRET>`	Create a local administrator.
7	`service password-encryption`	Obscure remaining plaintext line passwords in the configuration.
8	`banner motd #Authorized access only.#`	Display an access warning.
9	`ip domain name lab.example`	Set the domain needed for RSA key generation.
10	`line console 0`	Enter console-line configuration.
11	`logging synchronous`	Redraw commands after console log messages.
12	`exec-timeout 10 0`	Disconnect an idle console session after ten minutes.
13	`end`	Return to privileged EXEC mode.
14	`copy running-config startup-config`	Save the verified baseline.

Verification

show running-config | include hostname|username|domain
show startup-config

Back to use-case tutorials

2. Configure a user access port

Use when: Use this for one workstation, printer, camera, or other endpoint in a single data VLAN.

Before you start: The VLAN ID and endpoint port are known. The port does not connect to another switch or bridge.

Warning: Do not enable PortFast and BPDU Guard on a normal switch-to-switch link.

Step	Command	Why you use it
1	`vlan 20`	Create VLAN 20 if it does not already exist.
2	`name USERS`	Give the VLAN a clear name.
3	`interface gigabitEthernet1/0/10`	Select the endpoint port.
4	`description USER-PC-23`	Document the connection.
5	`switchport mode access`	Force static access mode.
6	`switchport access vlan 20`	Assign untagged data traffic to VLAN 20.
7	`spanning-tree portfast`	Move an edge port to forwarding quickly.
8	`spanning-tree bpduguard enable`	Error-disable the port if it receives a BPDU.
9	`no shutdown`	Enable the port.

Verification

show interfaces gi1/0/10 switchport
show vlan brief
show spanning-tree interface gi1/0/10 detail
show mac address-table interface gi1/0/10

Rollback: default interface gigabitEthernet1/0/10

Back to use-case tutorials

3. Configure a phone and attached PC port

Use when: Use this when an IP phone tags voice traffic and passes untagged PC traffic.

Before you start: Data VLAN 20 and voice VLAN 30 exist or are approved.

Step	Command	Why you use it
1	`vlan 20`	Create the data VLAN.
2	`name USERS`	Name the data VLAN.
3	`vlan 30`	Create the voice VLAN.
4	`name VOICE`	Name the voice VLAN.
5	`interface gigabitEthernet1/0/11`	Select the phone port.
6	`switchport mode access`	Use access mode for endpoint operation.
7	`switchport access vlan 20`	Assign untagged PC traffic to VLAN 20.
8	`switchport voice vlan 30`	Advertise VLAN 30 to the supported phone.
9	`spanning-tree portfast`	Allow quick edge convergence.
10	`spanning-tree bpduguard enable`	Protect the edge from unexpected BPDUs.

Verification

show interfaces gi1/0/11 switchport
show cdp neighbors detail
show lldp neighbors detail

Rollback: default interface gigabitEthernet1/0/11

Back to use-case tutorials

4. Configure a static 802.1Q trunk

Use when: Use this between managed switches or between a switch and a router, firewall, access point, or hypervisor that expects tagged VLANs.

Before you start: Both ends agree on the native VLAN and allowed VLAN list.

Warning: The allowed-vlan command replaces the existing list unless you use the add keyword.

Step	Command	Why you use it
1	`interface gigabitEthernet1/0/48`	Select the uplink.
2	`description TRUNK-TO-SW2`	Document the neighbor.
3	`switchport mode trunk`	Force trunk operation.
4	`switchport trunk native vlan 999`	Place untagged traffic in VLAN 999.
5	`switchport trunk allowed vlan 10,20,30,999`	Limit the trunk to required VLANs.
6	`switchport nonegotiate`	Disable DTP after configuring a static trunk.
7	`no shutdown`	Enable the link.

Verification

show interfaces trunk
show interfaces gi1/0/48 switchport
show cdp neighbors detail

Rollback: default interface gigabitEthernet1/0/48

Back to use-case tutorials

5. Enable Rapid PVST+ and set root placement

Use when: Use this to make STP behavior intentional instead of relying on default bridge priorities.

Before you start: Identify the primary and secondary distribution switches. Confirm all switches support Rapid PVST+.

Warning: Changing STP mode or root placement affects the entire Layer 2 topology. Make the change during a controlled window.

Step	Command	Why you use it
1	`spanning-tree mode rapid-pvst`	Enable Rapid PVST+ globally.
2	`spanning-tree vlan 10,20,30 root primary`	Make this switch the likely root for the listed VLANs.
3	`spanning-tree portfast default`	Enable PortFast by default on nontrunking access ports.
4	`spanning-tree portfast bpduguard default`	Enable BPDU Guard on PortFast-enabled ports.
5	`interface gigabitEthernet1/0/48`	Select a downstream switch-facing port when root protection is required.
6	`spanning-tree guard root`	Prevent the downstream device from becoming root through this port.

Verification

show spanning-tree summary
show spanning-tree vlan 10
show spanning-tree inconsistentports

Rollback: Remove the specific spanning-tree commands with their no forms. Do not change STP mode during an outage without a planned migration.

Back to use-case tutorials

6. Build an LACP EtherChannel trunk

Use when: Use this to combine parallel switch links into one logical link with negotiation.

Before you start: Member ports have matching speed, duplex, VLAN, trunk, and MTU settings on both switches.

Warning: Do not configure mismatched members. A static mode on bundle can create loops when the other side is not bundled.

Step	Command	Why you use it
1	`interface range gigabitEthernet1/0/47-48`	Select both physical members.
2	`channel-group 1 mode active`	Create Port-channel1 and actively negotiate LACP.
3	`interface port-channel 1`	Configure the logical bundle.
4	`switchport mode trunk`	Make the bundle a trunk.
5	`switchport trunk native vlan 999`	Set the shared native VLAN.
6	`switchport trunk allowed vlan 10,20,30,999`	Set the shared allowed VLANs.

Verification

show etherchannel summary
show lacp neighbor
show interfaces port-channel 1
show interfaces trunk

Rollback: Remove channel-group 1 from each member, then use no interface port-channel 1.

Back to use-case tutorials

7. Configure a management SVI on a Layer 2 switch

Use when: Use this to give a Layer 2 switch an IP address for SSH, NTP, SNMP, and syslog.

Before you start: Management VLAN 99 reaches the management gateway. IP routing remains disabled on the switch.

Warning: An SVI stays down until its VLAN exists and at least one Layer 2 port in the VLAN is operational.

Step	Command	Why you use it
1	`vlan 99`	Create the management VLAN.
2	`name MANAGEMENT`	Name the management VLAN.
3	`interface vlan 99`	Create or select the SVI.
4	`ip address 10.99.0.11 255.255.255.0`	Assign the switch management address.
5	`no shutdown`	Administratively enable the SVI.
6	`ip default-gateway 10.99.0.1`	Set the gateway used by a non-routing switch.

Verification

show ip interface brief
show vlan brief
ping 10.99.0.1
show ip arp

Back to use-case tutorials

8. Configure inter-VLAN routing on a multilayer switch

Use when: Use this when the switch should route between VLANs using SVIs.

Before you start: The switch model and license support Layer 3 routing.

Warning: Enabling routing changes how the switch handles its default gateway. Use a default route instead of ip default-gateway after ip routing is enabled.

Step	Command	Why you use it
1	`ip routing`	Enable IPv4 packet forwarding.
2	`vlan 10`	Create the server VLAN.
3	`vlan 20`	Create the user VLAN.
4	`interface vlan 10`	Select the VLAN 10 SVI.
5	`ip address 10.10.0.1 255.255.255.0`	Set the VLAN 10 default gateway.
6	`no shutdown`	Enable the SVI.
7	`interface vlan 20`	Select the VLAN 20 SVI.
8	`ip address 10.20.0.1 255.255.255.0`	Set the VLAN 20 default gateway.
9	`no shutdown`	Enable the SVI.

Verification

show ip interface brief
show ip route connected
show vlan brief
ping between test hosts in the two VLANs

Rollback: Remove ip routing only after confirming no routed functions depend on it.

Back to use-case tutorials

9. Configure router-on-a-stick

Use when: Use this when one router interface routes several switch VLANs through 802.1Q subinterfaces.

Before you start: The switch-facing port is a trunk and permits VLANs 10 and 20.

Step	Command	Why you use it
1	`interface gigabitEthernet0/0/0`	Select the physical router link.
2	`no shutdown`	Enable the physical interface.
3	`interface gigabitEthernet0/0/0.10`	Create the VLAN 10 subinterface.
4	`encapsulation dot1Q 10`	Associate the subinterface with VLAN 10.
5	`ip address 10.10.0.1 255.255.255.0`	Set the VLAN 10 gateway.
6	`interface gigabitEthernet0/0/0.20`	Create the VLAN 20 subinterface.
7	`encapsulation dot1Q 20`	Associate the subinterface with VLAN 20.
8	`ip address 10.20.0.1 255.255.255.0`	Set the VLAN 20 gateway.

Verification

show ip interface brief
show interfaces gi0/0/0.10
show ip route connected
show interfaces trunk on the switch

Rollback: Use no interface gigabitEthernet0/0/0.10 and no interface gigabitEthernet0/0/0.20.

Back to use-case tutorials

10. Configure a default route and floating backup

Use when: Use this when the router has a primary default next hop and a less-preferred backup.

Before you start: Both next hops are reachable on directly connected networks.

Warning: A next-hop route can stay installed when a failure occurs farther upstream. Use IP SLA and object tracking for stronger failover detection.

Step	Command	Why you use it
1	`ip route 0.0.0.0 0.0.0.0 203.0.113.1`	Install the primary default route with the default administrative distance.
2	`ip route 0.0.0.0 0.0.0.0 198.51.100.1 200`	Install a floating backup with a higher administrative distance.

Verification

show ip route 0.0.0.0
ping each next hop
traceroute a remote test address

Rollback: Use the no form of each exact ip route command.

Back to use-case tutorials

11. Configure single-area OSPF

Use when: Use this to exchange routes between routers in area 0 while keeping user LANs passive.

Before you start: Transit addressing works and each router has a unique router ID.

Warning: Changing a router ID on a live process can require clear ip ospf process, which drops all adjacencies.

Step	Command	Why you use it
1	`router ospf 1`	Create or enter OSPF process 1.
2	`router-id 1.1.1.1`	Set a stable unique router ID.
3	`passive-interface default`	Stop OSPF hellos on all interfaces by default.
4	`no passive-interface gigabitEthernet0/0/1`	Allow neighbor formation only on the transit interface.
5	`network 10.12.0.0 0.0.0.3 area 0`	Enable OSPF on the transit /30.
6	`network 10.10.0.0 0.0.0.255 area 0`	Advertise and enable OSPF on the user LAN interface, which remains passive.

Verification

show ip ospf neighbor
show ip ospf interface brief
show ip route ospf
show ip protocols

Rollback: Use no router ospf 1 only when you intend to remove the entire process.

Back to use-case tutorials

12. Configure a Cisco IOS DHCP server scope

Use when: Use this in a small branch or lab where the router provides DHCP.

Before you start: The gateway interface is configured and all static addresses are known.

Step	Command	Why you use it
1	`ip dhcp excluded-address 10.20.0.1 10.20.0.20`	Reserve the gateway and static-address range.
2	`ip dhcp pool VLAN20-USERS`	Create and enter the DHCP pool.
3	`network 10.20.0.0 255.255.255.0`	Define the served subnet.
4	`default-router 10.20.0.1`	Provide DHCP option 3.
5	`dns-server 10.0.0.53 1.1.1.1`	Provide DHCP option 6.
6	`domain-name lab.example`	Provide the client DNS suffix.
7	`lease 7`	Set a seven-day lease.

Verification

show ip dhcp pool
show ip dhcp binding
show ip dhcp conflict

Rollback: Use no ip dhcp pool VLAN20-USERS and remove the exclusion if no other pool needs it.

Back to use-case tutorials

13. Configure DHCP relay

Use when: Use this when clients and the DHCP server are on different IP networks.

Before you start: Routing works between the client gateway and DHCP server 10.0.0.50.

Warning: Place the helper on the client gateway interface, not the server-facing interface.

Step	Command	Why you use it
1	`interface vlan 20`	Select the client-facing Layer 3 interface.
2	`ip helper-address 10.0.0.50`	Relay supported UDP broadcasts, including DHCP, to the server.

Verification

show running-config interface vlan 20
ping 10.0.0.50 source vlan 20
review DHCP server logs during a client renewal

Rollback: no ip helper-address 10.0.0.50

Back to use-case tutorials

14. Configure Internet PAT using the WAN interface address

Use when: Use this when many inside hosts share one public interface address.

Before you start: Inside and outside interfaces are correctly identified and a default route exists.

Warning: Clearing translations breaks active sessions. Verify the inside and outside directions before troubleshooting the ACL.

Step	Command	Why you use it
1	`access-list 1 permit 10.0.0.0 0.255.255.255`	Match inside addresses that should be translated.
2	`interface gigabitEthernet0/0/1`	Select the LAN interface.
3	`ip nat inside`	Mark the LAN side of the NAT boundary.
4	`interface gigabitEthernet0/0/0`	Select the WAN interface.
5	`ip nat outside`	Mark the WAN side of the NAT boundary.
6	`ip nat inside source list 1 interface gigabitEthernet0/0/0 overload`	Translate matched sources through the WAN address and use ports to keep sessions unique.

Verification

show ip nat translations
show ip nat statistics
show access-lists 1

Rollback: Remove the NAT rule, then remove ip nat inside and ip nat outside from the interfaces.

Back to use-case tutorials

15. Build and apply an extended IPv4 ACL

Use when: Use this to allow HTTPS from VLAN 20 to one server, block other server-subnet access, and allow other destinations.

Before you start: The intended traffic matrix and application ports are documented.

Warning: Always account for the implicit deny at the end of every ACL. Keep an existing management session open during remote policy changes.

Step	Command	Why you use it
1	`ip access-list extended VLAN20-IN`	Create and enter a named extended ACL.
2	`10 permit tcp 10.20.0.0 0.0.0.255 host 10.50.0.10 eq 443`	Allow HTTPS to the application server.
3	`20 deny ip 10.20.0.0 0.0.0.255 10.50.0.0 0.0.0.255 log`	Block and log other access to the server subnet.
4	`30 permit ip 10.20.0.0 0.0.0.255 any`	Allow the remaining traffic. This avoids the implicit deny for other destinations.
5	`interface vlan 20`	Select the source VLAN gateway.
6	`ip access-group VLAN20-IN in`	Filter packets as they enter the SVI from VLAN 20.

Verification

show access-lists VLAN20-IN
show ip interface vlan 20
test both an allowed and denied connection

Rollback: Remove the interface ip access-group first, then remove the ACL.

Back to use-case tutorials

16. Enable SSH-only management

Use when: Use this to replace Telnet and authenticate against the local user database.

Before you start: A reachable management IP, hostname, domain name, local user, and secure source subnet are known.

Warning: A wrong ACL, AAA rule, or VTY command can lock out remote administrators.

Step	Command	Why you use it
1	`hostname R1`	Set the hostname used in RSA key identity.
2	`ip domain name lab.example`	Set the domain required by common RSA key-generation syntax.
3	`username netadmin privilege 15 secret <ADMIN-SECRET>`	Create a local administrator.
4	`crypto key generate rsa modulus 2048`	Generate RSA keys and start the SSH server.
5	`ip ssh version 2`	Require SSH version 2.
6	`ip access-list standard MGMT-SOURCES`	Create an ACL for approved management sources.
7	`10 permit 10.99.0.0 0.0.0.255`	Allow the management subnet.
8	`line vty 0 15`	Select remote-access lines.
9	`login local`	Authenticate with the local user database.
10	`transport input ssh`	Allow SSH and block inbound Telnet.
11	`access-class MGMT-SOURCES in`	Restrict VTY connection sources.
12	`exec-timeout 10 0`	Disconnect idle sessions.

Verification

show ip ssh
show ssh
show users
open a second SSH session before ending the first

Rollback: Remove the VTY access-class or transport restriction only through a working console or verified alternate session.

Back to use-case tutorials

17. Configure sticky port security

Use when: Use this on a stable access port where a small known number of endpoint MAC addresses is expected.

Before you start: The port is a static access port and the device-move process is understood.

Warning: Sticky entries can block replacement devices, docks, phones, or virtualized workloads until you remove or update the learned addresses.

Step	Command	Why you use it
1	`interface gigabitEthernet1/0/10`	Select the endpoint port.
2	`switchport mode access`	Port security requires an eligible Layer 2 switchport.
3	`switchport port-security`	Enable port security.
4	`switchport port-security maximum 2`	Allow two secure MAC addresses, such as a phone and PC.
5	`switchport port-security mac-address sticky`	Learn secure MAC addresses into running-config.
6	`switchport port-security violation restrict`	Drop violating traffic and record the violation without shutting the port.

Verification

show port-security interface gi1/0/10
show port-security address
show logging

Rollback: Remove port-security commands or use default interface gi1/0/10.

Back to use-case tutorials

18. Enable DHCP snooping and Dynamic ARP Inspection

Use when: Use this to block rogue DHCP replies and ARP spoofing in an access VLAN.

Before you start: The trusted path toward the legitimate DHCP server is known. Valid snooping bindings will exist for clients.

Warning: DAI can block valid traffic when bindings are missing, such as statically addressed hosts without an ARP ACL.

Step	Command	Why you use it
1	`ip dhcp snooping`	Enable DHCP snooping globally.
2	`ip dhcp snooping vlan 20`	Enable snooping in VLAN 20.
3	`interface gigabitEthernet1/0/48`	Select the trusted uplink.
4	`ip dhcp snooping trust`	Allow DHCP server replies on the uplink.
5	`ip arp inspection trust`	Trust ARP on the uplink.
6	`interface range gigabitEthernet1/0/1-47`	Select untrusted access ports.
7	`ip dhcp snooping limit rate 15`	Rate-limit DHCP messages on access ports.
8	`ip arp inspection vlan 20`	Enable DAI using snooping bindings in VLAN 20.

Verification

show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection
show logging

Rollback: Disable DAI first if legitimate ARP is blocked, then review snooping trust and bindings.

Back to use-case tutorials

20. Use a timed reload as a remote-change safety net

Use when: Use this before a remote change that could break routing, ACL, AAA, VLAN, or management access.

Before you start: The startup-config contains a known-good state and the device can reload safely if access is lost.

Warning: Do not save an unverified broken configuration before the scheduled reload. Confirm the platform supports the planned rollback behavior.

Step	Command	Why you use it
1	`copy running-config startup-config`	Save the known-good pre-change state.
2	`copy running-config flash:prechange.cfg`	Create an extra local backup.
3	`reload in 10`	Schedule a reload in ten minutes.
4	`configure terminal`	Make the intended change.
5	`reload cancel`	Cancel the reload only after all verification succeeds.
6	`copy running-config startup-config`	Save the verified new state.

Verification

show reload
open a second management session
verify routing, management, and required application paths

Back to use-case tutorials

21. Save and back up the configuration

Use when: Use this after successful verification.

Before you start: The change is approved and no rollback timer remains active.

Warning: TFTP is unencrypted. Prefer SCP or another protected management path.

Step	Command	Why you use it
1	`show running-config`	Review the active state.
2	`copy running-config startup-config`	Save for the next boot.
3	`copy running-config flash:postchange.cfg`	Keep a local named copy.
4	`copy running-config scp:`	Send an encrypted off-device backup where supported.

Verification

show startup-config
dir flash:
verify the remote backup exists

Back to use-case tutorials

22. Reset a lab switch

Use when: Use this only to return an isolated lab switch to an unconfigured state.

Before you start: The device is disconnected from production and no configuration or VLAN data must be preserved.

Warning: Destructive. Platform reset steps vary. Stack members, install mode, licenses, and provisioning files can require additional procedures.

Step	Command	Why you use it
1	`erase startup-config`	Delete the saved startup configuration.
2	`delete flash:vlan.dat`	Delete the persistent VLAN database on platforms that use vlan.dat.
3	`reload`	Restart the switch.
4	`no`	Decline to save when the reload prompt asks about the current configuration.

Verification

After reload, confirm the initial configuration dialog or an empty startup configuration.

Back to use-case tutorials