This is a working Cisco IOS and IOS XE reference laid out the way you actually use it: one table per job, commands on the left, what they do on the right. Everything here is current IOS XE syntax as it runs on today's Catalyst switching, not the classic IOS that a lot of older sheets were written against. Read the prompt before you type, verify with a show command before and after, and save your work.
CLI modes and navigation
The Cisco command line is layered, and the single biggest source of confusion for newer admins is not knowing which layer they are standing in. You land in user EXEC mode, type enable to reach privileged EXEC, run configure terminal to drop into global configuration, then step further into interface, line, or VLAN sub-modes from there. The prompt is your map: a trailing > means user EXEC, a # means privileged, and a tag like (config-if)# tells you the next command applies to a single interface and nowhere else.
| Command | What it does | Prompt you land on |
|---|---|---|
| enable | Move from user EXEC to privileged EXEC | Switch# |
| disable | Drop back down to user EXEC | Switch> |
| configure terminal | Enter global configuration mode | Switch(config)# |
| interface GigabitEthernet1/0/1 | Scope every following command to one physical port | Switch(config-if)# |
| interface range GigabitEthernet1/0/1 - 24 | Scope one edit to a whole block of ports | Switch(config-if-range)# |
| interface Vlan20 | Configure the switched virtual interface for VLAN 20 | Switch(config-if)# |
| vlan 20 | Create or edit VLAN 20 | Switch(config-vlan)# |
| line vty 0 15 | Configure the remote access lines | Switch(config-line)# |
| line console 0 | Configure the console port | Switch(config-line)# |
| router ospf 1 | Enter the OSPF routing process | Switch(config-router)# |
| exit | Back out one level | One mode up |
| end | Jump straight back to privileged EXEC from any depth | Switch# |
| do show ip interface brief | Run an EXEC show command without leaving config mode | Unchanged |
| ? | List every keyword valid at this exact point in the command | Unchanged |
| show ? | Same context help scoped to one keyword you already typed | Unchanged |
| Tab | Complete the keyword you started typing | Unchanged |
| Ctrl-Shift-6 | Abort a running command such as a long ping or traceroute | Unchanged |
| terminal length 0 | Turn off paging so long output scrolls in one pass | Unchanged |
| terminal monitor | Send log messages to your SSH session, not just the console | Unchanged |
| logging synchronous | Stop console messages from mangling the line you are typing | Set per line |
| show privilege | Confirm which privilege level you currently hold | Unchanged |
Show and verify essentials
Troubleshooting is mostly reading. These are the commands you run before you change anything, and the same ones you run again afterward to prove the change did what you intended. When the full running configuration is too much, pipe it: show running-config | section interface or show running-config | include vlan pulls just the part you care about out of a file that can run thousands of lines.
| Command | What it tells you |
|---|---|
| show version | Software train, uptime, license level, and the reason for the last reload |
| show running-config | The configuration active in memory right now |
| show startup-config | The configuration that will load at the next boot |
| show running-config interface GigabitEthernet1/0/1 | Only the lines applied to one port, ideal for before and after checks |
| show running-config | section router ospf | One config section without scrolling the whole file |
| show ip interface brief | One line per interface: address, admin status, line protocol |
| show interfaces status | Speed, duplex, access VLAN, and connect state per port |
| show interfaces GigabitEthernet1/0/1 | Full counters, errors, and drops for a single interface |
| show interfaces counters errors | CRC and input errors across every port at once |
| show vlan brief | VLAN IDs, names, and the access ports assigned to each |
| show interfaces trunk | Which ports trunk, the native VLAN, and the allowed and forwarding lists |
| show mac address-table | Which MAC address is learned behind which port |
| show ip route | The routing table, with codes for connected, static, and OSPF entries |
| show ip arp | IP to MAC bindings the device has resolved |
| show cdp neighbors detail | Directly attached Cisco devices with platform, IP, and software |
| show lldp neighbors detail | The same neighbor map in mixed-vendor environments |
| show spanning-tree | Root bridge, port roles, and port states per VLAN |
| show power inline | PoE budget and per-port power draw |
| show environment | Temperature, fan, and power supply health |
| show inventory | Serial numbers and PIDs for support and warranty registration |
| show logging | The buffered log the box has been quietly writing all along |
Interface configuration
Configuration follows a predictable pattern once you internalize it: enter global config with configure terminal, scope down to the object you are changing, make the edit, then back out and verify that one object rather than the whole file. Every command below runs from interface configuration mode unless noted.
| Command | What it does |
|---|---|
| interface GigabitEthernet1/0/1 | Select a single physical port |
| interface range GigabitEthernet1/0/1 - 24 | Select a contiguous block of ports and edit them together |
| description Uplink to core-sw01 | Label the port so the next admin knows what is on it |
| switchport mode access | Force the port to access mode with no negotiation |
| switchport access vlan 20 | Place the access port in VLAN 20 |
| switchport voice vlan 110 | Add the voice VLAN for an IP phone sharing the port |
| switchport port-security maximum 2 | Cap how many MAC addresses the port will learn |
| spanning-tree portfast | Move an access port to forwarding immediately at link up |
| spanning-tree bpduguard enable | Shut the port if a BPDU arrives, protecting the topology |
| speed 1000 | Pin the port speed when autonegotiation misbehaves |
| duplex full | Pin duplex to stop late collisions on a stubborn link |
| power inline never | Disable PoE on a port that should never supply power |
| no shutdown | Bring the interface up |
| shutdown | Administratively take the interface down |
| no switchport | Convert a switchport into a routed layer 3 interface |
| ip address 10.20.0.2 255.255.255.0 | Address an SVI or a routed port |
| ip address dhcp | Take the management address from DHCP instead |
| default interface GigabitEthernet1/0/1 | Wipe a port back to factory defaults in one command |
| show running-config interface GigabitEthernet1/0/1 | Verify precisely what you just changed and nothing else |
VLANs and trunking
| Command | What it does |
|---|---|
| vlan 20 | Create VLAN 20 and enter VLAN configuration |
| name FINANCE | Name the VLAN so the next person does not have to guess |
| no vlan 20 | Delete the VLAN from the database |
| switchport mode access | Set the port to carry a single untagged VLAN |
| switchport access vlan 20 | Assign that access VLAN |
| switchport mode trunk | Set the port to carry tagged traffic for multiple VLANs |
| switchport trunk encapsulation dot1q | Select 802.1Q tagging on platforms that ask for it |
| switchport trunk allowed vlan 10,20,30 | Restrict the trunk to exactly these VLANs |
| switchport trunk allowed vlan add 40 | Append a VLAN without retyping the whole list |
| switchport trunk native vlan 999 | Move untagged traffic off VLAN 1 to an unused VLAN |
| switchport nonegotiate | Stop sending DTP frames on a hardcoded trunk |
| show interfaces GigabitEthernet1/0/1 switchport | Per-port view of mode, access VLAN, and negotiation state |
| show interfaces trunk | Verify native VLAN plus allowed and forwarding VLAN lists |
| show vlan brief | Confirm the VLAN exists and which ports are members |
| vtp mode transparent | Keep the switch from learning or advertising VLANs over VTP |
| show vtp status | Check VTP mode, domain, and revision before adding a switch |
| interface Vlan20 | Create the SVI that gives VLAN 20 a gateway |
| ip routing | Enable layer 3 forwarding between SVIs, run in global config |
Routing basics: static and OSPF
| Command | What it does | Mode |
|---|---|---|
| ip routing | Turn on IPv4 routing on a layer 3 switch | Global config |
| ip route 0.0.0.0 0.0.0.0 203.0.113.1 | Default route pointing at the next hop | Global config |
| ip route 10.30.0.0 255.255.255.0 10.20.0.1 | Static route to a single subnet | Global config |
| ip route 10.30.0.0 255.255.255.0 10.20.0.2 210 | Floating backup route with a higher administrative distance | Global config |
| no ip route 10.30.0.0 255.255.255.0 10.20.0.1 | Remove a static route | Global config |
| router ospf 1 | Enter OSPF process 1 | Global config |
| router-id 10.0.0.1 | Pin the OSPF router ID instead of letting it be chosen | Router config |
| network 10.20.0.0 0.0.0.255 area 0 | Advertise matching interfaces into area 0 | Router config |
| passive-interface Vlan20 | Advertise the subnet but form no neighbors on a user VLAN | Router config |
| default-information originate | Push the default route into OSPF for the rest of the area | Router config |
| ip ospf 1 area 0 | Enable OSPF directly on an interface, the preferred IOS XE form | Interface config |
| ip ospf network point-to-point | Speed up adjacency on a routed link between two devices | Interface config |
| ip ospf cost 10 | Influence path selection on a specific link | Interface config |
| ip ospf hello-interval 5 | Tighten failure detection where both ends match | Interface config |
| show ip route ospf | Only the routes OSPF learned | Privileged EXEC |
| show ip ospf neighbor | Adjacency state, which should read FULL | Privileged EXEC |
| show ip ospf interface brief | Which interfaces run OSPF, in which area, at what cost | Privileged EXEC |
| show ip protocols | Active routing processes, networks, and passive interfaces | Privileged EXEC |
| clear ip ospf process | Reset adjacencies, disruptive and window-only | Privileged EXEC |
Save, backup, restore, and recovery
The command that ends every session is the one people forget under pressure: copy running-config startup-config, or the shorthand write memory, from privileged EXEC. The running configuration is what is active right now; the startup configuration is what loads on reboot. A change that works but was never saved survives exactly until the next reload, and then it is gone.
| Command | What it does |
|---|---|
| copy running-config startup-config | Save the active configuration so it survives a reload |
| write memory | Shorthand for the same save |
| show startup-config | Confirm what will actually load at boot |
| copy running-config flash:backup-2026-05-29.cfg | Keep a dated local copy on flash before an edit |
| copy running-config tftp: | Push the configuration off the box to a TFTP server |
| copy tftp: running-config | Merge a saved configuration back onto the device |
| archive | Enter the archive feature in global config |
| path flash:archive-config | Tell the archive where to store versions |
| archive config | Take a configuration snapshot on demand |
| show archive | List the stored versions available to roll back to |
| configure replace flash:backup-2026-05-29.cfg | Roll the whole device back to a known-good configuration |
| configure terminal revert timer 10 | Enter config mode with an automatic revert if you do not confirm |
| configure confirm | Confirm the change and cancel the pending automatic revert |
| reload in 10 | Schedule a reload as a lockout safety net before a risky remote edit |
| reload cancel | Cancel that pending reload once you confirm your session survived |
| reload at 02:00 | Schedule a reload inside a maintenance window |
| show reload | Check whether a reload is currently pending |
| dir flash: | List images and saved files on flash |
| show bootvar | See which image the device intends to boot next |
| write erase | Clear the startup configuration back to factory, then reload |
Troubleshooting and diagnostics
| Command | What it does |
|---|---|
| ping 10.20.0.1 | Basic reachability from the device itself |
| ping 10.20.0.1 source Vlan20 repeat 100 | Test from a specific SVI over a longer run |
| traceroute 10.30.0.5 | Hop by hop path toward a destination |
| show interfaces GigabitEthernet1/0/1 | Errors, drops, and counters on a suspect port |
| show interfaces counters errors | Scan every port for CRC and input errors at once |
| clear counters GigabitEthernet1/0/1 | Zero the counters so new errors are unambiguous |
| show mac address-table address 0011.2233.4455 | Find which port a specific MAC lives behind |
| show spanning-tree root | Identify the root bridge for each VLAN |
| show spanning-tree interface GigabitEthernet1/0/1 detail | Explain why a port is blocking |
| show processes cpu sorted | What is burning CPU right now |
| show processes memory sorted | The largest memory consumers |
| show logging | The device's own account of what went wrong and when |
| test cable-diagnostics tdr interface GigabitEthernet1/0/1 | Run a TDR cable test on a copper port |
| show cable-diagnostics tdr interface GigabitEthernet1/0/1 | Read the TDR result once the test completes |
| monitor session 1 source interface Gi1/0/1 | Start a SPAN session to capture traffic from a port |
| monitor session 1 destination interface Gi1/0/24 | Send that mirrored traffic to your capture device |
| show monitor | Confirm which SPAN sessions are configured |
| show debugging | List every debug currently running |
| undebug all | Stop all debugging immediately, the first thing to type if output floods |
| show tech-support | The full diagnostic dump TAC will ask for on a case |
Security hardening baseline
For federal, DoD, healthcare, and SLED environments, the command line is also where security controls actually land. The same CLI you use to bring up a port is where you force SSH, disable unused services, set banners, scope access with AAA, and apply the baselines an auditor will check line by line. These are small edits with outsized audit weight, and our security engineering team turns the same list into a repeatable baseline that lands identically on every device.
| Command | What it does |
|---|---|
| enable secret <password> | Store the privileged EXEC password as a salted hash |
| no enable password | Remove the older, reversibly encrypted password |
| service password-encryption | Obscure the remaining plaintext passwords in the configuration |
| username netadmin privilege 15 secret <password> | Create a local admin account with a hashed password |
| ip domain-name example.gov | Required before the device will generate an SSH key pair |
| crypto key generate rsa modulus 2048 | Generate the RSA key that SSH depends on |
| ip ssh version 2 | Force SSH version 2 and refuse the legacy protocol |
| ip ssh time-out 60 | Limit how long an unauthenticated SSH session can sit open |
| ip ssh authentication-retries 2 | Cut off password guessing at the service level |
| transport input ssh | Allow SSH only on the VTY lines, blocking Telnet |
| login local | Authenticate remote sessions against the local user database |
| exec-timeout 5 0 | Drop idle sessions after five minutes |
| no ip http server | Turn off the HTTP management plane when it is not required |
| no ip http secure-server | Turn off the HTTPS management plane on the same grounds |
| banner login ^C Authorized use only ^C | Present the login banner assessors expect to find |
| aaa new-model | Switch the device to the AAA authentication framework |
| aaa authentication login default group tacacs+ local | Centralize authentication with a local fallback |
| ntp server 10.0.0.10 | Trustworthy timestamps, which every log-based control depends on |
| service timestamps log datetime msec localtime show-timezone | Make each log line usable in an investigation |
| logging host 10.0.0.20 | Ship logs off the box to syslog or a SIEM |
| no snmp-server community public | Remove default read strings that should never exist |
| show ip ssh | Verify the running SSH version and key length |
EtherChannel and port-channel
| Command | What it does |
|---|---|
| interface range GigabitEthernet1/0/23 - 24 | Select the member ports so they are configured identically |
| channel-group 1 mode active | Bundle the members with LACP actively negotiating |
| channel-group 1 mode passive | LACP that waits for the far end to start negotiating |
| channel-group 1 mode desirable | PAgP negotiation, Cisco to Cisco only |
| channel-group 1 mode on | Static bundle with no negotiation, the easiest way to build a loop |
| interface Port-channel1 | Configure the logical bundle itself |
| switchport mode trunk | Applied to Port-channel1 so every member inherits it |
| switchport trunk allowed vlan 10,20,30 | Constrain the bundled trunk to named VLANs |
| no channel-group 1 | Remove a single member port from the bundle |
| port-channel load-balance src-dst-ip | Change the hash so traffic spreads across members |
| show etherchannel summary | Member state at a glance, look for the P flag on each port |
| show etherchannel 1 port-channel | Detail for one bundle including the active protocol |
| show lacp neighbor | What the far end is actually negotiating |
| show etherchannel load-balance | Confirm which hashing method is in effect |
| show interfaces port-channel1 | Aggregate counters and throughput for the bundle |
Frequently asked questions
Is IOS the same as IOS XE on current Catalyst switches?
They share most day-to-day command syntax, so classic IOS habits carry over, but modern Catalyst 9000 switches run IOS XE, which adds a Linux-based architecture, model-driven programmability through NETCONF and RESTCONF, and config-replace recovery. The commands in this reference are aimed at IOS XE.
How do I save my configuration so it survives a reboot?
Run copy running-config startup-config, or the shorthand write memory, from privileged EXEC mode. The running configuration is what is active now; the startup configuration is what loads on reboot, and any unsaved change is lost on the next reload.
What is the fastest way to check interface status?
show ip interface brief gives a one-line-per-interface snapshot of status and addressing, and show interfaces status adds speed, duplex, and the access VLAN. Both are far quicker than scrolling the full running configuration when you only need a health check.
How do I recover if a config change locks me out remotely?
Before a risky edit, schedule a safety net with reload in 10, which reloads the device in ten minutes unless you cancel it with reload cancel. On IOS XE you can also snapshot a known-good config with the archive feature and roll back instantly using configure replace if an edit goes wrong.
Which CLI commands matter most for STIG and NIST compliance?
The high-value ones disable attack surface and prove access control: transport input ssh on VTY lines, no ip http server where it is not needed, service password-encryption, login banners, and AAA configuration. These map directly to DISA STIG findings and NIST SP 800-53 control families that auditors check line by line.
When should we stop running these commands by hand?
Once you are running the same show-and-save cycle across more than a handful of devices, or chasing config drift across a campus, the by-hand model stops scaling. That is the point to move into template-driven provisioning with Catalyst Center or hand the routine cycle to a managed operations team.
Uniqcli Team
The Uniqcli Team is an authorized Cisco partner specializing in Catalyst wireless, switching, datacenter fabric, licensing, and managed services for U.S. federal, state, local, and education customers. We scope Cisco bills of materials, validate procurement paths (TAA, FIPS, contract vehicles), and deliver design, deployment, and managed operations.
Ready to scope your Cisco build?
Build a quoteRelated reading
View all →
GuidesCisco Catalyst 3560V2 (WS-C3560V2-48PS-S) to Catalyst 9200 Migration Guide
The WS-C3560V2-48PS-S reached Last Day of Support on May 31, 2021, no PSIRT patches, no TAC, no RMA. Here is a practical, specs-driven plan to migrate from the Fast Ethernet 3560V2 to the gigabit, IOS-XE Catalyst 9200 (C9200-48P-A).
May 13, 2026 · 7 min readGuidesCisco 2960-48TC-L EoL: Migrate to Catalyst 9200L 48-Port
The Catalyst 2960-48TC-L (WS-C2960-48TC-L) passed Last Day of Support on October 31, 2019. Here is why this Fast Ethernet LAN Base switch has to come out of the wiring closet, and how to refresh cleanly to the Catalyst 9200L 48-port C9200L-48T-4X-A.
June 9, 2026 · 8 min read
GuidesHow to size a campus wireless deployment: APs, switching and licensing
Sizing a campus wireless refresh is three problems wearing one trench coat: enough APs for the RF, enough switch ports and PoE to feed them, and the right licensing to run it all. Here is how to scope each layer so the bill of materials lands once.
June 6, 2026 · 12 min read
GuidesCisco Catalyst 9200 vs 9300 vs 9500: How to Choose
The Catalyst 9000 family spans the wiring closet to the campus core. Here is how the 9200, 9300, and 9500 actually differ, and a decision framework that keeps your refresh from being over- or under-built.
May 8, 2026 · 13 min read
GuidesCisco 1941W EoL: Migrate to Catalyst 8200 C8200-1N-4T
The Cisco 1941W reached Last Day of Support on December 31, 2021, no patches, no TAC, no RMA. Here is what the EoL milestones mean and how to migrate cleanly to the Catalyst 8200 Edge Platform (C8200-1N-4T), including the licensing and wireless changes that catch teams off guard.
April 22, 2026 · 6 min read
GuidesHow Much Does a Cisco Catalyst 9500 Cost?
A Catalyst 9500 core switch starts from about $10,000, but licensing tier, subscription term, SmartNet, optics, and install decide what you actually pay. Here is how the real number is built.
February 17, 2026 · 9 min read