Cisco IOS from the console: the commands everything else assumes

Every later article in this series ends up at a command prompt, and the prompt has opinions: which mode you are in decides which commands exist, and typing a perfectly correct command in the wrong place produces a cryptic complaint about an invalid input. Half an hour spent on the shell itself makes everything afterwards feel like configuration rather than combat.

The map

Read this first when short on time. Every branch is a section below.

Getting a prompt in the first place

A brand new switch has no IP address, so the only way in is the console port: a physical serial connection that works regardless of configuration, and the one thing that still saves you when everything else is broken.

Older devices use a light blue rollover cable with an RJ45 plug at the device end and a DB9 serial connector at the other; anything recent has a USB console port instead. Either way the serial settings are the same, and they have not changed in decades: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. Terminal software — PuTTY on Windows, screen or minicom on Linux and macOS — connects to the resulting serial device.

Once a management address and SSH exist you use those, but the console keeps two exclusive powers: you can watch the device boot, and you can perform password recovery, which requires interrupting the boot sequence with a break signal.

What happens between power and prompt

1. POST — power-on self test, run from ROM, checking CPU, memory and interfaces.
2. Bootstrap — a small program in ROM whose only job is to find and load a real operating system.
3. Load IOS — normally the image file in flash memory. If flash is empty or corrupt, the device falls back to ROMMON, a minimal prompt where you can copy an image over.
4. Load the configuration — IOS looks in NVRAM for startup-config and applies it line by line. If there is none, it offers the initial setup dialog, which everyone declines in order to configure by hand.

Modes: the prompt tells you where you are

IOS separates commands into modes, so destructive operations are not one typo away from a read-only session. The end of the prompt always tells you which mode you are in.

flowchart TD
  U["User exec<br/>Switch&gt;<br/>ping, show version"] -->|enable| P["Privileged exec<br/>Switch#<br/>all show, reload, copy"]
  P -->|disable| U
  P -->|configure terminal| G["Global config<br/>Switch config<br/>hostname, ip route"]
  G -->|exit| P
  G -->|interface Gi0/1| I["Interface config<br/>Switch config-if"]
  G -->|line vty 0 15| L["Line config<br/>Switch config-line"]
  I -->|end| P
  L -->|end| P

Two rules cover almost every navigation question. exit goes up exactly one level. end — or Ctrl-Z — returns to privileged exec from any depth. And commands only exist in their own mode: ip address is meaningless in global config, because the device would not know which interface you meant.

Two configuration files, and the one that bites

Every IOS device holds two configurations, and understanding the difference prevents the most avoidable outage in networking.

Switch# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

Switch# write memory          ! the older shorthand, still works
Switch# show startup-config   ! what will load next boot
Switch# erase startup-config  ! factory reset, takes effect after reload

The asymmetry is worth internalising. There is no "apply" step: typing a command is the change. But there is a save step, and skipping it means the change quietly disappears at the next power cut.

Experienced engineers turn the danger into a tool. Before a risky change to a remote device — an ACL, a routing statement, anything that could cut your own session — schedule an automatic rollback:

Switch# reload in 10
Switch# ! ... make the change, verify it works ...
Switch# reload cancel

If the change locks you out, the device reboots in ten minutes into the last saved configuration and gives you your session back. If it works, you cancel the reload and save.

Undoing things

Nearly every configuration command is removed by typing no in front of it. no shutdown enables an interface, no ip address removes an address, no username bob deletes a user. The symmetry is close to universal, which makes reading a configuration much easier than it looks: everything you see was typed, and everything can be untyped.

The commands you will actually type

A short list covers most days. Here is a switch going from factory state to something usable.

Switch> enable
Switch# configure terminal
Switch(config)# hostname ACCESS-SW1
ACCESS-SW1(config)# no ip domain-lookup

ACCESS-SW1(config)# interface vlan 1
ACCESS-SW1(config-if)# ip address 10.10.10.5 255.255.255.0
ACCESS-SW1(config-if)# no shutdown
ACCESS-SW1(config-if)# exit
ACCESS-SW1(config)# ip default-gateway 10.10.10.1

ACCESS-SW1(config)# interface GigabitEthernet0/1
ACCESS-SW1(config-if)# description Uplink to DIST-SW1 Gi1/0/24
ACCESS-SW1(config-if)# no shutdown
ACCESS-SW1(config-if)# end
ACCESS-SW1# copy running-config startup-config

Two lines in there are worth explaining. no ip domain-lookup stops the device from treating a mistyped command as a hostname and trying to resolve it — without it, a typo hangs your session for thirty seconds while DNS times out, and it is the single most irritating default in IOS. And a switch gets its management address on a VLAN interface, not on a physical port, because switch ports are layer 2 and have no addresses of their own.

Show commands, in order of usefulness

Filtering output

A full configuration can run to thousands of lines, so IOS supports a pipe with four useful filters:

Switch# show running-config | section interface GigabitEthernet0/1
Switch# show running-config | include username
Switch# show ip route | exclude 0.0.0.0
Switch# show interfaces | begin GigabitEthernet0/5

section prints a whole configuration block and is the one people discover last and then use constantly.

Passwords, users and getting in remotely

A device with no passwords is a device anyone with a cable owns. The minimum useful configuration protects privileged mode, protects both kinds of login, and replaces Telnet with SSH.

! protect privileged exec — secret is hashed, password is not
ACCESS-SW1(config)# enable secret Str0ng-Enable-Pass

! local user accounts instead of a shared line password
ACCESS-SW1(config)# username sujith privilege 15 secret Str0ng-User-Pass

! console access asks for one of those accounts
ACCESS-SW1(config)# line console 0
ACCESS-SW1(config-line)# login local
ACCESS-SW1(config-line)# exec-timeout 10 0
ACCESS-SW1(config-line)# logging synchronous
ACCESS-SW1(config-line)# exit

! SSH needs a hostname, a domain name and a key
ACCESS-SW1(config)# ip domain-name example.local
ACCESS-SW1(config)# crypto key generate rsa modulus 2048
ACCESS-SW1(config)# ip ssh version 2
ACCESS-SW1(config)# line vty 0 15
ACCESS-SW1(config-line)# login local
ACCESS-SW1(config-line)# transport input ssh
ACCESS-SW1(config-line)# exec-timeout 10 0
ACCESS-SW1(config-line)# end

Details that matter in that block:

• enable secret rather than enable password. The old password form stores a trivially reversible encoding; secret stores a hash. If both exist, secret wins, which is a hint about which one Cisco wants you to use.
• transport input ssh. Without it, the vty lines accept Telnet, and Telnet carries the password in clear text across the network.
• The key needs a name. RSA key generation fails until both a hostname and a domain name are set, because the key is labelled with hostname.domain.
• logging synchronous. Without it, a log message arriving while you type scatters your half-finished command across the screen. With it, IOS reprints your line. It changes nothing functionally and improves every session.
• exec-timeout 10 0. Ten minutes and zero seconds of idle time before the session closes. The default on some lines is never, which leaves logged-in consoles sitting in wiring cupboards.

One more, worth adding to any device that still has plaintext passwords in its configuration for legacy reasons:

ACCESS-SW1(config)# service password-encryption

This obscures passwords in show running-config using Cisco's type 7 encoding. Be clear about what it does: type 7 is reversible in a fraction of a second by any of a dozen free tools. It stops shoulder-surfing, and nothing else. Real protection comes from secret, which is hashed.

Privilege levels

IOS has sixteen privilege levels, 0 to 15. Level 1 is user exec, level 15 is privileged exec, and the twelve in between are available for building restricted roles — a level 5 that can run show commands and clear counters but change nothing, for example. In practice most organisations skip this and use AAA with a RADIUS or TACACS+ server instead, because per-device privilege configuration does not scale past a handful of devices.

Working faster: help, shortcuts and habits

The CLI has a small set of features that separate a slow session from a quick one.

The question mark

? is context-sensitive help and it works everywhere, including in the middle of a word.

Switch# sh?                    ! all commands starting with sh
show  shell

Switch# show ip ?              ! what can follow "show ip"
access-lists  arp  bgp  dhcp  interface  nat  ospf  protocols  route  ...

Switch(config-if)# ip address ?
A.B.C.D  IP address
dhcp     IP Address negotiated via DHCP

Used properly, this replaces most documentation lookups: you can discover an entire command by typing one word at a time and asking what comes next.

Abbreviation and completion

Any command can be shortened to the point where it is unambiguous. sh ip int br is show ip interface brief, conf t is configure terminal, int gi0/1 is interface GigabitEthernet0/1. Tab completes a partially typed keyword. Ambiguity produces % Ambiguous command, which means add another letter.

Ctrl-Shift-6 is the one to memorise before you need it. It is the escape from a traceroute to an unreachable address, which otherwise takes several minutes to give up on its own.

Error messages, decoded

The third one is worth pausing on, because the caret is genuinely helpful: it points at the first character IOS could not parse. If it points at the very start of the line, you are in the wrong mode. If it points partway in, that argument is wrong.

Two output habits

terminal length 0 disables the --More-- pager for the current session, which is what you want when copying a full configuration out to a file. And show run | section beats scrolling, every time.

NVRAM

Non-volatile RAM, where startup-config lives. Small, and separate from flash, which holds the IOS image.

ROMMON

The ROM monitor: a minimal prompt the device falls back to when it cannot load an IOS image, and where password recovery is performed.

vty line

Virtual teletype: a remote login session. Devices have 5 or 16 of them, and configuring line vty 0 15 covers all.

Configuration register

A four-hex-digit value that controls boot behaviour. 0x2102 is normal; 0x2142 tells the device to ignore startup-config, which is how passwords are recovered.

Recap