Cisco IOS Configuration Commands Cheat Sheet for Network Engineers

By Stackvora Team · 2026-09-07 · 8 min read

Bookmark this. These are the Cisco IOS commands that cover 90% of day-to-day switch and router work.

Modes and basics

enable                      # privileged EXEC
configure terminal          # global config
hostname SW1                # set hostname
do show run                 # run show commands from config mode
copy running-config startup-config   # save

Interfaces

interface GigabitEthernet0/1
 description UPLINK-TO-CORE
 switchport mode access
 switchport access vlan 20
 no shutdown

interface GigabitEthernet0/24
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

VLANs

vlan 20
 name USERS
show vlan brief
show interfaces trunk

Routing

ip routing
ip route 0.0.0.0 0.0.0.0 10.0.0.1
router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
show ip route
show ip ospf neighbor

NAT

interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

ACLs

ip access-list extended BLOCK-TELNET
 deny tcp any any eq 23
 permit ip any any
interface GigabitEthernet0/1
 ip access-group BLOCK-TELNET in

The troubleshooting five

Need a config generated for your exact model and IOS version? Ask Stackvora AI — it writes Cisco configs from plain English.

Securing management access

Before anything else, lock down how you reach the device. These commands replace telnet with SSH and enforce local authentication:

enable
configure terminal
hostname SW1
ip domain-name example.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret StrongPasswordHere
line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0
exit
line con 0
 login local
 exec-timeout 5 0
exit
enable secret StrongEnablePassword
service password-encryption
end
write memory

Never leave transport input all on the VTY lines — it silently re-enables telnet. Verify with show ip ssh and show line.

Saving and backing up configurations

copy running-config startup-config
show archive config differences
archive
 path flash:config-backup
 write-memory
end

The archive feature snapshots the config every time you save, giving you a local rollback history without an external server. For fleet-wide backups, schedule a TFTP or SCP copy: copy running-config scp://user@backup-server/configs/sw1.cfg.

Common mistakes to avoid

• Forgetting switchport trunk encapsulation dot1q on older switches before setting trunk mode — the command order matters.
• Applying an ACL without a final permit — IOS ACLs end in an implicit deny all, so a missing permit ip any any can take down a subnet.
• Changing the enable password remotely without a second session open — always keep one logged-in session until the new credentials are verified.
• Using no shutdown on the wrong interface — confirm with show ip interface brief first.

Paste any command output into Stackvora AI for an instant explanation, or browse the knowledge base for platform-specific IOS, IOS-XE and NX-OS differences.

Troubleshooting commands you'll use daily

show ip interface brief        # interface state at a glance
show interfaces gi1/0/1        # errors, duplex, utilization
show mac address-table         # where is this host?
show cdp neighbors detail      # what's connected where
show ip route                  # how does traffic leave?
show logging                   # what did the switch just say?
ping / traceroute              # end-to-end reachability
debug ip icmp                  # watch packets live (use carefully)

Memorize the first four — they answer roughly 80% of "is it the network?" questions. show cdp neighbors detail is especially underrated: it reveals the remote device, its IP, and the exact port, which turns cable-tracing guesswork into a thirty-second check.

Key takeaways

• SSH-only management and local users are the baseline — apply them on day one.
• Archive your configs automatically; rollback history has saved more outages than any redundancy feature.
• ACLs end in implicit deny: write the permit you need or expect silence.
• Keep one verified session open whenever you change remote access settings.

Print this cheat sheet, tape it inside the wiring closet, and use Stackvora AI when a command behaves differently on your IOS version — syntax varies between classic IOS, IOS-XE, and NX-OS, and the knowledge base tracks those differences per platform.

One last tip: build a personal command library. Every time you look up a command twice, save it — with a one-line note on when you used it — into your own reference. Within a few months you'll have a cheat sheet tailored to your exact environment, which no generic list (this one included) can match. Combine it with the platform-specific guides in the Stackvora knowledge base and you'll rarely need to search mid-incident again.