Stackvora.tech

Cisco IOS Configuration Cheatsheet (2026 Edition)

Cisco IOS remains the foundational operating system for a vast majority of enterprise network devices. This comprehensive cheatsheet provides essential…

Cisco IOS remains the foundational operating system for a vast majority of enterprise network devices. This comprehensive cheatsheet provides essential configuration commands and best practices for common networking tasks on IOS devices, focusing on versions prevalent in 2026. Each section offers practical examples and references to official Cisco documentation for deeper dives.

Interface Configuration & Management

Proper interface configuration is the first step in bringing any network device online. This covers physical and logical settings.

Physical Interface Setup

For a typical access port connecting an end-device or a trunk port connecting to another switch/router:

enable
configure terminal
interface GigabitEthernet0/1
  description Uplink to Core_R1
  ip address 10.10.10.1 255.255.255.0  ! For Layer 3 interfaces (e.g., on a router or SVI)
  no shutdown                       ! Activates the interface
  speed 1000                        ! Sets speed, use "auto" for autonegotiation (default)
  duplex full                       ! Sets duplex, use "auto" for autonegotiation (default)
  media-type rj45                   ! Specifies physical media (e.g., on some modular platforms)
  协商 auto                          ! For fiber interfaces, e.g., on Catalyst 9300
  exit
  • speed and duplex: On modern hardware, auto is generally preferred for autonegotiation. Manual settings should only be used to resolve specific compatibility issues.
  • description: Crucial for documentation and troubleshooting. Always use descriptive names.
  • Reference: Cisco IOS XE Interface and Hardware Components Configuration Guide

VLAN Configuration

VLANs segment broadcast domains and improve network security and performance. This section covers VLAN creation, assignment, and trunking.

vlan 20
  name USERS_VLAN
vlan 30
  name SERVERS_VLAN
exit

interface GigabitEthernet0/2
  description User Access Port
  switchport mode access      ! Configures as an access port
  switchport access vlan 20   ! Assigns to VLAN 20
  spanning-tree portfast      ! Speeds up port transition to forwarding state for access ports
  exit

interface GigabitEthernet0/3
  description Server Access Port
  switchport mode access
  switchport access vlan 30
  spanning-tree portfast
  exit

interface GigabitEthernet0/4
  description Trunk to Distribution Switch
  switchport mode trunk          ! Configures as a trunk port
  switchport trunk encapsulation dot1q  ! Mandatory for some older platforms, default on newer ones
  switchport trunk allowed vlan 10,20,30,100  ! Limits allowed VLANs (best practice)
  switchport trunk native vlan 99  ! Sets native VLAN (often for management or unused VLAN)
  exit

Routing Protocols (OSPFv2 & OSPFv3)

Open Shortest Path First (OSPF) is a widely used link-state routing protocol for large enterprise networks. We cover both IPv4 and IPv6 implementations.

OSPFv2 (IPv4)

Configuring OSPF for IPv4 on a router:

router ospf 1
  router-id 192.168.1.1       ! Unique identifier for this OSPF process
  network 10.10.10.0 0.0.0.255 area 0  ! Advertises the 10.10.10.0/24 network in area 0
  network 192.168.1.0 0.0.0.3 area 0   ! Example for a point-to-point link
  passive-interface GigabitEthernet0/1  ! Prevents OSPF hellos on this interface (e.g., LAN segment)
  log-adjacency-changes detail  ! Logs state changes in detail
  auto-cost reference-bandwidth 10000 ! Sets reference for cost calculation (e.g., 10Gbps)
  exit
  • router-id: Manually setting this is a best practice for predictability. Otherwise, OSPF selects the highest IP address of a loopback interface, then the highest IP of a physical interface.
  • network area: The wildcard mask (e.g., 0.0.0.255) defines the range of IP addresses to be included.
  • passive-interface: Use this on interfaces connecting to end-hosts to save router resources and improve security.
  • auto-cost reference-bandwidth: Adjust this based on your fastest links (e.g., 1000 for 1Gbps, 10000 for 10Gbps) to ensure correct cost calculation. The default is 100 Mbps.
  • Reference: Cisco IOS IP Routing: OSPF Configuration Guide, Cisco IOS Release 15M&T

OSPFv3 (IPv6)

For environments leveraging IPv6, OSPFv3 is the protocol of choice. It runs directly over IPv6, independent of IPv4.

ipv6 unicast-routing              ! Enables IPv6 routing globally
interface GigabitEthernet0/0
  ipv6 address 2001:db8:cisco:1::1/64
  ipv6 ospf 1 area 0              ! Activates OSPFv3 process 1 on this interface in area 0
  ipv6 ospf network point-to-point  ! Or broadcast, depending on link type
  exit

router ospf 1
  router-id 192.168.1.1           ! OSPFv3 still uses an IPv4-formatted router-id
  exit

Network Address Translation (NAT)

NAT is essential for connecting private networks to the public internet using a limited set of public IP addresses. This covers both static and dynamic NAT.

Dynamic NAT (PAT - Port Address Translation)

Allows many private IPs to share one or more public IPs using port numbers.

ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 interface GigabitEthernet0/0 8080 extendable ! Optional: Static NAT with PAT

interface GigabitEthernet0/0
  ip address 203.0.113.2 255.255.255.252
  ip nat outside                     ! Interface connected to the internet
  exit

interface GigabitEthernet0/1
  ip address 10.0.0.1 255.255.255.0
  ip nat inside                      ! Interface connected to the internal network
  exit

access-list 1 permit 10.0.0.0 0.0.0.255 ! Defines which internal IPs are allowed to be NATed
  • ip nat inside source list [ACL_NUMBER] interface [OUTSIDE_INTERFACE] overload: This is the most common form of NAT (PAT), using the outside interface's IP and port numbers.
  • ip nat inside and ip nat outside: Clearly mark the network boundary.
  • access-list: Used to define the pool of internal IP addresses that should be translated.
  • Reference: Cisco IOS XE IP Addressing Services Command Reference - NAT Overview

Static NAT

Maps a private IP address to a specific public IP address, often used for internal servers accessible from the internet.

ip nat inside source static 192.168.1.100 203.0.113.10
ip nat inside source static tcp 192.168.1.200 443 203.0.113.11 443 extendable ! Port forwarding

interface GigabitEthernet0/0
  ip nat outside
  exit

interface GigabitEthernet0/1
  ip nat inside
  exit
  • ip nat inside source static [PRIVATE_IP] [PUBLIC_IP]: One-to-one mapping.
  • extendable: Allows for additional configuration to be added later without removing and re-adding the main static NAT entry.

Security: Access Control Lists (ACLs)

ACLs are fundamental for network security, filtering traffic based on various criteria.

Standard ACLs (Numbered 1-99, 1300-1999)

Filter based only on source IP address. Place them as close to the destination as possible.

access-list 10 permit 192.168.1.0 0.0.0.255 ! Permits traffic from 192.168.1.0/24
access-list 10 deny any ! Implicit deny any at the end of every ACL, but good practice to explicitly state

interface GigabitEthernet0/0
  ip access-group 10 in ! Applies ACL 10 to inbound traffic on Gi0/0
  exit

Extended ACLs (Numbered 100-199, 2000-2699)

Filter based on source/destination IP, protocol, source/destination port numbers. Place them as close to the source as possible.

access-list 101 permit tcp 10.0.0.0 0.0.0.255 host 172.16.1.1 eq www
access-list 101 permit tcp 10.0.0.0 0.0.0.255 host 172.16.1.1 eq 443
access-list 101 deny ip any any log ! Deny all other IP traffic and log hits

interface GigabitEthernet0/1
  ip access-group 101 out ! Applies ACL 101 to outbound traffic on Gi0/1
  exit
  • Named ACLs (ip access-list extended WEB_ACCESS) are generally preferred for readability and easier editing.
  • ACLs are processed top-down. Once a match is found, processing stops.
  • Implicit deny any at the end of every ACL. Explicitly adding it with log is useful for troubleshooting.
  • Reference: Cisco IOS XE Security Configuration Guide - IP Access List Features

Device Management & Security Hardening

Securing and managing your Cisco devices effectively is paramount.

Console, VTY (Telnet/SSH) & AAA

line console 0
  logging synchronous ! Prevents console messages from interrupting command entry
  exec-timeout 10 0     ! Sets idle timeout to 10 minutes
  password cisco        ! Simple password (not recommended for production)
  login local           ! Uses local username database for authentication
  exit

line vty 0 4            ! Virtual Terminal lines for Telnet/SSH
  transport input ssh   ! Allows only SSH, deny telnet
  exec-timeout 10 0
  login local
  exit

username admin privilege 15 secret <your_strong_hashed_password> ! Local user for login local
enable secret <your_strong_hashed_password> ! Encrypted enable password

crypto key generate rsa modulus 2048 ! Generates RSA keys for SSH
ip domain-name stackvora.tech ! Required for SSH
ip ssh version 2 ! Use SSHv2 for security
  • Always use login local or RADIUS/TACACS+ for authentication, not simple password on line vty.
  • transport input ssh: Disables Telnet, which sends credentials in plain text.
  • crypto key generate rsa modulus 2048: Minimum recommended key size for strong encryption.
  • Reference: Cisco IOS XE Security Configuration Guide - AAA

Logging & NTP

logging host 192.168.10.100 transport udp port 514 ! Sends logs to syslog server
logging trap informational ! Sends informational level and higher logs
logging source-interface Loopback0 ! Specifies source IP for syslog messages
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone

ntp server 172.16.1.254 prefer ! Configures NTP server, 'prefer' marks it as preferred
ntp server 172.16.1.253
ntp source Loopback0 ! Uses Loopback0 IP as source for NTP packets
clock timezone EST -5 0 ! Sets timezone, e.g., Eastern Standard Time
  • Centralized logging via syslog is critical for monitoring and troubleshooting.
  • NTP ensures accurate timestamps across all devices, vital for log correlation.

Common Pitfalls

  • ACL Placement: Standard ACLs near destination, Extended ACLs near source. Incorrect placement can lead to unintended traffic blocking or inefficient processing.
  • VLAN Mismatch: Native VLAN mismatches on trunk links can create security vulnerabilities and cause traffic to be untagged incorrectly. Always ensure consistency.
  • OSPF Wildcard Masks: OSPF network commands use inverse masks, not subnet masks. A /24 subnet (255.255.255.0) corresponds to a wildcard mask of 0.0.0.255.
  • NAT Order of Operations: Cisco NAT processes inside-to-outside (DNAT, then PAT/SNAT) and outside-to-inside (SNAT, then DNAT). Complex NAT rules require careful planning.
  • Implicit Deny: Remember that every ACL has an implicit deny any at the end. If you don't explicitly permit something, it will be blocked.
  • Saving Configuration: Always save your running configuration to startup configuration (write memory or copy running-config startup-config) after making changes to prevent loss upon reboot.

Back to the knowledge base · Ask the AI assistant