IOS Command Reference

This appendix collects the Cisco IOS and IOS XE commands used throughout the book, organised by topic, as a quick reference for the final weeks of study. Each table lists the command, the mode where it is entered and a one-line purpose. Italic words are values you supply. Many configuration commands are negated with no in front of them, and any EXEC command can be run from configuration mode by prefixing it with do . The CCNA exam expects you to recognise these commands and predict their effect, so treat this appendix as a checklist: if a command looks unfamiliar, revisit the chapter that covers it.

Table A-1 Mode abbreviations used in this appendix

• Abbreviation Prompt How to get there
• user R1> Initial login
• priv R1# enable
• global R1(config)# configure terminal

if / subif R1(config-if)# , R1(config-subif)# interface g0/1 , interface g0/0.10 line R1(config-line)# line vty 0 15

router R1(config-router)# router ospf 1

dhcp / acl R1(dhcp-config)# , R1(config-ext-nacl)#ip dhcp pool , ip access-list extended

A.1 CLI Basics and Device Management

Table A-2 CLI Basics and Device Management

Command Mode Purpose

enable user Enter privileged EXEC mode.

disable priv Return to user EXEC mode.

configure terminal priv Enter global configuration mode.

• exit / end / Ctrl-Z any
• config
• Go back one level / return directly to privileged

Exec.

hostname R1 global Set the device name shown in the prompt.

enable secret password global Set the hashed privileged-mode password.

service password-encryption global Obscure plain-text passwords (type 7) in the configuration.

banner motd # text # global Display a message-of-the-day banner at login.

no ip domain-lookup global Stop the CLI treating mistyped commands as hostnames to resolve.

line console 0 global Configure the console port.

line vty 0 15 global Configure the virtual terminal (Telnet/SSH) lines.

password pw / login line Set a line password and require it at login.

logging synchronous line Reprint the command line after unsolicited log messages.

exec-timeout 10 0 line Log idle sessions out after 10 minutes 0 seconds.

copy running-config startup-config priv Save the active configuration to NVRAM (also write memory ).

copy running-config tftp: priv Back up the configuration to a TFTP server. erase startup-config priv Delete the saved configuration (factory reset on reload).

reload priv Restart the device.

show running-config priv Display the active configuration.

show running-config | section ospf priv Show only the matching section of the configuration.

show startup-config priv Display the saved configuration.

show version priv IOS version, uptime, memory, interfaces, config register.

show flash: / dir flash: priv List files in flash memory.

show clock / clock set 10:00:00 4

Oct 2026

priv Display or manually set the system clock.

terminal length 0 priv Disable output paging (--More--) for this session.

do command any

config

Run an EXEC command from configuration mode.

A.2 Interfaces

Table A-3 Interfaces

Command Mode Purpose

interface GigabitEthernet0/1 global Enter interface configuration mode.

interface range g0/1 - 4 global Configure several interfaces at once.

ip address 10.1.1.1 255.255.255.0 if Assign an IPv4 address and mask.

ip address dhcp if Obtain the interface address from a DHCP server.

shutdown / no shutdown if Administratively disable / enable the interface. description text if Label the interface.

speed {10|100|1000|auto} if Set or autonegotiate the interface speed.

duplex {half|full|auto} if Set or autonegotiate duplex.

bandwidth kbps if Set the bandwidth value used by routing metrics (not the real speed).

mtu bytes / ip mtu bytes if Set the Layer 2 or IP maximum transmission unit. interface loopback0 global Create a loopback (always-up virtual) interface. interface g0/0.10 / encapsulation

• dot1Q 10
• global
• / subif
• Create a router-on-a-stick subinterface for VLAN

show ip interface brief priv One-line status and IPv4 address of every interface.

show interfaces g0/1 priv Detailed status, counters, errors, speed and duplex.

show interfaces status priv Switch port status, VLAN, duplex and speed summary.

show interfaces description priv Interface status with descriptions.

show ip interface g0/1 priv IPv4 settings, ACLs applied, helper addresses.

A.3 Switching, VLANs and Trunks

Table A-4 Switching, VLANs and Trunks

Command Mode Purpose

vlan 10 / name SALES global Create a VLAN and name it.

switchport mode access if Make the port a static access port.

switchport access vlan 10 if Assign the access port to VLAN 10.

switchport voice vlan 20 if Assign a voice VLAN for an IP phone.

switchport mode trunk if Make the port a static 802.1Q trunk.

switchport mode dynamic

{auto|desirable}

if Negotiate trunking with DTP.

switchport nonegotiate if Disable DTP frames on the port.

switchport trunk encapsulation

dot1q

if Select 802.1Q on switches that also support ISL.

• switchport trunk allowed vlan
• 10,20
• if Limit the VLANs carried on a trunk ( add , remove ,

except also valid).

switchport trunk native vlan 99 if Change the trunk's untagged native VLAN. interface vlan 10 global Create a switch virtual interface (SVI) for VLAN

ip routing global Enable IPv4 routing on a multilayer switch.

no switchport if Turn a multilayer switch port into a routed port.

ip default-gateway 10.1.1.1 global Default gateway for a Layer 2 switch's management traffic.

mac address-table static mac vlan

10 interface g0/1

global Add a static MAC address table entry.

show vlan brief priv VLANs and their access ports.

show interfaces trunk priv Trunk ports, native VLAN, allowed and active VLANs.

show interfaces g0/1 switchport priv Administrative and operational mode, access/voice/native VLANs.

show mac address-table [dynamic |

address mac | interface g0/1]

priv Display learned MAC addresses.

clear mac address-table dynamic priv Flush dynamic MAC entries.

A.4 Spanning Tree Protocol

Table A-5 Spanning Tree Protocol

Command Mode Purpose

spanning-tree mode {pvst | rapid-pvst}global Select PVST+ or Rapid PVST+.

spanning-tree vlan 10 root primary global Set a low priority (24576 or lower) to become root for VLAN 10.

spanning-tree vlan 10 root

secondary

global Set priority 28672 to become backup root.

• spanning-tree vlan 10 priority
• 4096
• global Set the bridge priority manually (multiple of

4096).

spanning-tree vlan 10 cost 4 /

port-priority 64

if Influence root and designated port selection.

spanning-tree portfast if Skip listening/learning on an edge (host) port.

spanning-tree portfast default global Enable PortFast on all access ports. spanning-tree bpduguard enable if Err-disable the port if a BPDU is received. spanning-tree portfast bpduguard

default

global Enable BPDU Guard on all PortFast ports.

spanning-tree guard root if Prevent the port from becoming a root port (Root Guard).

spanning-tree link-type point-to-pointif Treat the link as point-to-point for RSTP fast transition.

• errdisable recovery cause
• bpduguard
• global Automatically re-enable ports err-disabled by

BPDU Guard.

show spanning-tree [vlan 10] priv Root bridge, local bridge ID, port roles, states and costs.

show spanning-tree summary priv STP mode and global features enabled.

• show spanning-tree interface g0/1
• detail
• priv Per-port STP detail including BPDUs

sent/received.

A.5 EtherChannel

Table A-6 EtherChannel

Command Mode Purpose

channel-group 1 mode active if LACP, actively negotiate.

channel-group 1 mode passive if LACP, respond only.

channel-group 1 mode desirable /

auto

if PAgP, actively negotiate / respond only.

channel-group 1 mode on if Static EtherChannel, no negotiation protocol.

interface port-channel 1 global Configure the logical bundle interface (trunk settings, etc.).

port-channel load-balance src-dst-ipglobal Select the hashing method for spreading frames. show etherchannel summary priv Bundles, protocol and member flags (P = bundled, s = suspended).

show etherchannel port-channel priv Detail of each port channel.

show etherchannel load-balance priv Current load-balancing method.

A.6 CDP and LLDP

Table A-7 CDP and LLDP

Command Mode Purpose

cdp run / no cdp run global Enable or disable CDP globally.

cdp enable / no cdp enable if Enable or disable CDP on an interface.

lldp run global Enable LLDP globally (off by default on most IOS).

lldp transmit / lldp receive if Control LLDP per interface direction.

show cdp neighbors [detail] priv Neighbor device ID, local and remote port, platform (detail adds IP and IOS).

show cdp entry name priv Detail of one CDP neighbor.

show lldp neighbors [detail] priv LLDP neighbor information.

A.7 IP Routing and Static Routes

Table A-8 IP Routing and Static Routes

• Command Mode Purpose
• ip route 10.2.0.0 255.255.0.0
• 10.1.1.2

global Static route via a next-hop address.

ip route 10.2.0.0 255.255.0.0 g0/1 global Directly attached static route via an exit interface. ip route 10.2.0.0 255.255.0.0 g0/1

10.1.1.2

global Fully specified static route.

ip route 0.0.0.0 0.0.0.0

203.0.113.1

global IPv4 default static route.

ip route 10.2.0.0 255.255.0.0

10.1.3.2 130

global Floating static route (AD 130) as a backup.

ip route 10.2.2.2 255.255.255.255

10.1.1.2

global Host route.

show ip route priv The IPv4 routing table with codes, AD/metric and next hops.

show ip route 10.2.2.2 priv Which route matches a destination (longest match).

show ip route static | connected |

ospf

priv Filter the routing table by source.

A.8 OSPFv2

Table A-9 OSPFv2

Command Mode Purpose

router ospf 1 global Start OSPF process 1 (locally significant ID).

router-id 1.1.1.1 router Set the OSPF router ID manually.

network 10.1.12.0 0.0.0.3 area 0 router Enable OSPF on interfaces matching the address and wildcard.

ip ospf 1 area 0 if Enable OSPF directly on the interface.

passive-interface g0/3 / passive-interface defaultrouter Stop hellos on an interface (or all) while still advertising it.

default-information originate

[always]

router Advertise a default route into OSPF.

• auto-cost reference-bandwidth
• 100000
• router Set the cost reference bandwidth in Mbps (same

on all routers).

maximum-paths 4 router Number of equal-cost paths installed.

ip ospf cost 10 if Set the interface cost directly.

ip ospf priority 100 if Set DR/BDR election priority (0 = never DR).

ip ospf network point-to-point if Use the point-to-point network type (no DR election).

ip ospf hello-interval 5 / dead-interval 20if Change OSPF timers (must match neighbors). ip ospf mtu-ignore if Skip MTU check in DBD packets.

clear ip ospf process priv Restart OSPF (needed for a new router ID).

show ip ospf neighbor priv Neighbor RID, priority, state/role, dead time, interface.

show ip ospf interface [brief] priv Area, cost, network type, state, DR/BDR, timers. show ip protocols priv RID, networks, passive interfaces, sources, AD.

show ip ospf database priv LSDB summary by LSA type.

show ip ospf priv Process details, RID, reference bandwidth, SPF runs.

debug ip ospf adj / hello priv Troubleshoot adjacency formation.

A.9 First Hop Redundancy (HSRP, VRRP, GLBP)

Table A-10 First Hop Redundancy (HSRP, VRRP, GLBP)

Command Mode Purpose

standby version 2 if Use HSRP version 2.

standby 10 ip 10.1.10.1 if Define HSRP group 10 and its virtual IP.

standby 10 priority 110 if Set priority (default 100; highest becomes active). standby 10 preempt if Allow a higher-priority router to take over as active.

standby 10 timers 1 3 if Set hello and hold times (seconds; msec also allowed).

standby 10 track g0/1 20 if Lower priority by 20 if the tracked interface fails. vrrp 10 ip 10.1.10.1 (or vrrp 10

address-family ipv4)

if Configure a VRRP group.

glbp 10 ip 10.1.10.1 if Configure a GLBP group.

show standby [brief] priv HSRP state, virtual IP and MAC, active/standby, timers.

show vrrp [brief] / show glbp

[brief]

priv VRRP or GLBP status.

A.10 NAT

Table A-11 NAT

Command Mode Purpose

ip nat inside / ip nat outside if Mark inside and outside NAT interfaces.

ip nat inside source static

192.168.10.100 203.0.113.3

global Static one-to-one NAT.

ip nat inside source static tcp

192.168.10.100 80 203.0.113.2 80

global Static PAT (port forwarding).

• ip nat pool PUBLIC 203.0.113.4
• 203.0.113.6 netmask
• 255.255.255.248

global Define a pool of inside global addresses.

ip nat inside source list 1 pool

Public

global Dynamic NAT for hosts matching ACL 1.

ip nat inside source list 1 pool

PUBLIC overload

global PAT using a pool.

ip nat inside source list 1

interface g0/1 overload

global PAT using the outside interface address.

ip nat translation timeout seconds global Change the dynamic translation timeout. show ip nat translations [verbose] priv Inside global/local and outside local/global table. show ip nat statistics priv Inside/outside interfaces, hits, misses, pool usage. clear ip nat translation * priv Remove all dynamic translations.

debug ip nat priv Show each translation as it happens.

A.11 DHCP, DNS and NTP

Table A-12 DHCP, DNS and NTP

• Command Mode Purpose
• ip dhcp excluded-address 10.1.10.1
• 10.1.10.10
• global Reserve addresses the DHCP server must not

lease.

ip dhcp pool LAN10 global Create a DHCP pool and enter DHCP config mode.

network 10.1.10.0 255.255.255.0 dhcp Subnet to lease from.

default-router 10.1.10.1 / dns-server 8.8.8.8dhcp Default gateway and DNS server options. domain-name example.com / lease 7 dhcp Domain name option and lease length in days. ip helper-address 10.9.9.9 if Relay DHCP broadcasts to a server on another subnet.

ip address dhcp if Act as a DHCP client on the interface.

show ip dhcp binding / pool /

conflict

priv Leases, pool usage and detected conflicts.

ip domain-lookup / ip name-server

8.8.8.8

global Enable DNS resolution and set the DNS server.

ip host SRV1 10.9.9.10 global Static hostname-to-address mapping.

ntp server 10.9.9.123 [prefer] global Synchronise the clock to an NTP server. ntp master 3 global Make the router an NTP server at stratum 3.

clock timezone EST -5 global Set the time zone offset.

show ntp status / show ntp

associations

priv Synchronisation state, stratum and peers.

A.12 SNMP, Syslog and File Transfer

Table A-13 SNMP, Syslog and File Transfer

Command Mode Purpose

snmp-server community string ro global SNMPv2c read-only community.

snmp-server group G1 v3 priv global SNMPv3 group with authentication and encryption.

snmp-server user U1 G1 v3 auth sha

pw priv aes 128 pw

global SNMPv3 user.

snmp-server host 10.9.9.50 version

2c string

global Send SNMP traps/informs to a manager.

snmp-server location / contact global Descriptive system information.

logging host 10.9.9.51 global Send syslog messages to a server.

logging trap warnings global Severity level sent to the syslog server (4 and lower numbers).

logging console / buffered /

monitor level

global Control console, buffer and VTY logging.

terminal monitor priv Show log messages in the current SSH/Telnet session.

service timestamps log datetime

msec

global Add timestamps to log messages.

show logging priv Logging settings and the local log buffer.

copy tftp: flash: / copy ftp:

flash:

priv Transfer an image or file to flash.

ip ftp username / ip ftp password global Credentials used by the router as an FTP client. boot system flash:image.bin global Select the IOS image to load at boot.

A.13 SSH and Device Security

Table A-14 SSH and Device Security

Command Mode Purpose

ip domain-name example.com global Domain name needed to generate RSA keys. crypto key generate rsa modulus

2048

global Create RSA keys (enables SSH).

ip ssh version 2 global Allow only SSHv2.

username admin secret pw global Create a local user with a hashed password. line vty 0 15 / login local line Authenticate VTY users against the local database.

transport input ssh line Permit only SSH on the VTY lines.

access-class 10 in line Restrict which source addresses may connect to the VTY lines.

security passwords min-length 10 global Enforce a minimum password length. login block-for 120 attempts 5

within 60

global Block logins after repeated failures.

aaa new-model global Enable AAA.

aaa authentication login default

group tacacs+ local

global Use TACACS+ for logins with local fallback.

show ip ssh / show ssh priv SSH version and active sessions.

A.14 Access Control Lists

Table A-15 Access Control Lists

• Command Mode Purpose
• access-list 10 permit 10.1.1.0
• 0.0.0.255

global Numbered standard ACL entry (1-99, 1300-1999).

• access-list 100 permit tcp
• 10.1.1.0 0.0.0.255 host 10.9.9.10
• eq 443
• global Numbered extended ACL entry (100-199, 2000-

2699).

ip access-list standard MGMT global Create or edit a named standard ACL.

ip access-list extended WEB global Create or edit a named extended ACL.

20 deny ip any host 10.9.9.9 acl Add a numbered sequence entry in a named ACL. no 20 acl Remove one entry by sequence number.

ip access-list resequence WEB 10

global Renumber entries.

ip access-group WEB in if Apply an ACL inbound (or out ) on an interface.

remark text acl Document an ACL entry.

show access-lists [name] priv ACL entries with match counters.

show ip interface g0/1 | include

access list

priv Which ACLs are applied to the interface.

A.15 Port Security, DHCP Snooping and DAI

Table A-16 Port Security, DHCP Snooping and DAI

Command Mode Purpose

switchport port-security if Enable port security (access or trunk port required).

switchport port-security maximum 2 if Maximum secure MAC addresses (default 1). switchport port-security mac-address stickyif Learn and save secure MACs to the running configuration.

switchport port-security violation

{shutdown|restrict|protect}

if Action on violation (default shutdown).

errdisable recovery cause psecure-violationglobal Automatically recover err-disabled ports. show port-security [interface

g0/1]

priv Secure ports, counts, violation mode and

counters.

show port-security address priv Secure MAC addresses.

ip dhcp snooping / ip dhcp

snooping vlan 10

global Enable DHCP snooping globally and per VLAN.

ip dhcp snooping trust if Trust the port toward the legitimate DHCP server. ip dhcp snooping limit rate 10 if Limit DHCP packets per second on an untrusted port.

no ip dhcp snooping information

option

global Stop inserting option 82 (common fix in labs).

show ip dhcp snooping [binding] priv Snooping settings and the binding table. ip arp inspection vlan 10 global Enable Dynamic ARP Inspection for VLAN 10. ip arp inspection trust if Trust ARP on uplinks.

ip arp inspection validate src-mac

dst-mac ip

global Additional ARP validity checks.

show ip arp inspection

[interfaces]

priv DAI status and statistics.

A.16 IPv6

Table A-17 IPv6

Command Mode Purpose

ipv6 unicast-routing global Enable IPv6 routing.

ipv6 address 2001:db8:1::1/64 if Static global unicast address.

ipv6 address 2001:db8:1::/64 eui-64if Address using an EUI-64 interface ID. ipv6 address fe80::1 link-local if Static link-local address.

ipv6 address autoconfig / ipv6

address dhcp

if Obtain an address by SLAAC / DHCPv6.

ipv6 enable if Enable IPv6 with only a link-local address.

ipv6 route 2001:db8:2::/64

2001:db8:12::2

global IPv6 static route via next hop.

ipv6 route ::/0 g0/1 fe80::2 global IPv6 default route with link-local next hop (interface required).

• ipv6 router ospf 1 / ipv6 ospf 1
• area 0
• global
• / if

OSPFv3 process and interface enablement.

show ipv6 interface brief priv IPv6 addresses and status per interface.

show ipv6 route priv IPv6 routing table.

show ipv6 neighbors priv IPv6 neighbor cache (NDP, equivalent of ARP).

A.17 Wireless-Related Switch Configuration

Lightweight APs and WLCs rely on correct switch port settings.

Table A-18 Wireless-Related Switch Configuration

• Command Mode Purpose
• switchport mode access /
• switchport access vlan 30
• if Access port for a lightweight AP in local mode

(CAPWAP tunnels all traffic).

switchport mode trunk if Trunk for a FlexConnect AP that switches WLAN traffic locally to several VLANs.

• switchport trunk allowed vlan
• 30,40,50
• if Carry management and WLAN VLANs to a WLC

or FlexConnect AP.

channel-group 1 mode on if Static EtherChannel to a WLC distribution system (LAG; WLCs do not negotiate LACP/PAgP).

spanning-tree portfast if Fast port up for AP ports (on trunks use spanning-tree portfast trunk ).

• power inline auto / show power
• inline
• if /
• priv

PoE for APs and PoE budget per port.

• ip dhcp pool AP / option 43 hex
• value
• global
• / dhcp

Help APs discover the WLC through DHCP.

A.18 Troubleshooting Tools

Table A-19 Troubleshooting Tools

• Command Mode Purpose
• ping 10.9.9.9 [source lo0 | repeat
• 100 | size 1500 df-bit]
• priv Test reachability; extended options set source,

count and size.

traceroute 10.9.9.9 priv Show each Layer 3 hop to a destination.

telnet / ssh -l admin 10.1.1.1 priv Connect to a remote device (also tests TCP reachability).

show ip arp / show arp priv IPv4 ARP cache.

show tech-support priv Comprehensive diagnostic output for support cases.

show debugging priv Debugs currently enabled.

undebug all / no debug all priv Turn off all debugging.

monitor session 1 source interface

g0/1 / destination interface g0/2

global SPAN: copy traffic to a port for packet capture.