Cisco Commands Cheat Sheet
Every Cisco IOS command you need for CCNA — grouped the way you actually use them, with what each one really does. Bookmark it. Free, no signup. Prefer paper? Download the PDF cheat sheets.
The three modes (get this wrong and nothing works)
Almost every "command not recognised" error is really a mode error. You are in the wrong place.
| Prompt | Where you are |
|---|---|
Router> | User EXEC. Look, don't touch. Very few commands. |
Router# | Privileged EXEC. All show and debug commands. Get here with enable. |
Router(config)# | Global config. Where you change things. Get here with configure terminal. |
Router(config-if)# | Interface config. Settings for one interface. |
Router(config-line)# | Line config. Console and VTY (SSH/Telnet) lines. |
Router> enable ! user EXEC -> privileged
Router# configure terminal ! privileged -> global config
Router(config)# interface g0/1 ! global -> interface
Router(config-if)# exit ! back one level
Router(config)# end ! jump straight back to privileged (or Ctrl+Z)The habit that saves you: read the prompt before every command. It tells you exactly what will and won't work.
Basic setup — the first ten minutes on any new device
| Command | What it does |
|---|---|
hostname CORE-SW1 | Name the device. Do it first — it prevents you configuring the wrong box. |
enable secret Str0ngPass | Set the privileged-mode password (hashed). See why never enable password. |
service password-encryption | Obscure the other plaintext passwords. Weak, but stops shoulder-surfing. |
banner motd #Authorised access only# | Legal warning banner. Genuinely matters in a prosecution. |
no ip domain-lookup | Stops the router trying to DNS-resolve your typos and hanging for 30 seconds. Set this on day one. |
copy running-config startup-config | SAVE. Or write memory. Forget this and your work dies at the next reboot. |
Interfaces
| Command | What it does |
|---|---|
interface GigabitEthernet0/1 | Enter interface config. |
interface range g0/1 - 24 | Configure 24 ports at once. See interface range. |
ip address 192.168.1.1 255.255.255.0 | Set an IPv4 address + mask. |
description Uplink to CORE | Label it. Your future self will thank you. |
no shutdown | Turn the interface on. Router interfaces are down by default — this is the #1 forgotten command. See no shutdown. |
speed 100 / duplex full | Hardcode speed/duplex. Only if you hardcode both ends — see duplex mismatch. |
switchport mode access | Make it an access port (endpoint). |
switchport access vlan 10 | Put the port in VLAN 10. |
switchport mode trunk | Make it a trunk (switch-to-switch). |
switchport trunk native vlan 999 | Move the native VLAN off VLAN 1 — stops VLAN hopping. |
switchport nonegotiate | Disable DTP. Do this on every access port. |
VLANs and inter-VLAN routing
| Command | What it does |
|---|---|
vlan 10 | Create VLAN 10. |
name SALES | Name it. |
show vlan brief | The single most useful VLAN command — which port is in which VLAN. See show vlan brief. |
interface vlan 10 | Create an SVI (a Layer 3 interface for VLAN 10). |
ip routing | Enable routing on a Layer 3 switch. Without it, SVIs will not route between VLANs. |
interface g0/0.10 / encapsulation dot1Q 10 | Router-on-a-stick subinterface. See the lab. |
Full walkthrough: inter-VLAN routing explained.
Routing
| Command | What it does |
|---|---|
ip route 0.0.0.0 0.0.0.0 203.0.113.1 | Default route — 'send anything I don't know here'. The most-used route on earth. |
ip route 10.0.0.0 255.0.0.0 192.168.1.2 | A static route. |
router ospf 1 | Start OSPF, process ID 1 (locally significant). |
network 192.168.1.0 0.0.0.255 area 0 | Advertise a network in OSPF. Note the wildcard mask, not a subnet mask. |
router eigrp 100 | Start EIGRP. The 100 is the AS number — it must match on neighbours. |
passive-interface g0/1 | Advertise the network but send no hellos out of it. Use on every user-facing interface. |
show ip route | The routing table. The first command in any routing problem. See show ip route. |
show ip ospf neighbor | Are my OSPF neighbours actually up? See the guide. |
ACLs, NAT and security
| Command | What it does |
|---|---|
access-list 10 permit 192.168.1.0 0.0.0.255 | Standard ACL (filters by source only). |
ip access-list extended BLOCK_TELNET | Named extended ACL — source, destination, protocol, port. |
ip access-group BLOCK_TELNET in | Apply the ACL to an interface. An ACL does nothing until it is applied. |
show access-lists | See hit counts — proof your ACL is actually matching. See the guide. |
ip nat inside / ip nat outside | Mark which interface is which. Get this backwards and NAT silently fails. |
ip nat inside source list 1 interface g0/0 overload | PAT — many private IPs behind one public IP. See NAT vs PAT. |
switchport port-security maximum 2 | Limit MACs per port — stops MAC flooding. |
ip ssh version 2 / transport input ssh | Use SSH, never Telnet. See how to configure SSH. |
Troubleshooting — the commands you actually live in
If you memorise nothing else, memorise these. They solve most real faults.
| Command | What it does |
|---|---|
show ip interface brief | Start here. Always. Every interface, its IP, and up/down status on one screen. See the guide. |
show running-config | The live configuration. What the device is actually doing. |
show interfaces g0/1 | Errors, CRCs, collisions, duplex. Where physical-layer faults confess. |
show mac address-table | Which MAC is on which port. See the guide. |
show cdp neighbors | What is plugged into what — instant topology map. See the guide. |
show version | IOS version, uptime, model. See the guide. |
ping / traceroute | Reachability and where it dies. See ping and traceroute. |
show logging | The device's own account of what went wrong. |
debug ip ospf adj | Live adjacency events. Use undebug all to stop — debug can overwhelm a production router. |
The troubleshooting order that works: show ip interface brief (is it even up?) → show ip route (do I know the way?) → ping (can I get there?) → show interfaces (is the wire healthy?). Follow that and you will diagnose most faults before you touch a debug. Full method: network troubleshooting guide.
Typing these is easy. Knowing which one to reach for at 2 a.m. when the network is down is the job. That judgement only comes from breaking real hardware and fixing it. Our students do exactly that, on physical Cisco racks in Ahmedabad.
Frequently asked questions
What are the most important Cisco commands for CCNA?
show ip interface brief, show running-config, show ip route, show vlan brief, show cdp neighbors, ping and traceroute. These solve the majority of real faults and appear constantly in the exam.
What is the difference between enable password and enable secret?
enable secret stores the password as a one-way hash and always takes precedence. enable password stores it in plaintext and is obsolete. Always use enable secret.
Why is my Cisco interface down?
On a router, interfaces are administratively down by default — you must issue 'no shutdown'. This is the single most commonly forgotten command.
How do I save a Cisco configuration?
Run 'copy running-config startup-config' (or 'write memory') in privileged EXEC mode. Without it, your configuration is lost at the next reboot.
Do I need to memorise Cisco commands for the CCNA exam?
You need fluency, not rote memory. The exam has simulations where you configure a live device, so the commands must be automatic — which only comes from doing labs, not from reading a list.
Related articles
Not sure about your next career step?
Talk it through with a counsellor at Attila Technologies — training in Ahmedabad since 2004, with 284 named placement records published for verification. Free session, no obligation.