updated summary page and added cli examples
This commit is contained in:
Hugh Ratsch
@@ -0,0 +1,670 @@
|
||||
# Cisco IOS Command Reference Sheet
|
||||
|
||||
## Basic Device Access
|
||||
```cisco
|
||||
# Access Modes
|
||||
enable # Privileged EXEC Mode (User → Privileged)
|
||||
configure terminal # Global Configuration Mode (Privileged → Global)
|
||||
end # Return to Privileged EXEC Mode
|
||||
exit # Exit one level back
|
||||
|
||||
# Basic Show Commands
|
||||
show running-config # Current configuration
|
||||
show startup-config # Saved configuration
|
||||
show version # IOS version and hardware info
|
||||
show flash: # Contents of flash memory
|
||||
show history # Previously used commands
|
||||
|
||||
# Configuration Management
|
||||
write memory # Save configuration
|
||||
copy running-config startup-config # Save configuration (alternative)
|
||||
erase startup-config # Erase saved configuration
|
||||
reload # Restart device
|
||||
```
|
||||
|
||||
## Device Configuration
|
||||
```cisco
|
||||
# System Settings
|
||||
hostname DEVICE_NAME
|
||||
service password-encryption # Encrypt plaintext passwords
|
||||
no ip domain-lookup # Disable DNS lookup
|
||||
banner motd #MESSAGE# # Set login banner
|
||||
|
||||
# Password Configuration
|
||||
enable secret PASSWORD # Encrypted privileged mode password
|
||||
enable password PASSWORD # Plaintext privileged mode password
|
||||
|
||||
# Console Settings
|
||||
line console 0
|
||||
password PASSWORD
|
||||
login
|
||||
logging synchronous # Prevent command interruption by logs
|
||||
|
||||
# SSH Configuration
|
||||
ip domain-name DOMAIN
|
||||
crypto key generate rsa modulus 2048
|
||||
username ADMIN privilege 15 secret PASSWORD
|
||||
line vty 0 15
|
||||
transport input ssh
|
||||
login local
|
||||
```
|
||||
|
||||
## Interface Configuration
|
||||
```cisco
|
||||
# Basic Interface Commands
|
||||
interface GigabitEthernet0/0
|
||||
description LINK_DESCRIPTION
|
||||
ip address 192.168.1.1 255.255.255.0
|
||||
no shutdown
|
||||
duplex {auto|full|half}
|
||||
speed {auto|10|100|1000}
|
||||
mtu 1500
|
||||
|
||||
# Interface Status Commands
|
||||
show ip interface brief # Quick interface status
|
||||
show interfaces # Detailed interface statistics
|
||||
show interfaces description # Interface descriptions
|
||||
show interfaces status # L1/L2 interface status
|
||||
show controllers # Interface hardware status
|
||||
|
||||
# Interface Range Configuration
|
||||
interface range g0/0 - 3 # Configure multiple interfaces
|
||||
interface range g0/0, g0/2 # Select specific interfaces
|
||||
default interface g0/0 # Reset interface configuration
|
||||
```
|
||||
|
||||
## Layer 2 Switching
|
||||
```cisco
|
||||
# VLAN Configuration
|
||||
vlan 10
|
||||
name DEPARTMENT
|
||||
show vlan brief
|
||||
show vlan id 10
|
||||
|
||||
# Access Port Configuration
|
||||
interface g0/1
|
||||
switchport mode access
|
||||
switchport access vlan 10
|
||||
switchport port-security
|
||||
switchport port-security maximum 2
|
||||
switchport port-security mac-address sticky
|
||||
|
||||
# Trunk Configuration
|
||||
interface g0/1
|
||||
switchport mode trunk
|
||||
switchport trunk allowed vlan 10,20,30
|
||||
switchport trunk native vlan 999
|
||||
switchport nonegotiate # Disable DTP
|
||||
|
||||
# VTP Configuration
|
||||
vtp mode {server|client|transparent}
|
||||
vtp domain DOMAIN_NAME
|
||||
vtp version {1|2|3}
|
||||
show vtp status
|
||||
```
|
||||
|
||||
## Spanning Tree Protocol
|
||||
```cisco
|
||||
# Global STP Commands
|
||||
spanning-tree mode {pvst|rapid-pvst|mst}
|
||||
spanning-tree extend system-id
|
||||
show spanning-tree
|
||||
show spanning-tree summary
|
||||
|
||||
# VLAN STP Configuration
|
||||
spanning-tree vlan 1 root primary
|
||||
spanning-tree vlan 1 root secondary
|
||||
spanning-tree vlan 1 priority 24576
|
||||
|
||||
# Interface STP Configuration
|
||||
interface g0/1
|
||||
spanning-tree portfast
|
||||
spanning-tree bpduguard enable
|
||||
spanning-tree guard root
|
||||
spanning-tree cost 100
|
||||
spanning-tree port-priority 64
|
||||
```
|
||||
|
||||
## EtherChannel
|
||||
```cisco
|
||||
# LACP Configuration
|
||||
interface range g0/1-2
|
||||
channel-group 1 mode active # LACP active
|
||||
channel-group 1 mode passive # LACP passive
|
||||
|
||||
# PAgP Configuration
|
||||
interface range g0/1-2
|
||||
channel-group 1 mode desirable # PAgP desirable
|
||||
channel-group 1 mode auto # PAgP auto
|
||||
|
||||
# Static Configuration
|
||||
interface range g0/1-2
|
||||
channel-group 1 mode on # Force channel without protocol
|
||||
|
||||
# Verification Commands
|
||||
show etherchannel summary
|
||||
show etherchannel port-channel
|
||||
show etherchannel load-balance
|
||||
```
|
||||
|
||||
## Layer 3 Routing
|
||||
```cisco
|
||||
# Basic Routing Commands
|
||||
ip routing # Enable routing on L3 switch
|
||||
show ip route
|
||||
show ip protocols
|
||||
|
||||
# Static Routes
|
||||
ip route 0.0.0.0 0.0.0.0 NEXT_HOP # Default route
|
||||
ip route NETWORK MASK NEXT_HOP # Static route
|
||||
ip route NETWORK MASK Null0 # Null route
|
||||
|
||||
# OSPF Configuration
|
||||
router ospf 1
|
||||
router-id 1.1.1.1
|
||||
network 192.168.1.0 0.0.0.255 area 0
|
||||
default-information originate
|
||||
passive-interface default
|
||||
no passive-interface g0/1
|
||||
|
||||
interface g0/1
|
||||
ip ospf 1 area 0
|
||||
ip ospf cost 100
|
||||
ip ospf priority 255
|
||||
```
|
||||
|
||||
## NAT & PAT
|
||||
```cisco
|
||||
# Static NAT
|
||||
ip nat inside source static LOCAL_IP GLOBAL_IP
|
||||
|
||||
# Dynamic NAT
|
||||
ip nat pool NAT_POOL 200.1.1.1 200.1.1.10 netmask 255.255.255.0
|
||||
ip nat inside source list 1 pool NAT_POOL
|
||||
|
||||
# PAT (NAT Overload)
|
||||
access-list 1 permit 192.168.1.0 0.0.0.255
|
||||
ip nat inside source list 1 interface g0/1 overload
|
||||
|
||||
# NAT Interface Configuration
|
||||
interface g0/0
|
||||
ip nat inside
|
||||
interface g0/1
|
||||
ip nat outside
|
||||
|
||||
# Verification
|
||||
show ip nat translations
|
||||
show ip nat statistics
|
||||
```
|
||||
|
||||
## Network Services
|
||||
```cisco
|
||||
# DHCP Server
|
||||
ip dhcp excluded-address 192.168.1.1 192.168.1.10
|
||||
ip dhcp pool POOL_NAME
|
||||
network 192.168.1.0 255.255.255.0
|
||||
default-router 192.168.1.1
|
||||
dns-server 8.8.8.8
|
||||
lease 7
|
||||
|
||||
# DHCP Relay
|
||||
interface g0/1
|
||||
ip helper-address DHCP_SERVER_IP
|
||||
|
||||
# NTP Configuration
|
||||
ntp server IP_ADDRESS
|
||||
ntp master
|
||||
ntp authenticate
|
||||
ntp trusted-key 1
|
||||
ntp authentication-key 1 md5 PASSWORD
|
||||
|
||||
# Syslog
|
||||
logging host IP_ADDRESS
|
||||
logging trap debugging
|
||||
logging facility local7
|
||||
```
|
||||
|
||||
## Monitoring & Troubleshooting
|
||||
```cisco
|
||||
# Discovery Protocols
|
||||
show cdp neighbors detail
|
||||
show lldp neighbors detail
|
||||
show cdp interface
|
||||
|
||||
# Debug Commands
|
||||
debug ip ospf packet
|
||||
debug ip ospf hello
|
||||
no debug all # Disable all debugging
|
||||
|
||||
# Interface Diagnostics
|
||||
show interfaces counters
|
||||
show interfaces counters errors
|
||||
show controllers ethernet-controller
|
||||
show processes cpu
|
||||
show memory statistics
|
||||
|
||||
# Logging
|
||||
show logging
|
||||
show logging history
|
||||
terminal monitor # Enable logging in SSH/Telnet
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 1. Basic Device Configuration
|
||||
### 1.1 Initial Device Access
|
||||
- **Enable Mode**: Access privileged EXEC mode
|
||||
```cisco
|
||||
Router> enable
|
||||
Router#
|
||||
```
|
||||
- **Configuration Mode**: Enter global configuration mode
|
||||
```cisco
|
||||
Router# configure terminal
|
||||
Router(config)#
|
||||
```
|
||||
- **Basic Device Security**:
|
||||
```cisco
|
||||
enable password boson # Basic password (not encrypted)
|
||||
enable secret boson # Encrypted password (preferred)
|
||||
```
|
||||
|
||||
### 1.2 Device Management
|
||||
- **Hostname Configuration**:
|
||||
```cisco
|
||||
hostname R1
|
||||
```
|
||||
- **Interface Configuration**:
|
||||
```cisco
|
||||
interface GigabitEthernet 0/0
|
||||
description Connection to SW1
|
||||
ip address 192.168.1.1 255.255.255.0
|
||||
no shutdown
|
||||
```
|
||||
- **Saving Configuration**:
|
||||
```cisco
|
||||
write memory # or 'wr'
|
||||
copy running-config startup-config
|
||||
```
|
||||
|
||||
## 2. Interface Configuration
|
||||
### 2.1 IPv4 Configuration
|
||||
```cisco
|
||||
## conf ipv4 ##
|
||||
en
|
||||
conf t
|
||||
int f0/1
|
||||
ip addr 192.168.1.1 255.255.255.0
|
||||
no shut
|
||||
end
|
||||
wr
|
||||
```
|
||||
- Purpose: Configures basic IPv4 addressing on an interface
|
||||
- Key Components:
|
||||
- `ip addr`: Assigns IP address and subnet mask
|
||||
- `no shut`: Enables the interface
|
||||
- `wr`: Saves configuration to NVRAM
|
||||
|
||||
### 2.2 IPv6 Configuration
|
||||
```cisco
|
||||
## conf ipv6 ##
|
||||
en
|
||||
conf t
|
||||
ipv6 unicast-routing
|
||||
int f0/1
|
||||
ipv6 addr 2001:db8:3445:abde::1/64
|
||||
no shut
|
||||
end wr
|
||||
```
|
||||
- Purpose: Enables and configures IPv6 on an interface
|
||||
- Key Components:
|
||||
- `ipv6 unicast-routing`: Enables IPv6 routing globally
|
||||
- `ipv6 addr`: Assigns IPv6 address with prefix length
|
||||
|
||||
## 3. VLAN Configuration
|
||||
### 3.1 Basic VLAN Setup
|
||||
```cisco
|
||||
## create vlan and conf name ##
|
||||
en
|
||||
conf t
|
||||
vlan 10
|
||||
name Sales
|
||||
|
||||
## conf int as switchport for vlan ##
|
||||
int f0/1
|
||||
sw mo ac
|
||||
switchport access vlan 10
|
||||
```
|
||||
- Purpose: Creates and assigns VLANs to interfaces
|
||||
- Key Concepts:
|
||||
- VLANs segment broadcast domains
|
||||
- Access ports belong to single VLAN
|
||||
- Trunk ports carry multiple VLAN traffic
|
||||
|
||||
### 3.2 VLAN Trunking
|
||||
```cisco
|
||||
## conf SW for 802.1q and trunking mode ##
|
||||
en
|
||||
conf t
|
||||
int f0/1
|
||||
sw tr enc dot1q
|
||||
sw mo tr
|
||||
```
|
||||
- Purpose: Configures trunk links between switches
|
||||
- Features:
|
||||
- 802.1Q tagging for VLAN identification
|
||||
- Supports multiple VLANs over single link
|
||||
- Can specify allowed VLANs
|
||||
|
||||
### 3.3 Inter-VLAN Routing
|
||||
```cisco
|
||||
## create a subint for vlan 10 ##
|
||||
en
|
||||
conf t
|
||||
int f0/0.10
|
||||
enc dot1q 10
|
||||
ip addr 192.168.10.1 255.255.255.192
|
||||
```
|
||||
- Purpose: Enables routing between VLANs
|
||||
- Methods:
|
||||
- Router-on-a-stick (shown above)
|
||||
- Layer 3 switch routing
|
||||
- Multiple physical interfaces
|
||||
|
||||
## 4. Spanning Tree Protocol (STP)
|
||||
### 4.1 Basic STP Configuration
|
||||
```cisco
|
||||
## conf vlan pvst (Rapid-PVST+) ##
|
||||
en
|
||||
conf t
|
||||
spanning-tree vlan 100 priority root
|
||||
|
||||
## conf portfast on int f0/1 ##
|
||||
int f0/1
|
||||
spanning-tree portfast
|
||||
```
|
||||
- Purpose: Prevents layer 2 loops
|
||||
- Key Features:
|
||||
- Root bridge election
|
||||
- Loop prevention
|
||||
- Convergence optimization
|
||||
|
||||
## 5. EtherChannel Configuration
|
||||
### 5.1 Layer 2 EtherChannel
|
||||
```cisco
|
||||
## layer 2 etherchannel ##
|
||||
en
|
||||
conf t
|
||||
int r f0/1 - 4
|
||||
channel-group 1 mode active
|
||||
```
|
||||
- Purpose: Combines multiple physical links into one logical link
|
||||
- Benefits:
|
||||
- Increased bandwidth
|
||||
- Redundancy
|
||||
- Load balancing
|
||||
|
||||
## 6. Security Features
|
||||
### 6.1 SSH Configuration
|
||||
```cisco
|
||||
## conf ssh ##
|
||||
en
|
||||
conf t
|
||||
line vty 0 15
|
||||
no password sharedpassword
|
||||
login local
|
||||
transport input ssh # enable ssh only
|
||||
|
||||
## ssh generate rsa key ##
|
||||
crypto key generate rsa
|
||||
```
|
||||
- Purpose: Secure remote access
|
||||
- Key Components:
|
||||
- RSA key generation
|
||||
- VTY line configuration
|
||||
- Authentication methods
|
||||
|
||||
### 6.2 Port Security
|
||||
```cisco
|
||||
## Basic Port Security ##
|
||||
en
|
||||
conf t
|
||||
int f0/1
|
||||
switchport port-security
|
||||
switchport port-security maximum 2
|
||||
switchport port-security mac-address sticky
|
||||
```
|
||||
- Purpose: Prevents unauthorized access at switch ports
|
||||
- Features:
|
||||
- MAC address limiting
|
||||
- Violation actions
|
||||
- Sticky learning
|
||||
|
||||
## 7. Routing Protocols
|
||||
### 7.1 OSPF Configuration
|
||||
```cisco
|
||||
## conf OSPF process and area on int ##
|
||||
en
|
||||
conf t
|
||||
int f0/1
|
||||
ip ospf 10 area 0
|
||||
|
||||
## conf network to operate in OSPF area 0 ##
|
||||
router ospf 10
|
||||
network 203.0.113.0 0.0.0.7 area 0
|
||||
```
|
||||
- Purpose: Dynamic routing protocol for internal networks
|
||||
- Key Concepts:
|
||||
- Area-based hierarchy
|
||||
- Link-state protocol
|
||||
- Dijkstra's algorithm for path selection
|
||||
- Verification Commands:
|
||||
```cisco
|
||||
show ip ospf
|
||||
show ip ospf neighbor
|
||||
show ip route ospf
|
||||
```
|
||||
|
||||
### 7.2 Static Routing
|
||||
```cisco
|
||||
## conf a default route by int ##
|
||||
ip route 0.0.0.0 0.0.0.0 int f0/1
|
||||
|
||||
## conf a default route by next int ip addr ##
|
||||
ip route 0.0.0.0 0.0.0.0 203.0.113.1
|
||||
```
|
||||
- Purpose: Manually configured routes
|
||||
- Use Cases:
|
||||
- Default routes
|
||||
- Stub networks
|
||||
- Small network designs
|
||||
|
||||
## 8. Network Address Translation (NAT)
|
||||
### 8.1 Static NAT
|
||||
```cisco
|
||||
## implement static nat on router ##
|
||||
en
|
||||
conf t
|
||||
int g0/0
|
||||
ip nat outside
|
||||
|
||||
int g0/1
|
||||
ip nat inside
|
||||
exit
|
||||
|
||||
ip nat inside source static 192.168.100.38 192.0.2.9
|
||||
```
|
||||
- Purpose: One-to-one mapping of private to public addresses
|
||||
- Verification:
|
||||
```cisco
|
||||
show ip nat translations
|
||||
show ip nat statistics
|
||||
```
|
||||
|
||||
### 8.2 PAT (NAT Overload)
|
||||
```cisco
|
||||
## conf pat aka nat overload ##
|
||||
en
|
||||
conf t
|
||||
access-list 1 permit 192.168.100.32 0.0.0.31
|
||||
int g0/1
|
||||
ip nat inside
|
||||
int g0/0
|
||||
ip nat outside
|
||||
ip nat inside source list 1 interface g0/0 overload
|
||||
```
|
||||
- Purpose: Many-to-one address translation
|
||||
- Benefits:
|
||||
- Conserves public IP addresses
|
||||
- Common in home/small business networks
|
||||
|
||||
## 9. Network Services
|
||||
### 9.1 DHCP Configuration
|
||||
```cisco
|
||||
## conf dhcp server ##
|
||||
en
|
||||
conf t
|
||||
service dhcp
|
||||
ip dhcp excluded-address 172.16.10.17
|
||||
ip dhcp pool pool_one
|
||||
network 172.16.10.16 255.255.255.240
|
||||
default-router 172.16.10.17
|
||||
|
||||
## conf dhcp relay ##
|
||||
int f0/1
|
||||
ip helper 203.0.113.1
|
||||
```
|
||||
- Purpose: Automatic IP address assignment
|
||||
- Components:
|
||||
- DHCP pool definition
|
||||
- Excluded addresses
|
||||
- Default gateway
|
||||
- DHCP relay for remote networks
|
||||
|
||||
### 9.2 NTP Configuration
|
||||
```cisco
|
||||
## conf ntp server ##
|
||||
en
|
||||
conf t
|
||||
ntp master
|
||||
|
||||
## conf ntp client ##
|
||||
ntp authenticate
|
||||
ntp authentication-key 1 md5 80$0n!
|
||||
ntp trusted-key 1
|
||||
ntp server 203.0.113.5 key 1
|
||||
```
|
||||
- Purpose: Network time synchronization
|
||||
- Security Features:
|
||||
- Authentication
|
||||
- Access control lists
|
||||
- Trusted keys
|
||||
|
||||
### 9.3 DNS Configuration
|
||||
```cisco
|
||||
## enable dns server ##
|
||||
en
|
||||
conf t
|
||||
ip dns server
|
||||
|
||||
## conf dns host table ##
|
||||
ip host www 192.168.52.44
|
||||
```
|
||||
- Purpose: Domain name resolution
|
||||
- Features:
|
||||
- Local DNS server
|
||||
- Static host mappings
|
||||
- DNS forwarding
|
||||
|
||||
## 10. High Availability
|
||||
### 10.1 HSRP Configuration
|
||||
```cisco
|
||||
## conf hsrp ##
|
||||
en
|
||||
conf t
|
||||
int f0/0
|
||||
standby 1 ip 192.168.1.1
|
||||
standby 1 priority 110
|
||||
standby 1 preempt
|
||||
```
|
||||
- Purpose: Router redundancy protocol
|
||||
- Features:
|
||||
- Virtual IP address
|
||||
- Priority-based active router selection
|
||||
- Preemption capability
|
||||
|
||||
### 10.2 VRRP Configuration
|
||||
```cisco
|
||||
## conf vrrp ##
|
||||
en
|
||||
conf t
|
||||
int vlan 100
|
||||
vrrp 1 ip 192.168.100.1
|
||||
vrrp 1 priority 110
|
||||
```
|
||||
- Purpose: Alternative to HSRP
|
||||
- Key Differences:
|
||||
- Industry standard (vs. Cisco proprietary HSRP)
|
||||
- Similar functionality
|
||||
|
||||
## 11. Troubleshooting
|
||||
### 11.1 Interface Status
|
||||
```cisco
|
||||
## check all int ##
|
||||
show ip interface brief
|
||||
show interface status # switches only
|
||||
|
||||
## check one int ##
|
||||
show ip interface f0/1
|
||||
```
|
||||
- Purpose: Verify interface operation
|
||||
- Key Information:
|
||||
- Line/protocol status
|
||||
- IP addressing
|
||||
- Interface errors
|
||||
|
||||
### 11.2 Protocol Debugging
|
||||
```cisco
|
||||
## debug ospf hello msg ##
|
||||
debug ip ospf hello
|
||||
|
||||
## show nat translations ##
|
||||
show ip nat translations
|
||||
|
||||
## show routing table ##
|
||||
show ip route
|
||||
```
|
||||
- Purpose: Detailed protocol analysis
|
||||
- Best Practices:
|
||||
- Use specific debug commands
|
||||
- Monitor system resources
|
||||
- Clear debug when finished
|
||||
|
||||
### 11.3 Common Show Commands
|
||||
```cisco
|
||||
show running-config
|
||||
show vlan brief
|
||||
show spanning-tree
|
||||
show etherchannel summary
|
||||
show cdp neighbors
|
||||
```
|
||||
- Purpose: Configuration verification
|
||||
- Use Cases:
|
||||
- Troubleshooting
|
||||
- Documentation
|
||||
- Change verification
|
||||
|
||||
## 12. Best Practices
|
||||
### 12.1 Configuration Management
|
||||
- Save configurations regularly
|
||||
- Document changes
|
||||
- Use consistent naming conventions
|
||||
- Implement secure passwords
|
||||
- Regular backups
|
||||
|
||||
### 12.2 Security Guidelines
|
||||
- Disable unused ports
|
||||
- Use secure protocols (SSH vs Telnet)
|
||||
- Implement access lists
|
||||
- Regular security audits
|
||||
- Password best practices
|
||||
+2
-1
@@ -10,4 +10,5 @@
|
||||
- [Dynamic Routing](3-ip-connectivity.md#dynamic-routing)
|
||||
- [IP Services](4-ip-services.md)
|
||||
- [Security Fundamentals](5-security-fundamentals.md)
|
||||
- [Automation and Programmability](6-automation-and-programmability.md)
|
||||
- [Automation and Programmability](6-automation-and-programmability.md)
|
||||
- [Command Line Examples](7-command-line-examples.md)
|
||||
Reference in New Issue
Block a user