Editing Cisco Commands (section)

= Cisco IOS Command Reference =

A quick-reference guide for common Cisco IOS commands on switches and routers.

----

== Device & System Information ==

=== Show MAC Address Table ===
<pre>
show mac address-table
</pre>

=== Show OS and Device Version ===
<pre>
show version
</pre>

=== Show Logged-in Users ===
<pre>
show users
</pre>

=== Show Files ===
<pre>
dir
dir nvram:
</pre>

----

== Configuration Files ==

=== Erase Configurations ===
 erase startup-config
 delete flash:vlan.dat

=== Show Configurations ===
<pre>
show running-config
show startup-config
</pre>

=== Show Interface Config ===
<pre>
show run interface g0/0
</pre>

=== Filter Running Config (grep-like) ===
<pre>
show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}
</pre>

=== Save Running Config ===
<pre>
copy running-config startup-config
copy run start
wr
</pre>

----

== User Privileges & Security ==

=== Enter Privileged Mode ("elevate to root") ===
<pre>
enable
</pre>

=== Set Encrypted Enable Password ===
<pre>
enable secret ThisisaSecret
</pre>

=== Encrypt Plaintext Passwords (Weak Encryption)  ===
You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
<pre>
service password-encryption
</pre>

----

== Interface & Network Status ==

=== Interface IP Summary ===
<pre>
show ip interface brief
show ipv6 interface brief
</pre>

=== Interface IP Summary (filtered to only interfaces with IPs) ===
<pre>
show ip interface brief | exclude unassigned
</pre>
== VLAN & Switching ==

=== Show VLANs ===
<pre>
show vlan brief
</pre>

=== Show Interface VLAN Details ===
<pre>
show interface g0/1 switchport
</pre>

=== Show Trunk Interfaces ===
<pre>
show int trunk
</pre>

=== Clear Tables ===
<pre>
clear mac address-table
clear arp-cache
</pre>

----

== Telnet & Remote Access ==

=== Connect via Telnet ===
<pre>
connect {DeviceName}
</pre>

=== Show Hosts & Sessions ===
<pre>
show hosts
show sessions
</pre>

=== Disconnect Session ===
<pre>
disconnect {DeviceName}
</pre>

=== Suspend Active Session ===
<pre>
Ctrl+Shift+6, then x
</pre>

----

== SSH Configuration ==

=== Basic SSH Setup ===
<pre>
ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2
</pre>

=== Generate RSA Keys (1-liner) ===
 crypto key generate rsa general-keys modulus 1024

=== Remove RSA Keys ===
<pre>
crypto key zeroize rsa
</pre>

=== Create Local User ===
<pre>
username admin secret ccna
</pre>

=== Set Default Gateway (switch) ===
<pre>
ip default-gateway 192.168.10.1
</pre>

=== Enable SSH on VTY Lines ===
<pre>
line vty 0 15
 transport input ssh
 login local
 exit
</pre>

----

== Global Configuration Mode ==

=== Enter Global Config ===
<pre>
configure terminal
</pre>

=== Disable DNS Lookup on Typos ===
<pre>
no ip domain-lookup
</pre>

=== Set MOTD Banner ===
<pre>
banner motd MESSAGEHERE
</pre>

=== Set Hostname ===
<pre>
hostname HOSTNAME
</pre>

----

== Line Configuration ==

=== Console Line ===
<pre>
line con 0
 password itsasecret
 login
</pre>

=== VTY Lines ===
<pre>
line vty 0 15
 password itsasecret
 login
</pre>

----

== Interface Configuration ==

=== Interface Selection ===
 interface vlan 1
 interface fa0/1
 interface range fa0/2-3
 interface range fa0/2-3,g0/1

=== Enable Interface ===
 no shutdown

=== Assign IPv4 Address ===
 ip address 192.168.0.1 255.255.255.0

=== Assign IPv4 Default Gateway (Switch) ===
 ip default-gateway 192.168.0.254

== Interface IPv6 Configuration ==

=== Assign IPv6 Address ===
<pre>
ipv6 address 2001:DB8:CAFE:1::1/64
</pre>

=== Assign Link-Local Address ===
<pre>
ipv6 address fe80::1 link-local
</pre>

=== Remove IPv6 Addresses ===
<pre>
no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address
</pre>

=== IPv6 ND Other-Config Flag ===
Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. 
- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

 ipv6 nd other-config-flag
</pre>

----

== VLAN Configuration ==

=== Create / Configure VLAN ===
<pre>
vlan 10
 name MyAwesomeVlan
</pre>

----

== Access / Trunk Switchport Configuration ==

=== Access Port ===
Configures the interface as an access port and assigns it to VLAN 10.
 switchport mode access
 switchport access vlan 10

=== Trunk Port ===
Configures the interface as a trunk port using 802.1Q encapsulation.
 switchport trunk encapsulation dot1q
 switchport mode trunk

=== Trunk Allowed VLANs ===
Specifies which VLANs are allowed to traverse the trunk link.
 switchport trunk allowed vlan 10,20,33,99

=== Trunk Native VLANs ===
Sets the native VLAN for untagged traffic on the trunk.
 switchport trunk native vlan 99

=== Trunk Nonegotiate ===
Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.
 switchport nonegotiate

== EtherChannel Configuration ==

=== Create EtherChannel (LACP Active) ===
Configures interfaces to actively negotiate EtherChannel using LACP.
 interface range g0/1 - 2
  channel-group 1 mode active

=== Create EtherChannel (LACP Passive) ===
Configures interfaces to respond to LACP negotiation.
 interface range g0/1 - 2
  channel-group 1 mode passive

=== Create EtherChannel (On Mode) ===
Forces EtherChannel without negotiation protocol.
 interface range g0/1 - 2
  channel-group 1 mode on

=== Configure Port-Channel as Access Port ===
Applies access configuration to the logical Port-Channel interface.
 interface port-channel 1
  switchport mode access
  switchport access vlan 10

=== Configure Port-Channel as Trunk ===
Applies trunk configuration to the logical Port-Channel interface.
 interface port-channel 1
  switchport trunk encapsulation dot1q
  switchport mode trunk

=== Verify EtherChannel ===
Displays EtherChannel status and summary information.
 show etherchannel summary

=== Verify Port-Channel Interface ===
Displays detailed information about the Port-Channel interface.
 show interfaces port-channel 1


== DHCP ==

=== Configure a DHCP Server on a Cisco Router ===
Assigns IP addresses automatically to clients on a network.

<pre>
ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8 8.8.4.4
 lease 7
</pre>

* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).  
* ''network'': Defines the subnet for DHCP clients.  
* ''default-router'': Sets the gateway IP for clients.  
* ''dns-server'': Specifies DNS servers for clients.  
* ''lease'': Duration the IP is valid (in days).  

=== Configure DHCP Relay (IP Helper) ===
Forwards DHCP requests from clients to a remote DHCP server.

<pre>
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip helper-address 192.168.2.100
</pre>

* ''ip helper-address'': IP of the DHCP server to forward requests to.  
* Needed when the server is on a different subnet.  

=== Verify DHCP Status ===
<pre>
show ip dhcp binding      ! Shows assigned IP addresses
show ip dhcp pool         ! Shows pool usage and statistics
show running-config       ! Check DHCP configuration
</pre>

=== Best Practices ===
* Exclude static IP addresses from DHCP pools.  
* Use ''DHCP relay'' when clients and server are on different subnets.  
* Monitor DHCP bindings to prevent IP conflicts.

== Spanning Tree ==

=== Enable PortFast on an interface ===
Use PortFast on edge/access ports that connect to end devices.

 interface GigabitEthernet0/1
  spanning-tree portfast

=== Enable PortFast globally ===
Enables PortFast on all access ports.

 spanning-tree portfast default

=== Enable PortFast on a trunk (use with caution) ===
Only use when the trunk connects to a single end device (not another switch).

 interface GigabitEthernet0/1
  spanning-tree portfast trunk

=== Verify PortFast status ===

 show spanning-tree interface GigabitEthernet0/1 detail

=== Disable PortFast on an interface ===

 interface GigabitEthernet0/1
  no spanning-tree portfast

=== Best Practice: Enable BPDU Guard with PortFast ===
Shuts down the port if a BPDU is received, protecting against loops.

Per interface:
 interface GigabitEthernet0/1
  spanning-tree portfast
  spanning-tree bpduguard enable

Globally:
 spanning-tree portfast default
 spanning-tree bpduguard default

=== Set the Root Bridge ===
The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.

Set priority to influence root bridge selection:
* The default priority value is **32768** for all switches.
* Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).

To influence the root bridge selection, change the priority value:
 interface GigabitEthernet0/1
  spanning-tree vlan 1 priority 4096
  (Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)

Set the root bridge for a specific VLAN:
* To make the current switch the root bridge:
 spanning-tree vlan 1 root primary
  (This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)

* To make the current switch the backup root bridge:
 spanning-tree vlan 1 root secondary
  (This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)

Alternatively, manually set the root bridge priority:
 interface GigabitEthernet0/1
  spanning-tree vlan 1 priority 24576
  (Sets this switch with a higher priority, making it more likely to become the root bridge)

=== Verify Root Bridge ===

 show spanning-tree vlan 1
 (Shows the current root bridge and its priority, along with other STP details)

=== Notes ===
* Do '''not''' enable PortFast on ports connected to other switches (this can cause network loops).
* PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
* Incorrect use of PortFast can cause Layer 2 loops.
* The default priority value is **32768**, and it is adjusted in increments of **4096**.
* Lower priority values increase the likelihood of becoming the root bridge.
* The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.

== DHCP Snooping ==

=== Enable DHCP Snooping globally ===
Enable DHCP Snooping for the switch.

 ip dhcp snooping

=== Enable DHCP Snooping on a VLAN ===
DHCP Snooping only operates on specified VLANs.

 ip dhcp snooping vlan 10
 ip dhcp snooping vlan 20

=== Configure trusted interfaces ===
Mark uplinks or ports connected to legitimate DHCP servers as trusted.

 interface GigabitEthernet0/1
  ip dhcp snooping trust

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. DHCP server responses are blocked.

 interface GigabitEthernet0/2
  no ip dhcp snooping trust

=== Configure DHCP Snooping rate limiting ===
Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

 interface GigabitEthernet0/2
  ip dhcp snooping limit rate 15

=== Verify DHCP Snooping status ===

 show ip dhcp snooping
 show ip dhcp snooping binding

=== Disable DHCP Snooping ===

 no ip dhcp snooping
 no ip dhcp snooping vlan 10

=== Notes ===
* Only trusted ports can send DHCP server messages
* Access ports should remain untrusted
* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
* Requires correct VLAN configuration to function properly

== Dynamic ARP Inspection (DAI) ==
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

 ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

 ip arp inspection vlan 10
 ip arp inspection vlan 20
 ip arp inspection vlan 10,20   (alternative: range)

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

 interface GigabitEthernet0/1
  ip arp inspection trust

Trusted ports forward ARP packets without validation.

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

 interface GigabitEthernet0/2
  no ip arp inspection trust   (optional; this is the default)

=== Configure ARP rate limiting ===
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

 interface GigabitEthernet0/2
  ip arp inspection limit rate 15   (example: 15 packets per second)
  ip arp inspection limit rate 100 burst interval 1   (optional: higher rate with burst)

=== Additional Validation Checks ===
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

 ip arp inspection validate src-mac
 ip arp inspection validate src-mac dst-mac ip   (common: enable all three)

Options:
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.

To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>

=== Verify DAI status ===
 show ip arp inspection
 show ip arp inspection vlan 10
 show ip arp inspection interfaces
 show ip arp inspection statistics   (shows drops, rate limit violations)
 show ip arp inspection log   (logs of dropped packets)

=== Disable DAI ===
 no ip arp inspection
 no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
* Access ports should remain '''untrusted''' to enforce checks.
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
* DAI is ingress-only (checks incoming packets on untrusted ports).

== Port Security ==

=== View status of port security on an interface ===
 show port-security interface f0/1

=== Activate Port Security on an interface ===
The port cannot be a dynamic port:
 switchport mode access
Enable Port Security
 switchport port-security

=== Set the maximum number of mac addresses that can be used on that port ===
 switchport port-security maximum 1

=== Whitelist a specific mac address ===
 switchport port-security mac-address 0001.6311.E7BC

=== Enable sticky mode to automatically learn mac addresses ===
 switchport port-security mac-address sticky

=== Port Security Violation Modes ===
==== Protect ====
Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
 switchport port-security violation protect

==== Restrict ====
Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
 switchport port-security violation restrict

==== Shutdown ====
Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
 switchport port-security violation shutdown

=== Port Security Aging ===
==== Enable static aging on an interface ====
 switchport port-security aging static

==== Enable timed aging on an interface (5 minutes) ====
 switchport port-security aging time 5