Cisco & Networking · Lesson 05
Cisco IOS CLI & Safe Navigation
Learn how Cisco IOS command modes, prompts, help, show commands, configuration contexts, running configuration, startup configuration, and verification fit together into safe CLI work.
The goal is not to memorize hundreds of commands. It is to know where you are, what a command will affect, how to inspect first, and how to prove a change worked before you save it.
Lesson Snapshot
Learning objectives
Work in IOS without losing track of scope
Navigate Cisco IOS command modes confidently without changing configuration accidentally.
Distinguish user EXEC, privileged EXEC, global configuration, and subconfiguration modes.
Use built-in help, command completion, history, and filtering to work efficiently.
Collect a baseline with safe show commands before entering configuration mode.
Understand the difference between running-config and startup-config.
Make, verify, save, and if necessary reverse small configuration changes in a controlled way.
Core idea
The prompt tells you your scope
Router>, Router#, Router(config)#, and Router(config-if)# are not cosmetic differences. Each prompt tells you which command set is available and how broad your next action may be.
Safety rule
Show first, configure second
Collect a baseline before entering configuration mode. Without the original state, you lose evidence and make rollback harder.
Cisco IOS modes
Read the prompt before typing
User EXEC
Router>Basic monitoring and limited commands. This is commonly the first CLI mode after console or remote login.
Enter
Login to the device.Leave
exit or logoutYou usually cannot make normal configuration changes from this mode.
Privileged EXEC
Router#Broader monitoring, debugging, file operations, saving configuration, and access to configuration mode.
Enter
enableLeave
disable or exitThis mode has significantly more power. Treat operational commands such as reload and clear carefully.
Global configuration
Router(config)#Change device-wide settings and enter specific subconfiguration modes.
Enter
configure terminalLeave
end, Ctrl+Z, or exitCommands entered here can immediately change the running configuration.
Interface configuration
Router(config-if)#Configure one physical or logical interface.
Enter
interface <interface-id>Leave
exit or endConfirm the exact interface before applying addressing, shutdown, switchport, or description commands.
Line configuration
Router(config-line)#Configure console, VTY, or auxiliary line behavior.
Enter
line console 0 or line vty <range>Leave
exit or endA mistake here can lock out authorized administrators.
Router configuration
Router(config-router)#Configure supported dynamic routing processes.
Enter
router <protocol>Leave
exit or endRouting changes can affect many networks. Verify the scenario and route table first.
Mode navigation
Move deliberately between command contexts
enableMove from user EXEC to privileged EXEC mode.
configure terminalEnter global configuration mode from privileged EXEC.
exitMove back one configuration level or leave the current session depending on context.
endReturn directly from configuration mode to privileged EXEC.
Ctrl+ZKeyboard shortcut that also returns from configuration mode to privileged EXEC on many IOS platforms.
disableMove from privileged EXEC back to user EXEC.
Built-in help
Let IOS tell you valid syntax
?
Show commands or keywords that are valid at the current point in the command.
show ?Tab
Complete an unambiguous command or keyword.
show run<Tab>Abbreviation
IOS accepts shortened commands when the abbreviation is unique.
show ip int brUp Arrow
Recall previous commands from command history.
Useful when repeating a show command after a change.Ctrl+A
Move the cursor to the beginning of the current command line on many terminal implementations.
Helpful when editing a long command.Ctrl+E
Move the cursor to the end of the current command line on many terminal implementations.
Useful for quick edits without retyping.Prefer discovery over guessing
Interface names, feature syntax, and available commands vary by platform and IOS version. Use the prompt and ? to discover the device you actually have.
Baseline
Twelve show commands worth knowing
show running-configDisplay the active running configuration currently controlling the device.
show startup-configDisplay the saved configuration that will normally load after a reload.
show ip interface briefSummarize interface addressing and up/down state.
show interfacesReview detailed interface state, counters, errors, speed, and duplex information.
show versionReview IOS version, platform information, uptime, configuration register details, and other system information where supported.
show inventoryReview hardware inventory on supported devices.
show usersReview current terminal or remote users where supported.
show clockCheck device time before interpreting logs or documenting changes.
show loggingReview logging state and buffered log messages where supported.
show ip routeReview the IPv4 routing table.
show vlan briefReview VLANs and access-port membership on supported switches.
show interfaces trunkReview active trunk state and VLAN carriage on supported switches.
Output filtering
Narrow large outputs instead of scrolling blindly
show running-config | include usernameDisplay lines matching the text username.
show running-config | include ip addressFind configuration lines containing IP address statements.
show running-config | section interfaceDisplay interface-related sections on IOS versions that support section filtering.
show running-config | begin line vtyBegin displaying output at the first matching line.
show interfaces | include line protocol|errorSearch large interface output for selected terms where the platform supports the expression.
show ip route | include 192.168.Filter route-table output for matching networks.
Filtering syntax and regular-expression behavior can vary by IOS platform. If a filter is unsupported, use a narrower show command or inspect the complete output rather than assuming the data is absent.
Configuration state
Running configuration
Source
Active configuration in device memory
Behavior
Changes made in configuration mode usually take effect here immediately.
Persistence
Normally lost after reload unless saved.
Configuration state
Startup configuration
Source
Saved configuration in nonvolatile storage
Behavior
Normally loaded when the device boots.
Persistence
Persists across reloads until changed or erased.
Saving configuration
Save only after verification
copy running-config startup-configCopy the currently active running configuration into startup configuration.
Save only after verifying the desired state. Saving a bad running configuration makes the bad state persistent.
write memoryCommon legacy shorthand for saving the running configuration on many IOS devices.
Prefer the explicit copy command when teaching because it clearly states source and destination.
show startup-configReview what is currently stored for the next boot.
Use this to confirm whether the saved state matches expectations.
Safe change pattern
Six stages for controlled CLI changes
Inspect
Collect the current state with show commands before entering configuration mode.
Enter the narrowest mode
Move only into the specific interface, line, VLAN, or feature context required for the change.
Change one thing
Apply the smallest justified configuration change possible.
Exit and verify
Return to privileged EXEC and use show commands plus connectivity tests to confirm the result.
Document
Record the old value, new value, reason, device, and verification evidence.
Save deliberately
Copy running-config to startup-config only after the configuration is verified.
Controlled examples
Small changes with explicit verification
Set a descriptive interface label
Commands
configure terminalinterface GigabitEthernet0/1description Staff uplinkendVerify
show running-config interface GigabitEthernet0/1Rollback concept
no description
Configure a router interface IPv4 address
Commands
configure terminalinterface GigabitEthernet0/0ip address 192.168.10.1 255.255.255.0no shutdownendVerify
show ip interface briefRollback concept
Restore the documented previous address or use no ip address only if the scenario confirms the interface should have none.
Create a local hostname change
Commands
configure terminalhostname Branch-R1endVerify
show running-config | include hostnameRollback concept
Restore the documented previous hostname.
Do not copy commands blindly
Interface identifiers, existing addresses, and intended settings differ between topologies. Treat every command block as a pattern to understand, then adapt it to the authorized scenario.
Configuration removal
no <command>Cisco IOS commonly uses the no form to remove or disable a configuration statement.
no descriptionDo not assume every no command simply restores a safe default. Confirm the intended state first.
Configuration removal
default <command>On supported platforms, the default form may return a setting to its default behavior.
default interface GigabitEthernet0/1This can remove many interface settings at once and is high impact. Avoid using it casually in competition.
Command impact
Configuration mode is not the only place powerful actions exist
Read-only inspection
show, ping, traceroutePrimarily collects evidence and tests reachability.
Configuration entry
configure terminal, interface, line vty, vlanMoves into a context where configuration can be modified.
Operational actions
clear, reload, debugCan affect runtime behavior even outside configuration mode.
Persistence
copy running-config startup-configMakes the active state survive reboot.
Management access
Keep authorized administration available
Console access
Direct console access is valuable because it can remain available even when IP-based management is misconfigured.
SSH access
SSH provides encrypted remote CLI access when correctly configured and restricted.
Telnet
Telnet is unencrypted and should generally not be preferred for management when secure alternatives are available and supported.
VTY lines
Virtual terminal lines control remote CLI access. Changes can affect every remote administrator.
Timeouts
Session timeout settings can reduce exposure from unattended administrative sessions.
Source restrictions
Management access can be restricted to authorized networks where the scenario and platform support it.
Troubleshooting with show commands
Match evidence to the symptom
Interface address looks wrong
show ip interface brief; show running-config interface <interface>Compare the summary with the actual configured statement before editing.
Remote management stopped working
show running-config | section line vty; show users; show ip interface briefCheck management-line configuration and Layer 3 reachability before changing passwords or transport settings.
Changes disappeared after reload
show running-config; show startup-configCompare active and saved states to determine whether the configuration was never saved.
Device prompt changed unexpectedly
show running-config | include hostnameConfirm whether the hostname was intentionally modified.
A command is rejected
?; show versionYou may be in the wrong mode, using unsupported syntax, or working on a different IOS feature set.
Output is too large to read efficiently
Use include, section, or begin filters where supportedNarrow the evidence rather than making decisions from partial scrolling.
Boot awareness
Configuration register
Know it exists
The configuration register can influence boot behavior on some Cisco platforms.
Do not change it casually
Changing boot behavior can prevent normal startup or alter how configuration is loaded.
Inspect first
show version may display configuration-register information on supported devices.
Treat recovery procedures separately
Password-recovery and boot-recovery workflows should only be used when the authorized scenario specifically requires them.
CLI efficiency
Command history with caution
History helps verification
After a change, recall the exact show command you used before and compare the result.
History is not documentation
Terminal history can disappear. Record important changes separately.
Be careful with recalled commands
Pressing Enter on a recalled configuration or operational command executes it again.
Read the prompt
The same text can behave differently depending on whether you are at Router>, Router#, or Router(config)#.
Evidence-based reasoning
Read the mode and state before deciding
The prompt shows Router>
Weak response
Type configure terminal immediately.
Better reasoning
Recognize that you are in user EXEC. Move to privileged EXEC with enable only if authorized and needed.
The prompt shows Router(config-if)#
Weak response
Assume all commands are device-wide.
Better reasoning
You are inside one interface context. Read the prompt before entering commands so you know their scope.
A configuration change works until reboot
Weak response
The router is unreliable.
Better reasoning
Compare running-config and startup-config. The running state may never have been saved.
A teammate saved immediately after a change
Weak response
Saving is always good because it protects progress.
Better reasoning
Saving preserves both good and bad changes. Verify the network first, then save the intended state.
show interfaces produces too much output
Weak response
Skip the command.
Better reasoning
Use a more targeted show command or supported output filters to narrow the evidence.
A remembered command returns Invalid input
Weak response
The feature must be broken.
Better reasoning
Check your current mode, use ?, verify interface naming, and confirm platform/IOS support before assuming a failure.
High-impact actions
Commands that deserve extra caution
reloadReboots the device, causes downtime, and may load a startup configuration different from the current running state.
erase startup-config / write eraseRemoves saved configuration and can leave the device unconfigured after reboot.
default interfaceCan remove multiple interface settings at once, including required addressing, VLAN, trunk, or security configuration.
shutdownAdministratively disables an interface and can immediately break required connectivity.
clear <feature>Clear commands can reset counters, tables, sessions, or protocol state depending on the feature.
debugDebugging can produce heavy output and resource load. Use only when justified and understand how to stop it.
Practice scenarios
Choose the safest next CLI action
You are at Switch(config)# and want to inspect VLANs without leaving configuration mode.
On IOS versions that support it, use do show vlan brief. Otherwise exit to privileged EXEC and run show vlan brief.
You typed interface g0/1 but the device rejects it.
Use show ip interface brief or show interfaces to confirm the actual interface naming, then use ? from configuration mode.
A working interface configuration is active but not present after reboot.
Compare running-config and startup-config. If the running state is correct and authorized, save it deliberately.
You cannot remember the full command after show ip.
Use show ip ? to display valid next keywords rather than guessing.
A teammate suggests write erase because the configuration looks messy.
Do not erase the saved configuration. Inspect and correct only confirmed issues.
You changed a VTY setting and lost SSH access.
Use console access if available, review line vty and SSH-related configuration, restore required authorized management, then verify before saving.
Verification
Prove the device is correct before you save
Prompt
You know which IOS mode you are currently in before entering a command.
Scope
The command affects only the intended device, interface, line, or feature.
Running state
show commands confirm the active configuration matches the intended change.
Connectivity
Required local, routed, and management traffic still works after the change.
Saved state
startup-config is updated only after the running configuration is confirmed correct.
Documentation
The previous value, new value, and verification result are recorded for important changes.
Defensive lab
Navigate IOS, make one safe change, and verify persistence
Open a fictional Packet Tracer router and identify whether the prompt begins in user EXEC or privileged EXEC mode.
Use ? and command completion to explore available show commands without changing configuration.
Collect a baseline with show running-config, show startup-config, show ip interface brief, show version, and show ip route.
Compare running-config and startup-config and record whether they appear consistent.
Enter global configuration mode, select one fictional interface, and add only a harmless descriptive label.
Return to privileged EXEC and verify the description with a targeted show command.
Remove the description with the appropriate no command and verify the rollback.
Repeat the description change, verify it, then save the running configuration and confirm the startup configuration contains the intended value.
Lesson checklist
Before moving on
I recognize user EXEC, privileged EXEC, global configuration, and common subconfiguration prompts.
I can move between IOS modes without guessing.
I use ? and command completion when syntax or platform support is uncertain.
I collect a baseline before configuration changes.
I understand the difference between running-config and startup-config.
I know that configuration changes often affect running-config immediately.
I verify before saving the configuration.
I understand that no <command> can remove a configuration statement.
I avoid high-impact commands such as reload, erase, clear, and default interface without clear justification.
I use targeted show commands and output filtering to reduce noise.
I document meaningful changes and rollback information.
I verify both device state and real network connectivity after configuration changes.
Reflection
Check your reasoning
Question 1
Why is the IOS prompt itself useful evidence?
Question 2
What is the practical difference between running-config and startup-config?
Question 3
Why can saving too early make a mistake harder to recover from?
Question 4
What should you do when a familiar command is rejected by the device?
Question 5
Why is default interface more dangerous than removing one specific configuration line?
Question 6
What evidence should you collect before and after changing a router interface?
Carry this forward
Read the prompt, inspect the current state, make the smallest justified change, verify the network, then save deliberately. That sequence protects both evidence and required connectivity.