Cisco Cheat Sheet: Switches, Routers, and Firewalls—From Model Selection to Ready‑to‑Copy Config Commands

1. Cisco Device Model Overview

Switches : Access (C2960‑X, C9200, C9200L), Aggregation (C9300, C9500), Data Center (Nexus N9K), Core (Catalyst 9600, Nexus 9500)

Routers : Small‑to‑mid size (ISR 1100/4300/4400), Mid‑range (ASR 1000/9000), Carrier (NCS 5500/6000)

Firewalls : Entry‑level (ASA 5506‑X/5508‑X), Mid‑range (Firepower 4110/4120/4140/4150), Next‑gen Secure Firewall (3100/4200)

2. Device Initial Setup – Console to SSH

Step 1: Hostname and Time Synchronization

Switch> enable
Switch# configure terminal
Switch(config)# hostname BJ-Core-SW-01
BJ-Core-SW-01(config)# clock timezone CST 8
BJ-Core-SW-01(config)# ntp server 10.0.0.1
BJ-Core-SW-01(config)# ntp master 3

Step 2: Disable Unnecessary Services

BJ-Core-SW-01(config)# no logging console
BJ-Core-SW-01(config)# no ip http server
BJ-Core-SW-01(config)# no ip http secure-server
BJ-Core-SW-01(config)# service timestamps debug datetime msec
BJ-Core-SW-01(config)# service timestamps log datetime msec

Step 3: Console and SSH Authentication

! Console password
BJ-Core-SW-01(config)# line console 0
BJ-Core-SW-01(config-line)# password Cisco@2024
BJ-Core-SW-01(config-line)# login
BJ-Core-SW-01(config-line)# exec-timeout 10 0
BJ-Core-SW-01(config-line)# exit
! Local user
BJ-Core-SW-01(config)# username admin privilege 15 secret Admin@2024
! Enable SSH
BJ-Core-SW-01(config)# ip domain-name corp.local
BJ-Core-SW-01(config)# crypto key generate rsa
The name for the keys will be: BJ-Core-SW-01.corp.local
Choose the size of the key modulus in the range of 360 to 4096:
How many bits in the modulus [512]: 2048
BJ-Core-SW-01(config)# ip ssh version 2
! VTY configuration
BJ-Core-SW-01(config)# line vty 0 15
BJ-Core-SW-01(config-line)# transport input ssh
BJ-Core-SW-01(config-line)# login local
BJ-Core-SW-01(config-line)# exec-timeout 10 0
BJ-Core-SW-01(config-line)# exit

Step 4: VLAN and Interface Basics (Office Example)

! Create VLANs
BJ-Core-SW-01(config)# vlan 10
BJ-Core-SW-01(config-vlan)# name Office
BJ-Core-SW-01(config-vlan)# exit
BJ-Core-SW-01(config)# vlan 20
BJ-Core-SW-01(config-vlan)# name Server
BJ-Core-SW-01(config-vlan)# exit
BJ-Core-SW-01(config)# vlan 30
BJ-Core-SW-01(config-vlan)# name WiFi
BJ-Core-SW-01(config-vlan)# exit
! Access port (PC)
BJ-Core-SW-01(config)# interface GigabitEthernet1/0/1
BJ-Core-SW-01(config-if)# switchport mode access
BJ-Core-SW-01(config-if)# switchport access vlan 10
BJ-Core-SW-01(config-if)# spanning-tree portfast
BJ-Core-SW-01(config-if)# exit
! Trunk port (uplink)
BJ-Core-SW-01(config)# interface GigabitEthernet1/0/48
BJ-Core-SW-01(config-if)# switchport mode trunk
BJ-Core-SW-01(config-if)# switchport trunk allowed vlan 10,20,30
BJ-Core-SW-01(config-if)# switchport trunk native vlan 99
BJ-Core-SW-01(config-if)# exit
! Range command for many ports
BJ-Core-SW-01(config)# interface range GigabitEthernet1/0/2-24
BJ-Core-SW-01(config-if-range)# switchport mode access
BJ-Core-SW-01(config-if-range)# switchport access vlan 10
BJ-Core-SW-01(config-if-range)# spanning-tree portfast
BJ-Core-SW-01(config-if-range)# exit

Step 5: Save Configuration

BJ-Core-SW-01# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration... 
[OK]
! or short form
BJ-Core-SW-01# write memory
Building configuration... 
[OK]

3. Routing Configuration – Static Routes and OSPF

Scenario 1: Static Routing

R1(config)# ip route 0.0.0.0 0.0.0.0 202.100.1.1
R1(config)# ip route 10.1.0.0 255.255.0.0 202.100.1.2
! Floating static route (backup)
R1(config)# ip route 0.0.0.0 0.0.0.0 203.100.1.1 80

Preference 80 makes the route a backup to the primary default route.

Scenario 2: OSPF

! Headquarters R1
R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 192.168.1.0 0.0.0.255 area 0
R1(config-router)# network 10.0.0.0 0.255.255.255 area 0
R1(config-router)# passive-interface default
R1(config-router)# no passive-interface GigabitEthernet0/0
R1(config-router)# exit
! Branch R2 (similar, router-id 2.2.2.2)
R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 192.168.2.0 0.0.0.255 area 0
R2(config-router)# network 10.0.0.0 0.255.255.255 area 0
R2(config-router)# passive-interface default
R2(config-router)# no passive-interface GigabitEthernet0/0
R2(config-router)# exit

Verification Commands

R1# show ip ospf neighbor
R1# show ip route ospf
R1# show ip ospf interface brief

Typical failure reasons: area mismatch, Hello/Dead timer differences, or authentication password mismatch.

4. NAT Configuration – Enabling Internet Access for Private Networks

Method 1: Dynamic PAT (Overload)

! Define ACL for internal traffic
R1(config)# access-list 100 permit ip 192.168.0.0 0.0.255.255 any
! Configure outside interface
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 202.100.1.1 255.255.255.252
R1(config-if)# ip nat outside
R1(config-if)# exit
! Configure inside interface
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# exit
! Enable PAT
R1(config)# ip nat inside source list 100 interface GigabitEthernet0/1 overload

Method 2: Static Port Mapping (NAT Server)

! Map internal web server to public IP
R1(config)# ip nat inside source static tcp 192.168.1.100 80 202.100.1.1 80
! If the public IP is dynamic, use the interface keyword
R1(config)# ip nat inside source static tcp 192.168.1.100 80 interface GigabitEthernet0/1 80

Verification Commands

R1# show ip nat translations
R1# show ip nat statistics
R1# debug ip nat

Common errors: reversed inside/outside designation or missing return route from the ISP.

5. IPSec VPN – Secure Site‑to‑Site Connectivity

Topology: Headquarters R1 (public 202.100.1.1, LAN 192.168.1.0/24) and Branch R2 (public 202.100.2.1, LAN 192.168.2.0/24).

Step 1: Define Interesting Traffic (ACL)

R1(config)# access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
R2(config)# access-list 110 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

Step 2: IKE Phase‑1 Policy

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha256
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config-isakmp)# lifetime 86400
R1(config-isakmp)# exit

Step 3: Pre‑Shared Key and Peer

R1(config)# crypto isakmp key CiscoVPN@2024 address 202.100.2.1
R2(config)# crypto isakmp key CiscoVPN@2024 address 202.100.1.1

Step 4: IPSec Phase‑2 Transform Set

R1(config)# crypto ipsec transform-set MYSET esp-aes 256 esp-sha256-hmac
R1(config-trans)# mode tunnel
R1(config-trans)# exit

Step 5: Crypto Map

R1(config)# crypto map MYMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 202.100.2.1
R1(config-crypto-map)# set transform-set MYSET
R1(config-crypto-map)# match address 110
R1(config-crypto-map)# exit

Step 6: Apply Crypto Map to Outside Interface

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 202.100.1.1 255.255.255.252
R1(config-if)# crypto map MYMAP
R1(config-if)# exit

Repeat analogous steps on R2, adjusting the peer address.

Verification

R1# show crypto isakmp sa
R1# show crypto ipsec sa

SA in QM_IDLE indicates a successful IKE negotiation; non‑zero encrypt/decrypt packet counters confirm data flow.

6. Security Configuration – ACLs and Zone‑Based Policies

Switch ACL Example (Block SSH from 192.168.2.0/24 to 192.168.1.0/24)

SW1(config)# access-list 150 deny tcp 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22
SW1(config)# access-list 150 permit ip any any
SW1(config)# interface vlan 20
SW1(config-if)# ip access-group 150 in
SW1(config-if)# exit

Firewall Zone‑Based Policy (ASA/FTD)

! Enable inspection policies
ASA(config)# policy-map global_policy
ASA(config-pmap)# class inspection_default
ASA(config-pmap-c)# inspect dns preset_dns_map
ASA(config-pmap-c)# inspect ftp
ASA(config-pmap-c)# inspect http
ASA(config-pmap-c)# inspect icmp
ASA(config-pmap-c)# exit
ASA(config-pmap)# exit
! Permit web traffic from inside to outside
ASA(config)# access-list OUT-IN extended permit tcp 192.168.1.0 255.255.255.0 any eq 80
ASA(config)# access-list OUT-IN extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
ASA(config)# access-list OUT-IN extended deny ip any any
ASA(config)# access-group OUT-IN in interface outside

Management‑Plane Hardening

! Disable HTTP management
ASA(config)# no http server enable
! Lock out repeated login failures
ASA(config)# aaa local authentication attempts max-fail 5
ASA(config)# aaa authentication ssh console LOCAL

7. Essential Troubleshooting Commands

Show commands display state; debug commands trace activity.

show running-config
show run
show ip interface brief
show ip route
show mac address-table
show vlan brief
show version
show processes cpu
show memory summary
show logging
traceroute 8.8.8.8
ping 8.8.8.8
ping 192.168.1.1
show tech-support

Recommended diagnostic order: physical → Layer 2 (VLAN, MAC) → Layer 3 (IP, routing) → Layer 4‑7 (policy, NAT, VPN).