Cisco Command Cheat Sheet: Switch, Router, and Firewall Essentials

Network engineers often waste time hunting for the right Cisco IOS command. This cheat sheet gathers the essential commands for switches, routers, and ASA/FTD firewalls into a single reference.

Cisco IOS View Hierarchy

Cisco IOS commands are organized into four views. Using a command in the wrong view has no effect.

User EXEC (prompt Router>) – view‑only, no configuration.

Privileged EXEC (prompt Router#) – view for all show commands; configuration requires configure terminal.

Global Configuration (prompt Router(config)#) – main configuration mode entered with configure terminal ( conf t).

Interface Configuration (prompt Router(config-if)#) – configure a specific interface, e.g. interface GigabitEthernet0/0 ( int g0/0).

Common shortcuts: en for enable, wr for write memory, exit to leave a view, end (or Ctrl+Z) to return to privileged mode.

Switch Common Commands

1. VLAN Configuration

Create and name VLANs, then verify.

Switch(config)#vlan 10
Switch(config-vlan)#name HR
Switch(config-vlan)#vlan 20
Switch(config-vlan)#name Sales
Switch(config-vlan)#exit

Batch creation: vlan 10,20,30,100. View with show vlan brief or show vlan id 10.

2. Access and Trunk Ports

Access port (single VLAN):

Switch(config)#interface GigabitEthernet0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#spanning-tree portfast
Switch(config-if)#exit

Trunk port (multiple VLANs):

Switch(config)#interface GigabitEthernet0/24
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 10,20,30
Switch(config-if)#exit

Check with show interfaces trunk and show interfaces GigabitEthernet0/1 switchport.

3. Layer‑3 VLAN Interface (Vlanif)

Assign an IP to a VLAN (requires a layer‑3 switch).

Switch(config)#interface vlan 10
Switch(config-if)#ip address 192.168.10.1 255.255.255.0
Switch(config-if)#no shutdown
Switch(config-if)#exit

4. Spanning‑Tree (STP/RSTP/MSTP)

Enable rapid‑pvst and set per‑VLAN priority.

Switch(config)#spanning-tree mode rapid-pvst
Switch(config)#spanning-tree vlan 10 priority 4096
Switch(config)#spanning-tree vlan 20 priority 8192

View with show spanning-tree or show spanning-tree summary.

5. EtherChannel (Port‑Channel)

Aggregate links for bandwidth and redundancy.

Switch(config)#interface range GigabitEthernet0/23-24
Switch(config-if-range)#channel-group 1 mode active
Switch(config-if-range)#exit
Switch(config)#interface port-channel 1
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 10,20,30

Check with show etherchannel summary and show etherchannel port-channel.

Router Common Commands

1. Interface Configuration

Interfaces are shutdown by default; always use no shutdown after assigning an IP.

Router(config)#interface GigabitEthernet0/0
Router(config-if)#description Link-To-ISP
Router(config-if)#ip address 203.0.113.2 255.255.255.252
Router(config-if)#no shutdown
Router(config-if)#exit

Loopback example (used for router‑ID in OSPF/BGP):

Router(config)#interface Loopback0
Router(config-if)#ip address 1.1.1.1 255.255.255.255
Router(config-if)#exit

2. Static Routing

Four typical forms: ip route <dest> <mask> <next‑hop IP> – standard static route. ip route 0.0.0.0 0.0.0.0 <next‑hop> – default route. ip route <dest> <mask> <out‑interface> – point‑to‑point link.

ip route <dest> <mask> <next‑hop> <admin‑distance>

– floating route for backup.

Router(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.1
Router(config)#ip route 10.0.0.0 255.0.0.0 192.168.1.2
Router(config)#ip route 172.16.0.0 255.255.0.0 GigabitEthernet0/0
Router(config)#ip route 192.168.0.0 255.255.0.0 10.1.1.2 110

Verify with show ip route, show ip route static, or show ip route <dest>.

3. OSPF Dynamic Routing

Typical configuration for a small‑to‑medium network.

Router(config)#router ospf 1
Router(config-router)#router-id 1.1.1.1
Router(config-router)#network 10.1.1.0 0.0.0.255 area 0
Router(config-router)#network 192.168.1.0 0.0.0.255 area 0
Router(config-router)#default-information originate
Router(config-router)#exit

Key notes: process ID is local, router‑ID should be set manually, and area‑0 is the backbone. Troubleshoot with show ip ospf neighbor, show ip ospf interface brief, and show ip protocols. Common pitfalls – mismatched area, missing network statements, passive interfaces, or inconsistent Hello/Dead timers.

4. DHCP Server

Configure a DHCP pool on the router for small networks.

Router(config)#ip dhcp pool HR
Router(dhcp-config)#network 192.168.10.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.10.1
Router(dhcp-config)#dns-server 8.8.8.8 223.5.5.5
Router(dhcp-config)#lease 7
Router(dhcp-config)#exit
Router(config)#ip dhcp excluded-address 192.168.10.1 192.168.10.20

View with show ip dhcp binding, show ip dhcp pool, and show ip dhcp conflict.

5. NAT (Network Address Translation)

Three common methods:

Dynamic NAT (many‑to‑many pool):

Router(config)#ip nat pool NAT-POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)#ip nat inside source list 1 pool NAT-POOL
Router(config)#interface GigabitEthernet0/0
Router(config-if)#ip nat outside
Router(config-if)#exit
Router(config)#interface GigabitEthernet0/1
Router(config-if)#ip nat inside

PAT (Port Address Translation) – overload:

Router(config)#ip nat inside source list 1 interface GigabitEthernet0/0 overload

Static port mapping for exposing internal servers:

Router(config)#ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80
Router(config)#ip nat inside source static tcp 192.168.1.101 22 203.0.113.5 2222

Check NAT with show ip nat translations and show ip nat statistics.

Firewall (ASA/FTD) Common Commands

1. Interface Configuration – Security Levels

Each interface needs a nameif and a security-level (0‑100). Traffic flows from higher to lower levels by default.

ciscoasa(config)#interface GigabitEthernet0/0
ciscoasa(config-if)#nameif outside
ciscoasa(config-if)#security-level 0
ciscoasa(config-if)#ip address 203.0.113.1 255.255.255.252
ciscoasa(config-if)#no shutdown
ciscoasa(config-if)#exit
ciscoasa(config)#interface GigabitEthernet0/1
ciscoasa(config-if)#nameif inside
ciscoasa(config-if)#security-level 100
ciscoasa(config-if)#ip address 192.168.1.254 255.255.255.0
ciscoasa(config-if)#no shutdown
ciscoasa(config-if)#exit

2. ACL – Object‑Based and Classic

Object‑network and object‑service simplify ACLs.

# Allow outside to reach internal web server on port 80
ciscoasa(config)#object network WEB-SERVER
ciscoasa(config-network-object)#host 192.168.1.100
ciscoasa(config-network-object)#nat (inside,outside) static 203.0.113.10
ciscoasa(config-network-object)#exit
ciscoasa(config)#object service HTTP
ciscoasa(config-service-object)#service tcp destination eq 80
ciscoasa(config-service-object)#exit
ciscoasa(config)#access-list OUT-IN extended permit tcp any object WEB-SERVER object HTTP
ciscoasa(config)#access-group OUT-IN in interface outside

View ACLs with show access-list and show running-config access-list. A hit count of zero means the rule never matched.

3. NAT on ASA

Dynamic PAT (interface IP) and static one‑to‑one mappings.

# Dynamic PAT using outside interface IP
ciscoasa(config)#object network INSIDE-NET
ciscoasa(config-network-object)#subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)#nat (inside,outside) dynamic interface

# Static NAT for a mail server
ciscoasa(config)#object network MAIL-SERVER
ciscoasa(config-network-object)#host 192.168.1.50
ciscoasa(config-network-object)#nat (inside,outside) static 203.0.113.25 service tcp 25 25

Check with show nat and show xlate.

4. Remote Management (SSH / ASDM)

Disable telnet, enable SSH, generate RSA keys, and configure ASDM.

ciscoasa(config)#username admin password StrongPass123 privilege 15
ciscoasa(config)#aaa authentication ssh console LOCAL
ciscoasa(config)#ssh 192.168.1.0 255.255.255.0 inside
ciscoasa(config)#ssh timeout 30
ciscoasa(config)#crypto key generate rsa modulus 2048
ciscoasa(config)#write memory

# Enable ASDM web server
ciscoasa(config)#http server enable
ciscoasa(config)#http 192.168.1.0 255.255.255.0 inside

Device Management & Maintenance

1. SSH Remote Login (Production‑Ready)

Router(config)#username admin privilege 15 secret StrongPass123
Router(config)#ip domain-name example.com
Router(config)#crypto key generate rsa
Router(config)#ip ssh version 2
Router(config)#line vty 0 4
Router(config-line)#transport input ssh
Router(config-line)#login local
Router(config-line)#exec-timeout 10 0

2. Configuration Backup & Restore

# Save to NVRAM
Router#copy running-config startup-config   # or "wr"
# Backup to TFTP server
Router#copy running-config tftp://192.168.1.100/router-backup.cfg
# Restore from TFTP
Router#copy tftp://192.168.1.100/router-backup.cfg running-config

3. Logging & Time Synchronization

Router(config)#ntp server 120.25.115.20
Router(config)#clock timezone CST 8
Router(config)#clock summer-time CST recurring
Router(config)#logging buffered 65536 informational
Router(config)#logging host 192.168.1.50

4. Top 10 Show Commands (Quick‑Check)

show version
show running-config
show ip interface brief
show interfaces GigabitEthernet0/0
show ip route
show arp
show mac address-table
show cdp neighbors
show log
show processes cpu sorted

These commands reveal device model, IOS version, current configuration, interface status, routing table, ARP entries, MAC table, CDP neighbors, log history, and CPU usage—essential for rapid fault isolation.

Conclusion

Memorizing commands is less effective than hands‑on practice. Build a lab with spare hardware or emulators (GNS3, EVE‑NG, Packet Tracer), run every command from this guide, and use the show commands to verify each step. Regular backups and proper logging complete a robust operational workflow.