Chapter 5: The Cisco IOS CLI
The chapter introduction explains why CCNA preparation must move from networking theory to hands-on configuration and verification of Cisco devices.
After this chapter you will be able to
- Theory and practical configuration. Explain why theoretical understanding alone is insufficient for CCNA topics that require configuration and verification on Cisco devices.
- Shell as User Interface. Explain what a shell is and how it is used when configuring a Cisco router or switch.
- GUI and CLI distinction. Distinguish a GUI from a CLI by how a user interacts with each, using the section’s examples.
- Console and network access. Distinguish a direct console connection from accessing the CLI over a network, including why console access requires being physically near the device.
- Console ports and cables. Describe how the console port determines the cable choice, including the USB and RJ45 options and the reversed pin pattern of an RJ45 rollover cable.
- Terminal emulator connection. Explain what software is needed after connecting the console cable and how to determine its connection settings.
- Initial configuration dialog. Explain what the system configuration dialog offers when first accessing a new Cisco device and how to skip it.
- EXEC privilege levels and navigation. Distinguish user EXEC mode from privileged EXEC mode by their prompts and available commands. Describe how enable and disable move between the modes.
- EXEC configuration boundary. Explain why entering privileged EXEC mode does not let you change a device’s configuration, and describe the kinds of actions the EXEC modes do permit.
- Global configuration mode access. Explain that device configuration changes are made in configuration modes rather than EXEC modes, and that configure terminal enters global configuration mode from privileged EXEC mode.
- Configuration mode exit paths. Distinguish how end, Ctrl-C, Ctrl-Z, and exit move between configuration modes and privileged EXEC mode, including what happens to a partially typed command when Ctrl-Z is used.
- EXEC commands during configuration. Explain why an EXEC command such as show clock fails when entered directly in configuration mode and how do lets you run it without leaving that mode.
- Current command editing shortcuts. Describe how to move the cursor and edit a command before executing it, including the effects of the arrow keys, Backspace, Ctrl-A, Ctrl-E, and Ctrl-U.
- Previous command recall. Explain how Cisco IOS command history and the up and down arrows help you reuse and correct previously executed commands.
- Available command and keyword help. Explain how typing ? in the Cisco IOS CLI lists commands available in the current mode, and how using it after a command or keyword shows what can follow. Interpret <cr> as meaning the command can be executed by pressing Enter.
- Unique command abbreviations. Explain when Cisco IOS accepts an abbreviated command or keyword, and distinguish pressing Tab to complete it from pressing Enter to execute it.
- Running and startup configurations. Distinguish the configuration that controls the device now from the one loaded at boot, including where each is stored and what happens on a restart.
- Saving configuration changes. Explain how to make changes to running-config persist across a power-off or restart, and name a command that does so.
- Privileged EXEC access protection. Explain why access to privileged EXEC mode should be protected with a password.
- Enable password access control. Explain how to configure an enable password and when IOS asks for it.
- Cleartext password exposure. Explain why an unencrypted enable password is a security concern even though IOS hides passwords as they are typed.
- Type 7 encryption limits. Describe what service password-encryption changes and why the section recommends enable secret instead.
- Enable Secret Configuration and Storage. Explain how to configure an enable secret to protect privileged EXEC mode and describe how its password is stored.
What it builds on
- Straight-through and crossover cables (chapter 3) · The earlier distinction between straight-through and crossover cable patterns.
Section by section
Introduction
The chapter introduction explains why CCNA preparation must move from networking theory to hands-on configuration and verification of Cisco devices.
- Theory and practical configuration: Explain why theoretical understanding alone is insufficient for CCNA topics that require configuration and verification on Cisco devices.
Why it matters: It explains why reading about a protocol is not enough when the exam expects you to configure and check it.
Key terms: configure, configure and verify, theoretical understanding
5.1 Shells: GUI and CLI
Defines a shell as the interface used to give commands to a computer, including a Cisco router or switch.
- Shell as User Interface: Explain what a shell is and how it is used when configuring a Cisco router or switch.
Why it matters: This gives you a starting point for understanding how you interact with a Cisco device.
Key terms: shell, interface, commands
5.1.1 GUI and CLI
This section distinguishes graphical and command-line shells and explains why CCNA candidates need hands-on practice with the Cisco IOS CLI.
- GUI and CLI distinction: Distinguish a GUI from a CLI by how a user interacts with each, using the section’s examples.
Why it matters: This distinction makes clear what changes when you move from windows and menus to typed commands. - CCNA interface practice: Explain which interfaces the section identifies as relevant to the CCNA and why hands-on CLI practice matters.
Why it matters: It helps you prioritize command practice without overlooking the WLC GUI.
Key terms: shell, graphical user interface (GUI), command-line interface (CLI), Cisco IOS, Cisco routers and switches, wireless LAN controller (WLC) GUI, Cisco Packet Tracer
5.1.2 Accessing the CLI of a Cisco device
This section explains how to reach a Cisco device’s CLI through a direct console connection, from choosing a cable to opening a terminal emulator.
- Console and network access: Distinguish a direct console connection from accessing the CLI over a network, including why console access requires being physically near the device.
Why it matters: The connection method determines whether you need physical access to the device. - Console ports and cables: Describe how the console port determines the cable choice, including the USB and RJ45 options and the reversed pin pattern of an RJ45 rollover cable.
Why it matters: Choosing the cable that matches the console port is necessary before software can open the CLI. - Terminal emulator connection: Explain what software is needed after connecting the console cable and how to determine its connection settings.
Why it matters: The cable alone does not display a CLI session; the terminal emulator must use settings appropriate to the device.
Key terms: console port, console cable, Telnet, Secure Shell (SSH), USB Mini-B, RJ45, rollover cable, terminal emulator, PuTTY, speed
5.2 Navigating the Cisco IOS CLI
This section encourages hands-on CLI practice and explains how to bypass the initial setup wizard on a new Cisco device.
- Initial configuration dialog: Explain what the system configuration dialog offers when first accessing a new Cisco device and how to skip it.
Why it matters: Skipping the wizard lets you proceed to the CLI commands practiced in this chapter. - Hands-on CLI practice: Justify practicing commands and shortcuts while reading about the Cisco IOS CLI.
Why it matters: Trying the commands as you read makes the CLI material easier to absorb.
Key terms: system configuration dialog, Cisco IOS CLI, Packet Tracer
5.2.1 The EXEC modes
This section explains how user and privileged EXEC modes differ, how to move between them, and why neither mode can change a device’s configuration.
- EXEC privilege levels and navigation: Distinguish user EXEC mode from privileged EXEC mode by their prompts and available commands. Describe how enable and disable move between the modes.
Why it matters: The prompt tells you which commands the device will accept. - EXEC configuration boundary: Explain why entering privileged EXEC mode does not let you change a device’s configuration, and describe the kinds of actions the EXEC modes do permit.
Why it matters: More privilege within EXEC mode is not the same as being able to configure the device.
Key terms: user EXEC mode, privileged EXEC mode, enable, disable, show clock, reload, EXEC modes, configuration, operational commands
5.2.2 Global configuration mode
Explains how to enter and leave global configuration mode, change and undo a hostname, and run EXEC commands while configuring a Cisco device.
- Global configuration mode access: Explain that device configuration changes are made in configuration modes rather than EXEC modes, and that configure terminal enters global configuration mode from privileged EXEC mode.
Why it matters: You need to enter the right mode before changing a device’s configuration. - Hostname changes and reversal: Describe how the hostname command changes a device’s name immediately, how the prompt shows the change, and how no hostname R1 reverses the example configuration.
Why it matters: Distinct hostnames make devices easier to identify, and the prompt lets you verify a name change. - Configuration mode exit paths: Distinguish how end, Ctrl-C, Ctrl-Z, and exit move between configuration modes and privileged EXEC mode, including what happens to a partially typed command when Ctrl-Z is used.
Why it matters: Choosing the wrong way to leave a mode can put you somewhere unexpected or execute a command you had not meant to submit. - EXEC commands during configuration: Explain why an EXEC command such as show clock fails when entered directly in configuration mode and how do lets you run it without leaving that mode.
Why it matters: The do command lets you check device status without interrupting your configuration workflow.
Key terms: privileged EXEC mode, global configuration mode, configure terminal, hostname, no, prompt, end, Ctrl-C, Ctrl-Z, exit
5.2.3 Keyboard shortcuts
This section explains keyboard shortcuts for editing commands at the Cisco IOS CLI and recalling previously executed commands.
- Current command editing shortcuts: Describe how to move the cursor and edit a command before executing it, including the effects of the arrow keys, Backspace, Ctrl-A, Ctrl-E, and Ctrl-U.
Why it matters: These shortcuts make it easier to correct a command without retyping it. - Previous command recall: Explain how Cisco IOS command history and the up and down arrows help you reuse and correct previously executed commands.
Why it matters: Command recall saves typing when you need to reuse or fix a command.
Key terms: cursor, Left arrow, Right arrow, Backspace, Ctrl-A, Ctrl-E, memory buffer, Up arrow, Down arrow
5.2.4 Context-sensitive help
This section explains how to discover Cisco IOS commands and keywords with context-sensitive help, then use unique abbreviations to enter commands faster.
- Available command and keyword help: Explain how typing ? in the Cisco IOS CLI lists commands available in the current mode, and how using it after a command or keyword shows what can follow. Interpret <cr> as meaning the command can be executed by pressing Enter.
Why it matters: It lets you find the next valid CLI input without memorizing every command and keyword. - Partial command completion choices: Describe how placing ? immediately after partially typed text, without a space, displays commands or keywords that could complete it.
Why it matters: It helps you find a command when you remember only its beginning. - Unique command abbreviations: Explain when Cisco IOS accepts an abbreviated command or keyword, and distinguish pressing Tab to complete it from pressing Enter to execute it.
Why it matters: Unique abbreviations make repeated CLI work faster without requiring full commands every time.
Key terms: context-sensitive help, ?, keyword, <cr>, partially typed command, possible completions, Tab, ambiguous command, enable, conf t
5.3 IOS configuration files
Explains how Cisco IOS uses running-config and startup-config to apply, retain, and reset device configurations.
- Running and startup configurations: Distinguish the configuration that controls the device now from the one loaded at boot, including where each is stored and what happens on a restart.
Why it matters: This distinction explains why a change can work now but disappear after a restart. - Saving configuration changes: Explain how to make changes to running-config persist across a power-off or restart, and name a command that does so.
Why it matters: Applying a configuration is not the same as saving it for the next boot. - Factory-default boot and reset: Describe what happens when startup-config is absent and how the section says to return a device to its factory-default configuration.
Why it matters: It explains both a new device’s initial state and how to deliberately restore that state.
Key terms: running-config, startup-config, RAM, NVRAM, write, write memory, copy running-config startup-config, privileged EXEC mode, factory-default, reload
5.4 Password-protecting privileged EXEC mode
This section explains why privileged EXEC mode should be password-protected.
- Privileged EXEC access protection: Explain why access to privileged EXEC mode should be protected with a password.
Why it matters: Protecting privileged EXEC mode helps keep unauthorized users from changing a device’s configuration.
Key terms: privileged EXEC mode, show commands, global configuration mode
5.4.1 Configuring the enable password
This subsection shows how to configure an enable password, why its storage is insecure, and why enable secret is preferable.
- Enable password access control: Explain how to configure an enable password and when IOS asks for it.
Why it matters: It lets you recognize how access to privileged EXEC mode is password-protected. - Cleartext password exposure: Explain why an unencrypted enable password is a security concern even though IOS hides passwords as they are typed.
Why it matters: A password hidden at the prompt may still be visible to someone inspecting the configuration. - Type 7 encryption limits: Describe what service password-encryption changes and why the section recommends enable secret instead.
Why it matters: It prevents you from mistaking an obscured configuration password for a securely protected one.
Key terms: enable password, enable, user EXEC mode, privileged EXEC mode, global configuration mode, cleartext, running-config, service password-encryption, type 7 encryption, ciphertext
5.4.2 Configuring the enable secret
This section explains how to configure an enable secret, why its stored hash is more secure, and how it interacts with an enable password.
- Enable Secret Configuration and Storage: Explain how to configure an enable secret to protect privileged EXEC mode and describe how its password is stored.
Why it matters: This is the section’s main way to protect access to privileged EXEC mode. - Enable Secret Password Precedence: Describe what happens when both an enable password and an enable secret are configured.
Why it matters: A visible enable password does not mean it still grants privileged access. - Default Hash Algorithm Differences: Distinguish the default hash algorithms described in the section and state which is more secure.
Why it matters: An enable secret’s hash type depends on the device, and the types do not offer equal security.
Key terms: enable secret, privileged EXEC mode, hash, global configuration mode, enable password, default hashing algorithm, scrypt, type 9, MD5, type 5
5.5 Summary
Where this is used later
- Interface speed (chapter 8) · Assumes the idea of viewing an IOS configuration file.
Concepts explained in this chapter
- privileged exec modePrivileged EXEC mode is the Cisco IOS CLI operational mode that provides access to configuration commands and advanced operational commands.
- user exec modeUser EXEC mode is the initial Cisco IOS command-line mode that provides limited operational access before privileged authorization.
- global configuration modeGlobal configuration mode is a Cisco IOS CLI mode in which device-wide settings and access to more specific configuration modes can be configured.
- command-line interfaceA command-line interface is a text-based interface through which a user controls and interacts with a device by entering commands.
- exec modeAn EXEC mode is a Cisco IOS command-line operating mode that determines which commands are available and whether device operations can be performed.
- running-configThe running-config is the Cisco IOS configuration currently held in active device memory and used for operation.
- Cisco IOS command-line interfaceThe Cisco IOS command-line interface is the text-based interface through which users enter commands to configure and operate Cisco IOS devices.
- enableThe Cisco IOS enable command changes the session from user EXEC mode to privileged EXEC mode, subject to authorization.
- reloadThe Cisco IOS reload command restarts a network device.
- console portA console port is a physical device port that provides a direct local connection for configuring a device through its command-line interface.
- configuration modeA configuration mode is a Cisco IOS CLI state that permits configuration commands for the device or a specific feature.
- enable secretThe enable secret command is a Cisco IOS global-configuration command that sets the password for privileged EXEC mode.
- context-sensitive helpContext-sensitive help is an interactive CLI feature that presents commands, keywords, and completions valid at the current input position.
- console cableA console cable is a cable that connects a computer to a network device's console port for local management access.
- enable passwordThe enable password command is a Cisco IOS global-configuration command that configures the password for privileged EXEC access.
- configure terminal commandThe configure terminal command is a Cisco IOS CLI command that enters global configuration mode from privileged EXEC mode.
- hostname commandThe Cisco IOS hostname command sets the configured human-readable name of the device.
- service password-encryption commandThe service password-encryption command is a Cisco IOS configuration command that applies reversible type 7 obfuscation to supported cleartext passwords.
- copy running-config startup-configThe Cisco IOS write memory command saves the active configuration to startup-config.
- factory-default configurationA factory-default configuration is the baseline device configuration supplied after configuration settings are removed or reset.
- startup-configThe startup-config is the Cisco IOS configuration file stored in nonvolatile memory and loaded when a device boots.
- question markThe question mark is a Cisco IOS CLI help trigger that displays valid commands, keywords, or completions for the current input context.
- Cisco Packet TracerCisco Packet Tracer is Cisco network simulation software for modeling and practicing the configuration of network devices and networks.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.