Basic Switch & End Device Configuration
Cisco IOS Overview
IOS (Internetwork Operating System) is the operating system that runs on Cisco routers and switches. Just like Windows runs on your PC, IOS runs on Cisco hardware — it provides the command-line interface (CLI) through which you configure and manage the device.
There are three methods to access the Cisco IOS CLI: Console (physical, direct connection), SSH (Secure Shell — encrypted remote access), and Telnet (unencrypted remote access — do not use in production).
Console access requires a rollover cable (also called a console cable) connecting the device's RJ-45 or USB console port to your laptop's serial or USB port, and a terminal emulator such as PuTTY or Tera Term configured at 9600 baud.
IOS Command Modes
Cisco IOS uses a hierarchical command structure. You must be in the correct mode to run a command — you cannot configure a hostname from User EXEC mode, for example. Each mode has a distinct prompt so you always know where you are.
| Mode | Prompt | Access Command | Purpose |
|---|---|---|---|
| User EXEC | Switch> | Default (after login) | Read-only, limited commands. Basic monitoring only. |
| Privileged EXEC | Switch# | enable | Full monitoring access, show commands, copy/save. |
| Global Config | Switch(config)# | configure terminal | Configure device-wide settings (hostname, passwords). |
| Interface Config | Switch(config-if)# | interface vlan 1 | Configure a specific interface (IP, shutdown, speed). |
| Line Config | Switch(config-line)# | line console 0 | Configure console or VTY (remote) lines. |
Switch> ! User EXEC — limited commands Switch> enable ! Enter Privileged EXEC Switch# ! Now in Privileged EXEC Switch# configure terminal ! Enter Global Config Switch(config)# ! Global Config mode Switch(config)# interface vlan 1 ! Enter Interface config Switch(config-if)# ! Interface config mode Switch(config-if)# exit ! Go back one level Switch(config)# line console 0 ! Line config Switch(config-line)# exit Switch(config)# end ! Return directly to Privileged EXEC Switch# disable ! Return to User EXEC Switch>
exit goes back one mode level (config-if → config). end jumps all the way back to Privileged EXEC from any config sub-mode — useful when you're done configuring and want to run show commands. Ctrl+Z does the same as end. Knowing these shortcuts saves significant time during real configuration and CCNA lab exams.IOS Command Structure & Help
Every IOS command follows a consistent syntax: command [keyword] {argument}. Keywords are predefined text words (like show, interface, ip). Arguments are values you supply — IP addresses, names, port numbers.
IOS has a powerful built-in help system. The ? character is your best friend — it can be used anywhere in a command to see what options are available. You never need to memorise every command — use ? to explore.
end.Switch# ? ! List all available commands in this mode Switch# sh? ! Commands beginning with "sh" show Switch# show ? ! All keywords for the show command interfaces Interface status and configuration ip IP information version System hardware and software status running-config Current operating configuration startup-config Contents of startup configuration Switch# show ip ? ! More help — drill deeper interface IP interface status and configuration route IP routing table
Basic Device Configuration
Every Cisco device should have a hostname (descriptive name that appears in the prompt and logs), secure passwords on all access methods, a banner MOTD (legal warning before login), and password encryption enabled so passwords are not stored in plain text.
Password best practices: minimum 8 characters, mix of upper/lowercase letters, numbers, and symbols. Configure four password types: Console (physical access), VTY (remote Telnet/SSH), Enable (privileged EXEC), and Enable Secret (encrypted privileged).
Always use enable secret — never enable password. Always run service password-encryption to encrypt the other stored passwords (console, VTY).
Switch# configure terminal Switch(config)# hostname SW1 ! Set device name SW1(config)# ! Prompt changes immediately SW1(config)# enable secret Cisco123 ! Encrypted privileged password (MD5) SW1(config)# SW1(config)# line console 0 ! Configure console line SW1(config-line)# password Console1 ! Console password SW1(config-line)# login ! Require login on console SW1(config-line)# exit SW1(config)# SW1(config)# line vty 0 15 ! VTY lines 0–15 = 16 simultaneous sessions SW1(config-line)# password Vty123 SW1(config-line)# login SW1(config-line)# exit SW1(config)# SW1(config)# service password-encryption ! Encrypt all plaintext passwords SW1(config)# banner motd # Authorised users only! Disconnect now if unauthorised. # SW1(config)# end SW1#
enable secret command stores the password using MD5 hashing — even if an attacker gets your config file, they cannot easily reverse the hash. The older enable password stores it in plain text in the running config (and only weak Type 7 obfuscation if service password-encryption is on). On the CCNA exam and in real life: always use enable secret, never enable password.Saving Configurations
Cisco devices have two critical configuration files. The running-config is the active configuration stored in RAM — it takes effect immediately but is lost if the device loses power or reboots. The startup-config is stored in NVRAM — it persists after reboot and is loaded on startup.
If you make changes and do not save, they are gone after a reboot. Always save with copy running-config startup-config (or the shorthand write memory) after making configuration changes.
show running-configshow startup-configcopy running-config startup-config. Both appear on the CCNA exam.SW1# copy running-config startup-config Destination filename [startup-config]? ! Press Enter to confirm Building configuration... [OK] SW1# SW1# show running-config ! View current active configuration Building configuration... Current configuration : 1012 bytes ! version 15.2 ! hostname SW1 ! enable secret 5 $1$mERr$9cTjUIl.../... ! MD5 encrypted — can't reverse ! SW1# show startup-config ! View saved NVRAM config SW1# write memory ! Alternative — same as copy run start Building configuration...[OK]
write memory and copy running-config startup-config do exactly the same thing — both save the running-config to NVRAM as the startup-config. Both commands appear on CCNA exam questions. The modern industry standard is copy running-config startup-config — it's more explicit. Either is acceptable in a lab or exam answer.Configuring IP Addressing
For PCs and end devices, you assign an IP address, subnet mask, and default gateway — either manually (static) or via DHCP (dynamic, automatically assigned by a DHCP server). The default gateway is the IP address of the router interface on the same subnet — it's where the PC sends traffic destined for other networks.
For switches, you configure a Switch Virtual Interface (SVI) — typically VLAN 1 — with an IP address. This allows you to remotely SSH into the switch for management. Without an SVI IP, you can only manage the switch via console cable.
SW1# configure terminal SW1(config)# interface vlan 1 ! Enter VLAN 1 SVI SW1(config-if)# ip address 192.168.1.10 255.255.255.0 ! IP + subnet mask SW1(config-if)# no shutdown ! Enable the SVI (shutdown by default) SW1(config-if)# exit SW1(config)# ip default-gateway 192.168.1.1 ! Set default gateway SW1(config)# end SW1# show ip interface brief ! Verify Interface IP-Address OK? Method Status Protocol Vlan1 192.168.1.10 YES manual up up
no shutdown command enables the interface. The "Status" column in show ip interface brief will show "up" when enabled and "administratively down" if you forgot no shutdown. This is a very common mistake in labs — if your SVI won't come up, check for a missing no shutdown.Verifying Connectivity
After configuration, always verify your work. Cisco IOS provides powerful verification commands. The most important one is show ip interface brief — used by network engineers dozens of times every day. Learn it well.
Ping tests reachability by sending ICMP echo requests to a destination. Each ! in the output means one successful reply. Each . means a timeout (no reply). A U means destination unreachable. Five pings are sent by default.
| include to filter: show run | include hostname! = success, . = timeout, U = unreachable. Five pings sent by default from Cisco devices.SW1# ping 192.168.1.1 ! Ping the default gateway Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms SW1# SW1# show ip interface brief Interface IP-Address OK? Method Status Protocol FastEthernet0/1 unassigned YES unset up up FastEthernet0/2 unassigned YES unset up up Vlan1 192.168.1.10 YES manual up up SW1# SW1# show interfaces vlan 1 Vlan1 is up, line protocol is up Hardware is EtherSVI, address is 0001.0001.0001 Internet address is 192.168.1.10/24
Step 1: Open Packet Tracer, drag a Cisco 2960 switch onto the workspace, and add a PC. Connect them with a straight-through cable.
Step 2: Click the switch, go to CLI tab. You will see the switch booting and arrive at
Switch>Step 3: From User EXEC (
Switch>), enter Privileged EXEC using enableStep 4: Enter Global Configuration mode with
configure terminalStep 5: Set the hostname to your name:
hostname YourNameSwitchStep 6: Use
? to explore available commands in each mode — notice how the list changesStep 7: Type
end to return to Privileged EXEC, then disable to return to User EXECStep 8: Verify your hostname changed — the prompt should show
YourNameSwitch>Expected outcome: Your prompt should show
AliSwitch> (or whatever name you used) after setting the hostname and returning to User EXEC.
💡 Show hints
- Packet Tracer is free — download from netacad.com (create a free Cisco Networking Academy account)
- If the switch is in setup mode, type
noand press Enter to skip it - The hostname command is in Global Config mode only — not User or Privileged EXEC
- Notice that the prompt changes immediately when you set the hostname — IOS is responsive
- Try typing
sh?in Privileged EXEC to see all commands starting with "sh"
Step 1: Set hostname to
SW-LAB1Step 2: Set enable secret to
Admin@2026Step 3: Configure console line (line console 0) password:
Console@1, with loginStep 4: Configure VTY lines (line vty 0 15) password:
Telnet@1, with loginStep 5: Enable password encryption with
service password-encryptionStep 6: Add banner:
banner motd # Authorised access only! #Step 7: Assign VLAN 1 SVI IP:
192.168.1.10 255.255.255.0, with no shutdownStep 8: Set default gateway:
ip default-gateway 192.168.1.1Step 9: Save with
copy running-config startup-configStep 10: Verify with
show running-config and show ip interface briefVerification:
show running-config should show: encrypted passwords (Type 7 or Type 5), banner text, VLAN 1 with IP 192.168.1.10/24, and default-gateway 192.168.1.1.
💡 Show hints & common mistakes
- After typing
hostname SW-LAB1, the prompt immediately changes toSW-LAB1(config)# - Remember
no shutdownon the VLAN 1 interface — the most common forgotten step - The
ip default-gatewaycommand is in Global Config mode, not interface mode - Type
show run | include passwordto check that passwords are encrypted (should show Type 7 encoded strings) - If VLAN 1 shows "administratively down", you forgot
no shutdown
copy running-config startup-config do?enable password?!!!!! mean in ping output?no shutdown command on an interface: