Reset devices

erase startup-config
reload

erase startup-config
delete vlan.dat
reload

Save configuration

You can save the current configuration by copying it to the startup configuration as follows: copy running-config startup-config in privileged EXEC mode.

Name device

You can name a cisco device by entering the hostname [name] command in global configuration mode.

Message of the day

You can set a message of the day using the banner motd "[message]" (or with the " as any identical character) command in global configuration mode.

Disable DNS-lookup

You can disable DNS-lookup using the no ip domain-lookup command in global configuration mode.

IP Address

You can set the IP address of any interface, by entering ip address [ip-address] [subnet mask]. On a switch this is usually done on a certain VLAN, on a router this can be done in the loopback [number] interface. The default gateway is given by ip default-gateway [ip-address].

User EXEC Mode

After you access the device, you are automatically in user EXEC command mode. The EXEC commands available at the user level are a subset of those available at the privileged level. This is the least privileged command mode. User EXEC mode is denoted by a >.

Privileged EXEC Mode

The privileged command set includes those commands contained in user EXEC mode as well as commands that configure operating parameters. Privileged access should be password-protected to prevent unauthorised use, you can achieve this by entering the enable secret [password] command in global configuration mode. It is highly recommend to also enable password encryption. Privileged EXEC mode is denoted by a #.

To access privileged EXEC mode, enter the enable command from user EXEC mode.

Global Configuration Mode

Configuration mode commands apply to features that affect the device as a whole. Global configuration mode is denoted by (config)#.

From privileged EXEC mode you can reach global configuration mode by entering the configure terminal command.

To execute a command that’s usually only available from privileged EXEC or User EXEC mode, like show ip interface brief, you have to preced it by do. ¹

Interface/Line Configuration Mode

Interface/Line configuration mode commands let you configure specific interfaces/lines on the router. Interface configuration mode is denoted by (config-if)# and line configuration mode by (config-line)#.

From global configuration mode you can reach interface configuration mode by entering the interface [interface-name] command. Similarly to reach line configuration mode you can enter the line [line-name] command.

You can go back to the privileged EXEC mode from this mode by entering the command end.

Console

To enable a password for a login through the console port, enter in global configuration mode:

line con 0
 password [password]
 login
 logging synchronous

Telnet

To configure telnet (vty or virtual terminal) with password protection, enter in global configuration mode:

line vty 0 15
 password [password]
 login

SSH

To configure SSH (Secure SHell) with password protection, enter in global configuration mode:

crypto key generate RSA general-keys modulus 1024
ip domain-name [your-domain.com]
username [username] privilege 15 secret [password]
line vty 0 15
 transport input ssh
 login local

This will automatically disable telnet connections on the vty lines, if you still want to allow telnet connections enter transport input ssh telnet instead of transport input ssh.

You can do some extra SSH-specific configuration in global configuration mode:

ip ssh version [ssh-version-number]
ip ssh time-out [seconds]
ip ssh authentication-retries [retries-number]

Security

Password protection on management interfaces is always recommended but extra security measures can be taken.

login block-for [seconds-blocked] attempts [attempts-number] within [seconds]
security password min-length [minimum-chars]

Making a new VLAN

in global configuration mode, you can make a new VLAN using the command vlan {number}. After that you give it the name using name {the name of the VLAN}; the state to active and don’t shut down.

state active
no shutdown

Assigning a VLAN to an interface

To enable a certain vlan, you have to go to interface [name], and then:

switchport acces vlan [number]

VLAN Trunking

In some cases you might want devices to be on the same VLAN, even though they aren’t connected to the same Switch. You can solve this by adding a router to one of the switches and setting up a VLAN trunk like this: For adding a VLAN trunk you need to go to an interface, for example f0/24.

Example code:

int f0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40
switchport trunk native vlan 99
no shutdown

Port-Security

In some cases you want your device to be secure from overloading. For example you bandwidth, you want to make sure that the connections on your port has some bandwidth. Because if you have 100 devices on one port, the bandwidth has to be shared. With only 1 device on your port you have the whole bandwidth for that device. Another reason would be the Availability of the port, because if 100 devices have to communicate through 1 port, you’ll have a huge que of actions your port has to finish.

If you want a maximum of dynamic max-addresses you can use switchport port-security maximum * ( on * you can put a number ). If more addresses are detected, those will be deactivated.

Between networks with no subinterfaces

If you want to make sure networks can communicate with eachother you’ll have to configure RIP. ²

Between networks with subinterfaces

If you’re having a whole subnetworking ( vlan’s ) on one end of your router you’ll need some more settings