CCNA CLI quick reference

Cisco CCNA (200-301) expects you to type, read, and troubleshoot IOS commands from memory, and the CLI simulations grade the exact sequence you enter. This sheet collects the mode navigation, verification commands, and base configuration recipes that appear most on the current v1.1 blueprint, plus the abbreviations you will see in real lab output. Commands work on both routers and Catalyst switches unless a row says otherwise.

Modes and navigation

Command	Where it takes you	Prompt after	Remember
(log in)	User EXEC	Switch>	Limited show commands; no config changes
enable	Privileged EXEC	Switch#	disable drops back to user EXEC
configure terminal	Global config	Switch(config)#	The only door into configuration modes
interface g0/1	Interface config	Switch(config-if)#	interface range g0/1-24 edits many ports at once
line con 0 / line vty 0 15	Line config	Switch(config-line)#	Console is one line; vty lines carry SSH/Telnet sessions
exit	Up one mode level	varies	From global config it lands in privileged EXEC
end (or Ctrl+Z)	Privileged EXEC	Switch#	Jumps all the way out from any config depth
do <exec command>	Stays in config mode	unchanged	Runs show/EXEC commands without leaving config, e.g. do sh run

Prompt text is the fastest clue in sim questions: > is user EXEC, # is privileged EXEC, (config)# and deeper are config modes.

Everyday verification

Command	Question it answers	Remember
show running-config	What is configured right now (in RAM)?	Lost on reload unless copied to startup-config
show ip interface brief	Which interfaces are up, with what IPs?	up/up is healthy; administratively down means it needs no shutdown
show vlan brief	Which VLANs exist and which access ports are in each?	Trunk ports do not appear in the port list
show interfaces status	Per-port speed, duplex, VLAN, connected state?	a-full / a-100 prefixes mean autonegotiated
show interfaces trunk	Which trunks formed; native and allowed VLANs?	Empty output = no trunk formed (classic DTP auto/auto miss)
show ip route	Which route will forward this destination?	Longest prefix wins; codes: C connected, S static, O OSPF
show mac address-table	Which port learned this MAC address?	Dynamic entries age out after 300 seconds by default
show cdp neighbors	What device and port sit at the far end of each link?	Add detail for IP and IOS version; CDP is Cisco-only, LLDP is the open standard
show version	IOS version, uptime, model, config register?	Register 0x2102 = normal boot; shown on the last line

Base switch and router config

Task	Commands (in order)	Remember
Hostname	hostname SW1	A non-default hostname is required before generating RSA keys
Login banner	banner motd #No unauthorized access#	The first character after motd is the delimiter that ends the text
Console password	line con 0 ; password X ; login	Bare login means: check the line password
Local user account	username admin secret Str0ng!	secret stores a hash; the older password keyword stores plaintext
Remote-access lines	line vty 0 15 ; login local ; transport input ssh	login local checks username/secret pairs; transport input ssh blocks Telnet
Privileged-mode password	enable secret X	Hashed, and always overrides an enable password if both exist
Hide plaintext passwords	service password-encryption	Weak, reversible type 7; it obscures, it does not secure
Enable SSH	ip domain-name example.com ; crypto key generate rsa modulus 2048 ; ip ssh version 2	Keys need hostname + domain name set first; SSHv2 needs at least 768-bit keys, and modern IOS XE (17.11.1+) requires 2048
Router interface IP	interface g0/0 ; ip address 10.1.1.1 255.255.255.0 ; no shutdown	Router ports default to shutdown; switch ports default to up
Switch management IP	interface vlan 1 ; ip address 10.1.1.2 255.255.255.0 ; no shutdown	An SVI (virtual interface), not a physical port
Switch default gateway	ip default-gateway 10.1.1.1	Global command on a Layer 2 switch so it can reach other subnets

VLANs and trunking

Task	Commands (in order)	Remember
Create and name a VLAN	vlan 10 ; name SALES	Assigning a port to a VLAN that does not exist auto-creates it
Access port	switchport mode access ; switchport access vlan 10	One data VLAN per access port; a phone uses switchport voice vlan separately
Static trunk	switchport mode trunk	Older switches need switchport trunk encapsulation dot1q first
Stop DTP negotiation	switchport nonegotiate	Two ports left at dynamic auto will never form a trunk
Native VLAN	switchport trunk native vlan 99	Carries untagged frames; a mismatch triggers CDP warnings
Limit VLANs on a trunk	switchport trunk allowed vlan 10,20	Without the add keyword the list is REPLACED, not appended
Verify the result	show vlan brief ; show interfaces trunk	Access assignments in the first, formed trunks only in the second

Saving and abbreviations

Full command	Short form	Remember
copy running-config startup-config	copy run start	The canonical save; writes the config to NVRAM so it survives reload
write memory	wr	Legacy equivalent of the save; still accepted and widely used
show running-config	sh run	Any unambiguous prefix of a keyword is accepted
configure terminal	conf t	The most common abbreviation in lab walkthroughs
interface gigabitethernet0/1	int g0/1	Interface type and number compress together
show ip interface brief	sh ip int br	Fastest first look at any device
no shutdown	no shut	Prefixing no reverses most commands
(context help)	? and Tab	? lists valid next keywords; Tab completes the current word

Reload without saving discards the running-config; IOS prompts to save modified config before reloading, and answering incorrectly is a classic exam trap.

Reading a sheet is recognition; the exam tests recall. The fastest way to make this stick is answering questions that use it.

Practice CCNA questions and CLI sims

Common questions

What is the difference between running-config and startup-config?

The running-config lives in RAM and reflects every change the moment you enter it; the startup-config lives in NVRAM and is what loads at boot. They diverge as soon as you configure anything, so copy running-config startup-config (or wr) is required to make changes permanent. A reload without saving reverts the device to the startup-config.

Why does crypto key generate rsa fail or SSH refuse to work?

RSA key generation requires a non-default hostname and a configured ip domain-name first, because the key is labeled with both. Use a 2048-bit modulus: SSH version 2 technically accepts 768 bits and up, but IOS XE 17.11.1 and later rejects keys smaller than 2048 by default. Also confirm the vty lines have login local, a username with a secret exists, and transport input allows SSH.

What is the difference between exit and end in Cisco IOS?

exit backs out exactly one mode level, so from interface config it returns to global config. end (or Ctrl+Z) jumps straight back to privileged EXEC from any configuration depth. In simulations, using end when you meant exit can leave you in the wrong mode for the next command, so watch the prompt.

Why won't a trunk form between two switches?

The usual cause is DTP defaults: two ports both set to dynamic auto passively wait and never negotiate a trunk. Configure switchport mode trunk on at least one side, or on both sides with switchport nonegotiate to disable DTP entirely. Then check show interfaces trunk and make sure the native VLAN matches on both ends.

More free practice tests

Back to all cert900 exams