Day 4: Introduction to the CLI

Introduction to the CLI (Command Line Interface)

Overview

The CLI (Command Line Interface) is the text-based interface used to configure Cisco network devices.

Contrast: A GUI (Graphical User Interface) is a visual, point-and-click interface—less common in Cisco device administration.

 

---

 

Accessing the CLI: Physical Connection

Console Port Connection

When you first configure a Cisco device, you must physically connect via the Console Port.

Cable Options:

• Rollover Cable (DB9 serial to RJ45)

  • Connects serial port on your computer to the RJ45 console port on the device

• USB Adapter (DB9 serial to USB)

  • For computers without a native serial port (most modern laptops)

Terminal Emulator

To actually access the CLI after connecting the console cable:

1. Open a Terminal Emulator application on your PC

   • Popular choices: PuTTY, Cisco Packet Tracer, SecureCRT, Tera Term

2. Configure the connection as "Serial" with Cisco default settings (see below)

Cisco Default Serial Settings

These are the standard configuration settings for console access to Cisco devices:

 

---

 

Cisco CLI Modes

The CLI is organized into different modes, each with different capabilities and prompts.

Mode 1: User EXEC Mode (User Mode)

How to enter: This is the default mode when you first connect to the device.

Prompt: Router> (greater-than symbol)

Capabilities:

• Very limited access

• Can view some basic information about the device

• Cannot make ANY changes to the device configuration

• Read-only mode

Common User EXEC Commands:

• enable — Switch to Privileged EXEC mode

• ? — Display available commands

• help — Get help

Mode 2: Privileged EXEC Mode

How to enter: Type enable from User EXEC mode (may require password)

Prompt: Router# (hash/pound symbol)

Capabilities:

• Full access to view device configuration

• Can restart the device

• Can save configuration files

• Can change the system clock/time

• Still cannot make configuration changes

• This mode is for "executing" commands, not entering configuration

Common Privileged EXEC Commands:

• configure terminal (or conf t) — Enter Global Configuration Mode

• show running-config — View current active configuration

• show startup-config — View configuration that loads on reboot

• write or write memory — Save running config to startup config

• exit — Go back to User EXEC mode

Mode 3: Global Configuration Mode

How to enter: From Privileged EXEC mode, type configure terminal or conf t

Prompt: Router(config)# (the word "config" appears in the prompt)

Capabilities:

• Can make changes to the device configuration

• Enter commands that modify how the device operates

• Can set passwords, configure interfaces, enable services, etc.

• Changes made here affect the running configuration (active config)

How to exit: Type exit to return to Privileged EXEC mode

Important: Changes made in Global Configuration Mode are temporary—they affect the running configuration but are lost if the device restarts. You must save them (with write or copy running-config startup-config) to make them permanent.

 

---

 

CLI Navigation Helpers

Question Mark (?)

The ? key provides context-sensitive help at ANY time and in ANY mode.

Uses:

View all available commands in current mode:

Router# ?

1.  Lists every command available at this prompt level
   
   

View commands that start with a specific letter or prefix:

Router(config)# conf ?

2.  Lists all commands starting with "conf"
   
   

View required parameters for a command:

Router# configure ?

3.  Shows what parameters are needed to complete the configure command
   
   

Pro tip: This is one of the most important tools in Cisco CLI—always use ? when you're unsure what to do.

TAB Key (Command Completion)

Press TAB to auto-complete a partially entered command.

How it works:

• Type the first few letters of a command

• Press TAB

• If the command is unambiguous (only one match), it auto-completes

• If multiple matches exist, nothing happens—add more letters to narrow it down

Example:

Router# conf<TAB>  → Router# configure

Router# conf t<TAB> → Router# configure terminal

 

---

 

Configuration Files

Cisco devices maintain two separate configuration files at all times:

Running Configuration (running-config)

• The current, active configuration on the device

• All commands you enter in the CLI edit this file in real-time

• If the device restarts, this configuration is lost (unless saved)

• Stored in RAM

Startup Configuration (startup-config)

• The configuration file that loads when the device boots up

• Used to restore the device configuration after a restart

• Stored in NVRAM (non-volatile memory)

• Persists even if power is lost

Viewing Configurations

From Privileged EXEC mode:

Router# show running-config    (view current active config)

Router# show startup-config    (view config that will load on reboot)

Saving Configuration (Making Changes Permanent)

To copy the running-config to startup-config, use any of these equivalent commands from Privileged EXEC mode:

Router# write

Router# write memory

Router# copy running-config startup-config

Destination filename [startup-config]? <ENTER>

All three commands accomplish the same thing—they save your changes so they survive a device restart.

 

---

 

Passwords and Security

Enable Password (Weak Encryption)

Purpose: Protects access to Privileged EXEC mode

Command (in Global Configuration Mode):

Router(config)# enable password (your-password)

Encryption Level:

• Uses Type 7 encryption (Cisco proprietary)

• Weak encryption—easy to crack

• Passwords are visible as plaintext in the config file until encryption is enabled

Important: Passwords are case-sensitive.

Enable Secret (Strong Encryption)

Purpose: Also protects access to Privileged EXEC mode (overrides enable password)

Command (in Global Configuration Mode):

Router(config)# enable secret (your-password)

Encryption Level:

• Uses Type 5 encryption (MD5 hashing)

• Much stronger than Type 7

• Should always be used over enable password

• Passwords are always encrypted (even without service password-encryption)

Important Note: Once you set enable secret, it takes precedence over enable password. If both are configured, only enable secret is used.

Service Password-Encryption

Purpose: Automatically encrypts all passwords in the configuration file

Command (in Global Configuration Mode):

Router(config)# service password-encryption

What it does:

• Converts plaintext passwords (like enable password) to Type 7 encrypted format

• Future passwords entered will also be encrypted automatically

• Does NOT affect enable secret (which is always encrypted anyway)

What happens if you disable it:

Router(config)# no service password-encryption

• Current encrypted passwords remain encrypted (won't be decrypted)

• Future passwords will not be encrypted

• enable secret is not affected

Encryption Type Reference:

 

---

 

Modifying or Deleting Configuration Commands

Using the "no" Keyword

To remove or disable any configuration command, prefix it with no:

Examples:

Router(config)# no enable password

(Removes the enable password entirely)

Router(config)# no service password-encryption

(Disables automatic encryption of passwords)

Router(config)# no enable secret

(Removes the enable secret)

The no keyword is how you undo any configuration change in Cisco CLI.

 

---

 

Practical Workflow: Initial Device Configuration

Here's a typical sequence for configuring a new device:

Router> enable

(Enter Privileged EXEC Mode)

Router# configure terminal

(Enter Global Configuration Mode)

Router(config)# enable password mypassword

(Set weak password protection for privileged mode)

Router(config)# enable secret mysecretpassword

(Set strong password protection for privileged mode)

Router(config)# service password-encryption

(Encrypt plaintext passwords in config)

Router(config)# exit

(Return to Privileged EXEC Mode)

Router# write memory

(Save configuration to startup-config)

Router# show running-config

(Verify your changes)

 

---

 

Key Takeaways for CCNA

✅ Know the three modes: User EXEC (>), Privileged EXEC (#), Global Configuration (config#)

✅ Understand the two config files: running-config (active, temporary) and startup-config (saved, permanent)

✅ Use ? and TAB constantly — They're your best friends in the CLI

✅ Password security: Use enable secret (Type 5), not enable password (Type 7)

✅ Always save your work — Use write or copy running-config startup-config

✅ Use no to undo — It's the standard way to remove any configuration

✅ Case-sensitive — All CLI input, especially passwords, is case-sensitive

 

---

 

Common Commands Quick Reference