# Day 4: Introduction to the CLI

# Introduction to the CLI (Command Line Interface)

## Overview

The CLI (Command Line Interface) is the text-based interface used to configure Cisco network devices.

Contrast: A GUI (Graphical User Interface) is a visual, point-and-click interface—less common in Cisco device administration.

---

## Accessing the CLI: Physical Connection

### Console Port Connection

When you first configure a Cisco device, you must physically connect via the Console Port.

Cable Options:

- Rollover Cable (DB9 serial to RJ45)
- Connects serial port on your computer to the RJ45 console port on the device

- USB Adapter (DB9 serial to USB)
- For computers without a native serial port (most modern laptops)


### Terminal Emulator

To actually access the CLI after connecting the console cable:

1. Open a Terminal Emulator application on your PC
- Popular choices: PuTTY, Cisco Packet Tracer, SecureCRT, Tera Term

3. Configure the connection as "Serial" with Cisco default settings (see below)

### Cisco Default Serial Settings

These are the standard configuration settings for console access to Cisco devices:

<div align="left" dir="ltr" id="bkmrk-setting-value-speed-"><table><colgroup><col width="136"></col><col width="123"></col></colgroup><tbody><tr><td>Setting

</td><td>Value

</td></tr><tr><td>Speed (Baud Rate)

</td><td>9600 bits/second

</td></tr><tr><td>Data Bits

</td><td>8

</td></tr><tr><td>Stop Bits

</td><td>1

</td></tr><tr><td>Parity

</td><td>None

</td></tr><tr><td>Flow Control

</td><td>None

</td></tr></tbody></table>

</div>---

## Cisco CLI Modes

The CLI is organized into different modes, each with different capabilities and prompts.

### Mode 1: User EXEC Mode (User Mode)

How to enter: This is the default mode when you first connect to the device.

Prompt: Router&gt; (greater-than symbol)

Capabilities:

- Very limited access
- Can view some basic information about the device
- Cannot make ANY changes to the device configuration
- Read-only mode

Common User EXEC Commands:

- enable — Switch to Privileged EXEC mode
- ? — Display available commands
- help — Get help

### Mode 2: Privileged EXEC Mode

How to enter: Type enable from User EXEC mode (may require password)

Prompt: Router# (hash/pound symbol)

Capabilities:

- Full access to view device configuration
- Can restart the device
- Can save configuration files
- Can change the system clock/time
- Still cannot make configuration changes
- This mode is for "executing" commands, not entering configuration

Common Privileged EXEC Commands:

- configure terminal (or conf t) — Enter Global Configuration Mode
- show running-config — View current active configuration
- show startup-config — View configuration that loads on reboot
- write or write memory — Save running config to startup config
- exit — Go back to User EXEC mode

### Mode 3: Global Configuration Mode

How to enter: From Privileged EXEC mode, type configure terminal or conf t

Prompt: Router(config)# (the word "config" appears in the prompt)

Capabilities:

- Can make changes to the device configuration
- Enter commands that modify how the device operates
- Can set passwords, configure interfaces, enable services, etc.
- Changes made here affect the running configuration (active config)

How to exit: Type exit to return to Privileged EXEC mode

Important: Changes made in Global Configuration Mode are temporary—they affect the running configuration but are lost if the device restarts. You must save them (with write or copy running-config startup-config) to make them permanent.

---

## CLI Navigation Helpers

### Question Mark (?)

The ? key provides context-sensitive help at ANY time and in ANY mode.

Uses:

View all available commands in current mode:  
  
Router# ?

1. Lists every command available at this prompt level

View commands that start with a specific letter or prefix:  
  
Router(config)# conf ?

2. Lists all commands starting with "conf"

View required parameters for a command:  
  
Router# configure ?

3. Shows what parameters are needed to complete the configure command

Pro tip: This is one of the most important tools in Cisco CLI—always use ? when you're unsure what to do.

### TAB Key (Command Completion)

Press TAB to auto-complete a partially entered command.

How it works:

- Type the first few letters of a command
- Press TAB
- If the command is unambiguous (only one match), it auto-completes
- If multiple matches exist, nothing happens—add more letters to narrow it down

Example:

Router# conf&lt;TAB&gt; → Router# configure

Router# conf t&lt;TAB&gt; → Router# configure terminal

#   


---

## Configuration Files

Cisco devices maintain two separate configuration files at all times:

### Running Configuration (running-config)

- The current, active configuration on the device
- All commands you enter in the CLI edit this file in real-time
- If the device restarts, this configuration is lost (unless saved)
- Stored in RAM

### Startup Configuration (startup-config)

- The configuration file that loads when the device boots up
- Used to restore the device configuration after a restart
- Stored in NVRAM (non-volatile memory)
- Persists even if power is lost

### Viewing Configurations

From Privileged EXEC mode:

Router# show running-config (view current active config)

#   


Router# show startup-config (view config that will load on reboot)

#   


### Saving Configuration (Making Changes Permanent)

To copy the running-config to startup-config, use any of these equivalent commands from Privileged EXEC mode:

Router# write

#   


Router# write memory

#   


Router# copy running-config startup-config

Destination filename \[startup-config\]? &lt;ENTER&gt;

#   


All three commands accomplish the same thing—they save your changes so they survive a device restart.

---

## Passwords and Security

### Enable Password (Weak Encryption)

Purpose: Protects access to Privileged EXEC mode

Command (in Global Configuration Mode):

Router(config)# enable password (your-password)

#   


Encryption Level:

- Uses Type 7 encryption (Cisco proprietary)
- Weak encryption—easy to crack
- Passwords are visible as plaintext in the config file until encryption is enabled

Important: Passwords are case-sensitive.

### Enable Secret (Strong Encryption)

Purpose: Also protects access to Privileged EXEC mode (overrides enable password)

Command (in Global Configuration Mode):

Router(config)# enable secret (your-password)

#   


Encryption Level:

- Uses Type 5 encryption (MD5 hashing)
- Much stronger than Type 7
- Should always be used over enable password
- Passwords are always encrypted (even without service password-encryption)

Important Note: Once you set enable secret, it takes precedence over enable password. If both are configured, only enable secret is used.

### Service Password-Encryption

Purpose: Automatically encrypts all passwords in the configuration file

Command (in Global Configuration Mode):

Router(config)# service password-encryption

#   


What it does:

- Converts plaintext passwords (like enable password) to Type 7 encrypted format
- Future passwords entered will also be encrypted automatically
- Does NOT affect enable secret (which is always encrypted anyway)

What happens if you disable it:

Router(config)# no service password-encryption

#   


- Current encrypted passwords remain encrypted (won't be decrypted)
- Future passwords will not be encrypted
- enable secret is not affected

Encryption Type Reference:

<div align="left" dir="ltr" id="bkmrk-type-encryption-meth"><table><colgroup><col width="48"></col><col width="150"></col><col width="74"></col><col width="283"></col></colgroup><tbody><tr><td>Type

</td><td>Encryption Method

</td><td>Strength

</td><td>Notes

</td></tr><tr><td>7

</td><td>Cisco Proprietary

</td><td>Weak

</td><td>Used by service password-encryption

</td></tr><tr><td>5

</td><td>MD5 Hash

</td><td>Strong

</td><td>Used by enable secret

</td></tr></tbody></table>

</div>---

## Modifying or Deleting Configuration Commands

### Using the "no" Keyword

To remove or disable any configuration command, prefix it with no:

Examples:

Router(config)# no enable password

(Removes the enable password entirely)

#   


Router(config)# no service password-encryption

(Disables automatic encryption of passwords)

#   


Router(config)# no enable secret

(Removes the enable secret)

#   


The no keyword is how you undo any configuration change in Cisco CLI.

---

## Practical Workflow: Initial Device Configuration

Here's a typical sequence for configuring a new device:

Router&gt; enable

(Enter Privileged EXEC Mode)

#   


Router# configure terminal

(Enter Global Configuration Mode)

#   


Router(config)# enable password mypassword

(Set weak password protection for privileged mode)

#   


Router(config)# enable secret mysecretpassword

(Set strong password protection for privileged mode)

#   


Router(config)# service password-encryption

(Encrypt plaintext passwords in config)

#   


Router(config)# exit

(Return to Privileged EXEC Mode)

#   


Router# write memory

(Save configuration to startup-config)

#   


Router# show running-config

(Verify your changes)

#   


---

## Key Takeaways for CCNA

✅ Know the three modes: User EXEC (&gt;), Privileged EXEC (#), Global Configuration (config#)

✅ Understand the two config files: running-config (active, temporary) and startup-config (saved, permanent)

✅ Use ? and TAB constantly — They're your best friends in the CLI

✅ Password security: Use enable secret (Type 5), not enable password (Type 7)

✅ Always save your work — Use write or copy running-config startup-config

✅ Use no to undo — It's the standard way to remove any configuration

✅ Case-sensitive — All CLI input, especially passwords, is case-sensitive

---

## Common Commands Quick Reference

<div align="left" dir="ltr" id="bkmrk-task-command-mode-sw"><table><colgroup><col width="185"></col><col width="226"></col><col width="127"></col></colgroup><tbody><tr><td>Task

</td><td>Command

</td><td>Mode

</td></tr><tr><td>Switch to Privileged mode

</td><td>enable

</td><td>User EXEC

</td></tr><tr><td>Enter config mode

</td><td>configure terminal

</td><td>Privileged EXEC

</td></tr><tr><td>Exit current mode

</td><td>exit

</td><td>Any mode

</td></tr><tr><td>View all commands

</td><td>?

</td><td>Any mode

</td></tr><tr><td>View running config

</td><td>show running-config

</td><td>Privileged EXEC

</td></tr><tr><td>View startup config

</td><td>show startup-config

</td><td>Privileged EXEC

</td></tr><tr><td>Save config

</td><td>write or write memory

</td><td>Privileged EXEC

</td></tr><tr><td>Set weak password

</td><td>enable password (pass)

</td><td>Global Config

</td></tr><tr><td>Set strong password

</td><td>enable secret (pass)

</td><td>Global Config

</td></tr><tr><td>Enable auto-encryption

</td><td>service password-encryption

</td><td>Global Config

</td></tr><tr><td>Remove a command

</td><td>no (command)

</td><td>Global Config

</td></tr></tbody></table>

</div>