Day 4: Introduction to the CLI

Introduction to the CLI (Command Line Interface)
Overview
The CLI (Command Line Interface) is the text-based interface used to configure Cisco network devices.
Contrast: A GUI (Graphical User Interface) is a visual, point-and-click interface—less common in Cisco device administration.
 
 
Accessing the CLI: Physical Connection
Console Port Connection
When you first configure a Cisco device, you must physically connect via the Console Port.
Cable Options:
Rollover Cable (DB9 serial to RJ45)
Connects serial port on your computer to the RJ45 console port on the device
USB Adapter (DB9 serial to USB)
For computers without a native serial port (most modern laptops)
Terminal Emulator
To actually access the CLI after connecting the console cable:
Open a Terminal Emulator application on your PC
Popular choices: PuTTY, Cisco Packet Tracer, SecureCRT, Tera Term
Configure the connection as "Serial" with Cisco default settings (see below)
Cisco Default Serial Settings
These are the standard configuration settings for console access to Cisco devices:
Setting
Value
Speed (Baud Rate)
9600 bits/second
Data Bits
8
Stop Bits
1
Parity
None
Flow Control
None
 
 
Cisco CLI Modes
The CLI is organized into different modes, each with different capabilities and prompts.
Mode 1: User EXEC Mode (User Mode)
How to enter: This is the default mode when you first connect to the device.
Prompt: Router> (greater-than symbol)
Capabilities:
Very limited access
Can view some basic information about the device
Cannot make ANY changes to the device configuration
Read-only mode
Common User EXEC Commands:
enable — Switch to Privileged EXEC mode
? — Display available commands
help — Get help
Mode 2: Privileged EXEC Mode
How to enter: Type enable from User EXEC mode (may require password)
Prompt: Router# (hash/pound symbol)
Capabilities:
Full access to view device configuration
Can restart the device
Can save configuration files
Can change the system clock/time
Still cannot make configuration changes
This mode is for "executing" commands, not entering configuration
Common Privileged EXEC Commands:
configure terminal (or conf t) — Enter Global Configuration Mode
show running-config — View current active configuration
show startup-config — View configuration that loads on reboot
write or write memory — Save running config to startup config
exit — Go back to User EXEC mode
Mode 3: Global Configuration Mode
How to enter: From Privileged EXEC mode, type configure terminal or conf t
Prompt: Router(config)# (the word "config" appears in the prompt)
Capabilities:
Can make changes to the device configuration
Enter commands that modify how the device operates
Can set passwords, configure interfaces, enable services, etc.
Changes made here affect the running configuration (active config)
How to exit: Type exit to return to Privileged EXEC mode
Important: Changes made in Global Configuration Mode are temporary—they affect the running configuration but are lost if the device restarts. You must save them (with write or copy running-config startup-config) to make them permanent.
 
 
CLI Navigation Helpers
Question Mark (?)
The ? key provides context-sensitive help at ANY time and in ANY mode.
Uses:
View all available commands in current mode:
Router# ?
 Lists every command available at this prompt level
View commands that start with a specific letter or prefix:
Router(config)# conf ?
 Lists all commands starting with "conf"
View required parameters for a command:
Router# configure ?
 Shows what parameters are needed to complete the configure command
Pro tip: This is one of the most important tools in Cisco CLI—always use ? when you're unsure what to do.
TAB Key (Command Completion)
Press TAB to auto-complete a partially entered command.
How it works:
Type the first few letters of a command
Press TAB
If the command is unambiguous (only one match), it auto-completes
If multiple matches exist, nothing happens—add more letters to narrow it down
Example:
Router# conf<TAB>  → Router# configure
Router# conf t<TAB> → Router# configure terminal
 
 
Configuration Files
Cisco devices maintain two separate configuration files at all times:
Running Configuration (running-config)
The current, active configuration on the device
All commands you enter in the CLI edit this file in real-time
If the device restarts, this configuration is lost (unless saved)
Stored in RAM
Startup Configuration (startup-config)
The configuration file that loads when the device boots up
Used to restore the device configuration after a restart
Stored in NVRAM (non-volatile memory)
Persists even if power is lost
Viewing Configurations
From Privileged EXEC mode:
Router# show running-config    (view current active config)
Router# show startup-config    (view config that will load on reboot)
Saving Configuration (Making Changes Permanent)
To copy the running-config to startup-config, use any of these equivalent commands from Privileged EXEC mode:
Router# write
Router# write memory
Router# copy running-config startup-config
Destination filename [startup-config]? <ENTER>
All three commands accomplish the same thing—they save your changes so they survive a device restart.
 
 
Passwords and Security
Enable Password (Weak Encryption)
Purpose: Protects access to Privileged EXEC mode
Command (in Global Configuration Mode):
Router(config)# enable password (your-password)
Encryption Level:
Uses Type 7 encryption (Cisco proprietary)
Weak encryption—easy to crack
Passwords are visible as plaintext in the config file until encryption is enabled
Important: Passwords are case-sensitive.
Enable Secret (Strong Encryption)
Purpose: Also protects access to Privileged EXEC mode (overrides enable password)
Command (in Global Configuration Mode):
Router(config)# enable secret (your-password)
Encryption Level:
Uses Type 5 encryption (MD5 hashing)
Much stronger than Type 7
Should always be used over enable password
Passwords are always encrypted (even without service password-encryption)
Important Note: Once you set enable secret, it takes precedence over enable password. If both are configured, only enable secret is used.
Service Password-Encryption
Purpose: Automatically encrypts all passwords in the configuration file
Command (in Global Configuration Mode):
Router(config)# service password-encryption
What it does:
Converts plaintext passwords (like enable password) to Type 7 encrypted format
Future passwords entered will also be encrypted automatically
Does NOT affect enable secret (which is always encrypted anyway)
What happens if you disable it:
Router(config)# no service password-encryption
Current encrypted passwords remain encrypted (won't be decrypted)
Future passwords will not be encrypted
enable secret is not affected
Encryption Type Reference:
Type
Encryption Method
Strength
Notes
7
Cisco Proprietary
Weak
Used by service password-encryption
5
MD5 Hash
Strong
Used by enable secret
 
 
Modifying or Deleting Configuration Commands
Using the "no" Keyword
To remove or disable any configuration command, prefix it with no:
Examples:
Router(config)# no enable password
(Removes the enable password entirely)
Router(config)# no service password-encryption
(Disables automatic encryption of passwords)
Router(config)# no enable secret
(Removes the enable secret)
The no keyword is how you undo any configuration change in Cisco CLI.
 
 
Practical Workflow: Initial Device Configuration
Here's a typical sequence for configuring a new device:
Router> enable
(Enter Privileged EXEC Mode)
Router# configure terminal
(Enter Global Configuration Mode)
Router(config)# enable password mypassword
(Set weak password protection for privileged mode)
Router(config)# enable secret mysecretpassword
(Set strong password protection for privileged mode)
Router(config)# service password-encryption
(Encrypt plaintext passwords in config)
Router(config)# exit
(Return to Privileged EXEC Mode)
Router# write memory
(Save configuration to startup-config)
Router# show running-config
(Verify your changes)
 
 
Key Takeaways for CCNA
✅ Know the three modes: User EXEC (>), Privileged EXEC (#), Global Configuration (config#)
✅ Understand the two config files: running-config (active, temporary) and startup-config (saved, permanent)
✅ Use ? and TAB constantly — They're your best friends in the CLI
✅ Password security: Use enable secret (Type 5), not enable password (Type 7)
✅ Always save your work — Use write or copy running-config startup-config
✅ Use no to undo — It's the standard way to remove any configuration
✅ Case-sensitive — All CLI input, especially passwords, is case-sensitive
 
 
Common Commands Quick Reference
Task
Command
Mode
Switch to Privileged mode
enable
User EXEC
Enter config mode
configure terminal
Privileged EXEC
Exit current mode
exit
Any mode
View all commands
?
Any mode
View running config
show running-config
Privileged EXEC
View startup config
show startup-config
Privileged EXEC
Save config
write or write memory
Privileged EXEC
Set weak password
enable password (pass)
Global Config
Set strong password
enable secret (pass)
Global Config
Enable auto-encryption
service password-encryption
Global Config
Remove a command
no (command)
Global Config