Day 4: Introduction to the CLI

CCNAIntroduction 200-301to Study Guide: Device Management &the CLI Fundamentals(Command Line Interface)

Overview

MasteringThe initialCLI device(Command access and Command-Line Interface (CLI) navigationInterface) is the foundationtext-based forinterface allused to configure Cisco network configuration,devices.

troubleshooting,

Contrast: andA security hardening. These skills are central to Domain 1.0GUI (NetworkGraphical Fundamentals)User andInterface) Domainis 5.0a (Securityvisual, Fundamentals).point-and-click interface—less common in Cisco device administration.

 

---

 

1.0 EstablishingAccessing the InitialCLI: ConsolePhysical Connection

Console Port Connection

BeforeWhen network-basedyou protocolsfirst (SSH/Telnet)configure cana beCisco used,device, you must establishphysically "out-of-band"connect access. This isvia the onlyConsole reliable method for managing unconfigured devices.Port.

1.1

Cable Physical Hardware and CablingOptions:

• ConsoleRollover Port: A dedicated management portCable (RJ-45DB9 orserial USBto mini-B).RJ45)

• Rollover Cable: A specialized cable with reversed pinouts designed for serial communication.

  • USB-to-Serial Adapter: Required for modern PCs lacking native DB9Connects serial ports.port on your computer to the RJ45 console port on the device

• CriticalUSB Note:Adapter A(DB9 rolloverserial cableto isUSB)

  electrically

incompatible

with standard

For Ethernetcomputers signaling. Usingwithout a standardnative Ethernetserial cableport in(most amodern laptops)

Terminal Emulator

To actually access the CLI after connecting the console port will not work and may cause hardware damage.cable:

1.2

Open a Terminal Emulator Configuration

application on your PC

UsePopular anchoices: applicationPuTTY, likeCisco PuTTYPacket orTracer, SecureCRT, Tera Term

Configure the connection as "Serial" with Cisco default settings (see below)

Cisco Default Serial Settings

These are the followingstandard preciseconfiguration serialsettings settings:for console access to Cisco devices:

 

---

 

2.0 Mastering the Cisco IOSCLI CLIModes

The CiscoCLI Internetworkis Operatingorganized Systeminto different modes, each with different capabilities and prompts.

Mode 1: User EXEC Mode (IOS)User usesMode)

How to enter: This is the default mode when you first connect to the device.

Prompt: Router> (greater-than symbol)

Capabilities:

Very limited access

Can view some basic information about the device

Cannot make ANY changes to the device configuration

Read-only mode

Common User EXEC Commands:

enable — Switch to Privileged EXEC mode

? — Display available commands

help — Get help

Mode 2: Privileged EXEC Mode

How to enter: Type enable from User EXEC mode (may require password)

Prompt: Router# (hash/pound symbol)

Capabilities:

Full access to view device configuration

Can restart the device

Can save configuration files

Can change the system clock/time

Still cannot make configuration changes

This mode is for "executing" commands, not entering configuration

Common Privileged EXEC Commands:

configure terminal (or conf t) — Enter Global Configuration Mode

show running-config — View current active configuration

show startup-config — View configuration that loads on reboot

write or write memory — Save running config to startup config

exit — Go back to User EXEC mode

Mode 3: Global Configuration Mode

How to enter: From Privileged EXEC mode, type configure terminal or conf t

Prompt: Router(config)# (the word "config" appears in the prompt)

Capabilities:

Can make changes to the device configuration

Enter commands that modify how the device operates

Can set passwords, configure interfaces, enable services, etc.

Changes made here affect the running configuration (active config)

How to exit: Type exit to return to Privileged EXEC mode

Important: Changes made in Global Configuration Mode are temporary—they affect the running configuration but are lost if the device restarts. You must save them (with write or copy running-config startup-config) to make them permanent.

 

---

 

CLI Navigation Helpers

Question Mark (?)

The ? key provides context-sensitive help at ANY time and in ANY mode.

Uses:

View all available commands in current mode:

Router# ?

 Lists every command available at this prompt level

View commands that start with a hierarchicalspecific letter or prefix:

Router(config)# conf ?

 Lists all commands starting with "conf"

View required parameters for a command:

Router# configure ?

 Shows what parameters are needed to complete the configure command

Pro tip: This is one of the most important tools in Cisco CLI—always use ? when you're unsure what to do.

TAB Key (Command Completion)

Press TAB to auto-complete a partially entered command.

How it works:

Type the first few letters of a command

Press TAB

If the command is unambiguous (only one match), it auto-completes

If multiple matches exist, nothing happens—add more letters to narrow it down

Example:

Router# conf<TAB>  → Router# configure

Router# conf t<TAB> → Router# configure terminal

 

---

 

Configuration Files

Cisco devices maintain two separate configuration files at all times:

Running Configuration (running-config)

The current, active configuration on the device

All commands you enter in the CLI edit this file in real-time

If the device restarts, this configuration is lost (unless saved)

Stored in RAM

Startup Configuration (startup-config)

The configuration file that loads when the device boots up

Used to restore the device configuration after a restart

Stored in NVRAM (non-volatile memory)

Persists even if power is lost

Viewing Configurations

From Privileged EXEC mode:

Router# show running-config    (view current active config)

Router# show startup-config    (view config that will load on reboot)

Saving Configuration (Making Changes Permanent)

To copy the running-config to startup-config, use any of these equivalent commands from Privileged EXEC mode:

Router# write

Router# write memory

Router# copy running-config startup-config

Destination filename [startup-config]? <ENTER>

All three commands accomplish the same thing—they save your changes so they survive a device restart.

 

---

 

Passwords and Security

Enable Password (Weak Encryption)

Purpose: Protects access to Privileged EXEC mode

Command (in Global Configuration Mode):

Router(config)# enable password (your-password)

Encryption Level:

Uses Type 7 encryption (Cisco proprietary)

Weak encryption—easy to crack

Passwords are visible as plaintext in the config file until encryption is enabled

Important: Passwords are case-sensitive.

Enable Secret (Strong Encryption)

Purpose: Also protects access to Privileged EXEC mode structure(overrides enable password)

Command (in Global Configuration Mode):

Router(config)# enable secret (your-password)

Encryption Level:

Uses Type 5 encryption (MD5 hashing)

Much stronger than Type 7

Should always be used over enable password

Passwords are always encrypted (even without service password-encryption)

Important Note: Once you set enable secret, it takes precedence over enable password. If both are configured, only enable secret is used.

Service Password-Encryption

Purpose: Automatically encrypts all passwords in the configuration file

Command (in Global Configuration Mode):

Router(config)# service password-encryption

What it does:

Converts plaintext passwords (like enable password) to preventType accidental7 configurationencrypted errors by restricting sensitive commands to specific modes.format

2.1

The Hierarchy

Future ofpasswords CLIentered Modeswill also be encrypted automatically

Does NOT affect enable secret (which is always encrypted anyway)

What happens if you disable it:

Router(config)# no service password-encryption

Current encrypted passwords remain encrypted (won't be decrypted)

Future passwords will not be encrypted

enable secret is not affected

Encryption Type Reference:

 

---

 

Modifying or Deleting Configuration Commands

Using the "no" Keyword

To remove or disable any configuration command, prefix it with no:

Examples:

Router(config)# no enable password

(Removes the enable password entirely)

Router(config)# no service password-encryption

(Disables automatic encryption of passwords)

Router(config)# no enable secret

(Removes the enable secret)

The no keyword is how you undo any configuration change in Cisco CLI.

 

---

 

Practical Workflow: Initial Device Configuration

Here's a typical sequence for configuring a new device:

Router> enable

(Enter Privileged EXEC Mode)

Router# configure terminal

(Enter Global Configuration Mode)

Router(config)# enable password mypassword

(Set weak password protection for privileged mode)

Router(config)# enable secret mysecretpassword

(Set strong password protection for privileged mode)

Router(config)# service password-encryption

(Encrypt plaintext passwords in config)

Router(config)# exit

(Return to Privileged EXEC Mode)

Router# write memory

(Save configuration to startup-config)

Router# show running-config

(Verify your changes)

 

---

 

Key Takeaways for CCNA

✅ Know the three modes: User EXEC (>), Privileged EXEC (#), Global Configuration (config#)

✅ Understand the two config files: running-config (active, temporary) and startup-config (saved, permanent)

✅ Use ? and TAB constantly — They're your best friends in the CLI

✅ Password security: Use enable secret (Type 5), not enable password (Type 7)

✅ Always save your work — Use write or copy running-config startup-config

✅ Use no to undo — It's the standard way to remove any configuration

✅ Case-sensitive — All CLI input, especially passwords, is case-sensitive

 

---

 

Common Commands Quick Reference

2.2 Navigation & Productivity Shortcuts

3.0 Core Device Configuration and Security

3.1 Establishing Identity and Access

Hostname: Use hostname [Name] in Global Config to identify the device.

Securing Privileged Access:

enable password: Insecure. Stores password in plain text. Do not use.

enable secret: Best Practice. Stores password as a strong cryptographic hash.

Precedence Rule: If both are configured, the device always enforces the enable secret and ignores the plain-text password.

3.2 Password Obfuscation & Reversal

service password-encryption: Applies weak, reversible encryption to plain-text passwords to prevent "shoulder surfing."

The no Command: Prefix any command with no to remove or reverse it (e.g., no hostname).

4.0 Managing and Saving Configuration Files

It is vital to distinguish between active (volatile) memory and permanent storage.

4.1 The Two Key Configuration Files

4.2 Persisting Changes

To save active changes, you must copy the running configuration to the startup configuration:

copy running-config startup-config

5.0 Study Summary: Critical Recall

Console Settings: 9600, 8, N, 1 (8-N-1).

Access Escalation: User EXEC $\rightarrow$ enable $\rightarrow$ Privileged EXEC $\rightarrow$ conf t $\rightarrow$ Global Config.

Encryption Best Practice: Always use enable secret over enable password.

Final Step: Always perform a copy run start before exiting your session to ensure changes survive a reboot.