Cisco CCNA Command Guide For Beginners And Intermediates: A Practical Step By Step Guide to Cisco CCNA Routing And Switching Command Line

Welcome back to the deep dive. Today, we're really getting our hands dirty, jumping into the practical world of Cisco CCNA commands.

Yeah, exactly.

Imagine you're setting up a network from scratch, maybe for a new office, a growing startup. Where do you even begin?

Right?

Our mission for you today is basically to pull out the absolute must know bits, give you a kind of shortcut, you know, so you feel ready to connect some dots.

And what's really valuable here, I think, is that this guide we're looking at focuses on the commands you actually need. Beginner, intermediate level CCNA stuff, practical stuff exactly, stuff you can use on real gear or in the simulation labs for the exam. It's all about application.

Okay, So first things first, before any configuration, you got to connect things right.

Cabling the physical layer yep.

Sounds basic maybe, but here's where it gets interesting, Like choosing the wrong cable that can completely sink your network before you type a single command.

Oh absolutely, I've seen it happen. Hours wasted me too.

I remember, spending age is troubleshooting once only to find YEP, crossover cable where a straight through should have been. Total face palm moment happens to the best of us. So the guide really stresses mastering this. Know you're streight through your crossover, your rollover cables.

And the pinouts are key. It's the wiring inside, which pin connects to which get that wrong? No data flow, simple as that.

And once it's plugged in, you need to check the config on the actual computers.

Right, yeah, on the end devices, So like if you can FIG on Linux or Mac.

Or IP can fig if you're on Windows, Windows two thousand and up.

Basically, and this whole cabling thing, getting it right, it really sets the stage, doesn't it. Make sure you're not chasing hardware ghosts when the problem is actually software exactly.

You don't want to be troubleshooting routing protocols. If the cable's just.

Wrong, you're trying to drive a car with no wheels.

Essentially, good analogy. Okay, so physically connected, now they need addresses. They need to speak the language of IP. Right, let's talk IP subnetting. Sounds a bit scary, maybe you can see in that way, but we'll break it down. Think about those IP address classes ABC.

Mainly, Yeah, they're like different sizes of networks right.

So Class A starts with a zero first number is zero to one twenty seven. That's your massive network like an ocean liner holds millions of devices.

Huge organizations ISPs.

Maybe Class B starts one zero numbers one twenty eight to one ninety one. That's maybe more like a large cargo ship medium to large businesses makes sense. And Class C starts one one zero numbers one ninety two to two twenty three. That's your small fishing boat home networks small offices holds a couple hundred addresses.

Perfect for most smaller setups.

Then you have Class D for multicasting like video streams to many people at once.

Two hundred and twenty four to two thirty nine range.

And Class E, which is reserved experimental stuff two forty.

In up right, And the guide shows how computer see these numbers converting decimal to binary.

Yeah, like one ninety two becomes one hundred and one hundred thousand, or two twenty four is eleven hundred and fetter thousand.

So that familiar private IP one ninety two point one sixty eight point two five four point twenty five four The router sees it as a one one hundred zero zero zero zero one zero one one zero zero point one one one on a narrow point one one one one one one point one one one one one one one one binary.

Okay, So how does the router use that?

That's where binary ending comes in. It sounds technical, but it's fundamental. It's how devices figure out the network part of an address versus the host part.

Like separating the street name from the house number exactly.

It uses the IP address and the subnet mask. Think of it like a filter. Only where both the IP and the mask have a one bit, does a one come through in the result.

Okay?

The logic is simple zero no zero one and no zero zero one is a one bit only one on one gives you one, got it? So take that one ninety two point one sixty eight point two five four point two five four Again. If your mask is two five five point two five five point zero point zero, which is all ones in the first two oct it's when you endy them together binary style. Get one ninety two point one sixty eight point zero zero. That's the network number. That's how your device knows if another IP

Okay, that makes sense. So wired up addresses understood. Now, how do we talk to these Cisco devices, routers, switches.

That's the command line interface, the CLI, your.

Direct line in no fancy graphics, just task commands.

Pretty much. It's the primary way you can figure and manage Cisco gear.

And there are shortcuts right right to save.

Typing Oh yeah, tons of them, big time savers like typing COF then hitting the TB key It autocompletes to configure terminal nice or just for able to get into privilege mode.

Very handy, but you still need to know the full command for exams usually.

Definitely good point. The shortcuts are for efficiency on the job.

And what if you forget a command or aren't sure what options are available?

The question mark your best friend on the CLI? Yeah yep. Just type bought on its own shows you all commands in that mode. Type C or N shows commands starting C or N or type of command like clock, then a space then and it shows you what words or parameters can come next. Super helpful, like a built in.

What about the setup mode? The guide mentions is that useful?

Not really for most people. It kicks in automatically if a device has zero configuration.

Like brand new out of the box exactly, or you.

Can type set up. It's like a basic wizard, ask you questions, but it's very limited.

Can't do much with it.

Nope, basic IP stuff maybe a password, no ACLS, no NAT. Serious configuration requires the CLI. Most engineers skip.

It, gotcha, stick to the CLI definitely.

And speaking of the CLI, there are even more shortcuts, like keyboard shortcuts that really boost productivity. Oh like what well, Ctrl plus z is amazing, jumpt you right back to privileged mode from anywhere, and configu mode saves typing end or exit multiple times. Oh I like that. Ctrl plus F moves forward a character, ec plus b moves back a whole word. Ctrl plus e takes you to the end of the line you're typing.

Handy for fixing typos totally.

And then there's command history. Ctrl plus P recalls previous commands ctr we'll plug and recalls newer ones if you went back too.

Far, so you don't have to retype everything exactly.

And you can even control how many commands get remembered with terminal history size. And then a number. Default is often just ten, but you can bump it up maybe to fifty or one hundred max is two fifty six?

Why not? I always set it to max.

It uses a bit of router memory, probably not noticeable on modern gear, but something to be aware of. There's always a trade off. You can reset it with no terminal history size. Okay. Cool.

Now, once you're configuring things, you need to see what's going on right.

Verify stuff absolutely. That's where the show commands come in. They are indispensable your eyes and ears inside the device.

So if something's broken, where do you start? What are the key show commands?

Great question, It's less about memorizing a list and more about thinking what do I need to check? I tend to group them. Okay. First, basic connectivity and interfaces. Show interfaces status gives you a quick look at all ports of they up, down, connected, show interface fast Internet oh one or whatever. It gives you detailed staff for that specific port, error speed.

Duplex all right, checking the physical connection.

Then ipaddressing DOT show interface brief is fantastic, quick summary dot interface, IP address is that up status protocol dot super useful, And show ARP shows the mapping between IP addresses and MC addresses the device has learned. Crucial for Layer two troubleshooting makes sense.

What about the actual configuration.

That's where show running config comes in. Shows you the active configuration what the device is using right now from ramp absolutely vibe and you compare that to show startup canfig that's the config saved and NVRMP the one the loads on boot. If they're different, you know you haven't saved your changes. Ah, the classic mistake happens all the time. Then for routing, show ip rout that's your routing table. How does this router know how to reach different networks?

Configured, got it any others?

Show version is good for checking the iOS software version, uptime, hardware info. Show history dumps your command history buffer. Show flash shows you the flash memory contents, Show clock for the time, Show hosts for any local host named it mappings you've set up.

Wow. Okay, so show commands are really your window into the device.

Absolutely you live and breathe Show commands when managing Cisco gear.

Okay, let's zoom in on router. Specifically, they're the traffic cops directing packets between.

Networks, directing the traffic.

Yeah, and configuring them means understanding those different modes you mentioned earlier.

Right, you start in user mode usually just router prelimited. Then enable gets you to privileged mode rater hashtag. Here you can run show commands, debugs, save can figs, but still can't make changes. For changes, you need configure terminal or can fig for short. That takes you into global configuration mode router can fig hashtag. This is where the

Is different commands work in different modes.

Exactly, And first thing you usually do in global config get the writer or a.

Name post name R one or whatever post name name Yeah.

Yeah. Good practice for identification.

And security is paramount right passwords, oh absolute foundational.

You've got two main enabled passwords.

The ones to get into privileged mode.

Right enable password password is the old way stores in plaintext and the config bad idea to so avoid that one, yes, always use enable secret password. This one uses stronger encryption MT five hashing usually much more secure, and if you can figure both the enabled secret wins, it always overrides the enabled password.

Good to know. What about passwords for actually logging in, like over the console cable or remotely?

Yep, you secure those lines too, Line console zero for the console port line VTIO four typically covers the five virtual terminal lines for Telnet or SSH, LINEO zero for the auxiliary report. In the commands inside the line config mode, use password to set it, and then critically you must type log in to tell a router to actually check for that password on login.

Attempts okay password, then log in right.

And there's also service password encryption. This command applies a very weak encryption to all plaintext passwords in the config like the line passwords or if you foolishly used enable password.

Is it actually secure?

Not really, it's easily breakable. It just stops casual shoulder surfing. Enable secret is the only strong one built in for the enabled password. If you turn off service password encryption later, any passwords that weakly encrypted stay that way.

So just to be clear. Why is an able password such a bad idea? How quickly could that bite you?

Instantly? If anyone gets a copy of your config file, maybe a backup, maybe through some other access, they just read the password. It's right there, no guessing, no cracking required, enable secret hashes it so even seeing the config doesn't give away the password directly. It's a basic essential secure step.

Okay, message received, use an able secret. Now interfaces, the actual connections, how do we configure those?

Right? So you navigate using interface followed by the type in number like interface cereal zero zero zero, interface faceter and at zero zero.

And you warned the prompt doesn't always change.

Yeah, it might just say rote or configu hashagg regardless of whether you're in serial zero zero, fascinated at zero zero, keep track, exit moves you back up one level.

Okay. Let's say we're configuring a serial interface like for a WAN link.

Okay, so interface serial zero zero zero zero. Good practice to add a description like description link to main office helps document things and the IP address, app dress, subnetmask, standard stuff.

And the special thing for cereal the clock rate.

If you have the DCE cable, the one providing the timing signal for the link You must set the clock rate speed command on that interface only needed on the DCE side.

How do you know the speed?

Usually determined by the service provider or the capabilities of the link fin no shutdown to actually turn the interface on, They're off by default? No shutdown? Got it?

And for fast Ethernet like connecting to a land switch.

Simpler interface fast Ethernet zero zero maybe a description then IP address, IP address, subnet mask and no shutdown. No clock rate needed there?

Okay? What about those messages you sometimes see when you log into a device, like warnings or welcome messages.

Ah banners? Yeah, you could set those banner mot hashtag, message here, hashtag attag. The hashtag is a deliminter. You can use any character not nut in your message. MOTD stands for Message of the day. When does that show up after successful log in? Usually there's also banner log in hashtag message hashtag which shows up before the login prompt. MOOTD usually takes precedence if both are set. Good for legal disclaimers or warnings?

Cool? You mentioned show hosts earlier? Can you manually set those?

You can use IPPO host name, IP address so you could do IIP post server one one nine two point one sixty eight point one one one on a zero. Then on that router you could potentially ping server one instead of the IP. It's just a local mapping on that device.

Handy for remembering key servers.

Yeah, and related to look ups. By default, if you type something the router doesn't recognize as a command, it tries to resolve it via DNS, thinking it's a host name you want to connect.

To, and that can be slow. If you just made a typo.

Exactly, it hangs for a bit. Try to contact a DNS server. You can turn that off with no IP domain lookup. Saves a lot of frustration from typos.

Good tip. All right, any other really useful general commands we should know?

Yeah, a few life savers. No logging synchronous ever. Typing a command and a console message like percent link fine you be down? Yeah, pops up right in the middle of your line.

Yes, so annoying.

No logging synchronous stops that. It ensures your command prompt reappears cleanly below the message, so you don't lose your place.

Essential Okay, definitely using that one.

Then exact timeout sets how long a console or vty session can be idle before it logs you out. Yeah, exact time out one hundred zero means ten minutes, zero seconds, good security practice. What about zero zero means never time out? Big security hole. Don't do that on production.

Gear right, and saving your work crucial.

Copy running config, startup config, or copyrun start for short saves the act of config from RAM to envy RAM. If you don't do this and the router reboots, all gone, yep, mistake, you only make ones. You can also erase startup config to wipe the save config for starting fresh and copy running config. TFTP lets you back up your config to a TFTP serve on the network. Good for disaster recovery.

And that do command you mentioned right do.

Let's say you're deep in interface configuration mode. Router can fig ashtag ETI. Normally to see the running config, you'd have to type end then show running config.

Yeah, jump back out with do.

You can just type do show running config right there in interface mode. It executes the show command without making you leave config mode. Huge time saver, but it doesn't work for everything. Doesn't work for commands that change your mode, like configure terminal itself, but for most show commands, ping trace for it.

That's pert awesome, Okay configured. How do they learn about networks beyond the ones directly plugged into them?

Ah, Now we get into routing. How riders build their maps of the internetwork.

Starts with static routes the manual way.

Often yeah, simple scenarios. The command is that brot, then the destination network, then the subnet mask of that destination, than how to get there. How to get there could be either the IP address of the next router in the path, next hopyup, or the router's own exit interface

Simple enough, but they're temporary by default.

Yeah. If the interface used to reach the next hop goes down, the static route disappears. From the routing table. You can add the permanent keyword at the end if you want it to stay even if the interface is down. But that's less common.

Okay, But what if a router learn multiple ways to get to the same place, maybe a static route and also a dynamic protocol.

Excellent question. That's where administrative distance or AD comes in.

AD sounds important. It is.

It's a number from zero to two fifty five that represents how trustworthy a routing source is. Lower number means more trustworthy, So the.

Router picks the path with the lowest AD.

Exactly if it learns about the same network from two different sources, it installs the route with the lower AD into the routing table.

What are some typical AD values.

A directly connected network has an AD of zero. Can't be that it's plugged right in, makes sense. A static route has a default AD of one, very trustworthy because you manually configured it. Okay, Then the dynamic protocols EIGRP is ninety, OSPF is one ten, RIP is one twenty.

So EIGRP is preferred over OSPF, which is preferred over RIP. If they all offer a route.

By default, yes, and two fifty five means totally untrusted, the route won't be used.

Can you use this AD cleverly.

Absolutely, that's the idea behind and floating static routes. Imagine you're running EI g RP eighty ninety as your main routing protocol. You could configure a static route for the same destination, but manually give it a higher AD, say one hundred.

So normally the EIGRP route.

Is used, right, but if the e I goop route disappears, maybe the link fails, the router sees the static route with eighty one hundred is now the best path, and it floats into the routing table as a backup.

Ah cool, automatic backup.

Exactly intelligent failover using AD. And then there are default routes the route of last resource decisely ap route one ozero point zero point zero point zero point zero point zero, followed by the next hop or exit interface. It basically means, if you don't have a specific route for this destination at your table, send it here, usually points towards your ISP or core network, and you check all this one shoe iproot your main command for viewing the routing table

Okay, so static routes are manual. What about the dynamic ones you mentioned RIP E I g r POSPF right.

Those are the protocols routers used to automatically share routing information with each other, much more scalable for larger networks.

Let's maybe touch on each one briefly, starting with RIP sure.

RIP Routing Information Protocol. It's a pretty old simple distance vector protocol. You enable it with router RIP, then tell it what networks to advertise YEP using the network command. But crucially with RP version one and sometimes version two, you use the classical network number like network one nine two point one six eight point one one point zero, even if you're using subnets within.

That class four. Okay.

Version two is better supports subnet masks. It's common to use version two and no auto summary to stop it from doing unhelpful classful summarization. You might also use passive interface on interfaces facing users, so RIT updates don't go out there and troubleshooting debug IP RIP shows you the updates being sent or received. Also show a protocols gives you info about RIP timers and settings.

Got it next up E I g RP E I g.

RP Enhanced Interior Gateway Routing Protocol Cisco proprietary but very popular. It's an advanced distance sometimes called hybrid.

How do you turn it on?

Router I GRIP followed by an autonomous system number like router I GRIP one hundred. This as number must match on all routers you want to become neighbors.

Okay, as number is key. What else?

EIGRP uses metrics based on bandwidth and delay. By default, the bandwidth command on interface influences the calculation, but doesn't actually change the interface speed. It supports unequal cost load balancing using the variance command. Like RIP, no auto summary is usually recommended.

What about security?

EIGRP has robust MT five authentication. You create a key chain, define key numbers and key string passwords and apply it to the interface and choos. Routers only accept updates from trusted neighbors. Very important o'ifying EIGRP show at P c rep neighbors to see adjacent routers, show apic GRIP topology, shows the routes. EIGRP knows about debug I GRIP packets for deep troubleshooting.

Cool and finally, OSPF.

OSPF Open Shortest Path first industry standard link state protocol very scalable wide use.

How it's a configure router OS.

Followed by a process eight like router os one. This idea is just locally significant. It doesn't have to match between routers.

Okay, different from eigrp's AS number.

Right. Then you use the network command. But it's different here network IP address, wildcard mask, area, area card mask.

What's that?

It's like an inverted subnet maask zeros mean match this bit exactly, ones mean ignore this bit. So network one ninety two point one six eight point hero zero point two five to five. Area zero means enable OSPF on any interface whose IP starts with a one ninety two point one sixty eight point one. The area is crucial for osps's hierarchical design.

And loopback interfaces are important.

Often use for the routar eight. OSPF needs a unique ID for each router. A loopback interface IP is stable because it never goes down unless manually shut down, making it a good source for the router ID. What else is key for OSPF on multi access networks like ethernet, OSPF ALEXA designated router DR and backup DR. To manage adjacencies, you can influence this with EPUS five priority on the interface priority wins Priority zero means it can't become DRBDR.

Adjacency verifying OSPF show.

IP your ref of neighbor is key, show IP ASP of database shows the link state information, debug APAASP events helps troubleshoot adjacency issues. OSPF is powerful, especially in larger complex networks.

Okay, that's a whirlwind tour of routing. Let's switch gears. Now move from the wide area network down to the local network switches.

Right connecting devices within the same building or floor, typically managing local traffic.

Switches have modes like routers too, YEP user.

Mode, switch, privileged mode, switch, hashtag, global config. Very similar feel it is show commands many of the same show version, show running canfig but also switch specific ones like showflan, showmac address table, show interfaces status.

How do you configure basic switch info?

Pretty much like a router hostname name to say, the team. Password configuration is identical. Enable secret line console, zero line vt AoE fifteen switches often to have more vty lines, password log in service, password encryption.

Can you give us switch an IP address? I thought there were layer two devices?

Good question. They operate primarily at layer two. Yes, forwarding based on AIRP addresses. But for management, so you can telnet or SSH into the switch, you need an IP address where you can figure that on a switched virtual interface or SVII, usually interface FLAN one. By default, you go to that interface, assign an app address of address,

Huh okay, so the IP is just for managing the switch itself exactly.

You can also set interface descriptions, configure speed in duplex settings. Auto is common, but sometimes you need to hard code them.

And resetting a switch reload.

Restarts it right. A restartup config wipes the safe config but wiping VLAN infos different. You need to erase flash dot vland DOTU. Careful with that command, very careful, make sure you type the call incorrectly. Flash dot vland dot dot dat. If you just do a race flash, you could wipe the entire operating system.

Hikes. Okay, Switches work with MPO addresses, right, How do you manage those?

They learn app addresses automatically by looking at the source address of frames coming into each port. They build a macaddress table sometimes it's called a CAM table. You can see it with show Mac address table.

Can you clear it?

Yep? Clear macaddress table. Dynamic removes all learned addresses. Or you can specify an interface or VLAN.

Can you manually assign a MAC address to a port?

You can mac address table static macaddress landed interface type number. This permanently locks that MPOCK address to that specific port in that vland. Sometimes used for security or specific configurations.

Speaking of security, what about locking down ports preventing random people from plugging.

In AH port security crucial feature on switches Unless you control witch MACA addresses and how many are allowed to connect to a specific switch.

Port, how do you turn it on?

First, make sure the port is an access port, switchport mode access. Then switchport port security enables the feature on that interface.

Then you set the rules exactly.

Switchport port security maximum value says how many MAC addresses are allowed, often just one. Switchport port security mac address MAC address can statically define the allowed MAC or you can use switch court port security MAC address dicky to let the switch learn the first MA address it sees and stick it to the port.

What happens if someone violates the rule plugs in a different device That depends.

On the violation mode. You said it with switch port security violation shut down restrict.

Protect shutdowns sounds serious.

It is. The interface goes into an air disabled state, effectively shutting it down requires manual intervention to bring back ups drops the violate in traffic and sends log messages in S and MP traps. The port stays up, but the unauthorized device can't communicate. Protect simplest just drops the violating traffic, no logs port stays up. Shutdown is the most common secure default.

How do you check if port security tripped?

Show port security interface type number gives you all the details. Max addresses, current count, sticky ams, violation mode and security action count.

Okay, very useful. Now let's talk VLANs virtual lands right.

Breaking up one physical switch into multiple logical broadcast domains great for security organization performance.

How do you create them?

Simple? In global config land landed like land ten, then optionally name name like name sales.

VLAN ten is now called sales. How do you put ports into it?

Go into the interface canfig interface faster net zero one First make it an access port switchport mode access, then assign it switchboard access LAN ten, So.

Fazero one is now in the sales vlan. Can you do multiple ports at once?

Yes? Using the interface range their face range fasten it zero one ten than any commands you type applied to all ten ports. Very efficient. Verifying VLAN Chovelan brief is the best quick overview shows all vlands their names and which ports are assigned to them. You can also use chauvelin name sales or Chauvelan E ten.

How are VLANs saved? Is it in the startup configure?

Mostly? Yes? For standard range vilans one one thousand and five, they're actually saved in that VLAN dot dot file and flash memory we mentioned. Extended range villans one thousand and six four to ninety four might behave differently depending on the switch model and configuration.

Mode and clearing VLAN assignments.

On an interface no switch court access FLAN usually puts it back into VLAN one. The default to delete a vilan entirely use no VLAN ten, but be careful any ports still assigned to VLAN ten will become inactive. Best practice is to reassign the ports before deleting the VLAN good tip.

Okay, Last big topic connecting switches together and managing VLANs across multiple switches. Trunking and BTP right.

If you want multiple vlands to cross a link between two switches, you need a trunk, and VDP helps synchronize VLAN databases.

How does a trunk get formed?

Often automatically using DTP Dynamic trunking Protocol Cisco proprietary interface modes like Dynamic Auto or Dynamic Desirable negotiate, or you can manually force it with switchport mode. Trunk using switchport non negotiate turns off DTP if you hardcode it as a trunk or.

Access port and the trunk needs to know how to tag the traffic for different vlands.

Right, exactly. That's encapsulation. Two main types Cisco's old ISL and the industry standard IEE eight two point one Q often called DOT one Q. You can figure it with switchport trunk encapsulation is ATO dot one Q negotiate. Most modern networks use dot one Q if set to negotiate, it usually prefers isl Both sides support.

It, okay, Now, VTP VLAN trunking protocol.

This protocol lets one switch the VTP server manage the VLAN database for other switches VTP clients in the same VDP domain. You create VLAN twenty on the server and boom, it automatically appears on all the clients.

Saves a lot of work.

Huge time saver. In large networks, you can figure the VDP mode server client or transparent. Transparent switches manage their own vlands, but PASSVDP info. You said a VDP domain name and optionally a VTPU password password, then those have to match absolutely critical domain name and password must be identical case sensitive for switches to exchange VTP updates. A mismatch can cause big problems.

What's VTP pruning smart feature?

If enabled, VTP pruning switches tell their neighbors which VLANs they actually have active ports for. Then broadcast traffic for a specific VLAN is only sent across trunks if the neighboring switch actually needs that. VLAN reduces unnecessary.

Traffic verifying VTP.

So VTP status gives you the mode, domain name, revision number, very important pruning status, show VTP counters, shows update statistics.

Wow, we've covered a ton of ground, from basic cables and ips all the way to complex routing and switching configus.

We really have. It's the core toolkit for a CEC and a engineer.

So what does this all mean for you listening? You've just gotten, hopefully a really powerful shortcut to understanding these cor Cisco commands and concepts. We've tried to unpack everything from you know, literally how devices connect to how they talk across networks and how you manage them.

It really provides that foundational command structure. But this raises a final important question for you, yea, how will you take this structured knowledge, this theory and turn it into hands on practice?

Right reading about it is one thing.

Exactly We really recommend you get into simulation labs, packet tracer, GNS three, EVENG whatever works for you. Start typing these commands, build networks, break them, fix them. That's where the real learning happens, when you actually apply it