Cisco Internetwork Operating System (IOS) Fundamentals

Learn Cisco IOS fundamentals, device memory, boot process, CLI modes, configuration management, verification commands, SSH access, and basic hardening for CCNA.

Cisco Internetwork Operating System (Cisco IOS) is the network operating system used on many Cisco routers, switches, and other network devices. It provides the software functions needed to start the device, control hardware, forward packets, configure features, and manage the device locally or remotely.

This lesson introduces the Cisco IOS command-line interface (CLI), device memory, startup behavior, configuration files, common commands, and basic management security. It assumes familiarity with routers, switches, interfaces, IP addressing, and the difference between volatile and nonvolatile storage.

What Cisco IOS Does

An operating system is the software layer that manages hardware and provides services to users and applications. Cisco IOS performs this role on supported Cisco network devices.

Startup functions: initializes the device and loads the operating system.
Hardware control: manages interfaces, processors, memory, and platform-specific components.
Packet forwarding: uses configured and learned information to move traffic through the device.
Configuration: provides commands for features such as interfaces, routing, VLANs, access control, and management.
Management access: supports console, auxiliary where available, Telnet, SSH, and other management methods.
Verification and troubleshooting: provides commands such as show, clear, and debug.

IOS is software, not the physical device. A router or switch is the hardware platform containing processors, memory, interfaces, and storage. IOS is the software image loaded onto that platform. The same IOS release cannot necessarily run on every Cisco platform because images depend on hardware architecture, platform family, features, and licensing.

Cisco Device Memory and Storage

Cisco devices use several memory types for different purposes. The exact implementation varies by platform, but the following model is fundamental for CCNA study.

Component	Volatile or nonvolatile	Typical contents	Effect of reload
ROM	Nonvolatile	POST, bootstrap code, and recovery-related code such as ROMMON on applicable platforms	Contents remain available
Flash memory	Nonvolatile	IOS images, boot files, and other stored files	Contents remain available
RAM	Volatile	Running configuration, routing tables, switching data, buffers, processes, and temporary operational data	Contents are lost and rebuilt during startup
NVRAM	Nonvolatile	Startup configuration on platforms that use NVRAM for this purpose	Saved contents remain available

IOS Image versus Configuration File

An IOS image is a software file containing operating system code. It is commonly stored in flash memory and loaded into RAM during boot. The image supplies the commands and device functions supported by that release.

A configuration file is a set of settings that tells IOS how to operate. It can contain a hostname, interface addresses, routing settings, passwords, line settings, and many other values. A configuration file is not an operating system and cannot replace an IOS image.

The running-config is the active configuration held in RAM. The startup-config is the saved configuration normally loaded at startup and is traditionally stored in NVRAM. Because RAM is volatile, changes made only to the running configuration disappear after a reload or power loss.

IOS Startup and Boot Process

At a high level, a Cisco device follows this sequence:

POST: Power-on self-test checks important hardware components.
Bootstrap: Startup code initializes hardware and determines how to find and load the IOS image.
IOS loading: The device locates an appropriate image, commonly in flash memory, and loads it into RAM.
Startup configuration loading: IOS looks for a saved startup configuration and applies it to create the running configuration.
CLI availability: The device presents a management prompt after startup completes.

When a valid IOS image and startup configuration are available, the device normally boots IOS and applies the saved settings without requiring interactive setup.

Recovery Situations

If a usable IOS image cannot be found or loaded, a device may enter a low-level recovery environment called ROMMON, short for ROM monitor. ROMMON supports platform-specific recovery and boot operations but is not the normal IOS CLI.

If no startup configuration is available, the device may offer setup mode, sometimes called the initial configuration dialog. Setup mode asks a series of questions to create an initial configuration. Experienced administrators commonly choose a controlled manual configuration instead of relying on a questionnaire.

The configuration register is a boot-related setting that influences behavior on applicable platforms. It can affect how the device finds an IOS image, whether a saved configuration is loaded, and related startup behavior. Configuration-register changes are recovery or maintenance operations; do not alter them casually.

Accessing the IOS CLI

The CLI, or command-line interface, is a text-based method for entering IOS commands and viewing output.

Method	Transport security	Typical use	Recommended status
Console	Local physical connection; not a network transport	Initial setup, recovery, and local administration	Essential for first access and recovery
Auxiliary connection	Depends on the attached access method; available only on some devices	Out-of-band or modem-based administration	Use only when required and properly secured
Telnet	Unencrypted	Remote CLI access on legacy or controlled networks	Generally avoid in production
SSH	Encrypted	Remote CLI administration	Preferred remote method

Console access commonly requires a console cable, a suitable device port, and terminal-emulation software. The terminal program must use settings appropriate to the device and connection, such as the correct serial port and console speed.

SSH is preferred over Telnet because Telnet sends the session, including credentials, without encryption. SSH protects the remote management session in transit. SSH still requires correct IP reachability, authentication, keys, and line configuration.

The prompt displays useful context. The text before the ending character is normally the hostname. A prompt ending in > indicates user EXEC mode, while one ending in # indicates privileged EXEC mode or a configuration mode.

IOS Command Modes

IOS separates commands into modes. The current mode controls which commands are available and what a command can change.

Mode	Typical prompt	How to enter	Typical tasks	How to exit
User EXEC	`Router>`	Initial CLI access	Limited monitoring and basic connectivity tests	`enable`
Privileged EXEC	`Router#`	`enable`	Administrative verification, file operations, and access to configuration mode	`disable` or `exit`
Global configuration	`Router(config)#`	`configure terminal`	Device-wide settings such as hostname and security	`exit` or `end`
Interface configuration	`Router(config-if)#`	`interface GigabitEthernet 0/0`	Interface addresses, descriptions, and state settings	`exit` or `end`
Line configuration	`Router(config-line)#`	`line console 0` or `line vty 0 4`	Console, auxiliary, and remote terminal access settings	`exit` or `end`
Router configuration	`Router(config-router)#`	For example, `router ospf 1`	Routing protocol settings	`exit` or `end`
VLAN configuration	`Switch(config-vlan)#`	`vlan 10`	VLAN name and VLAN-specific settings	`exit` or `end`

Mode Transition Example

Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet 0/0
Router(config-if)# exit
Router(config)# end
Router# disable
Router>

exit moves back one level. For example, it moves from interface configuration to global configuration. end returns directly to privileged EXEC mode from a configuration mode. disable moves from privileged EXEC to user EXEC.

IOS Command Syntax and Help

IOS commands are made from keywords and arguments. A keyword is a fixed word recognized by IOS, such as show or hostname. An argument is a value supplied by the administrator, such as a device name or interface number.

Some commands have required parameters; others have optional parameters. For example, hostname requires a name, while many show commands accept additional options.

Context-Sensitive Help

Enter ? to display commands or parameters valid at the current position. The results depend on the current mode and the text already entered.

Router# show ?
Router# show ip ?
Router# show ip interface ?

Inline help is especially useful when a command is rejected. Place ? after the last accepted word to discover what IOS expects next.

Completion, History, and Abbreviations

Press Tab to complete an unambiguous command or keyword.
Use the Up and Down arrow keys, or equivalent terminal controls, to recall commands.
Use show history to display recently entered commands when supported.
IOS permits abbreviated commands when the abbreviation is unique in the current context.
Avoid relying on short abbreviations in documentation or operational procedures because new commands or features can make an abbreviation ambiguous.

The no form generally removes or reverses a configuration setting. For example, no shutdown enables an interface that was administratively disabled, while shutdown disables it. Some commands support default to restore a feature or command to its default behavior.

Router(config)# no hostname OldName
Router(config-if)# no shutdown
Router(config-if)# default description

Running and Startup Configuration

Characteristic	running-config	startup-config
Location	RAM	Normally NVRAM or platform-equivalent nonvolatile storage
Purpose	Active settings currently used by IOS	Saved settings used during the next normal boot
Change behavior	Configuration commands affect it immediately	Changes only when explicitly saved or copied
Effect of reload	Lost and rebuilt	Read during startup
View command	`show running-config`	`show startup-config`

Configuration changes made in configuration mode affect the running configuration immediately. To preserve intended changes across a reload, copy the active configuration to the startup configuration.

Router# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

Before saving, review the change. Saving an incorrect configuration makes it the configuration the device will normally use after its next reload. Conversely, reloading before saving causes unsaved changes to disappear.

Inspection and Backup

Router# show running-config
Router# show startup-config
Router# show flash:
Router# show version

Backups should be stored in a controlled local location or on an approved network file server. Confirm the destination, protect backup files because they may contain secrets, record the device and configuration date, and verify that a restore procedure is available. Use change control for restoring or replacing a production configuration.

Basic Navigation and Verification Commands

Command	Mode	Purpose	Example use
`show version`	Privileged EXEC	Displays IOS version, image information, hardware, uptime, and boot details	`show version`
`show running-config`	Privileged EXEC	Displays the active configuration	`show running-config`
`show startup-config`	Privileged EXEC	Displays the saved configuration	`show startup-config`
`show ip interface brief`	Privileged EXEC	Summarizes interface IP addresses and status	`show ip interface brief`
`show interfaces`	Privileged EXEC	Displays detailed interface counters and operational information	`show interfaces GigabitEthernet 0/0`
`show flash:`	Privileged EXEC	Lists files and available flash storage	`show flash:`
`show history`	EXEC	Displays recently entered commands	`show history`

EXEC commands inspect or operate on the device. Configuration commands change settings and are available only in the relevant configuration mode. If a command is rejected, first check the prompt and use ? to determine whether the command belongs in another mode.

Filtering Output

Many IOS displays support a pipe followed by a filter. The exact filters can vary by platform and release.

Router# show running-config | include hostname
Router# show running-config | exclude shutdown
Router# show running-config | begin line vty

include displays lines containing specified text.
exclude hides lines containing specified text.
begin starts output at the first matching line.

clear commands remove or reset operational information, such as counters or learned state. Use them carefully because they can affect troubleshooting evidence or live operation. debug commands produce detailed real-time diagnostic output and can consume CPU, memory, and terminal bandwidth. Use debugging briefly, during controlled troubleshooting, and disable it afterward with undebug all or the platform-appropriate command.

IOS Images, Releases, and Licensing

IOS images vary by platform, IOS family or release, supported feature set, and licensing. A command available on one device may be absent on another because of hardware, software release, or license limitations.

Use verification commands to identify the running image and version:

Router# show version
Router# show flash:

show version commonly identifies the software version, image filename, hardware platform, memory, and boot information. show flash: helps identify stored image files and available space.

Basic IOS Hardening

Initial hardening should protect privileged access, local console access, and remote management lines. Apply settings in a lab first and adapt them to the organization’s security policy.

Hostname and Privileged Access

Router> enable
Router# configure terminal
Router(config)# hostname Edge-Router
Edge-Router(config)# enable secret Use-A-Strong-Secret
Edge-Router(config)# end

enable secret protects entry into privileged EXEC mode and is preferred to the older enable password. Use a strong, unique secret. The hostname also makes prompts and logs easier to interpret.

Console Line Protection

Edge-Router# configure terminal
Edge-Router(config)# line console 0
Edge-Router(config-line)# login
Edge-Router(config-line)# exec-timeout 10 0
Edge-Router(config-line)# exit
Edge-Router(config)# end

The login command tells the line to require the configured line password when one is present. In modern configurations, local username authentication is generally preferred where supported. exec-timeout 10 0 disconnects an inactive EXEC session after ten minutes.

Local Users and SSH

Edge-Router# configure terminal
Edge-Router(config)# username admin secret Use-A-Different-Strong-Secret
Edge-Router(config)# ip domain-name example.local
Edge-Router(config)# crypto key generate rsa
Edge-Router(config)# ip ssh version 2
Edge-Router(config)# line vty 0 4
Edge-Router(config-line)# login local
Edge-Router(config-line)# transport input ssh
Edge-Router(config-line)# exec-timeout 10 0
Edge-Router(config-line)# end

SSH setup also requires a reachable management IP address and suitable interface and routing configuration. RSA keys are required on many IOS platforms before SSH can operate. The exact key-generation prompts and supported key sizes depend on the release.

service password-encryption can obscure some plaintext line passwords in the configuration, but it is not a substitute for strong secrets or encryption. Its protection is limited and should not be treated as a complete security control.

Warning Banner

Edge-Router# configure terminal
Edge-Router(config)# banner motd #Authorized access only. Disconnect immediately if unauthorized.#
Edge-Router(config)# end

A warning banner communicates the authorized-use policy. Use wording approved by the organization and avoid exposing unnecessary device or network details.

Practical Example: Inspect, Configure, Save, and Verify

The following sequence sets a hostname, applies a console timeout, saves the configuration, and verifies both active and saved settings.

Router> enable
Router# show version
Router# show flash:
Router# configure terminal
Router(config)# hostname Branch-SW
Branch-SW(config)# line console 0
Branch-SW(config-line)# exec-timeout 10 0
Branch-SW(config-line)# exit
Branch-SW(config)# end
Branch-SW# show running-config | include hostname
Branch-SW# copy running-config startup-config
Branch-SW# show startup-config | begin hostname

Troubleshooting Common IOS Problems

Changes Disappear After Reload

Likely cause: The change exists in RAM only and was not copied to startup-config.

Router# show running-config
Router# show startup-config
Router# copy running-config startup-config

Compare the two configurations, decide which settings should be retained, and save only after reviewing the result.

Invalid or Incomplete Command

The command may require an argument, use unsupported syntax, or be entered from the wrong mode. Check the prompt, use ?, and use show version when platform or release support is uncertain.

SSH or Telnet Access Fails

Check management IP reachability, interface status, VTY settings, authentication, SSH prerequisites, and permitted transport:

Router# show ip interface brief
Router# show running-config | section line vty
Router# show running-config | include username|ip domain-name|ip ssh
Router# show crypto key mypubkey rsa

For SSH, confirm local authentication with login local, RSA keys, SSH version settings, and transport input ssh. Telnet should not be enabled merely to avoid diagnosing an SSH configuration problem.

Device Enters Setup Mode or Does Not Boot Normally

There may be no usable startup configuration, no bootable IOS image, or boot settings that point to an unexpected location. Observe console messages and inspect storage and boot variables when normal IOS access is available. Treat image recovery and configuration-register changes as controlled maintenance tasks and verify platform-specific recovery procedures before acting.

Output Is Paged or Too Long

At a --More-- prompt, press the space bar to advance and q to stop. Use include, exclude, or begin filters where supported to narrow the output.

Key Points to Remember

Cisco IOS is software; the router or switch is the hardware platform.
ROM contains startup and recovery-related code, flash commonly stores IOS images, RAM holds active operational data, and NVRAM traditionally stores startup-config.
running-config is active and volatile; startup-config is saved and nonvolatile.
A reload discards unsaved running-configuration changes.
Prompts identify IOS modes: > is user EXEC, # is privileged EXEC, and (config)# indicates global configuration.
Use ?, Tab, and command history to work efficiently and avoid syntax errors.
Use show for verification, and use clear and debug cautiously.
SSH is preferred to Telnet because SSH encrypts remote administration traffic.
Verify platform, release, feature, and licensing compatibility before changing an IOS image.
Save and verify configurations deliberately, especially before a reload or maintenance operation.

For related foundations, review the OSI Reference Model and Configure Passwords in IOS.