CCNA online course

Cisco IOS Command Modes

Learn Cisco IOS command modes, prompts, hierarchy, navigation, context-sensitive help, configuration persistence, and safe CCNA CLI workflows.

Cisco IOS is the operating system used by many Cisco routers and switches. Its CLI, or command-line interface, lets an administrator monitor the device and enter configuration commands. IOS organizes these commands into command modes: operational contexts that determine which commands are accepted.

The current mode matters. A command that works in Privileged EXEC mode may be unavailable in User EXEC mode, while an interface command may be accepted only after entering the correct interface subconfiguration mode.

Why Cisco IOS Uses Command Modes

IOS separates monitoring, troubleshooting, device-wide configuration, and object-specific configuration. This organization provides two important benefits:

• Access control: users normally begin with limited access and must deliberately enter more privileged modes before making changes.
• Configuration context: commands apply to the device or to a selected object, such as an interface, VTY line, VLAN, or routing process.

Modes form a hierarchy. A typical session progresses from User EXEC to Privileged EXEC, then to Global Configuration mode, and finally to a specific subconfiguration mode.

Understanding Cisco IOS Prompts

A Cisco IOS prompt identifies the device hostname and usually reveals the current command mode. In the examples below, Router is the hostname.

The hostname is the text before the mode suffix. The characters > and # distinguish the two EXEC modes. Parenthetical text such as (config-if) identifies a configuration context.

The hostname itself can be changed in Global Configuration mode:

Router# configure terminal
Router(config)# hostname Branch1
Branch1(config)#

After the change, the hostname portion of the prompt becomes Branch1. Always read the complete prompt before entering a command.

User EXEC Mode

User EXEC mode is the initial mode after console or terminal access. It is identified by a prompt ending in >, such as Router>. Its purpose is limited monitoring and basic connectivity testing rather than configuration.

Common commands include:

• ping for basic reachability testing.
• enable to request Privileged EXEC access.
• logout to end the terminal session.
• Limited inspection and assistance commands, depending on the platform.

Most configuration commands are unavailable in User EXEC mode. If a command is rejected, check whether the prompt ends in > and enter enable when authorized.

Privileged EXEC Mode

Privileged EXEC mode is the main administrative operational mode. It is identified by a prompt ending in #, such as Router#. Enter it from User EXEC mode with enable:

Router> enable
Router#

If authentication is configured, IOS requests the enable credential. Return to User EXEC mode with disable:

Router# disable
Router>

Privileged EXEC mode provides access to verification, troubleshooting, file operations, reload operations, and configuration mode. Common command families include:

• show to inspect status, interfaces, routes, protocols, and configuration.
• copy to copy configurations or other files.
• debug to produce detailed real-time troubleshooting output; use it carefully.
• clear to remove counters, sessions, or other operational state.
• configure terminal to enter Global Configuration mode.
• reload to restart the device after confirming the operational impact.

Privileged access should be protected with secure credentials. An enable secret is preferred over a plain-text enable password because it is stored using a stronger protected representation.

Global Configuration Mode

Global Configuration mode is the starting point for device-wide configuration. Enter it from Privileged EXEC mode with configure terminal, commonly abbreviated as conf t where supported:

Router# configure terminal
Router(config)#

Representative global commands include:

• hostname Branch1 changes the device name.
• enable secret <secret> protects entry into Privileged EXEC mode.
• ip routing enables Layer 3 routing on platforms that support this command.
• banner configures login or message banners.
• interface ... selects an interface subconfiguration context.
• line ... selects a terminal-line context.

Leave configuration contexts with exit, or return directly to Privileged EXEC mode with end or Ctrl+Z.

Subconfiguration Modes

A subconfiguration mode applies commands to one selected object or feature. The prompt changes to show the selected context. Commands accepted in one submode may not be accepted in another.

Interface Configuration Mode

Interface Configuration mode is used for physical interfaces, switch virtual interfaces, loopback interfaces, and routed interfaces. Select an interface from Global Configuration mode:

Router(config)# interface gigabitethernet 0/1
Router(config-if)# description Uplink to distribution switch
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)#

The command description documents the connection. The command no shutdown administratively enables the interface. The interface type and numbering vary by device.

Line Configuration Mode

Line Configuration mode configures terminal access lines:

• line console 0 selects the console line.
• line aux 0 selects the auxiliary line on platforms that provide one.
• line vty 0 4 selects a range of virtual terminal lines for remote access.

Router(config)# line vty 0 4
Router(config-line)# login local
Router(config-line)# exit
Router(config)#

The exact authentication commands should match the credentials and access design used in the lab or organization.

Router Configuration Mode

Router Configuration mode configures a routing-process instance. Examples include:

Router(config)# router ospf 1
Router(config-router)# exit
Router(config)# router rip
Router(config-router)# exit
Router(config)#

Commands under one routing process are not automatically valid under another. For example, OSPF-specific commands belong under the OSPF process context.

Other Feature-Specific Contexts

Depending on the platform and enabled features, IOS may provide contexts such as:

• VLAN Configuration mode, commonly shown as (config-vlan)#.
• Access-list configuration mode.
• DHCP pool configuration mode.
• class-map and policy-map configuration contexts.
• Controller configuration mode.

Use the prompt and context-sensitive help to determine which commands are available on a particular device.

Cisco IOS Command Mode Reference

Mode Hierarchy and Navigation

The typical progression is:

Router> enable
Router# configure terminal
Router(config)# interface gigabitethernet 0/1
Router(config-if)#

For example, exit from Router(config-if)# returns to Router(config)#. It does not return directly to Router#. Use end or Ctrl+Z when you need to return immediately to Privileged EXEC mode.

Context-Sensitive Help and Command Discovery

IOS provides context-sensitive help with the question mark character. Enter ? by itself to list commands available in the current mode:

Router> ?
Router# show ?
Router(config)# ?

Help can also reveal valid continuations and required arguments:

Router# show ip ?
Router# show ip interface ?
Router(config)# interface ?

If a command is incomplete, IOS may display a prompt indicating that more input is required. Use ? at that position to see the expected keywords or arguments.

Press Tab to complete an unambiguous command or keyword. IOS also supports abbreviated commands when the abbreviation uniquely identifies one command. Full commands are often clearer in documentation and safer when a future software release adds a conflicting command.

Command history improves efficiency and reduces typing errors. Use the Up and Down arrow keys, or the platform's supported history keys, to recall previous commands. Review a recalled command before pressing Enter, especially when it contains an interface number or a destructive operation.

Running Configuration and Startup Configuration

The running configuration, displayed as running-config, is the active configuration currently used by the device. Configuration commands normally change it immediately.

The startup configuration, displayed as startup-config, is the saved configuration used during the next boot. A change made only to running-config is lost after a reload or power interruption unless it is saved.

Save the active configuration from Privileged EXEC mode:

Router# copy running-config startup-config

Some IOS platforms support equivalent shortcuts such as write memory or wr, but copy running-config startup-config is explicit and widely recognized.

Practical Example: Configure and Verify an Interface

This sequence demonstrates prompt changes from initial access through interface configuration:

Router> enable
Router# configure terminal
Router(config)# interface gigabitethernet 0/1
Router(config-if)# description Uplink to distribution switch
Router(config-if)# no shutdown
Router(config-if)# end
Router# show ip interface brief

1. Start in User EXEC mode, identified by >.
2. Use enable to enter Privileged EXEC mode, identified by #.
3. Use configure terminal to enter Global Configuration mode.
4. Select the intended interface and confirm the (config-if)# prompt.
5. Apply the description and administrative enable command.
6. Use end to return to Privileged EXEC mode.
7. Verify the result with show ip interface brief.

Practical Example: Configure Remote-Access Lines

Router# configure terminal
Router(config)# line vty 0 4
Router(config-line)# login local
Router(config-line)# exit
Router(config)#

The prompt changes from (config)# to (config-line)#, proving that the VTY line range—not an interface—is selected. The exit command returns one level to Global Configuration mode.

Safe CLI Workflow

• Check the prompt before every configuration command.
• Use verification commands before changing an interface, route, or access line.
• Enter the exact intended interface or object; do not assume that a similar name is correct.
• Add useful descriptions to interfaces and other supported objects.
• Use ? and Tab completion instead of guessing syntax.
• Review the running configuration after making changes.
• Save only after confirming that the active configuration is correct.
• Use debug, clear, and reload cautiously because they can affect production traffic or device state.

Troubleshooting Command-Mode Problems

Invalid input marker

If IOS displays % Invalid input detected at '^' marker., the command may be invalid in the current mode, incorrectly formed, or unsupported by the platform or IOS version.

• Read the prompt and identify the current mode.
• Use ? at the point where the syntax becomes uncertain.
• Move to the required EXEC or configuration context.
• Check platform and feature support if the syntax appears correct.

A configuration command is unavailable

The command may belong in a more specific context. Return to Global Configuration mode if necessary, enter the relevant interface, line, router, VLAN, or feature context, and confirm the expected prompt.

Changes disappear after reload

Verify the active change with show running-config. If it is correct, save it with copy running-config startup-config, then confirm the saved file with show startup-config.

Privileged EXEC access is unavailable

Enable authentication may be required. Use the authorized credential. If it is unknown, follow the organization's approved password-recovery procedure. During initial setup, configure and protect an enable secret.

exit does not reach the expected prompt

exit normally moves up one level only. Use end or Ctrl+Z to return directly to Privileged EXEC mode.

Key Points to Remember

• IOS command modes control which commands are accepted.
• User EXEC uses > and provides limited operational access.
• Privileged EXEC uses # and provides administrative operational access.
• Global Configuration mode uses (config)# and is the entry point for device configuration.
• Subconfiguration modes apply settings to a selected object or feature.
• exit moves up one level; end and Ctrl+Z return to Privileged EXEC.
• Running-config is active; startup-config is saved for boot.
• Save validated changes with copy running-config startup-config.

For related practice, review Configure Passwords in IOS, Configure OSPF, and Configure Trunk Ports.