CCNA online course

Run Privileged EXEC Commands from Global Configuration Mode

Learn how to use Cisco IOS do to run show, verification, and save commands from global configuration mode without changing CLI context.

When configuring a Cisco router or switch, you often need to verify a change before continuing. Cisco IOS provides the do command so you can run a privileged EXEC command while remaining in global configuration mode or a configuration submode.

Cisco IOS Command Modes

Cisco IOS is the operating system and command-line environment used on many Cisco network devices. Its CLI, or command-line interface, provides different command modes. The commands available at a prompt depend on the current mode.

  • User EXEC mode: A limited operational mode. The prompt commonly ends with >, such as Router>.
  • Privileged EXEC mode: An administrative operational mode used for extensive verification and device management. The prompt commonly ends with #, such as Router#.
  • Global configuration mode: The mode for device-wide configuration. The prompt commonly appears as Router(config)#.
  • Configuration submode: A more specific configuration context, such as interface or line configuration mode. Examples include Router(config-if)# and Router(config-line)#.

A typical mode transition looks like this:

Router> enable
Router# configure terminal
Router(config)# interface gigabitEthernet 0/0
Router(config-if)#

Use enable to enter privileged EXEC mode and configure terminal to enter global configuration mode. From global configuration mode, commands such as interface enter a configuration submode.

Why Run EXEC Commands During Configuration?

Many useful operational commands are privileged EXEC commands. They are commonly used for:

  • Displaying the running configuration.
  • Checking interface status and IP addressing.
  • Reviewing VLANs and the routing table.
  • Monitoring device behavior.
  • Testing or confirming the effect of a configuration change.

Without do, an administrator might leave configuration mode, run a command, and then return to configuration mode:

Router(config)# end
Router# show running-config
Router# configure terminal
Router(config)#

If the original context was an interface or line submode, the administrator would also need to navigate back to that submode. Repeating this sequence interrupts the configuration workflow and increases the chance of entering a command in the wrong context.

The do Command

do is a configuration-mode command prefix. It runs an EXEC-level command from global configuration mode or a configuration submode.

do <privileged-exec-command>

Place do before the intended EXEC command. It is not part of the EXEC command itself. For example, the EXEC command is show running-config; when entered from configuration mode, the complete command is:

Router(config)# do show running-config

After the command finishes, IOS returns you to the same configuration mode:

Router(config)# do show running-config
! configuration output appears here
Router(config)#

The configuration context is preserved. If you started in interface configuration mode, you remain in interface configuration mode after the command completes.

Using do from Global Configuration Mode

Display the running configuration

The running configuration, or running-config, is the active configuration currently used by the device.

Router(config)# do show running-config

This displays the active configuration without requiring a return to privileged EXEC mode.

Check interface status and addressing

After changing an interface or IP address, use a concise status command to verify the result:

Switch(config)# do show ip interface brief

This command commonly displays interface names, IP addresses, status, and protocol state. It is useful immediately after an interface-related change.

Inspect an individual interface

Router(config)# do show interfaces gigabitEthernet 0/0

The detailed output can show line state, protocol state, counters, errors, bandwidth, and other interface information.

Review VLAN information

On supported Cisco switches, review a concise VLAN summary during a switching configuration workflow:

Switch(config)# do show vlan brief

Review the IPv4 routing table

Router(config)# do show ip route

This displays routes known to the device, including connected, static, and dynamically learned routes when applicable.

Using do in Configuration Submodes

do is also useful in configuration submodes. For example, while configuring an interface:

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip address 192.0.2.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# do show interfaces gigabitEthernet 0/0
! detailed interface output
Router(config-if)#

The final prompt remains Router(config-if)#. The command did not remove you from the interface context.

The same principle applies in line configuration mode:

Router(config)# line console 0
Router(config-line)# do show running-config
Router(config-line)#

This differs from end. The end command exits all configuration levels and returns directly to privileged EXEC mode:

Router(config-if)# end
Router#

Ctrl-Z commonly has the same mode-exiting effect as end:

Router(config-if)# ^Z
Router#

Command Help and Completion

IOS provides context-sensitive help through the question-mark character. Help displays commands or arguments that are valid at the current position.

Router(config)# do ?
Router(config)# do show ?

The second command asks IOS to display available options after do show. The results depend on the platform, IOS software release, privilege level, and current command support.

IOS also supports command abbreviations when an abbreviation is unique enough to identify the intended command. For example, a platform may accept:

Router(config)# do sh ip int br

For learning, troubleshooting records, and operational documentation, prefer clear full commands such as:

Router(config)# do show ip interface brief

After do, use the normal syntax and arguments of the EXEC command. For example, an interface identifier follows the regular show interfaces syntax:

Router(config-if)# do show interfaces gigabitEthernet 0/0

Configure, Verify, Then Continue

A reliable workflow is to make a small change, verify it, and only then proceed to the next task.

  1. Enter the configuration mode required for the feature.
  2. Enter the configuration command directly in that mode.
  3. Use do show ... to verify the active result.
  4. Correct any problem before adding more configuration.
  5. Review the relevant portion of the running configuration.
  6. Save the configuration after the changes are confirmed.

For example, an interface workflow might look like this:

Router# configure terminal
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip address 192.0.2.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# do show ip interface brief
Router(config-if)# do show running-config
Router(config-if)#

Verification output should match the intended design before you continue configuring other interfaces, routing, or services.

Saving the Configuration

The running-config is active but is normally stored in volatile memory. The startup configuration, or startup-config, is the saved configuration that the device loads after a reboot.

After reviewing and confirming your changes, you can save from configuration mode with an appropriate privileged EXEC command:

Router(config)# do copy running-config startup-config

IOS may ask for confirmation or a destination filename. Read interactive prompts carefully and provide the required response.

Common Commands Used with do

  • do show running-config — displays the active configuration.
  • do show ip interface brief — displays a concise IPv4 interface status summary.
  • do show interfaces <interface-id> — displays detailed information for a selected interface.
  • do show vlan brief — displays VLAN summary information on supported switches.
  • do show ip route — displays the IPv4 routing table.
  • do copy running-config startup-config — saves the active configuration for use after a reboot.

Limitations and Operational Caution

do does not make every command valid in every situation. The command after do must still be:

  • Supported by the device platform and IOS software release.
  • Valid EXEC command syntax.
  • Allowed by the user’s privilege level.
  • Available in the current feature and software context.

Configuration commands should normally be entered directly in their applicable configuration mode. For example, enter an interface address in interface configuration mode rather than trying to use do as a replacement for the configuration workflow.

Use extra care with disruptive EXEC commands, especially commands that clear sessions, reset interfaces, reload the device, erase or copy files, or otherwise affect production traffic. The fact that a command can be invoked with do does not make it safe to run without reviewing its impact.

do Versus Leaving Configuration Mode

Use do when you need a short verification or operational command and want to preserve the current configuration context.

  • do <command>: Runs the EXEC command and returns to the same configuration mode.
  • end: Exits all configuration levels and returns to privileged EXEC mode.
  • Ctrl-Z: Common keyboard shortcut that also returns to privileged EXEC mode.

Temporarily exiting configuration mode may still be preferable for a longer operational workflow, when you need to run several EXEC commands, or when a particular command is unsupported through do. In those cases, use end or Ctrl-Z, perform the operational work, and return with configure terminal. If you need a specific submode again, navigate back to it explicitly.

Troubleshooting do Commands

An EXEC-style command is rejected from configuration mode

If you enter this:

Router(config)# show running-config

IOS may reject it because show is being interpreted in a configuration context. Add the do prefix:

Router(config)# do show running-config

The command after do is rejected

The underlying command may be unsupported on the platform or release, require a higher privilege level, contain invalid syntax, or not be an EXEC command. Use question-mark help, check the syntax, confirm authorization, and verify platform-specific support.

The configuration prompt is lost

If you used end or Ctrl-Z only to run a verification command, you exited the current configuration context. When appropriate, use do instead so the original mode is retained.

A configuration command does not work with do

do is intended to invoke EXEC commands. Enter configuration commands directly in the correct global configuration mode or submode.

Changes disappear after a reload

The changes were likely present in running-config but not saved to startup-config. After reviewing the configuration, save it with:

Router(config)# do copy running-config startup-config

An interactive command asks for more information

Some commands request confirmation, a destination, or additional parameters. Read each prompt carefully. Do not confirm a disruptive operation unless you understand its effect.

Key Points

  • The available IOS commands depend on the current command mode.
  • do is a configuration-mode prefix for running an EXEC command.
  • The general syntax is do <privileged-exec-command>.
  • do show ... is useful for verifying changes without leaving global configuration or a submode.
  • After the command completes, IOS returns to the same configuration mode.
  • end and Ctrl-Z exit configuration mode, while do preserves it.
  • Use question-mark help to discover valid commands and arguments.
  • Enter configuration commands directly in the appropriate configuration context.
  • Review changes before copying running-config to startup-config.

For related configuration practice, review configuring NTP on a Cisco device, configuring OSPF, and configuring trunk ports. These workflows all benefit from frequent verification with do show ... while you remain in the relevant configuration mode.