Cisco Internetwork Operating System (IOS): Overview and CLI Modes

Learn what Cisco IOS does, how routers and switches use it, how to access its CLI, and how to navigate user EXEC, privileged EXEC, global configuration, and interface modes.

What Is Cisco IOS?

Cisco IOS stands for Cisco Internetwork Operating System. It is the operating system used by many Cisco networking devices, including routers and switches.

IOS controls how a device operates and provides the networking functions supported by its hardware. These functions can include routing, switching, interface operation, management, monitoring, and connectivity testing.

Administrators interact with IOS primarily through its command-line interface (CLI). A CLI is a text-based interface where commands are entered to view information, test the network, and configure supported features.

IOS Capabilities

IOS supports the configuration and operation of routing, switching, and other internetworking features. The exact capabilities depend on the device and software version, but common tasks include:

  • Configuring interfaces and assigning device-wide settings.
  • Operating routing and switching functions.
  • Viewing interface status, statistics, and operational information.
  • Testing reachability with commands such as ping.
  • Performing administrative actions such as restarting the device.

The CLI is the main interface for both operational commands and configuration commands. IOS organizes these commands into modes. Each mode exposes a particular scope of commands and a particular privilege level.

IOS Architecture

IOS is a multitasking operating system, meaning it can run multiple processes or tasks. Those processes support different parts of device operation, such as packet handling, interface management, routing protocols, and management access.

IOS is traditionally described as having a monolithic architecture. In this conceptual model, IOS runs as one software image and its processes use a shared memory space. This architectural description helps explain how the operating system is organized; it is not a configuration task that an administrator performs from the CLI.

Ways to Access the IOS CLI

The CLI can be reached locally or remotely. The three common access methods are console, Telnet, and SSH.

Access method: Console
Local or remote: Local
Security characteristic: Uses a direct physical management connection; security also depends on physical access and local credentials
Typical use: Initial setup, recovery, or local administration when network access is unavailable

Access method: Telnet
Local or remote: Remote
Security characteristic: Does not encrypt session traffic
Typical use: Older or controlled environments where encrypted remote access is not being used

Access method: SSH
Local or remote: Remote
Security characteristic: Encrypts remote management session traffic
Typical use: Secure remote administration when the device supports and has been configured for SSH

Console Access

Console access is direct local management through the device's console connection. An administrator connects a terminal or workstation to the router or switch using the appropriate console connection and then opens a terminal session.

Console access is especially useful during initial installation, before remote management has been configured, or when a device cannot be reached across the network.

Telnet Access

Telnet provides a remote terminal session over the network. It can be used to reach a device's CLI, but it does not encrypt the session traffic. Credentials and commands may therefore be exposed to someone who can capture the traffic.

SSH Access

SSH, or Secure Shell, provides remote terminal access while encrypting management session traffic. SSH is preferred over Telnet for remote administration when it is supported and correctly configured.

IOS Command Modes and Prompts

A prompt is the text IOS displays when it is ready to accept a command. The prompt commonly includes the device hostname and a marker that identifies the current mode.

For example, the hostname in these examples is Router_HQ. The ending of the prompt tells you where you are:

  • Router_HQ> indicates user EXEC mode.
  • Router_HQ# indicates privileged EXEC mode.
  • Router_HQ(config)# indicates global configuration mode.
  • Router_HQ(config-if)# indicates interface configuration mode.

Modes control command scope. A command may be valid in one mode but rejected in another. The usual progression is user EXEC mode, privileged EXEC mode, global configuration mode, and then a feature-specific configuration submode.

User EXEC Mode

User EXEC mode is the initial IOS command mode after console, Telnet, or SSH login. Its prompt ends with a greater-than symbol:

Router_HQ>

This mode provides limited access to monitoring, statistics, and basic diagnostic commands. For example, ping can be used to test reachability to a destination IP address:

Router_HQ> ping <destination-ip-address>

IOS sends ICMP echo requests and displays whether replies are received. The exact result depends on the destination, the path, and device configuration.

Privileged EXEC Mode

Privileged EXEC mode provides more powerful operational and administrative commands. From user EXEC mode, enter enable:

Router_HQ> enable
Router_HQ#

The prompt changes from > to #. A device may request an enable password or other authentication before allowing entry into this mode.

Privileged EXEC mode provides access to additional monitoring commands, administrative actions, and the commands needed to enter configuration modes. For example, reload is a privileged administrative command:

Router_HQ# reload

Global Configuration Mode

Global configuration mode is used to change device-wide configuration settings. From privileged EXEC mode, enter configure terminal:

Router_HQ# configure terminal
Router_HQ(config)#

The prompt contains (config)#. Global configuration mode is the parent of several configuration submodes. Device-wide settings are entered here, while settings for a particular feature or object are usually entered in a more specific submode.

Configuration Submodes

A configuration submode narrows the command scope to a particular feature or object. Submodes are entered from global configuration mode.

Interface Configuration Mode

Interface configuration mode is used to configure an individual network interface. You must first select the interface with the interface command:

Router_HQ(config)# interface <interface-type-and-number>
Router_HQ(config-if)#

After the prompt changes to (config-if)#, interface-specific commands can be entered for the selected interface. The interface selection is important because IOS needs to know which interface the settings apply to.

Cisco IOS Command Modes

Mode: User EXEC
Example prompt: Router_HQ>
How entered: Initial mode after console, Telnet, or SSH login
Primary purpose: Basic monitoring, statistics, and limited diagnostics
Representative commands: ping

Mode: Privileged EXEC
Example prompt: Router_HQ#
How entered: Enter enable from user EXEC mode
Primary purpose: More powerful operational, administrative, and configuration-entry commands
Representative commands: reload, configure terminal

Mode: Global configuration
Example prompt: Router_HQ(config)#
How entered: Enter configure terminal from privileged EXEC mode
Primary purpose: Device-wide configuration and entry into configuration submodes
Representative commands: interface

Mode: Interface configuration submode
Example prompt: Router_HQ(config-if)#
How entered: Enter interface <interface-type-and-number> from global configuration mode
Primary purpose: Configuration of one selected interface
Representative commands: Interface-specific configuration commands

Basic IOS Navigation Workflow

The following short session demonstrates the core mode progression. The commands change the mode, and the prompts show the result:

Router_HQ> enable
Router_HQ# configure terminal
Router_HQ(config)# interface <interface-type-and-number>
Router_HQ(config-if)#
  1. After login, the session begins at the user EXEC prompt, Router_HQ>.
  2. Enter enable to move to privileged EXEC mode, shown by Router_HQ#.
  3. Enter configure terminal to enter global configuration mode, shown by Router_HQ(config)#.
  4. Enter an interface selection command to enter interface configuration mode, shown by Router_HQ(config-if)#.

To run an operational test such as ping, use an appropriate EXEC mode rather than a configuration submode. Configuration mode is for entering configuration commands, while EXEC modes are used primarily for operational commands.

Troubleshooting Mode and Access Problems

A Configuration Command Is Rejected

If IOS rejects a configuration command, the command may have been entered from user EXEC or privileged EXEC mode instead of the required configuration mode or submode.

Check the prompt. If necessary, enter enable, then configure terminal, and finally the relevant submode command such as interface.

The Prompt Ends with >

A prompt ending with > means the session is in user EXEC mode. Higher-privilege commands such as reload are unavailable there. Enter enable and confirm that the prompt ends with #.

An Interface Command Is Not Accepted

If an interface-specific command is entered at the Router_HQ(config)# prompt, the session is still in global configuration mode. Select the target interface and verify the Router_HQ(config-if)# prompt.

Telnet Works but Is Insecure

Telnet does not encrypt management traffic. Use SSH for remote administration when the device supports it and SSH has been appropriately configured.

CatOS in Historical Context

CatOS was an older, discontinued Cisco switch operating system that also provided a command-line interface. It is included here only as historical context. This lesson focuses on Cisco IOS and its command modes.

Exam-Relevant Notes

  • A prompt ending in > identifies user EXEC mode.
  • A prompt ending in # identifies privileged EXEC mode.
  • enable moves from user EXEC mode to privileged EXEC mode.
  • configure terminal moves from privileged EXEC mode to global configuration mode.
  • (config)# identifies global configuration mode.
  • (config-if)# identifies interface configuration mode.
  • IOS command availability depends on the software release, platform, and device capabilities.
  • SSH encrypts remote management traffic; Telnet does not.

For a concise reference to the operating system and its CLI modes, see Cisco Internetwork Operating System (IOS).