VMware ESXi and vSphere Cluster Management

Cisco IOS Command Modes: User EXEC, Privileged EXEC, Global Configuration, and Interface Configuration

Learn how Cisco IOS command modes work, identify modes from their prompts, use context-sensitive help, and navigate between EXEC and configuration modes.

Cisco IOS (Cisco Internetwork Operating System) uses a mode-based command-line interface, or CLI, to manage routers and switches. Each command mode provides a different set of commands and controls a different scope of device operation or configuration.

The prompt is the quickest way to determine the active mode. Before entering a command, inspect the hostname and the symbols or parenthesized suffix at the end of the prompt.

Why Cisco IOS Uses Command Modes

A command mode is an IOS operating context that controls command availability and configuration scope. IOS separates commands so that monitoring and testing operations are distinct from commands that change the device configuration.

• EXEC modes are primarily used to observe, test, and administer the device.
• Configuration modes are used to change the active device configuration.
• Configuration submodes focus commands on a particular object, such as one interface or a group of terminal lines.

The hostname in a prompt is configurable, so it may not always be Router. The prompt markers are more important than the hostname.

User EXEC Mode

User EXEC mode is normally the first IOS CLI mode after connecting through a console cable, SSH, or Telnet session. Its typical prompt is a hostname followed by a greater-than symbol:

Router>

This is a low-privilege mode. It supports basic operational and diagnostic activities, but it cannot perform most configuration changes or protected administrative actions.

For example, a basic connectivity test can be run from user EXEC mode:

Router> ping <destination>
Router> traceroute <destination>

Use the question mark to see the commands available in the current mode:

Router> ?

If a configuration command is rejected while the prompt ends in >, the session is probably still in user EXEC mode. Enter enable when authorized administrative access is required.

Privileged EXEC Mode

Privileged EXEC mode provides expanded EXEC commands and administrative operations. It is entered from user EXEC mode with enable:

Router> enable
Router#

If protected, IOS requests an enable password or, preferably, an enable secret. An enable secret is a protected credential used to control entry to privileged EXEC mode.

The typical privileged EXEC prompt ends with a number sign:

Router#

Common privileged EXEC tasks include viewing detailed device status, displaying configuration information, saving the active configuration, and reloading the device. Examples of inspection commands include:

Router# show running-config
Router# show startup-config

The running configuration is the active configuration currently applied to the device. The startup configuration is the saved configuration used when the device starts. Privileged EXEC is also where administrators commonly save changes, for example with an appropriate copy or write command supported by the platform.

Global Configuration Mode

Global configuration mode contains commands that affect the device as a whole. Enter it from privileged EXEC mode with configure terminal:

Router# configure terminal
Router(config)#

The prompt suffix (config)# identifies this mode. Representative device-wide settings include the hostname, login and security behavior, banners, and authentication-related configuration.

Router(config)# hostname Branch-Router
Branch-Router(config)#

Changing the hostname changes the hostname portion of future prompts. The mode marker remains the same, so the new prompt still identifies global configuration mode.

Global configuration mode is also the parent of feature-specific configuration submodes. From here, you can select an interface, configure terminal lines, or enter a routing protocol configuration context.

Configuration Submodes

A configuration submode is a specialized context entered from global configuration mode. It exposes commands relevant to the selected feature or object rather than every global configuration command.

• Interface configuration mode applies commands to one selected physical or logical interface.
• Line configuration mode is used for console, VTY, and other terminal-line settings.
• Router protocol configuration mode is used for settings associated with a routing protocol process.

The exact submode names and available commands depend on the device platform, IOS release, and installed features.

Interface Configuration Mode

To configure one interface, use the interface command from global configuration mode:

Router(config)# interface FastEthernet0/0
Router(config-if)#

The (config-if)# suffix identifies interface configuration mode. Commands entered here apply to the selected interface, not to every interface on the device.

Typical interface-specific tasks include assigning an address, adding a description, and changing the administrative state. For example, the following is a context demonstration:

Router(config)# interface FastEthernet0/0
Router(config-if)# description Link-to-LAN
Router(config-if)# exit
Router(config)#

FastEthernet0/0 is only an example. Actual interface names vary among routers, switches, virtual labs, platforms, and IOS versions. Use the identifier shown by the device.

Normal Mode Progression

The usual hierarchy is:

User EXEC        Router>
       |
       | enable
       v
Privileged EXEC  Router#
       |
       | configure terminal
       v
Global config    Router(config)#
       |
       | interface FastEthernet0/0
       v
Interface config Router(config-if)#

From the interface context, exit moves back to its parent, global configuration mode. From global configuration mode, another exit returns to privileged EXEC mode.

Exit, End, and Disable Are Different

• exit moves back one level in the mode hierarchy. From interface configuration it returns to global configuration.
• end leaves configuration modes and returns directly to privileged EXEC, regardless of how deeply nested the configuration context is.
• disable moves from privileged EXEC down to user EXEC. It is not normally used to leave a configuration submode.

For example:

Router(config-if)# exit
Router(config)# end
Router# disable
Router>

Prompt Interpretation and Mode Verification

Read the entire prompt, including parentheses, rather than looking only at the final symbol.

Context-Sensitive Help

Context-sensitive help is IOS assistance accessed with the question mark. It displays commands or arguments that are valid at the current point. Because command availability depends on mode, help output changes when the prompt changes.

Router> ?
Router# show ?
Router(config)# interface ?

A question mark after a partial command or keyword reveals valid next choices. This helps you discover syntax without memorizing every command:

Router# show ?
Router(config)# interface ?

Use help at each prompt and compare the results in user EXEC, privileged EXEC, global configuration, and interface configuration mode.

Access Methods and Session Context

Common ways to reach the IOS CLI include:

• Console: a local connection, commonly used for initial setup or recovery.
• SSH: an encrypted remote management session and the preferred secure choice for remote access.
• Telnet: a remote CLI session that does not provide the same protection as SSH and should generally be avoided in real environments when SSH is available.

The access method does not change the basic command-mode hierarchy. After authentication, the session can move through user EXEC, privileged EXEC, global configuration, and feature-specific submodes according to the user’s permissions.

Complete Practice Walkthrough

The following sequence demonstrates prompt recognition, elevation, global configuration, interface selection, and navigation back through the hierarchy.

Router> ?
Router> ping <destination>
Router> enable
Router# show running-config
Router# configure terminal
Router(config)# hostname Branch-Router
Branch-Router(config)# interface FastEthernet0/0
Branch-Router(config-if)# exit
Branch-Router(config)# end
Branch-Router# disable
Branch-Router>

At every step, verify the prompt before entering the next command. If the prompt is not the one expected, use exit, end, or disable according to the required destination.

Troubleshooting Mode Problems

A configuration command is rejected at a prompt ending in >

The session is in user EXEC mode, which has limited privileges. Use enable with authorized credentials, then use configure terminal if configuration is required.

An enable command requests a password

Privileged EXEC access is protected by an enable password or enable secret. Use authorized credentials. Do not attempt configuration without the required administrative access.

A global configuration command is unavailable at Router#

The session is in privileged EXEC rather than global configuration mode. Enter configure terminal and verify the (config)# suffix.

An interface-specific command is unavailable at Router(config)#

No interface has been selected, so the session is not in interface configuration mode. Enter interface followed by a valid identifier and verify the (config-if)# suffix.

The interface identifier is invalid

The interface type or number may not exist on the device, or the platform may use a different naming convention. Use context-sensitive help and device status commands to discover valid interface names and numbers.

exit does not return to privileged EXEC

exit normally moves back only one level. Repeat it as needed, or use end to return directly from configuration modes to privileged EXEC.

Key Takeaways

• Router> identifies user EXEC mode, the initial low-privilege operational context.
• Router# identifies privileged EXEC mode, which provides expanded monitoring and administrative commands.
• Router(config)# identifies global configuration mode for device-wide settings.
• Router(config-if)# identifies interface configuration mode for one selected interface.
• enable moves up to privileged EXEC; configure terminal enters global configuration.
• interface <identifier> enters an interface submode.
• exit moves back one level, end returns to privileged EXEC, and disable returns to user EXEC.
• The question mark provides help that is specific to the current mode and command position.

For a concise reference, review Cisco IOS command modes and practice identifying the prompt before every command.