VMware ESXi and vSphere Cluster Management

Using the do Command to Run Privileged EXEC Commands from Cisco IOS Configuration Modes

Learn how to use Cisco IOS do to run show and other privileged EXEC commands from global configuration and interface configuration modes without leaving the current context.

When configuring a Cisco IOS device, you normally move between command modes. A verification command such as show interfaces belongs to privileged EXEC mode, while commands such as description belong to a configuration submode. The do command lets you run an eligible privileged EXEC command from a configuration mode without leaving that mode.

This is useful when you want to verify a change and then continue configuring the same interface or feature immediately.

Cisco IOS command modes

A Cisco IOS command mode is a CLI context that determines which commands are available. The prompt identifies the current mode. Cisco IOS does not treat every command as valid in every context.

Privileged EXEC mode

Privileged EXEC mode is the administrative command mode commonly identified by a prompt ending in #. It accepts monitoring, troubleshooting, management, and configuration-navigation commands, including many show commands.

Switch# show running-config

You commonly enter privileged EXEC mode from user EXEC mode with:

Switch> enable
Switch#

Global configuration mode

Global configuration mode is used for device-wide configuration changes. Its prompt normally ends in (config)#.

Switch# configure terminal
Switch(config)#

Commands entered here can change broad device settings or open a more specific configuration submode.

Configuration submodes

A configuration submode is a nested configuration context for a particular feature or object. For example, interface configuration mode is used to configure one physical or logical interface.

Switch(config)# interface FastEthernet0/1
Switch(config-if)#

The (config-if)# prompt indicates that commands now apply to the selected interface. Other examples of configuration submodes include line, router, and VLAN configuration contexts, depending on the platform and feature set.

Why a direct show command fails in configuration mode

Suppose you are configuring an interface and enter show interfaces directly:

Switch(config)# interface FastEthernet0/1
Switch(config-if)# show interfaces
                     ^
% Invalid input detected at '^' marker.

The command is rejected because the current mode is interface configuration mode, not privileged EXEC mode. Depending on the command and IOS release, the response may indicate invalid or incomplete input. IOS is looking for an interface-configuration command at that prompt rather than interpreting the input as a normal privileged EXEC command.

What the do command does

do is a configuration-mode prefix. It invokes an eligible privileged EXEC command while preserving the current configuration context. The capability is available in Cisco IOS 12.3 and later.

The general syntax is:

do <privileged-exec-command>

Place do before the complete EXEC command. The command's normal arguments remain after it:

do show running-config
do show interfaces status
do show interfaces FastEthernet0/1

Do not insert do into the command's options or after the show keyword. It is a prefix for the entire privileged EXEC command.

Using do from interface configuration mode

The following example selects an interface, checks its operational details, and then continues configuring it:

Switch# configure terminal
Switch(config)# interface FastEthernet0/1
Switch(config-if)# do show interfaces FastEthernet0/1
FastEthernet0/1 is up, line protocol is up
  Hardware is ...
  ...output omitted...
Switch(config-if)# description Uplink to distribution switch
Switch(config-if)#

The output from do show interfaces FastEthernet0/1 is produced while the prompt is Switch(config-if)#. After the output finishes, the same interface configuration prompt returns. You do not need to exit to privileged EXEC mode and then re-enter interface configuration mode.

Useful verification commands

Inspect the running configuration

The running configuration is the active device configuration currently held in memory. From global configuration mode or a configuration submode, use:

Switch(config)# do show running-config

This is useful for checking whether an existing setting is present and for reviewing the active configuration while working in another context.

Review port status

On platforms that support it, show interfaces status provides a concise view of port state and commonly includes fields such as port, name, status, VLAN, duplex, and speed.

Switch(config-if)# do show interfaces status

Use this after a port change when you need a quick status overview. The command and its output vary by IOS release, device family, and feature support.

Inspect one interface in detail

Use the normal interface identifier after the show interfaces command:

Switch(config-if)# do show interfaces FastEthernet0/1

This can display administrative state, line protocol state, hardware information, counters, errors, traffic statistics, and other operational details. The exact fields depend on the interface type and platform.

Direct command versus do-prefixed command

Switch(config-if)# show interfaces FastEthernet0/1
                     ^
% Invalid input detected at '^' marker.

Switch(config-if)# do show interfaces FastEthernet0/1
FastEthernet0/1 is up, line protocol is up
  ...output...
Switch(config-if)#

The second command succeeds because do tells IOS to execute the following text as a privileged EXEC command. The interface configuration context is retained before, during, and after the verification.

Workflow benefits

• Fewer mode changes: You do not repeatedly use end, exit, or configure terminal just to run a check.
• Faster verification: You can inspect the running configuration or interface state immediately after making a change.
• Better troubleshooting: Operational details can be compared with the configuration while the relevant object remains selected.
• Safer continuity: Returning to the same prompt makes it clear that the next command still applies to the same configuration context.

For example, after entering an interface description, you can verify the relevant configuration and then continue with another interface command:

Switch(config)# interface FastEthernet0/1
Switch(config-if)# description Uplink to distribution switch
Switch(config-if)# do show running-config
Switch(config-if)# shutdown
Switch(config-if)#

The shutdown command is a configuration command, so it is entered normally in interface configuration mode. In contrast, show running-config is an EXEC command and uses the do prefix in that context.

Scope and limitations

• Use it for EXEC commands: do is intended to launch privileged EXEC commands from configuration contexts. It is not a replacement for configuration-command syntax.
• Command eligibility is not universal: A command may be unavailable because of the IOS version, device family, feature set, or current platform.
• Arguments remain platform-specific: An interface name such as FastEthernet0/1 must exist and use the syntax supported by the device.
• Privileges still matter: The session must have sufficient authorization to run the requested EXEC command.
• Output can differ: Even when the command is accepted, fields and formatting may vary between IOS releases and platforms.

The do prefix does not make an unsupported command available, bypass authorization, or convert a configuration command into an EXEC command.

Troubleshooting do command errors

A show command is rejected in configuration mode

Likely cause: The command belongs to privileged EXEC mode and was entered without do.

Resolution: Add the prefix before the complete command:

Switch(config-if)# do show interfaces FastEthernet0/1

The command still fails after adding do

Likely cause: The syntax is not supported by the IOS version, device type, feature set, or interface naming convention.

Resolution: Use context-sensitive help and check the available syntax on the device:

Switch(config-if)# do show ?
Switch(config-if)# do show interfaces ?

Then adjust the command or interface identifier to match the available options.

Output is unavailable or access is denied

Likely cause: The session may have insufficient privilege, or the requested feature may not exist on the device.

Resolution: Confirm the session's privilege level and verify that the platform supports the requested operational feature before investigating the configuration.

You keep exiting configuration modes to run checks

Likely cause: The do capability is not being used in the configuration workflow.

Resolution: Run the needed privileged EXEC command with do, review its output, and continue from the same configuration prompt.

Exam-relevant points

• A prompt ending in # commonly indicates privileged EXEC mode; (config)# indicates global configuration mode; (config-if)# indicates interface configuration mode.
• show commands are normally privileged EXEC commands.
• From global configuration mode or a configuration submode, write do show ... to run an eligible show command.
• The syntax is do <privileged-exec-command>; all normal command arguments follow do.
• The current configuration context remains unchanged after the command completes.
• IOS 12.3 and later provide this capability, but individual commands and output remain platform- and release-dependent.

Summary

Cisco IOS modes accept different command sets, and the prompt identifies the current context. Privileged EXEC commands such as show running-config and show interfaces normally cannot be entered directly from global configuration mode or interface configuration mode. Prefixing the command with do runs it from the configuration context:

do show running-config
do show interfaces status
do show interfaces FastEthernet0/1

Use this feature to verify configuration and operational state without repeatedly leaving and re-entering the configuration hierarchy. For related prompt and mode practice, see running privileged commands in global configuration mode.