Unit

Accessing Cisco IOS: Modes, Navigation, and Basic Device Access

Learn how to access Cisco IOS through the console, Telnet, and SSH; navigate IOS command modes; use CLI help; verify device state; and save configurations.

Cisco IOS access begins with a connection and continues with understanding the command-line interface (CLI). This lesson explains how to connect to a router or switch, recognize IOS command modes, navigate between them, use built-in help, verify device status, save configuration changes, and prepare secure SSH access.

The examples are suitable for Cisco Networking Academy labs, Cisco Packet Tracer, and compatible Cisco routers or switches. Commands and available features can vary by IOS platform and software version.

What Cisco IOS Does

Cisco Internetwork Operating System (IOS) is the operating system used to manage supported Cisco network devices. IOS provides a CLI for entering commands and includes features for device configuration, operational monitoring, troubleshooting, and network-service control.

Through IOS, an administrator can configure interfaces, inspect hardware and software status, control routing and switching services, manage remote access, and save configuration data. The CLI is context-sensitive: the commands available depend on the current command mode.

Ways to Access a Cisco Device

Device access can be local or remote. It can also be out-of-band or in-band.

• Out-of-band management uses a management path that does not depend on normal data-network connectivity. Console access is the common example.
• In-band management carries management traffic across the network, usually through an IP address on a router interface or switch virtual interface.

Console access is normally the first access method used on a new device because it works before management addressing and routing are configured. Telnet and SSH require the device to have a reachable management IP address and an operational network path. SSH is preferred because it encrypts the remote session; Telnet sends traffic without encryption.

Console Connection Setup

The console port is a physical local-management port. Depending on the device, it may use an RJ-45 console connection, a USB console connection, or both. Connect the workstation to the device console port with the appropriate console cable or USB cable.

A terminal emulator is software that provides a text terminal session. Examples include terminal applications supplied with operating systems, dedicated serial tools, and the terminal feature in Cisco Packet Tracer.

For a traditional serial console session, use these common settings:

These settings are often summarized as 9600 8N1, with flow control disabled. Some platforms or deployments may use different settings, so follow the device documentation when the standard values do not work.

When the Console Window Is Blank

1. Confirm that the router or switch is powered on and has finished booting.
2. Confirm that the cable is connected to the device's console port rather than a network port.
3. Check that the terminal application selected the correct COM port or USB serial device.
4. Verify the settings: 9600 bits per second, 8 data bits, no parity, 1 stop bit, and no flow control.
5. Press Enter several times to prompt a response.
6. Try another known-good cable, USB adapter, or terminal application if necessary.

IOS Command Modes

IOS separates commands into modes. Each mode has a different purpose and prompt. The prompt is an important safety clue: check it before entering a command.

User EXEC mode has a prompt ending in > and is intended for limited monitoring. Privileged EXEC mode has a prompt ending in # and allows more powerful operational commands. Global configuration mode changes the device-wide running configuration. A configuration submode is a narrower context entered from global configuration mode, such as interface, line, or router configuration mode.

The hierarchy normally follows this path:

Switch> enable
Switch# configure terminal
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# exit
Switch(config)# line vty 0 4
Switch(config-line)# end
Switch#

Entering, Leaving, and Navigating Modes

Switch> enable
Switch# disable
Switch>

Switch> enable
Switch# configure terminal
Switch(config)# exit
Switch#

Switch# configure terminal
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# exit
Switch(config)# end
Switch#

• enable moves from user EXEC to privileged EXEC. A password may be requested.
• disable returns from privileged EXEC to user EXEC.
• configure terminal enters global configuration mode from privileged EXEC.
• exit moves back one level. From a configuration submode, it returns to its parent mode.
• end or Ctrl+Z returns directly from any configuration mode to privileged EXEC mode.
• logout terminates the current user session. From EXEC mode, exit can also terminate a session when there is no configuration parent to return to.

CLI Help and Command Entry

IOS includes context-sensitive help. Enter a question mark to display commands or options valid at the current point. Help changes according to both the current mode and the text already entered.

Switch> ?
Switch> show ?
Switch> sh?
Switch> show ip ?

A partial command followed by ? displays valid completions without executing the command. For example, sh? may show commands beginning with those letters. Type enough characters to make an abbreviation unique.

• Tab: completes an unambiguous command or keyword where supported.
• Up Arrow or Ctrl+P: recalls an older command.
• Down Arrow or Ctrl+N: moves toward newer commands in the history.
• Question mark: displays context-sensitive commands, keywords, arguments, or value guidance.

Understanding IOS Syntax

Command syntax usually consists of required keywords, optional keywords or arguments, and values supplied by the administrator. Brackets or other notation in help output commonly indicate optional elements, while angle-bracket-style descriptions indicate a value that must be supplied. Read the actual help output for the installed IOS version rather than relying on a memorized syntax.

IOS commonly reports three command-entry problems:

• Invalid input detected: the command or keyword is not valid at that position, often because of a typo, wrong mode, or unsupported feature.
• Incomplete command: more required keywords or values are missing.
• Ambiguous command: the abbreviation matches multiple possible commands; type more characters.

Basic Verification Commands

show commands display operational information or configuration. They do not normally change the device. Most useful show commands are entered from privileged EXEC mode.

Switch> enable
Switch# show version
Switch# show ip interface brief
Switch# show users
Switch# show running-config

Use show ip interface brief to confirm management addressing and whether the relevant interface or switch virtual interface is up. Use show users to inspect active sessions. Use show running-config to confirm the current mode-related access settings, interface configuration, local users, and VTY configuration.

Running Configuration and Startup Configuration

The running configuration is the active configuration stored in RAM. Configuration changes normally take effect immediately in the running configuration. The startup configuration is the saved configuration read during device startup. It is traditionally stored in NVRAM, nonvolatile storage that retains data when power is removed.

Changing the running configuration does not automatically preserve it across a reload. Copy a known-good running configuration to startup configuration when the change has been tested:

Switch# copy running-config startup-config

On many IOS devices, write memory is an older alternative:

Switch# write memory

Check both configurations to find unsaved changes:

Switch# show running-config
Switch# show startup-config

If you reload or lose power before saving, changes that exist only in RAM can disappear. Always verify the saved configuration before reloading a lab or production device.

Example: Make, Compare, Save, and Verify

Switch# configure terminal
Switch(config)# hostname S1
S1(config)# end
S1# show running-config
S1# show startup-config
S1# copy running-config startup-config
S1# show startup-config

The hostname is a harmless lab change that makes the prompt easier to recognize. The exact save prompts vary by IOS release; accept the destination filename only when it is correct.

Secure Remote Access with SSH

SSH is an encrypted protocol for remote CLI access. Telnet is unsuitable for normal administrative access because it does not encrypt the session or credentials. Use SSH on authorized devices and restrict remote access according to organizational policy.

A typical IOS SSH setup requires:

• A reachable management IP address on a router interface or switch virtual interface, with the interface operational.
• A hostname.
• An IP domain name.
• A local user account and secret.
• RSA keys generated on the device.
• VTY lines configured for local authentication.
• VTY transport restricted to SSH.
• A client with IP reachability to the device and an SSH client capable of connecting to TCP port 22.

The following is an instructional example. Replace the hostname, domain, username, and secret with values approved for your lab or organization. The management IP configuration is platform-specific and must be completed separately.

Switch# configure terminal
Switch(config)# hostname S1
S1(config)# ip domain-name example.local
S1(config)# username admin privilege 15 secret <strong-secret>
S1(config)# crypto key generate rsa modulus 2048
S1(config)# ip ssh version 2
S1(config)# line vty 0 4
S1(config-line)# login local
S1(config-line)# transport input ssh
S1(config-line)# end
S1# copy running-config startup-config

Some IOS versions ask for the RSA key modulus interactively rather than accepting it entirely on the command line. Follow the prompt and use an appropriate key size supported by the platform.

Verifying SSH Access

1. Run show ip interface brief and confirm that the management address is correct and the interface is up.
2. From the client, test IP reachability to the device.
3. Confirm that SSH is enabled and that the VTY lines contain login local and transport input ssh.
4. Connect with an SSH client using the device management address and the configured local username.
5. After login, run show users on the device to confirm the active remote session.

ssh admin@192.0.2.10

The address above is an example documentation address. Use the actual reachable management address assigned to your authorized lab device.

Remote-Access Troubleshooting

SSH Cannot Connect

• Use show ip interface brief to check the management address and interface status.
• Test reachability from the client and check the route between the client and device.
• Verify that the hostname, domain name, local user, and RSA keys exist.
• Inspect the VTY configuration for login local and transport input ssh.
• Check whether an ACL or firewall blocks TCP port 22.

Telnet Works but SSH Does Not

This often means that VTY lines permit Telnet but have not been prepared for SSH. Check for missing RSA keys, incorrect VTY authentication, or incompatible client and device settings. After validating SSH access, restrict VTY transport to SSH rather than leaving Telnet enabled.

Safe IOS Practice

• Check the current prompt before entering a command. The same word can have different meaning or availability in different modes.
• Use abbreviated commands only when the abbreviation is unambiguous. Full commands are clearer in documentation and assessments.
• Use ? instead of guessing syntax, especially when working on a new IOS version or platform.
• Verify the device state before and after a configuration change.
• Save only known-good configurations, and compare running and startup configurations before reloading.
• Use authorized lab devices and follow organizational policies for credentials, remote access, and management networks.
• Do not expose passwords or private keys in screenshots, shared configurations, or training submissions.

Guided Practice: First Local Access

1. Connect a workstation to the switch or router console port.
2. Open a terminal emulator with 9600 8N1, no parity, one stop bit, and no flow control.
3. Press Enter and identify the user EXEC prompt ending in >.
4. Enter enable and identify the privileged EXEC prompt ending in #.
5. Run show version, show ip interface brief, and show interfaces.
6. Run show users to inspect the current session.

Guided Practice: Explore the Mode Hierarchy

1. Use ? in user EXEC mode and privileged EXEC mode. Notice that the available commands differ.
2. Enter show ? and then use a more specific form such as show ip ?.
3. Use Tab to complete an unambiguous command.
4. Enter global configuration mode with configure terminal.
5. Enter an interface submode and leave it with exit.
6. Enter a VTY line submode and return directly to privileged EXEC with end or Ctrl+Z.
7. Use the Up Arrow or Ctrl+P to recall a command, and Down Arrow or Ctrl+N to move forward through command history.

Guided Practice: Save and Verify a Change

1. In a lab device, enter global configuration mode and set a harmless hostname.
2. Return to privileged EXEC and inspect show running-config.
3. Inspect show startup-config and identify whether the change has been saved.
4. Copy the running configuration to startup configuration.
5. Run show startup-config again and verify the change.

Key Exam Notes

• A prompt ending in > is user EXEC; a prompt ending in # is privileged EXEC.
• enable enters privileged EXEC; configure terminal enters global configuration.
• exit moves back one level; end and Ctrl+Z return directly to privileged EXEC.
• Console access is local and out-of-band; Telnet and SSH are remote and in-band.
• SSH is preferred over Telnet because SSH encrypts the remote session.
• The running configuration is active in RAM; the startup configuration is used after boot.
• Copy running configuration to startup configuration to preserve changes across reloads.
• The question mark provides context-sensitive help, and command history can be recalled with arrow keys or Ctrl+P/Ctrl+N.