How Configure Cisco Router Step by Step

Configuring a Cisco router from a factory-default state into an operational enterprise gateway requires a systematic approach. Whether deploying an Integrated Services Router (ISR) in a branch office or provisioning a virtual routing appliance in a lab environment, the setup process follows an orderly progression: establishing console connectivity, navigating the Cisco IOS command hierarchy, configuring core interfaces, hardening device access, and deploying essential networking services like DHCP, default routing, and Network Address Translation (NAT).

This guide walks through every stage of configuring a Cisco router using the Cisco IOS command-line interface (CLI).

Cisco IOS CLI Navigation and Command Hierarchy

Before applying configuration parameters, you must understand how Cisco IOS organizes commands. Cisco IOS utilizes a contextual, hierarchical modal structure where commands are only valid within their specific mode. The terminal prompt alters its display to reflect your current privilege and configuration depth.

       +------------------------------------+
       |          User EXEC Mode            |  Prompt: Router>
       +-----------------+------------------+
                         |  command: enable
                         v
       +------------------------------------+
       |       Privileged EXEC Mode         |  Prompt: Router#
       +-----------------+------------------+
                         |  command: configure terminal
                         v
       +------------------------------------+
       |      Global Configuration Mode     |  Prompt: Router(config)#
       +-------+--------------------+-------+
               |                    |
  interface gig0/0/0                |  line vty 0 4
               v                    v
+------------------------+  +----------------------+
| Interface Config Mode  |  |   Line Config Mode   |
| Prompt:                |  | Prompt:              |
| Router(config-if)#     |  | Router(config-line)# |
+------------------------+  +----------------------+

1. User EXEC Mode (Router>)

Upon establishing a console or terminal session, the router enters User EXEC mode, denoted by the > prompt. This level offers restricted, read-only operational monitoring. You can run basic status commands (such as non-intrusive show commands and ping), but you cannot view sensitive system configurations, alter running parameters, or restart the router.

• Entry: Default mode upon initial connection.
• Navigation Command: Type enable to advance to Privileged EXEC mode.

2. Privileged EXEC Mode (Router#)

Identified by the # prompt, Privileged EXEC mode (often called Enable mode) grants full administrative visibility. In this mode, engineers run deep diagnostics, issue debugging routines, inspect full configuration files, manage the flash file system, reload the device, and save configurations.

• Entry: Execute enable at the Router> prompt (and supply the enable secret when prompted).
• Return Command: Type disable to drop back down to User EXEC mode.

3. Global Configuration Mode (Router(config)#)

Global Configuration mode is where you apply parameters that affect the router as an entire system—such as the device hostname, global routing engines, local user accounts, and security policies.

• Entry: Execute configure terminal (or shorthand conf t) from Privileged EXEC mode.
• Return Command: Type exit to step back to Privileged EXEC mode.

4. Specific Configuration Sub-Modes

From Global Configuration mode, entering commands target specific subsystems shifts the CLI into context-specific sub-modes:
* Interface Configuration (Router(config-if)#): Used to assign IP addresses, define encapsulation, and adjust interface operational states (e.g., interface GigabitEthernet0/0/0).
* Line Configuration (Router(config-line)#): Used to configure access parameters on administrative ports such as the physical console, auxiliary ports, and virtual terminal (VTY) lines (e.g., line console 0 or line vty 0 4).
* Routing Protocol Configuration (Router(config-router)#): Used to define dynamic routing protocol parameters such as OSPF, BGP, or EIGRP (e.g., router ospf 1).

Essential CLI Navigation and Keystroke Shortcuts

• exit: Navigates backward by one hierarchical level.
• end or Ctrl + Z: Instantly breaks out of any sub-configuration mode directly to Privileged EXEC mode (Router#).
• ?: The context-sensitive help command. Typing ? at any point displays available commands for that mode, or typing a partial command followed by ? (e.g., show ip ?) details the expected trailing parameters.
• Tab: Automatically completes a partially typed, unambiguous command string.

Initial Device Provisioning: Hostname, Interfaces, and IP Addressing

With an understanding of the CLI hierarchy, you can establish physical connectivity and execute the baseline provisioning steps.

Step 1: Establish Console Connectivity

Connect a rollover console cable (RJ-45 or micro-USB/USB-C, depending on the hardware model) from your workstation to the port labeled CONSOLE on the Cisco chassis. Open a terminal emulator (such as PuTTY, SecureCRT, or Tera Term) and configure your serial connection settings to the standard Cisco default parameters:
* Baud Rate (Speed): 9600 bps
* Data Bits: 8
* Parity: None
* Stop Bits: 1
* Flow Control: None

Power on the router. When prompted with Would you like to enter the initial configuration dialog? [yes/no]:, type no and press Enter to proceed directly to the manual CLI.

Step 2: Configure the Device Hostname

Assigning a distinct, standardized hostname makes the router easily identifiable across logs, administrative sessions, and network maps.

Router> enable
Router# configure terminal
Router(config)# hostname Edge-R1
Edge-R1(config)#

Step 3: Configure Interface IP Addresses

A router links distinct broadcast domains. In a typical setup, at least two physical interfaces are provisioned:
1. An internal Local Area Network (LAN) gateway interface.
2. An external Wide Area Network (WAN) uplink interface connecting to the Internet Service Provider (ISP) or upstream router.

Cisco router interfaces are administratively shut down by default upon unboxing. You must explicitly apply the no shutdown command on each interface to turn its physical transceiver on.

! Configure the Local LAN Gateway Interface
Edge-R1(config)# interface GigabitEthernet0/0/1
Edge-R1(config-if)# description Internal_Office_LAN_Gateway
Edge-R1(config-if)# ip address 192.168.10.1 255.255.255.0
Edge-R1(config-if)# no shutdown
Edge-R1(config-if)# exit

! Configure the External WAN Uplink Interface
Edge-R1(config)# interface GigabitEthernet0/0/0
Edge-R1(config-if)# description Uplink_To_ISP_WAN
Edge-R1(config-if)# ip address 203.0.113.2 255.255.255.252
Edge-R1(config-if)# no shutdown
Edge-R1(config-if)# exit

Step 4: Verify Interface Status

Return to Privileged EXEC mode and verify that your physical interfaces have negotiated carrier detect and are functioning properly:

Edge-R1# show ip interface brief

Look for two key criteria in the command output:
* Status: Must display up (indicating physical Layer 1 signaling is intact).
* Protocol: Must display up (indicating Layer 2 framing and keepalives have been negotiated).

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   203.0.113.2     YES manual up                    up      
GigabitEthernet0/0/1   192.168.10.1    YES manual up                    up      

Step 5: Save the Running Configuration

Modifications made in Global Configuration mode reside solely in volatile RAM (the running-config). If power is cycled, all changes will be lost unless committed to non-volatile RAM (NVRAM, the startup-config):

Edge-R1# copy running-config startup-config
Destination filename [startup-config]? [Enter]
Building configuration...
[OK]

(Alternatively, you can run the shorthand write memory or wr command.)

Hardening Administrative Access and Configuring Secure Shell (SSH)

Before connecting a router to an upstream network or live uplink, administrative access channels must be secured. Telnet transmits authentication data and commands in plain text, making it vulnerable to interception. Modern production standards require disabling unencrypted remote access and enforcing SSHv2 with robust cryptographic keys.

Step 1: Secure Privileged EXEC Access

Set an encrypted enable secret password. This safeguards access against unauthorized elevation to the # prompt.

Edge-R1(config)# enable secret C1sc0$tr0ngSecr3t!

Note: Always use enable secret instead of the legacy enable password command. enable secret protects the string using strong salted cryptographic hashing algorithms, whereas enable password relies on weaker reversible encodings.

Step 2: Encrypt Cleartext Passwords in the Configuration File

Activate the internal Cisco password encryption service to obfuscate local passwords that might otherwise display as cleartext when reading the active configuration:

Edge-R1(config)# service password-encryption

Step 3: Secure Physical Console Access

Secure the physical serial console port to prevent unauthorized terminal access if a rogue device is physically plugged into the router:

Edge-R1(config)# line console 0
Edge-R1(config-line)# exec-timeout 10 0
Edge-R1(config-line)# logging synchronous
Edge-R1(config-line)# login local
Edge-R1(config-line)# exit

• exec-timeout 10 0: Automatically disconnects idle sessions after 10 minutes and 0 seconds.
• logging synchronous: Prevents incoming system syslog messages from interrupting or overwriting typed CLI input.
• login local: Instructs the console port to authenticate against the router’s local user database rather than an open prompt.

Step 4: Configure Local Administrative Accounts and SSHv2

Generating an RSA key pair for SSH requires setting an active domain name and a distinct hostname (as set in the initial provisioning phase).

1. Define an IP Domain Name:
   cisco
Edge-R1(config)# ip domain-name corporate.local
2. Create a Local Administrator Account:
   Assign full administrative rights (privilege level 15) and an encrypted secret:
   cisco
Edge-R1(config)# username netadmin privilege 15 secret Admin$tr0ngP@ss2026!
3. Generate RSA Cryptographic Keys:
   Use a modulus of at least 2048 bits to comply with modern security baselines:
   cisco
Edge-R1(config)# crypto key generate rsa modulus 2048
4. Enforce SSH Version 2:
   Disable legacy, vulnerable SSHv1 routines:
   cisco
Edge-R1(config)# ip ssh version 2
Edge-R1(config)# ip ssh time-out 60
Edge-R1(config)# ip ssh authentication-retries 3
5. Lock Down Virtual Terminal (VTY) Lines:
   Configure the virtual terminal lines (0 through 4) to require local authentication and exclusively accept SSH connections:
   cisco
Edge-R1(config)# line vty 0 4
Edge-R1(config-line)# transport input ssh
Edge-R1(config-line)# login local
Edge-R1(config-line)# exec-timeout 10 0
Edge-R1(config-line)# logging synchronous
Edge-R1(config-line)# exit

Establishing End-to-End Connectivity: Routing, DHCP, and NAT Overload

With interfaces addressed and administrative paths hardened, the router must now handle packet forwarding: routing local traffic across the WAN uplink, automatically provisioning client devices on the LAN with network configurations via DHCP, and translating private IP blocks into routable public IP space using Network Address Translation (NAT).

   [ LAN Clients ]
   192.168.10.0/24
          |
          v
   +---------------------------------------------+
   | Cisco Router (Edge-R1)                      |
   |                                             |
   |  DHCP Pool: Hands out 192.168.10.x IPs      |
   |  NAT Inside: GigabitEthernet0/0/1           |
   |  NAT Outside: GigabitEthernet0/0/0          |
   |  NAT Rule: Overload onto 203.0.113.2        |
   |  Default Route: 0.0.0.0/0 -> 203.0.113.1    |
   +---------------------------------------------+
          |
          v  Public IP: 203.0.113.2
   [ Upstream ISP Gateway (203.0.113.1) ]
          |
          v
     (( INTERNET ))

Step 1: Configure a Default Static Route

A default static route serves as the router’s “gateway of last resort.” Any packet whose destination IP address does not explicitly match a specific entry in the internal routing table will be forwarded to the upstream ISP gateway address:

Edge-R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

• Syntax breakdown: ip route [destination_network] [subnet_mask] [next_hop_ip]. Using 0.0.0.0 0.0.0.0 matches all destination networks.

Step 2: Configure the Cisco IOS DHCP Server

Configuring the router as the local DHCP server allows LAN clients (workstations, printers, access points) to automatically acquire IP addresses, default gateway assignments, and DNS servers upon joining the network.

1. Exclude Static Addresses:
   Reserve specific address ranges (for gateways, printers, static servers) so the DHCP engine will not allocate them to dynamic hosts:
   cisco
Edge-R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.20
2. Define the DHCP Pool Parameters:
   cisco
Edge-R1(config)# ip dhcp pool LAN_CLIENTS
Edge-R1(dhcp-config)# network 192.168.10.0 255.255.255.0
Edge-R1(dhcp-config)# default-router 192.168.10.1
Edge-R1(dhcp-config)# dns-server 1.1.1.1 8.8.8.8
Edge-R1(dhcp-config)# domain-name corporate.local
Edge-R1(dhcp-config)# lease 1 0 0
Edge-R1(dhcp-config)# exit
   (The lease 1 0 0 command sets lease duration to 1 day, 0 hours, 0 minutes).

Step 3: Configure Network Address Translation (NAT Overload / PAT)

Internal workstations utilize private, non-routable RFC 1918 addresses (192.168.10.0/24). Because private subnets cannot be routed across the public Internet, you must configure Port Address Translation (PAT)—referred to as “NAT Overload” in Cisco IOS—to map multiple private IPs to the single public IP assigned to your WAN interface.

1. Designate NAT Roles on Physical Interfaces:
   Tell the router which interface connects to the private network and which connects to the untrusted public Internet:
   “`cisco
   Edge-R1(config)# interface GigabitEthernet0/0/1
   Edge-R1(config-if)# ip nat inside
   Edge-R1(config-if)# exit

Edge-R1(config)# interface GigabitEthernet0/0/0
Edge-R1(config-if)# ip nat outside
Edge-R1(config-if)# exit
“`

1. Define an Access Control List (ACL) Matching Inside Traffic:
   Create a standard Access Control List that permits the local LAN subnet to undergo translation:
   cisco
Edge-R1(config)# ip access-list standard NAT_PERMIT_LAN
Edge-R1(config-std-nacl)# permit 192.168.10.0 0.0.0.255
Edge-R1(config-std-nacl)# exit
   (Note: Standard ACLs use wildcard masks rather than subnet masks. 0.0.0.255 is the inverse of 255.255.255.0).
2. Bind the ACL to the WAN Interface with the Overload Keyword:
   Link the ACL to your external WAN interface and append the overload keyword:
   cisco
Edge-R1(config)# ip nat inside source list NAT_PERMIT_LAN interface GigabitEthernet0/0/0 overload

Step 4: Verify Routing and Address Translation

Confirm full operational connectivity from Privileged EXEC mode using the following verification suite:

• Verify the Routing Table:
  cisco
Edge-R1# show ip route
  Ensure a line beginning with S* 0.0.0.0/0 [1/0] via 203.0.113.1 is present in the table. The * indicates a candidate default route.
• Verify DHCP Leases Handed Out:
  cisco
Edge-R1# show ip dhcp binding
  Confirms that connected endpoints are successfully requesting and leasing IP addresses from the pool.
• Verify Active NAT Translations:
  Generate traffic from an internal workstation toward an external target (e.g., pinging a public DNS IP like 1.1.1.1), then inspect the router’s active state table:
  cisco
Edge-R1# show ip nat translations
  The output will display active translations showing the Inside global, Inside local, Outside local, and Outside global IP and port mappings.

Ready-to-Deploy Cisco IOS Starter Configuration Template

The following production-ready baseline configuration template integrates all security, addressing, routing, and translation steps covered above. Modify the variable values inside the angled brackets (< >) to match your network addressing requirements, then copy and paste directly into the terminal while in Global Configuration mode.

! ================================================================
! CISCO IOS BASELINE STARTER CONFIGURATION SCRIPT
! ================================================================

! --- System Identification & Password Hardening ---
hostname <ROUTER_HOSTNAME>
ip domain-name <DOMAIN_NAME>
service password-encryption
enable secret <STRONG_ENABLE_SECRET>

! --- Local Administrative User ---
username <ADMIN_USER> privilege 15 secret <ADMIN_PASSWORD>

! --- Management Line Hardening ---
line console 0
 exec-timeout 10 0
 logging synchronous
 login local
exit

line vty 0 4
 transport input ssh
 login local
 exec-timeout 10 0
 logging synchronous
exit

! --- SSHv2 Cryptographic Keys ---
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3

! --- LAN Interface Setup ---
interface <LAN_INTERFACE>
 description Core_Internal_LAN
 ip address <LAN_IP> <LAN_SUBNET_MASK>
 ip nat inside
 no shutdown
exit

! --- WAN Interface Setup ---
interface <WAN_INTERFACE>
 description External_ISP_Uplink
 ip address <WAN_PUBLIC_IP> <WAN_SUBNET_MASK>
 ip nat outside
 no shutdown
exit

! --- Default Route to ISP Gateway ---
ip route 0.0.0.0 0.0.0.0 <ISP_GATEWAY_IP>

! --- Local DHCP Server Configuration ---
ip dhcp excluded-address <DHCP_EXCLUDE_START> <DHCP_EXCLUDE_END>
ip dhcp pool PRIMARY_LAN_POOL
 network <LAN_NETWORK_ID> <LAN_SUBNET_MASK>
 default-router <LAN_IP>
 dns-server <PRIMARY_DNS> <SECONDARY_DNS>
 domain-name <DOMAIN_NAME>
 lease 1
exit

! --- Dynamic NAT Overload (PAT) ---
ip access-list standard NAT_ACL
 permit <LAN_NETWORK_ID> <LAN_WILDCARD_MASK>
exit

ip nat inside source list NAT_ACL interface <WAN_INTERFACE> overload

! --- Save to Startup NVRAM ---
do copy running-config startup-config

Authoritative Cisco IOS Documentation and Verification Directory

When planning deployments or verifying platform-specific syntax variations, consult official Cisco technical documentation. Syntax variations frequently occur between traditional Cisco IOS releases and modern Cisco IOS XE architectures (found on Catalyst 8000 and ISR 4000/1000 Series platforms).

Authoritative Documentation Portals

Configuration Validation Reference Standards

To ensure deployment compliance with official Cisco design guides, verify your configurations against the following foundational engineering documents:
* Cisco Validated Designs (CVD) for Enterprise Networks: Provides end-to-end architectural blueprinted deployments for enterprise edge and branch environments.
* Cisco Guide to Harden Cisco IOS Devices: The definitive reference for control plane policing, line access restriction, secure logging implementations, and management plane protection.

Building a reliable Cisco router configuration requires methodically layering core networking functions onto a well-secured base system. By understanding the command-line interface hierarchy, properly structuring interface assignments, enforcing strict SSHv2 cryptographic controls, and provisioning NAT and DHCP services, you establish a resilient, secure network edge capable of supporting modern enterprise operations. Commit all active configurations to NVRAM upon completion, verify translations and routing states through the built-in diagnostic tools, and maintain documented configuration backups across all production equipment.

Please follow and like us: