<\/span><\/h2>\nBefore applying configuration parameters, you must understand how Cisco IOS organizes commands. Cisco IOS utilizes a contextual, hierarchical modal structure where commands are only valid within their specific mode. The terminal prompt alters its display to reflect your current privilege and configuration depth.<\/p>\n
+------------------------------------+\n | User EXEC Mode | Prompt: Router>\n +-----------------+------------------+\n | command: enable\n v\n +------------------------------------+\n | Privileged EXEC Mode | Prompt: Router#\n +-----------------+------------------+\n | command: configure terminal\n v\n +------------------------------------+\n | Global Configuration Mode | Prompt: Router(config)#\n +-------+--------------------+-------+\n | |\n interface gig0\/0\/0 | line vty 0 4\n v v\n+------------------------+ +----------------------+\n| Interface Config Mode | | Line Config Mode |\n| Prompt: | | Prompt: |\n| Router(config-if)# | | Router(config-line)# |\n+------------------------+ +----------------------+\n<\/code><\/pre>\n<\/span>1. User EXEC Mode (Router><\/code>)<\/span><\/h3>\nUpon establishing a console or terminal session, the router enters User EXEC mode, denoted by the ><\/code> prompt. This level offers restricted, read-only operational monitoring. You can run basic status commands (such as non-intrusive show<\/code> commands and ping<\/code>), but you cannot view sensitive system configurations, alter running parameters, or restart the router.<\/p>\n\n- Entry:<\/strong> Default mode upon initial connection.<\/li>\n
- Navigation Command:<\/strong> Type
enable<\/code> to advance to Privileged EXEC mode.<\/li>\n<\/ul>\n<\/span>2. Privileged EXEC Mode (Router#<\/code>)<\/span><\/h3>\nIdentified by the #<\/code> prompt, Privileged EXEC mode (often called Enable mode) grants full administrative visibility. In this mode, engineers run deep diagnostics, issue debugging routines, inspect full configuration files, manage the flash file system, reload the device, and save configurations.<\/p>\n\n- Entry:<\/strong> Execute
enable<\/code> at the Router><\/code> prompt (and supply the enable secret when prompted).<\/li>\n- Return Command:<\/strong> Type
disable<\/code> to drop back down to User EXEC mode.<\/li>\n<\/ul>\n<\/span>3. Global Configuration Mode (Router(config)#<\/code>)<\/span><\/h3>\nGlobal Configuration mode is where you apply parameters that affect the router as an entire system\u2014such as the device hostname, global routing engines, local user accounts, and security policies.<\/p>\n
\n- Entry:<\/strong> Execute
configure terminal<\/code> (or shorthand conf t<\/code>) from Privileged EXEC mode.<\/li>\n- Return Command:<\/strong> Type
exit<\/code> to step back to Privileged EXEC mode.<\/li>\n<\/ul>\n<\/span>4. Specific Configuration Sub-Modes<\/span><\/h3>\nFrom Global Configuration mode, entering commands target specific subsystems shifts the CLI into context-specific sub-modes:
\n* Interface Configuration (Router(config-if)#<\/code>):<\/strong> Used to assign IP addresses, define encapsulation, and adjust interface operational states (e.g., interface GigabitEthernet0\/0\/0<\/code>).
\n* Line Configuration (Router(config-line)#<\/code>):<\/strong> Used to configure access parameters on administrative ports such as the physical console, auxiliary ports, and virtual terminal (VTY) lines (e.g., line console 0<\/code> or line vty 0 4<\/code>).
\n* Routing Protocol Configuration (Router(config-router)#<\/code>):<\/strong> Used to define dynamic routing protocol parameters such as OSPF, BGP, or EIGRP (e.g., router ospf 1<\/code>).<\/p>\n<\/span>Essential CLI Navigation and Keystroke Shortcuts<\/span><\/h3>\n\nexit<\/code>: Navigates backward by one hierarchical level.<\/li>\nend<\/code> or Ctrl + Z<\/code>: Instantly breaks out of any sub-configuration mode directly to Privileged EXEC mode (Router#<\/code>).<\/li>\n?<\/code>: The context-sensitive help command. Typing ?<\/code> at any point displays available commands for that mode, or typing a partial command followed by ?<\/code> (e.g., show ip ?<\/code>) details the expected trailing parameters.<\/li>\nTab<\/code>: Automatically completes a partially typed, unambiguous command string.<\/li>\n<\/ul>\n
\n<\/span>Initial Device Provisioning: Hostname, Interfaces, and IP Addressing<\/span><\/h2>\nWith an understanding of the CLI hierarchy, you can establish physical connectivity and execute the baseline provisioning steps.<\/p>\n
<\/span>Step 1: Establish Console Connectivity<\/span><\/h3>\nConnect a rollover console cable (RJ-45 or micro-USB\/USB-C, depending on the hardware model) from your workstation to the port labeled CONSOLE<\/strong> on the Cisco chassis. Open a terminal emulator (such as PuTTY, SecureCRT, or Tera Term) and configure your serial connection settings to the standard Cisco default parameters:
\n* Baud Rate (Speed):<\/strong> 9600 bps
\n* Data Bits:<\/strong> 8
\n* Parity:<\/strong> None
\n* Stop Bits:<\/strong> 1
\n* Flow Control:<\/strong> None<\/p>\nPower on the router. When prompted with Would you like to enter the initial configuration dialog? [yes\/no]:<\/code>, type no<\/code> and press Enter<\/strong> to proceed directly to the manual CLI.<\/p>\n<\/span>Step 2: Configure the Device Hostname<\/span><\/h3>\nAssigning a distinct, standardized hostname makes the router easily identifiable across logs, administrative sessions, and network maps.<\/p>\n
Router> enable\nRouter# configure terminal\nRouter(config)# hostname Edge-R1\nEdge-R1(config)#\n<\/code><\/pre>\n<\/span>Step 3: Configure Interface IP Addresses<\/span><\/h3>\nA router links distinct broadcast domains. In a typical setup, at least two physical interfaces are provisioned:
\n1. An internal Local Area Network (LAN) gateway interface.
\n2. An external Wide Area Network (WAN) uplink interface connecting to the Internet Service Provider (ISP) or upstream router.<\/p>\n
Cisco router interfaces are administratively shut down by default upon unboxing. You must explicitly apply the no shutdown<\/code> command on each interface to turn its physical transceiver on.<\/p>\n! Configure the Local LAN Gateway Interface\nEdge-R1(config)# interface GigabitEthernet0\/0\/1\nEdge-R1(config-if)# description Internal_Office_LAN_Gateway\nEdge-R1(config-if)# ip address 192.168.10.1 255.255.255.0\nEdge-R1(config-if)# no shutdown\nEdge-R1(config-if)# exit\n\n! Configure the External WAN Uplink Interface\nEdge-R1(config)# interface GigabitEthernet0\/0\/0\nEdge-R1(config-if)# description Uplink_To_ISP_WAN\nEdge-R1(config-if)# ip address 203.0.113.2 255.255.255.252\nEdge-R1(config-if)# no shutdown\nEdge-R1(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 4: Verify Interface Status<\/span><\/h3>\nReturn to Privileged EXEC mode and verify that your physical interfaces have negotiated carrier detect and are functioning properly:<\/p>\n
Edge-R1# show ip interface brief\n<\/code><\/pre>\nLook for two key criteria in the command output:
\n* Status:<\/strong> Must display up<\/code> (indicating physical Layer 1 signaling is intact).
\n* Protocol:<\/strong> Must display up<\/code> (indicating Layer 2 framing and keepalives have been negotiated).<\/p>\nInterface IP-Address OK? Method Status Protocol\nGigabitEthernet0\/0\/0 203.0.113.2 YES manual up up \nGigabitEthernet0\/0\/1 192.168.10.1 YES manual up up \n<\/code><\/pre>\n<\/span>Step 5: Save the Running Configuration<\/span><\/h3>\nModifications made in Global Configuration mode reside solely in volatile RAM (the running-config<\/code>). If power is cycled, all changes will be lost unless committed to non-volatile RAM (NVRAM, the startup-config<\/code>):<\/p>\nEdge-R1# copy running-config startup-config\nDestination filename [startup-config]? [Enter]\nBuilding configuration...\n[OK]\n<\/code><\/pre>\n(Alternatively, you can run the shorthand write memory<\/code> or wr<\/code> command.)<\/em><\/p>\n
\n<\/span>Hardening Administrative Access and Configuring Secure Shell (SSH)<\/span><\/h2>\nBefore connecting a router to an upstream network or live uplink, administrative access channels must be secured. Telnet transmits authentication data and commands in plain text, making it vulnerable to interception. Modern production standards require disabling unencrypted remote access and enforcing SSHv2 with robust cryptographic keys.<\/p>\n
<\/span>Step 1: Secure Privileged EXEC Access<\/span><\/h3>\nSet an encrypted enable secret password. This safeguards access against unauthorized elevation to the #<\/code> prompt.<\/p>\nEdge-R1(config)# enable secret C1sc0$tr0ngSecr3t!\n<\/code><\/pre>\nNote: Always use enable secret<\/code> instead of the legacy enable password<\/code> command. enable secret<\/code> protects the string using strong salted cryptographic hashing algorithms, whereas enable password<\/code> relies on weaker reversible encodings.<\/em><\/p>\n<\/span>Step 2: Encrypt Cleartext Passwords in the Configuration File<\/span><\/h3>\nActivate the internal Cisco password encryption service to obfuscate local passwords that might otherwise display as cleartext when reading the active configuration:<\/p>\n
Edge-R1(config)# service password-encryption\n<\/code><\/pre>\n<\/span>Step 3: Secure Physical Console Access<\/span><\/h3>\nSecure the physical serial console port to prevent unauthorized terminal access if a rogue device is physically plugged into the router:<\/p>\n
Edge-R1(config)# line console 0\nEdge-R1(config-line)# exec-timeout 10 0\nEdge-R1(config-line)# logging synchronous\nEdge-R1(config-line)# login local\nEdge-R1(config-line)# exit\n<\/code><\/pre>\n\nexec-timeout 10 0<\/code>: Automatically disconnects idle sessions after 10 minutes and 0 seconds.<\/li>\nlogging synchronous<\/code>: Prevents incoming system syslog messages from interrupting or overwriting typed CLI input.<\/li>\nlogin local<\/code>: Instructs the console port to authenticate against the router’s local user database rather than an open prompt.<\/li>\n<\/ul>\n<\/span>Step 4: Configure Local Administrative Accounts and SSHv2<\/span><\/h3>\nGenerating an RSA key pair for SSH requires setting an active domain name and a distinct hostname (as set in the initial provisioning phase).<\/p>\n
\n- Define an IP Domain Name:<\/strong>
\ncisco
\nEdge-R1(config)# ip domain-name corporate.local<\/code><\/li>\n- Create a Local Administrator Account:<\/strong>
\nAssign full administrative rights (privilege level 15) and an encrypted secret:
\ncisco
\nEdge-R1(config)# username netadmin privilege 15 secret Admin$tr0ngP@ss2026!<\/code><\/li>\n- Generate RSA Cryptographic Keys:<\/strong>
\nUse a modulus of at least 2048 bits to comply with modern security baselines:
\ncisco
\nEdge-R1(config)# crypto key generate rsa modulus 2048<\/code><\/li>\n- Enforce SSH Version 2:<\/strong>
\nDisable legacy, vulnerable SSHv1 routines:
\ncisco
\nEdge-R1(config)# ip ssh version 2
\nEdge-R1(config)# ip ssh time-out 60
\nEdge-R1(config)# ip ssh authentication-retries 3<\/code><\/li>\n- Lock Down Virtual Terminal (VTY) Lines:<\/strong>
\nConfigure the virtual terminal lines (0 through 4) to require local authentication and exclusively accept SSH connections:
\ncisco
\nEdge-R1(config)# line vty 0 4
\nEdge-R1(config-line)# transport input ssh
\nEdge-R1(config-line)# login local
\nEdge-R1(config-line)# exec-timeout 10 0
\nEdge-R1(config-line)# logging synchronous
\nEdge-R1(config-line)# exit<\/code><\/li>\n<\/ol>\n
\n<\/span>Establishing End-to-End Connectivity: Routing, DHCP, and NAT Overload<\/span><\/h2>\nWith interfaces addressed and administrative paths hardened, the router must now handle packet forwarding: routing local traffic across the WAN uplink, automatically provisioning client devices on the LAN with network configurations via DHCP, and translating private IP blocks into routable public IP space using Network Address Translation (NAT).<\/p>\n
[ LAN Clients ]\n 192.168.10.0\/24\n |\n v\n +---------------------------------------------+\n | Cisco Router (Edge-R1) |\n | |\n | DHCP Pool: Hands out 192.168.10.x IPs |\n | NAT Inside: GigabitEthernet0\/0\/1 |\n | NAT Outside: GigabitEthernet0\/0\/0 |\n | NAT Rule: Overload onto 203.0.113.2 |\n | Default Route: 0.0.0.0\/0 -> 203.0.113.1 |\n +---------------------------------------------+\n |\n v Public IP: 203.0.113.2\n [ Upstream ISP Gateway (203.0.113.1) ]\n |\n v\n (( INTERNET ))\n<\/code><\/pre>\n<\/span>Step 1: Configure a Default Static Route<\/span><\/h3>\n