Press RETURN to get started!\n<\/code><\/pre>\nPressing Enter<\/strong> presents the initial User EXEC prompt (Router><\/code> or Switch><\/code>).<\/p>\n
\n<\/span>Navigating Cisco IOS Modes to Access Configuration<\/span><\/h2>\nCisco IOS relies on a hierarchical mode structure. Each mode grants access to a specific subset of commands, indicated by a unique prompt character. To apply any system-wide setting, you must navigate from the unprivileged monitoring mode to Global Configuration mode.<\/p>\n
User EXEC Mode (Router>) \n \u2502\n \u25bc [Command: enable]\nPrivileged EXEC Mode (Router#) \n \u2502\n \u25bc [Command: configure terminal]\nGlobal Configuration Mode (Router(config)#)\n \u2502\n \u25bc [Commands: interface ..., line ..., etc.]\nSub-Configuration Modes (Router(config-if)#, Router(config-line)#)\n<\/code><\/pre>\n<\/span>Step 1: User EXEC Mode (Router><\/code>)<\/span><\/h3>\nUpon pressing Enter at boot, you arrive at User EXEC mode<\/strong>. This level allows basic, non-disruptive inspection commands (such as ping<\/code>, traceroute<\/code>, and limited show<\/code> commands), but prohibits any operational or configuration changes.<\/p>\nTo escalate privileges, enter the enable<\/code> command:<\/p>\nRouter> enable\n<\/code><\/pre>\n(If an enable password or secret has already been established, IOS will prompt for authentication here; on a factory-default unit, press Enter.)<\/em><\/p>\n<\/span>Step 2: Privileged EXEC Mode (Router#<\/code>)<\/span><\/h3>\nYour prompt changes from a right angle bracket (><\/code>) to a hash mark (#<\/code>), signifying Privileged EXEC mode<\/strong> (also known as Enable mode). In this mode, you can view detailed hardware status, inspect the active configuration (show running-config<\/code>), reboot the device (reload<\/code>), and manage file storage. <\/p>\nHowever, you still cannot modify device parameters directly. To begin making configuration changes, execute:<\/p>\n
Router# configure terminal\n<\/code><\/pre>\n(Network engineers frequently abbreviate this command as conf t<\/code>.)<\/em><\/p>\n<\/span>Step 3: Global Configuration Mode (Router(config)#<\/code>)<\/span><\/h3>\nThe prompt appends (config)#<\/code>, confirming you are in Global Configuration mode<\/strong>. Commands entered at this prompt affect the device as a whole (such as the hostname, global security parameters, and routing services).<\/p>\n<\/span>Step 4: Accessing Sub-Configuration Modes<\/span><\/h3>\nFrom Global Configuration mode, specific subsystems are configured by entering dedicated sub-modes:
\n* Interface Configuration:<\/strong> Router(config)# interface gigabitethernet 0\/1<\/code> results in Router(config-if)#<\/code>
\n* Line Configuration (Console\/VTY):<\/strong> Router(config)# line console 0<\/code> results in Router(config-line)#<\/code>
\n* Routing Protocol Configuration:<\/strong> Router(config)# router ospf 1<\/code> results in Router(config-router)#<\/code><\/p>\nTo return one level backward in the hierarchy, type exit<\/code>. To exit all sub-modes immediately and return to Privileged EXEC mode (Router#<\/code>), type end<\/code> or press Ctrl+Z<\/code><\/strong>.<\/p>\n
\n<\/span>Baseline Device Configuration Checklist<\/span><\/h2>\nOnce Global Configuration mode is active, follow this standardized sequence of foundational tasks to establish administrative security, operational stability, and management connectivity.<\/p>\n
\n- Assign a Unique Hostname:<\/strong> Replace generic system prompts (
Router<\/code> or Switch<\/code>) with a standardized network identifier using hostname <NAME><\/code>. This prevents accidental configuration of the wrong device during multi-terminal operations.<\/li>\n- Disable Unintended DNS Lookups:<\/strong> By default, entering a mistyped command at the CLI causes IOS to broadcast a DNS lookup, freezing the terminal for up to several minutes. Enter
no ip domain-lookup<\/code> to disable this behavior.<\/li>\n- Protect Privileged EXEC Access:<\/strong> Secure Enable mode with strong, salted hashing rather than plain text. Apply
enable secret <PASSWORD><\/code>. Avoid the deprecated enable password<\/code> command.<\/li>\n- Encrypt Plaintext Passwords in Memory:<\/strong> Prevent shoulder-surfing and casual exposure of passwords in configuration files by executing
service password-encryption<\/code>. This applies Cisco Type 7 obfuscation across unencrypted lines.<\/li>\n- Secure the Physical Console Port:<\/strong> Restrict local terminal access by applying credentials, enforcing an inactivity timer, and preventing console messages from disrupting command entry:<\/li>\n
- Navigate to
line con 0<\/code>.<\/li>\n- Enable
logging synchronous<\/code> to keep syslog output from interrupting your typing.<\/li>\n- Apply
exec-timeout 10 0<\/code> to log out idle sessions after 10 minutes.<\/li>\n- Require local authentication via
login local<\/code>.<\/li>\n- Deploy Secure Shell (SSH) for Remote Administration:<\/strong> Disable legacy, unencrypted Telnet sessions in favor of SSH version 2:<\/li>\n
- Define an administrative domain name:
ip domain-name <DOMAIN><\/code>.<\/li>\n- Generate an asymmetric RSA key pair:
crypto key generate rsa modulus 2048<\/code>.<\/li>\n- Enforce modern protocol standards:
ip ssh version 2<\/code>.<\/li>\n- Under virtual terminal lines (
line vty 0 4<\/code>), mandate SSH transport using transport input ssh<\/code> and configure login local<\/code>.<\/li>\n- Create a Local Administrative Account:<\/strong> Configure a dedicated administrator user with full administrative privileges:
username <ADMIN_USER> privilege 15 secret <PASSWORD><\/code>.<\/li>\n- Configure Management Connectivity:<\/strong><\/li>\n
- For a Switch:<\/strong> Assign an IP address to the default management Switch Virtual Interface:
interface vlan 1<\/code>, followed by