Cisco IOS Device Management

Mental model

A Cisco device runs IOS, which exposes a command-line interface. You connect to that CLI through one of several access methods, navigate through a hierarchy of command modes, and either inspect (with show commands) or configure (with everything else).

Every Cisco engineer’s day-1 muscle memory:

R1>           ← user EXEC (show some things, ping, traceroute)
R1> enable    ← move up to privileged EXEC
R1#           ← privileged EXEC (all show commands, debug, reload)
R1# configure terminal
R1(config)#   ← global config (change device settings)
R1(config)# interface GigabitEthernet0/0
R1(config-if)#   ← interface config (change one interface)

exit moves you back one level. end jumps all the way to privileged EXEC. Ctrl+Z is the keyboard shortcut for end.

The three ways in

Method	Used for	Encryption
Console	First setup, password recovery, troubleshooting when network is down	None (physical cable)
SSH (VTY)	Daily remote management	TLS, port 22
AUX / OOB management	Out-of-band backup access (over a separate management network or modem)	Varies
Telnet (VTY)	DON’T USE — port 23, unencrypted	None

Always disable Telnet, always enable SSH. Telnet sends passwords in plain text — any attacker on the path can read them. There’s zero reason to allow it in 2026.

Configuring SSH and disabling Telnet

R1(config)# hostname R1
R1(config)# ip domain-name corp.local                ! required for crypto key gen
R1(config)# crypto key generate rsa modulus 2048     ! generate SSH keys

! Configure VTY lines (remote access)
R1(config)# line vty 0 15
R1(config-line)# transport input ssh                 ! only SSH allowed
R1(config-line)# login local                         ! use local username database
R1(config-line)# exec-timeout 10 0                   ! kick idle sessions after 10 min

! Create a local user
R1(config)# username admin privilege 15 secret strong-password

! Console line — set a password
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# logging synchronous                 ! stop log msgs interrupting your typing
R1(config-line)# exec-timeout 0 0                    ! console doesn't time out (debatable)

Critical: the secret keyword stores a hashed password. The older password keyword stores it in plaintext (or weakly reversible Type 7). Always secret, never password.

Password types — know your hash

Cisco IOS supports several password storage formats:

Type	What it is	Use?
Type 0	Plaintext	Never
Type 7	Weakly reversible	Never — decoded in seconds
Type 5	MD5 hash	Acceptable, weak by modern standards
Type 8	PBKDF2-SHA256	Good
Type 9	scrypt	Best — use this for new configs

! Type 9 (scrypt) — modern, strong
R1(config)# username admin algorithm-type scrypt secret strong-password

! Enable password encryption for all stored passwords
R1(config)# service password-encryption

service password-encryption upgrades any remaining Type 0 to Type 7 (still weak, but at least not plaintext). It doesn’t downgrade stronger hashes.

Saving and reloading

R1# copy running-config startup-config        ! save the current config
R1# wr                                          ! shortcut for the same
R1# show running-config                         ! what's running now
R1# show startup-config                         ! what will load on next reload
R1# reload                                      ! reboot

Forgetting to save is the #1 mistake of new engineers. Make config changes → forget to save → device reloads (planned or panic) → all your changes gone. Always end a config session with wr.

Banners

A banner shows on login. Two types you’ll meet:

R1(config)# banner motd #
Enter TEXT message. End with the character '#'.
WARNING: Authorized access only. Activity is logged.
#

R1(config)# banner login #
Welcome to corporate router R1.
#

motd (message of the day) appears before login. login appears after authentication. Use motd for legal warnings — courts have ruled this matters for prosecuting unauthorized access.

The four “show” commands you’ll run constantly

R1# show running-config                ! the live config
R1# show ip interface brief            ! one-line summary of every interface
R1# show version                        ! IOS version, uptime, model, serial
R1# show running-config | section interface  ! filter to interface configs

| pipes the output through filters. | include X, | begin X, | section X, | exclude X — all useful. CCNA loves to test the difference between include (lines containing) and section (whole subsection starting with).

Common mistakes

1. Leaving Telnet enabled. transport input ssh on every VTY line, every device.

2. service password-encryption and thinking it’s secure. It uses weak Type 7 — decoded with online tools in seconds. Use stronger algorithms for important secrets (Type 8 or 9).

3. No console password. A physical attacker can connect to the console port and get unrestricted access. Always set a console password.

4. exec-timeout 0 0 on VTY lines. Means idle sessions never time out. A walked-away admin’s session is a permanent open door. Set 10 min or less for VTY.

5. Forgetting copy running startup. The single most common reason for “my config disappeared after reboot.”

6. Putting the enable password instead of enable secret. The old enable password stores Type 7. enable secret stores Type 5/8/9. Always secret.

7. Using the same enable secret across every device. If one device is compromised, the secret is reused everywhere. Use TACACS+/RADIUS (centralized AAA) so each user has unique credentials.

8. Disabling DNS-lookup on console without realizing why. no ip domain-lookup is a common config item — without it, mistyping a command makes the router try to DNS-resolve it as a hostname, timing out for ~30 seconds. Most engineers add this on every device.

Lab to try tonight

1. Console into a fresh Cisco router (CML, Packet Tracer, or real device).
2. Set hostname, enable secret (Type 9), and a console password.
3. Configure SSH: generate RSA key 2048, create a local user, enable SSH on VTY lines, disable Telnet.
4. From another device, SSH in. Verify Telnet fails.
5. Configure a motd banner with a legal warning.
6. Make some config changes. Run show running-config then show startup-config — note they differ.
7. wr. Re-run both — they now match.
8. Reload. Verify your changes survived.
9. Bonus: configure AAA pointing at a RADIUS / TACACS+ server (see AAA topic).

Cheat strip

Concept	Plain English
Modes	user (R1>) → priv (R1#) → config (R1(config)#)
Console	Physical cable. Day-1 setup, password recovery.
SSH / VTY	Daily remote access. Port 22, encrypted.
Telnet	Never use. Plaintext.
enable secret	Privileged password. Hashed.
secret (in username)	Hashed user password. Always this, never password.
Type 9	scrypt — best password hash
service password-encryption	Type 0 → 7. Weak but better than nothing.
copy run start	Save config. Survive reboot.
exit / end / Ctrl+Z	Back one level / all the way out
wr	Shortcut for copy run start